EXHIBIT 7 - INFORMATION SECURITY & PRIVACY REQUIREMENTS.pdf

This is an Information Security & Privacy Requirements exhibit for a California state software renewal contract for Red Hat products. The document establishes the comprehensive security and privacy standards that the contractor must implement and maintain throughout the contract term. The requirements cover multiple domains including data protection, access controls, encryption standards, audit logging, incident response procedures, and compliance with applicable federal and state privacy regulations. The contractor is required to implement security measures that protect all information systems, data, and communications from unauthorized access, modification, or disclosure while maintaining the confidentiality, integrity, and availability of information processed or stored on behalf of the state.

The exhibit mandates that contractors comply with current industry standards and best practices for information security, including requirements for employee training, background checks, and security clearances as applicable. Contractors must establish and maintain documented security policies, conduct regular risk assessments, perform vulnerability testing, and implement corrective actions for identified deficiencies. The requirements include provisions for third-party audits, security incident notification timelines, data breach reporting obligations, and remediation procedures. Additionally, contractors must comply with privacy laws governing the handling of personal information, maintain records of all security-related activities, and provide the state with regular compliance reports and documentation to verify adherence to these security and privacy standards throughout the contract period.