Exhibit 7 - Information Security & Privacy Requirements.pdf

Exhibit 7 - Information Security & Privacy Requirements is a supporting document for the State of California's Splunk software maintenance and annual renewal procurement (RFB IS-26200844). This exhibit establishes the mandatory security and privacy controls that the selected contractor must implement and maintain throughout the contract term. The document outlines comprehensive information security and privacy obligations aligned with federal and state regulations, including requirements for data protection standards, encryption protocols, access controls, audit logging capabilities, incident response procedures, and regular security assessments. The contractor must designate personnel with appropriate security clearances, implement background check requirements for staff accessing sensitive systems or data, and establish mandatory staff training programs addressing information security and privacy obligations. Additionally, the contractor is required to protect all confidential information and state intellectual property, cooperate fully with state audit activities, and provide immediate notification to the state of any security breaches or unauthorized access incidents.

The security requirements detailed in this exhibit serve as evaluation criteria for bidder responsiveness and are binding upon contract award. Contractors must demonstrate the capability to comply with all specified information security and privacy controls as a condition of contract performance. The exhibit functions as a critical component of the overall procurement documentation, establishing the technical and operational standards necessary to safeguard the state's Splunk infrastructure and associated sensitive data throughout the contract renewal period. Failure to meet these security and privacy requirements may result in contract non-compliance and potential remedial action by the state.