Duty to Protect Confidential Information; Reporting Requirements. In consideration for the ability to perform the Services, the Vendor shall hold all Confidential Information in confidence and protect that Confidential Information with the same standard of care required to keep its own similar information confidential. The Vendor must abide by all commercially reasonable administrative, physical, and technical standards for maintaining this information confidential, which must be in accordance with standards established by the National Institute of Standards and Technology (“NIST”). In addition, the Vendor must safeguard all Confidential Information from unauthorized access, loss, theft, destruction, and the like. The Vendor may not, without prior consent from OIT, disclose any Confidential Information to any person for any reason at any time; provided, however it is understood that the Vendor may disclose Confidential Information to its Representatives and its business, financial and legal advisors who require the Confidential Information for the purpose of evaluating or performing the Services on the condition that, prior to such disclosure, the Representatives and advisers have been advised of the confidential and non-public nature of the Confidential Information and are subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Agreement. The Vendor shall be responsible for any breach of this Agreement by any of the Vendor’s Representatives or advisors. The Vendor shall promptly report any activities by any individual or entity that the Vendor suspects may compromise the availability, integrity, security, or privacy of any Confidential Information. The Vendor shall notify OIT immediately upon becoming aware that Confidential Information is in the possession of, or has been disclosed to, an unauthorized person or entity.
