Test Third Party

• Get a written statement from the third party that any software created and/or installed by the third-party is free of viruses and any other malicious code 22. Third-party must comply with the handling of confidential data belonging to the City in the following manner: • Access to confidential data must be granted by City of Greensboro designated employees. Viewing and modification of confidential data must be restricted to authorized individuals only • Documents containing confidential data should only be printed when there is a legitimate business need and should not be left unattended on a printer or anywhere else • Copies of confidential data must be limited to individuals authorized to access the data • Documents containing confidential data cannot be transmitted via e-mail unless encrypted 23. To ensure that the City’s data and infrastructure are protected while under contract, the third party shall comply with the following information security requirements: • The third party shall strive to identify vulnerabilities, risks and threats, take all actions necessary to protect the City of Greensboro information regarding security issues and help limit the likelihood that vulnerabilities in systems and applications are exposed • The third party shall complete the City of Greensboro “Service Provider Information Security Questionnaire” and engage with the City of Greensboro Information Security Personnel to review the completed questionnaire. If deemed necessary, the City of Greensboro shall conduct security scans against the application, software or service. If critical security issues are identified after reviewing the security questionnaire and/or conducting the security scans, the third party shall resolve these issues as quickly as possible • The City of Greensboro shall not use the application, software or service until all critical security issues has been resolved • If the third party experiences a data breach that impacts the City of Greensboro’s information, the third party shall notify the City of Greensboro immediately or as quickly as possible so that certain measures can be taken to limit the impact of such a breach

Third Party Access Policy

7