B-2_Article_X_Subcontractor_Cyber_Security_Requirements.pdf
PDF 78 KB Posted
- Attached to
- Dispersive Mirror
- Solicitation number
- SLAC_368931_DispersiveMirror
- Issued by
-
Department of Energy Office of Science
About this file
This document is a subcontractor cyber security requirements clause from a Stanford University agreement. The clause establishes mandatory data protection and security standards for any subcontractor handling University data, particularly Moderate or High Risk Data as defined in Stanford's Minimum Security Standards (available at https://minsec.stanford.edu). Prior to accessing, transmitting, or storing University Moderate or High Risk Data, subcontractors must obtain third-party certification verifying compliance with these Guidelines through the specified Stanford portal (https://uit.stanford.edu/security/asp).
The clause imposes strict obligations on subcontractors regarding data handling, use, and disclosure. Subcontractors are prohibited from copying, using, or disclosing University data except as permitted by the Agreement, required by law, or authorized in writing by the University. Subcontractors must immediately notify the University of any actual or suspected unauthorized disclosure, access to, or breach of data, and must comply with all applicable state and federal breach notification laws and regulations while cooperating with University legal obligations. The subcontractor assumes full indemnification responsibility for violations, including costs associated with breach notification and any required credit monitoring or credit support services. Upon agreement termination or expiration, subcontractors must return or destroy all University data within thirty days, at the University's election. The cyber security requirements and associated indemnity obligations survive termination of the underlying Agreement.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Article X - Subcontractor Cyber Security Requirements
Subcontractor agrees to handle data and other information ("Data") with a standard of care at least as rigorous as that specified in the University's Minimum Security Standards, located at https://minsec.stanford.edu ("Guidelines"), which are hereby incorporated by reference into the Agreement. Prior to performing Services which require access to, transmission of, and/or storage of the University's Moderate or High Risk Data, as defined in the Guidelines, Subcontractor will provide a third party certification (https://uit.stanford.edu/security/asp) verifying its ability to comply with the Guidelines. Subcontractor will not copy, cause to be copied, use or disclose Data received from or on behalf of the University except as permitted or required by the Agreement, as required by law, or as otherwise authorized by the University in writing.
Subcontractor will give immediate notice to the University of any actual or suspected unauthorized disclosure of, access to or other breach of the Data. In the event of actual or suspected unauthorized disclosure of, access to, or other breach of the Data, Subcontractor will comply with all state and federal laws and regulations related to such breach, and will cooperate with the University in fulfilling its legal obligations. Subcontractor will indemnify the University for its violation of this paragraph, including but not limited to the cost of providing appropriate notice to all required parties and credit monitoring, credit rehabilitation, or other credit support services to individuals with information impacted by the actual or suspected breach. Upon termination or expiration of the Agreement, Subcontractor will return or, at the University's election, destroy, the Data within 30 days from the conclusion of the Agreement. This paragraph and its indemnity will survive the termination of the Agreement.
https://minsec.stanford.edu/ https://uit.stanford.edu/security/asp
File details come from the government source that posted it. Updated .