DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

26.a
Approved 4/25/2023
Board of Supervisors
DOC-2023-333

DIGITAL WALLET PILOT PROGRAM AGREEMENT
This Agreement, which is effective on the date it is fully executed, is between the
COUNTY OF SANTA CRUZ, hereinafter called COUNTY, and HUMBL, INC., hereinafter
called HUMBL and describes the terms and conditions that govern COUNTY’s use of HUMBL
digital wallet blockchain services including proprietary software, interfaces, and Application
Programming Interfaces (API) for the COUNTY’s digital wallet pilot program.
RECITALSThe Parties will collaboratively conduct a pilot program focusing on development andutilization of the HUMBL digital wallet. The intent is to leverage the HUMBL wallet to mirror the
COUNTY’s current MySantaCruzCounty app adding the addition of blockchain based features
such as Recreational Vehicles (“RV”) parking permits, bike registration, Over-the-Counter(“OTC”) building permits, Parks volunteer hours, Parks Department facility reservation,
Emergency Push Notifications, and Pet Registration.
As part of this pilot program, the Parties will beta test the blockchain enhanced application
to a select group of Santa Cruz County residents focusing on ease of use; security, and accuracyof the enhanced application as compared to the current digital application. Digital application
reviews will provide key information primarily for the COUNTY and county residents (betatesters). The overall objective is for the COUNTY to evaluate the possibilities of using blockchain
technology and designing implementation actions plans.
The Parties acknowledge the forgoing recitals and hereby agree as follows:
1. STATEMENT OF WORK.
1.1. The Parties agree to comply with the duties and obligations set forth in the Statement ofWork as identified in Exhibit A and attached to this Agreement.
1.2. HUMBL will grant to COUNTY a royalty-free license(s) of the any proprietary
software, interfaces, APIs, and any other technology used for the performance or in any
manner connected to or in support of HUMBL’s digital wallet.
1.3. HUMBL will install and set up an on-premises HyperLedger Fabric Server to provide
validation of issued Blocks (aka certificates). This installation and setup will include
any and all hardware, software including any applicable licenses, operations,maintenance, and upkeep documentation, and one training course for the COUNTY’s
Systems Administration team.
1.4. Application hosting is to be administered exclusively through Amazon Web Services
GovCloud using a pre-paid pricing structure. Upon termination or expiration of thisAgreement, HUMBL will transfer said application hosting to COUNTY.

1

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

2. DATA SECURITY PLAN.
2.1. HUMBL will comply with the Data Security Plan as identified in Exhibit B andattached to this Agreement.
3. STYLE GUIDE.
3.1. HUMBL will comply with the Style Guide as identified in Exhibit C and attached tothis Agreement.
4. TERM.

4.1. The term of this Agreement shall be for one (1) year commencing on May 1, 2023
through April 30, 2024.
5. TERMINATION.
5.1. Either party hereto may terminate this Agreement at any time by giving thirty (30)
calendar days’ written notice to the other Party.
5.2. Upon termination or expiration of this Agreement, HUMBL will allow COUNTY’s
continued use of HUMBL’s digital wallet including any license(s) of the any
proprietary software, interfaces, APIs, and any other technology used for the
performance or in any manner connected to or in support of HUMBL’s digital wallet.
6. COMPENSATION.
6.1. COUNTY shall pay zero compensation for services and licenses provided by HUMBL
pursuant to this Agreement. The Parties acknowledge and agree that the consideration
for the execution of this Agreement is each Party’s performance of the duties andobligations stated herein.
6.2. Each Party shall bear their own costs and expenses in the performance of their duties
and obligations stated herein.
7. INDEMNIFICATION.
7.1. HUMBL will indemnify, defend, and hold COUNTY and its officers, employees,
agents, and volunteers harmless from and against all claims, demands, damages,
actions, expenses, losses, or liability of any kind or nature which COUNTY may
sustain or incur or which may be imposed upon it as a result of, arising out of, or in any
manner connected with HUMBL’s digital wallet, HUMBL’s performance under theterms of this Agreement, and infringement of any third party’s intellectual property
rights and protection throughout the world, including without limitation any (i) patents(including any patent applications, together with all reissuances, continuations,continuations-in-part, revisions, extensions and reexaminations thereof), (ii) copyrights,2

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A(iii) Internet domain names, trademarks, service marks, and trade dress, together withall goodwill associated therewith, (iv) trade secrets, (v) rights in databases and designs(ornamental or otherwise), (vi) moral rights, rights of privacy, rights of publicity andsimilar rights, and (vii) and any other proprietary rights and protections, whether
currently existing or hereafter developed or acquired, whether published or
unpublished, arising under statutory law, common law, or by contract, and whether or
not perfected, including all applications, disclosures and registrations with respect
thereto.
7.2. The party seeking indemnification pursuant to this Section (the “Indemnified Party”)
shall provide the party obligated to provide such indemnification (the “Indemnifying
Party”) with: (i) prompt written notification of any such claim; (ii) sole control andauthority over the defense or settlement thereof; and (iii) all available information andreasonable assistance necessary to settle and/or defend any such claim, at theIndemnifying Party’s expense, provided that if any settlement requires any action oradmission by the Indemnified Party, then the settlement will require the Indemnified
Party’s prior written consent. Failure by the Indemnified Party to provide prompt
notice of a claim or to provide such control, authority, information, or assistance shallnot relieve the Indemnifying Party of its obligations under this Section, except to theextent that the Indemnifying Party is materially prejudiced by such failure. The
Indemnified Party may have its own counsel present at and participating in allproceedings or negotiations relating to a claim, at the Indemnified Party’s own expense.
7.3. The obligations specified in this Section shall survive the expiration or termination ofthis Agreement.
8. INSURANCE.
8.1. HUMBL shall procure and maintain in force during the term of this Agreement, at its
sole cost and expense, insurance in the amounts that are reasonably necessary to protect
it against liability arising from all negligent acts or incidents caused by its employees.
Upon request, HUMBL shall provide proof of professional liability, general liability,
cyber insurance, and Workers' Compensation insurance coverage.
9. EQUAL EMPLOYMENT OPPORTUNITY.
9.1. HUMBL shall not discriminate against any employee or applicant for employment
because of race, color, creed, religion, national origin, ancestry, physical, or mental
disability, medical condition (including cancer–related and genetic characteristics),
marital status, sexual orientation, age (over 18), veteran status, gender, gender identity,
gender expression, pregnancy, or any other non-merit factor unrelated to job duties.
Such action shall include, but not be limited to, the following: recruitment; advertising,layoff or termination; rates of pay or other forms of compensation; and selection for
training (including apprenticeship), employment, upgrading, demotion, or transfer.
HUMBL agrees to post in conspicuous places, available to employees and applicantsfor employment, notice setting forth the provisions of this non-discrimination clause.
3DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

10. CONFIDENTIALITY OF RECORDS.
10.1. HUMBL agrees that all information and records obtained in the course of providing
services to COUNTY shall be subject to confidentiality and disclosure provisions ofapplicable Federal and State statutes and regulations adopted pursuant thereto.
HUMBL agrees that it has a duty and responsibility to make available to COUNTY
Administrator or their designated representatives, including the Auditor ControllerTreasurer-Tax Collector of the COUNTY, the contents of records pertaining to
COUNTY which are maintained in connection with the performance of HUMBL’s
duties and responsibilities under this Agreement, subject to the provisions of theheretofore mentioned Federal and State statutes and regulations. COUNTY
acknowledges its duties and responsibilities regarding such records under such statutes
and regulations.
10.2. The obligations specified in this Section shall survive the expiration or termination ofthis Agreement.
11. DATA OWNERSHIP.
11.1. As between the Parties, COUNTY owns all rights, title, and interest in and to the
COUNTY’s data including all intellectual property rights and protections throughout
the world therein.
11.2. HUMBL’s use of COUNTY’s data is limited to only the development, operation, andperformance of HUMBL’s digital wallet including the service provided by HUMBL for
this Agreement. HUMBL is prohibited from selling, licensing, or disclosing in any
way or manner COUNTY’s data unless approved by COUNTY. Upon termination ofthis Agreement, HUMBL will return COUNTY’s data if feasible or destroy
COUNTY’s data at COUNTY’s request.
12. RETENTION AND AUDIT OF RECORDS.
12.1. HUMBL shall retain records pertinent to this Agreement for a period of not less than
five (5) years after termination or expiration of this Agreement or until a final audit
report is accepted by COUNTY, whichever occurs first. CONTRACTOR hereby
agrees to be subject to the examination and audit by the Santa Cruz County AuditorController-Treasurer-Tax Collector, the Auditor General of the State of California, or
the designee of either for a period of five (5) years after termination or expiration ofthis Agreement.
12.2. The obligations specified in this Section shall survive the expiration or termination ofthis Agreement.

4DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

13. INDEPENDENT CONTRACTOR.
13.1. HUMBL and COUNTY agree that HUMBL is an independent contractor and not an
employee of COUNTY. HUMBL is responsible for all insurance (workers’
compensation, unemployment, etc.) and all payroll related taxes. HUMBL is notentitled to any employee benefits. COUNTY agrees that HUMBL shall have the rightto control the manner and means of accomplishing the result contracted for herein.
13.2. By their signatures to this Agreement, each of the undersigned certifies that it is theirconsidered judgment that HUMBL engaged under this Agreement is in fact an
independent contractor.
14. NONASSIGNMENT.
14.1. HUMBL shall not assign the Agreement without the prior written consent of the
COUNTY.
15. APPLICABLE LAW AND VENUE.
15.1. Each Party shall comply with, and all activities under this Agreement shall be subject
to, all applicable federal, State of California, and local laws and regulations, as now
existing and as may be amended or modified.
15.2. The parties hereto agree that the provisions of this Agreement shall be governed by andinterpreted in accordance with California Law.
15.3. Any arbitration, mediation, or litigation arising out of this Agreement shall occur onlyin the County of Santa Cruz, notwithstanding the fact that one of the contracting parties
may reside outside of the County of Santa Cruz.
16. COUNTERPARTS.
16.1. This Agreement may be executed in one or more counterparts. Delivery of an executedcounterpart of this Agreement by facsimile or a .pdf data file or other scanned executedcounterpart by email shall be equally as effective as delivery of a manually executedcounterpart of this Agreement. Each duplicate and counterpart shall be equallyadmissible in evidence, and each shall fully bind each party who has executed it. The
Parties to this document agree that a copy of the original signature (including anelectronic copy) may be used for any and all purposes for which the original signature
may have been used. The Parties agree they will have no rights to challenge the use orauthenticity of this Agreement based solely on the absence of an original signature.

5

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

17. MISCELLANEOUS.
17.1. This written Agreement, along with any attachments, is the full and complete
integration of the parties’ agreement forming the basis for this Agreement. The parties
agree that this written Agreement supersedes any previous written or oral agreements
between the parties, and any modifications to this Agreement must be made in a written
document signed by all parties. The unenforceability, invalidity or illegality of any
provision(s) of this Agreement shall not render the other provisions unenforceable,
invalid or illegal. Waiver by any party of any portion of this Agreement shall notconstitute a waiver of any other portion thereof. Any and all acts which may havealready been consummated pursuant to the terms and conditions of this Agreement are
hereby ratified.
IN WITNESS WHEREOF, the Parties hereto have executed this Agreement as of theday, month and year below written:
COUNTY OF SANTA CRUZ

HUMBL, INC.

By: _____________________________________ By: ________________________________
Brian Foote
Name: Tammie Weigl
Name: ________
CEO
Title: Director of Information Services
Title: __________
4/25/2023
4/19/2023
Date: ____________________________________
Date: _________________________

Approved as to Form:
4/19/2023_________________________________
Office of the County Counsel
Date

Approved as to Insurances:
4/19/2023_________________________________
Risk Management
Date

LIST OF EXHIBITS:
Exhibit A: Statement of Work
Exhibit B: Data Security Plan
Exhibit C: Style Guide

6

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Table of Contents
Contents ............................................................................................................................................... 2
1.

Introduction and Pilot Program Objectives ..................................................................................... 3
1.1
Where did the Pilot Program idea originate and what is it intended to do? Who are the participants from HUMBL
as well as the Santa Cruz County and what previous work has HUMBL done that is relevant to this pilot? ........................... 3

2.

The Approach ..........................................................................................................................................4
2.1.
2.2.
2.3.
2.4.
2.5.
2.6.
2.7.

2.8.

Blockchain Technology Solutions ................................................................................................................................. 4
Centralized versus Decentralized Data Storage ........................................................................................................... 4
Private versus Public Blockchain solutions .................................................................................................................. 5
Blockchain data management and Alert Notifications ................................................................................................. 5
Immutability using Blockchain Technology .................................................................................................................. 6
Why Blockchain? .......................................................................................................................................................... 6
Quantifiable Results by Phase (Phases 1-4) ................................................................................................................. 7

Previous Experience Deploying Blockchain Technology .........................................................................7

2.8.1. United States Air Force – Ongoing (DEXTER) ...........................................................................................7
2.8.2. Casinos .................................................................................................................................................82.9.3. Pharmacies – COVID 19 .........................................................................................................................82.9.4. Academic Institutions ............................................................................................................................8
3.Overview of the HUMBL solutions approach .................................................................................................9
3.2 Statement of Work Tasks ........................................................................................................................ 10
1.
2.
3.

Volunteer Hours ............................................................................................................................................................. 10
OTC Building Permits ..................................................................................................................................................... 12
Bike Registration ............................................................................................................................................................ 12

3.3 Project Management Approach ...............................................................................................................14
3.4 Quality Assurance and Security Planning .................................................................................................14
4. Team HUMBL ............................................................................................................................................14
4.1 Why team HUMBL? .................................................................................................................................14
4.2 Santa Cruz Pilot Team Skills and Experience ............................................................................................. 15
4.3 Rough Order of Magnitude ...................................................................................................................... 16
4.3.1 HUMBL commitment ...................................................................................................................................................... 16
4.3.2 BLOCKS commitment ..................................................................................................................................................... 17

5. Findings and Summary .................................................................................................................... 17

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

1. Introduction and Pilot Program Objectives
Santa Cruz County and HUMBL collaboratively conduct a pilot program focusing on development
and utilization of the HUMBL digital wallet. The intent is to leverage the HUMBL wallet to mirror
the current MySantaCruzCounty app adding the addition of blockchain based features such as OTC
building permits, volunteer hours, and bike registration. Santa Cruz County representatives alongwith HUMBL developers will beta test the blockchain enhanced application to a select group of Santa
Cruz County residents focusing on ease of use; security, and accuracy of the enhanced application ascompared to the current digital application. Digital application reviews will provide key information
primarily for Santa Cruz County government personnel and end users of the government participants
and the county residents (beta testers). The overall objective is for Santa Cruz County governmentand constituents to evaluate the possibilities of using blockchain technology and designing
implementation actions plans to make it reality.

1.1 Where did the Pilot Program idea originate and what is it intended to do? Who are
the participants from HUMBL as well as the Santa Cruz County and what previous
work has HUMBL done that is relevant to this pilot?
In 2022 HUMBL engaged the county of Santa Cruz to provide an overview of the emerging
blockchain technology applications that municipal governments could utilize to enhance theirgovernmental organizations’ means of tracking actions, safeguarding information (official as well as
constituent information), facilitating ease of government accessibility and management (i.e.
registration(s), applications, quality control, hours/cost tracking, verifiable credentialling, etc.). The
end state to this effort is Santa Cruz County (government and constituents) being able to increasesafe, secure, and efficient interactions using blockchain technology provided by HUMBL.
HUMBL is currently one of the leading publicly traded companies pioneering the way for web3.
HUMBL has many verticals, including bridging governments to industry, to help streamline theprocess of integrating blockchain web3 applications. HUMBL currently has an on-chain solution
utilizing ERC777 smart contracts on the BLOCKS blockchain.
HUMBL will utilize the BLOCKS Registry within an integrated roadmap to bring together thenecessary technology, digital, data and analytics capabilities as requested by Santa Cruz County. The
BLOCKS Registry is a global decentralized registry used to categorize wallet to wallet commerce
and tokenized trade between people, people and companies, people, and governments. Utilizing the
Verified by BLOCKS technology, which serves as immutable authentication, users will be able totokenize digital, physical, and institutional data. A benefit of this technology is combating fraud andforgery issues for consumers and government entities. Utilizing the registry with the knowledge that
it is a multipurpose utility tool will enhance the ability for all participating entities leverage it for
tangible, intangible, and/or a hybrid of both.
The BLOCKS Registry functions using BLOCKS tokens as a transaction. Users are required to utilize
credits that are acquired by buying and owning the BLOCKS token. The acquisition of the BLOCKS
tokens allows hybrid access across various chains like Ethereum, Polygon, BLOCKS, Solana, andGnosis. Utilizing KYC (Know Your Customer) verification, users can write data to the registry with

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

API keys and credits. Since BLOCKS can fractionalize 18 decimal places, the credit value can vary
per blockchain or per transaction request.
Currently Team BLOCKS and HUMBL are working with elements of the United States Air Force,to secure and streamline flight testing data. The United States Air Force is using the mobile digitalwallet so that, pilots can securely store flight data from a tablet, while at the same time storing hashdata to the blockchain for traceability and immutability. This allows the pilots to show a verifiable
credential that the plane is safe and approved for take-off, while also allowing them to build a masterdeck at the end of the quarter ensuing no data has been manipulated. An objective of this effort is toimprove data collection, analysis, security, and data trust for Test and Evaluation Squadrons.

