PCI Contract Addendum - Exhibit D.docx

PCI Contract Addendum

University of Wisconsin – Milwaukee (“UWM”) and ______________________ (“Vendor”) hereby agree as follows:

1. Vendor will protect the confidentiality of all cardholder information it receives, maintains or creates under the Agreement (collectively, the “Protected Information”) as set forth in this addendum.

2. Vendor acknowledges its responsibility for securing Protected Information on all systems it utilizes, including, but not limited to, computer systems, networks, servers, and databases maintained by Vendor, its agents, or its subcontractors. Vendor agrees that it shall take all commercially reasonable measures necessary to protect Protected Information from unauthorized disclosure, loss, damage, and destruction including, but not limited to, the following:

a. Vendor warrants at its sole cost and expense, that it shall implement processes and maintain security of Protected Information; provide reasonable care and efforts to detect fraudulent activity involving information Protected Information; and promptly notify UWM of any breaches of security involving Protected Information.

b. Vendor will provide and maintain secure backup of the Protected Information. Vendor shall implement and maintain secure passwords for its systems on which Protected Information is accessible, as well as all appropriate administrative, physical, technical and procedural safeguards to secure the Protected Information and protect the Protected Information from loss, corruption, unauthorized disclosure, and from hacks, and the introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that could result in a disruption of service or unauthorized access to Protected Information.

c. Vendor shall certify to UWM:

i. The sufficiency of its security standards, tools, technologies and procedures in providing services under the Agreement;

ii. That the system used to provide services under the Agreement has and will maintain a valid FISMA certification and accreditation consistent with the minimum‐security requirements assigned against a low‐impact information system (per Federal Information Processing Standards Publications 199, “Standards for Security Categorization of Federal Information and Information Systems” and 200, “Minimum Security Requirements for Federal Information and Information Systems”). UWM reserves the right to independently evaluate, audit, and verify such FISMA certification and accreditation.

iii. That the Services will comply with the following:

1. Privacy provisions of the Federal Privacy Act of 1974;

2. Applicable industry standards and guidelines, including but not limited to, relevant security provisions of the Data Security Standard (PCIDSS) including the PCIDSS Cloud Computing Guidelines.

3. In the event of actual, attempted, suspected, or threatened circumstances that compromise or could reasonably be expected to compromise access to Protected Information (any such circumstances shall be considered a “Security Breach”), Vendor shall, at its own expense:

a. Make UWM aware of such Security Breach within 24 hours of learning of its occurrence;

b. Investigate such Security Breach, including conducting a forensic investigation to determine what systems, data, and information have been affected;

c. Allow UWM reasonable access to its security logs, latency statistics, investigation file, and any other data relating to Protected Information.

d. Provide a remediation plan that is acceptable to UWM to address the Security Breach and prevent further incidents;

e. If required under a remediation plan, provide notification to parties impacted by the Security Breach; and

f. Cooperate with UWM in responding to any third‐party inquiries resulting from the Security Breach.

RFB T21-038

4. Vendor agrees to indemnify and hold harmless UWM from all losses, damages, and related expenses resulting from a Security Breach. In the event the Security Breach resulted from the negligence or intentional actions of Vendor, its employees, or agents, or resulted from a flaw in Vendor’s product or services, Vendor agrees to indemnify and hold harmless UWM from all losses, damages, and related expenses resulting from such Security Breach.”

5. Vendor will have written policies governing access to and duplication and dissemination of Protected Information and shall provide UWM with a copy of such policies (i) upon execution of the Agreement, and (ii) upon implementing any updates to the policies during the term of the Agreement.

6. The terms of this addendum shall survive termination of the Agreement and continue in effect until such time as Vendor has no Protected Information in its possession.

Renewals. This addendum is effective for the current term of the service and any renewals of this service.

The State of Wisconsin __________________ by:

on behalf of the Board of Regents for Name:

Title:

Signature:

Date:

the University of Wisconsin System the University of Wisconsin-Milwaukee

By: Date: __________