This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
Name of Official
Title
Firm or Corporation
Date
H. Data Security Clauses
1. Network Security. Vendor agrees at all times to maintain network security that at a minimum includes:
network firewall provisioning, intrusion detection, and regular (three or more annually) third party
vulnerability assessments. Likewise, Vendor agrees to maintain network security that conforms to
generally recognized industry standards.
2. Data Security. Vendor agrees to preserve the confidentiality, integrity and accessibility of NNPS data
with administrative, technical and physical measures that conform to generally recognized industry
standards (see “11. Industry Standards”) and best practices that Vendor then applies to its own
processing environment. Maintenance of a secure processing environment includes but is not limited
to the timely application of patches, fixes and updates to operating systems and applications as
provided by vendor or open source support.
3. Data Storage. Vendor agrees that any and all NNPS data will be stored, processed, and maintained
solely on designated target servers and that no NNPS data at any time will be processed on or
transferred to any portable or laptop computing device or any portable storage medium, unless that
device or storage medium is in use as part of the Vendor's designated backup and recovery processes
and encrypted in accordance with “5. Data Encryption”.
4. Data Transmission. Vendor agrees that any and all electronic transmission or exchange of system and
application data with NNPS and/or any other parties expressly designated by NNPS shall take place via
secure means (using HTTPS or SFTP or equivalent) and solely in accordance with “7. Data Re-Use”.
5. Data Encryption. Vendor agrees to store all NNPS backup data as part of its designated backup and
recovery processes in encrypted form, using a commercially supported encryption solution. Vendor
further agrees that any and all NNPS data defined as personally identifiable information under current
legislation or regulations stored on any portable or laptop computing device or any portable storage
medium be likewise encrypted. Encryption solutions will be deployed with no less than a 128-bit key
for symmetric encryption and a 1024 (or larger) bit key length for asymmetric encryption.
6. Data Re-Use. Vendor agrees that any and all data exchanged shall be used expressly and solely for the
purposes enumerated in the Current Agreement and this Addendum. Data shall not be distributed,
repurposed or shared across other applications, environments, or business units of Vendor. Vendor
further agrees that no NNPS data of any kind shall be transmitted, exchanged or otherwise passed to
other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by
Newport News Public Schools.
7. End of Agreement Data Handling. Vendor agrees that upon termination of this Agreement it shall
erase, destroy, and render unrecoverable all NNPS data and certify in writing that these actions have
been completed within 30 days of the termination of this Agreement or within 7 days of the request of
Page 21 of 22Jump to an indexed page (25 of 25)