Exhibit Z - Data Security Rider.docx

Exhibit Z

DATA SECURITY RIDER

For

RFP-YK-006732

Prescription Safety Eyewear

Contractor acknowledges and agrees that the data and information to be provided to Contractor or otherwise received, stored, processed, hosted, managed, or used by Contractor during performance of this Agreement is categorized as Confidential Information under this Agreement or by laws and regulations requiring protection from intrusion, release, breach, or other exposure. The following requirements apply to applications (including Cloud applications and subscriptions, Hosted/Managed services, and web sites / interfaces) used by Utilities and all devices and infrastructure to be connected to the Utilities network or that otherwise document, contain, or process Utilities’ information on the Utilities’ network or accessed through other means:

A. Standards

1. Authentication Contractor agrees to utilize multifactor authentication for all user access to the systems / solution which comprise the services(s) that they provide and systems/solutions they manage on behalf of Utilities. If supported, Contractor agrees to utilize Utilities approved federated identity / single sign-on solution which satisfies the multifactor authentication requirement.

2. Encryption Contractor agrees to apply industry standard encryption protocols meeting or exceeding the requirements listed below to encrypt Utilities’ data while at rest and in transit. The encryption method employed to satisfy the ‘at rest’ requirement must be sufficient to protect against unauthorized access / use of the data while the system storing/processing the information is in use (e.g. column encryption). Encryption methods designed to render unmounted/inactive data unreadable to unauthorized parties (e.g. full-disk encryption) will only satisfy the ‘at rest’ requirement for offline backups.

Contractor agrees to encrypt and store all backups containing Utilities’ data separate from the production system. Contractor agrees to use encryption keys unique to Utilities for the encryption of Utilities’ data, including backups and store these keys in a location separate from the data being encrypted. Contractor agrees to protect these keys at a level equal to or exceeding the encryption level of the data being encrypted. For information systems which Utilities has determined that a loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals, data and backup encryption keys must remain within the exclusive control of Utilities.

Contractor agrees to meet or exceed the following minimum encryption and configuration requirements:

(a) TLS version 1.2 for all TLS-based sessions

(b) AES 256 for all symmetric encryption

(c) 2048 bit keys with no DHE ciphers for all asymmetric encryption

(d) IKEv2 and PFS for all IPsec VPN tunnels

(e) mTLS and Oauth 2.0 for all web service integrations

(f) X.509 standards, SHA-2 hashing, and an independent authority as issuer for all certificates

Within 30 days of discovery, Contractor agrees to notify Utilities of the usage any encryption protocol, cipher, algorithm, or other method that is known to be compromised or suspected to have been compromised within the systems/solution which comprise the services(s) that they provide and systems/solutions they manage on behalf of Utilities. In their notification, Contractor agrees to supply their plan and associated timeframe to remove the protocol, cipher, algorithm, or method from their systems/solution.

3. Location of Data Contractor agrees that Utilities’ data must always remain within the continental United States. Utilities’ data may be accessed outside the continental United States on a limited basis (e.g customer support) if the following conditions are met: (a.) access is limited to a single record at a time, (b.) no programmatic access (i.e. back-end database access, aggregate access, etc.) or ability to export / remove data from the hosting system (within the United States) is ever available outside the continental United States, and (c.) Basic Cybersecurity Practices as defined in Section C. are always in-place for all systems accessing or hosting Utilities’ data. Contractor may alter the specified location within the U.S. of Utilities’ data with ninety (90) day advance written notice to Utilities. Primary / alternate data centers must be geographically separated.

4. Use, Sharing, and Segregation All data provided to the Contractor may only be used for the express purpose of fulfilling the obligation of this Agreement. Any other use is strictly prohibited. Utilities data may not be shared with any other party without written content from Utilities. Contractor agrees to segregate Utilities’ data from all other clients’ data.

B. Audits and Cyber Security Testing

1. Utilities has the right to audit and/or test applications and devices delivered hereunder prior to acceptance and periodically thereafter during performance of this Agreement.

2. Contractor agrees to undergo such acceptance and periodic security audits by certified third parties occurring at least annually. Any identified issues must be resolved within ninety (90) days of the date of the audit report. The initial acceptance audit requirement may be satisfied by providing a SSAE 18 SOC 2 Type II report, and such report shall also be provided to Utilities annually, after the completion of the audit, or upon request. If financial services are within scope of the Agreement, a SSAE 18 SOC 1 Type II report must be provided prior to execution and annually thereafter.

