18._exhibit_2_-_sample_agreement.pdf

2. The term of this Agreement is:

Agreement IFB 24-3044 Page 1 of 3 CDSS/To Be Determined

EXHIBIT A

(Standard Agreement)

SCOPE OF WORK

A. Introduction and Background

The California Department of Social Services (CDSS), Community Care Licensing Division (CCLD) is responsible for conducting background investigations for potential peace officer applicants. The Investigations Branch (IB) requires assistance in conducting sworn background investigations to certify that the peace officer candidates meet the requirements of Government Code Section 1031.

B. Contractor Responsibilities

The Contractor shall:

1. Provide standard Peace Officer Standards and Training (POST) pre-employment background investigation services for sworn peace officer candidates of the

CDSS.

2. Be POST certified to conduct pre-employment backgrounds that are supported by POST and Standards & Training Program for Corrections (STC).

3. Ensure every employee of the Contractor completes a certified background investigation course through POST to conduct background investigations and must attend updated course as needed. Each employee shall attend in house training to ensure knowledge of legal issues and updates. Additionally, vendor personnel shall adhere to published POST bulletins which include updates from the California Department of Justice.

4. Have three (3) years of continuous experience with a California State Agency, or California Public Agency, providing POST pre-employment background investigation services.

5. Prepare a complete and thorough written report on each candidate. Submit a written Background Investigation Report using POST standards, no more than forty-five (45) calendar days from when the candidate’s personal history form is received by the Contractor barring any serious and unforeseen circumstance(s).

The Contractor shall submit written Background Investigation Reports and an invoice briefly describing the services rendered for each candidate..

6. Immediately notify CDSS and commence communication if during the course of an applicant’s background investigation, the Contractor finds information which would exclude a candidate from Peace Officer status. After notifying CDSS, immediately pause its investigation until CDSS provides further instruction.

Agreement IFB 24-3044 Page 2 of 3

a. In the event IB terminates any further investigations on a background within the first eight hours of work, the fee/rate shall be reduced by no less than 25%.

b. If the background is terminated after the first eight hours the full rate shall apply.

7. Contractor Warranties. The Federal taxpayer I.D. number of the Contractor is

______TBD________. The Contractor is licensed to perform the agreed upon services enumerated herein and covenants that it maintains all valid licenses, insurance, permits, and restrictions to perform same and on behalf of its employees and subagents.

8. Competent Work. All work shall be done in a competent fashion in accordance with applicable standards of the profession.

9. Representations. The Contractor shall make no representations, warranties, or commitments binding the CDSS.

10. Confidentiality. In the course of performing services, the parties recognize that the Contractor may come in contact with or become familiar with information which the CDSS or its affiliates or subsidiaries may consider confidential, including information pertaining to applicants/candidates. The Contractor shall keep all such information confidential and not to discuss or divulge any of it to anyone other than Project Representative of the CDSS.

11. Notice. Any notice or communication permitted or required by this Agreement shall be deemed effective when personally delivered or deposited, postage prepaid, by first-class regular mail, addressed to the other party’s business address or via email to the Project Representative listed on page 3 of the Scope of Work.

12. In the event the Contractor is unable to perform the services contracted for as to quality, quantity, or for any reason violates the specifications set forth in this contract, such action shall immediately null and void this Agreement.

13. In the event the Contactor fails to complete the background within the forty-five

(45) calendar days, as described in section 2, damage shall be sustained by CDSS. Therefore, the parties agree that the Contractor shall pay CDSS a late fee of $1,000 per occurrence. Such penalties shall be deducted by CDSS from amounts owed by CDSS to the Contractor. Additionally, if the Contractor fails to complete the background within the forty-five (45) calendar days as described in

Agreement IFB 24-3044 Page 3 of 3 section 2, the parties agree that the Contractor shall pay CDSS a 10% reduction for each day the report is late. Such penalties shall be deducted by CDSS from amounts owed by CDSS to the Contractor.

C. CDSS Responsibilities

The CDSS Shall:

1. Provide Applicant’s/Candidates personal history statement, job description, credit report, Soundex or photograph of the Applicant/Candidate, California (CA) Department of Motor Vehicle printout, documentation of clearance through the CA Department of Justice (DOJ) criminal history, and documentation of fingerprint clearance through live scan or original fingerprint card (JUS 107) and firearms clearance through the CA DOJ.

2. All printing shall be sent to the California Department of General Services, Office of State Publishing (OSP). It is the responsibility of the CDSS Project Representative to obtain an exemption from OSP to competitively bid out any and all printing listed within this Agreement.