2. The Approach
2.1. Blockchain Technology Solutions
Blockchain provides trust based on mathematics and on cryptology, in that you can be virtually 100%sure that the record added to the chain is verified and immutable. HUMBL leverages this ability ofblockchain to ensure that credentials are issued by trusted institutions, and that those credentials havenot been modified. Blockchains replace trust in humans with trust in mathematics. Regardless of their
specific design, all blockchains represent a cryptographic triple play: 1. Each transaction in theblockchain is digitally signed by the originator. 2. Each transaction—singly or in blocks—is chained
to the prior via a digital hash. 3. Validated transactions are replicated across all nodes using a
consensus algorithm.

2.2. Centralized versus Decentralized Data Storage
Our approach delivers a repeatable, reproducible, and accurate process, that incorporates datapreparation and analytic tools to aid in dataset(s) and algorithm testing, data enrichment, advanced
and predictive analytics, and distribution to the cloud. Our capabilities will provide the Santa Cruz
users a suite of capabilities to enable them to scan, collect, transform, normalize, and apply AI andmachine learning in a variety of ways. Our instrumentation has provided detailed metrics for timely
understanding of weather conditions, flight paths, and geolocation tracking, which results in:••••Distributed secure, cloud-based, capability with parallel processing for collaboration.
High speed GPU computational power with real-time streaming data.
Automated data ingestion, integration, and data normalization.
AI/ML enrichment with plug-and-play features for easy interfaces into Mission
Command Tools.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

End-users will require consistency and repeatability in creating the environment baseline andexperiments (via automated and self-service) provisioning to perform effective evaluations andpredictive analytics. Team HUMBL solutions deliver automation coupled with Data Source
Acquisition to leverage AI and ML algorithms for automation and application of predictive
automation and application of predictive analytics.

2.3. Private versus Public Blockchain solutions
The HUMBL utilization of BLOCKS enables the use of both public and private blockchain solutions.
The HUMBL platform is based on Hyperledger and can use both the public networks as well as
AWS manages blockchain, AKA Hyperledger Fabric. BLOCKS runs on the Ethereum network andother supported EVM based blockchains.
The BLOCKS smart contract can be deployed on alternate compatible networks. The ability to deploy
the BLOCKS smart contract on alternate blockchains makes BLOCKS an agnostic solution. In
addition to BLOCKS being a cross-chain deployed smart contract, 3rd party data can be placed on
any blockchain that supports data insertion or OP_RETURN as used on UTXO blockchains (Bitcoin
forks). As EVM compatible sidechains evolve, opportunities to deploy BLOCKS will expand,creating additional redundancies.

2.4. Blockchain data management and Alert Notifications
Our approach delivers a repeatable, reproducible, and accurate process, that incorporates datapreparation and analytic tools to aid in dataset(s) and algorithm testing, data enrichment, advanced
and predictive analytics, and distribution to the cloud. Our capabilities provide the Santa Cruz County
from a variety of backgrounds and skill sets to web scrape, scan, transform, normalize, and apply AI
and machine learning. Our instrumentation provides metrics which results in:••••Distributed secure, cloud-based, capability with parallel processing for collaboration.
High speed GPU computational power with real-time streaming data.
Automated data ingestion, integration, and data normalization.
AI/ML enrichment with plug-and-play features for easy interfaces
into Mission Command Tools.

Organizational end-users will require consistency and repeatability in creating the environment
baseline and experiments (via automated and self-service) provisioning in order to perform
effective evaluations, apply predictive analytics for alerting. Our solution delivers Automation
coupled with Data Source Acquisition to leverage AI and ML algorithms for automation andapplication of predictive analytics.
The BLOCKS contract is open source and published on Etherscan, in addition the HUMBL
Verifiable Credential Solution is based on open standards and implements open source
Hyperledger Stack from the Linux Foundation as well as KERI which is part of the Apache2 opensource project.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

2.5. Immutability using Blockchain Technology
Blockchain provides trust based on mathematics and on cryptology, in that you can be virtually
100% sure that the record added to the chain is verified and immutable.
HUMBL leverages blockchain capabilities to ensure that credentials are issued by trusted
institutions, and that those credentials have not been modified. Blockchains replace trust in humans
with trust in mathematics.
Regardless of their specific design, all blockchains represent a cryptographic triple play:
1. Each transaction in the blockchain is digitally signed by the originator.
2. Each transaction—singly or in blocks—is chained to the prior via a digital hash.
3. Validated transactions are replicated across all nodes using a consensus algorithm.
Transactions in a blockchain are cryptographically chained to prior transactions, making themdifficult to modify or remove after the fact. Any update to the blockchain state requires a newtransaction that is visible to all parties in the ledger. Independent parties can consequently
collaborate and trust that all transactions posed to the ledger are legitimate. Learners can reliably
share their academic credentials and a relying party can verify the integrity of the credentials via
the blockchain—without having to consult the issuing institution and keeping private data private.
Issuers can reliably manage the status of credentials—say, revoking a credential if it was issued inerror—through an immutable and trustworthy source of truth without introducing single points offailure.

2.6. Why Blockchain?
• Time savings: Transaction times for complex, multi-party interactions are slashed from days
to minutes. Transaction settlement is faster because it doesn’t require verification by a central
authority.
• Tighter security: Blockchain’s security features protect against tampering, fraud, andcybercrime. If a network is permissioned, it enables the creation of a members-only network with
proof that members are who they say they are, and that goods or assets traded are exactly as
represented.
• Enhanced privacy: Through the use of IDs and permissions, users can specify whichtransaction details they want other participants to be permitted to view. Permissions can be
expanded for special users such as auditors who may need access to more transaction detail.
• Improved auditability: Having a shared ledger that serves as a single source of truth improves
the ability to monitor and audit transactions.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A• Increased operational efficiency: Pure digitization of assets streamlines transfer of ownership.
Transactions can be conducted at a speed more in line with the pace of doing business.

2.7. Quantifiable Results by Phase (Phases 1-4)
2.7.1. Phase 1 Plan
2.7.2. Phase 2 Execute
2.7.3. Phase 3 Assess
2.7.4. Phase 4 Conclude

2.8. Previous Experience Deploying Blockchain Technology
HUMBL has developed the HUMBL Digital Wallet, a user-centric digital wallet that offers realcontrol, and a practical way to manage your official records. Your digital wallet can contain official
records that you have accumulated over the years, academic achievements, professional
certifications, and government documents. The HUMBL Wallet keeps your documents secure,private, and convenient. HUMBL enables you to receive, protect, and share your records digitallywith anyone on our network. We offer a secure and convenient method for verifying your records
through blockchain technology.
HUMBL is working with both public and private enterprises using Blockchain Technologies.
Including, but not limited to: Educational Institutions, Military Defense Contractors, Private
Businesses, and the Department of Defense.
The BLOCKS team element leveraged by HUMBL has a decade’s worth of extensive blockchain
and technical experience. The team has built Proof of Concept for Powerfleet, NASDAQ: PWFO,
inserting logistics data onto the blockchain to reconcile against a private database for insurance
and tracking purposes. The HUMBL and BLOCKs explored how packets of information arebundled in a series of transactions in the blockchain, and the results can be accessed through a QR
code.
The HUMBL team won the World Blockchain Summit in Singapore in 2019 as the top North
American startup. Brian spoke in 2019 at the UN 2030 Agenda on how blockchain solutions canaccomplish many of the UN’s goals such as financial inclusion and reduction in poverty as well
as fair access to title. The team has two pending US and international blockchain patents, one
highly focused on stable payment systems on blockchain and the other focused on verifying theprovenance of goods and the tracking of data
2.8.1. United States Air Force – Ongoing (DEXTER)Team HUMBL is currently working alongside the United States Air Force, to secure andstreamline flight data. Using the mobile digital wallet, pilots can securely store flight data from atablet, while storing hash data to the blockchain for traceability and immutability. This allows theDocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

pilots to show a verifiable credential that the plane is safe and approved for take-off, while also
allowing them to build a master deck at the end of the quarter ensuing no data has been
manipulated. This will improve data collection, analysis, security, and data trust for Test and
Evaluation Squadrons.
2.8.2. Casinos
Team HUMBL has deployed identity and data services to local casinos in San Diego. Currently,
team HUMBL is working on the use case to take a local casinos club card and issues these cards
within the digital wallet as verifiable credentials. This will allow patrons to use casino programs
such as the bus system, all while giving the user the privacy of the blockchain.
2.9.3. Pharmacies – COVID 19
Team HUMBL has worked with pharmacies across the state of Nevada to issue verifiable
credentials for proof of covid testing. The pharmacies have a seamless portal to input all the patient
information, giving them the ability to do bulk uploads and automatically issue the COVID results
to the patient’s digital wallet. Team HUMBL has also worked alongside the state of Nevada toallow for seamless reporting while keeping patient information protected with HIPPA regulations.
2.9.4. Academic Institutions
Team HUMBL has worked with various public and private schools across the United States topilot blockchain initiative. Team HUMBL recently worked with Hawaii Pacific University toverify covid testing, and issue verifiable credentials to allow students to enter classrooms while
showing proof of weekly testing securely and safely.
Team HUMBL most recently is working with San Diego State University, to issue verifiable
credentials for sporting events. Combining proof of vaccination, student ID, and proof of ticket
purchase, students are able to seamlessly enter arenas with 1 cryptographic QR code allowing forlines to move seamlessly. With the HUMBL Wallet portion, students will be able to alsopurchase food and beverages using fiat and crypto currencies.
Team HUMBL has developed the HUMBL Digital Wallet, a user-centric digital wallet that offers
real control, and a practical way to manage your official records. Your digital wallet can contain
official records that you have accumulated over the years, academic achievements, professional
certifications, and government documents. HUMBL Wallet keeps your documents secure, private
and convenient. HUMBL enables you to receive, protect, and share your records digitally withanyone on our network. We offer a secure and convenient method for verifying your records
through blockchain technology.
Team HUMBL has/is working with both public and private enterprises using Blockchain
Technologies. Including, but not limited to: Educational Institutions, Military Defense
Contractors, Private Businesses, United States Air Force, and the US Governments.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

3.Overview of the HUMBL solutions approach
The pilot project will be conducted in four phases. The phases will be referred to as: Plan, Execute,
Assess, and Conclude. The planning phase (Phase 1) will address all current and expected
requirements; resources, assessment / impact criteria; and expected time determination for phases
and overall project. The Execution phase (Phase 2) will progress to application of the plan throughidentified collective tasks that display the technical and non-technical elements that produce theresults necessary for Design Test & Evaluations as well as Operational Test & Evaluations. The
Assessment phase (Phase 3) brings all findings from Phase 2 together to be evaluated against fullprogrammatic (including the consumer/end user) requirements. The Conclude phase (Phase 4) isthe amalgamation of the three other phases to provide the outcomes, solution(s) recommendations,and ways ahead for potential future opportunities with the County of Santa Cruz. The desired end
state to this effort is the feasibility and viability of leveraging blockchain technology to address
data useability, protection, authentication, and improve organizational processes that have positive
impacts for consumer utilization.

3.1 Scope of Project Key Project Management Milestones & Events – DiagramDocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

3.2 Statement of Work Tasks
The Scope of the Pilot is organized into the following tasks:••••

Task 1. Development of a HUMBL wallet that includes the current MySantaCruzCounty app websites.
Task 2. Identification of new services to add to the wallet
Task 3. Beta testing of Santa Cruz County HUMBL wallet
Task 4. Review of test performance, usage and final evaluation / report

3.2.1. Initiate Development Modifications.

3.2.2. Create template Schemas (Forms) to use for County of Santa Cruz use cases.
3.2.3. Modify Mobile Application UI/UX for Santa Cruz.

1. Volunteer Hours
Parks department and other departments utilize volunteers to provide county services, some grants
allow for volunteer hours to be included in local in-kind matching fund calculations. Allow for
individuals sign up and to track their own hours. County could provide awards and recognition toindividuals

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

2. OTC Building Permits
Planning department issues “Over the Counter” permits for basic building and construction
through a in house build “ePlan” portal.

3. Bike Registration
A Bike registration program does not yet exists but could be easier to establish and administer witha Digital Wallet tool.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

4. RV Parking Permits
Issue credentials for RVs to park on city streets for up to 72hrs. HUMBL will work with theexisting county app to collect payment and initiate the transaction. Upon successful confirmationof payment, HUMBL will issue a verifiable credential that can be added to the existing county
flow and printed for display on the RVs window.

5. Parks Facility Registration
The Parks department utilizes a system to reserve tables and other park services for parties andevents. HUMBL will work with the existing county app to collect payment and initiate thetransaction. Upon successful confirmation of the payment, HUMBL will issue a verifiable
credential that can be added to the existing county flow and printed for display at the event.

6. Emergency Push Notifications
Utilizing the wallet app combined with HUMBL, Social Santa Cruz County will be able to sendout Emergency push notification to all wallet users. Additionally, the county can utilize the same
platform to have two way communications with its constituents and if needed and financial aid,
payments directly to the constituents wallet.
7. Pet Registration
HUMBL will work with the existing county app to collect payment and initiate the transaction.
Upon successful confirmation of payment, HUMBL will issue a verifiable credential that can be
added to the existing county flow.

HUMBL, along with designated representatives from Santa Cruz County, will initially designand develop testing parameters for the technical design elements (Design Technical Evaluation)of the software. The design of the evaluation criteria will be based on current local, state, andfederal laws/regulations aligned with the functional requirements necessary for the government
entity to fulfill constituent needs. Data and Information (further referenced as only
“Information”) will be approved in writing by designated Santa Cruz County representative(s)prior to the data being provided to a designated HUMBL entity. The designation in writing of
information management personnel for the development, testing, and termination of the effort isessential to maintaining quality assurance and security protocols required and recommended
through best practices.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

All development and evaluation data will be voluntary and publicly available to ensure the utmost
respect and protection of sensitive information. If there is a need for a test that requires “Live”
information a quality assurance and security plan for that activity must be designed andscrimmaged to evaluate the risk of any compromises or spillages.
Functional interaction assessments require multiple parties that include government userinterface, other end-user (non-government) interactions (useability), and system designinteractions (chain, off-chain, hybrid-chain). The key to all of the assessments will be the control
factors associated with the handling of Santa Cruz County provided data along with data thatis input from all participating entities (government, non-government, HUMBL, et). The
expectation during testing and evaluation is that the data will change in format and quantity
because of user interactions to address the application design and intended functions. The
expected end state is that information oversight is still handled by Santa Cruz County while
security and system assurance is implemented by all participating parties. HUMBL will
designate an information oversight representative to ensure that both entities are aligned andacting in-line with the Santa Cruz County information and systems security requirements. Prior to
the start of any activity Santa Cruz County representative will get with the designated HUMBL
representative to ensure all entities are aligned before any activities are executed.
Santa Cruz County will be expected to design and approve a tester recruitment plan to ensure thatparticipants are available to interact with the HUMBL application development. The
management of the recruits will be the responsibility of Santa Cruz County to ensure that there isa single point of contact for the interface of all testers with Santa Cruz County and HUMBL.
Understanding that testing will happen with multiple entities it is necessary to identity the spiraldevelopment concept that while the application may be completely functional and meet all
requirement it will require updating to maintain the most up to date security and information
management requirements.
The target timeline is to ensure that initial development is less than six months ensuring criticalsafety and data management findings are captured in the application technical design and thefunctional interaction assessments. The six months timeline ensures the product is tested,
reviewed, and relevant, ensuring a product that enhances Santa Cruz County functionality for all
entities.
3.2.4. Establish computing environment in AWS GovCloud for the County of Santa Cruz.
3.2.5. Provide training to the customer
3.2.6. Provide ongoing technical support/maintenance.
3.3 Project Management Approach
Team HUMBL will provide a Pilot Project lead to oversee, coordinate, and communicate allneeds to and from the County of Santa Cruz designated points of contact(s). The TeamHUMBL project lead will also be the central point of contact to provide and coordinate
information to and from Team HUMBL participants. A designated alternate Pilot Project leadfor Team HUMBL will be assigned to ensure there is depth in management, oversight, andresponsiveness to all participating entities.

