Exhibit 7 - Information Security & Privacy Requirements Exhibit Summary

This document is an Information Security & Privacy Requirements Exhibit for the State of California's software renewal contract for Zscaler. The exhibit establishes comprehensive security and privacy standards that the vendor must comply with throughout the contract term. The requirements address data protection, access controls, encryption, incident response, audit capabilities, and compliance with applicable federal and state privacy laws and regulations. The exhibit serves as a binding attachment to the procurement agreement, establishing mandatory technical and operational security controls that the Zscaler solution and associated services must meet or exceed.

The exhibit outlines specific security requirements including data encryption standards, authentication mechanisms, system monitoring and logging capabilities, and vendor accountability for maintaining security postures consistent with industry best practices and regulatory requirements. Zscaler must demonstrate compliance with these requirements during implementation and maintain ongoing compliance throughout the contract period. The requirements align with California's information security governance frameworks and applicable federal standards, including protections for sensitive state data. The vendor is required to provide documentation, audit reports, and compliance certifications as evidence of adherence to these security and privacy standards, with regular assessment and verification mechanisms incorporated into the contract administration process.