For any agreements executed, or amended, on or after January 1, 2015, when EKU contracts with a Nonaffiliated Third Party and discloses Personal Information to the nonaffiliated third party, EKU shall require, as part of that agreement, that the Nonaffiliated Third Party implement, maintain, and update security and breach investigation procedures pursuant to Kentucky's Personal Information Security and Breach Investigation Practices Act, KRS 61.931 – 61.934.

These agreements will be reviewed for approval by EKU's IT Security Analyst or designee for compliance to this Regulation.

Additional information regarding Nonaffiliated Third Party Contract Requirements can be found at: http://policies.eku.edu/policies/non-academic under Information Security Incident Response.

The University is desirous of an option to extend the contract resulting from this RFP to members of Kentucky Educational Purchasing Cooperative (KEPC). Members of KEPC are:

Is your company willing to extend this contract to members of KEPC?

____yes

___ no