{"component": "clause", "props": {"groups": [{"snippet_links": [{"key": "the-provision-of-the-services", "type": "clause", "offset": [38, 67]}], "size": 2, "samples": [{"hash": "8jAwBMjxuX6", "uri": "/contracts/8jAwBMjxuX6#cloud-storage", "label": "Client Services Terms and Conditions", "score": 34.2779808044, "published": true}, {"hash": "eCsHTSTleOi", "uri": "/contracts/eCsHTSTleOi#cloud-storage", "label": "Client Services Terms and Conditions", "score": 33.9923057556, "published": true}], "snippet": "We utilise cloud storage providers in the provision of the Services", "hash": "cd3275140fa3ab62c608c77d50bffec2", "id": 7}, {"snippet_links": [{"key": "county-confidential-information", "type": "definition", "offset": [5, 36]}, {"key": "equal-to", "type": "definition", "offset": [58, 66]}, {"key": "this-exhibit", "type": "definition", "offset": [116, 128]}, {"key": "storage-of-data", "type": "clause", "offset": [136, 151]}, {"key": "the-county", "type": "clause", "offset": [184, 194]}, {"key": "the-environment", "type": "clause", "offset": [231, 246]}, {"key": "the-data", "type": "clause", "offset": [256, 264]}, {"key": "county-data", "type": "clause", "offset": [305, 316]}, {"key": "cloud-solution", "type": "definition", "offset": [358, 372]}, {"key": "written-procedures", "type": "definition", "offset": [440, 458]}, {"key": "in-place", "type": "clause", "offset": [459, 467]}, {"key": "and-the-contractor", "type": "clause", "offset": [507, 525]}, {"key": "in-writing", "type": "clause", "offset": [534, 544]}, {"key": "at-all-times", "type": "definition", "offset": [764, 776]}, {"key": "the-contractor-will", "type": "clause", "offset": [831, 850]}, {"key": "decryption-key", "type": "definition", "offset": [861, 875]}, {"key": "contractor-and-or", "type": "clause", "offset": [943, 960]}, {"key": "authorized-systems", "type": "definition", "offset": [1026, 1044]}, {"key": "authorized-user", "type": "definition", "offset": [1216, 1231]}, {"key": "cloud-storage-provider", "type": "definition", "offset": [1386, 1408]}, {"key": "the-requirements", "type": "clause", "offset": [1480, 1496]}, {"key": "protected-health-information", "type": "definition", "offset": [1605, 1633]}, {"key": "covered-by", "type": "definition", "offset": [1640, 1650]}, {"key": "cloud-provider", "type": "definition", "offset": [1662, 1676]}, {"key": "business-associate-agreement", "type": "clause", "offset": [1689, 1717]}, {"key": "prior-to", "type": "clause", "offset": [1718, 1726]}], "size": 2, "samples": [{"hash": "995e7BtZkct", "uri": "/contracts/995e7BtZkct#cloud-storage", "label": "Professional Services Agreement", "score": 33.3628540039, "published": true}, {"hash": "blUwdcqdU8h", "uri": "/contracts/blUwdcqdU8h#cloud-storage", "label": "Professional Services Agreement", "score": 33.3601722717, "published": true}], "snippet": "DSHS/County Confidential Information requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DSHS, the County, nor the Contractor have control of the environment in which the Data is stored. For this reason:\n9.8.1. DSHS/County Data will not be stored on any consumer grade Cloud solution, unless all of the following conditions are met:\na. Contractor has written procedures in place governing the use of the Cloud storage and the Contractor attests in writing that all such procedures will be uniformly followed\nb. The Data will be encrypted while within the Contractor network\nc. The Data will remain encrypted during transmission to the Cloud\ni. The Data will remain encrypted at all times while residing within the Cloud storage solution.\nii. The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or the County and DSHS.\niii. The Data will not be downloaded to non-authorized systems, meaning systems that are not either the County, DSHS or Contractor networks.\niv. The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within either the County, DSHS, or Contractor\u2019s network.