2007/10/17 Council Agenda Packet

.1 2 a. by September 30, 2005: a review of CDRL 31 with an assessment of its adequacy and conformance with industry best practices; a review and assessment of the Contractor's existing security measures at its facilities operating the Translink system; b. by October 31, 2005: a detailed plan and description of the testing that will be conducted as specified in 11.3(c) below; c. as part of the SIT Part 1 End-to-End Testing of the RFCS (to be completed by July 27, 2006), intrusion and other security auditing activities as agreed by ERG and the Agencies. The Contractor shall complete a second audit no later than May 31, 2007, and then shall conduct such audits by May 31 annually thereafter. The scope of work for each audit shall be submitted to the Contractor Administrator for review prior to the commencement of the audit and said work shall include but not be limited to assessing whether the actions identified in the prior audit have been taken. Subject to the confidentiality provisions of this Contract, Contractor shall direct the auditor to provide the Contract Administrator with a copy of the final report of such audit within forty-five (45) days after it is completed. 11.4 The Contractor shall report to the Contract Administrator any unauthorized use of the RFC System or unauthorized disclosure of RFCS- related data within forty-eight (48) hours after the Contractor becomes aware of such use or disclosure. In such event, the Contractor shall take such further steps as may reasonably be requested by the Contract Administrator to prevent further unauthorized use of the RFCS or data related thereto. 11.5 At all times, the Contractor shall maintain the security of the collection and clearinghouse operations in accordance with this Contract, applicable legal and regulatory requirements, and in accordance with the professional standards of persons and firms with specialized knowledge, expertise and experience who are leading designers and providers of systems, software and hardware used in the automated smart card fare payment industry. 2.0 System Backup and Disaster Recovery/Business Resumption Plan Section 3.1-13, "System Backup and Disaster Recovery/Business Resumption Plan" is hereby amended to read as follows: 3.1-13.1 System Backup and Disaster Recovery/Business Resumption Plan" 13.1 In accordance with the Contract Document Requirements List provided in Section 6.11-11.6.1.1, the Contractor shall submit to the Contract Administrator a CCA#3-Attachment A 3