|
2 10,001—50,000 $3,000,000 per occurrence
<br /> 3 50,001—100,000 $4,000,000 per occurrence
<br /> 4 100,001—500,000 $15,000,000 per occurrence
<br /> 5 500.001— 1,000,000 $30,000,000 per occurrence
<br /> 6 1,000,001 —10,000,000 $100,000,000 per occurrence
<br /> The policy shall comply with the following requirements:
<br /> • Issued by an insurance company acceptable to the City of Everett and valid for the entire term of the contract,
<br /> inclusive of any term extension(s).
<br /> • Liability limits will be calculated based on the maximum system record count and the Ponemon Institute
<br /> average Public Sector Breach cost per record (currently$154). Refer to the Tiered Coverage Schedule above.
<br /> • Shall include, but not be limited to,coverage for liabilities arising out of premises, operations, independent
<br /> contractors, products, completed operations, and liability assumed under an insured contract.
<br /> • At a minimum,the policy must include third party coverage for credit monitoring; notification costs to data
<br /> breach victims; and regulatory penalties and fines.
<br /> • Shall apply separately to each insured against whom claim is made or suit is brought subject to the Service
<br /> Provider's limit of liability.
<br /> • Shall include a provision requiring that the policy cannot be cancelled without thirty days written notice to the
<br /> City of Everett.
<br /> • The Service Provider shall be responsible for any deductible or self-insured retention contained in the
<br /> insurance policy.
<br /> • The coverage under the policy shall be primary, and not excess,to any other insurance carried by the Service
<br /> Provider.
<br /> • In the event contractor fails to keep in effect at all times the insurance coverage required by this provision,the
<br /> City may, in addition to any other remedies it may have, terminate the contract upon the occurrence of such
<br /> event, subject to the provisions of the contract.
<br /> 5. Breach Notification and Recovery: City of Everett requires public breach notification when citizens'
<br /> personally identifiable information is lost or stolen.Additionally, unauthorized access or disclosure of non-
<br /> public data is considered to be a breach. The Service Provider will provide notification without unreasonable
<br /> delay and all communication shall be coordinated with the City of Everett. When the Service Provider or their
<br /> subcontractors are liable for the loss,the Service Provider shall bear all costs associated with the
<br /> investigation, response and recovery from the breach including but not limited to credit monitoring services
<br /> with a term of at least 3 years, mailing costs,website, and toll free telephone call center services. The City of
<br /> Everett shall not agree to any limitation on liability that relieves a Contractor from its own negligence or to the
<br /> extent that it creates an obligation on the part of the State to hold a Contractor harmless.
<br /> 6. Notification of Legal Requests: The Service Provider shall contact the City of Everett upon receipt of any
<br /> electronic discovery, litigation holds,discovery searches, and expert testimonies related to, or which in any
<br /> way might reasonably require access to the data of the City. The Service Provider shall not respond to
<br /> subpoenas, service of process,and other legal requests related to the City of Everett without first notifying the
<br /> City unless prohibited by law from providing such notice.
<br /> 7. Termination and Suspension of Service: In the event of termination of the contract, the Service Provider
<br /> shall implement an orderly return of City of Everett data in CSV or XML or another mutually agreeable format.
<br /> The Service Provider shall guarantee the subsequent secure disposal of City of Everett data.
<br /> a) Suspension of services: During any period of suspension or contract negotiation or disputes, the
<br /> Service Provider shall not take any action to intentionally erase any City of Everett data.
<br /> b) Termination of any services or agreement in entirety: In the event of termination of any services or
<br /> agreement in entirety,the Service Provider shall not take any action to intentionally erase any City of
<br /> Everett data for a period of 90 days after the effective date of the termination.After such 90 day period,
<br /> the Service Provider shall have no obligation to maintain or provide any City of Everett data and shall
<br /> thereafter, unless legally prohibited, dispose of all City of Everett data in its systems or otherwise in its
<br /> possession or under its control as specified in section 7d)below.Within this 90 day timeframe,vendor will
<br /> continue to secure and back up City of Everett data covered under the contract.
<br /> City of Everett/Gtechna Software Agreement
<br /> Page 17 7/25/2018
<br />
|