Vendor shall use industry best practices to update all systems and third party software security patches to reduce security risk. Vendor shall protect their systems with anti-virus, host intrusion protection, incident response monitoring and reporting, network firewalls, application firewalls, and employ system and application patch management to protect its network and customer data from unauthorized disclosure. Vendor shall be solely responsible for all data storage required, starting on Day 1 (no archiving of prior history is required). See Section 7.3.6 for storage requirements after startup. Vendor shall take all necessary measures to protect the data including, but not limited to, the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques. Vendor agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Vendor controlled or owned electronic device. Vendor shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Stored media must be kept in an all-hazards protective storage safe at the worksite and when taken offsite. All back up data and media shall be encrypted. Online and offsite data retention period has been established as six (6) years from the time of collection. Cost options for Tape and/or Disk are solicited. Adherence to Policy Vendor support and problem resolution solution shall provide a means to classify problems as to criticality and impact and with appropriate resolution procedures and escalation process for each classification of problem. Vendor shall comply with all pertinent federal and state privacy regulations. REFERENCES Vendor must provide at least three (3)three (3) references. A form for providing reference information is attached as Attachment B. ITS requires that references
Vendor shall use industry best practices to update all systems and third party software security patches to reduce security risk. Vendor shall protect their systems with anti-virus, host intrusion protection, incident response monitoring and reporting, network firewalls, application firewalls, and employ system and application patch management to protect its network and customer data from unauthorized disclosure. Vendor shall be solely responsible for all data storage required, starting on Day 1 (no archiving of prior history is required). See Section 7.3.6 for storage requirements after startup. Vendor shall take all necessary measures to protect the data including, but not limited to, the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques. Vendor agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Vendor controlled or owned electronic device. Vendor shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Stored media must be kept in an all-hazards protective storage safe at the worksite and when taken offsite. All back up data and media shall be encrypted. Online and offsite data retention period has been established as six (6) years from the time of collection. Cost options for Tape and/or Disk are solicited. Adherence to Policy Vendor support and problem resolution solution shall provide a means to classify problems as to criticality and impact and with appropriate resolution procedures and escalation process for each classification of problem. Vendor shall comply with all pertinent federal and state privacy regulations. REFERENCES Vendor must provide at least three (3)three (3) references. A form for providing reference information is attached as Attachment B. ITS requires that references
43163-B%20LOC.docx