RFB-IS-26200831 Info Security & Privacy Exhibit.pdf

This Information Security & Privacy Exhibit is a supporting document for RFB-IS-26200831, a California state procurement for CommVault Metallic Cloud software subscription services. The exhibit establishes the security and privacy requirements that vendors must meet to provide cloud-based backup and recovery solutions to the state. The document outlines mandatory compliance standards, data protection protocols, and information security controls that bidders must implement and maintain throughout the contract term. Specific requirements address encryption standards, access controls, audit logging, incident response procedures, and compliance with state and federal information security regulations. The exhibit serves as a binding specification that all responsive bids must fully satisfy.

The Information Security & Privacy Exhibit functions as a technical and compliance baseline document that vendors must acknowledge and commit to meeting as a condition of contract award. The requirements detailed in the exhibit are non-negotiable and form part of the evaluation criteria for vendor selection. Vendors must demonstrate existing capability or provide detailed implementation plans to achieve compliance with all specified security controls and privacy protections. The exhibit ensures that any awarded vendor maintains security standards consistent with California state government requirements and protects sensitive state data in accordance with applicable federal and state information security laws and regulations.