Fort Walton Beach Resolution — 2026-09 Accepting Funding FL Department of Managed Services-Cybersecurity Software — reading text

disclose the Covered Data. C. Authorized Third Party — An individual, state agency, other Florida state or local governmental entity, or a private sector contractor or service provider of the Grantee which receives Covered Data. D. Authorized User —An individual granted Access or to use Software Entitlement by either FADS] or Grantee. E. County and Municipality Cybersecurity Technical Assistance Program (" the Program") —refers to the grant program established by the 2025-2026 General Appropriations Act to enhance county and municipal cybersecurity and protect the infrastructure of local governments from threats. F. Covered Data — The limited subset of security data that is derived from Grantee' s use of any Software Entitlements as defined in the attached Rider(s); a Grantee's confidential or proprietary information; and personal information as defined under section 501. 171, F. S., and any other applicable privacy or data breach notification laws as may exist. G. Data Breach — Either ( 1) any unauthorized access to, or use or disclosure of, Covered Data for any purpose other than as expressly permitted by this DSA or required by law; or (2) a breach of privacy or of the security of the Covered Data. Good faith access of data by an employee or agent of the Grantee does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use. H. DSA Coordinators — The individuals appointed by the signatories to this DSA as the point of contact for this DSA, who are responsible for ensuring that the Authorized Users comply with the activities identified herein. I. HIPAA - Health Insurance Portability and Accountability Act of 1996. J. Information Technology ( IT) Coordinators — The individuals appointed by the signatories to this DSA as responsible for data flow and other technology -related considerations under this DSA. K. Information Technology Resources —As defined in section 282. 0041, Florida Statutes, the data processing hardware and software and services, communications, supplies, personnel, facility Page 24 of 37  ATTACHMENT C GRANTEE DATA SHARING AGREEMENT resources, maintenance, and training. As used in this DSA, the term also includes the definition for "Information Technology," as defined in section 282. 0041, Florida Statutes, to add equipment, hardware, software, firmware, programs, systems, networks, infrastructure, media, and related material used to automatically, electronically, and wirelessly collect, receive, access, transmit, display, store, record, retrieve, analyze, evaluate, process, classify, manipulate, manage, assimilate, control, communicate, exchange, convert, converge, interface, switch, or disseminate information of any kind or form. A. Software Entitlement — Proprietary software provided to the Grantee under the Agreement to satisfy provision of the solution( s) awarded to the Grantee, as identified in Attachment A —Solution Statement of Work. Responsibilities of the Parties A. Data Transmission. Covered Data shall only be transmitted through secure file transfer protocol or other secure transmission methods utilizing a National Institute of Standards and Technology approved means of electronic encryption as well as password protection and in a file format and layout determined by FL[ DS]. Covered Data shall not be transmitted via any other means, including electronic mail. If applicable to any transmission of the Covered Data, both transmitting and receiving Grantee shall completely and permanently remove Covered Data from any temporary transfer location within twenty-four (24) hours of receipt of the Covered Data. B. Compliance with Applicable Laws. Each Party covenants and agrees that, in the performance of this DSA, it shall comply with all applicable federal, state, and local laws, statutes, and regulations including, but not limited to, such laws set forth in Article VI as applicable to a Project and such other data privacy or security laws, all as they exist now and as they may be amended from time to time (" Applicable Laws"). In the event of any notice of a material violation of Applicable Laws, or an investigation into an alleged material violation, the affected Party shall promptly notify the other in writing of such notice. The Parties further agree to follow and be bound by the terms and conditions of any policy decisions or directives from the federal and state agencies with jurisdiction over the use of the data described herein upon receipt of written notice directing that such rules, policy decisions, or directives apply to this DSA. C. HIPAA Business Associate Agreement. To the extent that a Party is acting as a Business Associate ( as defined by HIPAA) of the other Party, the Parties further agree to enter into a Business Associate Agreement as necessary, in the form of a mutually agreed- upon appendix to the DSA. D. Incorporation and Compliance with Exhibits, Appendices and Riders, if Applicable. The