2-5. [Automated Crime Victims Notification System] BPM005579 Solicitation Attachment 5 - Conformance Statements_Equifax Response 2.pdf

Request for Proposal

Solicitation No. BPM005579

Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Attachment – Conformance Statements | Revision No. 1 | Revised 11-22

Attachment 5 – Conformance Statements

If taking exceptions, the relevant subsequent pages titled “Attachment Supplements” must be completed.

Attach additional pages as needed.

STATE WILL NOT CONSIDER ANY EXCEPTIONS UNLESS DESIGNATED ON THIS FORM.

READ ALL INSTRUCTIONS TO OFFERORS BEFORE TAKING ANY EXCEPTIONS. OFFERS WITH EXCEPTIONS MAY BE FOUND NOT SUSCEPTIBLE FOR AWARD UNDER A.A.C. R2-7-C311 OR RECEIVE LOWER SCORES DURING EVALUATION.

IF NEITHER BOX IS CHECKED UNDER ANY SECTION BELOW, THE OFFEROR’S RESPONSE TO THAT SECTION WILL BE CONSIDERED “YES” AND STATE WILL INTERPRET THE OFFER AS IF THERE WERE NO EXCEPTIONS TAKEN.

CONFORMANCE TO THE INSTRUCTIONS TO OFFERORS

Check one of the following:

☐ YES – Offeror acknowledges that it has read and understands the Special Instructions to Offerors and Uniform Instructions to Offerors of the Solicitation Documents and attests that its Offer complies with both.

☐ NO – Offeror acknowledges that it has read and understands the Instructions to Offerors in the Solicitation Documents, and attests that its Offer complies with both EXCEPT FOR the exceptions listed in Attachment Supplement – Conformance Statements - Exceptions to Instructions.

CONFORMANCE TO THE SCOPE OF WORK

☐ YES – Offeror acknowledges that it has read and understands the Scope of Work Document and the Pricing Document of the Solicitation Documents and attests that its Offer complies with both.

☐ NO – Offeror acknowledges that it has read and understands the Scope of Work Document and the Pricing Document of the Solicitation Documents and attests that its Offer complies with both EXCEPT FOR the exceptions listed in Attachment Supplement – Conformance Statements - Exceptions to Scope of Work.

CONFORMANCE TO THE CONTRACT TERMS AND CONDITIONS

☐ YES – Offeror acknowledges that it has read and understands the Special Terms and Conditions and the Uniform Terms and Conditions, along with their respective Exhibits and Appendices of the Solicitation Documents and attests that its Offer complies with all.

☐ NO – Offeror acknowledges that it has read and understands the Special Terms and Conditions and the Uniform Terms and Conditions, along with their respective Exhibits and Appendices of the Solicitation Documents and attests that its Offer complies with all EXCEPT FOR the exceptions listed in Attachment Supplement – Conformance Statements - Exceptions to Contract Terms and Conditions.

Company name Signature of person authorized to sign

Appriss Insights, LLC Jarrod Carnahan (Jan 26, 2024 16:36 EST) https://account.na2.adobesign.com/verifier?tx=CBJCHBCAABAAKhRilOYU4lOQBQS011ycMv28ziJHOp6L

Attachment Supplement 1 – Conformance Statements - Exceptions to Instructions

Article / paragraph or exhibit reference

RFP language (Copy and paste from Solicitation) Alternate language and Rationale

Special Instructions to Offerors

X X Alternate language: X

Rationale: X

Uniform Instructions to Offerors

Attachment Supplement 2 – Conformance Statements - Exceptions to Scope of Work or exhibit reference

RFP language (Copy and paste from Solicitation) Alternate language and Rationale

Scope of Work

1.1.1 Receive Multi-Agency Notifications – This area

includes the sharing of status of an incident or an investigation with another identified agency. It is currently unclear if receiving a status is intended to trigger an update in the receiving LEA’s RMS system.

Alternate language: Receive Multi-Agency Notifications – This area includes the sharing of status of an incident or an investigation with another identified agency.

Rationale: Removes ambiguity in the SOW.

Additional functionality can be addressed via change orders.

1.2.2 Design the System – This work includes developing

detailed architecture and design documents including UI design that trace back to the validated requirements. This work will also review the expansion options or integration options relative to VINE, and include the applicable decision-making and planning for the integration option chosen.

Alternate language: Design the System – This work includes developing high level architecture and design documents including UI design that trace back to the validated requirements. This work will also review the expansion options or integration options relative to VINE, and include the applicable decision-making and planning for the integration option chosen.

Rationale: The solution being proposed is a SaaS solution. Detailed architecture is proprietary to the vendor(s).