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Team HUMBL will conduct a minimum of one In-Progress Review (IPR) per quarter to address
current phase progress, phase transition preparations, and address any multi-phase issues that arise.
The IPRs will be developed and presented by Team HUMBL. Primary audience will be theCounty of Santa Cruz identified personnel and any additional personnel approved by both TeamHUMBL Project Lead and SCC senior POC. Personnel being cleared for interaction andreview of this effort must be vetted and approved by both parties to ensure that security
considerations are in place prior to any engagement.

3.4 Quality Assurance and Security Planning
Team HUMBL will provide a data security plan prior to receiving or integrating any informationfrom the SCC designated representatives. Team HUMBL will ensure that all data is always secured
and only personnel designated by name and position will have access. Personnel will only accessor utilize the information in an official capacity in line with the purpose, functions, and necessity
to develop, test, evaluate, and codify outcomes from the Santa Cruz County Blockchain Pilot
Project. Any Personally Identifiable Information (known as PII), financial information, Personal
Health Information (known as PHI), and any other information that requires protection.

4. Team HUMBL
4.1 Why team HUMBL?
HUMBL’s staff has over 40+ years of experience leading Cyber Security efforts in both private
and public sectors. Additionally, HUMBL’s staff have extensive experience in Risk Management
Framework, beginning from Step 1, where system information is gathered, to categorizing thesystem using the NIST 800-57 Security Controls, onto the last step, Step 6, with continued
monitoring for compliance. The HUMBL team has recently undergone extensive training to becertified as a CMMC Registered Practitioner, which ensures that the HUMBL/BLOCKS network
achieves a minimum of CMMC level 3, to access and store Controlled Unclassified Information(CUI). HUMBL realizes the importance of being contractually compliant and meeting thesecurity controls required to be (DRFARS 252.204-7012) NIST 800-171 compliant, so that all
government CUI is protected while in the care of the Team HUMBL. During the creation of the
HUMBL Digital Verifiable Credential ecosystem, HUMBL used Cyber Security industry bestpractices, as well as guidance from the Defense Information Security Agency (DISA), Security
Technical Implementation Guidelines (STIG), in order to secure compliance for government use.
With HUMBL’s extensive background in federal government agency work, team HUMBL is
confident in bringing the same level of security and attention to detail to the County of Santa
Cruz. With being one of the first publicly traded blockchain companies and having worldwide
recognition such as placing first place in the blockchain world summit in 2019, we are ready tobring innovation to our local governments. [AA1]4.2 Santa Cruz Pilot Team Skills and ExperienceDocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz

Information Services Department

HUMBL Data Security Plan
Version 1.0

Date: March 6, 2023

Exhibit B: Data Security Plan

Software High Level Design Document

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Table of Contents
1

INTRODUCTION ............................................................................................................. 4
1.1

2

GENERAL INFORMATION................................................................................................ 5
2.1
2.2
2.3

2.4
2.5
2.6
2.7
2.8

3

O

3.3
3.4
3.5
3.6

RISK ASSESSMENT AND MANAGEMENT .........................................................................................11
REVIEW OF SECURITY CONTROLS .................................................................................................11
15
PLANNING FOR SECURITY IN THE LIFE CYCLE ....................................................................................15
DEVELOPMENT/ACQUISITION PHASE ............................................................................................23
IMPLEMENTATION PHASE . ........................................................................................................23
OPERATION/MAINTENANCE PHASE .............................................................................................23

OPERATIONAL CONTROLS ............................................................................................ 24
4.1
4.2
4.3
4.4
4.5
4.6
4.7
4.8
4.9

5

SYSTEM IDENTIFICATION.......................................................................................................5
2.1.1
System Name/Title ....................................................................................................5RESPONSIBLE ORGANIZATION .......................................................................................................5ROLES AND RESPONSIBILITIES .......................................................................................................5
2.3.1
Humbl Contacts .........................................................................................................5
2.3.2
Information Contact(s) ...............................................................................................5
2.3.3
Assignment of Security Responsibility ..........................................................................5
SYSTEM OPERATIONAL STATUS .....................................................................................................5
GENERAL DESCRIPTION/PURPOSE..................................................................................................6
SYSTEM ENVIRONMENT ..............................................................................................................6
APPLICABLE LAWS OR REGULATIONS AFFECTING THE SYSTEM ................................................................7
GENERAL DESCRIPTION OF INFORMATION SENSITIVITY.........................................................................8

MANAGEMENT CONTROLS........................................................................................... 11
3.1
3.2

4

PURPOSE ................................................................................................................................4PERSONNEL SECURITY...............................................................................................................24
PHYSICAL AND ENVIRONMENTAL PROTECTION ................................................................................26
PRODUCTION, INPUT/OUTPUT CONTROLS .....................................................................................26
CONTINGENCY PLANNING ..........................................................................................................28
HARDWARE AND SYSTEM SOFTWARE MAINTENANCE CONTROLS ..........................................................31
INTEGRITY CONTROLS ...............................................................................................................32
DOCUMENTATION ...................................................................................................................33
SECURITY AWARENESS AND TRAINING ..........................................................................................33
RISK MANAGEMENT ................................................................................................................34
4.9.1
Cyber Insurance .......................................................................................................35
4.9.2
Service Level Agreement ..........................................................................................35
4.9.3
Incident Response Plan ............................................................................................37

TECHNICAL CONTROLS ................................................................................................. 39
5.1
5.2
5.3

IDENTIFICATION AND AUTHENTICATION .........................................................................................39
LOGICAL ACCESS CONTROLS .......................................................................................................40
INTERNAL POLICIES AND PROCEDURES...........................................................................................41

2 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

5.4

5.5
5.6

Data Security Plan Document

5.3.1
Security Awareness Training .....................................................................................41
5.3.2
Personnel Security ...................................................................................................41
DATA PROTECTION SAFEGUARDS .................................................................................................41
5.4.1
Blockchain Encryption ..............................................................................................41
5.4.2
FIPS-140-3 Compliance ............................................................................................42
NETWORK SECURITY ................................................................................................................42RESPONSE AND RECOVERY .........................................................................................................43
5.6.1
Disaster Recovery Plan .............................................................................................49
5.6.2
Physical & Environmental Security ............................................................................50
5.6.3
Network Diagram: ...................................................................................................52

3 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

1 Introduction
1.1

PurposeThe County of Santa Cruz requires a data security plan (DSP) to create effective administrative, technical,
and physical safeguards for the protection of constituent information. This DSP sets forth procedures forevaluating and addressing the electronic and physical methods of accessing, collecting, storing, using,transmitting, and protecting client information.

4 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

2

GENERAL INFORMATION

2.1

SYSTEM IDENTIFICATION

Data Security Plan Document

2.1.1 System Name/Title●

2.2

HUMBL Platform.

Responsible Organization●

2.3

HUMBL Inc.

Roles and Responsibilities

Name of person(s) knowledgeable about, or the owner of, the system. More than one point of contact may beprovided. Name of person responsible for security of the system. More than one point of contact may be provided

2.3.1 HUMBL Contacts

2.4

System Operational Status

If more than one status is selected, list which part of the system is covered under each status.

●

Operational – HUMBL Platform and it subcomponents have three distinct environments:
o Productiono UAT
5 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Departmento

2.5

Data Security Plan Document

Development

General Description/Purpose

Team HUMBL will provide a Pilot Project lead to oversee, coordinate, and communicate all needs to andfrom the County of Santa Cruz designated points of contact(s). The TEAM HUMBL project lead will also
be the central point of contact to provide and coordinate information to and from Team HUMBL
participants. A designated alternate Pilot Project lead for Team HUMBL will be assigned to ensure there
is depth in management, oversight, and responsiveness to all participating entities.
Team HUMBL will conduct a minimum of one In-Progress Review (IPR) per quarter to address current
phase progress, phase transition preparations, and address any multi-phase issues that arise. The IPRs
will be developed and presented by Team HUMBL. Primary audience will be County of Santa Cruz
identified personnel and any additional personnel approved by both Team HUMBL Project Lead andCounty of Santa Cruz’s Senior point of contact. Personnel being cleared for interaction and review ofthis effort must be vetted and approved by both parties to ensure that security considerations are inplace prior to any engagement.

2.6

System Environment

6 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

HUMBL is a three-tiered system as depicted in Exhibit 1. The top tier is HUMBL Ownership. The CEO, Mr.
Brian Foote, drives a culture of quality within HUMBL and leads our Quality Management System (QMS).
He chairs the HUMBL quarterly Quality Management Review, focusing on continuous improvement ofpolicies, processes, and procedures that drive effective services and deliveries. The second tier is
HUMBL’s Quality Management Council (QMC). Each department has representation monthly in the
QMC. The QMC meets with Project Managers (PMs) to remain informed and better understand how
HUMBL QMS is working within their specific programs. Maintaining holistic situational awarenessprovides optimal opportunities for all management levels to identify shortfalls early and seek
approaches to improve our service and delivery to our customers. The QMC reviews customer
assessments of HUMBL’s performance and works towards improving our QMS in order to enable more
effective service delivery. The QMC works with each department to direct and guide new or modified
policies and procedures that improve service, delivery, and performance. The third representative tier of
HUMBL quality management is the Program Level.
Day-to-Day Operations Approach
HUMBL currently uses the Colonel John Boyd’s Cognitive Decision approach to establish a collective
understanding for day-to-day baseline operations. The ability to utilize the Observe, Orient, Decide, Act(OODA decision process enables HUMBL to leverage a methodology that spans from the direct
application level of solution development up through large programmatic management efforts.
Communication simplicity at all levels increases initial information consumption between two parties
and provides a common systematic process to audit decision calculus. The OODA decision process
enables all members of HUMBL the ability to effectively communicate their short and long-term
contributions to organizational efforts.
●
●
●
●

2.7

Observe (track) performance.
Orient (report to) management with results and present Courses of Actions (COAs).
Decide which COA to implement.
Act on decision (implement).

Applicable Laws or Regulations Affecting the System

7 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Information owners must classify information to facilitate the appropriate application of Information
Security Policy and Standards. Information owners must establish a process to classify their information
throughout its life cycle, and information classifications must be reviewed annually and adjusted
accordingly. For security purposes, information must be classified as RESTRICTED, CONFIDENTIAL,
INTERNAL, or PUBLIC. Any information that has not been specifically classified will be considered
CONFIDENTIAL.

2.8

General Description of Information Sensitivity

The information created, processed, and used by HUMBL Inc. (“Company” or “HUMBL”) is one of ourmost valuable assets. Given the competitive nature of our business and market dynamics, these assets
must be protected commensurately with their business defined risk to the Company. The compromiseof these assets could severely impact our consumers, constitute a breach of laws and regulations, andnegatively affect the Company.
Securing HUMBL’s information assets involves addressing and resolving fundamental security questions.
These questions and their answers comprise the HUMBL Information Security Framework:
●
●
●
●
●
●
●
●

Do we know who is using the service?
Can we control what they do?
Can we ensure the privacy of information?
Can we prevent unauthorized changes to information?
Can we provide for non-repudiation of a transaction? (Can it be proved that someone
performed a transaction?)
Do we know whether there is a problem soon enough to take appropriate action?
How to minimize/contain the problem?
Can we prevent denial of service?

Confidentiality - HighCONFIDENTIAL information is characterized as secret or private materials shared by parties who stand ina relation of firm, fully assured trust to each other, and have a need-to-know. For HUMBL’s purposes,
this information is used on a need-to-know basis only by a specific group of employees.
Information must be classified as CONFIDENTIAL if it includes at least one of the following characteristics
and is not classified as RESTRICTED. Information intended to allow HUMBL to acquire or contact
potential or actual customers may, subject to the specified criteria, be classified in the CONFIDENTIALCONTACT sub-category by the Business unit:●

Product or system development information or marketing strategies, prior to general or public
disclosure.
8 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department●●

Data Security Plan Document

Information about customers and employees.
Information about customers, employees, payroll, medical, and HUMBL business that HUMBL is
obliged to protect, with local laws taking precedence.

CONFIDENTIAL CONTACT INFORMATION (CCI)●●May ONLY INCLUDE: Name, mailing address, email address, telephone number, FAX number.
The sub-category EXCLUDES: All financial information, transactional information, credit
applications and ID verification information (Social Security number, demographic data, etc.), or
any information otherwise classified by Policy or Standards as RESTRICTED.

All information characterized as production, including all customer information when used in a system
testing or development environment including:● Voice mail access codes and passwords.
● Internal and external audit reports.
● Business Risk Reviews.
● Regulatory agency reports, unless specified reports are classified by the regulatory agency as
PUBLIC information.
● Logs and reports produced by security services.
● Information that the business unit indicates provides or has potential for providing competitive
advantage.
Integrity - Medium
HUMBL business units must either perform Information Security Administration (ISA) for all information
under their jurisdiction, or have a written agreement (for example, a Service Level Agreement) to havethis function performed by a unit within another HUMBL business. ISA must manage and administer
security services under its control and ensure that these security services comply with HUMBL’s
Information Security Policy.
Business units that are serviced by an ISA function of another business unit must conform to thepractices of that ISA function and comply with this policy. ISA staff must not perform transactions thatconflict with their security administration function. Specifically:•

All administrative actions performed for business-determined high risk systems (for example
funds and securities transfers) that affect changes to user access, including entitlements andnew passwords, require an independent verification process to ensure that no one person
dominates the Security Administration process.

•

ISAs are required to review security audit logs, incident reports and on-line reports on an ongoing basis, and document and report any unusual or suspicious items to their ISO.
Availability - Medium
9 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Information must be classified as RESTRICTED if it includes at least one of the following characteristics:
●
●
●
●

●
●
●
●

HUMBL strategic planning information, prior to general or public disclosure.
HUMBL information on mergers, acquisitions, or divestitures, prior to general or public
disclosure.
HUMBL’s financial forecasts or results, prior to general or public disclosure.
Passwords – all except the following:○ Dynamically generated passwords, voice mail user access codes.
○ A one-time password (for example, temporary passwords that can be used only to allow
conversion to permanent passwords and permitting no access to databases).
Any form of cryptographic key.
Dynamic password PINs.
Customer identification and authentication information. Examples: Mother’s maiden name,elementary school attended.
Any other information that may be damaging to HUMBL if disclosed.

10 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

3 MANAGEMENT CONTROLS
3.1

Risk Assessment and Management

On June 28, 2021 a Cyber Risk Report was prepared for HUMBL. This report was prepared on behalf ofTokio Marine HCC and its cyber risk management partner, ePlace Solutions, Inc. to identify areas ofcybersecurity risk. The information evaluated in this assessment was acquired from a non-intrusive,
external scan of Internet-facing systems and applications used by HUMBL and from a comprehensive
search of over 100 databases of known software vulnerabilities, malware, blacklists, “darkweb”
information, and other sources of cybersecurity vulnerabilities.
HUMBL scored a 95 out of 100 on this test, where a higher score shows the more resistant yourorganization is to a successful cyber attack.
The assessment was based on:
1. Network Security Scan
● RDP Exposure● Network Exposure● Web Application Risk
● Web Traffic Encryption
2. Organizational Security Scan
● Dark Web● Domain and Mail Server Security● Twisted Domains
There will be another system risk assessment on or before June 28, 2023.

3.2

Review of Security Controls

The independent security review was conducted on June 28, 2021
The results were as follows:
1. Network Security ScanRDP Exposure:
Vulnerability Details- No open RDP ports were identified at this time.
The recommendation from the assessment was as follows:

11 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

●
●
●
●

Data Security Plan Document

Close all open RDP ports or put them behind a virtual private network (VPN)/Remote Desktop
gateway with two-factor authentication.
Train employees to recognize “phishing” attacks.
Create clean offline backups.
Install software patches ASAP.

Network Exposure:

Web Application Risk:
Vulnerability Details - No negative results were detected in this area.
The recommendation from the assessment was as follows:
●
●
●
●
●
●
●
●
●
●
●

Be sure your organization performs the following critical cybersecurity measures:
Train employees on social engineering/phishing (how to identify scams and not falling forphishing emails) and other basic cybersecurity measures.
Implement two-factor authentication wherever possible, including all remote access into yourenvironment and on all email accounts.
Remove any remote services from the public internet and secure them behind a VPN/RD
Gateway with two-factor authentication.
Prepare timely and complete backups for essential systems and data.
Restrict administrative privileges to operating systems and applications based on user duties.
Encrypt critical data.
Create a patch management program to keep all systems and software up-to-date.
Perform regular risk assessments.
Deploy Next Generation Endpoint protection.
Prepare and test an incident response plan to help you in the event of a live security incident.

