04-02-2018 Council Work Session Packet

Home Search

State of Minnesota -U.S. Bank Commercial Card Solutions -Participating Addendum Contract# 75413 Purchasing Card Contract# 75427 Fleet Card Appendix B-Minnesota General Terms, Conditions and Specifications d. Data Management. Contract Vendor will not use State data, including production data, for testing or development purposes. Contract Vendor has implemented and will maintain procedures to physically and logically segregate State data, unless otherwise explicitly authorized by the State Chief Information Security Officer or delegate. e. Data Encryption. Contract Vendor shall encrypt all State data in transit, if such data Is part of or associated with Contract Vendors cloud computing or hosting services. Encryption keys to State data shall only be accessed by Contract Vendor as necessary for performance of this Contracl/Agreement. f. Data Storage. Contract Vendor agrees that any and all State data will be stored, processed, and maintained solely on designated servers and that no such data at any time will be processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of the Contract Vendor's designated backup and recovery processes. g, Data Center and Monitoring/Support Locations. During the term of the Contracl/Agreement, Contract Vendor agrees to: (1) locate all production and disaster recovery data centers that store, process or transmit State data only in the continental United States, (2) store, process and transmit State data only in the continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental United States. The State has the right to on-site visits and reasonable inspection of the data centers upon notice to Contract Vendor of seven calendar days prior to visit. h. Security Audits & Remediation. Contract Vendor will audit the security of the systems and processes used to provide any and all cloud computing or hosting services, including those of the data centers used by Contract Vendor to provide any and all cloud computing or hosting services to the State. This security audit: (1) will be performed at least once every calendar year beginning with 2014; (2) will be performed according to appropriate industry security standards; (3) will be performed by third party security professionals at Contract Vendors election and expense; (4) will result in the generation of an audit report ("Contract Vendor Audit Report") which will, to the extent permitted by applicable law, be deemed confidential information and not public data under the Minnesota Government Data Practices Act; and (5) may be performed for other purposes in addition to satisfying this section. Notwithstanding subsection h (3) above, the security audit for the Payment Analytics application may be conducted by independent internal security professionals at Contract Vendor's expense. The Contract Vendor Audit Report will address the control procedures used by Contract Vendor to provide any and all cloud computing or hosting services, including specifically an assessment of whether (A) the control procedures were suitably designed to provide reasonable assurance that the stated internal control objectives would be achieved if the procedures operated as designed and (B) the control procedures operated effectively at all times during the reporting period. The Contract Vendor Audit Report must also address relevant controls of any subservice providers of any and all cloud computing or hosting services. Upon the State's reasonable, advance written request, Contract Vendor will provide to the State a copy of the Contract Vendor Audit Report. Contract Vendor will make best efforts to remediate any control deficiencies identified in the Contract Vendor Audit Report in a commercially reasonable timeframe. If the State becomes aware of any other Contract Vendor controls that do not substantially meet the State's requirements, the State may request remediation from Contract Vendor. Contract Vendor will make best efforts to remediate any control deficiencies identified by the State or known by Contract Vendor, in a commercially reasonable timeframe. I. Subcontractors. Contract Vendor agrees that no State data shall be transmitted, exchanged or otherwise provided to other parties except as specifically agreed to in writing by the State Chief Information Security Officer or delegate. Contract Vendor must ensure that any contractors, subcontractors, agents and others to whom it provides State data, agree in writing to be bound by the same restrictions and conditions under this Contracl/Agreement that apply to Contract Vendor with respect to such data. j. Compliance with Payment Card Industry Data Security Standard. All of Contract Vendors systems and components that process, store, or transmit State data shall comply with the applicable and then most recent version of the Payment Card Industry Data Security Standard ("PCI DSS") promulgated by the PCI Security Standards Council. The Contract Vendor shall, upon request, provide the State with Contract Vendors currently available and applicable Attestation of Compliance signed by a PCI QSA ("Qualified Security Assessor'). Page 37 of 37