EXHIBIT A_SECURITY AND PRIVACY REQUIREMENTS EXHIBIT.pdf

This document is a Security and Privacy Requirements Exhibit for California's Tableau Renewal (Brand Only) contract opportunity. The exhibit establishes comprehensive security and privacy standards that the vendor must implement and maintain throughout the contract term. The requirements cover data protection, access controls, encryption protocols, incident response procedures, and compliance with applicable state and federal privacy laws. The vendor is required to implement technical and administrative safeguards to protect sensitive information, maintain audit logs, and provide regular security assessments. The exhibit specifies that all systems must comply with California's data privacy regulations and establish clear procedures for handling potential security breaches, including notification timelines and remediation protocols.

The document outlines mandatory security certifications, training requirements for vendor personnel, and detailed specifications for system architecture and data handling procedures. The vendor must obtain prior approval before implementing any changes to security controls or data processing methods and is responsible for maintaining compliance throughout the contract period. Regular security audits and vulnerability assessments are required, with results to be provided to the state. The exhibit establishes liability provisions for security failures and requires the vendor to maintain appropriate insurance coverage. Specific provisions address requirements for subcontractors and third-party service providers who must meet equivalent security standards.