Exhibit_E_PERA_DataSecurity_Confidentiality.pdf

PERA Data Security and Confidentiality Agreement

Secure Protection and Handling of Data Network Security. To the extent applicable to Vendor’s performance under the Agreement to perform services, Vendor agrees at all times to maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third party penetration testing. Vendor further agrees to:

a. Data Security: Vendor agrees to protect and maintain the security of any PERA data in accordance with industry standards and with protection that is at least as good as or better than that maintained by PERA.

These security measures include maintaining secure environments that are patched and up-to-date with all appropriate security updates no less than the standards set forth in NIST Cybersecurity Framework and NIST SP800 series publications (see https://www.nist.gov/cyberframework/framework and https://csrc.nist.gov/publications/sp800);

b. Data Transmission: Vendor agrees that any and all transmission or exchange of system application data with PERA and/or any other parties expressly designated by PERA, shall take place via secure means, e.g., HTTPS or SFTP;

c. Data Storage: Vendor agrees that any and all PERA data will be stored, processed, and maintained solely on designated target servers and that no PERA data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless medium is in part of the Vendor’s designated backup and recovery process;

d. Domain Encryption: Vendor agrees that any websites hosted by Vendor on behalf of PERA shall be on an encrypted domain using HTTPS;

e. Data Encryption: Vendor agrees to store any PERA backup data as part of its designated backup and recovery process in encrypted form, using no less than the standards set forth in NIST 800 and Federal Information Processing Standards (FIPS).

f. Password Protection: Vendor agrees that any portable or laptop computer that resides at any PERA facility, has access to a PERA network, or stores any non-public PERA data is equipped with strong and secure password protection in compliance with NIST SP 800-63.

g. Data Re-Use: Vendor agrees that any and all data exchanged shall be used expressly and solely for the purpose enumerated in the Agreement. Data shall not be distributed, repurposed or shaped across other applications, environments, or business units of Vendor. Vendor further agrees that no PERA data of any kind shall be transmitted, exchanged or otherwise passed to other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by PERA;

h. Data Return or Destruction: Vendor agrees that, upon completion, termination, or cancellation of the Agreement, all PERA data shall be remitted, in a mutually agreeable format and media, to PERA. The foregoing sentence does not apply if PERA's Chief Financial Officer or delegate authorizes in writing Vendor to erase, destroy, and render unreadable the data in a manner consistent with NIST standards found in NIST SP 800-88 and Vendor certifies in writing that these actions have been completed within thirty (30) days of the termination of the Agreement or within seven (7) days of the request of an agent of PERA, whichever shall come first.

Vendor further agrees, in the case of one time use of digital data, to erase, destroy, and render unreadable the data in a manner consistent with NIST standards found in NIST SP 800-88 and Vendor certifies in writing that these actions have been completed within thirty (30) days of the termination of the Agreement or within seven (7) days of the request of an agent of PERA, whichever shall come first.

https://www.nist.gov/cyberframework/framework https://csrc.nist.gov/publications/sp800

i. Notification and Data Breaches. Vendor agrees to comply with all applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification in accordance there with. In the event of a data breach of any Vendor’s security obligations or other event requiring notification under applicable law (a “Notification Event”), Vendor agrees to assume responsibility for informing all such individual in accordance with applicable laws and to indemnify, hold harmless, and defend PERA against any claims, damages, or other harm related to such Notification Event.

j. Requirement to comply and clarify. Vendor agrees to resolve any questions about compliance with the above listed requirements with the PERA Chief Financial Officer prior to signing the PERA Data Security and Confidentiality Agreement and prior to receiving or sending any data.

The protective requirements contained in this document are to survive the termination of the Agreement or any other agreement with the vendor. Non-compliance with the PERA Data Security and Confidentiality Agreement may result in suspension of services, termination, termination of contacts, civil and/or criminal prosecution.

By signing the PERA Data Security and Confidentiality Agreement you agree to the following:

I have read the PERA Data and Security Confidentiality Agreement. I fully understand the terms of this agreement and have authority to sign on behalf of my organization. Both I and my respective organization understand the importance of maintaining the confidentiality of PERA non-public data and agree to abide by this agreement as well as the PERA Data Privacy Policy, MN Chapter 13 Data Privacy Laws, and all other applicable Federal and State laws. My failure to adhere to this agreement, follow PERA’s Data Privacy policy, and/or follow Minnesota State Statutes Chapter 13 may result in monetary fines up to and exceeding $10,000 per record. Notwithstanding anything to the contrary in the PERA Data Security and Confidentiality Agreement, (1) PERA data may be transferred to or processed on Contractor’s workstations; (2) any return or destruction of PERA data shall be upon the State’s request, and (3) notification to individuals (including but not limited to a Notification Event) of a security or privacy incident shall be in accordance with Section 36.3 of the Contract.

Company: ___________________________________________________________

Signature: ___________________________________________________________

Print name: __________________________________________________________

Date: _______________________________________________________________

Contract or project name: _______________________________________________