Laserfiche WebLink
the Subrecipient shall immediately report report the loss or breach to the Pass- EXHIBIT 2 <br />through Entity. If the Pass-through Entity determines that notice to the <br />Individuals whose data has been lost or breached is appropriate, the Subrecipient <br />will bear any and all costs associated with the notice or any mitigation selected <br />by the Pass-through Entity. These costs include, but are not limited to, staff <br />time, material costs, postage, media announcements, and other identifiable costs <br />associated with the breach or loss of data. <br />f. The Subrecipient shall provide for the management and control of physical access to <br />Information assets (Including personal computer systems, computer terminals, mobile <br />computing devices, and various electronic storage media) used in performance of this <br />Subgrant. This shall include, but is not limited to, security measures to physically <br />protect data, systems, and workstations from unauthorized access and malicious <br />activity; the prevention, detection, and suppression of fires; and the prevention, <br />detection, and minimization of water damage. <br />g. At no time will confidential data obtained pursuant to this agreement be placed on a <br />mobile computing device, or on any form of removable electronic storage media of any <br />kind unless the data are fully encrypted. <br />h. Each party shall provide its employees with access to confidential information with <br />written Instructions fully disclosing and explaining the penalties for unauthorized <br />use or disclosure of confidential information found in Section 1798.55 of the <br />California Civil Code, Section 502 of the California Penal Code, Section 2111 of the <br />California Unemployment Insurance Code, Section 10850 of the California Welfare and <br />Institutions Code and other applicable local, state and federal laws. <br />1. Each party shall (where it is appropriate) store and process Information In <br />electronic format, in such a way that unauthorized persons cannot reasonably retrieve <br />the information by means of a computer. <br />j. All Subreclpient staff and subcontractors that are provided access to any data <br />systems of the Pass-through Entity, excluding CaIJOBS, are required to complete <br />and sign an Employee Confidentiality Statement (DE 7410). <br />k. Each party shall promptly return to the other party confidential information when <br />its use ends, or destroy the confidential information utilizing an approved method of <br />destroying confidential information: shredding, burning, or certified or witnessed <br />destruction. Magnetic media are to be degaussed or returned to the other party. <br />I. If the Pass-through Entity or Subreclpient enters into an agreement with a third <br />party to provide WIOA services, the Pass-through Entity or Subrecipient agrees to <br />include these data and security and confidentiality requirements in the agreement <br />with that third parry. In no event shall said information be disclosed to any <br />individual outside of that third party's authorized staff, subcontractor(s), service <br />providers, or employees. <br />m. The Subrecipient may, in its operation of the America's Job Center of California <br />(AJCC), permit an AJCC Operator to enter into a subcontract to manage confidential <br />information. This subcontract may allow an individual to register for resume <br />distribution services at the same time the individual enrolls in CaIJOBS. <br />Subrecipient shall ensure that all such subcontracts comply with the intellectual <br />property requirements of this subgrant agreement, the confidentiality requirements of <br />this subgrant agreement and any other terms of this subgrant agreement that may be <br />applicable. In addition, the following requirements must be included in the <br />subcontracts: <br />All client information submitted over the internet to the subcontractor's <br />databases must be protected, at a minimum, by 128 -bit Secure Socket Layer (SSL) <br />encryption. Clients' social security numbers must be stored in a separate <br />database within the subcontractor's network of servers, and protected by a <br />firewall and a secondary database server firewall or AES data encryption. If a <br />subcontractor receives client social security numbers or other confidential <br />Information in the course of business, for example a resume -distribution service <br />that provides enrollment in CaIJOBS, social security numbers must be destroyed <br />within two days after the client registers for CaIJOBS. If a subcontractor <br />obtains confidential information as an agent of the Subrecipient, the subcontract <br />must specifically state the purpose for the data collection and the term of <br />records retention must be stated, and directly related, to the purpose and use of <br />the information. Social security numbers and other client specific information <br />Page 16 of 17 <br />55E-20 <br />