Exhibit_E_TRA_DataSecurity_Confidentiality.pdf

TRA Data Security and Confidentiality Agreement Secure Protection and Handling of Data Network Security. To the extent applicable to Vendor’s performance under the Agreement to perform services, Vendor agrees at all times to maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third party penetration testing. Vendor further agrees to:

a. Data Security: Vendor agrees to protect and maintain the security of any Minnesota Teachers Retirement Association data in accordance with industry standards and with protection that is at least as good as or better than that maintained by Minnesota Teachers Retirement Association. These security measures include maintaining secure environments that are patched and up-to-date with all appropriate security updates no less than the standards set forth in NIST Cybersecurity Framework and NIST SP800 series publications (see https://www.nist.gov/cyberframework/framework and https://csrc.nist.gov/publications/sp800);

b. Data Transmission: Vendor agrees that any and all transmission or exchange of system application data with Minnesota Teachers Retirement Association and/or any other parties expressly designated by Minnesota Teachers Retirement Association, shall take place via secure means, e.g., HTTPS or SFTP;

c. Data Storage: Vendor agrees that any and all Minnesota Teachers Retirement Association data will be stored, processed, and maintained solely on designated target servers and that no Minnesota Teachers Retirement Association data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless medium is in part of the Vendor’s designated backup and recovery process;

d. Domain Encryption: Vendor agrees that any websites hosted by Vendor on behalf of Minnesota Teachers Retirement Association shall be on an encrypted domain using HTTPS;

e. Data Encryption: Vendor agrees to store any Minnesota Teachers Retirement Association backup data as part of its designated backup and recovery process in encrypted form, using no less than the standards set forth in NIST 800 and Federal Information Processing Standards (FIPS).

f. Password Protection: Vendor agrees that any portable or laptop computer that resides at any Minnesota Teachers Retirement Association facility, has access to a Minnesota Teachers Retirement Association network, or stores any non-public Minnesota Teachers Retirement Association data is equipped with strong and secure password protection in compliance with NIST SP 800-63.

g. Data Re-Use: Vendor agrees that any and all data exchanged shall be used expressly and solely for the purpose enumerated in the Agreement. Data shall not be distributed, repurposed or shaped across other applications, environments, or business units of Vendor. Vendor further agrees that no Minnesota Teachers Retirement Association data of any kind shall be transmitted, exchanged or otherwise passed to other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by Minnesota Teachers Retirement Association;

h. Data Return or Destruction: Vendor agrees that, upon completion, termination, or cancellation of the Agreement, all Minnesota Teachers Retirement Association data shall be remitted, in a mutually agreeable format and media, to Minnesota Teachers Retirement Association. The foregoing sentence does not apply if Minnesota Teachers Retirement Association's Chief Information Security Officer or delegate authorizes in writing Vendor to erase, destroy, and render unreadable the data in a manner consistent with NIST standards found in NIST SP 800-88 and Vendor certifies in writing that these actions have been completed within thirty (30) days of the termination of the Agreement or within seven (7) days of the request of an agent of Minnesota Teachers Retirement Association, whichever shall come first.

https://www.nist.gov/cyberframework/framework https://csrc.nist.gov/publications/sp800

Vendor further agrees, in the case of one time use of digital data, to erase, destroy, and render unreadable the data in a manner consistent with NIST standards found in NIST SP 800-88 and Vendor certifies in writing that these actions have been completed within thirty (30) days of the termination of the Agreement or within seven (7) days of the request of an agent of Minnesota Teachers Retirement Association, whichever shall come first.

i. Notification and Data Breaches. Vendor agrees to comply with all applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification in accordance there with. In the event of a data breach of any Vendor’s security obligations or other event requiring notification under applicable law (a “Notification Event”), Vendor agrees to assume responsibility for informing all such individual in accordance with applicable laws and to indemnify, hold harmless, and defend Minnesota Teachers Retirement Association against any claims, damages, or other harm related to such Notification Event.

j. Requirement to comply and clarify. Vendor agrees to resolve any questions about compliance with the above listed requirements with the Minnesota Teachers Retirement Association Chief Information Security Officer prior to signing the TRA Data Security and Confidentiality Agreement and prior to receiving or sending any data.

The protective requirements contained in this document are to survive the termination of the Agreement or any other agreement with the vendor. Non-compliance with the TRA Data Security and Confidentiality Agreement may result in suspension of services, termination, termination of contracts, civil and/or criminal prosecution.

By signing the TRA Data Security and Confidentiality Agreement you agree to the following:

I have read the TRA Data and Security Confidentiality Agreement. I fully understand the terms of this agreement and have authority to sign on behalf of my organization. Both I and my respective organization understand the importance of maintaining the confidentiality of TRA non-public data and agree to abide by this agreement as well as the TRA Data Privacy Policy, MN Chapter 13 Data Privacy Laws, and all other applicable Federal and State laws. My failure to adhere to this agreement, follow TRA’s Data Privacy policy, and/or follow Minnesota State Statutes Chapter 13 may result in monetary fines up to and exceeding $10,000 per record. Notwithstanding anything to the contrary in the TRA Data Security and Confidentiality Agreement, (1) TRA data may be transferred to or processed on Contractor’s workstations;

(2) any return or destruction of TRA data shall be upon the State’s request, and (3) notification to individuals (including but not limited to a Notification Event) of a security or privacy incident shall be in accordance with Section 36.3 of the Contract.

Company: ___________________________________________________________

Signature: ___________________________________________________________

Print name: __________________________________________________________

Date: _______________________________________________________________

Contract or project name: _______________________________________________