Laserfiche WebLink
Offsite/Cloud Addendum - 4 <br />6.20.23 <br />12.Security Logs and Reports: Vendor shall allow the City access to <br />system security logs that affect the engagement under the Agreement, <br />its data and or processes. This includes the ability for the City to <br />request a report of the records that a specific user accessed over a <br />specified period of time. <br />13. Contract Audit: Vendor shall allow the City to audit conformance to <br />Agreement terms, system security and data centers as appropriate. <br />The City may perform this audit or contract with a third party at its <br />discretion at the City’s expense. Such reviews shall be conducted with <br />at least 30 days advance written notice and shall not unreasonably <br />interfere with Vendor’s business. <br />14. Subcontractor Disclosure: Vendor shall identify to City technical <br />staff all of its strategic business partners related to services provided <br />under the Agreement, including, but not limited to, all subcontractors or <br />other entities or individuals who may be a party to a joint venture or <br />similar agreement with Vendor, who will be involved in any application <br />development and/or operations. <br />15. Third-Party Vendors: Vendor may use third-party vendors to provide <br />services to City. Vendor must ensure that any third-party vendor is also <br />SOC2 compliant and must provide to the City evidence of compliance <br />upon City request. <br />16. Business Continuity: Vendor will maintain a comprehensive <br />continuity of operations plan consistent with SOC2 requirements and <br />will regularly review and update the plan as necessary. Vendor will <br />provide the City with notice of any changes to the continuity of <br />operations plan that may impact the City’s use of the services under <br />the Agreement. <br />a. In the event of a disruption of Vendor’s operations, Vendor will <br />use commercially reasonable efforts to restore service as soon <br />as possible, consistent with SOC2 requirements. <br />b. Vendor will conduct regular tests of its continuity of operations <br />plan to ensure that it is effective and up-to-date. <br />17. Operational Metrics: Vendor and the City technical staffs shall reach <br />agreement on operational metrics and document these metrics in the <br />Agreement or elsewhere in writing. Examples include, but are not <br />limited to: <br />a. Advance notice and change control for major upgrades and <br />system changes <br />b. System availability/uptime guarantee/agreed-upon maintenance <br />downtime <br />c. Recovery time objective/recovery point objective <br />d. Security vulnerability scanning