Data Security Requirements Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53). Contractor also shall provide technical and organizational safeguards against accidental, unlawful, or unauthorized access or use, destruction, loss, alteration, disclosure, transfer, commingling, or processing of such information that ensure a level of security appropriate to the risks presented by the processing of County Data, Contractor personnel and/or subcontractor personnel and affiliates approved by County to perform work under this Contract may use or disclose County personal and confidential information only as permitted in this Contract. Any other use or disclosure requires express approval in writing by the County of Orange. No Contractor personnel and/or subcontractor personnel or affiliate shall duplicate, disseminate, market, sell, or disclose County personal and confidential information except as allowed in this Contract. Contractor personnel and/or subcontractor personnel or affiliate who access, disclose, market, sell, or use County personal and confidential information in a manner or for a purpose not authorized by this Contract may be subject to civil and criminal sanctions contained in applicable federal and state statutes. Contractor shall take all reasonable measures to secure and defend all locations, equipment, systems, and other materials and facilities employed in connection with the Services against hackers and others who may seek, without authorization, to disrupt, damage, modify, access, or otherwise use Contractor systems or the information found therein; and prevent County data from being commingled with or contaminated by the data of other customers or their users of the Services and unauthorized access to any of County data. Contractor shall also continuously monitor its systems for potential areas where security could be breached. In no case shall the safeguards of Contractor’s data privacy and information and cyber security program be less stringent than the safeguards used by County. Without limiting any other audit rights of County, County shall have the right to review Contractor’s data privacy and information and cyber security program prior to commencement of Services and from time to time during the term of this Contract. All data belongs to the County and shall be destroyed or returned at the end of the contract via digital wiping, degaussing, or physical shredding as directed by County.
Eligibility Requirements The Trustee hereunder shall at all times (i) be a corporation or association having its principal office in a state and city acceptable to the Seller, organized and doing business under the laws of such state or the United States of America, authorized under such laws to exercise corporate trust powers, having a combined capital and surplus of at least $50,000,000, or shall be a member of a bank holding system, the aggregate combined capital and surplus of which is at least $50,000,000, provided that its separate capital and surplus shall at all times be at least the amount specified in Section 310(a)(2) of the Trust Indenture Act of 1939, (ii) be subject to supervision or examination by federal or state authority and (iii) have a credit rating or be otherwise acceptable to the Rating Agencies such that neither of the Rating Agencies would reduce their respective then current ratings of the Certificates (or have provided such security from time to time as is sufficient to avoid such reduction) as evidenced in writing by each Rating Agency. If such corporation or association publishes reports of condition at least annually, pursuant to law or to the requirements of the aforesaid supervising or examining authority, then for the purposes of this Section the combined capital and surplus of such corporation or association shall be deemed to be its combined capital and surplus as set forth in its most recent report of condition so published. In case at any time the Trustee shall cease to be eligible in accordance with the provisions of this Section, the Trustee shall resign immediately in the manner and with the effect specified in Section 8.08.