1.2.2 Design the System’s configurations – This work needs

to produce a full list of the system configurations that govern the System behavior at runtime and that implement the validated requirements. These configurations should be grouped by the user group that is intended to administer them, e.g. overall system configurations administered by the CVNS operator team, LEA configurations administered by each participating LEA, crime victim configurations administered by a proxy of crime victims, and so on.

Alternate language: <STRIKE> solution, administration and configuration is provided as service with the subscription, no functionality will need to be exposed to ACJC.

1.2.2 Design the System’s configuration management – This

work focuses on identifying and provisioning the System’s environments needed and the purpose of each, e.g. Development, Integration, Testing, Production. Provisioning includes making the applicable hosting arrangements with the vendor, a State Agency or ACJC at the discretion of the ACJC.

solution, administration and configuration is provided as service with the subscription, no functionality will need to be exposed to ACJC.

This work also identifies the planned deployment processes between the environments for software/functionality, settings, data, documents, interfaces and logs. Finally, this work includes a detailed plan for introducing, testing and deploying System changes across environments prior to and including deployment on production. This work needs to inform DEL-8 System Configuration Management Plan.

1.2.3 Developing software - Code the notification system

and implement the software configurations based on the approved design.

Alternate language: Deliver access to software that enabled the required functionality.

Rationale: For clarity, the solution being proposed is a SaaS solution and software is not a deliverable, but rather access to a deployed SaaS solution is.

1.2.3 Iteratively test the System during implementation –

This work includes functional, performance, and security tests at a minimum. Test results that are consistently above acceptable thresholds will be used to make decisions about adjusting project scope, budget and/or time. Prolonged Test Failures can give rise to a contract cancellation for cause.

Rationale: The solution being proposed is an existing SaaS solution deployed in Arizona. Testing is done as part of any incremental change. No need for the iterative testing approach that a green field project would require.

1.3.11 The System must allow for any notification to be

configured in English, and automatically versioned for other languages.

Alternate language: The System must allow for any notification to be configured in English, and versioned for other languages.

Rationale: Removed automatically versioned, as translations are supported via curated configuration and not automated to ensure accuracy, tone and context.

1.3.22 The System must connect a victim et al and a

concerned citizen who may have canceled their account, with their personal notification and activity history on their canceled account in the event that the victim et al and a concerned citizen elect to request access to CVNS again.

SaaS solution deployed in Arizona. The current system does not provide notification history. Additionally, canceling accounts is likened to the “right to be forgotten” in many state and local privacy laws.

1.3.28 The System must, at the option of the receiving LEA

for one or all of the messages it receives, save any notification to the LEA's network or local device/machine in a standard format. The standard format must use one or more of the following: Comma Separated Value (CSV), Extensible Markup Language

SaaS solution deployed in Arizona. The current system does not provide this function natively, however email

(XML), Java Simple Object Notation (JSON). and texts can be saved to the LEA systems and networks according to LEA IT policies and practices.

1.3.29 The System must provide an option to withdraw or

otherwise roll-back a notification sent in error as determined by the sending LEA at any time after the withdrawn or roll-back message was sent.

Rationale: Due to the mechanisms for sending notifications, email and SMS, there are no technical solutions for rolling back or withdrawing a message.

However, we can send corrective notifications as needed.

1.3.30 The System must maintain all user and System activity

and notification data.

Alternate language: The System must maintain all user and System activity and notification data, in accordance to LEA and other privacy and data retention policies in effect.

Rationale: As the data is the Agencies or Victims data, they have control over data retention.

1.3.31 System must provide a user interface to LEA and

System administrative users for viewing, filtering, sorting and exporting data maintained per requirement 2.7.1, as well as current and historic notification settings.

Alternate language: System must provide a method for LEA and System administrative users for viewing, filtering, sorting and exporting data maintained per requirement 2.7.1, as well as current and historic notification settings.

Rationale: Some of this detail will require support and engineering to provide versus an interface with this data.

1.3.33 System must show the victim et al, and the concerned

citizen what the current and historic System and LEA notifications options are.

Rationale: Based on our experience, the value for the user to know the historic notifications options is minimal.

1.3.39 The System must at all times have the most recent

security settings and patches installed. This requirement applies to the System under development and in operation, in any of its environments unless so approved by ACJC and for the purpose of iterative testing and deployment across environments.

Alternate language: The System must address security vulnerabilities due to configuration and software patches in generally accepted industry standard based on risk.

Rationale: “At all times” is not a feasible expectation.

1.3.43 The System must record when outbound notifications

are sent/made, when a recipient sees a text, when a recipient answers a call, when an answering machine answers a call, when a call is unanswered, when an email is opened and when any of the action options are

Alternate language: The System must record when outbound notifications are sent/made, when a recipient answers a call, when an answering machine answers a call and when a call is unanswered.

chosen that may be part of the notification sent, for example click on links, click/tap on a phone number.