Project Riders, and any exhibits or appendices to this DSA are hereby incorporated and made a part hereof and are an integral part of this DSA. Each Rider, Exhibit, and Appendix attached hereto or referred to herein are hereby incorporated in and made a part of this DSA as if set forth in full herein. II. FL[ DS] Role and Responsibilities A. FL[ DS] is responsible for: 1. Processing Covered Data in accordance with the State Cybersecurity Act; Page 25 of 37  2. Facilitating data sharing with the Grantee and/ or an Authorized Third Party in accordance with this DSA; 3. Providing the Grantee with the option to utilize Software Entitlements; and 4. Protecting the integrity of Covered Data obtained by FL[ DS] through Grantee' s use of any of the Software Entitlements. FL[ DS] will not disclose this Covered Data to any third party unless required by law or as otherwise authorized by Grantee. B. FL[ DS] will only access, use, or disclose Covered Data, as permitted by Grantee, as required by Applicable Law, or as necessary for completion of its responsibilities under this DSA, including any Project Riders. FL[ DS] will ensure that its Authorized Users only access, use, or disclose Covered Data, as permitted by Grantee, as required by Applicable Law, or as necessary for completion of its responsibilities for any Projects, as assigned by FL[ DS]. C. FL[ DS] will exercise reasonable care and no less than the same degree of care FL[ DS] uses to protect its own confidential information to prevent confidential information from being used in a manner that is not expressly a purpose authorized in this DSA or as required by Applicable Law. III. Grantee' s Role and Responsibilities A. Covered Data is and shall remain the property of Grantee. B. Grantee is solely responsible for its Access to and use of Software Entitlements and Covered Data, including: 1. Ensuring a level of security appropriate to the risk in respect of Covered Data; 2. Securing Grantee' s and its Authorized Users' systems and devices that can Access FL[ DS] systems and Software Entitlements and complying with the Security Standards; 3. Selecting and/ or ensuring that Grantee has selected its Authorized Users; activating and deactivating the Access, credentials, and privileges of its Authorized Users; and managing access controls to the FL[ DS] system and Software Entitlements in a timely manner in accordance with the Security Standards; 4. Securing the account authentication credentials, systems, and devices of Grantee personnel who the Grantee designates to be Authorized Users; 5. Managing the compliance of its Authorized Users with the Grantee' s established security measures and as required by Applicable Law; 6. Maintaining audit logs, as deemed necessary by the Grantee to demonstrate compliance with its obligations under this DSA; 7. Backing up Covered Data, if required by law or Grantee policy; and 8. Ensuring that it and its Authorized Users remain in compliance with the terms and conditions of any Software Entitlements. C. FL[ DS] is not responsible for, and has no obligation for: Page 26 of 37  ATTACHMENT C GRANTEE DATA SHARING AGREEMENT 1. Selecting or verifying Grantee' s Authorized Users, activating or deactivating the Access or credentials of Authorized Users; or 2. Protecting Covered Data that Grantee elects to store or transfer outside of FL[ DS]' s and its sub -processors' systems ( for example, offline or on -premises storage). Unauthorized Disclosure/ Data Breach A. In the event of a Data Breach of the Covered Data while in Grantee' s ( or an Authorized Third Party's) custody or control or as a result of Grantee' s ( or an Authorized Third Party' s) access to or use of the Covered Data, which requires the provision of notice in accordance with section 501. 171, F. S., or other Applicable Law ( including, but not limited to, HIPAA), the Parties agree as follows: 1. Grantee shall notify FL[ DS] of the Data Breach not more than 24 hours after discovery that a Data Breach has occurred or is reasonably likely to have occurred. 2. Grantee ( or its Authorized Third Party) shall be responsible for all costs related to the Data Breach including FL[ DS]' and/ or Grantee' s ( or an Authorized Third Party' s) costs of complying with all legal requirements, including the requirements for Data Breach notification under Applicable Law, as well as defending any claims, actions, or lawsuits related thereto. 3. If a Data Breach is subject to the notice provisions of section 501. 171, F. S., or Applicable Law, the Parties agree to cooperate and work together to ensure full legal compliance and to provide breach notification to the extent required by Applicable Law. Grantee shall use its best and diligent efforts to identify the individuals entitled to receive notice of the Data Breach and obtain the names and mailing information of such individuals, so that FL[ DS] and/ or Grantee are able to distribute the notices within the legally required time periods. FL[ DS] and/ or Grantee, as applicable, shall bear its