Common use of SECURE PROTECTION AND HANDLING OF STATE DATA Clause in Contracts

SECURE PROTECTION AND HANDLING OF STATE DATA. If Contractor is given access to State Data, the protection of State Data shall be an integral part of the business activities of Contractor, and Contractor shall ensure that there is no inappropriate or unauthorized use of State Data. Contractor shall safeguard the confidentiality, integrity, and availability of the State Data and comply with the conditions outlined below. The Eligible User reserves the right to verify Contractor’s adherence to the following conditions to ensure they are met: Network Security: Contractor shall maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third-party penetration testing. Contractor shall maintain network security and ensure that Contractor network security policies conform to one of the following: Those standards the State of Utah applies to its own network, found outlined in DTS Policy 5000-0002 Enterprise Information Security Policy; Current standards set forth and maintained by the National Institute of Standards and Technology, includes those at: xxxx://xxxxxxx.xxxx.xxx/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf; or Any generally recognized comparable standard that Contractor then applies to its own network and pre-approved by the Eligible User in writing. State Data Security: Contractor shall protect and maintain the security of State Data with protection that is at least as good as or better than that maintained by the State of Utah which will be provided by an Eligible User upon Contractor’s request (DTS Policy 5000-0002). These security measures included but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification). The Eligible User reserves the right to determine if Contractor’s level of protection meets the Eligible User’s security requirements. State Data Transmission: Contractor shall ensure all transmission or exchange of system application data with the Eligible User and State of Utah and/or any other parties expressly designated by the State of Utah, shall take place via secure means (ex. HTTPS or FTPS).