|
9
<br />Confidential
<br />d.Post-Incident Review. Within thirty (30) days following resolution of the Security Incident,
<br />provide City with a written post-incident report that includes: root cause analysis, a timeline
<br />of events, actions taken to remediate the incident, and a plan for preventing similar incidents,
<br />including any changes to business practices, security controls, or system architecture.
<br />e.Security Standards. Contractor shall maintain, at a minimum, SOC 2 Type II compliance and
<br />shall provide the City with a current SOC 2 Type II report annually. Contractor shall conduct
<br />penetration testing at least annually by a qualified third party and shall share a summary of
<br />findings and remediation actions with the City upon request. Contractor shall maintain and
<br />follow a vulnerability management program that includes patching Critical vulnerabilities
<br />within fifteen (15) days, High vulnerabilities within thirty (30) days, and Medium
<br />vulnerabilities within sixty (60) days of discovery or vendor release.
<br />f.Definition. “Security Incident” means any unauthorized access, acquisition, use, disclosure,
<br />modification, or destruction of City Data, or any breach or compromise of any system,
<br />network, or application used to store, process, or transmit City Data, including but not limited
<br />to: data breaches, ransomware attacks, denial of service attacks, unauthorized system access,
<br />malware infections, and any incident requiring notification under applicable law.
<br />26.Safety. Core & Main shall have the primary responsibility for all safety precautions and
<br />programs necessary to complete its Work associated with the Project. Core & Main agrees to
<br />comply with all applicable regulations, ordinances, and laws relating to safety. It shall be the
<br />responsibility of City, however, to assure that the sites controlled by City at which Core & Main
<br />is expected to perform its Work are safe sites
<br />27.Hazardous Materials. The Project and the Work expressly excludes any Work of any nature
<br />associated or connected with the identification, abatement, cleanup, control, removal, or disposal
<br />of hazardous materials or substances. City warrants and represents that, to the best of City’s
<br />knowledge, there is no asbestos or other hazardous materials in the Project premises in areas that
<br />Core & Main shall be required to perform work that in any way will affect Core & Main’s ability
<br />to complete the Project. If Core & Main is made aware or suspects the presence of hazardous
<br />materials, Core & Main reserves the right to stop work in the affected area and shall immediately
<br />notify City. It shall remain City’s responsibility to correct the condition to comply with local and
<br />federal standards and regulations. City shall remain responsible for any Claims that result from
<br />the presence of the hazardous materials. City is responsible for proper disposal of all hazardous
<br />materials, including but not limited to lithium batteries.
<br />28.Delays and Access. In the event of any delay, including but not limited to Force Majeure or delays
<br />caused by City, Core & Main will notify City in writing of the existence and nature of the delay.
<br />City and Core & Main will then mutually agree upon any new completion dates, and pricing or
<br />payment terms for the Work contemplated by this Agreement. Nothing in the foregoing sentence
<br />shall be deemed to relieve City from its obligation to provide Core & Main and its subcontractors
<br />reasonable and safe access to facilities that are necessary for Core & Main to complete the Work.
<br />29.Compliance. Core & Main and City will comply with all applicable laws, statutes, rules,
<br />regulations, ordinances, codes, and orders of any governmental bodies, agencies, authorities, and
<br />courts having jurisdiction.
<br />Docusign Envelope ID: 6AD75F50-8A33-85A5-8039-9E3E1257A838Docusign Envelope ID: 177582DA-4F1C-8834-813C-BC4FD03AA45E
|