Exhibit 7 - Information Security & Privacy Requirements.pdf

This document is an Information Security & Privacy Requirements exhibit for a California state and local cloud software renewal contract for Rubrik. The exhibit establishes comprehensive security and privacy standards that must be met by the vendor providing cloud-based backup and data management services. The requirements encompass multiple security domains including access controls, encryption, audit logging, vulnerability management, incident response, business continuity, disaster recovery, and compliance with applicable regulations. The vendor must demonstrate compliance with industry standards such as SOC 2 Type II, ISO 27001, and relevant data protection regulations including California Consumer Privacy Act (CCPA) requirements. The contract requires the vendor to maintain continuous monitoring, regular security assessments, and third-party audits to verify adherence to these security and privacy standards throughout the contract term.

The requirements mandate specific technical controls such as encryption of data in transit and at rest, multi-factor authentication, role-based access controls, and comprehensive audit trails for all system activities. The vendor must establish and maintain incident response procedures with defined notification timelines, typically requiring notification of security breaches within specified timeframes to the state agency. The exhibit also requires the vendor to implement data residency controls ensuring that customer data remains within specified geographic boundaries and to provide detailed documentation of security certifications, penetration testing results, and privacy impact assessments. Additionally, the vendor must comply with state and federal data protection obligations, maintain business continuity and disaster recovery plans with defined recovery time objectives and recovery point objectives, and submit to periodic security reviews and audits as determined by the state agency. These requirements ensure that Rubrik's cloud services meet stringent security and privacy standards necessary for protecting sensitive state government information.