PD-83

Revised: 02/17/2017

ATTACHMENT A: EXPANDED DATA SECURITY TERMS

Confidential Data Protection, Privacy, and Ownership: Service Provider must abide by the limitations on information disclosure set forth in The Family Educational Rights and Privacy Act (FERPA), (34 CFR § 99.33 (a) (2)) and with the terms set forth below. 34 CFR 99.33 (a) (2) states that the officers, employees and agents of a party that receive education record information from the Institution may use the information, but only for the purposes for which the disclosure was made. Service Provider must also abide by other applicable laws, rules, and standards, including but not limited to, The Health Insurance Portability and Accountability Act (HIPPA), the Gramm-Leach-Bliley Act (GLB), and Payment Card Industry Data Security Standards (PCI-DSS).

Definitions:

Service Provider refers to the contractor named in this agreement.

Institution & MSU refer to Montana State University.

Covered data and information (CDI) includes paper and electronic student education record information supplied by Institution, as well as any data provided by Institution’s students to the Service Provider.

Personally Identifiable Information (PII) includes records, social security numbers, or any other information that can be used to identify, contact, or locate a single person.

Cardholder Data includes credit card account numbers, security codes, expiration dates, names, addresses, social security numbers, and any other personally identifiable information associated with the cardholder that is stored, processed, or transmitted.

Acknowledgment of Access to CDI and/or PII: Service Provider acknowledges that the Agreement may allow the Service Provider access to CDI, PII and/or Cardholder Data.

Prohibition on Unauthorized use or disclosure of CDI, PII and/or Cardholder Data: If solution requires access to CDI, PII, and/or Cardholder Data, Service Provider shall not use or disclose such data received from or on behalf of the Institution (or its students) except as permitted or required by the Agreement, as required by law, or as otherwise authorized in writing by Institution or a student separately via direct agreement to terms with Service Provider. Service Provider agrees not to use CDI/PII/Cardholder Data for any purpose other than the purpose for which the disclosure was made. These measures will be extended by contract to all subcontractors used by Service Provider

Maintenance of the security of electronic information: If solution requires that Service Provider is given access to and will be storing CDI/PII/Cardholder Data, Offeror must hold CDI/PII/Cardholder Data in strict confidence and must use appropriate security measures to preserve the confidentiality, integrity, and availability of all such data. All sessions transmitting CDI/PII/Cardholder Data must be protected with minimum encryption levels that meet current industry best practices. Acceptable protocols include transferring files over Secure Socket Layer (SSL) and Secure File Transfer Protocol (SFTP) with public and private encryption keys. Unsecured protocols such as File Transfer Protocol (FTP) cannot be used. Service Provider must disclose which data elements (student ID #, name, contact information, etc.) are being stored in the solution. Service Provider must employ secure data backup scheme and restore procedures and security controls in the server and database environment used to store CDI/PII/Cardholder Data. Servers holding such data must be appropriately secured and maintained (physical security, updates, backups, uptime requirements, monitoring, etc.). CDI/PII/Cardholder Data must be encrypted at rest, if possible, and segregated from data belonging to other institutions or customers. Service Provider must maintain third-party data center audit compliance to a standard such as SOC 2 or SSAE 16. The university is required to adhere to the Payment Card Industry Data Security Standard (PCI DSS) promulgated by the PCI Security Standards Council. PCI DSS requires the university to maintain a written agreement that includes an acknowledgement that the Service Provider is responsible for the security of cardholder data that the Service Provider possesses; and requires the university to maintain a program to monitor the Service Provider’s PCI DSS compliance status at least annually. The Service Provider agrees that it is responsible for the security of all cardholder data that it obtains or possesses, including but not limited to the functions relating to storing, processing, and transmitting the cardholder data. The Service Provider attests that, as of the effective date of this contract, it has complied with all applicable requirements to be considered PCI DSS compliant, and has performed the necessary steps to validate its compliance with the PCI DSS. The Service Provider agrees to supply the current status of Service Provider’s PCI DSS compliance, and evidence of its most recent validation of compliance upon execution of this contract to the university. Service Provider must supply to the university an attestation of compliance, and sufficient evidence of its most recent appropriate compliance validation assessment for the university to ascertain the assessment scope and outcome, at least annually to pci@montana.edu.

Return or Destruction of CDI/PII: Upon termination, cancellation, expiration or other conclusion of the Agreement, Service Provider must return, purge, or destroy all Institutional data, CDI/PII/Cardholder Data, or otherwise except to the extent consented to by the given data subject. If Service Provider destroys the information, Service Provider shall provide Institution with a Certificate confirming the date of the destruction of the data within fourteen (14) days.

Remedies: If the Institution reasonably determines in good faith that Service Provider has materially breached any of its obligations under this contract, the Institution, in its sole discretion, shall have the right to provide Service Provider with a fifteen (15) day period to cure the breach; or terminate the Agreement immediately if cure is not possible. Before exercising any of these options, the Institution shall provide written notice to Service Provider describing the violation and the action it intends to take. If the breach involves educational records and if the Family Policy Compliance Office of the U.S. Department of Education determines that the Service Provider improperly disclosed personally identifiable information obtained from the Institution’s education records, the Institution may not allow the Service Provider access to education records for at least five years.

Reporting of Unauthorized Disclosures or Misuse of Covered Data and Information: Service Provider shall, within one day of discovery, report to the Institution any use or disclosure of CDI/PII/Cardholder Data not authorized by this agreement or in writing by Institution. Service Provider’s report shall identify: (i) the nature of the unauthorized use or disclosure, (ii) the CDI/PII/Cardholder Data used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Service Provider has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Service Provider has taken or shall take to prevent future similar unauthorized use or disclosure. Service Provider shall provide such other information, including a written report, as reasonably requested by Institution.

Contractor’s Responsibilities: If solution is hosted by MSU, the Contractor may design, test, and operate all software on equipment owned by MSU, using reasonable care to safeguard all software and equipment owned by MSU.

Indemnity: In addition to the indemnification provisions of the original agreement, Service Provider shall also defend and hold Institution harmless from all claims, liabilities, damages, or judgments involving a third party, including Institution’s costs and attorney fees, which arise as a result of Service Provider’s failure to meet any of its obligations under this Attachment A: Expanded Data Security Terms.