Rationale: Due to the state of technology and the capabilities many of these events are not reliably trackable.

1.3.47 The System must have a user interface available to the vendor or support service provider of a LEA's RMS, as well as the System Administrator. That user interface must provide monitoring of the performance of the data exchange between the RMS and the System.

Rationale: As the system is built RMS vendors control data access within their systems. No need to manage within the CVNS,

1.3.49 The System must provide analytical tools and libraries in order for ACJC to perform analytics about the System's e notification activities and the System itself such as notification settings, data exchanges, usage analysis and LEA participation. The tools must include a user interface for viewing raw data; for filtering, sorting and transforming data; and for presenting and refreshing annotated charts and graph using raw data that is refreshed on at least a weekly basis.

Alternate language: The System must provide analytical tools in order for ACJC to perform analytics about the System's notification activities and the System itself such as notification settings, data exchanges, usage analysis and LEA participation.

Rationale: The system as built has dashboards for core analytics. RAW data can be exported and integrated into any analytics solution ACJC may use.

Attachment Supplement 3 – Conformance Statements - Exceptions to Contract Terms and Conditions or exhibit reference

RFP language (Copy and paste from Solicitation) Alternate language and Rationale

Special Terms and Conditions

1.12 Data Breach: Data Breach is used herein as defined as

stated in A.R.S. Title 18, chapter 5, article 4 (Data Security Breaches), or in any relevant state or federal standard, to indicate an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

Alternate language: Data Breach: Data Breach is used herein to indicate an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

Rationale: Equifax cannot agree to an ever-changing definition that Equifax has no control over, however we can agree to the definition as of the Effective Date of the contract.

3.9 Order Cancellations. State may cancel Orders within a

reasonable period after issuance and at its discretion.

The same method used for ordering will be used for cancellation.

Alternate language: State and Contractor may mutually agree to cancel Orders within a reasonable period after issuance.

Rationale: We believe that both parties should have the ability to approve the cancellation of an order if needed.

3.10.3 Contractor shall pay State an administrative fee against all Contract sales to Co‑Op Buyers, as provided for under A.R.S. § 41‑ 2633. The fee rate is one (1%) percent. Failure to remit the administrative fees is a material breach of contract, and will entitle the State to its remedies under Contract Terms and Conditions Section 8 and its right to terminate for default under Section 9. Method of calculation, payment procedures, and other details are provided on the State Procurement Office website:

https://spo.az.gov/suppliers/usage-reporting.

Alternate language: Method of calculation, payment procedures, and other details are provided on the State Procurement Office website:

https://spo.az.gov/suppliers/usage-reporting.

Rationale: 1% fee to be removed or the price of the services will increase accordingly to facilitate administrative fees.

3.10.4 Contractor shall submit to State a quarterly usage

report documenting all Contract sales to both Eligible Agencies and Co‑Op Buyers, itemized separately.

Contractor shall further itemize divisions, groups or

Alternate language: Contractor shall further itemize divisions, groups or areas within a given Eligible Agency if they place Orders independently of each other. Failure to submit the report is a material breach areas within a given Eligible Agency if they place Orders independently of each other. Failure to submit the report is a material breach of contract, and will entitle the State to its remedies under Contract Terms and Conditions Section 8 and its right to terminate for default under Section 9. Contractor shall submit the report using the forms and following the instructions on the State Procurement Office website:

https://spo.az.gov/suppliers/usage-reporting.

of contract, and will entitle the State to its remedies under Contract Terms and Conditions Section 8 and its right to terminate for default under Section 9.

Contractor shall submit the report using the forms and following the instructions on the State Procurement Office website:

https://spo.az.gov/suppliers/usage-reporting.

Rationale: Additional reporting will increase pricing of services being offered.

3.10.5 Contractor shall acknowledge each Order from

Eligible Agencies within one (1) business day after receipt by either: (a) “approving” the Order electronically in the State’s eProcurement System, which will indicate Contractor’s unqualified acceptance of the Order as‑issued; or (b) “rejecting” the Order electronically in the State’s eProcurement System, with a concurrent explanation by email to relevant originator as to the reason for rejecting it. By way of reminder, the only grounds on which the Contractor may reject or refuse an Order are those set out in subparagraph 3.11.3 [Orders are Obligatory].

Unless and until Contractor has approved the Order in the State’s eProcurement System, it will have no effect under the Contract and will not oblige either State or Contractor. If the relevant Eligible Agency explicitly instructs at the time that a verbal acceptance is sufficient because of urgency or other unusual circumstances and Contractor duly gives its verbal acceptance, then Contractor will be deemed to have accepted the Order immediately upon commencing performance, provided that, Contractor must follow-up its verbal acceptance by accepting the Purchase Order electronically in the State’s eProcurement System within three

(3) business days. Contractor shall thereafter be barred from subsequently rejecting the Order in the State’s eProcurement System and if it does so the rejection will be void.