\n9.8.2. Data will not be stored on an Enterprise Cloud storage solution unless either:\na. The Cloud storage provider is treated as any other Sub-Contractor and agrees in writing to all of the requirements within this exhibit, or\nb. The Cloud storage solution used is FedRAMP certified\n9.8.3. If the Data includes protected health information (PHI) covered by HIPPA, the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution.", "hash": "8d667b3209a57a91f15dc742bc4430a4", "id": 6}, {"snippet_links": [{"key": "dshs-confidential-information", "type": "definition", "offset": [0, 29]}, {"key": "equal-to", "type": "definition", "offset": [51, 59]}, {"key": "storage-of-data", "type": "clause", "offset": [132, 147]}, {"key": "the-contractor", "type": "definition", "offset": [183, 197]}, {"key": "the-environment", "type": "clause", "offset": [213, 228]}, {"key": "the-data", "type": "clause", "offset": [238, 246]}], "size": 7, "samples": [{"hash": "9Xfk8BfxZdR", "uri": "/contracts/9Xfk8BfxZdR#cloud-storage", "label": "Professional Services", "score": 32.5872764587, "published": true}, {"hash": "f7nkI5okXrX", "uri": "/contracts/f7nkI5okXrX#cloud-storage", "label": "Professional Services", "score": 32.5845413208, "published": true}, {"hash": "lNx99qfuRro", "uri": "/contracts/lNx99qfuRro#cloud-storage", "label": "Professional Services", "score": 31.5744514465, "published": true}], "snippet": "DSHS Confidential Information requires protections equal to or greater than those specified elsewhere within this Attachment. Cloud storage of Data is problematic as neither DSHS nor the Contractor has control of the environment in which the Data is stored. For this reason:", "hash": "2f36f180dd57f8f020d2956eb02642dd", "id": 3}, {"snippet_links": [{"key": "cloud-provider", "type": "definition", "offset": [8, 22]}], "size": 4, "samples": [{"hash": "l8qog0YiW3w", "uri": "/contracts/l8qog0YiW3w#cloud-storage", "label": "Data Sharing Agreement", "score": 33.0922431946, "published": true}, {"hash": "bJ0x7MUK7xp", "uri": "/contracts/bJ0x7MUK7xp#cloud-storage", "label": "Business Licensing Services Agreement", "score": 29.3636741638, "published": true}, {"hash": "adjWRGJ9gPa", "uri": "/contracts/adjWRGJ9gPa#cloud-storage", "label": "Business Licensing Services Agreement", "score": 27.9674434662, "published": true}], "snippet": "Use the cloud provider\u2019s procedures to permanently delete the files and folders.", "hash": "5b3c44c83da2b50065a3a74259410a49", "id": 5}, {"snippet_links": [{"key": "dshs-confidential-information", "type": "definition", "offset": [0, 29]}, {"key": "equal-to", "type": "definition", "offset": [51, 59]}, {"key": "this-exhibit", "type": "definition", "offset": [109, 121]}, {"key": "storage-of-data", "type": "clause", "offset": [129, 144]}, {"key": "the-environment", "type": "clause", "offset": [210, 225]}, {"key": "the-data", "type": "clause", "offset": [235, 243]}, {"key": "dshs-data", "type": "definition", "offset": [276, 285]}, {"key": "cloud-solution", "type": "definition", "offset": [327, 341]}, {"key": "written-procedures", "type": "definition", "offset": [410, 428]}, {"key": "in-place", "type": "clause", "offset": [429, 437]}, {"key": "in-writing", "type": "clause", "offset": [496, 506]}, {"key": "at-all-times", "type": "definition", "offset": [732, 744]}, {"key": "the-contractor-will", "type": "clause", "offset": [799, 818]}, {"key": "decryption-key", "type": "definition", "offset": [829, 843]}, {"key": "contractor-and-or", "type": "clause", "offset": [911, 928]}, {"key": "authorized-systems", "type": "definition", "offset": [978, 996]}, {"key": "authorized-user", "type": "definition", "offset": [1163, 1178]}, {"key": "cloud-storage-provider", "type": "definition", "offset": [1322, 1344]}, {"key": "the-requirements", "type": "clause", "offset": [1417, 1433]}, {"key": "protected-health-information", "type": "definition", "offset": [1542, 1570]}, {"key": "covered-by", "type": "definition", "offset": [1571, 1581]}, {"key": "health-insurance-portability-and-accountability-act", "type": "definition", "offset": [1586, 1637]}, {"key": "cloud-provider", "type": "definition", "offset": [1651, 1665]}, {"key": "business-associate-agreement", "type": "clause", "offset": [1678, 