3. If the SSAE 18 SOC 2 Type II report submitted covers the hosting provider or datacenter instead of the contracted company or solution, it must be accompanied by additional documentation specifically addressing the following areas specific to the parties hosting, storing, or processing Utilities data:

· Risk Management Strategy, Governance, and Oversight

· How access to Utilities’ data is controlled and all parties with access such data.

· Methods used to segregate Utilities’ data from other clients’ data

· Applicable Security Policies

4. Contractor agrees to provide the results of penetration test(s) conducted on the relevant version of the product(s) and/or solution(s) by a reputable and accredited 3rd party to Utilities under NDA prior to the execution of any Agreement and annually thereafter. Penetration testing results must include high-level details to include the number and severity of each finding along with corrective actions taken.

5. In addition to remediating or mitigating vulnerabilities prior to acceptance, Contractor is responsible for constantly monitoring and either remediating or mitigating vulnerabilities or configuration issues identified.

C. Basic Cybersecurity Practices Contractor agrees to maintain industry standard cybersecurity safeguards on the systems / solutions that comprise the service(s) that they provide and systems / solutions they manage on behalf of Utilities. At a minimum, such safeguards must include: (a.) active, updated, industry standard malicious code protection mechanisms, (b.) least privilege access control, (c.) log monitoring, (d.) web application firewall for web-based services, and (e.) installation of all currently available OS and application critical security patches on a currently supported operating system. Contractor agrees to notify Utilities in writing if critical security patches are not applied within 30 days of patch issuance.

D. Breaches Contractor agrees to provide Notice to Utilities of any access, acquisition, use, or disclosure of Utilities’ data in a manner which compromises the security or privacy of the data (“breach”), within forty-eight (48) hours of discovery. Notice shall be made to both Utilities’ Representative in the manner provided for legal Notices under this Agreement, and by email to Utilities Cyber Security Team at the following address:

cybersecurity@csu.org.

In its initial Notice and when more information becomes available, Contractor shall state to the extent known:

(a) the details of the event that caused the breach,

(b) whether the breach involved exposure, scanning, exfiltration, destruction or modification, or other misuse/misappropriation of the data,

(c) the amount and nature of the data involved in the breach,

(d) the persons/parties who gained access to the data, to the extent known (subject to an ongoing duty of disclosure as information is developed), and

(e) the Contractor’s plan to mitigate the cause of the breach.

E. Destruction of Data / Records / Information Contractor agrees to sanitize all media containing Utilities’ data / information in accordance with NIST SP 800-88 media sanitization guidelines. Specifically, media containing Utilities’ non-Confidential data must be sanitized by ‘Clearing’ at a minimum and media containing Utilities’ Confidential data must be sanitized by ‘Purging’ at a minimum.

Upon termination, cancellation, expiration, special request, or other conclusion of the Agreement or upon expiration of the specified retention period of any applicable laws, regulatory requirements, or retention schedules to include exemptions for legal holds, Contractor agrees to return all Utilities’ data and any other information in Contractor’s custody provided to enable performance of this Agreement (e.g. infrastructure or context diagrams, project plans, etc.) or sanitize the media containing the data / information based upon Utilities’ preference. Promptly after completion, Contractor agrees to provide Utilities with a certificate confirming the date and method of destruction of the data.

F. Data Storage, Replication and Backup Contractor shall backup all Utilities’ data from the production server for data recover purposes. In addition, Contractor shall also backup all Utilities’ data to a separate geographically isolated location for disaster recovery purposes. Utilities’ data shall be stored for a minimum of thirty (30) days at the production facility and at the disaster recovery facility for a minimum of ninety (90) days. Upon Utilities’ request, Contractor shall make available to Utilities a copy of Utilities’ data with twenty-four (24) hour advance written notification.

Contractor shall ensure that Utilities’ data accessed by or disclosed to Contractor is stored, processed, or maintained only to the extent required for the performance of Contractor support services under this Agreement. Contractor shall ensure that Utilities’ data is not replicated or stored on any unencrypted removable / portable storage devices.

G. Termination Utilities reserves the right to terminate this Agreement in its entirety when there is a material lapse or degradation in the security of the systems/solution which comprise the services(s) that are provided by the Contractor or systems/solutions they manage on behalf of Utilities based upon the notifications, notices, test results, documentation, or other information provided by the Contractor as required by the provisions in this Rider or as a result of tests / audits conducted by Utilities.

image1.jpeg