Alternate language: Upon mutual agreement between Contractor and the State, each Order from Eligible Agencies within ten (10) business day after receipt by either: (a) “approving” the Order electronically in the State’s eProcurement System, which will indicate Contractor’s unqualified acceptance of the Order as‑issued; or (b) “rejecting” the Order electronically in the State’s eProcurement System, with a concurrent explanation by email to relevant originator as to the reason for rejecting it. By way of reminder, the only grounds on which the Contractor may reject or refuse an Order are those set out in subparagraph 3.11.3 [Orders are Obligatory].

Unless and until Contractor has approved the Order in the State’s eProcurement System, it will have no effect under the Contract and will not oblige either State or Contractor. If the relevant Eligible Agency explicitly instructs at the time that a verbal acceptance is sufficient because of urgency or other unusual circumstances and Contractor duly gives its verbal acceptance, then Contractor will be deemed to have accepted the Order immediately upon commencing performance, provided that, Contractor must follow-up its verbal acceptance by accepting the Purchase Order electronically in the State’s eProcurement System within three

(3) business days. Contractor shall thereafter be barred from subsequently rejecting the Order in the State’s eProcurement System and if it does so the rejection will be void

Rationale: We need at least 10 business days and right of refusal.

6.1 Risk of Loss: Contractor shall bear all risk of loss to

Materials while in pre-production, production, storage, transit, staging, assembly, installation, testing, and

Alternate language: The Contractor shall bear all loss of conforming Materials covered under this Contract until received by authorized personnel at the location commissioning, if and as those duties are within the scope of the Work, until they have been accepted as conforming by State in the particular location and situation specified in the Order, or as specified generally elsewhere in the Contract if the Order does not provide particulars, provided that, risk of loss for nonconforming Materials will remain with Contractor notwithstanding acceptance to the extent the loss stems from the nonconformance.

designated in the purchase order or Contract. Mere receipt does not constitute final acceptance. The risk of loss for nonconforming Materials shall remain with the Contractor regardless of receipt.

Rationale: Utilizing the “Uniform Terms and Conditions” language, as it is more applicable to Insights’ services

6.2.1 Contractor Indemnification (Not Public Agency). To

the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona.

Alternate language: Contractor Indemnification (Not Public Agency). To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole by or in part, by the gross negligent or willful misconduct of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors gross negligence or willful misconduct.

This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the gross negligent or willful acts of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona. NOTWITHSTANDING ANYTHING TO

THE CONTRARY IN THIS CONTRACT, TO THE

EXTENT PERMITTED BY LAW, THE

AGGREGATE LIABILITY OF THE CONTRACTOR

IN EACH CASE UNDER THIS CONTRACT (AND

WHETHER SUCH LIABILITY ARISES FROM

ANY CLAIM BASED ON INDEMNITY, BREACH

OR CONFIDENTIALITY, WARRANTY, TORT

(INCLUDING NEGLIGENCE OR BREACH OF

STATUTORY DUTY), OR OTHERWISE) SHALL

NOT EXCEED FIVE MILLION U.S. DOLLARS

($5,000,000).”

Rationale: Contractor should only be liable for what it causes. We further requests to narrow the scope to gross negligence and willful misconduct. Additionally, “omissions” is too broad. If there were an act to which claim would arise it would fall under gross negligence or willful misconduct.

6.3 Patent and Copyright Indemnification. With respect to

Materials or Services provided or proposed by a Contractor Indemnitor for performance under the Contract, Contractor shall indemnify, defend and hold harmless State Indemnitees against any third-party claims for liability, costs, and expenses, including, but not limited to reasonable attorneys' fees, for infringement or violation of any patent, trademark, copyright, or trade secret by the Materials and the Services. With respect to the defense and payment of claims under this subparagraph:

6.3.1. State shall provide reasonable and timely

notification to Contractor of any claim for which Contractor may be liable under this paragraph;

6.3.2. Contractor, with reasonable consultation from

State, shall have control of the defense of any action on an indemnified claim including all negotiations for its settlement or compromise;

6.3.3. State may elect to participate in such action at

its own expense; and

6.3.4. State may approve or disapprove any

settlement or compromise, provided that,

(i) State shall not unreasonably withhold or delay such approval or disapproval and (ii) State shall cooperate in the defense and in any related settlement negotiations.

