Agenda 12-04-23; 8-f - End Point Protection – Managed Detection Response CrowdStrike Contract Renewal

Browse Search

29 b. Suspicious/Unknown File Analysis. While using certain CrowdStrike Offerings Customer may have the option to upload (by submission, configuration, and/or, in the case of Services, by CrowdStrike personnel retrieval) files and other information related to the files for security analysis and response or, when submitting crash reports, to make the product more reliable and/or improve CrowdStrike's products and services or enhance cyber-security. These potentially suspicious or unknown files may be transmitted and analyzed to determine functionality and their potential to cause instability or damage to Customer's endpoints and systems. In some instances, these files could contain Personal Data for which Customer is responsible. 4. Compliance with Privacy and Information Security Requirements a. Compliance with Laws. CrowdStrike shall comply with all Privacy and Security Laws, the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use,and retention of Personal Data from the European Economic Area, Switzerland, and the United Kingdom, as applicable. CrowdStrike's privacy notice may be found at http://www.crowdstrike.com/privacy-notice/. To the extent necessary to comply with Privacy and Security Laws, including but not limited to when Customer is a controller of Personal Data processed by CrowdStrike originating in the European Union, Switzerland, or the United Kingdom, the Data Protection Addendum set forth here https://www.crowdstrike.com/data-protection-agreement/ shall apply to CrowdStrike's processing of such Customer Personal Data. b. Safeguards. CrowdStrike shall maintain appropriate technical and organizational safeguards commensurate with the sensitivity of the Customer Data and Personal Data processed by it on Customer's behalf, which are designed to protect the security, confidentiality, and integrity of such Customer Data and Personal Data and protect such Customer Data and Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, including the safeguards set forth on Appendix 1 which substantially conform to the ISO/IEC 27002 control framework. ("Information Security Controls for CrowdStrike Systems"). c. Access; Contacts. With respect to employees, agents, and subcontractors, CrowdStrike shall limit access to Customer Data and Personal Data to only those employees, agents, and subcontractors who have a need to access the Customer Data and/or Personal Data in order to carry out their roles as contemplated in the terms of this Agreement. CrowdStrike shall assign and train personnel who shall: (i) liaise with customers regarding any issues concerning the security of Customer Data and/or Personal Data; (ii) receive notice of any Security Breach discovered by CrowdStrike and provide notice of any such Security Breach to Customer; and (iii) coordinate CrowdStrike's Security Breach response and remedial action. 5. Security Breach Response In the event CrowdStrike discovers a Security Breach, CrowdStrike shall: a. Without undue delay but no later than 72 hours of becoming aware, notify Customer of the discovery of the Security Breach. Such notice shall summarize the known circumstances of the Security Breach and the corrective action taken or to be taken by CrowdStrike. b. Conduct an investigation of the circumstances of the Security Breach. c. Use commercially reasonable efforts to remediate the Security Breach. d. Use commercially reasonable efforts to communicate and cooperate with Customer concerning its response to the Security Breach. 6. Security Assessment and Provision of Audited Security Controls. Promptly after written (including email) request from Customer, CrowdStrike shall provide Customer with: (i) its most recent SOC II, Type 2 report regarding the CrowdStrike Systems; and (ii) provide its completed Standardized Information Gathering (SIG) questionnaire (or similar document) for the CrowdStrike Systems (the "Security Documentation"). Upon the provision of reasonable notice to CrowdStrike, once every twelve months during the term of the Agreement and during normal business hours unless otherwise decided by CrowdStrike in its sole discretion, CrowdStrike shall make appropriate CrowdStrike personnel reasonably available to Customer to discuss CrowdStrike's manner of compliance with applicable security obligations under this Agreement. In advance of such discussion, CrowdStrike may, in addition to the Security Documentation, provide Customer with access to additional requested information or documentation concerning CrowdStrike's information security practices as they relate to this Agreement, including without limitation, access to any security assessment reports designed to be shared with third parties. Any information or documentation provided pursuant to this assessment process or otherwise pursuant to this Schedule shall be considered CrowdStrike's Confidential Information and subject to the Confidentiality section of the Agreement. CrowdStrike Form May 27 2019 14 of 17