1706]}, {"key": "prior-to", "type": "clause", "offset": [1707, 1715]}], "size": 175, "samples": [{"hash": "k53vm2ZuwKF", "uri": "/contracts/k53vm2ZuwKF#cloud-storage", "label": "Professional Service Contract", "score": 36.3936767578, "published": true}, {"hash": "iFVk9LVwpYg", "uri": "/contracts/iFVk9LVwpYg#cloud-storage", "label": "Client Service Contract", "score": 36.1163253784, "published": true}, {"hash": "97O14Skvjxc", "uri": "/contracts/97O14Skvjxc#cloud-storage", "label": "Personal Service Contract", "score": 36.0951118469, "published": true}], "snippet": "DSHS Confidential Information requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DSHS nor the Contractor has control of the environment in which the Data is stored. For this reason:\n(1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met:\n(a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed.\n(b) The Data will be Encrypted while within the Contractor network.\n(c) The Data will remain Encrypted during transmission to the Cloud.\n(d) The Data will remain Encrypted at all times while residing within the Cloud storage solution.\n(e) The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DSHS.\n(f) The Data will not be downloaded to non-authorized systems, meaning systems that are not on either the DSHS or Contractor networks.\n(g) The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within either the DSHS or Contractor\u2019s network.\n(2) Data will not be stored on an Enterprise Cloud storage solution unless either:\n(a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to all of the requirements within this exhibit; or,\n(b) The Cloud storage solution used is FedRAMP certified.\n(3) If the Data includes protected health information covered by the Health Insurance Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution.", "hash": "3eafc7e5cab56d3080a694fb32ebec6b", "id": 1}, {"snippet_links": [{"key": "city-will", "type": "clause", "offset": [3, 12]}, {"key": "data-requirements", "type": "clause", "offset": [28, 45]}, {"key": "in-washington", "type": "clause", "offset": [46, 59]}, {"key": "securing-information-technology-assets", "type": "clause", "offset": [75, 113]}, {"key": "chief-information-officer", "type": "definition", "offset": [125, 150]}, {"key": "security-risk-assessment", "type": "definition", "offset": [196, 220]}, {"key": "asset-management-policy", "type": "definition", "offset": [298, 321]}, {"key": "media-sanitization", "type": "clause", "offset": [332, 350]}, {"key": "data-backup-and-recovery", "type": "clause", "offset": [383, 407]}, {"key": "data-at-rest", "type": "clause", "offset": [493, 505]}, {"key": "access-to-the", "type": "clause", "offset": [534, 547]}, {"key": "cloud-environment", "type": "definition", "offset": [548, 565]}, {"key": "unique-user", "type": "definition", "offset": [573, 584]}, {"key": "complex-password", "type": "definition", "offset": [592, 608]}, {"key": "authentication-method", "type": "definition", "offset": [634, 655]}, {"key": "provider-data", "type": "definition", "offset": [707, 720]}, {"key": "organization-control", "type": "clause", "offset": [759, 779]}, {"key": "type-ii", "type": "clause", "offset": [788, 795]}, {"key": "risk-management-program", "type": "clause", "offset": [824, 847]}, {"key": "certified-solution", "type": "clause", "offset": [858, 876]}], "size": 1, "samples": [{"hash": "l8qog0YiW3w", "uri": "/contracts/l8qog0YiW3w#cloud-storage", "label": "Data Sharing Agreement", "score": 33.0922431946, "published": true}], "snippet": "a. City will meet Cloud and Data requirements in Washington\u2019s Standard for Securing Information Technology Assets, Office of Chief Information Officer (OCIO) Standard 141.10, WaTech\u2019s Information Security Risk Assessment Standard, WaTech\u2019s Encryption Standard, WaTech\u2019s Firewall Standard, WaTech\u2019s Asset Management Policy, WaTech\u2019s Media Sanitization and Disposal Standard, WaTech\u2019s Data Backup and Recovery Standard\nb. City will, at a minimum, meet the following requirements:\nI. Encrypt the Data at rest and in transit.