Alternate language: Patent and Copyright Indemnification. With respect to Materials or Services provided or proposed by a Contractor Indemnitor for performance under the Contract, Contractor shall indemnify, defend and hold harmless State Indemnitees against any third-party claims for liability, costs, and expenses, including, but not limited to reasonable attorneys' fees, for infringement or violation of any patent, trademark, copyright, or trade secret by the Materials and the Services. With respect to the defense and payment of claims under this subparagraph:

6.3.1. State shall provide reasonable and timely

notification; however no later than ten (10) business days, to Contractor of any claim for which Contractor may be liable under this paragraph;

6.3.2. Contractor, with reasonable consultation from

State, shall have control of the defense of any action on an indemnified claim including all negotiations for its settlement or compromise;

Rationale: Contractor requests to put a time limit as it needs time address the claim and ensure that its rights are not affected. Contractor must have full control to handle claims related to its Intellectual Property.

Contractor will reasonably with the State as required in a 6.3.2.

12.3 Compensation for Late Deliveries. Contractor shall

have clear, published policies in place regarding late delivery, order cancellation, discounts, or rebates given to compensate for late deliveries, etc., and make them readily available to those Eligible Agencies, and

Rationale: The clause does not really apply to the purchase of SaaS products.

CoOp Buyers if applicable, that are likely to need them. If late deliveries have been specifically addressed in the Contract, the Contract shall take precedence over any such Contractor policies.

12.4 Indicate Shipping Costs on Order. Contractor shall

identify and provide the required substantiating documentation for the amount it intends to add for shipping in the Order acknowledgment if shipping is additional to the contracted price or rate for an item;

otherwise, Contractor shall indicate that shipping is included in the Order price (in other words, every Order must indicate clearly whether or not shipping is included in the Order price, and if not included, how much is to be added and why that amount is the correct or appropriate one).

Rationale: The clause does not really apply to the purchase of SaaS products.

12.14 Materials Acceptance. State has the right to accept

Materials subject to a complete inspection on delivery and installation, if installation is Contractor’s responsibility. State may require acceptance criteria, including, but not limited to, conformity to the Contract, workmanship, and quality under the Contract or for a specific Order. Contractor shall remove any rejected Materials from the delivery location, or from any area to which it might have been reasonably necessary to move it, and subsequently deliver an equal quantity of conforming items within a timeframe set by the Eligible Agency or Co-Op Buyer. State shall not owe Contractor any payment for rejected Materials, and State may, at its discretion, withhold or make partial payment for any rejected Materials that have been returned to Contractor in those instances where State has agreed to permit repair instead of demanding replacement.

Rationale: For this product we normally do not provide an acceptance period. This type of clause makes more sense if there are physical deliverables.

12.16 Returns. State may, at its discretion, return for full

credit and with no restocking charges, any delivered Materials unused in the original packaging within thirty (30) days after receipt, regardless of acceptance.

If State elects to return delivered Materials, then State shall pay delivery costs to return the products to the place from which Contractor shipped them. However, if State returns delivered Materials because they are defective or non-conforming or for any other reason having to do with Contractor fault or error, then State will not be responsible for any costs associated with returning the Materials and may, at its discretion, either have those billed directly to Contractor, offset them under paragraph 8.5 [Right of Offset] of the Uniform Terms and Conditions, or take any other

Rationale: Does not apply to software.

appropriate actions under the Contract.

14.2 Data Protection and Confidentiality of Information.

Contractor warrants that it will establish and maintain procedures and controls acceptable to State for ensuring that State’s proprietary and sensitive Data is protected from unauthorized access and information obtained from State or others in performance of its contractual duties is not mishandled, misused, or inappropriately released or disclosed. For purposes of this paragraph, all Data created by Contractor in any way related to the Contract, provided to Contractor by State, or prepared by others for State are proprietary to State, and all information by those same avenues is State’s confidential information. To comply with the foregoing warrant:

Alternate language: Data Protection and Confidentiality of Information. Contractor warrants that it will establish and maintain procedures and controls for ensuring that State’s proprietary and sensitive Data is protected from unauthorized access and information obtained from State or others in performance of its contractual duties is not mishandled, misused, or inappropriately released or disclosed. For purposes of this paragraph, all Data, provided to Contractor by State, is State’s Confidential information. To comply with the foregoing warrant:

Rationale: The alternate language appropriately specifies State’s Data.

14.2.1 Contractor shall provide the State and Eligible

Agencies with a copy of its Disaster Recovery upon request. The Disaster Recovery plan shall outline the Contractor's actions, with timelines, in the event of a natural disaster, cyber- attack or loss of ability to operate and perform services under this contract.

Alternate language: Contractor shall provide the State and Eligible Agencies with a copy of its Executive Summary Documentation, upon request.

