Exhibit 7 - Information Security & Privacy Requirements.pdf

This is an Information Security & Privacy Requirements exhibit for a California state and local contract opportunity for Okta brand identity management software-as-a-service (SaaS). The exhibit establishes the comprehensive security and privacy standards that the service provider must maintain throughout the contract term. The requirements address data protection protocols, access controls, encryption standards, audit capabilities, and compliance frameworks necessary to safeguard sensitive state information handled through the identity management system. These requirements are designed to ensure the contractor meets federal and state security benchmarks while managing user identities and access across state systems.

The exhibit defines specific technical and operational security measures that the Okta SaaS platform must support, including encryption both in transit and at rest, role-based access controls, multi-factor authentication capabilities, audit logging and monitoring, incident response procedures, and regular security assessments. Privacy requirements include data minimization practices, retention and disposal protocols, and compliance with applicable regulations such as the California Consumer Privacy Act (CCPA) and federal standards. The contractor must demonstrate compliance through certifications, attestations, and periodic security assessments, with provisions for breach notification and remediation. These security and privacy requirements are fundamental to the contract's execution and represent non-negotiable conditions for the state's acceptance of the SaaS solution.