CORE & MAIN LP (#2027021) - Laserfiche WebLink

8 Confidential render inaccessible any City Data for a minimum period of ninety (90) days after the effective date of termination, unless expressly authorized by City in writing. City shall be entitled to any post-termination assistance generally made available with respect to the Services, unless a unique data retrieval arrangement has been established as part of the Service Level Agreement (SLA), attached hereto as Exhibit E. Contractor shall securely dispose of all City Data in all of its forms, including but not limited to cloud storage, local disk, removable media, backup systems, disaster recovery environments, and paper records, when requested by City. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST) Special Publication 800-88 or successor guidelines. Contractor shall require the same of any sub processors or subcontractors who have had access to City Data. Certificates of destruction shall be provided to City within thirty (30) days of the destruction request. Data Retention. During the term of this Agreement, Contractor shall retain all City Data for a minimum of 13 months hourly usage values and daily values for 5 years through the software platform. Contractor shall maintain automated backups at intervals no less frequent than every four (4) hours. All backup and disaster recovery data shall be stored exclusively on servers located within the United States and shall be subject to the same security, access, and confidentiality requirements as production data. Data Location. All City Data, including production, backup, and disaster recovery copies, shall be stored exclusively on servers located within the United States. Contractor shall not transfer, process, or store City Data outside the United States without prior written consent of the City. Contractor shall notify the City in writing at least thirty (30) days prior to any change in data center location or hosting provider. 25.Cyber Security Incident. In the event a. Security Incident (as defined below) occurs with respect to City Data, user accounts, or any component of the AMI system, Contractor shall: a.Notification. Notify the City’s IT Director and designated City contact by telephone within twenty-four (24) hours of discovery of the Security Incident, followed by written notification within forty-eight (48) hours. The written notification shall include, to the extent known: the nature and scope of the incident, the categories and approximate number of records affected, a description of the measures taken or proposed to address the incident, and the identity and contact information of Contractor’s designated incident response lead. b.Investigation and Remediation. Cooperate fully with City to investigate and resolve the Security Incident, including providing the City with timely access to all relevant logs, forensic analysis, and documentation. Contractor shall promptly implement all necessary remedial measures to contain, mitigate, and prevent recurrence of the incident. c.Regulatory Compliance. Comply with all applicable breach notification laws, including California Civil Code §1798.82 (California Data Breach Notification Law) and any other applicable state or federal requirements. Contractor shall bear all costs associated with legally required breach notifications to affected individuals, including notification preparation, mailing, credit monitoring services (if applicable), and any call center support. Docusign Envelope ID: 6AD75F50-8A33-85A5-8039-9E3E1257A838Docusign Envelope ID: 177582DA-4F1C-8834-813C-BC4FD03AA45E