RFB-IS-27200077 Info Security & Privacy Exhibit.pdf

This is an Information Security & Privacy Exhibit document supporting a multi-year software subscription procurement for Commvault by the State of California. The exhibit outlines the security and privacy requirements that vendors must meet to provide cloud-based data management and backup solutions. The procurement seeks to establish a multi-year subscription agreement for Commvault software, with specific focus on data protection, disaster recovery, and business continuity capabilities. The contract specifies detailed technical requirements for system security, data encryption, access controls, and audit logging to ensure compliance with California's information security standards and privacy regulations.

The exhibit establishes comprehensive security and privacy standards that must be implemented throughout the contract term, including requirements for data classification, risk assessment, incident response procedures, and compliance with applicable state and federal regulations such as HIPAA, PCI-DSS, and California Consumer Privacy Act (CCPA) requirements. Vendors must demonstrate their ability to maintain secure data handling practices, provide regular security assessments and vulnerability management, and maintain detailed audit trails. The document specifies minimum security certifications and compliance frameworks required, including SOC 2 Type II certification or equivalent, and mandates that all personnel with access to sensitive data complete appropriate security training and background checks before contract award.