Exhibit_I_-_County_of_Orange_Security_Policies_and_Procedures.pdf

County of Orange RFP #026-2630601-RA Page 1 of 2

District Attorney Implementation, Maintenance and Support of New Case Management System File No. 2630601

EXHIBIT I

COUNTY OF ORANGE SECURITY POLICIES AND PROCEDURES

Policies and Procedures

Contractor, its subcontractors, the Contractor personnel, and all other agents and representatives of Contractor, will at all times comply with and abide by all Information Technology (IT) policies and procedures of the County that are provided or made available to Contractor that reasonably pertain to Contractor (and of which Contractor has been provided with advance notice) in connection with Contractor’s performance under this Contract including, but not limited to https://cio.ocgov.com/egovernment-policies. Contractor shall cooperate with the County in ensuring

Contractor’s compliance with the IT policies and procedures described in this Contract and as adopted by the County from time-to-time, and any material violations or disregard of such IT policies or procedures shall, in addition to all other available rights and remedies of the County, be cause for termination of this Contract. In addition to the foregoing, Contractor shall comply with the following:

Security and Policies

All performance under this Contract, shall be in accordance with the County’s security requirements, policies, and procedures as set forth above and as modified, supplemented, or replaced by the County from time to time, in its sole discretion, by providing Contractor with a written copy of such revised requirements, policies, or procedures reasonably in advance of the date that they are to be implemented and effective (collectively, the “Security Policies”).

Contractor shall at all times use industry best practices and methods with regard to the prevention, detection, and elimination, by all appropriate means, of fraud, abuse, and other inappropriate or unauthorized access to County systems accessed in the performance of services in this Contract.

Information Access

The County may require all Contractor personnel performing services under this Contract to execute a confidentiality and non-disclosure Contract concerning access protection and data security in the form provided by County. The

County shall authorize, and Contractor shall issue, any necessary information-access mechanisms, including access

IDs and passwords, and in no event shall Contractor permit any such mechanisms to be shared or used by other than the individual Contractor personnel to whom issued. Contractor shall provide each Contractor Person with only such level of access as is required for such individual to perform his or her assigned tasks and functions. All County systems, and all data and software contained therein, including County data, County hardware and County software, used or accessed by Contractor: (a) shall be used and accessed by such Contractor solely and exclusively in the performance of their assigned duties in connection with, and in furtherance of, the performance of Contractor’s obligations hereunder; and (b) shall not be used or accessed except as expressly permitted hereunder, or commercially exploited in any manner whatsoever, by Contractor, at any time.

Enhanced Security Procedures

The County may, in its discretion, designate certain areas, facilities, or systems as requiring a higher level of security and access control. The County shall notify Contractor in writing reasonably in advance of any such designation becoming effective. Any such notice shall set forth in reasonable detail the enhanced security or access-control procedures, measures, or requirements that Contractor shall be required to implement and enforce, as well as the date on which such procedures and measures shall take effect. Contractor shall fully comply with and abide by all such enhanced security and access measures and procedures as of such date.

Breach of Security

Any breach or violation by Contractor of any of the foregoing shall be deemed a material breach of a material obligation of Contractor under this Contract and may be deemed an incurable and material breach of a material obligation of Contractor under this Contract resulting in termination.

https://cio.ocgov.com/egovernment-policies

County of Orange RFP #026-2630601-RA Page 2 of 2

District Attorney Implementation, Maintenance and Support of New Case Management System File No. 2630601

Conduct on County Premises

Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of the County (or that may be established thereby, from time to time) that pertain to conduct on the County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that the Contractor has been provided with a copy of each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and Subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Audits

Each Contract Year, County may perform or have performed security reviews and testing based on an IT infrastructure review plan. Such testing shall ensure all pertinent County security standards as well as any customer agency requirements, such as federal tax requirements or HIPPA.

Security Requirements

Contractor employees must conduct County business strictly from Contractor provided devices.

County data must not be transmitted to personal devices, personal emails, or personal cloud storage locations of Contractor employees.

All Contractor employees with access to County network and resources must annually complete the County cybersecurity awareness training (CSAT). It is incumbent upon Contractor to ensure that new employees with access to County network complete CSAT within 30 days of employment and at least annually.

Remote Access

If required and approved by County, Contractor employees will gain remote access to County network. Access will be limited to applications and resources necessary for Contractor to perform duties identified in this agreement.