Laserfiche WebLink
9 <br /> <br />consent of the City. Contractor shall notify the City in writing at least thirty (30) days <br />prior to any change in data center location or hosting provider. <br /> <br />25. Cyber Security Incident. In the event a. Security Incident (as defined below) occurs <br />with respect to City Data, user accounts, or any component of the AMI system, <br />Contractor shall: <br /> <br />a. Notification. Notify the City’s IT Director and designated City contact by telephone <br />within twenty-four (24) hours of discovery of the Security Incident, followed by <br />written notification within forty-eight (48) hours. The written notification shall <br />include, to the extent known: the nature and scope of the incident, the categories and <br />approximate number of records affected, a description of the measures taken or <br />proposed to address the incident, and the identity and contact information of <br />Contractor’s designated incident response lead. <br /> <br />b. Investigation and Remediation. Cooperate fully with City to investigate and resolve <br />the Security Incident, including providing the City with timely access to all relevant <br />logs, forensic analysis, and documentation. Contractor shall promptly implement all <br />necessary remedial measures to contain, mitigate, and prevent recurrence of the <br />incident. <br /> <br />c. Regulatory Compliance. Comply with all applicable breach notification laws, <br />including California Civil Code §1798.82 (California Data Breach Notification Law) <br />and any other applicable state or federal requirements. Contractor shall bear all costs <br />associated with legally required breach notifications to affected individuals, including <br />notification preparation, mailing, credit monitoring services (if applicable), and any <br />call center support. <br /> <br />d. Post-Incident Review. Within thirty (30) days following resolution of the Security <br />Incident, provide City with a written post-incident report that includes: root cause <br />analysis, a timeline of events, actions taken to remediate the incident, and a plan for <br />preventing similar incidents, including any changes to business practices, security <br />controls, or system architecture. <br /> <br />e. Security Standards. Contractor shall maintain, at a minimum, SOC 2 Type II <br />compliance and shall provide the City with a current SOC 2 Type II report annually. <br />Contractor shall conduct penetration testing at least annually by a qualified third party <br />and shall share a summary of findings and remediation actions with the City upon <br />request. Contractor shall maintain and follow a vulnerability management program <br />that includes patching Critical vulnerabilities within fifteen (15) days, High <br />vulnerabilities within thirty (30) days, and Medium vulnerabilities within sixty (60) <br />days of discovery or vendor release. <br /> <br />f. Definition. “Security Incident” means any unauthorized access, acquisition, use, <br />disclosure, modification, or destruction of City Data, or any breach or compromise of <br />any system, network, or application used to store, process, or transmit City Data, <br />Page 204 of 443