12 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Web Traffic Encryption:
Vulnerability Details- No negative results were detected in this area.
The recommendation from the assessment was as follows:
●
●
●
●
●
●
●
●
●
●
●
●

Be sure your organization performs the following critical cybersecurity measures:
Train employees on social engineering/phishing (how to identify scams and not falling forphishing emails) and other basic cybersecurity
measures.
Implement two-factor authentication wherever possible including all remote access into yourenvironment and on all email accounts.
Remove any remote services from the public internet and secure them behind a VPN/RD
Gateway with two-factor authentication.
Prepare timely and complete backups for essential systems and data.
Restrict administrative privileges to operating systems and applications based on user duties.
Encrypt critical data.
Create a patch management program to keep all systems and software up-to-date.
Perform regular risk assessments.
Deploy Next Generation Endpoint protection.
Prepare and test an incident response plan to help you in the event of a live security incident.

2. Organizational Security Scan
Dark Web
Status - Good News: Your data is not on the dark web.
The recommendation from the assessment was as follows:
No news is good news, but a good score does not mean a “clean bill of health.” The dark web isnotoriously difficult to find information in because users are anonymous. That’s why the cyber criminals
use the dark web where search engines cannot operate. There is no “Google-like” search tool for thedark web. Instead, we rely on services that employ web crawlers and scrapers that monitor certain P2P
networks, websites and chat rooms where stolen information is being sold and advertised. Many P2P
networks, websites and chat rooms remain covert, and they are not being searched.

Domain Security
Status - Secure, detected lists: None
13 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Domain Security score uses your website domain (i.e. www.qmerit.com) and the related IP addresses tosearch over 103 blacklists and malware lists to identify whether your organization’s servers have beentagged as containing a virus or source of spam email.
Flagged servers are typically a sign of weak perimeter defenses or poor intrusion detection, showing ahigher risk of a data breach. This score indicates the strength of your perimeter defenses. A blacklist is areal-time list of IP addresses that are believed to distribute spam, and the lists are created and updatedby organizations that specialize in this area, like Spamhaus, Spamcop, and Barracuda. If yourorganization is found on a blacklist, it usually indicates a weakness in your cybersecurity defenses and/or
your intrusion detection systems. In other words, bad guys may have breached your security and may beusing your servers to send spam. The blacklists discovered and connected to your organization are listed
below. Malware lists are different, developed and maintained by cybersecurity organizations and major
law enforcement branches (e.g. the FBI) to catalog the known malware types used by hackers to gain
access to your computer for monetary gain. We look for evidence of known malware on your publicfacing servers and systems. The malware lists discovered and connected to your organization arelisted below.

Mail Server Security
Status - Secure, detected lists: None
If your email server is not configured properly, malicious actors use it to send spam and other harmful
content which will land you on a blacklist. The blacklists discovered and connected to your organization
are listed below. Poor mail server security may reflect an organization with poor cybersecurity habits.
Organizations with poor security habits are more likely to experience a successful cyber attack, includinga costly data breach. A lower Mail Server Security score is often associated with the failure to implement
some of the basic common cybersecurity controls, including: (1) proper configuration so that your email
server is not an "open relay" allowing spammers to use your mail server and network resources, (2)setting up your SMTP authentication to control user access, and (3) limiting connections to protect
against DoS attacks.
Twisted Domains
Status- Secure, detected lists: None

14 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Documento3.3

Planning for Security in the Life Cycle

5.

LIFE CYCLE OUTCOMESThe following narrative addresses the intent of the property & data management system relative to thelife cycle performance outcomes. The outcomes are grouped into the property & data lifecycle, as
follows:
The Acquisition lifecycle phase includes:
Acquisition (Outcome 1)
Receiving (Outcome 2)
The Use lifecycle phase includes: Physical Inventory (Outcome 4) Subcontractor Control (Outcome 5)
Utilization (Outcome 8)
Maintenance (Outcome 9)
The Disposition lifecycle phase includes: Relief of Stewardship (Outcome 7) Property & data Closeout(Outcome 10)
Records (Outcome 3) and Reports (Outcome 6) apply to all three lifecycle phases.
Outcome 1 - ACQUISITION
HUMBL will ensure that acquisitions are contractually authorized and consistent with its engineering,production planning, and material management operations. The Government may furnish property &data or may authorize HUMBL to acquire property & data for the performance of a contract, the costs ofwhich are allocable or properly chargeable to the contract as a direct cost. Property & data furnished by
the Government will be listed in the contract, or other authorizing documents. If HUMBL is authorized to

15 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

acquire property & data through use of the MILSTRIP or other agency acquisition system, the applicablepolicies, procedures, and forms, will be utilized.
Outcome 2 - RECEIVING
HUMBL will ensure controlled receipt for all property & data. Sites will establish a process for identifying
items received for the purpose of creating a record for and managing customer owned items andcompany capital assets. In addition, a process will be established for recording and managing materials.
The methods chosen will be validated and concurred with by the appropriate HUMBL Property & data
Management organization.
A process will be established to record the receipt of incoming shipments, including a process to reportany discrepancies, or damage, through the appropriate channels back to the sender or shipper as
required by terms of the contract and FAR 52.245-1.
IDENTIFICATIONHUMBL will apply an indication of ownership and identification number using a machine- readable
system to customer owned tooling, test equipment, and equipment, and company capital assets, wherepractical. This identification method will be controlled by Property & data Management and will be usedas the basis for establishing accountable stewardship records of managed property & data . Departmentof Defense (DoD) Unique Identification (UID) of Government Property & data will be applied andreported consistent with the requirements of the contract.
Outcome 3 - RECORDS Property & data Management System Records
HUMBL will establish a property & data management system to maintain complete, current, andaccurate auditable records for property & data accountable under HUMBL stewardship in accordancewith the established capital threshold.
A record will be established for items below the established capital threshold for both company andcustomer property & data). However, custodial updates such as location changes within a site andphysical inventory are not required. (Does not apply to Sensitive/Classified items). Records for company
expensed items are optional unless accountability is required for calibration or other reasons.
Each property & data management record will contain at a minimum the following information, unlessotherwise authorized:

1. The name, part number and description, National Stock Number (if needed for additional item
identification tracking and/or disposition), and other data elements as necessary and required inaccordance with the terms and conditions of the contract.

16 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

2.

Quantity received or fabricated, issued, and balance-on-hand.

3.

Unit Acquisition Cost (actual or estimated).

4.

Unique-item identifier or equivalent (if available and necessary for individual tracking).

5.

Unit of measure.

6.

Accountable contract number or equivalent code designation.

7.

Location (as a minimum site).

8.

Disposition.

9.

Posting reference and date of transactions.

10.

Date placed in service (if required in accordance with the terms and conditions of the contract).

Material Records
HUMBL will use a material management system for the accountability and control of production andengineering material when the DFARS MMAS clause is in the contract.
HUMBL may maintain, in lieu of system property & data records, a file of appropriately cross-referenced
documents evidencing receipt, issue, and use of material issued for immediate consumption whenappropriate and approved by Property & Data Management and the Government Property & Data
Administrator where applicable.

Sensitive Property & Data Records
Records of sensitive property & data will be clearly marked to indicate the basis for the designation as
sensitive property & data. Examples include weapons (record serial numbers), ammunition, narcotics,
explosives, radioactive material, hazardous material, hazardous waste, and precious metals.

Outcome 4 - PHYSICAL INVENTORYHUMBL will conduct physical inventories of Government/Customer property & data on a periodic basis
and upon contract completion or termination as required in accordance with industry practices (ILP) andstandards unless specified in contract provision. The Physical Inventory process will consist of 4 steps:
17 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Planning, Data Collection, Reconciliation and Reporting. Physical Inventory reporting will be required forcontracts with accountable property & data. Results will be reported to the Government or customer inaccordance with Site Specific Procedures.
Fixed assets will be inventoried in accordance with HUMBL’s accounting policies.
Outcome 5 - SUBCONTRACTOR CONTROLHUMBL will require subcontractors, who possess or manage Government/Customer property & data, toadequately manage, care for, and maintain the property & data in accordance with the provisions of thesubcontract/purchase order/administrative contract. HUMBL will ensure that appropriate language andclauses are delineated in the subcontract, purchase order, administrative contract, or internal workorder to mutually protect the interest of the Government, Customer and HUMBL. HUMBL will ensurethat contractually required reports include Subcontractor supplied data as necessary. Each ProjectManager will determine whether to use the Subcontractor records as the stewardship records, or toestablish duplicate records in the appropriate HUMBL Property & Data System.
Property & Data Management or its designee will perform subcontractor analysis when required. Initial
reviews of the Subcontractor will include review of any or all the Subcontractor’s property & data plan,
procedures, Government issued approval letter, and any self-assessments. Periodically, eachsubcontractor possessing Government/Customer property & data accountable to HUMBL prime
contractors will be required to provide a report of physical inventory results. HUMBL Property & DataManagement personnel or its designee may visit those entities that demonstrate any of the following:
•
•
•
•
•
•

Non-responsiveness to contract provisions.
A significant amount of property & data.
A high incidence of Loss (including damage, or destruction).
An inadequate Government Property & data & Data Management Plan/system.
An inadequate self-assessment report.
Ineffective processes to accurately account for property & data.

HUMBL will require subcontractors to report a loss, including damage, or destruction of property & datain their possession in accordance with the terms and conditions delineated in the contractual
arrangement, and prior to closure of the subcontract, purchase order, administrative contract, orinternal work order.
Prior to the close-out of the subcontract(s) or purchase order(s) requiring the use of Subcontractor held
Government/Customer property & data, HUMBL will coordinate the transfer to follow-on orders, its
return, or disposal. All loss, including damage or destruction liability cases will be resolved prior to
subcontract, purchase order, administrative contract, or internal work order closure.
Outcome 6 – REPORTS
18 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

HUMBL will ensure contractually required reports of Government/Customer property & data aresubmitted accurately and in a timely manner.
Processes will be established to create and provide as required the following types of reports:
•
•
•
•
•
•

Reports of Discrepancies.
Loss, including damage and destruction reports.
Reports of physical inventory results.
Reports of audits and self-assessment results.
Reports of corrective actions.
Other property & data related reports as required by the contract.

Preparation of the following reports will be handled by gathering information from the different sites
and compiling the information into the format required.
a.

Property & data Management System

HUMBL’s Property & Data Management maintains a suitable property & data management and tracking
system for maintaining accountable stewardship records of all customer-owned property & data under
the custody of HUMBL.
*Loss reporting for property & data with a value below the established capital threshold or determined
to be low risk may be deferred until contract completion or termination.

Outcome 7 - RELIEF OF STEWARDSHIP
Relief of Stewardship Responsibility
HUMBL will disclose and report excess property & data to the Government when it is no longer required
to fulfill contractual obligations. Relief of Stewardship responsibility will take place when:a.
Property & data is disposed in accordance with contract instructions.
b.
Consumed or expended during contract performance.
c.
Processed through an inventory adjustment.
d.
Delivered or shipped under Government instructions.
e.
Relieved of liability through a Loss, including Damage or Destruction Report.
f.
Processed as production scrap (unusable material resulting from production, engineering,
operations and maintenance, repair, and research and development contract activities).
g.
Transferred to fulfill another contract’s requirements.
19 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Documenth.
Credit the costs of Contractor-acquired property & data (material only) to the losing contract,and debit the gaining contract with the corresponding cost, when such material is needed for use on
another contract.
i.
Processed through PCARSS disposal instructions.
j.
Abandoned in accordance with contract terms.
Individual contracts should address the disposition of aircraft parts or should be disposed of upon
direction of the Plant Clearance Officer.
Scrap Process:Production scrap may be commingled regardless of ownership and dispositioned without customer
approval in accordance with its own internal scrap procedures. However, customer owned scrap that
requires demilitarization or is sensitive or hazardous in nature (including precious metals in raw or bulkform) shall be submitted on an inventory disposal schedule to the customer. Production scrap that may
contain precious metals may be commingled regardless of ownership and dispositioned without
customer approval in accordance with its own internal scrap procedures.
Periodically, HUMBL may issue a formal or informal bid for scrap sales in accordance with Property &Data Management procedures. In addition, HUMBL may contract with a third party for the collection,
separating and processing of scrap. Net proceeds from a scrap sale will be handled in a mannerconsistent with disclosed cost accounting practices
Government-owned property & data , other than that resulting from production scrap, that has been
expended (no longer has value in its current form), may be submitted on an Inventory Disposal
Schedule. Scrap (other than production scrap) should be reported by “lot” along with metal content,
estimated weight and estimated value.
Particular attention should be paid to the following
•
•
•
•
•

Sensitive items
Hazardous materials or wastes
Classified or otherwise controlled items
Precious or strategic metals
Characteristics or components dangerous to public health or safety.

Such scrap property & data may require physical segregation, unique disposal processing or separate
plant clearance or customer reporting.
Repair Contracts may delineate disposal language by commodity. Items deemed Beyond Economical
Repair (BER) will be disposed of in accordance with contract direction. Items deemed Beyond PhysicalRepair (BPR) will be disposed of in the most efficient manner: contract direction or plant clearance.
20 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Removal of Government Markings
If property & data is not returned to the Government, HUMBL will ensure removal of any markings
identifying the property & data as U.S. Government-owned property & data prior to its disposal.
PCARSS Submission Requirements
HUMBL will submit inventory disposal schedules to the Plant Clearance Officer no later than (i)30 days following the determination that a Government property & data item is no longer
required for performance of a contract;(ii)
60 days, as may be approved by the Plant Clearance Officer, following completion of contract
deliveries or performance; or(iii)
120 days, as may be approved by the Termination Contracting Officer following contract
termination in whole or in part.
The Plant Clearance Officer shall provide the contractor disposition instructions for property & data
identified on an acceptable inventory disposal schedule within 120 days. Failure to provide disposition
instructions by this date may entitle HUMBL to an equitable adjustment.
Outcome 8 - UTILIZATION
Government/Customer property & data, whether furnished or acquired, will only be used for the
purpose for which it was acquired or as authorized. Systems have been established for ensuring thatproperty & data is authorized for use. When necessary, rent-free, non-interference use is requested.
Property & data is utilized and or consumed to its maximum capacity and declared excess when nolonger contractually required for retention.
Property & data is moved and stored with proper contractual authority, adequate protection,
appropriate documentation, and prompt record updates.
Outcome 9 - MAINTENANCE
HUMBL will provide a maintenance program designed to the degree necessary to ensure the optimum
useful life of property & data in its possession. Maintenance is not required for items in disposal. It
includes the determination of the need for, and the performance of, maintenance, rehabilitation, andthe recording of work accomplished. The four major types of maintenance are Routine Repair andAdjustment, Preventive Maintenance, Emergency Repair, and Calibration. HUMBL will disclose andreport to the Property & data Administrator the need for replacement or capital rehabilitation.
Outcome 10 – PROPERTY & DATA CLOSEOUT
Upon notification from HUMBL Contracts of contract completion or termination, the following actions
will be promptly performed:
21 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

1.
Physically inventory property & data sufficient for disposal purposes unless waived by the
Customer.
2.
Screen for reutilization, purchasing and excess.
3.
Investigate, report, and resolve loss, including theft, damage, and destruction cases.*
4.
Report excess/residual Government/Customer property & data.
However, excess/residual property & data may not be reported when contractual disposal instructions
exist.
5.
Comply with disposal instructions.
6.
Submit property & data closeout certification.
*A summary report listing all property & data below the established capital threshold or low risk
property & data not located will be provided.
Upon completion or termination of a subcontract, the subcontractor will be directed by HUMBL toinitiate closeout actions for property & data in their possession.
6.

SOURCE DATAHUMBL will make available acquisition and disposition source data for Government/customer owned
property & data as may be required by the contract.

Records will be retained in accordance with contract terms and HUMBL records retention policy.
7.

PROCEDURES

HUMBL will maintain procedures necessary to ensure the effectiveness of its property & data
management system.
8.

SELF-ASSESSMENT

HUMBL will perform risk-assessments at the appropriate entity level to evaluate the effectiveness andefficiency of its property & data management system. This risk-assessment will be utilized to determine
the outcomes to review.
Self-Assessments will be performed, and results made available to the Government/Customer uponrequest. As a result of these self-assessments, improvements may be made, and significant deficiencies
corrected and documented.
HUMBL will develop, maintain, and publish metrics to measure the performance of the property & data
management system. Data collected for the metrics will be used to compare to the standards and will
22 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

represent the actual level of performance. The metrics will be used to provide insight for managing
property & data and to provide information for use in identifying process improvements.

3.4

Development/Acquisition Phase

HUMBL worked with the following vendors during the development / acquisition phase:
●
●
●
●
●

7Ci ("Chief Information Security Officer")
Ascent (Business Continuity Planning/Disaster Recovery)
Venminder (Third Party/Vendor Risk Management
FIS Global / Regulatory University (Employee Training platform)
Privacy Team ("Data Protection Officer"):

In addition to the stated vendors, as mentioned in 3.2 Review of Security Controls, a thorough Network
and Organizational Security Scan were performed with the results summarized above.
Even Though HUMBL passed the test with a score of 95/100, HUMBL’s management and complianceofficers took the results as well as feedback from the cybersecurity assessment very seriously.

