Data Center and Monitoring/Support Locations. During the term of the Contract, Contractor will: (1) locate all production and disaster recovery data centers that store, process or transmit State data only in the continental United States, (2) store, process and transmit State data only in the continental United States, and (3) locate all monitoring and support of all the Cloud Services only in the continental United States. The State has the right to on-site visits and reasonable inspection of the data centers upon notice to Contractor of seven calendar days prior to visit.
Data Center and Monitoring/Support Locations. During the term of the Contract, Contractor will: (1) locate all production and disaster recovery data centers that store, process or transmit GRPUC data only in the continental United States, (2) store, process and transmit GRPUC data only in the continental United States, and (3) locate all monitoring and support of all Software Services only in the continental United States. GRPUC has the right to on-site visits and reasonable inspection of the data centers upon reasonable notice to Contractor prior to the visit.
Data Center and Monitoring/Support Locations. During the term of the Contract/Agreement, CONTRACTOR agrees to: (1) locate all production and disaster recovery data centers that store, process or transmit STATE data only in the continental United States, (2) store, process and transmit STATE data only in the continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental United States. Customer has the right to on-site visits and reasonable inspection of the data centers upon notice to CONTRACTOR of seven calendar days prior to visit. CONTRACTOR will audit the security of the systems and processes used to provide any and all cloud computing or hosting services, including those of the data centers used by CONTRACTOR to provide any and all cloud computing or hosting services to the State of Minnesota. This audit: (A) will be performed at least once every calendar year beginning with 2019, or the year the Master Service Agreement is executed, whichever is later; (B) will be performed according to appropriate industry security standards (e.g., SSAE 16 SOC2); (C) will be performed by third party security professionals at CONTRACTOR’s election and expense; (D) will result in the generation of an audit report (“CONTRACTOR Audit Report”), which will, to the extent permitted by applicable law, be deemed confidential information and as non-public data under the Rules of Public Access; and (E) may be performed for other purposes in addition to satisfying this section. The CONTRACTOR Audit Report will address the control procedures used by CONTRACTOR to provide any and all cloud computing or hosting services, including specifically an assessment of whether
Data Center and Monitoring/Support Locations. During the term of the Contract, Contractor will: (1) locate all production and disaster recovery data centers that store, process or transmit State data only in the continental United States, (2) store, process and transmit State data only in the continental United States, and (3) locate all monitoring and support of all Cloud Services only in the continental United States. The State has the right to on-site visits and reasonable inspection of the data centers upon notice to Contractor of seven calendar days prior to visit. Security Audits & Remediation. If Applicable, Contractor will audit the security of the systems and processes used to provide any and all Cloud Services, including those of the data centers used by Contractor to provide any and all Cloud Services to the State. This security audit: (1) will be performed at least once every calendar year beginning with 2016; (2) will be performed according Statement on Standards for Attestation Engagements (“SSAE”) 16 Service Organization Control (“SOC”) 2, International Organization for Standardization (“ISO”) 27001, or FedRAMP; (3) will be performed by third party security professionals at Contractor’s election and expense; (4) will result in the generation of an audit report (“Contractor Audit Report”), which will, to the extent permitted by applicable law, be deemed confidential information and as not public data under the Minnesota Government Data Practices Act (Minnesota Statutes chapter 13); and (5) may be performed for other purposes in addition to satisfying this section. Subcontractors and Third Parties. Contractor warrants that no State data will be transmitted, exchanged or otherwise provided to other parties except as specifically agreed to in writing by the State Chief Information Security Officer or delegate. Contractor must ensure that any contractors, subcontractors, agents and others to whom it provides State data, agree in writing to be bound by the same restrictions and conditions under this Contract that apply to Contractor with respect to such data. Compliance with Data Privacy and Security Laws and Standards. Contractor shall comply with all applicable State and federal data privacy and data security laws, rules, and regulations. Remedies. Contractor acknowledges that the State, because of the unique nature of its data, would suffer irreparable harm in the event that Contractor breaches its obligation under this Security and Data Protection section, and monetary damages may not ade...