Rationale: Insights conducts its own Business Impact Analysis (BIA) for the VINE business process, which is accompanied with a Business Continuity Plan (BCP). The BCP is integrated with the Incident Response Plan and also the Disaster Recovery Plan.

14.2.2 Contractor shall: (a) notify State immediately of any

unauthorized access or inappropriate disclosures, whether stemming from an external Data Breach, internal Data Breach, system failure, or procedural lapse within twenty-four

(24) hours of a Data Breach, by sending an email to the Arizona Department of Homeland Security at AZSOC@azdohs.gov, reporting the incident that occurred; (b) cooperate with State to identify the source or cause and respond to each unauthorized access or inappropriate disclosure; and (c) notify State promptly of any security threat that could result in unauthorized access or inappropriate disclosures; and

Alternate language: Contractor shall: (a) notify State within 48 hours discovery of unauthorized or inappropriate disclosures, whether stemming from an external Data Breach or internal Data Breach that affects State data. This is accomplished by sending an email to the Arizona Department of Homeland Security at AZSOC@azdohs.gov, reporting the incident that occurred; (b) reasonably cooperate with State to identify the source or cause and respond to each unauthorized access or inappropriate disclosure;

and

Rationale: 48 hours is the "latest" process time to client notification of a confirmed incident, which also aligns with the time to triage, contain and eradicate on the way to recover, and mandated reporting to the Equifax Board of Directors. Of course, we will notify sooner as able.

14.2.3 Contractor shall not: (a) release any such Data or allow it to be released or divulge any such information to

Alternate language: Contractor shall not: (a) release any such Data or allow it to be released or divulge any anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b) respond to any requests it receives from a third party for such Data or information, and instead route all such requests to State’s designated representative.

such information, citing the State by name, to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing when the State is identified;

or (b) Contractor will comply with the Law, regulations and Law Enforcement.

Rationale: Unless required by applicable law or government enforcement or regulatory agency having jurisdiction, EWS shall not identify by name or implication in any announcements about Incidents without prior consent of Client.

14.4 Protected Health Information. Contractor warrants

that, to the extent performance under Contract involves individually identifiable health information (referred to hereinafter as protected health information (“PHI”) and electronic PHI (“ePHI”) as defined in the Privacy Rule referred to below), it:

14.4.1. is familiar with and will comply with the applicable aspects of the following collective regulatory requirements regarding patient information privacy protection: (a) the “Privacy Rule” in CFR 45 Part 160 and Part 164 pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996; (b) Arizona laws, rules, and regulations applicable to PHI/ePHI that are not preempted by CFR45-160(B) or the Employee Retirement Income Security Act of 1974 (“ERISA”) as amended; and (c) State’s current and published PHI/ePHI privacy and security policies and procedures;

14.4.2. will cooperate with State in the course of performing under the Contract so that both State and Contractor stay in compliance with the requirements in

(1) above; and

14.4.3. will sign any documents that are reasonably necessary to keep both State and Contractor in compliance with the requirements in (1) above, in particular “Business Associate Agreements” in accordance with the Privacy Rule.

NOTE: For convenience of reference only, the Privacy Rule is available at:

http://www.hhs.gov/hi$paa/for-professionals/privacy/index.html

Alternate language: Protected Health Information Contractor warrants that, to the extent performance under Contract involves individually identifiable health information (referred to hereinafter as protected health information (“PHI”) and electronic PHI (“ePHI”) will comply with the applicable aspects of the following collective regulatory requirements.

Nothing contained herein shall be construed to grant the Contractor any ownership rights in data supplied by the State to the Contractor in connection with this Contract. Further, Contractor shall not use any data it receives from victims of crime, or data it receives from the State or any third party pertaining to victims of crime, except for the provision of the Services set forth in this Scope of Work.

Contractor builds and maintains databases and solutions utilizing data from disparate incarceration systems. The hygiene, maintenance and storage of this incarceration data improves data quality and solutions for all clients seeking to manage risk, security and fraud (collectively “Risk Solutions”). A network effect is created whereby benefits increase with each participating organization. The State permits internal access (within Contractor) to the incarceration data for development and improvement of Service Provider’s Risk Solutions. Customer authorizes third-party access to the incarceration data only for Risk Solutions.

Notwithstanding the foregoing, and in accordance with Section 14.2 herein, Service Provider may utilize non-confidential incarceration data made available to the public.

1. is familiar with and will comply with the applicable aspects of the following collective regulatory requirement

Rationale: Paragraph 1: We do not anticipate receiving PHI under this contractual vehicle.

Equifax Insights cannot agree to be linked to the Privacy Rule and changes that may come from future changes to the Privacy Rule.

Equifax Insights will use appropriate safeguards to protect the privacy of Personal Data collected & comply with applicable laws, regulations, / standards to processing of U.S. Personal Data.