D. Project Representatives

The Project Representatives during the term of this Agreement shall be:

CDSS Contractor

TBD TBD

The Project Representative may be changed by providing written notice to the other party within five (5) business days of the change. Said change shall not require an amendment to this Agreement.

Agreement IFB 24-3044 Page 1 of 3

EXHIBIT B

(Standard Agreement)

Revised 12/29/23

BUDGET DETAIL AND PAYMENT PROVISIONS

A. Invoicing and Payment

1. The maximum amount payable under this Agreement shall not exceed $To be determined (TBD). Shown below are the amounts that cannot be exceeded for each of the fiscal year(s):

2024/25 $TBD

2025/26 $TBD

2026/27 $TBD

2. For services satisfactorily rendered, and upon receipt and approval of the invoice(s), CDSS agrees to pay the Contractor for said services in accordance with the rates specified below:

POST Pre-Employment Background Investigation Services Per

Investigation

$ TBD

3. Invoices shall include the Agreement Number TBD and Reporting Structure TBD and shall be submitted not more frequently than monthly in arrears to:

California Department of Social Services

TBD

Any invoices submitted without the above referenced information may be returned to the Contractor for further re-processing.

B. State Budget Contingency Clause

1. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, CDSS shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

2. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, CDSS shall have the option to either cancel this Agreement with

Agreement IFB 24-3044 Page 2 of 3

EXHIBIT B

(Standard Agreement)

Revised 12/29/23 no liability occurring to the State, or offer an agreement amendment to Contractor to reflect the reduced amount.

C. For Contract with Federal Funds

1. It is mutually understood between the parties that this Agreement may have been written before ascertaining the availability of Congressional appropriation of funds, for the mutual benefit of both parties, in order to avoid program and fiscal delays which would occur if the Agreement were executed after that determination was made.

2. This Agreement is valid and enforceable only if sufficient funds are made available to the State by the United States Government for the term of this Agreement for the purposes of this program. In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by the Congress or any statute enacted by the Congress which may affect the provisions, terms, or funding of this Agreement in any manner.

3. It is mutually agreed that if the Congress does not appropriate sufficient funds for the program, this Agreement shall be amended to reflect any reduction in funds.

4. CDSS has the option to invalidate the Agreement under the 30-day cancellation clause or to amend the Agreement to reflect any reduction of funds.

D. Prompt Payment Clause

Payment shall be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927.

E. Review

CDSS reserves the right to review service levels and billing procedures as they impact charges against this Agreement.

F. Final Billing

Invoices for services must be received by CDSS within 90 days following each state fiscal year, or 90 days following the end of the contract term, whichever comes first.

The final invoice must include the statement “Final Billing.”

G. Nonresident Tax Withholdings

Payments to all nonresidents may be subject to withholding. Nonresident payees performing services in California or receiving rent, lease, or royalty payments from property (real or personal) located in California shall have seven percent of their total

Agreement IFB 24-3044 Page 3 of 3

EXHIBIT B

(Standard Agreement)

Revised 12/29/23 payments withheld for state income taxes. However, no withholding is required if total payments to the payee are $1,500 or less for the calendar year.

Agreement IFB 24-3044 Page 1 of 5

EXHIBIT D

(Standard Agreement)

Revised 11/1/22

SPECIAL TERMS AND CONDITIONS

A. Dispute Provisions

1. If Contractor disputes a decision of the State’s Project Representative regarding the performance of this Agreement or on other issues for which the Project Representative is authorized by this Agreement to make a binding decision, Contractor shall provide written dispute notice to the State’s Project Representative within 15 calendar days after the date of the action. The written dispute notice shall contain the following information:

a. the decision under dispute;

b. the reason(s) Contractor believes the decision of the State’s Project

Representative to have been in error (if applicable, reference pertinent contract provisions);

c. identification of all documents and substance of all oral communication which support Contractor’s position; and

d. the dollar amount in dispute, if applicable.

2. Upon receipt of the written dispute notice, the State program management will examine the matter and issue a written decision to Contractor within 15 calendar days. The decision of State program management shall contain the following information:

a. a description of the dispute;

b. a reference to pertinent contract provisions, if applicable;

c. a statement of the factual areas of agreement or disagreement; and

d. a statement of the representative’s decision with supporting rationale.

3. The decision of the State program management shall be final unless, within 30 calendar days from the date of receipt of the decision, Contractor files with the California Department of Social Services a notice of appeal addressed to:

California Department of Social Services 744 P Street, M.S. 9-6-747

Sacramento, CA 95814 Attention: Chief, Contracts and Procurement Services Branch

Pending resolution of any dispute, Contractor shall diligently continue all contract work and comply with all of the Project Representative’s orders and directions.

