CORE & MAIN LP (#2027020) - Laserfiche WebLink

11 proposed to address the incident, and the identity and contact information of Contractor’s designated incident response lead. b.Investigation and Remediation. Cooperate fully with City to investigate and resolve the Security Incident, including providing the City with timely access to all relevant logs, forensic analysis, and documentation. Contractor shall promptly implement all necessary remedial measures to contain, mitigate, and prevent recurrence of the incident. c.Regulatory Compliance. Comply with all applicable breach notification laws, including California Civil Code §1798.82 (California Data Breach Notification Law) and any other applicable state or federal requirements. Contractor shall bear all costs associated with legally required breach notifications to affected individuals, including notification preparation, mailing, credit monitoring services (if applicable), and any call center support. d.Post-Incident Review. Within thirty (30) days following resolution of the Security Incident, provide City with a written post-incident report that includes: root cause analysis, a timeline of events, actions taken to remediate the incident, and a plan for preventing similar incidents, including any changes to business practices, security controls, or system architecture. e.Security Standards. Contractor shall maintain, at a minimum, SOC 2 Type II compliance and shall provide the City with a current SOC 2 Type II report annually. Contractor shall conduct penetration testing at least annually by a qualified third party and shall share a summary of findings and remediation actions with the City upon request. Contractor shall maintain and follow a vulnerability management program that includes patching Critical vulnerabilities within fifteen (15) days, High vulnerabilities within thirty (30) days, and Medium vulnerabilities within sixty (60) days of discovery or vendor release. f.Definition. “Security Incident” means any unauthorized access, acquisition, use, disclosure, modification, or destruction of City Data, or any breach or compromise of any system, network, or application used to store, process, or transmit City Data, including but not limited to: data breaches, ransomware attacks, denial of service attacks, unauthorized system access, malware infections, and any incident requiring notification under applicable law. 29.Substitution of Securities in Lieu of Retention. Pursuant to Section 22300 of the Public Contract Code, the Contractor may substitute securities for any money held by the City to insure performance of the contract. At the request and expense of the Contractor, securities equivalent to the amount withheld shall be deposited with the City or federally- chartered banks as an escrow agent, who shall return such securities to the Contractor upon satisfactory completion of the contract. Docusign Envelope ID: D15BA154-47D3-8EAA-8171-B89F63E73DD1