Exhibit 7 - Information Security & Privacy Requirements.pdf

This is an Information Security & Privacy Requirements exhibit for a California state and local network security renewal contract involving Okta brand identity management services. The document outlines the security and privacy standards that the contractor must implement and maintain throughout the contract term. Key requirements include compliance with applicable federal and state information security regulations, implementation of security controls aligned with NIST frameworks, and adherence to data protection standards. The contractor must demonstrate capability to protect sensitive state data, maintain system availability and integrity, and implement encryption protocols for data in transit and at rest. Additionally, the contractor is required to conduct regular security assessments, maintain audit logs, implement access controls, and provide incident response capabilities. The contract specifies that the contractor must comply with California privacy laws and federal requirements such as HIPAA where applicable, and maintain documentation of security compliance measures throughout the contract performance period.

The exhibit establishes baseline security posture requirements and ongoing compliance obligations that serve as prerequisites for contract performance. The contractor must implement multi-factor authentication, maintain segregation of duties, and establish security incident response procedures with defined notification timelines. Privacy requirements include data minimization principles, restrictions on data sharing, and implementation of privacy impact assessments. The contractor is obligated to maintain current security certifications and participate in regular security audits conducted by state representatives or third-party assessors. Additionally, the contractor must provide security training for personnel with access to state systems and maintain cybersecurity insurance coverage. Any security incidents or breaches must be reported immediately to designated state contacts, with the contractor bearing responsibility for notification and remediation costs. These requirements serve as mandatory compliance standards that supersede standard commercial practices and are non-negotiable elements of the contract award and performance.