3.5

Implementation Phase
The date the accreditation request will be made is June 4, 2023.

3.6

Operation/Maintenance Phase
The security plan documents the security activities required in this phase.

23 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

4 OPERATIONAL CONTROLS
4.1

Personnel Security●

Have all positions been reviewed for sensitivity level?

Yes●

Have individuals received background screenings appropriate for the position to which they are
assigned?
Background checks were conducted on all employees through Checkr (https://checkr.com).
● Is user access restricted to the minimum necessary to perform the job?
Yes●

Are critical functions divided among different individuals (separation of duties)?

Yes● What mechanisms are in place for holding users responsible for their actions?
Acceptable use policy
Failure to comply with acceptable use policy may result in appropriate disciplinary/corrective actions,which may include termination of employment.
●

What are the friendly and unfriendly termination procedures?

There are procedures and policies in place as stated in HUMBL’s Employee Separation Policy, dependingon whether the separation was Voluntary or Unvoluntary.
VOLUNTARY SEPARATIONS
A voluntary termination of employment occurs when either an employee informs his or her supervisorof their resignation, or when an employee is absent from work for three consecutive workdays and fails
to contact his or her supervisor (job abandonment).
Procedure
Employees are expected, but not required, to provide a minimum of two weeks’ notice of their intention
to separate from the company in order to allow a reasonable amount of time to transfer ongoing
responsibilities to another employee. The employee should provide written notification to his or her
supervisor.
Upon receipt of an employee's resignation, the Supervisor is to complete a Personnel Action Form,providing important details for the separation, and forward to the HR Department with the resignation
letter (if provided).
The Supervisor is to meet with the employee just after notification of the resignation to review theemployee’s current responsibilities, the location of specific job-related documents, and other job
specific information pertinent for the continued success of that position.

24 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

HR will coordinate the employee's separation. This process includes:• Processing separation letter and corresponding separation documentation.
• Processing final pay, including pay out of accrued vacation, expenses and/or commissions.
• Processing an IT Ticket to inform the IT Department to disconnect computer access and cancel
passwords at time of separation.
• Providing an exit Interview questionnaire to employees.
o The exit interview provides the employee the opportunity to freely express views about working
at the company and will be held in strict confidence. HR will compile data from exit interviews todetermine if feedback to an employee’s Supervisor is necessary.
● On the employee's last day, meeting with employee and Supervisor to review separation paperwork,
obtain all company property (i.e., keys, computer equipment, etc.), review exit interview
questionnaire and answer any remaining questions.
● Canceling all computer systems accesses.
INVOLUNTARY SEPARATIONS
An involuntary separation of employment, including layoffs, is a management-initiated dismissal.
Discharge may be for any legal reason, i.e., misconduct, tardiness, absenteeism, unsatisfactory
performance, inability to perform, etc. In many cases coaching and corrective action may be used, prior
to separation of employment, with the intent to correct any performance problem(s). However, certain
types of employee misconduct are so severe that one incident of misconduct (gross misconduct) will
result in immediate dismissal without prior use of coaching and corrective action. Types of grossmisconduct may include, but are not limited to: theft, fighting, serious negligence, and offensive
behavior (discrimination, harassment, bullying, abuse and violence). The Supervisor is to contact HR
immediately upon discovery of gross misconduct.
Prior to an involuntary termination, consideration will be given to an employee's service and past
contributions to the company. The possibility of transfer or demotion will be explored in all cases except
those which involve gross misconduct.
Procedure
Before any action is taken to dismiss an employee, the employee’s Supervisor is to inform HR of therequest to terminate employment. A written document is to be provided that identifies dates andspecific details of the issue(s) that occurred, as well as any and all conversations, and/or other written
documentation that was provided to the employee.
HR will review all information provided and speak with the Supervisor and appropriate Senior Manager
and make a decision whether termination is warranted.
• If dismissal is NOT warranted, HR will work with the Supervisor to formally review and document
performance expectations with the employee, and document progress or failure. The Supervisor isto keep HR informed on the status of the employee’s performance until such time as the employee’s
performance has significantly and consistently improved or it is agreed the employee’s performance
is not improving and termination of employment is appropriate.

25 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department•

Data Security Plan Document

If dismissal is warranted, the Supervisor is to complete a Personnel Action Form and provide it to
HR. HR will coordinate the employee’s separation as follows:o Create all the necessary separation documents.
o Schedule the separation meeting with the Supervisor.
o Process final check for day of separation.
o Process an IT Ticket to inform the IT Department to disconnect computer access and cancel
passwords at time of separation.

The day of the separation the following is to take place:● The Supervisor and HR Representative will meet and discuss any final details and ensure thescheduled meeting time with the employee is still appropriate, adjusting if necessary.
● The Supervisor and HR Representative will meet with the employee, inform him/her that theiremployment is being terminated, review all appropriate documents, and provide a final paycheck.
● The Supervisor is to stay with the employee while he/she collects any personal belongings and thenescort the employee off the premises. All of this is to be conducted in a professional and respectfulmanner.
● After the separation meeting, HR and the Supervisor are to meet to ensure all aspects of theseparation were covered, verify all documents were processed and property was collected.
● HR will inform IT to cancel computer systems access.

4.2

Physical and Environmental Protection•

4.3

The building is controlled by lock and key, and only Jeff Hinshaw and Michele Rivera maintainkey access to the facility. There is also 24/7 security that is on staff that monitors access to thefacility.

Production, Input/Output Controls

Describe the controls used for the marking, handling, processing, storage, and disposal of input andoutput information and media, as well as labeling and distribution procedures for the information andmedia. The controls used to monitor the installation of, and updates to software should be listed. In thissection, provide a synopsis of the procedures in place that support the system. Below is a sampling of
topics that should be reported in this section.

HUMBL staff, consultants, and vendors must not disclose RESTRICTED, CONFIDENTIAL, or INTERNAL
information except as authorized by information owners. In all cases, appropriate non-disclosureagreements must be in place and complied with. The person disclosing information must ensure positive
identification of the requester and a credible need-to-know requirement.
If an unknown caller requests telephone information, call back after verification of the requester’s ID
and a valid business purpose must be performed. Business units with established, documented positive
identification processes for customers may be exempted. Any use of emerging identification and
26 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

authentication systems (for example biometrics, smart cards, and public key infrastructure systems)
must be reviewed with and certified by the CISO prior to production implementation.
Audit Trails
All technology platforms that store HUMBL information must use audit trails to ensure accountability ofsystem and security-related events.
Network Information Security
All information networks, regardless of connectivity, whether proprietary, contracted, or public, must be
protected from unauthorized access. Information networks include, but are not limited to Intranets,
LANs, WANs, MANs, and VANs. Network information security is not a substitute for application security.
Each business unit is responsible for its own information application or host processor security.
All entry points into HUMBL networks must be protected from unauthorized access, and all processors
and nodes processing information must be protected from unauthorized access. The purchase,
downloading, or installation of hardware or software network data monitoring tools, including sniffersand data scopes, is prohibited unless the activity is approved by CISO. All use must comply withapplicable laws and Information technology policy.
Clean Desk
Each Business Unit must ensure that a clean desk policy is documented and enforced that ensures all
RESTRICTED and CONFIDENTIAL information stored on any media are always secured from access ordisclosure to unauthorized persons. In general, HUMBL is a paper-free organization.
Penetration Testing
All HUMBL products, services, or applications which use the Internet for connectivity or communications
must undergo a penetration test managed by the Information Security Officer and the sponsoringbusiness unit's Information Security Officer prior to opening the Internet connection. High risk findings
identified in the tests must be resolved to the satisfaction of the Information Security Officer and theappropriate Information Security Officer before the product, service, or application can establish an
open Internet connection.
All modifications to products, services, or applications that use the Internet must be reviewed by the
Information Security Officer prior to implementation to determine if a subsequent test is required. This
standard applies to all Internet products, services, or applications which store, transfer, or process
HUMBL information, whether maintained by HUMBL or a third-party and are intended for use byanyone accessing HUMBL via the Internet.

27 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

4.4

Data Security Plan Document

Contingency Planning

Briefly describe the procedures (contingency plan) that would be followed to ensure the system
continues to process all critical applications if a disaster were to occur. If a formal contingency plan has
been completed, reference the plan. A copy of the contingency plan can be attached as an appendix.
Include descriptions for the following:
●
●

●
●
●

Any agreements for backup processing
Documented backup procedures including frequency (daily, weekly, monthly) and scope (full,incremental, and differential backup) Critical data will be backed up on a daily basis to AWS andto our on-premises NAS. As per the Business Continuity and Disaster Recovery Plan
Backups are stored on premise to the corporate NAS
Are tested contingency/disaster recovery plans in place? How often are they tested?
Are all employees trained in their roles and responsibilities relative to the emergency, disaster,and contingency plans? Yes, the plan is as follows:
Phase I: Determination of a Breach, Alert and Organization

1.

Company alerted to possible data breach - record date, time, and method of alert

2.
Notify relevant internal Incident Response Team (IRT), consisting of a representative from, as
needed:a.

Information Technologyb.

Legal/Compliance

c.

HR

d.

Public Relationse.

Customer Service

3.

Business Head identifies an incident lead for this incident - performs as project manager

4.

Coordinate or convene conference call of IRT if needed5.
Determine whether a breach has occurred. If a breach has not occurred, the remainder of thisAppendix do not apply. However, a possible incident log will be maintained which includes the record
date, time, and method of alert and basis for determination. The IT Contact will maintain the log.
6.
If determined there is a breach, consider hiring forensic technology partner depending on
available internal resources and complexity of breach7.
If determined there is a breach, notify the insurance carrier/understand scope ofpreauthorization or limitations on third-party vendor reimbursement if needed.
Phase II: Initial Scoping Before Containing an Ongoing Breach

28 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

1.
Identify, document, and preserve initial understanding of scope of compromise to the extent
possible within 24-48 hours
2.
Consider notifications or steps to take before stopping the breach that may prevent harm in theevent the act of stopping the breach alerts data thieves that you have discovered them3.

Preserve any evidence related to the ongoing breachPhase III: Contain the Breach4.
Be sure that the full scope of compromise is understood to the extent possible within 24-48
hours
5.

Contain/arrest the breach — stop any possible flow of data to unauthorized recipients

6.

Document results of containment effort

Phase IV: Conduct Investigation
7.

Root cause analysis

8.

Classify type of breacha.

Hackingb.

Internalc.

Loss/Theft of Tangible Data (computer, device, storage media)d.

Inadvertent Disclosuree.

Loss with No Known Disclosure

f.

Other

9.

Full identification of data compromiseda.

Type of information compromisedi.

Sensitive personal information

1.

Social Security numbers

2.

Credit card information

3.

Financial account data

4.

Medical information

5.

Usernames and passwords

6.

Driver’s license numbers

29 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

7.

Other sensitive personal information (disclosure of which could cause harm)ii.

Other personal information

1.

Contact information (name, address, email address, phone number, etc.)2.

Preferences, purchase history

3.

Other information linked to a person that is not sensitiveb.

Individuals whose information was compromised, including where they reside

10.

Determine nature of any unauthorized recipientsa.

Employee acquisition in good faithb.

Business partnerc.

Trustworthy recipient who normally receives information of this natured.

Unknown individuals, but definite disclosuree.

Lost information — may not have been disclosedf.

Suspected bad actor/employee not in good faithg.

Known bad actor/departed or departing employee

11.

Assess known or discoverable actual use of compromised information

12.

Undertake security updates necessary before notification

Phase V: Notifications (In light of information developed in Phase IV)
13.

Before notifications consider if neededa.

Develop PR plan for potential media inquiriesb.
Consider notification to Company senior management or others who should be notified before
publicc.

Prepare for inquiries from affected individuals - call center or other14.
If criminal and depending on seriousness and other factors, notify relevant law enforcement —local, FBI, Secret Service, or other15.
If required by law or recommended because individuals could do something to prevent further
harm to themselves, make notifications to affected individuals. If made,30 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Documenta.
Include what happened, what the Company has done, and what the individual can do to prevent
any harmb.

Include legally required information and resources available from government agenciesc.
Consider an offer of identity theft prevention/ credit monitoring depending on nature of
information compromised
16.

Notifications to government agencies and Attorneys General as required by law

17.

Other notifications as required by information at issue

18.
Evaluate feedback from notifications and determine if additional steps/notifications are
requiredPhase VI: Post-Notifications Considerations
19.

Disclosures to customers, stockholders, regulators etc.

20.

Cost recoveries - responsible third parties, insurance, other21.
Consider longer-term security upgrades or other measures to prevent reoccurrence or similar
events22.

Analyze data breach notification plan/checklist for necessary changes in light of lessons learned

23.

Prepare final reportsa.
Executive report with a summary of what happened, how it was addressed, what notifications
were provided, and steps taken to prevent future incidents of the same or similar nature
Technical report with detailed background of the event; evidentiary backup for analysis, decisions, andconclusions; and evidence of preventative measures

4.5

Hardware and System Software Maintenance Controls
No employees are permitted to install software on firm-owned equipment without first obtaining
written approval from the IT Department (“IT”). The Company has implemented security
procedures to protect nonpublic personal information that is electronically stored or transmitted
include authentication protocols, secure access control measures, and encryption of alltransmitted files. The Company has adopted procedures to promptly eliminate access to all
Company networks, devices, and resources as part of its HR procedures in the event an employee
resigns or is terminated. Such an employee must immediately return all firm-related equipment
and information to the CTO or head of HR.
Access to the Company’s information systems is limited to authorized persons and only to thoseparts of its systems that are appropriate to each employee’s, consultant’s, or vendor’s job duties.
Employees, consultants, and vendors should not attempt to access another person’s computeraccount without the prior consent of such person or of his or her supervisor. Function heads and
31 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

supervisors should notify the IT Service Desk promptly whenever an employee leaves theCompany, a consultant or vendor relationship is terminated, or other circumstances exist that
require additional or restricted access to the Company’s information systems so that such
person’s access can be appropriately changed or revoked.

●
●
●
●
●
●
●

●
●
●
●

4.6

Restriction/controls on those who perform maintenance and repair activities.
Special procedures for performance of emergency repair and maintenance.
Procedures used for items serviced through on-site and off-site maintenance (e.g., escort ofmaintenance personnel, sanitization of devices removed from the site).
Procedures used for controlling remote maintenance services where diagnostic procedures ormaintenance is performed through telecommunications arrangements.
Version control that allows association of system components to the appropriate systemversion.
Procedures for testing and/or approving system components (operating system, other system,
utility, applications) prior to promotion to production.
Impact analysis to determine the effect of proposed changes on existing security controls to
include the required training for both technical and user communities associated with thechange in hardware/software.
Change identification, approval, and documentation procedures.
Procedures for ensuring contingency plans and other associated documentation are updated toreflect system changes.
Are test data “live” data or made-up data?
Are there organizational policies against illegal use of copyrighted software or shareware?

Integrity Controls
●
●
●
●
●
●

●

Is virus detection and elimination software installed? If so, are there procedures for updating
virus signature files, automatic and/or manual virus scans, and virus eradication and reporting?
Are reconciliation routines used by the system, i.e., checksums, hash totals, record counts?
Include a description of the actions taken to resolve any discrepancies.
Are password crackers/checkers used?
Are integrity verification programs used by applications to look for evidence of data tampering,errors, and omissions?
Are intrusion detection tools installed on the system?
Is system performance monitoring used to analyze system performance logs in real time to look
for availability problems, including active attacks, and system and network slowdowns andcrashes?
Is penetration testing performed on the system? If so, what procedures are in place to ensure
they are conducted appropriately?

32 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department●

4.7

Data Security Plan Document

Is message authentication used in the application to ensure that the sender of a message isknown and that the message has not been altered during transmission?

Documentation
●

●

4.8

Documentation for a system includes descriptions of the hardware and software, policies,
standards, procedures, and approvals related to automated information system security of thesystem to include backup and contingency activities, as well as descriptions of user and operator
procedures.
List the documentation maintained for the system (vendor documentation of
hardware/software, functional requirements, security plan, program manuals, test results
documents, standard operating procedures, emergency procedures, contingency plans, user
rules/procedures, risk assessment, certification/accreditation statements/documents,
verification reviews/site inspections). Before entering a contract or sharing data with a vendor,
the vendor will be assessed as to whether they have the proper security controls in place toprotect the type of data that will be shared or stored. Also, the contract language will include, ata minimum, that the vendor is required to contact HUMBL Inc. within 72 hours if there has beena breach that involved our data or customer data. The contract also states that the vendor isrequired to keep the security controls at the current level or above in place to protect the data.

