RFB-IS-27200108 Info Security & Privacy Exhibit.pdf

This is an Information Security & Privacy Exhibit document supporting a software subscription procurement for Commvault Air Gap in California. The exhibit establishes the security and privacy requirements that must be met by vendors responding to request for bid (RFB) RFB-IS-27200108. The document outlines mandatory information security standards, data protection protocols, and privacy compliance measures that vendors must implement and maintain throughout the contract term. These requirements are designed to ensure the protection of sensitive state data and compliance with applicable state and federal security regulations governing cloud-based and air-gapped backup solutions.

The exhibit specifies technical security controls, access management procedures, encryption requirements, audit and monitoring capabilities, and incident response protocols that vendors must demonstrate and maintain. Vendors are required to document their security posture, provide evidence of compliance with specified standards, and agree to security assessments and audits as determined by the state. The document establishes baseline security expectations for the Commvault Air Gap subscription service, including requirements for data isolation, backup integrity verification, and protection against unauthorized access or data exfiltration. Compliance with all outlined security and privacy requirements is a mandatory condition of contract award and ongoing performance.