Agreement IFB 24-3044 Page 2 of 5

EXHIBIT D

(Standard Agreement)

Revised 11/1/22

B. Termination Without Cause

This Agreement may be terminated without cause by the State upon 30 days written notice to Contractor.

C. Debarment and Suspension

For federally funded agreements, Contractor certifies that to the best of their knowledge and belief that they and their principals or affiliates or any subcontractor utilized under this Agreement, are not debarred or suspended from federal financial assistance programs and activities, nor proposed for debarment, declared ineligible, or voluntarily excluded from participation in covered transactions by any federal department or agency. Contractor also certifies that it or any of its subcontractors are not listed with any active exclusions on the System for Award Management (http://www.sam.gov) (Executive Order 12549, 2 C.F.R. Parts 180, 376, 417 and 2336).

D. Certification Regarding Lobbying

The following provisions are applicable to Cooperative Agreements and Contracts exceeding $100,000 in federal funds:

1. For agreements with contractors who are State entities not under the authority of the Governor, or cities, private firms, or agencies which are receiving in excess of $100,000 in federal funds from CDSS to perform services. By signing this Agreement, Contractor certifies that to the best of their knowledge and belief, that:

a. No federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of a federal contract, the making of a federal grant, the making of a federal loan, the entering into of a cooperative agreement, and the extension, continuation, renewal, amendment, or modification of a federal contract, grant, loan, or cooperative agreement.

b. If any funds other than federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a member of Congress in connection with this federal grant or agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure of Lobbying Activities,” in accordance with its instructions.

http://www.sam.gov/

Agreement IFB 24-3044 Page 3 of 5

EXHIBIT D

(Standard Agreement)

Revised 11/1/22

c. Contractor shall require that the language of this certification be included in the award documents for all covered subawards exceeding $100,000 in federal funds at all appropriate tiers and that all subrecipients shall certify and disclose accordingly.

2. This certification is a prerequisite for making or entering into this transaction and is imposed by Section 1352, Title 31, U.S. Code. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Any person who fails to file the required certification shall be subject to a civil penalty of no less than $10,000 and not more than $100,000 for each such failure.

3. Nonprofit organizations and Institutes of Higher Education are also required to comply with the lobbying provisions contained in 2 C.F.R. section 200.450 and 45 C.F.R. section 75.450.

E. Unruh Civil Rights Act and the Fair Employment & Housing Act

By entering into this Agreement, Contractor certifies compliance with the Unruh Civil Rights Act (Section 51 of the Civil Code) and the Fair Employment and Housing Act (Section 12960 of the Government Code); and if Contractor has an internal policy against a sovereign nation or peoples recognized by the United States government, Contractor certifies that such policies are not used in violation of the Unruh Civil Rights Act or the Fair Employment and Housing Act.

F. Computer Software Copyrights

Contractor certifies that it has appropriate systems and controls in place to ensure that state funds will not be used in the performance of this Agreement for the acquisition, operation, or maintenance of computer software in violation of copyright laws.

G. OMB Audit

Pursuant to Office of Management and Budget (OMB) audit requirement regulations (2 C.F.R. § 200.501), non-federal entities that expend $750,000 or more in a year in federal awards from all sources combined shall have a single or program-specific audit conducted for that year in accordance with the provisions of 2 C.F.R. section

200.514 (previously OMB Circular A-133). All OMB audit reports shall meet the report submission requirements established in 2 C.F.R. section 200.512 and a copy shall be forwarded to CDSS.

Agreement IFB 24-3044 Page 4 of 5

EXHIBIT D

(Standard Agreement)

Revised 11/1/22

H. Subcontractors

The following provision is applicable to agreements in which the Contractor subcontracts out a portion of the work performed under this Agreement:

Contractor may enter into subcontracts for the services to be performed at Contractor’s expense, provided such subcontracts are consistent with this Agreement. Nothing contained in this Agreement or otherwise shall create any contractual relationship between CDSS and any subcontractors, and no subcontractor shall relieve Contractor of its responsibilities and obligations hereunder. Contractor agrees to be fully responsible to CDSS for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by Contractor. Contractor’s obligation to pay its subcontractors is an independent obligation from the obligation of CDSS to make payments to Contractor. As a result, CDSS shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor. Contractor shall maintain a copy of each subcontract entered into in support of this Agreement and shall, upon request by CDSS, make copies available for approval, inspection, or audit. Contractor shall ensure that all subcontracts for services include provision(s) requiring compliance with applicable terms and conditions specified in this Agreement and shall, as applicable, advise all subcontractors of their obligations to comply with the terms of the Agreement between CDSS and Contractor.

I. Indirect Costs/Administrative Overhead

Where allowed and identified in this Agreement, Contractor may claim indirect costs.

