The following apply to any agreement, PO or engagement in which Vendor has access to, stores or processes electronic or digital records and information or records of any type owned, created, received, collected or stored by the University or on its behalf (“Data”). Data includes, but is not limited to, personally identifiable information, University, student, faculty and staff Data, metadata, and user content.
Vendor shall collect and use Data only for the purpose of performing its obligations under a PO or agreement. Vendor shall not provide or disclose Data to any entity or person not employed by Vendor without prior written consent of the University, except as may be required by law or permitted by the express terms of the PO or agreement. Vendor shall not change the manner in which Data is collected, used, or shared without the prior written consent of the University.
All Data in the possession or control of Vendor or its subcontractors or agents shall be destroyed, or transferred to the University when the Data is no longer needed for performance of the PO or agreement.
Vendor, and each subcontractor and agent of Vendor with access to Data, shall maintain appropriate technical and organizational measures for the protection of the security, confidentiality and integrity of Data and to prevent unauthorized access to including without limitation, safeguards that meet the requirements of the Federal Trade Commission Safeguard Rule, set forth at 16 CFR Part 314 and the European Union’s General Data Protection Regulations (“GDPR”). Vendor’s technical and organizational measure shall conform to the standards set in the current version of the NIST Cybersecurity Framework (or its equivalent). Such measures shall include measures for protection against unauthorized or unlawful access to Data and against accidental or unlawful destruction, loss, alteration, damage, disclosure of, or access, to Data.
Vendor shall maintain and operate a formal security program materially in accordance with industry standards that is designed to: (i) ensure the security and integrity of Data, (ii) protect against threats or hazards to the security or integrity of Data, (iii) prevent unauthorized access to Data, and (iv) prevent unauthorized access to the University’s information technology infrastructure including, without limitation, data processing devices, data storage devices, servers, networks, information services and computing devices and communication devices (“IT Infrastructure”).
If Vendor processes payment card data, Vendor shall also comply with all applicable requirements for validation and compliance with the PCI DSS (Payment Card Industry Data Security Standard), as appropriate for its Service Provider level.
In the event Vendor discovers unauthorized access to IT Infrastructure or unauthorized use or disclosure of Data (a “Security Breach”) or reasonably believes that a Security Breach has occurred, Vendor shall promptly (and within any timeframe established by applicable law concerning Vendor’s notification requirement) notify the University of such Security Breach, shall provide to the University any information regarding the incident reasonably requested by the University (including a list of the Data and IT Infrastructure affected and all affected individuals and their contact information) and shall promptly take all measures reasonably required to recover Data, to remedy any flaws, defects or vulnerabilities in Vendor’s systems, software or personnel related to the Security Breach and, if requested by the University, to assist the University in identifying and remedying any other flaws, defects or vulnerabilities related to the Security Breach.
If Vendor maintains or stores Data, Vendor shall engage, at its cost, an independent accounting firm to produce annual audit reports. The University reserves the right to require that such audits employ the SOC 2 standards of the American Institute of Certified Public Accountants. Vendor will transmit a copy of each audit report to the University immediately following Vendor’s receipt of such report.
With respect to any processing of personal data of persons located in the European Union or the European Economic Area, Vendor shall only act on the written instruction of the University and shall assist the University in compliance with GDPR in relation to the security of processing, the notification of personal data breaches, data protection impact assessments, answering data subjects’ requests, and allowing data subjects to exercise their rights. Vendor shall ensure that individuals processing the data are subject to a duty of confidentiality and only engage sub-processors with the prior consent of the University and under a written contract.
Vendor shall limit access to Data and IT Infrastructure (“Data Access”) to individuals whose duties require Data Access in order for Vendor to perform its contractual obligations. Before permitting Data Access to any individual, Vendor shall obtain, to the extent permitted by law, current criminal and financial background checks for such individual. Vendor shall not permit Data Access by any individual that Vendor reasonably determines may expose the University to a risk of loss or damage, unauthorized use or modification of Data, damage to IT Infrastructure.
Except as may be provided by a separate written agreement, all rights in Data and IT Infrastructure, including all intellectual property rights, shall remain the property of the University, and Vendor has only a limited, nonexclusive license for the sole purpose of performing its obligations as outlined in the PO or agreement.
Vendor shall maintain insurance, in the amount of at least $5,000,000 per occurrence, protecting the University against loss or damages (including costs of litigation) arising from a Security Breach related to or arising from Vendor’s acts or omissions.