Paragraph 2: Previous approved language from 2021 RFP. The request internal use of the offender information for Insights’ Risk Solutions which is utilized by our customers includes law enforcement agencies and other state agencies. Insights solutions aid in criminal investigations.

15.3.2 Individual Measures. Contractor personnel shall

comply with applicable State policies and procedures regarding Data access, privacy, and security, including prohibitions on remote access and obtaining and maintaining access identifications (IDs) and passwords. Contractor is responsible to State for ensuring that any State access IDs and passwords are used only by the person to whom they were issued.

Contractor shall ensure that personnel are only provided the minimum only such level of access necessary to perform his or duties. Contractor shall, on request, provide a current register of the access IDs and passwords and corresponding access levels currently assigned to its personnel.

Alternate language: Individual Measures. Contractor personnel shall comply with industry standard practices regarding Data access, privacy, and security, including remote access and obtaining and maintaining access identifications (IDs) and passwords. Contractor is responsible to State for ensuring that any State access IDs and passwords are used only by the person to whom they were issued. Contractor shall ensure that personnel are only provided the minimum only such level of access necessary to perform his or duties. All personnel will comply with CJIS standards for data access.

Rationale: Contractor adheres to the highest industry standards for cybersecurity and compliance for accomplishing the scope of work, as modified in this section, as represented by CJIS standards. Contractor agrees to provide full-spectrum, NIST-based, defense in depth controls to protect the full lifecycle of information systems, data flow and data protection; a summary of the framework addressing security controls by domain may be viewed at https://controlsframework.equifax.com/home. These controls are updated at least annually. Insights uses SOC2 Type 2 Compliance and Audit and complies with Criminal Justice Information Systems (CJIS) Standards.

15.3.3 Access Control. Contractor is responsible to State for ensuring that hardware, software, Data, information, and that has been provided by State or belongs to or is in the custody of State and is accessed or accessible by Contractor personnel is only used in connection with carrying out the Work and is never commercially exploited in any manner whatsoever not expressly permitted under the Contract. State may restrict access of Contractor personnel, or instruct Contractor to restrict their access, if in its determination the requirements of this subparagraph are not being met.

Alternate language: Access Control. Contractor will ensure that hardware, software, information, and that has been provided by State or belongs to or is in the custody of State and is accessed or accessible by Contractor personnel is only used in connection with carrying out the Work and is never commercially exploited in any manner whatsoever not expressly permitted under the Contract. State may restrict access of Contractor personnel, or instruct Contractor to restrict their access, if in its determination the requirements of this subparagraph are not being met.

Rationale: VINE does disclose to credentialed law enforcement personnel in furtherance of their investigations. I assume LE gets paid. So, we do share State data. If this is not accurate, or is covered elsewhere in the contract, with Legal’s concurrence, then Security has no objection.

15.4.1 Indemnity from Third Party. For computer hardware or

software included in the Work as discrete units that were manufactured or developed solely by a third party, Contractor may satisfy its indemnification obligations under the Contract by, to the extent permissible by law, passing through to State such indemnity as it receives from the third-party source (each a “Pass-Through Indemnity”) and cooperating with State in enforcing that indemnity. If the third party fails to honor its Pass-Through Indemnity, or if a Pass-Through Indemnity is insufficient to indemnify State Indemnitees to the extent and degree, Contractor is required to do by the Uniform Terms and Conditions, then Contractor shall indemnify, defend and hold harmless State Indemnitees to the extent the Pass-Through Indemnity does not.

Alternate language: Indemnity from Third Party. For computer hardware or software included in the Work as discrete units that were manufactured or developed solely by a third party, Contractor may satisfy its indemnification obligations under the Contract by, to the extent permissible by law, passing through to State such indemnity as it receives from the third-party source (each a “Pass-Through Indemnity”) and cooperating with State in enforcing that indemnity.

Rationale: We request to be limited to whatever each party is limited too. Certain third-party providers have different liabilities such AWS. We believe in a fair distribution of risk.

15.6.2 Cancellation Option. In every case under 15.6.1, if

none of those options can reasonably be accomplished, or if the continued use of the infringing items is impracticable, State may cancel the relevant Order or terminate the Contract, and Contractor shall take back the infringing items. If State does cancel the Order or terminate the Contract, Contractor shall refund to State:

Alternate language: Cancellation Option. In every case under 15.6.1, if none of those options can reasonably be accomplished, or if the continued use of the infringing items is impracticable, the Contractor may cancel the relevant Order or terminate the Contract, and Contractor shall take back the infringing items. If Contractor does cancel the Order or terminate the Contract, Contractor shall refund to State:

Rationale: The Contractor should be able to determine whether or not it should cancel a contract due being to remedy an intellectual property infringement.

