(1) The data vendor must submit an annual report to the lead organization, the office, and the office of the state chief information security officer that includes the following information:

(a) Summary results of its independent security assessment; and

(b) Summary of its penetration testing and vulnerability assessment results.

(2) The data vendor, upon reasonable notice, must allow access and inspections by staff of the office of the state chief information security officer to ensure compliance with state standards.

(3) The data vendor, upon reasonable notice, must allow on-site inspections by the office to ensure compliance with laws, rules and contract terms and conditions.

(4) The data vendor must have data retention and destruction policies that are no less stringent than that required by federal standards, including the most current version of NIST Special Publication 800-88, Guidelines for Media Sanitization.