B-2 Article X Subcontractor Cyber Security Requirements

Article X - Subcontractor Cyber Security Requirements
Subcontractor agrees to handle data and other information ("Data") with a standard of care at least as rigorous as that specified in the University's Minimum Security Standards, located at https://minsec.stanford.edu ("Guidelines"), which are hereby incorporated by reference into the Agreement. Prior to performing Services which require access to, transmission of, and/or storage of the University's Moderate or High Risk Data, as defined in the Guidelines, Subcontractor will provide a third party certification (https://uit.stanford.edu/security/asp) verifying its ability to comply with the Guidelines. Subcontractor will not copy, cause to be copied, use or disclose Data received from or on behalf of the University except as permitted or required by the Agreement, as required by law, or as otherwise authorized by the University in writing. Subcontractor will give immediate notice to the University of any actual or suspected unauthorized disclosure of, access to or other breach of the Data. In the event of actual or suspected unauthorized disclosure of, access to, or other breach of the Data, Subcontractor will comply with all state and federal laws and regulations related to such breach, and will cooperate with the University in fulfilling its legal obligations. Subcontractor will indemnify the University for its violation of this paragraph, including but not limited to the cost of providing appropriate notice to all required parties and credit monitoring, credit rehabilitation, or other credit support services to individuals with information impacted by the actual or suspected breach. Upon termination or expiration of the Agreement, Subcontractor will return or, at the University's election, destroy, the Data within 30 days from the conclusion of the Agreement. This paragraph and its indemnity will survive the termination of the Agreement.