Indirect costs are expenses incurred for administrative services such as, but not limited to, accounting; personnel and payroll administration; accounts payable services; general and specialized insurance coverage; compliance and regulatory monitoring; independent audit services; and legal services. Indirect costs are applied to personnel, operating expenses, supplies, equipment, and travel expenses. Contractor shall ensure that all administrative fees are reasonable considering the services being provided. Contractor may only pay overhead charges on the first $25,000 of each subcontract. Any subcontractor receiving $25,000 or more must be clearly identified in the budget display and excluded when the total indirect costs are calculated. Line-item budget shifts which increase the indirect costs shall not be allowed.

J. Accessibility Requirements

Contractor shall comply with California Government Code sections 7405 and 11135 which requires, among other things, that Contractor shall comply with the accessibility requirements of Section 508 of the Federal Rehabilitation Act of 1973, Agreement IFB 24-3044 Page 5 of 5

EXHIBIT D

(Standard Agreement)

Revised 11/1/22 as amended (29 U.S.C. Sec. 794d), and regulations implementing that act as set forth in Part 1194 of Title 36 of the Federal Code of Regulations. All Contractor deliverables shall meet the requirements of the Web Content Accessibility Guidelines 2.0, or a subsequent version, published by the Web Accessibility Initiative of the World Wide Web Consortium at minimum Level AA success criteria.

Contractor shall respond to and resolve any complaint regarding accessibility of its products or services that is brought to its attention.

K. Russia – Ukraine Conflict Economic Sanctions

Contractor shall ensure compliance with economic sanctions imposed by the U.S.

government in response to Russia's actions in Ukraine, as well as any sanctions imposed under state law (collectively, economic sanctions). Economic sanctions include, but are not limited to, refraining from new investments in, and financial transactions with, Russian institutions or companies that are headquartered or have their principal place of business in Russia (Russian entities), and not transferring technology to Russia or Russian entities. Contractor(s) are further notified that they will be subject to additional reporting requirements pursuant to Executive Order (N- 6-22) issued on March 4, 2022, and any other subsequently issued orders.

Agreement IFB 24-3044 Page 1 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

ADDITIONAL PROVISIONS

A. Agreement Term and Amendment

The date of Agreement approval by the State shall be the governing factor as to the date of commencement. Should performance commence before the Agreement is approved, such services may be considered voluntary. The State may exercise any options to extend and/or amend the Agreement as permitted by the Solicitation.

B. Confidentiality Requirements

Contractor and its employees and agents shall comply with CDSS Confidentiality and Information Security Requirements as described in Exhibit E – Attachment 1.

C. Insurance Requirements

1. Contractor, at their own expense, shall maintain the following insurance coverage:

a. Commercial General Liability – Contractor shall maintain general liability on an occurrence form with limits not less than $1,000,000 per occurrence for bodily injury and property damage liability combined with a $2,000,000 annual policy aggregate. The policy shall include coverage for liabilities arising out of premises, operations, independent contractors, products, completed operations, personal & advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

The policy shall include California Department of Social Services, State of California, its officers, agents, employees, and guests, as additional insureds, but only with respect to work performed under the Agreement.

This endorsement shall be supplied under form acceptable to the Office of Risk and Insurance Management. In the case of Contractor’s utilization of subcontractors to complete the contracted scope of work, Contractor shall include all subcontractors as insureds under Contractor’s insurance or supply evidence of insurance to the State equal to policies, coverages, and limits required of Contractor.

b. Workers’ Compensation and Employers Liability – Contractor shall maintain statutory workers’ compensation and employer’s liability coverage for all its employees who will be engaged in the performance of the Agreement.

Employer’s liability limits of $1,000,000 are required.

Agreement IFB 24-3044 Page 2 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the State. The waiver of subrogation endorsement is to be provided with the certificate of insurance.

c. Professional Liability – Contractor shall maintain professional liability covering any damages caused by a negligent error, act, or omission with limits of not less than $1,000,000 per occurrence and $3,000,000 policy aggregate. The policy’s retroactive date shall be shown on the certificate of insurance and shall be before the date this contract was executed or before the beginning of contract work.

2. Certificates evidencing Contractor's insurance coverage shall be filed with CDSS prior to execution of this Agreement.

D. General Provisions Applying to All Insurance Polices

1. Coverage Term – Coverage shall be in force for the complete term of the Agreement. If insurance expires during the term of the Agreement, a new certificate shall be received by the State at least ten (10) days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of the Agreement.

