Specifications
Page 6 of 15
Solicitation XXX – Appendix _ - Sample Contract
Service Provided
Location
OGS reserves the right to reject any request for renewal, extension, or assignment for an entity
that appears on the Prohibited Entities List prior to the renewal, extension, or assignment of the
Contract, and to pursue a responsibility review with Contractor should it appear on the
Prohibited Entities List hereafter.
21. INFORMATION SECURITY BREACH
In accordance with the Information and Security Breach Notification Act (ISBNA) (Chapter 442
of the Laws of 2005, as amended by Chapter 491 of the Laws of 2005), a Contractor with OGS
shall be responsible for all applicable provisions of the ISBNA and the following terms herein
with respect to any private information (as defined in the ISBNA) received by or on behalf of
OGS under this Agreement.
Contractor shall supply OGS with a copy of its notification policy, which shall be modified
to be in compliance with this provision, as well as OGS’s notification policy.
Contractor must encrypt any database fields and backup tapes that contain private data
elements, as set forth in the ISBNA.
Contractor must ensure that private data elements are encrypted in transit to / from their
systems.
In general, contractor must ensure that private data elements are not displayed to users
on computer screens or in printed reports; however, specific users who are authorized to
view the private data elements and who have been properly authenticated may
view/receive such data.
Contractor must monitor for breaches of security to any of its systems that store or
process private data owned by OGS.
Contractor shall take all steps as set forth in ISBNA to ensure private information shall
not be released without authorization from OGS.
In the event a security breach occurs as defined by ISBNA Contractor shall immediately
notify OGS and commence an investigation in cooperation with OGS to determine the
scope of the breach.
Contractor shall also take immediate and necessary steps needed to restore the
information security system to prevent further breaches.
Contractor shall immediately notify OGS following the discovery that OGS’s system
security has been breached.
Unless the Contractor is otherwise instructed, Contractor is to first seek consultation and
receive authorization from OGS prior to notifying the individuals whose personal identity