Laserfiche WebLink
Offsite/Cloud Addendum - 2 <br />6.20.23 <br /> <br /> <br />cryptography standards as specified in National Institute of Standards <br />and Technology FIPS140-2, Security Requirements. The key location <br />and other key management details will be agreed to by City and Vendor <br />technical staffs. <br /> <br />Additional verbiage intentionally omitted. <br />7. Breach Notification and Recovery: The City requires public breach <br />notification when citizens’ personally identifiable information is lost or <br />stolen. Additionally, unauthorized access or disclosure of non -public data <br />is considered to be a breach. Vendor will provide notification within 72 <br />business hours, unless otherwise directed by law enforcement, and all <br />communication shall be pre-coordinated with the City. When Vendor or <br />Vendor’s subcontractors are solely responsible for the loss, Vendor shall <br />bear all costs associated with the investigation, response and recovery <br />from the breach, including credit monitoring services with a term of at <br />least three years, mailing costs, website, and toll free telephone call <br />center services, subject to the terms of the Master Services Agreement. <br />8. Notification of Legal Requests: Vendor shall notify the City upon <br />receipt of any electronic discovery, litigation holds, discovery searches, <br />and expert testimonies related to, or which in any way requires access to, <br />the data of the City. Vendor shall not respond to subpoenas, service of <br />process, and other legal requests <br />related to the City without first notifying the City and providing the City a <br />reasonable opportunity to respond, unless prohibited by law from <br />providing such notice and opportunity. <br />9. Termination and Suspension of Service: In the event of termination or <br />expiration of the Agreement, Vendor shall implement an orderly return of <br />City data in CSV or XML or another mutually agreeable format. Vendor <br />shall guarantee the subsequent secure disposal of City data. <br />a. Suspension of services: During any period of suspension or <br />contract negotiation or disputes, Vendor shall not take any action <br />to intentionally erase any City data. <br />b. Termination or Expiration of any Services or Agreement in entirety: <br />After termination, Vendor shall have no obligation to maintain or <br />provide any City data and shall thereafter, unless legally prohibited, <br />dispose of all City data in its systems or otherwise in its possession <br />or under its control as specified in section 9.d below. <br />c. Post-Termination Assistance: Intentionally omitted. <br />d. Secure Data Disposal: When required under section 9.b above, <br />Vendor shall destroy all identifiable data in all of its forms, for <br />example: disk, CD/DVD, backup tape, and paper. Data shall be <br />permanently deleted and shall not be recoverable, according to <br />National Institute of Standards and Technology (NIST) approved <br />methods, and certificates of destruction shall be provided to the City.