2. Policy Cancellation / Termination & Notice of Non-Renewal – Contractor shall provide to the State within five (5) business days a copy of any notice of Cancellation/Termination or Non-renewal received by Contractor for any required insurance policies. In the event Contractor fails to keep the insurance coverage required by this Agreement in effect at all times, the State may, in addition to any other remedies it may have, terminate this Agreement upon the occurrence of such event, subject to the provisions of this Agreement.

3. Deductible – Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause – Any required insurance contained in this Agreement shall be primary, and not excess or contributory, to any other insurance carried by the State.

5. Insurance Carrier Required Rating – All insurance companies shall carry a rating acceptable to the Office of Risk and Insurance Management. If the Contractor is self-insured for a portion or all of its insurance, review of financial information including a letter of credit may be required.

6. Endorsements – Any required endorsements requested by the State shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

Agreement IFB 24-3044 Page 3 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

7. Inadequate Insurance – Inadequate or lack of insurance does not negate the Contractor’s obligations under this Agreement.

E. Certifications and Licenses

Contractor and its employees shall maintain applicable valid and current certifications and/or licenses as required throughout the term of the Agreement.

Contractor shall furnish, upon CDSS request, certifications and/or licenses of staff utilized to perform services.

F. Substitution of Subcontractor

Contractor may not substitute any subcontractor without advance written consent of

CDSS.

G. Disabled Veteran Business Enterprise Subcontractors

1. If for this Agreement Contractor made a commitment to achieve Disabled Veteran Business Enterprise (DVBE) participation, then Contractor shall within 60 days of receiving final payment under this Agreement (or within such other time period as may be specified elsewhere in this Agreement) certify in a report to the awarding department: (1) the total amount the prime contractor received under the contract; (2) the name and address of the DVBE(s) that participated in the performance of the contract; (3) the amount each DVBE received from the prime contractor; (4) that all payments under the contract have been made to the DVBE(s); and (5) the actual percentage of DVBE participation that was achieved.

A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Military & Veterans Code (M&VC) §999.5(d).)

2. Contractor understands and agrees that should award of this Agreement be based in part on their commitment to use the DVBE subcontractor(s) identified in their bid or offer, per M&VC 999.5(e), a DVBE subcontractor may only be replaced by another DVBE subcontractor and shall be approved by the Department of General Services (DGS). Changes to the scope of work that impact the DVBE subcontractor(s) identified in the bid or offer and approved DVBE substitutions will be documented by contract amendment.

3. Failure of Contractor to seek substitution and adhere to the DVBE participation level identified in the bid or offer may be cause for contract termination, recovery of damages under the rights and remedies due to the State, and penalties as outlined in M&VC §999.9; Public Contract Code (PCC) §10115.10, or PCC §4110 (applies to public works only).

Agreement IFB 24-3044 Page 4 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

H. DVBE Subcontractor Invoices

To ensure that DVBE participation is applied correctly, all DVBE subcontractor invoices submitted to the Contractor shall include the Agreement number.

2022 01 Exhibit E Attachment 1 - Contractor

The California Department of Social Services Confidentiality and Information Security Requirements

Contractor/Entity - v 2022 01

This Confidentiality and Information Security Requirements Exhibit (hereinafter referred to as “this Exhibit”) sets forth the information security and privacy requirements Contractor/Entity (hereinafter referred to as “Contractor”) is obligated to follow with respect to all confidential and sensitive information (as defined herein) disclosed to or collected by Contractor, pursuant to Contractor’s Agreement (the “Agreement”) with the California Department of Social Services (hereinafter “CDSS”) in which this Exhibit is incorporated. The CDSS and Contractor desire to protect the privacy and provide for the security of CDSS Confidential, Sensitive, and/or Personal (CSP) Information (hereinafter referred to as “CDSS CSP”) in compliance with state and federal statutes, rules and regulations.

I. Order of Precedence.

With respect to information security and privacy requirements for all CDSS CSP, unless specifically exempted, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the Agreement between Contractor and CDSS.

II. Effect on Lower Tier Transactions.

The terms of this Exhibit shall apply to all lower tier transactions (e.g.

agreements, sub-agreements, contracts, subcontracts, and sub-awards, etc.).

Contractor shall incorporate the contents of this Exhibit into each lower tier transaction.

III. Confidentiality of Information.

A. DEFINITIONS.

The following definitions apply to this Exhibit and relate to CDSS Confidential, Sensitive, and/or Personal Information.

1. “Confidential Information” is information maintained by the CDSS that is exempt from disclosure under the provisions of the California Public Records Act (Government Codes Sections

7920.000 et seq.) or has restrictions on disclosure in accordance with other applicable state or federal laws.

2. “Sensitive Information” is information maintained by the CDSS, which is not confidential by definition, but requires special precautions to protect it from unauthorized access and/or modification (i.e., financial, or operational information). Sensitive information is information in which the disclosure would jeopardize the integrity of the CDSS (i.e., CDSS' fiscal resources and operations).

