Common use of Security Breach Notification Clause in Contracts

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and CJB3222-A1 Page 11 of 13 March 27, 2024 other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 Xxxxxx.Xxxxxxxx@xxxx.xxxxx.xxx Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 Xxxxx.Xx@xxxx.xxxxx.xxx County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 714-541-7785 Xxxxx.Xx@xxx.xxxxx.xxx

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or CPS0221-03-A4 Page 4 of 7 April 17, 2024 suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 CPS0221-03-A4 Page 5 of 7 April 17, 2024

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorneys fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Xxxxxx Xxxxxxx Chief Information Security Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 E-mail: Xxxxxx.xxxxxxx@xxxx.xxxxx.xxx Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence amaterial breach within 48hrs of discovery and perform a root aroot cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, that is causedsolelyby the Contractor’s acts, errors or omissions, negligence, and/or misconduct, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorneys fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Xxxxxx Xxxxxxx Chief Information Security Officer 0000 X. Xxxx Xx, 0xx Xxxxx Santa Ana, CA 92701 Office: (000) 000-0000 E-mail: DocuSign Envelope ID: 2464DB96-258B-4365-A0E3-C78AF6EEDFF7 Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or CPS0221-01-A4 Page 4 of 7 April 17, 2024 suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 CPS0221-01-A4 Page 5 of 7 April 17, 2024

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorneys fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxx Xx, CHPC, CHC, CHP Xxxxxx Xxxxxxx County Privacy Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Chief Information Security Officer 0000 X. Xxxx Xx, 0xx Xxxxx Santa Ana, CA 92701 Office: (000) 000-0000 E-mail: Xxxxxx.xxxxxxx@xxxx.xxxxx.xxx Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of or has access to each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. DocuSign Envelope ID: 32AC7F38-40B4-4FD7-9103-57D01A9AA5C7 In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorneys fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Xxxxxx Xxxxxxx Chief Information Security Officer 0000 X. Xxxx Xx, 0xx Xxxxx Santa Ana, CA 92701 Office: (000) 000-0000 E-mail: Xxxxxx.xxxxxxx@xxxx.xxxxx.xxx Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of or has access to each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or CPS0221-05-A1 Page 4 of 7 April 17, 2024 suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 CPS0221-05-A1 Page 5 of 7 April 17, 2024

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or CPS0221-02-A4 Page 4 of 7 April 17, 2024 suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 CPS0221-02-A4 Page 5 of 7 April 17, 2024

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident within Contractor’s environment including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the CountyHCA’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorneys fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Santa Ana, CA 92701 Office: (000) 000-0000 E-Mail: xxxxxxxxxxxx@xxxxx.xxx XxxxxxxxXxxxxxxxx@xxxxx.xxx Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the securityor, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (within 24 hours) ), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and a material breach within 48 hrs of discovery. (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrence, breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County)occurrence. County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, that is caused by Contractor’s acts, errors or omissions, negligence, and/or misconduct. Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. MA-063-23011212-A1 Page 12 of 14 April 3, 2024 Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 Xxxxxx.Xxxxxxxx@xxxx.xxxxx.xxx Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 Xxxxx.Xx@xxxx.xxxxx.xxx County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately promptly (within 24 hours) but in no event more than 48 hours from the reasonably suspected or confirmed breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, information and other materials required to comply with applicable law or as otherwise reasonably required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County)occurrence. DocuSign Envelope ID: 8F724B0D-AE39-4CD0-9970-9DCE16C2EE82 County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs for legally required notifications incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct other than in accordance with the terms of the Contract resulting in a requirement for legally required notifications. Notification shall be sent to: Xx Xxxxxx Assistant Chief Information Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reasonably reimburse County for all notification related costs (all such reasonable costs shall be negotiated and agreed upon by the Parties) incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications.. County Privacy Officer 0000 X. Xxxx Xxxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx Xxxxxx Xxxxxxx Chief Information Security Officer 0000 X. Xxxx Xxxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 E-mail: Xxxxxx.xxxxxxx@xxxx.xxxxx.xxx

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, confidentiality, or integrity of County Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the security, confidentiality, or integrity of County Data, Contractor shall, at its own expense, (1) immediately (within 24 hours) notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and perform a root cause analysis thereon, (2) investigate such occurrence, (3) provide a remediation plan, acceptable to County, to address the occurrence and prevent any further incidents, (4) conduct a forensic investigation to determine what systems, data and information have been affected by such event, and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County persons, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of personally identifiable information, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. In addition to indemnity obligations set forth elsewhere in this Contract, Contractor shall indemnify, defend and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxx Chief Information Security Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 E-mail: Xxxxxx.xxxxxxx@xxxx.xxxxx.xxx Xxxxx Xx, CHPC, CHC, CHP County Privacy Officer 0000 X. Xxxx Xx, 0xx Xxxxx Xxxxx Xxx, XX 00000 Office: (000) 000-0000 Email: xxxxx.xx@xxxx.xxxxx.xxx xxxxxxxxxxxxx@xxxx.xxxxx.xxx Contractor shall, at all times, comply with and abide by all reasonable policies and procedures of County (or that may be established thereby, from time to time) that pertain to conduct on County’s premises, possession or distribution of contraband, or the access to, and security of, the Party’s real property or facilities, to the extent that Contractor has been provided with a copy of each such policy or procedure. Contractor shall exercise due care and diligence to prevent any injury to persons or damage to property while on the other Party’s premises. The operation of vehicles by either Party’s personnel on the other Party’s property shall conform to posted and other applicable regulations and safe-driving practices. Vehicular accidents occurring on a Party’s property and involving either Party’s personnel shall be reported promptly to the appropriate Party’s personnel. Each Party covenants that at all times during the Term, it, and its employees, agents, and subcontractors shall comply with, and take no action that results in the other Party being in violation of, any applicable federal, state, and local laws, ordinances, regulations, and rules. Each Party’s personnel shall clearly identify themselves as the appropriate Party’s personnel and not as employees of the other Party. When on the other Party’s premises, each Party’s personnel shall wear and clearly display identification badges or tags, as approved by the other Party.

Security Breach Notification. In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, or and/or integrity of County Data data or the physical, technical, administrative, or organizational safeguards put in place by Contractor required under this Contract that relate to the security, availability, confidentiality, or and/or integrity of County Datadata, Contractor shall, at its own expense, (1) immediately (or within 24 hours) hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence and occurrence; (2) perform a root cause analysis thereonof the actual, (2) investigate such occurrencepotential, or CPS0221-04-A1 Page 4 of 7 April 17, 2024 suspected breach; (3) provide a remediation plan, plan that is acceptable to CountyCounty within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents, ; (4) conduct a forensic investigation to determine what systems, data data, and information have been affected by such event, ; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County). County shall make the final decision on notifying County personsofficials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by the County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications. In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals. Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence. Xxxxxx Xxxxxxxx, MBA, CISSP Chief Information Security Officer 0000 X. Xxxx Xx., 0xx Xxxxx Santa Ana, CA 92701 Phone: (000) 000-0000 County Privacy Officer 0000 X. Xxxx Xx., 0xx Xxxxx Xxxxx Xxx, XX 00000 Phone: (000) 000-0000 County of Orange Social Services Agency Contracts Services 000 X. Xxxxx Xxxxxxx Xxxx, Xxxxx 000 Xxxxxx, XX 00000 CPS0221-04-A1 Page 5 of 7 April 17, 2024