Extract to table

140(ag), a service-provider agreement must include a certification that the service provider "understands" the restrictions imposed by the CCPA and "will comply with them

Cascade's election must be communicated in writing within 15 days of the applicable trigger event; in the absence of such election, the default will be secure destruction

A narrow exception to the destruction/return obligation may apply where Fieldhaven is required to retain specific categories of Cascade personal information pursuant to an applicable law, regulation, or legal-hold obligation

All destruction of Cascade personal information must employ methods meeting NIST Special Publication 800-88, Revision 1 ("Guidelines for Media Sanitization") or equivalent industry standards

Fieldhaven's destruction certification must identify the methods used

Fieldhaven must notify Cascade of any confirmed or reasonably suspected security incident involving Cascade personal information within 24 hours of discovery