3. “Personal Information” is information, in any medium (paper, electronic, or oral) that identifies or describes an individual (i.e., name, social security number, driver’s license, home/mailing address, telephone number, financial matters with security codes, Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 1 of 14 medical insurance policy number, Protected Health Information [PHI], etc.) and must be protected from inappropriate access, use or disclosure and must be made accessible to information subjects upon request. It can also be information in the possession of the Department in which the disclosure is limited by law or contractual Agreement (i.e., proprietary information, etc.).

4. “Breach” is

a. the unauthorized acquisition, access, use, or disclosure of

CDSS CSP in a manner which compromises the security, confidentiality or integrity of the information; or

b. the same as the definition of "breach of the security of the system" set forth in California Civil Code section 1798.29(f).

5. “Information Security Incident” is

a. unauthorized access or disclosure, modification, or destruction of, or interference with, CDSS CSP that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of any state or federal law or in a manner not permitted under the Agreement between Contractor and CDSS, including this Exhibit.

B. CDSS CSP which may become available to Contractor as a result of the implementation of the Agreement shall be protected by Contractor from unauthorized access, use, and disclosure as described in this Exhibit.

C. Contractor is notified that unauthorized disclosure of CDSS CSP may be subject to civil and/or criminal penalties under state and federal law, including but not limited to:

• California Welfare and Institutions Code section 10850

• Information Practices Act - California Civil Code section 1798 et seq.

• Public Records Act - California Government Code section 7920.000 et seq.

• California Penal Code Section 502, 11140-11144, 13301-13303

• Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) -

45 CFR Parts 160 and 164

• Safeguarding Information for the Financial Assistance Programs - 45

CFR Part 205.50

• Unemployment Insurance Code section 14013

D. EXCLUSIONS.

“Confidential Information,” “Sensitive Information,” and “Personal Information” (CDSS CSP) does not include information that

1. is or becomes generally known or available to the public other than because of a breach by Contractor of these confidentiality provisions;

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 2 of 14

2. already known to Contractor before receipt from CDSS without an obligation of confidentiality owed to CDSS;

3. provided to Contractor from a third party except where Contractor knows, or reasonably should know, that the disclosure constitutes a breach of confidentiality or a wrongful or tortious act; or

4. independently developed by Contractor without reference to the

CDSS CSP.

IV. Contractor Responsibilities.

A. Training.

Contractor shall instruct all employees, agents, and subcontractors with access to the CDSS CSP regarding:

1. The confidential nature of the information;

2. The civil and criminal sanctions against unauthorized access, use, or disclosure found in the California Civil Code Section 1798.55, Penal Code Section 502 and other state and federal laws;

3. CDSS procedures for reporting actual or suspected information security incidents in Paragraph V - Information Security Incidents and/or Breaches; and

4. That unauthorized access, use, or disclosure of CDSS CSP is grounds for immediate termination of this Agreement with CDSS and Contractor and may be subject to penalties, both civil and criminal.

B. Use Restrictions.

Contractor shall take the appropriate steps to ensure that their employees, agents, and subcontractors will not intentionally seek out, read, use, or disclose the CDSS CSP other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

C. Disclosure of CDSS CSP.

Contractor shall not disclose any individually identifiable CDSS CSP to any person other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

D. Subpoena.

If Contractor receives a subpoena or other validly issued administrative or judicial notice requesting the disclosure of CDSS CSP, Contractor will immediately notify the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer. In no event should notification to CDSS occur more than three (3) business days after receipt by Contractor’s responsible unit for handling subpoenas and court orders.

E. Information Security Officer.

Contractor shall designate an Information Security Officer to oversee its compliance with this Exhibit and to communicate with CDSS on matters concerning this Exhibit.

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 3 of 14

F. Requests for CDSS CSP by Third Parties.

Contractor shall promptly transmit to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer all requests for disclosure of any CDSS CSP requested by third parties to the Agreement between Contractor and CDSS (except from an Individual for an accounting of disclosures of the individual’s personal information pursuant to applicable state or federal law), unless prohibited from doing so by applicable state or federal law.

G. Documentation of Disclosures for Requests for Accounting.

Contractor shall maintain an accurate accounting of all requests for disclosure of CDSS CSP Information and the information necessary to respond to a request for an accounting of disclosures of personal information as required by Civil Code section 1798.25, or any applicable state or federal law.

