This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
an agent of NNPS, whichever shall come first. At a minimum, a “Clear” media sanitization is to be
performed according to the standards enumerated by the National Institute of Standards, Guidelines for
Media Sanitization, SP800-88, Appendix A -see http://csrc.nist.gov/.
8. Security Breach Notification. Vendor agrees to comply with all applicable laws that require the
notification of individuals in the event of unauthorized release of personally identifiable information or
other event requiring notification. In the event of a breach of any of Vendor’s security obligations, or
other event requiring notification under applicable law, Vendor agrees to:
a. Notify NNPS by telephone and e-mail of such an event within 24 hours of discovery, and;
b. Assume responsibility for informing all such individuals in accordance with applicable law, and;
c. Indemnify, hold harmless and defend NNPS and its trustees, officers, and employees from and
against any claims, damages, or other harm related to such Notification Event.
9. Right to Audit. Newport News Public Schools or an appointed audit firm (Auditors) has the right to
audit the Vendor and the Vendor’s sub-vendors or affiliates that provide a service for the processing,
transport or storage of Newport News Public Schools’ data. Newport News Public Schools will
announce their intent to audit the Vendor by providing at a minimum two weeks (10 business days)
notice to the Vendor. This notice will go to the Vendor that this contract is executed with. A scope
document along with a request for deliverables will be provided at the time of notification of an audit.
If the documentation requested cannot be removed from the Vendor’s premises, the Vendor will allow
the Auditors access to their site. Where necessary, the Vendor will provide a personal site guide for
the Auditors while on site. The Vendor will provide a private accommodation on site for data analysis
and meetings; the accommodation will allow for a reasonable workspace, with appropriate lighting,
electrical, a printer and Internet connectivity. The Vendor will make necessary employees or
contractors available for interviews in person or on the phone during the time frame of the audit. In
lieu of NNPS or its appointed audit firm performing their own audit, if the Vendor has an external audit
firm that performs a certified SSAE16 SOC Type II review, NNPS has the right to review the controls
tested as well as the results, and has the right to request additional controls to be added to the certified
SSAE16 SOC Type II review for testing the controls that have an impact on NNPS data. Audits will
be at Newport News Public Schools's sole expense, except where the audit reveals material
noncompliance with contract specifications, in which case the cost will be borne by the vendor.
10. Industry Standards. Generally recognized industry standards include but are not limited to the current
standards and benchmarks set forth and maintained by the:
Center for Internet Security -see http://www.cisecurity.org
Payment Card Industry/Data Security Standards (PCI/DSS) -see http://www.pcisecuritystandards.org/
National Institute for Standards and Technology -see http://csrc.nist.gov
Federal Information Security Management Act (FISMA) -see http://csrc.nist.gov
ISO/IEC 27000-series -see http://www.iso27001security.com/
Organization for the Advancement of Structured Information Standards (OASIS) -see
http://www.oasis-open.org/
11. Vendor agrees to provide SSAE 16 (SOC 1) Standard Type II reports to NNPS Contract Administrator
annually which document verification of controls tested. Annual date determined to be thirty (30) days
prior to the established contract renewal date.
I. Copyright/Patent Indemnity:
Successful Offeror shall pay all royalty and license fees relating to the items covered by this contract. In the
event any third party shall claim that the manufacture, use and sales of the goods supplied under this
contract constitute an infringement of any copyright, trademark, or patent, the Successful Offeror shall
indemnify NNPS and hold NNPS harmless from any cost, expense, damage or loss incurred in any manner
by NNPS on account of any such alleged or actual infringement.
Page 22 of 22Jump to an indexed page (25 of 25)