Security Awareness and Training●●

Describe the awareness program for the system (posters, booklets, and trinkets).
Describe the type and frequency of general support system training provided to employees andcontractor personnel (seminars, workshops, formal classroom, focus groups, role-based training,and on-the job training).
Employees are required to complete security awareness training upon hire. The training helps
employees to identify potential phishing emails, how to identify PII, and how to protect PII, as
well as how to recognize tricks and techniques hackers may use to harm employees or theorganization.
HUMBL has partnered with FIS Global / Regulatory University as part of their employee training
platform. This is HUMBL’s main platform for educating and training employees on importantcompliance topics. FIS® Regulatory University features a library of more than 350 online
compliance training courses covering safety and soundness, consumer protection, high andemerging risk issues, and other topics relevant to multiple lines of business. The Regulatory
University platform’s analytics identify gaps in staff awareness around risk and compliance laws,
policies and procedures.
HUMBL will carefully select additional courses that all employees will be required to complete
for Q1 and Q2 of 2023.

33 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

4.9

Data Security Plan Document

Risk Management

Are there procedures for reporting incidents handled either by system personnel or externally?
Yes, HUMBL has a comprehensive incident response plan as well as information privacy incident
response plan (“IRP”). This is summarized in 5.7.1● Are there procedures for recognizing and handling incidents, i.e., what files and logs should be
kept, who to contact, and when?
●

Incidents can be detected in different ways and through various sources depending on their nature andcontext. Incidents may be detected by an internal / external stakeholder or third-party, for example:
Nature of Incident

Source of Information

Context of Detection

List of HUMBL’s event attendees isavailable on the dark web
User data is circulating the Internet

Regulatory or enforcement
authority
Detection software

User data is exposed tounauthorized agents

Third-party provider

HUMBL manager receives acall or an email
HUMBL employee stumbles
across it
Third-party provider
experiences an Incident

Note: While it is not unusual for there to be a delay between the occurrence of the Incident and its
detection, the goal of a proactive approach is to reduce this time period.
Once an Incident has been detected, a thorough analysis must be initiated without delay.
6-Step Incident Detection & Analysis:Upon detection or suspicion that an Incident has occurred, immediate notification must be made to the
Incident Response Leader, who, where appropriate, shall assemble the IRT. The Incident analysis is thentypically performed by relevant members of the IRT.
Once concluded, the analysis should be documented by the IRT Leader, Facilitator, or other member
as determined by IRT Leader at such time.

Step 1

Step 2

Step 3

All: Detect & Escalate
Detection of potential incidents may occur in/by Customer Success, R&D, Legal,
Communications, or by any other team, employee or vendor of the company - andshould be followed by immediately alerting the IRT Leader for initial analysis anddetermination.
IRT Leader + Legal + DPO: Analyze & Assess
The IRT Leader, together with Legal and Privacy teams as necessary, shall perform an
initial analysis and assessment of the characteristics and severity of the Incident, andupon preliminary determination that it may involve Personal Data, shall activate the IRP
and assemble the IRT.
IRT Leader: Activate Incident Response Plan & Assemble IRT
Based on the conclusion that is drawn from the Incident analysis, activate Plan andassemble IRT – by sending alerts via mail or Google Meet (if working remotely).
34 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Step 4

Step 5

Step 6

Data Security Plan Document

Incident Response Team: Assemble
Immediately upon receiving an alert, assemble in the Google Meet dedicated room (ifworking remotely) or in [Conference room #XXX] if situated on HUMBL premises.
Incident Response Team: Rollout of Incident Response Plan
Performance of respective Roles and Responsibilities for each IRT member in
Containment, Communication, Eradication.
IRT Leader: Announce Disassembly, De-brief & Document

4.9.1 Cyber Insurance●

HUMBL is in the process of renewing its comprehensive cyber security plan, with policy number:●

HUMBL has a general liability insurance plan with policy number

4.9.2 Service Level Agreement
The Single Sign-On (SSO) SaaS Services will achieve System Availability (as defined below) of at least
99.9% during each calendar year of the Subscription Term. All other SaaS Services will achieve
System Availability (as defined below) of at least 99% during each calendar year of the Subscription
Term. “System Availability” means the number of minutes in a year that the key components of the
SaaS Services are operational as a percentage of the total number of minutes in such year, excluding
downtime resulting from (a) scheduled maintenance, (b) events of Force Majeure in the SaaS
Agreement),(c) malicious attacks on the system, (d) issues associated with the Customer’s computing devices,
local area networks or internet service provider connections, or (e) inability to deliver services
because of acts or omissions of Customer or any Immutable Data Services user. HUMBL reserves theright to take the Service offline for scheduled maintenance for which Customer has been provided
reasonable notice and HUMBL reserves the right to change its maintenance window upon priornotice to Customer.
If HUMBL fails to meet System Availability in the year, upon written request by Customer within 30
days after the end of the year, HUMBL will issue a credit in Customer’s next invoice in an amountequal to 1% of the yearly fee for the affected SaaS Services for each 1% loss of System Availability
below stated SLA per SaaS Service, up to a maximum of the Customer’s fee for the affected SaaS
Services. If the yearly fee has been paid in advance, then at Customer’s election HUMBL shallprovide a credit to Customer to be used for additional Immutable Data Services or term extension.
The remedy stated in this paragraph is Customer’s sole and exclusive remedy for interruption of
SaaS Services and HUMBL’s failure to meet System Availability.
1.

Support and Maintenance Services

35 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Support and Maintenance Services are included in the SaaS Service subscription in Exhibit A and entitles
Customer to the following:(a)Telephone or electronic support in order to help customers locate and correct problems with
the Software.
(b)
Bug fixes and code corrections to correct Software malfunctions in order to bring such Software
into substantial conformity with the operating specifications.
(c)
All extensions, enhancements, and other changes that HUMBL, at its sole discretion, makes oradds to the Software and which HUMBL furnishes, without charge, to all other Subscribers of the SaaS
Service.
(d)Up to five (5) dedicated contacts designated by Customer in writing that will have access to
support services.

2.

Response and Resolution Goals“Business hours” 8am-6pm CST, Monday thru Friday, except holidays.
“Fix” means the repair or replacement of a Software component to remedy Problem.
“Problem” means a defect in Software as defined in HUMBL’s standard Software specification thatsignificantly degrade such Software.
“Respond” means acknowledgement of Problem received containing assigned support engineer name,date and time assigned, and severity assignment.
“Workaround” means a change in the procedures followed or data supplied by Customer to avoid a
Problem without substantially impairing Customer’s use of the Software.

Problem Severity Response Goals Resolution Goals
1. The production system is creating a significant impact to the Customer’s business function preventingthat function from being executed. HUMBL will Respond within 2 business hours. Upon confirmation ofreceipt, a HUMBL support personnel begins continuous work on the Problem, and a customer resourcemust be available at any time to assist with problem determination. Customer Support will provide
reasonable effort for Workaround or Fix within 24 hours once the Problem is reproducible or once wehave identified the Software defect. HUMBL may incorporate Fix in future release of software.
2. The production system or application is moderately affected. There is no workaround currently
available, or the workaround is cumbersome to use. HUMBL will Respond within 4 business hours.
Customer Support will provide reasonable effort for Workaround or Fix within 7 business days, once the
Problem is reproducible. HUMBL may incorporate fixes in future releases of software.
3. The production system or application issue is not critical: no data has been lost, and the system has
not failed. The issue has been identified and does not hinder normal operation, or the situation may be
temporarily circumvented using an available workaround. HUMBL will Respond within 8 business hours.
Customer Support will provide reasonable effort for Workaround or Fix within 10 business days, once
the Problem is reproducible. HUMBL may incorporate Fix in future release of software.
36 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

4. Non-critical issues, general questions, enhancement requests, or the functionality does not matchdocumented specifications. HUMBL will Respond within 24 business hours. Resolution of Problem may
appear in future release of software.

3.Accessing Support
Customer Support offers several ways to resolve any technical difficulties. In addition to online help in
the Software, which can be accessed by clicking the “Help” tab when logged into the Software, functionspecific help information can also be accessed throughout the Software using the ‘?’ option.
The support email address is support@HUMBL.com. The support phone number is +1-619-505-5101 or
via ZenDesk @ https://www.humbl.com/contact/support.

4.9.3 Incident Response Plan
The Company has established an incident response plan, attached hereto, to manage detected security
events or incidents, analyze their impact, and mitigate their threat. The incident response plan isdesigned to coordinate responses both internally and externally.
Procedures employed in the event of specific, defined circumstances are outlined below.
Unauthorized Website Access – In the event that an unauthorized person gains access to a customer’s
online account, IT will remove the customer’s website user ID from the site, remove all account data forthe customer from the website, and notify the web server if the server is not aware of the breach.
Fraudulent Customer Communication – In the event that the Company receives a fraudulent
communication purporting to be from a customer, the Company will escalate the issue to IT and the
CTO. The Company will notify personnel and require that all account transfer requests related to thecustomer are verbally approved by calling the customer at a telephone number known to the Company.
The Company’s CTO will contact the relevant custodian to notify the custodian of the fraudulent
communication. The Company will contact the customer if the customer is not aware of the issue.
Account information will be accessible through the phone only until the customer provides confirmationthat electronic communication is permitted for the account.
Loss or Theft of Laptop or Mobile Device – In the event that an employee laptop or device is lost or
stolen, IT will wipe all information from the lost device. An authorized person from the Company may
contact outside counsel to discuss the situation and whether further steps are necessary.
Breach of Main Server – In the event of a breach of the main server, the Company will switch to theback-up server. IT will investigate the breach and determine how to contain the breach as quickly as
possible. The Company will ensure that access is denied to anyone who attempts to log in to its website.
An authorized person from the Company may contact outside counsel to discuss the situation andwhether further steps are necessary.
Breach of Back-Up Server – In the event of a breach of the back-up server, the Company will shut down
the back-up server. IT will investigate the breach and determine how to contain the breach as quickly as

37 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

possible. The Company will ensure that access is denied to anyone who attempts to log in to its website.
An authorized person from the Company may contact outside counsel to discuss the situation andwhether further steps are necessary.

38 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

5 TECHNICAL CONTROLS
5.1

Identification and Authentication

All user accounts will be required to be at least eight characters long. It is recommended that thesystems be set up to allow up to 64-character passwords to allow people to set a passphrase since thishas been shown to be more secure and less likely for someone to forget. If it only requires an 8character password, then it will need to be complex, which also requires capital letters, numbers, andspecial characters, and it will need to be changed every 90 days. It is highly recommended to havepersonnel select a passphrase of at least 14 characters long. It is a best practice to also utilize MultiFactor Authentication (MFA) when available.
Administrative or privileged accounts will be required to be a minimum of 14 characters and be required
to change every 60 days. Administrative accounts will also be required to use MFA if available.
Systems will be set to lock an account after three failed login attempts. Doing so helps to mitigate therisk of someone trying to brute force a password.
Accounts are set up to have the least privilege required to perform work. Only administrator/privilege
accounts are given to those with a need to know to perform their job function.
When an employee is no longer employed, accounts and access to the building will be removed within
24 hrs.
System Access● It is prohibited for any person to intentionally access any Protected Information on Company
information systems that are not relevant to such person’s job duties.
● Access to the Company’s information systems is limited to authorized persons and only to thoseparts of its systems that are appropriate to each employee’s, consultant’s, or vendor’s job
duties. Employees, consultants, and vendors should not attempt to access another person’s
computer account without the prior consent of such person or of his or her supervisor. Function
heads and supervisors should notify the IT Service Desk promptly whenever an employee leaves
the Company, a consultant or vendor relationship is terminated, or other circumstances exist
that require additional or restricted access to the Company’s information systems so that such
person’s access can be appropriately changed or revoked.
Physical Access●

The Company will maintain building security standards, including card access requirements.
Servers are stored in secured rooms or remote locations with access restricted to authorized
personnel. Hard copy documents containing PII may be stored in lockable filing cabinets, whichshall be kept locked, except were attended by employees with a business need for regularaccess to such information. Documents containing Protected Information must never be left
unattended in public spaces, such as copying rooms, conference rooms, or lobbies. When the
Company is not required to retain hard copy documents containing Confidential Information,
39 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

the hard copies should be securely disposed by shredding the documents or placing them in asecure receptacle for subsequent shredding and secure disposal.

5.2

Logical Access Controls

CISO must ensure implementation of access controls to protect all HUMBL information and the media
and technology platforms upon which the information resides.
All access controls deployed must:••

Support the security concepts of least possible privilege and need-to-know; andBe auditable.

All users of HUMBL information technology must be uniquely identified and authenticated with anappropriate method based on the risk associated with the data at sign-on by a unique User ID andpassword. When supported, Functional IDs must be required to initiate a sign-on.
All information assets, including objects, files, and programs, must be identifiable to a security service.
Access entitlements must be traceable to the User ID and:• Highly privileged access (for example, system administration access) must be controlled,
audited, and limited to required entitlements.
• All access entitlement updates must ensure proper maker/checker accountability.
Users must be authorized by the security service to initiate processes and transactions; there must be
no default access. Each business unit must implement a process to ensure that data and resource accessprivileges (entitlement review) are verified annually and more frequently if required by another policy.
When supported by a security service, the following information must be displayed after a successful
login:••The date and time of the last successful login and
The number of unsuccessful login attempts since the last successful login.

Procedures for using Emergency User IDs and system administration IDs must be defined. Users must
lock desktop systems when away from their desks for an extended period. User IDs for HUMBL staff,
consultants, and vendors that left HUMBL or no longer work for HUMBL must be disabled after sixty (60)days of inactivity.
Functional IDs, as determined by the business and system administrator IDs may be exempted from thisrequirement. Emergency User IDs, as determined by the business, to be used for systems andapplications repair, when necessary, may be exempted from this requirement.

40 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

5.3

Data Security Plan Document

Internal Policies and Procedures

5.3.1 Security Awareness Training
Security Aware training was conducted on 3/28/2022 and required virtual attendance for all
HUMBL employees and advisors with 43 total people on the call. The security training went
over the following:●

Overall Security Risks●

How to Mitigate the Risks●

Passwords●

Multi Factor Authentication (2FA)●

Social Engineering & Phishing●

Secure Use of the Internet●

Social Media Security●

Malware5.3.2 Personnel Security

5.4●

Personnel Security Policy and Procedure●

Personnel Screening●

Personnel Termination
HUMBL has specific policies and procedures in place for employee termination. This includes achecklist to ensure that all access including sensitive information has been revoked and theemployee computer is turned in.

●

Personnel Transfer●

Access Agreements●

Third-Party Personnel Security●

Personnel Sanctions

Data Protection Safeguards

5.4.1 Blockchain Encryption
Private versus Public Blockchain solutions –41 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Our joint offering with BLOCKS enables the use of both public and private blockchain solutions. The
HUMBL platform is based on Hyperledger and can use both the public networks as well as AWS
managed blockchain, AKA Hyperledger Fabric. BLOCKS runs on the Ethereum network and othersupported EVM based blockchains.
The BLOCKS smart contract can be deployed on alternate compatible networks. The ability to deploy the
BLOCKS smart contract on alternate blockchains makes BLOCKS an agnostic solution. In addition to
BLOCKS being a cross-chain deployed smart contract, 3rd party data can be placed on any blockchainthat supports data insertion or OP_RETURN as used on UTXO blockchains (Bitcoin forks). As EVM
compatible side chains evolve, opportunities to deploy BLOCKS will expand, creating additional
redundancies.
What Goes on GovCloud Ledger• Decentralized identifiers and associated DDOs with verification keys and endpoints.
• Schemas and claim definitions• Proof of consent for data sharing• Public claims• Revocation registries
What does not go on GovCloud Ledger• Private data of any kind (including hashed personal data)• Private proof of existence
Team HUMBL retains experts in cybersecurity and focuses on ensuring all data is securely stored while
maintaining high availability, and in compliance with NIST 800-171 standards.

5.4.2 FIPS-140-3 Compliance

5.5●

Security Requirements for Cryptographic Modules (nist.gov)●

Use The Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm
that can be used to protect electronic data. The AES algorithm is a symmetric block cipher thatcan encrypt (encipher) and decrypt (decipher) information. Encryption converts data to an
unintelligible form called ciphertext; decrypting the ciphertext converts the data back into its
original form, called plaintext. The AES algorithm is capable of using cryptographic keys 256 bits
to encrypt and decrypt data.

Network Security

All information networks, regardless of connectivity, whether proprietary, contracted, or public, must be
protected from unauthorized access. Information networks include, but are not limited to Intranets,
LANs, WANs, MANs, and VANs. Network information security is not a substitute for application security.
Each business unit is responsible for its own information application or host processor security.
42 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

All entry points into HUMBL networks must be protected from unauthorized access, and all processors
and nodes processing information must be protected from unauthorized access. The purchase,
downloading, or installation of hardware or software network data monitoring tools, including sniffersand data scopes, is prohibited unless the activity is approved by the CISO. All users must comply withapplicable laws and Information technology policy.