H. Return or Destruction of CDSS CSP on Expiration or Termination.

Upon expiration or termination of the Agreement between Contractor and CDSS, or upon a date mutually agreed upon by the Parties following expiration or termination, Contractor shall return or destroy the CDSS CSP. If return or destruction is not feasible, Contractor shall provide a written explanation to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer, using the contact information in this Agreement. CDSS, in its sole discretion, will make a determination of the acceptability of the explanation and, if retention is permitted, shall inform Contractor in writing of any additional terms and conditions applicable to the retention of the CDSS CSP.

I. Retention Required by Law.

If required by state or federal law, Contractor may retain, after expiration or termination, CDSS CSP for the time specified as necessary to comply with the law.

J. Obligations Continue Until Return or Destruction.

Contractor’s obligations regarding the confidentiality of CDSS CSP set forth in this Agreement, including but not limited to obligations related to responding to Public Records Act requests and subpoenas shall continue until Contractor returns or destroys the CDSS CSP or returns the CDSS CSP to CDSS; provided however, that on expiration or termination of the Agreement between Contractor and CDSS, Contractor shall not further use or disclose the CDSS CSP except as required by state or federal law.

K. Notification of Election to Destroy CDSS CSP.

If Contractor elects to destroy the CDSS CSP, Contractor shall certify in writing, to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer, using the contact information, that the CDSS CSP has been destroyed.

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 4 of 14

L. Background Check.

Before a member of Contractor’s workforce may access CDSS CSP, Contractor must conduct a thorough background check of that worker and evaluate the results to assure that there is no indication that the worker may present a risk to CDSS information technology systems and/or CDSS data. Contractor shall retain each workforce member’s background check documentation for a period of three (3) years following Agreement termination.

M. Confidentiality Safeguards.

Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the CDSS CSP that it creates, receives, maintains, uses, or transmits pursuant to the Agreement. Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, including at a minimum the following safeguards:

1. General Security Controls

a. Confidentiality Acknowledgement.

By executing this Agreement and signing Paragraph XI, CDSS Confidentiality and Security Compliance Statement, Contractor acknowledges that the information resources maintained by CDSS and provided to Contractor may be confidential, sensitive, and/or personal and requires special precautions to protect it from wrongful access, use, disclosure, modification, and destruction.

b. Workstation/Laptop Encryption.

All Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP must be encrypted using a FIPS 140-2, until deprecated, certified algorithm which is 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by the CDSS Information Security Office.

c. Data Encryption.

Any CDSS CSP shall be encrypted at rest when stored on network file shares or document repositories.

d. Server Security.

Servers containing unencrypted CDSS CSP must have sufficient administrative, physical, and technical controls in

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 5 of 14 place to protect that data, based upon a risk assessment/system security review.

e. Minimum Necessary.

Only the minimum necessary amount of the CDSS CSP required to perform necessary business functions may be copied, downloaded, or exported.

f. Removable Media Devices.

All electronic files that contain the CDSS CSP must be encrypted when stored on any removable media or portable device (i.e. USB thumb drives, floppies, CD/DVD, smart phone, backup tapes etc.). Encryption must be a FIPS 140- 2, until deprecated, certified algorithm which is 128 bit or higher, such as AES.

g. Antivirus Software.

All Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP must install and actively use comprehensive anti-virus software solution with automatic updates scheduled at least daily.

h. Patch Management.

To correct known security vulnerabilities, Contractor shall install security patches and updates in a timely manner on all Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP as appropriate based on Contractor’s risk assessment of such patches and updates, the technical requirements of Contractor’s systems, and the vendor’s written recommendations. If patches and updates cannot be applied in a timely manner due to hardware or software constraints, mitigating controls will be implemented based upon the results of a risk assessment.

i. User IDs and Password Controls.

All users must be issued a unique username for accessing CDSS CSP. Contractor’s password policy must be based on information security best practices for password length, complexity, and reuse.

j. Data Destruction.

Upon termination of the Agreement, all CDSS CSP must be sanitized in accordance with NIST Special Publication 800- 88, Guidelines for Media Sanitization.

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 6 of 14

2. System Security Controls

a. System Timeout.

The system providing access to the CDSS CSP must provide an automatic timeout, requiring re-authentication of the user session after no more than thirty (30) minutes of inactivity for applications, and fifteen (15) minutes of inactivity for desktops and laptops.

b. Warning Banners.

All systems (servers, desktops, laptops, etc.) containing CDSS CSP must display a warning banner at login stating that data is confidential, systems are logged, and system use is for business purposes only. User must be directed to log off the system if they do not agree with these requirements.

c. System Logging.

The system must maintain an automated audit trail which can identify the user or system process which initiates a request for CDSS CSP, or which alters CDSS CSP. The audit trail must be date and time stamped, must log both successful and failed accesses, must be read only, and must be restricted to authorized users. If CDSS CSP is stored in a database, database logging functionality must be enabled.

