INFORMATION SECURITY AND PRIVACY REQUIREMENTS EXHIBIT.docx

This Information Security and Privacy Requirements Exhibit establishes mandatory security and privacy standards for vendors providing services to California state and local government entities under the APC Comprehensive Protection Plan Service contract. The exhibit outlines comprehensive requirements governing data protection, access controls, encryption standards, audit logging, incident response procedures, and compliance with applicable federal and state privacy regulations including CCPA, HIPAA, and FERPA where applicable. Vendors must implement multi-factor authentication, maintain current security certifications, conduct regular security assessments and penetration testing, and provide detailed documentation of security controls and privacy safeguards. The requirements mandate immediate notification of any security breaches or privacy incidents, maintenance of detailed audit trails for all system access and data handling activities, and regular employee training on information security and privacy obligations.

Vendors must comply with all specified security requirements as a condition of contract performance and are subject to audit and verification of compliance by the state or local government entity. The exhibit requires vendors to maintain cybersecurity insurance coverage and implement disaster recovery and business continuity plans meeting state standards. Costs associated with implementing and maintaining these security and privacy controls are the vendor's responsibility and must be incorporated into their pricing. Non-compliance with any requirement may result in contract termination, remediation demands, or liability for damages resulting from security failures or privacy violations. The requirements apply throughout the entire contract term and any renewal periods, with vendors required to maintain compliance with evolving security standards and regulatory changes.