ORANGE, COUNTY OF (20) - Laserfiche WebLink

Home Browse Search

Contractor's notification shall identify: • The nature of the Incident(s); • Any Data accessed, used or disclosed; • The person(s) who accessed, used, disclosed and/or received Data (if known); • What Contractor has done or will do to quarantine and mitigate the Incident(s); and • What corrective action Contractor has taken or will take to prevent future Incident(s). 2) Contractor will provide daily updates, or more frequently if required by the County, regarding findings and actions performed by Contractor until the Incident(s) has been effectively resolved to the County's satisfaction. 3) Contractor shall quarantine the Incident(s), ensure secure access to Data, and repair the system as needed. 4) If the Contractor causes or knowingly experiences a breach of the security of County's Data containing personal information, as defined by Civil Code Section 1798.3, Contractor shall immediately report any breach of security of such system to the Orange County Sheriff s Department Emergency Management Division personnel assigned as lead program manager following discovery or notification of the breach in the security of such Data. The County shall determine whether notification to the individuals whose Data has been lost or breached is appropriate. If personal information of any resident of California was, or is reasonably believed to have been acquired by an unauthorized person as a result of a security breach of such system and Data that is not due to the fault of the County or any person or entity under the control of the County, Contractor shall bear any and all costs associated with the County's notification obligations and other obligations set forth in Civil Code Section 1798.29 (d) as well as the cost of credit monitoring, subject to the dollar limitation, if any, agreed to by the County and Contractor in the applicable Statement of Work. These costs may include, but are not limited to staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach of the security of such personal information. 5) Contractor shall conduct an investigation of the Incident(s) and shall share the report of the investigation with the County. The County and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the County, its agents and law enforcement. 6) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, Contractor will at its expense have an independent, industry -recognized, County -approved third party perform an information security audit. The audit results shall be shared with the County within seven (7) days of Contractor's receipt of such results. Upon Contractor receiving the results of the audit, Contractor will provide the County with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract. Corrective Action In the event any goods or service provided by the Contractor in the performance of the Contract should fail to conform to the requirements in this Contract, it shall become the duty of the Contractor to immediately advise the County of the failure and correct the performance of goods or services, without expense to the County. If corrective action (including but not limited to patches, bug fixes, updates) is taken by the Contractor to remedy Incident(s) in the provision of Cowty of Orange MA-060-20010263 Pile No. CO21209 Sheriff-Coroner/Purchasing Services Bureau Public Mass Notification System Page 17 of40