Resolution 2024-27 - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: 601932A9-29F4-4C23-80F1-CEA4FACB795C v.4.10 COLORADO Financfal5ervices Division of Cont—" and Procurement or termination of this Contract, Contractor shall return State Records provided to Contractor or destroy such State Records and certify to the State that it has done so, as directed by the State. If Contractor is prevented by law or regulation from returning or destroying State Confidential Information, Contractor warrants it will guarantee the confidentiality of, and cease to use, such State Confidential Information. D. Incident Notice and Remediation If Contractor becomes aware of any Incident, Contractor shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Contractor can establish that Contractor and its Subcontractors are not the cause or source of the Incident, Contractor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Contractor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State, at no additional cost to the State. The State may adjust or direct modifications to this plan in its sole discretion, and Contractor shall make all modifications as directed by the State. If Contractor cannot produce its analysis and plan within the allotted time, the State, in its discretion, may perform such analysis and produce a remediation plan, and Contractor shall reimburse the State for the actual costs thereof. The State may, in its sole discretion and at Contractor's sole expense, require Contractor to engage the services of an independent, qualified, State -approved third party to conduct a security audit. Contractor shall provide the State with the results of such audit and evidence of Contractor's planned remediation in response to any negative findings. E. Data Protection and Handling Contractor shall ensure that all State Records and Work Product in the possession of Contractor or any Subcontractors are protected and handled in accordance with the requirements of this Contract, including the requirements of any Exhibits hereto, at all times. F. Safeguarding PII IF CONTRACTOR OR ANY OF ITS SUBCONTRACTORS WILL OR MAY RECEIVE PII UNDER THIS CONTRACT, CONTRACTOR SHALL PROVIDE FOR THE SECURITY OF SUCH PII, IN A MANNER AND FORM ACCEPTABLE TO THE STATE, INCLUDING, WITHOUT LIMITATION, STATE NON -DISCLOSURE REQUIREMENTS, USE OF APPROPRIATE TECHNOLOGY, SECURITY PRACTICES, COMPUTER ACCESS SECURITY, DATA ACCESS SECURITY, DATA STORAGE ENCRYPTION, DATA TRANSMISSION ENCRYPTION, SECURITY INSPECTIONS, AND AUDITS. CONTRACTOR SHALL BE A "THIRD -PARTY SERVICE PROVIDER" AS DEFINED IN §24-73-103(1)(I), C.R.S. AND SHALL MAINTAIN SECURITY PROCEDURES AND PRACTICES CONSISTENT WITH §§24-73-101 ET SEQ., C.R.S. IN ADDITION, AS SET Page 15 of 41