5.6

Response and Recovery

Upon detection or suspicion that an Incident has occurred, immediate notification must be made to the Incident
Response Leader, who, where appropriate, shall assemble the IRT. The Incident analysis is then typically performedby relevant members of the IRT.

Once concluded, the analysis should be documented by the IRT Leader, Facilitator, or other member
as determined by IRT Leader at such time.

Step 1 All: Detect & Escalate
Detection of potential incidents may occur in/by Customer Success, R&D, Legal,
Communications, or by any other team, employee, or vendor of the company and should be followed by immediately alerting the IRT Leader for initial analysis
and determination.
Step 2 IRT Leader + Legal + DPO: Analyze & Assess
The IRT Leader, together with Legal and Privacy teams as necessary, shall perform
an initial analysis and assessment of the characteristics and severity of the
Incident, and upon preliminary determination that it may involve Personal Data,
shall activate the IRP, and assemble the IRT.
Step 3 IRT Leader: Activate Incident Response Plan & Assemble IRT
Based on the conclusion that is drawn from the Incident analysis, activate Plan
and assemble IRT – by sending alerts via mail or Google Meet (if working
remotely).
Step 4 Incident Response Team: Assemble
Immediately upon receiving an alert, assemble in the Google Meet dedicatedroom (if working remotely) or in [Conference room #] if situated on HUMBL
premises.
Step 5 Incident Response Team: Rollout of Incident Response Plan
Performance of respective Roles and Responsibilities for each IRT member in
Containment, Communication, Eradication.
Step 6 IRT Leader: Announce Disassembly, De-brief & Document
Step 1: Assessment – Is Personal Data compromised or at risk?
If any of the following situations applies - this Privacy Incident Response Plan should be activated:● An actual or potential loss, alteration, or unlawful destruction of Personal Data;
43 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document● An actual or potential unauthorized use, access or disclosure of Personal Data;● An actual or suspected unauthorized reversal of pseudonymization of Personal Data;● An ongoing, actual or suspected, exploited vulnerability affecting Personal Data;● Any suspected loss of control over Personal Data.

Step 2: Initial Fact Finding / Activating the Plan
To help determine the factors and the level of severity of the Incident, the following questions can be
asked to ascertain the scope of the Incident:
Information involved in the Incident● What type of information is involved?
● Where is this information processed and stored? Was it in electronic or hard-copy form?
● How was this information protected, e.g., encrypted, redacted, password-protected?
● If the data was encrypted, was the encryption key compromised?
● What categories of Data Subjects are impacted? Are the affected Data Subjects - employees,
customers, partners, or vendors? Are sub-processors involved?
● How many Data Subjects are impacted? Where do the affected Data Subjects reside? Whatstates and countries are implicated?
● Was any of the Personal Data involved “sensitive”? (e.g., information relating to children under
the age of 13; SSN or national insurance/identification number; driver’s license or othergovernment-issued identification number; payment card information; financial accountinformation; health or medical information; union membership; race; religion; sexual
orientation; political affiliation or opinions; or criminal history)?
Details about how the Incident happened● When did the Incident start?
● How was the Incident discovered?
● If applicable, how long has the data been gone (last subject to HUMBL’s control)?
● What systems or devices were involved, e.g., laptop, USB drive, website, server? How did thepotential exposure of the data occur? Was it lost, is it missing, or was it stolen or possiblystolen? If so, has it been recovered? Could copies have been made?
● If stolen, does the information appear to be the motivator for the theft (as opposed to computer
hardware, cash, etc.)? What is the likelihood of the data being used for fraud and/or identity
theft purposes?
● Is there evidence that information has been misused or likely will be misused?
● Is there evidence that the Incident likely will result in harm to affected Data Subject or HUMBL?
Mitigation and recovery● Is the Incident continuing, and if so, what is being done to address and contain it?
● What is the likelihood of recovering the missing data?
● If appropriate, has a fix been implemented to prevent further data exposure or potential
exposure? What is the likelihood that the issue will recur?

44 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Additional considerations● Who knows about the Incident and is it publicly known? Has the media been notified? Who else
needs to be informed internally?
● Has law enforcement been notified or involved? Other third parties?
● What are the likely consequences of the Incident?
● Are there any further facts needed to respond to the Incident?
Note: In the event of disagreement or uncertainty on whether to activate the Incident Response Plan,
IRT Leader has the final decision. If it is decided not to activate the IRP, then an alternative plan shouldbe created to allow for a low-level Incident response using regular management channels. This
alternative plan could involve the invocation of relevant procedures at a local level (e.g., hot fix). If an
Incident does warrant activating the plan, IRT Leader should assemble the team.
Step 3: Incident Response Plan & Assemble IRT

Step 4: Assembly of Incident Response Team by Leader
IRT Leader should assemble the team by contacting all members to inform them of the Incident’s
occurrence and nature, with a request for assembly at an appropriate location.
IRT Members & Roles:
Role

Responsibilities

Leader

●
●
●
●

●
●
●
●
R&D/CISO

●
●
●
●
●

Decides whether or not to initiate a response
Assembles the Incident Response Team
Overall management of the Incident Response Team
Ensure flow of information and updates among IRT members (e.g.,
additional tickets received, important findings by R&D, do’s and don’ts
from Legal & Privacy teams)
Final decision maker in cases of disagreement
Decides the level, frequency, and content of communications withexternal parties such as the media, users and followers
Defines approach to keeping affected parties informed
Works with the relevant stakeholders on messaging (subject to final
legal sign-off), and release to Operations
Escalates the Incident to the relevant team members
Investigates the Incident and proposes mitigation actions
Investigates the Incident scope, number, and geography of affected
Data Subjects
Considers known vulnerabilities already on the roadmap
Performs corrective actions to prevent security Incident from causing
further damage, and to mitigate existing risks

45 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department●

Data Security Plan Document●

Eliminates vulnerability causing the Incident, and restores normal
systems operation
Provide information to IRT Leader about the Incident scope, affected
Data Subjects, vulnerability status etc., 30 min after Incident was
declared, and whenever there are new findings (at least every 30 min)and until the Incident is resolved
Provides input on any Incident affecting internal systems

Operations /Facilitator

●
●
●
●
●
●

Supports the Incident Response Team
Coordinates resources within the company
Prepares for meetings and takes record of actions and decisions
Briefs team members on latest status on their return to the company
Facilitates communication via secure methods such as Meet, etc.
Liaises with emergency services such as police, fire and medical

Support /Customer
Success●

Identify and escalate tickets concerning suspected Incidents to IRT
Leader & CS leadershipCS leadership to alert CS team to especially look for similar tickets(existing and incoming)
Responsible for ensuring ongoing communications (after PR & Legalsign-off), through tickets system & social (at least every 30 min),updating the IRT on every released message.
Update the IRT Leader on tickets volume & severity
Update the IRT Leader about relevant tickets (tickets from authorities,
media, other stakeholders)

●

●
●

●
●
Legal

●
●

Privacy●●●

Assesses the actual and potential legal implications of the Incident andsubsequent actions
Advising on any communication to Data Subjects, media, or any other3rd party
Advising with respect to the Privacy and Data Protection complianceduties under applicable regulations
Monitoring the appropriate application of this IRP
Liaising with the Relevant Authority and affected Data Subjects, asnecessary and in cooperation with IRT and other relevant parties

IT

●
●
●

Provides input on any Incident affecting internal systems
Assists Operations with IT logistics
Assists with impact assessment

Marketing/PR●

Decides the level, frequency, and content of communications withexternal parties such as the media, users and followers
Defines approach to keeping affected parties informed
Works with the relevant stakeholders on messaging (subject to final
legal sign-off), and release to CS●●

46 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

HR (if relevant)Data Security Plan Document●●

Monitors external information feeds such as news and social media
Work with the CEO on messaging for all stakeholders●

Assesses and advises on affected HR data (employees, candidates,
freelancers)

Step 5: Roll out of IRP: Containment, Eradication, Internal Communication
Containment
Containing the Incident so that it does not worsen, is always important. Depending on the Incident’s
nature and context, different actions can be taken (e.g., network disconnection). However, before
containment, the Incident and its implications should be ascertained based on Incident analysis, digital
evidence, and unaltered, secure copies of audit logs.
The following principles should be followed:
Principle 1

Do not alter any of the data so as to not affect the court case.

Principle 2

Only access the original data under exceptional circumstances.
Data analyses are performed on a copy of the data only.

Principle 3

Always keep an audit trail of what has been done with the evidence.
Keep in mind that this cannot involve altering the evidence.

Principle 4

Ensure that the following items are collected:●●●●

Records (photos; screenshots; videos) of relevant information
Manually written records of the Incident’s chronology
Original documents and who found them, when and where
Details of witnesses

Digital evidence is kept in a safe space, after which a formal chain of custody is established. The
evidence may be used in the following scenarios:●●●

Analysis of the Incident’s cause
Forensic evidence for criminal or civil court proceedings
To support compensation negotiations with Service Providers

Eradication
To eradicate an Incident, a change management process must be applied aiming to fix the Incident’s
cause (e.g., malware deletion) and prevent the Incident from reoccurring. Vulnerabilities exploited aspart of the Incident should be taken into consideration.
Recovery
47 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

To recover, systems should be restored to pre-Incident conditions, and actions performed to address
vulnerabilities exploited as part of the Incident (e.g., changing passwords).
Internal Communications
Communication should be consistently maintained between all parties involved in the Incident Response
Plan, using the following recommended communication methods:
MethodFace-to-Face

Phone/VOIP

E-Mail/Text messaging

Recommended?

Yes

Yes

No, unless specificallyapproved by IRT leader

External Communications
The following communication guidelines should be adhered to:
●
●
●
●
●

Communication is to be done calmly at all times
Stick to the facts – avoid Hyperbole or opinion
Overly lengthy conversations are to be avoided
Information requests from third parties are to be referred to the IRT
All written communications with third parties must be recorded and securely shared andapproved by IRT Leader

Note: If an external call is answered by somebody other than a contact person, then one should ask
whether the contact person is available. If not, leave a message requesting this person to contact thecaller in return on a specific phone number. Do not provide further details on the Incident.

Step 6: Incident Notification & Documentation
Determining whether to provide notice, and to whom, is largely a legal decision. This determination isbased on the facts as they develop, applicable laws, the number of affected Data Subject, contractual
obligations, the sensitivity, and type of the information involved in the Incident, any risks to the affected
Data Subject associated with public communication of the Incident, requests by regulatory authorities orlaw enforcement, costs of notification, and feasibility of notification.
As a result, the above information must be developed during the investigation of the Incident.
Determining notification obligations is to be handled in consultation with Legal and Privacy. In addition,
it is possible that public reports, or rumors, about a possible Incident may warrant issuing a placeholder
statement.
Documentation: When communicating about the Incident, any summaries of steps taken and/or
decisions made ought to be clearly and accurately always documented. This is necessary as the
document may have to be presented publicly at a later date for legal purposes.
Documentation will always be subject to review and approval by IRT Leader and the Legal Counsel.
Other, non-approved documentation will also be marked as such.

48 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

5.6.1

Data Security Plan Document

Disaster Recovery Plan

IRT Leader is responsible for deciding on the finalization of Incident response activities. Once decided,
informal actions may be continued while the IRT is stepping down.
Informal Actions:
Actions may continue under informal management control rather than as part of the Incident Response
Plan. Such a decision should be based on the following criteria:
●
●
●
●
●

The situation has been resolved or is reasonably stable
The pace has slowed down to a point where few(er) decisions are required
A response is underway, and the plan progresses according to schedule
The degree of risk to the Business has lessened to an acceptable degree
Immediate legal and regulatory responsibilities have been fulfilled

Ongoing efforts to continue the plan informally may include:
●
●
●
●
●

Infrequent IRT meetings, depending on individual circumstances
Informing involved parties that the IRT is stepping down
Ensuring that all Incident documentation is approved and safely stored
Requesting staff to return to their normal duties
Any other relevant actions

Remember to document any such ongoing efforts.

IRT Disassembly:
After the IRT steps down, IRT Leader must organize a debrief meeting for all IRT members – ideallywithin 24 hours of stepping down.
All relevant Incident records should be examined by the IRT to ensure that records adequately reflect
the actual events of the Incident, representing an accurate depiction.
Relevant records: Incident analysis; digital evidence; audit logs; documented communications
Feedback or comments on behalf of the team should also be documented.
Post-Incident Review:
A formal, post-Incident review should also be held as decided by HUMBL management and will be basedon the overall magnitude of the Incident.

49 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

5.6.2 Physical & Environmental Security
HUMBL business units must either perform Information Security Administration (ISA) for all information
under their jurisdiction, or have a written agreement (for example, a Service Level Agreement) to havethis function performed by a unit within another HUMBL business. ISA must manage and administer
security services under its control and ensure that these security services comply with HUMBL’s
Information Security Policy.
Business units that are serviced by an ISA function of another business unit must conform to thepractices of that ISA function and comply with this policy. ISA staff must not perform transactions thatconflict with their security administration function. Specifically:••

All administrative actions performed for business-determined high-risk systems (for example
funds and securities transfers) that affect changes to user access, including entitlements andnew passwords, require an independent verification process to ensure that no one person
dominates the Security Administration process.
ISAs are required to review security audit logs, incident reports and on-line reports on an ongoing basis , and document and report any unusual or suspicious items to their ISO.

Responsibilities
The ISA is responsible for security services, security objects, and supporting documentation. For the
security services under its control, ISA must:
•
•
•
•
•
•
•
•
•

Establish and manage a process for User ID and password administration
Functional IDs associated with a process or function and not assigned to an individual asdetermined by the business, may be exempted from an entitlement review.
For all security objects under its control, ISA must:
Establish and manage a process for their protection
Explicitly authorize access to each security object
Ensure that security objects, created or modified within a development environment, areindependently verified and controlled prior to movement into a production environment.
ISA must review and retain required information security documentation received frominformation owners for the life of the product.
ISA must resolve or escalate non-compliance issues until resolution is achieved.
ISA functions must not be outsourced.

Security products certified by CISO and configured to meet all HUMBL requirements, policies, andstandards must be used.

50 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Logging, auditing, and reporting of security events must be enabled at all times. All changes to user
privileges, including adding and deleting users, must be reviewed by a business unit, or as specified by
the information owner.
Information Security staff will review daily security audit logs, incident reports, and on-line reports as
specified by the Chief Information Security Officer(CISO), on an on-going basis , and report result(s) to
the CISO. Any existing outsourcing agreements, upon renewal, must be modified to meet theserequirements.
Access Controls
CISO must ensure implementation of access controls to protect all HUMBL information and the media
and technology platforms upon which the information resides.
All access controls deployed must:••

Support the security concepts of least possible privilege and need-to-know; andBe auditable.

All users of HUMBL information technology must be uniquely identified and authenticated with anappropriate method based on the risk associated with the data at sign-on by a unique User ID andpassword. When supported, Functional IDs must be required to initiate a sign-on.
All information assets, including objects, files, and programs, must be identifiable to a security service.
Access entitlements must be traceable to the User ID and:• Highly privileged access (for example, system administration access) must be controlled,
audited, and limited to required entitlements.
• All access entitlement updates must ensure proper maker/checker accountability.
Users must be authorized by the security service to initiate processes and transactions; there must be
no default access. Each business unit must implement a process to ensure that data and resource accessprivileges (entitlement review) are verified annually and more frequently if required by another policy.
When supported by a security service, the following information must be displayed after a successful
login:••The date and time of the last successful login and
The number of unsuccessful login attempts since the last successful login.

Procedures for using Emergency User IDs and system administration IDs must be defined. Users must
lock desktop systems when away from their desks for an extended period. User IDs for HUMBL staff,
consultants, and vendors that left HUMBL or no longer work for HUMBL must be disabled after sixty(60) days of inactivity.
51 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

Functional IDs, as determined by the business and system administrator IDs may be exempted from thisrequirement. Emergency User IDs, as determined by the business, to be used for systems andapplications repair, when necessary, may be exempted from this requirement.
Changes in Employee Status
Each business unit must implement a process that identifies changes in employee status to ensure that
affected User IDs and associated access rights are disabled or modified immediately.
••Dial-in access must be disabled or modified immediately with the change in employee status,and deleted within 90 days if disabled.
For staff transfers, it is the responsibility of the business unit from which the staff member
transferred to disable the affected User ID and associated access rights.

