|
Confidential Information wherever located. Contractor shall provide the State with access,
<br />subject to Contractor's reasonable security requirements, for purposes of inspecting and
<br />monitoring access and use of State Confidential Information and evaluating security control
<br />effectiveness. Upon the expiration or termination of this Contract, Contractor shall return
<br />State Records provided to Contractor or destroy such State Records and certify to the State
<br />that it has done so, as directed by the State. If Contractor is prevented by law or regulation
<br />from returning or destroying State Confidential Information, Contractor warrants it will
<br />guarantee the confidentiality of, and cease to use, such State Confidential Information.
<br />D. Incident Notice and Remediation
<br />If Contractor becomes aware of any Incident, it shall notify the State immediately and
<br />cooperate with the State regarding recovery, remediation, and the necessity to involve law
<br />enforcement, as determined by the State. Unless Contractor can establish that none of
<br />Contractor or any of its agents, employees, assigns or Subcontractors are the cause or
<br />source of the Incident, Contractor shall be responsible for the cost of notifying each person
<br />who may have been impacted by the Incident. After an Incident, Contractor shall take steps
<br />to reduce the risk of incurring a similar type of Incident in the future as directed by the
<br />State, which may include, but is not limited to, developing and implementing a remediation
<br />plan that is approved by the State at no additional cost to the State. The State may, in its
<br />sole discretion and at Contractor's sole expense, require Contractor to engage the services
<br />of an independent, qualified, State -approved third party to conduct a security audit.
<br />Contractor shall provide the State with the results of such audit and evidence of
<br />Contractor's planned remediation in response to any negative findings.
<br />E. Data Protection and Handling N.
<br />Contractor shall ensure that all State Records and Work Product in the possession of
<br />Contractor or any Subcontractors are protected and handled in accordance with the
<br />requirements of this Contract, including the requirements of any Exhibits hereto, at all
<br />times.
<br />F. Safeguarding PII
<br />If Contractor or any of its Subcontractors will or may receive PII under this Contract,
<br />Contractor shall provide for the security of such PII, in a manner and form acceptable to the
<br />State, including, without limitation, State non -disclosure requirements, use of appropriate
<br />technology, security practices, computer access security, data access security, data storage
<br />encryption, data transmission encryption, security inspections, and audits. Contractor shall
<br />be a "Third -Party Service Provider" as defined in §24-73-103(1)(i), C.R.S. and shall
<br />maintain security procedures and practices consistent with §§24-73-101 et seq., C.R.S. In
<br />addition, as set forth in § 24-74-102, et. seq., C.R.S., Contractor, including, but not limited
<br />to, Contractor's employees, agents and Subcontractors, agrees not to share any PII with any
<br />third parties for the purpose of investigating for, participating in, cooperating with, or
<br />assisting with Federal immigration enforcement. If Contractor is given direct access to any
<br />State databases containing PII, Contractor shall execute, on behalf of itself and its
<br />employees, the certification attached hereto as Exhibit B on an annual basis Contractor's
<br />duty and obligation to certify as set forth in Exhibit B shall continue as long as Contractor
<br />has direct access to any State databases containing PII. If Contractor uses any
<br />Subcontractors to perform services requiring direct access to State databases containing PII,
<br />the Contractor shall require such Subcontractors to execute and deliver the certification to
<br />Contract Number:
<br />12.1.2024
<br />Page 9 of 20 Version
<br />16
<br />
|