Orange County NC Website
Browse       Search
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9 <br /> suspected data breaches? <br /> AutoMon is obligated to notify the County in the event of a data breach. The Cloud <br /> Provider, Microsoft Government Azure, is obligated to notify AutoMon. In addition, both <br /> AutoMon and Microsoft are required to comply with applicable law. <br /> 7. Is the Cloud provider obligated to inform the County of all locations in which the data is <br /> stored (including backups) and to continually keep the County informed of any changes <br /> to those locations? <br /> If No, Explain: AutoMon runs Ce Pretrial on Microsoft Government Azure. Under the <br /> terms and conditions of its operating agreement with its US Federal, State and Local <br /> customers, data is stored in data centers within the United States only. Movement of data <br /> storage within its US based data centers is handled by Microsoft and reflects operating <br /> exigencies required to efficiently serve its customers. <br /> 8. What are the Cloud provider's contractual obligations with respect to litigation holds on <br /> County data? <br /> Microsoft is subject to the jurisdiction of the courts of the United States and is obligated <br /> to comply with judicial orders. <br /> 9. What are the Cloud provider's contractual prohibitions on disclosing data to individuals, <br /> groups or organizations making record requests, unless so directed by an authorized <br /> County official? <br /> See Master Subscription Agreement for language describing confidentiality of the <br /> customers' data. Microsoft is subject to the jurisdiction of the courts of the United States <br /> and is obligated to comply with judicial orders. <br /> 10. Does the contract obligate the Cloud provider to allow third-party audits and/or <br /> certifications related to infrastructure and security, including penetration testing and <br /> vulnerability assessment, as requested by the County? <br /> If No, Explain: Microsoft performs third party audits and obtains certifications,both of <br /> which are publicly available upon request. <br /> 11. Does the contract obligate the Cloud provider to allow third party onsite inspections of <br /> the Cloud provider's infrastructure and security practices on a specified basis? <br /> (1101o, 1H .l.m.. <br /> If No, Explain: See answer to Question 10. <br /> 12. Does the contract obligate the Cloud provider to provide security documentation upon <br /> request by the County? <br /> Yes. Microsoft's security documentation is generally publicly available and may be <br /> requested by AutoMon on behalf of the County. <br /> If No, Explain: a' II u l 11c.n V V .t <br />