Disclosure
HUMBL staff, consultants, and vendors must not disclose RESTRICTED, CONFIDENTIAL, or INTERNAL
information except as authorized by information owners. In all cases, appropriate non-disclosureagreements must be in place and complied with. The person disclosing information must ensure positive
identification of the requester and a credible need-to-know requirement.
If an unknown caller requests telephone information, call back after verification of the requester’s ID
and a valid business purpose must be performed. Business units with established, documented positive
identification processes for customers may be exempted. Any use of emerging identification andauthentication systems (for example biometrics, smart cards, and public key infrastructure systems)
must be reviewed with and certified by the CISO prior to production implementation.

5.6.3 Network Diagram:

52 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

53 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

County of Santa Cruz
Information Services Department

Data Security Plan Document

The Company will conduct an assessment of systems on a periodic basis. During suchassessment, the Company will:• identify and assess threats, vulnerabilities, and “at risk” data (such as customer andcounterparty personally identifiable information, to extent the Company possesses that
information);• assess threats and vulnerabilities to its electronic infrastructure, including systems used toinitiate, authorize, record, process, and report transactions relating to customer funds (tothe extent the Company possesses that information), capital compliance, and risk
management;• incorporate past internal and external security incidents that the Company has experienced
and consider known threats that have been identified by third parties (such as the industry
and the Company’s critical third-party service providers, among others); and• estimate the severity of potential threats, perform a vulnerability analysis, and consider
modifying the framework for managing risks of cybersecurity threats to the Company basedon the results of periodic testing. Examples of potential threats include viruses, spyware, or
malware; loss, destruction, or theft of critical hardware that contains at-risk data; andinterception of (or other compromise) to email, payment processing systems, or otherelectronic transmissions.

54 of 54

3/3/2023

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Additional Logos& Examples

FULL COLOR WITH A GOLD SEAL

BLACK AND WHITE (SINGLE COLOR)

3

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Primary
Color
PaletteCounty Blue is required to be used
for all sites in some capacity. The

following colors are complementaryCounty Blue
#1C4E69

Ocean Blue
#007FB0

Forest Green#008155

to County Blue and is therecommended color palette fordepartment websites.

Secondary color palettes areallowed as long as they include

and complement the primary color:
County Blue.

Redwood Brown#C64B06

Sunset Yellow#FFA400

4

Fog Grey#E8EBE4

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Secondary Color Palette
Alternative Option 1#1C4E69#4A1C68#960666#008155#049947#E8EBE4#007FB0#079385#008155#FFA400#E8EBE4#55B3D8#079385#FFA400#EF5848#E8EBE4

Alternative Option 2#1C4E69

Alternative Option 3#1C4E695DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Graphic Elements & Iconography
To help provide clear and easy-to-read information on County websites as well as printed and digital materials, icons may be

used. Below are examples of icons and graphics that are acceptable. Icons should be simple and easy to understand, not too busy.
Recommended arrows and buttons are included as well.
Lineart Icons

Arrows and Buttons

SIGN UP NOW
SIGN UP NOW
SIGN UP NOW

8DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Website Template
If your department is planning on a visual upgrade to your website that will enhance the user experience, the County has

standardized website templates for you to use. The full set of home page and interior page templates can be viewed here.
LAND NG PAGE A

LAND NG PAGE B

9DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

How to Write in the County’s Voice & Tone

People visit a website to do or learn about something: complete a specific task or answer a question. People use social media channels
to ask questions about programs and services and to stay up to date on the latest news and information. Both places provide a great
opportunity to connect with your audience. As the use of digital communications continues to expand, customer expectations will

increase and monitoring/communicating through digital and social media will become an increasingly important part of our daily
workflows. Follow these tips for communication success:Keep it simple!

We understand that there may be very technical aspects to the work that you or your team does, but public-facing information needs tobe easy to understand.

Do

Avoid

• Write at an 8th Grade level or lower.

• Overly technical jargon, legal terminology.

• Communicate using an active voice. (Ex: The• Using exclamation points on documents

department provided an update vs. An update

or website.

was provided by the department.)• Limit the use of acronyms and be sure to

introduce the full name first when using them.

Provide answers quickly

Most users will spend less than a minute on a webpage. Offer customer-first website navigation to help meet potential needs quickly.

The home page should feature key information sought by visitors. When it comes to website content, ask yourself: What key questions
can I answer for site visitors? How can I answer them quickly? What information are they likely looking for? And then limit the amountof information you provide. Information overload can have the same effect as too little information. The quicker a visitor can get the
information they are looking for, the more satisfied they will be with their experience with your team.
11

DocuSign Envelope ID: 98A3C159-0E3D-4FFD-A3B6-9D898049FD1A

Know your audience

We serve a wide range of people. They have different needs, preferences and abilities. When writing, ask:
• Who is my audience? (homeowners, business owners, etc.)?

• Are they likely first-time visitors, or knowledgeable returning visitors?
Imagine you’re talking to the website visitor over the phone or on site at your office. What words would you use to answer questions
directly? What wording can you use to come across as approachable and understanding?

Additional recommendations for Social Media

When it comes to sharing information on Facebook, Twitter, Instagram, etc., you are encouraged speak in a warmer tone. Be caring andkind, a bit more lighthearted. Some additional recommendations include:

Do

Avoid

• When acceptable, communicate enthusiastically. Use of exclamation
points is allowed. (Ex: Announcing important accomplishment that positively
impacts the community)• Deleting comments or posts by users thatyou don’t like. Doing so may be construed
as viewpoint discrimination. Under certain
rare circumstances, deleting posts may benecessary. Refer to the County’s Social Media
Policy for more information.

• Include a photo or video with your post. Visual content will help your post
get noticed, get more views and engage more people. Facebook posts withimages get over 2.3 times more engagement than posts without.
• Incorporate hashtags if relevant. Hashtags help you reach a target audience,and more importantly, they help your target audience find you.
• Engage with channel followers in a positive way – like or love a post, make athoughtful or appreciative comment, ask questions. By interacting with youraudience, you’ll fuel further engagement, increasing the reach and impact ofyour communications.
• Respond to direct messages or posts as quickly as possible. If this presentsa challenge, consider setting up an automated response. This will help the
person feel taken care of and give you time to work on a proper response if
it’s still needed.

12• Debating openly with a frustrated or angryuser who might be repeating the samemessage again and again. This type of
conversation will generally involve manyrounds, often with the frustrated party not
giving up (often their goal). It is ultimately awaste of time and will negatively impact youraudience. In these instances, it’s best to takethe high road and ignore the comments.

Certificate Of Completion
Envelope Id: 98A3C1590E3D4FFDA3B69D898049FD1A

Status: Completed

Subject: Agreement with HUMBL BOS 04/25/23 AMS #14504
Source Envelope:
Document Pages: 89

Signatures: 4

Envelope Originator:

Certificate Pages: 5

Initials: 0

Emilia Gamboa

AutoNav: Enabled

Stamps: 1

701 Ocean Street

EnvelopeId Stamping: Enabled

Santa Cruz, CA 95060

Time Zone: (UTC-08:00) Pacific Time (US &Emilia.Gamboa@santacruzcounty.us

Canada)IP Address: 63.194.190.100

Record Tracking
Status: Original
4/19/2023 2:49:35 PM

Holder: Emilia Gamboa

Location: DocuSign

Emilia.Gamboa@santacruzcounty.us

Security Appliance Status: Connected

Pool: FedRamp

Storage Appliance Status: Connected

Pool: County of Santa Cruz

Signer Events

Signature

Location: DocuSign

Timestamp

Ruby Marquez for John Nguyen

Sent: 4/19/2023 2:58:41 PM

Ruby.Marquez@santacruzcounty.us

Viewed: 4/19/2023 3:00:16 PM

Santa Cruz County Counsel's OfficeSigned: 4/19/2023 3:07:54 PM

Security Level: Email, Account Authentication(None)

Signature Adoption: Pre-selected Style
Using IP Address: 63.194.190.100

Electronic Record and Signature Disclosure:Accepted: 9/23/2022 5:09:28 PM
ID: 285e595d-331b-47cd-b34d-fb2c5b3af149
Enrique Sahagun

Sent: 4/19/2023 3:07:56 PM

Enrique.Sahagun@santacruzcounty.us

Viewed: 4/19/2023 3:26:22 PM

Risk Manager

Signed: 4/19/2023 3:32:06 PM

County of Santa Cruz
Security Level: Email, Account Authentication(None)

Signature Adoption: Pre-selected Style
Using IP Address: 63.194.190.100

Electronic Record and Signature Disclosure:Accepted: 2/28/2022 5:38:23 PM
ID: 53dded50-e6e0-41af-93b9-11ee12d5835c
Brian Foote

Sent: 4/19/2023 3:32:08 PM

brian@humbl.com

Viewed: 4/19/2023 3:34:06 PM

CEO

Signed: 4/19/2023 3:36:29 PM

Security Level: Email, Account Authentication(None)

Signature Adoption: Drawn on Device
Using IP Address: 107.127.42.105
Signed using mobile

Electronic Record and Signature Disclosure:Accepted: 4/19/2023 3:34:06 PM
ID: b4ef59dd-4668-4196-b431-df93a2e2a1f8
Tammie Weigl

Sent: 4/25/2023 10:18:15 AM

Tammie.Weigl@santacruzcounty.us

Viewed: 4/25/2023 10:19:43 AM

Director

Signed: 4/25/2023 10:20:05 AM

County of Santa Cruz
Security Level: Email, Account Authentication(None)
Electronic Record and Signature Disclosure:

Signature Adoption: Pre-selected Style
Using IP Address: 63.194.190.100

Signer Events

Signature

Timestamp

SignedSent: 4/25/2023 10:20:07 AM

Accepted: 2/27/2023 7:18:55 AM
ID: 089da347-4c42-4696-b51e-9dc35cdf1884
CBD eSignature
CBD.eSignature@santacruzcounty.us

Viewed: 5/5/2023 2:46:12 PMCounty of Santa Cruz

Signed: 5/5/2023 2:46:54 PM

Security Level: Email, Account Authentication(None)

Freeform Signing

Using IP Address: 63.194.190.100
Electronic Record and Signature Disclosure:Accepted: 3/1/2022 5:29:04 PM
ID: c4e5a2a3-4d71-4795-ac63-16aaad036e28

In Person Signer Events

Signature

Timestamp

Editor Delivery Events

StatusTimestamp

Agent Delivery Events

StatusTimestamp

Intermediary Delivery Events

StatusTimestamp

Certified Delivery Events

StatusTimestamp

Emilia Gamboa

Sent: 4/19/2023 3:36:31 PM

emilia.gamboa@santacruzcounty.us

Viewed: 4/25/2023 10:18:14 AM

Administrative Services Manager
County of Santa Cruz Information Services

Using IP Address: 97.84.110.200

Security Level: Email, Account Authentication(None)
Electronic Record and Signature Disclosure:Accepted: 9/9/2022 2:40:26 PM
ID: 2532647f-a5b6-4001-9042-d399e8f8e7e8

Carbon Copy Events

StatusTimestamp

Witness Events

Signature

Timestamp

Notary Events

Signature

Timestamp

Envelope Summary Events

StatusTimestamps

Envelope Sent

Hashed/Encrypted

4/19/2023 2:58:41 PM

Certified Delivered

Security Checked

5/5/2023 2:46:12 PM

Signing Complete

Security Checked

5/5/2023 2:46:54 PM

Completed

Security Checked

5/5/2023 2:46:54 PM

Payment Events

StatusTimestamps

Electronic Record and Signature DisclosureElectronic Record and Signature Disclosure created on: 2/28/2022 5:23:37 PM
Parties agreed to: Ruby Marquez for John Nguyen, Enrique Sahagun, Brian Foote, Tammie Weigl, CBD eSignature, Emilia Gamboa

ELECTRONIC RECORD AND SIGNATURE DISCLOSURE
From time to time, County of Santa Cruz (we, us or Company) may be required by law toprovide to you certain written notices or disclosures. Described below are the terms andconditions for providing to you such notices and disclosures electronically through the DocuSign
system. Please read the information below carefully and thoroughly, and if you can access thisinformation electronically to your satisfaction and agree to this Electronic Record and Signature
Disclosure (ERSD), please confirm your agreement by selecting the check-box next to ‘I agree to
use electronic records and signatures’ before clicking ‘CONTINUE’ within the DocuSign
system.

Getting paper copies
At any time, you may request from us a paper copy of any record provided or made available
electronically to you by us. You will have the ability to download and print documents we send
to you through the DocuSign system during and immediately after the signing session and, if you
elect to create a DocuSign account, you may access the documents for a limited period of time(usually 30 days) after such documents are first sent to you. After such time, if you wish for us tosend you paper copies of any such documents from our office to you, you will be charged a$0.00 per-page fee. You may request delivery of such paper copies from us by following theprocedure described below.

Withdrawing your consent
If you decide to receive notices and disclosures from us electronically, you may at any timechange your mind and tell us that thereafter you want to receive required notices and disclosures
only in paper format. How you must inform us of your decision to receive future notices anddisclosure in paper format and withdraw your consent to receive notices and disclosureselectronically is described below.

Consequences of changing your mind
If you elect to receive required notices and disclosures only in paper format, it will slow the
speed at which we can complete certain steps in transactions with you and delivering services toyou because we will need first to send the required notices or disclosures to you in paper format,
and then wait until we receive back from you your acknowledgment of your receipt of such
paper notices or disclosures. Further, you will no longer be able to use the DocuSign system toreceive required notices and consents electronically from us or to sign electronically documentsfrom us.

All notices and disclosures will be sent to you electronicallyUnless you tell us otherwise in accordance with the procedures described herein, we will provide
electronically to you through the DocuSign system all required notices, disclosures,
authorizations, acknowledgements, and other documents that are required to be provided or madeavailable to you during the course of our relationship with you. To reduce the chance of you
inadvertently not receiving any notice or disclosure, we prefer to provide all of the required
notices and disclosures to you by the same method and to the same address that you have given
us. Thus, you can receive all the disclosures and notices electronically or in paper format throughthe paper mail delivery system. If you do not agree with this process, please let us know as
described below. Please also see the paragraph immediately above that describes theconsequences of your electing not to receive delivery of the notices and disclosureselectronically from us.

How to contact County of Santa Cruz:
You may contact us to let us know of your changes as to how we may contact you electronically,
to request paper copies of certain information from us, and to withdraw your prior consent toreceive notices and disclosures electronically as follows:
To contact us by email send messages to: nada.algharib@santacruzcounty.us

To advise County of Santa Cruz of your new email address
To let us know of a change in your email address where we should send notices and disclosureselectronically to you, you must send an email message to us
at nada.algharib@santacruzcounty.us and in the body of such request you must state: yourprevious email address, your new email address. We do not require any other information fromyou to change your email address.
If you created a DocuSign account, you may update it with your new email address through youraccount preferences.

To request paper copies from County of Santa Cruz
To request delivery from us of paper copies of the notices and disclosures previously provided
by us to you electronically, you must send us an email to nada.algharib@santacruzcounty.us andin the body of such request you must state your email address, full name, mailing address, andtelephone number. We will bill you for any fees at that time, if any.

To withdraw your consent with County of Santa Cruz
To inform us that you no longer wish to receive future notices and disclosures in electronic
format you may:i. decline to sign a document from within your signing session, and on the subsequent page,
select the check-box indicating you wish to withdraw your consent, or you may;ii. send us an email to nada.algharib@santacruzcounty.us and in the body of such request you
must state your email, full name, mailing address, and telephone number. We do not need anyother information from you to withdraw consent.. The consequences of your withdrawing
consent for online documents will be that transactions may take a longer time to process..

Required hardware and software
The minimum system requirements for using the DocuSign system may change over time. The
current system requirements are found here: https://support.docusign.com/guides/signer-guidesigning-system-requirements.

Acknowledging your access and consent to receive and sign documents electronically
To confirm to us that you can access this information electronically, which will be similar toother electronic notices and disclosures that we will provide to you, please confirm that you haveread this ERSD, and (i) that you are able to print on paper or electronically save this ERSD foryour future reference and access; or (ii) that you are able to email this ERSD to an email address
where you will be able to print on paper or save it for your future reference and access. Further,
if you consent to receiving notices and disclosures exclusively in electronic format as describedherein, then select the check-box next to ‘I agree to use electronic records and signatures’ before
clicking ‘CONTINUE’ within the DocuSign system.
By selecting the check-box next to ‘I agree to use electronic records and signatures’, you confirm
that:





You can access and read this Electronic Record and Signature Disclosure; andYou can print on paper this Electronic Record and Signature Disclosure, or save or send
this Electronic Record and Disclosure to a location where you can print it, for futurereference and access; andUntil or unless you notify County of Santa Cruz as described above, you consent toreceive exclusively through electronic means all notices, disclosures, authorizations,acknowledgements, and other documents that are required to be provided or madeavailable to you by County of Santa Cruz during the course of your relationship withCounty of Santa Cruz.