15.6.2.1 For any software created for State under the Contract, the amount State paid to Contractor for creating it;

Rationale: This clause does not apply we are not creating any software we are providing a ready-made software solution.

15.6.2.2 for all other Materials, the net book value of the product provided

Rationale: Requesting to cap to the amount indicated in 15.6.2.3. Utilizing the net book value may be debatable item.

15.7.1 Limit. Subject to the provisos that follow below and

unless stated otherwise in the Special Terms and Conditions, State’s and Contractor’s respective first party liability arising from or related to the Contract is limited to the greater of $1,000,000 (one million dollars) or three (3) times the purchase price of the specific Materials or Services giving rise to the claim.

Alternate language: Subject to the provisos that follow below and unless stated otherwise in the Special Terms and Conditions, State’s and Contractor’s respective first party liability arising from or related to the Contract is limited to the total aggregate liability is limited to the total amount customer paid Contractor under this agreement in the twelve (12) month period immediately preceding the date on which the claim giving rise to the liability arose.

Rationale: We believe that the cap is excessive. We request to lower the cap to ensure a proper distribution of the risk.

15.7.2 Provisos. This paragraph limits liability for first party direct, indirect, incidental, special, punitive, and consequential damages relating to the Work regardless of the legal theory under which the liability is asserted.

This paragraph does not limit liability arising from any:

Alternate language: UNDER NO CIRCUMSTANCES

WILL THE CONTRACTOR BE LIABLE FOR ANY

OF THE FOLLOWING UNDER THIS

AGREEMENT FOR ANY REASON: (A) SPECIAL,

INDIRECT, CONSEQUENTIAL, INCIDENTAL,

PUNITIVE OR EXEMPLARY DAMAGES OF ANY

KIND, INCLUDING WITH RESPECT TO LOSS OF

PROFITS, REVENUES, CUSTOMERS OR

CONTRACTS, LOSS OF USE OF EQUIPMENT,

LOSS OF OR DAMAGE TO DATA OR

CUSTOMER RECORDS, REPUTATIONAL HARM,

OPERATIONAL OR SERVICE INTERUPTIONS,

BUSINESS INTERRUPTION, OR LACK OF

AVAILABILITY OF CUSTOMER MATERIALS OR

FACILITIES, INCLUDING CUSTOMER'S

COMPUTER RESOURCES, SOFTWARE AND

ANY STORED DATA (INCLUDING CUSTOMER

DATA) OR RECORDS; OR (B) ANY THIRD-

PARTY CLAIMS AGAINST CITY FOR LOSSES

OR DAMAGES IN EACH CASE, EVEN IF

ADVISED OF THE POSSIBILITY OF SAME OR

EVEN IF SAME WERE REASONABLY

FORESEEABLE.

The above limitation applies to the Uniform Terms and Conditions

Rationale: We believe that it is reasonable to limit damages to only direct damages succumbed by the party seeking to be indemnified.

15.11.1 Contractor shall submit a completed Arizona Baseline

Infrastructure Security Controls assessment spreadsheet in the .xls format provided as found at:

https://azdohs.gov/file/4357, and mitigate or install compensating controls for any issues of concern identified by State. Contractor is required to provide any requested documentation supporting the review of the assessment to include NIST-based System Security Plans (SSP), Written Information Security Programs (WISP), and/or written IT policies in the manner requested. The assessment shall be re-validated on a minimum annual basis

Alternate language: Contractor shall submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet in the .xls format provided as found at: https://azdohs.gov/file/4357, and consider mitigating or installing compensating controls for any issues of concern identified by State.

Contractor is required to provide the NIST-based System Security Plans (SSP) referred to as the Security Framework, Written Information Security Programs (WISP), and/or written IT policies. Arizona will be responsible for any he assessment that shall be re-validated on a minimum annual basis.

Rationale: Equifax Insights will address perceived vulnerabilities, but Equifax Insights does not acknowledge vulnerabilities for security reasons;

doing so is akin to releasing a roadmap for a malicious actor. The process is addressed in the Security Framework, applying the Vulnerability and Security Risk Management Control Statements at https://controlsframework.equifax.com/home; so, the vulnerability will be managed according to the defined processes reviewed by the State during an assessment and also by SOC2 auditors, who note no gaps. We have defense in depth applying industry standard practices based on NIST CSF, and mapping to NIST 800-53 and ISO27001 though not like for like, and other frameworks such as CIS, etc. which means that if any control fails, then other controls will keep from resulting in a disclosure of data.

15.11.2 State reserves the right to conduct penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time.

Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

Alternate language: State may request, no more than once a year, a copy of the Executive Summary…