CALIFORNIA, STATE OF - FRANCHISE TAX BOARD

Home Browse Search

State of California City of Santa Ana Franchise Tax Board Agreement# 107503 4. EMPLOYEE ACCESS TO INFORMATION: Each party receiving data agrees that the information obtained will be kept in the strictest confidence and shall make information available to its own employees only on a "need-to- know" basis. The "need-to-know" standard is met by authorized employees who need information to perform their official duties in connection with the uses of the information authorized by this Agreement. Each party receiving data recognizes its responsibility to protect the confidentiality of the information in its custody as provided by law and to ensure that such information is disclosed only to those individuals and for such purposes as are authorized by law and this Agreement. 5. PROTECTING CONFIDENTIAL INFORMATION/ INCIDENT REPORTING: Each party receiving data, in recognizing the confidentiality of the information to be exchanged, agrees to take all appropriate precautions to protect the confidential information obtained pursuant to this Agreement from unauthorized access, use, or disclosure. Each party receiving data will conduct oversight of its users with access to the confidential information provided under this Agreement, and will immediately notify FTB's Information Security Audit & Investigations Unit (SecurityAuditMailAftb.ca.gov) of any unauthorized or suspected unauthorized accesses, uses and/or disclosures (incidents). For purposes of this section, "immediately" is defined as within 24 hours of the discovery of the breach or suspected breach. The notification must describe the incident in detail and identify responsible personnel (name, title and contact information). The party with an incident will comply with the incident reporting requirements in accordance with Civil Code Section 1798.29, State Administrative Manual (SAM) Chapter 5300 and Sections 8643, and State Information Management Manual 5340-A and 5340-C to facilitate the required reporting to the taxpayer(s) or state oversight agencies. 6. INFORMATION SECURITY: Information security is defined as the preservation of the confidentiality, integrity, and availability of information. A secure environment is required to protect the confidential information obtained by each party pursuant to this Agreement. Each party receiving data will store information so that it is physically secure from unauthorized access. The records received will be securely maintained and accessible only by employees of the specified program who are committed to protect the data from unauthorized access, use or disclosure. All FTB electronic data must be encrypted when in transit using FIPS 140-3 approved encryption technology, and be password protected and secure at all times when in storage. Confidential information obtained from FTB must be secured in accordance with the SAM Chapters 5100 and 5300 (Information Security), and National Institute of Standards and Technology (NIST) Special Publication 800-53 (moderate); and additional security requirements provided by FTB. FTB may require that a Security Questionnaire for the party receiving confidential data from FTB be completed or be on file with FTB's Chief Security Officer, or their designee. If this Agreement calls for Federal Tax Information (FTI) to be provided by FTB, the receiving party must also comply with Internal Revenue Service Publication 1075. 7. CLOUD COMPUTING ENVIRONMENT: Each party receiving FTB's confidential data must submit a completed FTB Cloud Computing Questionnaire before using a Cloud Computing Environment. The questionnaire will be reviewed for approval by FTB's Chief Security Officer, or their designee. A Cloud Computing Environment cannot be used to receive, transmit, store or process FTB's confidential data without prior written approval from FTB's Chief Security Officer, or their designee. Page 6 of 13 Rcaiiccd no+c nR n7 ')no