\nII. Control access to the cloud environment with a unique user ID and complex password, passphrase, or stronger authentication method such as a physical token or biometrics.\nIII. Cloud provider Data center(s) and systems must be Service Organization Control (SOC) 2 Type II certified, and/or a Federal Risk Management Program (FedRAMP) certified solution.", "hash": "11687457e4461969dfeadaade34440a6", "id": 8}, {"snippet_links": [{"key": "equal-to", "type": "definition", "offset": [26, 34]}, {"key": "this-exhibit", "type": "definition", "offset": [84, 96]}, {"key": "storage-of-data", "type": "clause", "offset": [104, 119]}, {"key": "the-contractor", "type": "definition", "offset": [155, 169]}, {"key": "the-environment", "type": "clause", "offset": [185, 200]}, {"key": "the-data", "type": "clause", "offset": [210, 218]}, {"key": "cloud-solution", "type": "definition", "offset": [297, 311]}, {"key": "written-procedures", "type": "definition", "offset": [380, 398]}, {"key": "in-place", "type": "clause", "offset": [399, 407]}, {"key": "in-writing", "type": "clause", "offset": [466, 476]}], "size": 6, "samples": [{"hash": "8vHIXAGXr0r", "uri": "/contracts/8vHIXAGXr0r#cloud-storage", "label": "Interlocal Agreement", "score": 31.611913681, "published": true}, {"hash": "iS5saBzvxfK", "uri": "/contracts/iS5saBzvxfK#cloud-storage", "label": "Interlocal Agreement", "score": 25.4852848053, "published": true}, {"hash": "4UQQsv0GE6I", "uri": "/contracts/4UQQsv0GE6I#cloud-storage", "label": "Interlocal Agreement", "score": 25.4852848053, "published": true}], "snippet": "Data requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DCYF nor the Contractor has control of the environment in which the Data is stored. For this reason:\n(1) Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met:\n(a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed;\n(b) The Data will be Encrypted while within the Contractor network; (c). The Data will remain Encrypted during transmission to the Cloud;", "hash": "b05d837abe2176436f8c15249557610e", "id": 4}, {"snippet_links": [{"key": "confidential-data", "type": "clause", "offset": [8, 25]}, {"key": "the-data", "type": "clause", "offset": [55, 63]}, {"key": "cloud-provider", "type": "definition", "offset": [111, 125]}, {"key": "encryption-keys", "type": "clause", "offset": [184, 199]}, {"key": "the-contractor", "type": "definition", "offset": [224, 238]}, {"key": "contractor-will", "type": "clause", "offset": [240, 255]}, {"key": "responsible-for", "type": "clause", "offset": [259, 274]}, {"key": "providing-the", "type": "clause", "offset": [275, 288]}, {"key": "security-office", "type": "definition", "offset": [306, 321]}, {"key": "technical-controls", "type": "clause", "offset": [392, 410]}, {"key": "dshs-data", "type": "definition", "offset": [460, 469]}, {"key": "hipaa-data", "type": "clause", "offset": [510, 520]}, {"key": "business-associates-agreement", "type": "clause", "offset": [529, 558]}, {"key": "prior-to", "type": "clause", "offset": [600, 608]}], "size": 1, "samples": [{"hash": "bpEt1ink69h", "uri": "/contracts/bpEt1ink69h#cloud-storage", "label": "Personal Service Contract", "score": 25.7464828491, "published": true}], "snippet": "If DSHS Confidential data will be stored in the cloud, the data must be encrypted at rest and transit, and the cloud provider must not possess the key(s) required to decrypt the data. Encryption keys must be held by DSHS or the Contractor. Contractor will be responsible for providing the DSHS Information Security Office with a comprehensive enumeration of the administrative, physical, and technical controls used by the cloud provider to securely store the DSHS data. If the DSHS Confidential data includes HIPAA data, then a Business Associates Agreement must be executed with the cloud provider prior to storage of the data with the cloud provider.", "hash": "6442a9a912a61e59765b43ba754b9939", "id": 9}, {"snippet_links": [{"key": "county-information-assets", "type": "clause", "offset": [91, 116]}, {"key": "written-authorization", "type": "definition", "offset": [143, 164]}, {"key": "the-cloud-service", "type": "clause", "offset": [194, 