Audit trail data must be archived for at least one (1) year after occurrence.

d. Access Controls.

The system must use role-based access controls for all user authentications, enforcing the principle of least privilege.

e. Transmission Encryption.

All data transmissions of CDSS CSP by Contractor outside the secure internal network must be encrypted using a FIPS 140-2, until deprecated, certified algorithm, such as Advanced Encryption Standard (AES), with a 128bit key or higher. Encryption can be end to end at the network level, or the data files containing CDSS CSP can be encrypted. This requirement pertains to any type of CDSS CSP in motion such as website access, file transfer, and email.

f. Intrusion Detection.

All systems involved in accessing, holding, transporting, and protecting CDSS CSP that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 7 of 14

g. International Access.

Access to CDSS resources from outside of the United States is prohibited. Contractor must ensure CDSS data, systems, and resources are not accessed from international locations.

h. Software as a Service.

If the Contractor is providing any web/cloud hosting services that store or process CDSS CSP, the Contractor shall agree to the State Model Cloud Computing Special Provisions for Software as a Service (SaaS), hereby incorporated by reference.

3. Audit Controls

a. System Security Review.

All systems processing and/or storing CDSS CSP must have at least an annual system risk assessment/security review which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews shall include vulnerability scanning and/or penetration testing tools. The Contractor must submit the vulnerability assessment and/or penetration testing report(s) to the CDSS Information Security and Privacy Office upon request. The Contractor must agree to CDSS vulnerability assessment scans of the portion of its extranet to be used to service CDSS.

b. Log Reviews.

All systems processing and/or storing CDSS CSP must have a routine procedure in place to review system logs for unauthorized access.

c. Change Control.

All systems processing and/or storing CDSS CSP must have a documented change control procedure that ensures changes can be attributed to an individual and can be tracked and audited to protect the confidentiality, integrity, and availability of data.

4. Business Continuity / Disaster Recovery Controls

a. Disaster Recovery.

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 8 of 14 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CloudComputing_SaaSGeneralProvisions062122.pdf?la=en&hash=7B3D8F241D1486B9CA44AAE0932AA21BBBE19D74 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CloudComputing_SaaSGeneralProvisions062122.pdf?la=en&hash=7B3D8F241D1486B9CA44AAE0932AA21BBBE19D74 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CloudComputing_SaaSGeneralProvisions062122.pdf?la=en&hash=7B3D8F241D1486B9CA44AAE0932AA21BBBE19D74

Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of electronic CDSS CSP in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than twenty-four (24) hours.

b. Data Backup Plan.

Contractor must have established documented procedures to backup CDSS CSP to maintain retrievable exact copies of CDSS CSP. The plan must include a regular schedule for making backups, storing backups offsite, an inventory of backup media, and the amount of time to restore CDSS CSP should it be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite storage of CDSS data.

5. Paper Document Controls

a. Supervision of Information.

CDSS CSP in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk, or office. Unattended means that information may be observed by an individual not authorized to access the information.

CDSS CSP in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

b. Escorting Visitors.

Visitors to areas where the CDSS CSP are contained shall be escorted by a CDSS Employee and CDSS CSP shall be kept out of sight while visitors are in the area.

c. Confidential Destruction.

CDSS CSP must be disposed of through confidential means, such as crosscut shredding and/or pulverizing.

d. Removal of Information.

CDSS CSP must not be removed from the premises of Contractor except for identified routine business purposes or with express written permission of CDSS.

e. Faxing.

CDSS CSP that must be transmitted by fax shall require that Contractor confirms the recipient fax number before sending, takes precautions to ensure that the fax was appropriately received, maintains procedures to notify recipients if

Agreement IFB 24-3044 Exhibit E - Attachment 1 CDSS/To Be Determined Page 9 of 14

Contractor’s fax number changes, and maintains fax machines in a secure area.

f. Mailing.

Paper copies of CDSS CSP shall be mailed using a secure, bonded mail service, such as Federal Express, UPS, or by registered U.S. Postal Service (i.e., accountable mail using restricted delivery). All packages must be double packed with a sealed envelope and a sealed outer envelope or locked box.

V. Information Security Incidents and/or Breaches of CDSS CSP A. CDSS CSP Information Security Incidents and/or Breaches Response

Responsibility.

The Contractor shall be responsible for facilitating the Information Security Incident and/or Breach response process as described in California Civil Code 1798.82(f), and State Administrative Manual (SAM) Section 5340, Information Security Incident Management, including, but not limited to, taking:

1. Prompt corrective action to mitigate the risks or damages involved with the Information Security Incident and/or Breach and to protect the operating environment; and

2. Any action pertaining to such unauthorized…