minutes
...
VERSION 2.0
Please describe the intended business use case for your solution within Placer County. Your response should include:
Vendor must ensure the County owns all right, title and interest in its data that is related to the services provided by this contract.
Protection of personal privacy and sensitive data is imperative.
The vendor will ensure that there is no inappropriate or unauthorized use of County of Placer information at any time.
Placer County requests a security and/or network architecture diagram with minimally the exterior(egress) data points.
Non-public County data cannot be stored or transferred outside of the United States.
Placer requires notification of any location changes to data center(s) that will process or store County data.
In addition, all vendor personnel who handle Placer data must be located in the US.
All non-public data in transit regardless of the transit mechanism must be encrypted.
For engagements where the Vendor stores sensitive personally identifiable or otherwise confidential information, this data shall be encrypted at rest. Encryption to be consistent with validated cryptography standards as specified in National Institute of Standards and Technology Security Requirements: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf
When encryption at rest cannot be offered, this must be disclosed and existing security measures that provide a similar level of protection outlined.
All breaches should be reported to ITSEC@placer.ca.gov and to all parties referenced in the "Notices" section of the Agreement within 24 hours of discovery.
California Civil Codes 1798.29 and 1798.82 require public breach notification when citizens’ personally identifiable information is lost or stolen.
Vendor is liable in the event of any act, error or omission, negligence, misconduct, or breach that compromises or is suspected to compromise the security, confidentiality, or integrity of County data or operations.
Vendor will conduct criminal background checks and not utilize any staff, including sub-contractors, to fulfill the obligations of the contract who has been convicted of any crime of dishonesty.
Vendor will promote and maintain an awareness of the importance of securing the County’s information among the their employees and agents.
Vendor will identify all of its strategic business partners related to services provided under this contract.
Vendor will maintain business continuity and disaster recovery plans and will ensure that the County’s Recovery Time Objective (RTO) and Recovery Point Objective (RPO) can be met as agreed to by the parties and set forth in the SOW and/or SLA.
Placer County requires vendors to maintain Cyber Liability Insurance, with limits not less than two million dollars ($2,000,000) per occurrence or claim, two million dollars ($2,000,000) aggregate? (Some contracts may be subject to higher limits.) Please confirm your compliance with the cyber liability insurance limits as noted above.
The vendor is required to support Single Sign On authentication utilizing Okta. Single Sign On capability is required for cloud applications. Please confirm your compliance with Single Sign On using Okta.
In addition, please indicate whether Okta integration is included as part of your standard offering or requires an additional fee. If additional costs apply, please provide details on pricing, licensing requirements, and any implementation or ongoing maintenance fees.
Please also provide a link to your Okta integration documentation, or upload the documentation as a file attachment with your response.
Placer County uses Box.com for authenticated file sharing and collaboration. If a third party file sharing, storage or collaboration tool is embedded in your solution, please disclose. Otherwise, functionality will be impacted as Placer users do not have access to third party file sharing and storage such as Google Drive and Sharefile.
https://www.ada.gov/resources/2024-03-08-web-rule/