211]}, {"key": "by-county", "type": "clause", "offset": [212, 221]}], "size": 18, "samples": [{"hash": "6VPwcAY7RT1", "uri": "/contracts/6VPwcAY7RT1#cloud-storage", "label": "Subaward Agreement", "score": 26.3442840576, "published": true}, {"hash": "kNnxw9MO2Jf", "uri": "/contracts/kNnxw9MO2Jf#cloud-storage", "label": "Subaward Agreement", "score": 26.2197132111, "published": true}, {"hash": "4tWuHjSVzC8", "uri": "/contracts/4tWuHjSVzC8#cloud-storage", "label": "Subaward Agreement", "score": 26.0869274139, "published": true}], "snippet": "9.17.15.1 Subrecipient and its Lower Tier Subrecipient(s) may not utilize cloud storage of County Information Assets without the prior express written authorization of County, after a review of the cloud service by County or its designee(s).", "hash": "871dde7ae17693a50b4687c645a2794b", "id": 2}, {"snippet_links": [{"key": "equal-to", "type": "definition", "offset": [26, 34]}, {"key": "this-exhibit", "type": "definition", "offset": [84, 96]}, {"key": "storage-of-data", "type": "clause", "offset": [104, 119]}, {"key": "the-contractor", "type": "definition", "offset": [155, 169]}, {"key": "the-environment", "type": "clause", "offset": [185, 200]}, {"key": "the-data", "type": "clause", "offset": [210, 218]}], "size": 1, "samples": [{"hash": "hoZ9dx2bEzV", "uri": "/contracts/hoZ9dx2bEzV#cloud-storage", "label": "Interlocal Agreement", "score": 25.3839836121, "published": true}], "snippet": "Data requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DCYF nor the Contractor has control of the environment in which the Data is stored. For this reason:", "hash": "615ebbb975a4fec900b639c3017d8a11", "id": 10}], "next_curs": "ClYSUGoVc35sYXdpbnNpZGVyY29udHJhY3RzcjILEhZDbGF1c2VTbmlwcGV0R3JvdXBfdjU2IhZjbG91ZC1zdG9yYWdlIzAwMDAwMDBhDKIBAmVuGAAgAA==", "clause": {"size": 222, "parents": [["protection-of-data", "Protection of Data"], ["miscellaneous-provisions", "Miscellaneous Provisions"], ["mandatory-individual-arbitration-and-class-or-collective-action-waiver-as-a-condition-of-employment", "Mandatory Individual Arbitration and Class or Collective Action Waiver as a Condition of Employment"], ["disputes", "Disputes"], ["taxes", "Taxes"]], "children": [["", ""], ["the-clean-air-act", "The Clean Air Act"], ["drug-free-workplace-statement", "Drug Free Workplace Statement"], ["the-clean-water-act", "The Clean Water Act"], ["equal-employment", "Equal Employment"]], "title": "Cloud storage", "id": "cloud-storage", "related": [["tool-storage", "TOOL STORAGE", "TOOL STORAGE"], ["data-storage", "Data Storage", "Data Storage"], ["storage", "Storage", "Storage"], ["transport", "Transport", "Transport"], ["transportation-management", "Transportation Management", "Transportation Management"]], "related_snippets": [], "updated": "2025-07-24T06:48:53+00:00", "also_ask": ["What key data security and privacy provisions must be included in a cloud storage clause?", "How can liability for data breaches or loss be strategically allocated between parties?", "What are the most common enforceability challenges for cloud storage clauses in court?", "How do cloud storage obligations differ across major jurisdictions or regulatory regimes?", "What negotiation leverage points exist regarding data access, retention, and termination rights?"], "drafting_tip": "Specify data ownership and access rights to prevent disputes; define security standards to ensure data protection; require compliance with relevant laws to mitigate legal risks.", "explanation": "The cloud storage clause defines the terms under which data is stored, accessed, and managed using remote servers operated by a third-party provider. It typically outlines the responsibilities of both the service provider and the client regarding data security, backup procedures, and access rights, and may specify acceptable use policies or data retention periods. This clause ensures that both parties understand how data will be handled in the cloud environment, thereby reducing the risk of data loss, unauthorized access, or compliance issues."}, "json": true, "cursor": ""}}