Information Technology Policy Manual 2022

• Documents containing confidential data should only be printed when there is a legitimate business need and should not be left unattended on a printer • Copies of confidential data must be limited to individuals authorized to access the data • Documents containing confidential data cannot be transmitted via e-mail unless encrypted

23. To ensure that the City’s data and infrastructure are protected while under contract, the third-party shall comply with the following information security requirements: • The third-party shall strive to identify vulnerabilities, risks and threats, take all actions necessary to protect the City of Greensboro information regarding security issues and help limit the likelihood that vulnerabilities in systems and applications are exposed • The third-party shall complete the City of Greensboro “Service Provider Information Security Questionnaire” and engage with the City of Greensboro Information Security Personnel to review the completed questionnaire. If deemed necessary, the City of Greensboro shall conduct security scans against the application, software or service. If critical security issues are identified after reviewing the security questionnaire and/or conducting the security scans, the third-party shall resolve these issues as quickly as possible. • The City of Greensboro shall not use the application, software or service until all critical security issues has been resolved. • If the third-party experiences a data breach that impacts the City of Greensboro’s information, the third-party shall notify the City of Greensboro as quickly as possible so that certain measures can be taken to limit the impact of such a breach. N ON- C OMPLIANCE The third-party agrees to indemnify the City for any and all loss that the City suffers as a result of the third-party’s failure to comply with the terms and conditions of this policy. Notwithstanding the third party’s agreement to indemnify the City, the City may pursue any civil and/or criminal remedies to recover any loss suffered by the City as a result of the third-party’s non-compliance with any of the terms and conditions of this policy. The venue for any legal action will be in Greensboro, Guilford County, North Carolina.

7 3

GSO-TPAP-002