Information Security & Privacy Exhibit.pdf

This Information Security & Privacy Exhibit document outlines security and privacy requirements for the Cribl Suite Renewal contract opportunity in California. The exhibit establishes mandatory information security standards and privacy protections that must be implemented by the vendor throughout the contract term. Key requirements include compliance with applicable state and federal data protection regulations, implementation of security controls for data confidentiality and integrity, and establishment of incident response procedures. The vendor must maintain current security certifications and conduct regular security assessments. Personnel handling sensitive information must undergo background checks and security training. The exhibit specifies requirements for system access controls, encryption standards for data in transit and at rest, and audit logging capabilities to track system activities and data access.

The exhibit details vendor obligations regarding breach notification procedures, requiring prompt reporting of any security incidents involving state data within specified timeframes. The vendor must maintain liability insurance covering data breaches and cyber incidents, with minimum coverage amounts specified. Documentation and evidence of security compliance must be provided upon request through regular audits and assessments. The exhibit establishes that the vendor assumes responsibility for protecting all state and customer data processed under the contract and outlines consequences for non-compliance, including potential contract termination. Requirements address third-party subcontractor security obligations, ensuring that any vendors used by the primary contractor maintain equivalent security and privacy standards.