2.6_Exhibit B-3_Fed Required Language_2024-05.pdf

EXHIBIT B-3 – ADDITIONAL FEDERAL/WTSC REQUIREMENTS: NO. 2024-05

Exhibit B-3 – Additional Federal / WTSC Requirements

Competitive Solicitation: No. 2024-05_Training Positive Community Framework

Bidder: _________________________________ Type/print full legal name of Bidder

Notes & Instructions to Bidders:

1. WTSC is provided with federal funding to pay for the goods/services provided to WTSC pursuant to the Contract resulting from the above-referenced Competitive Solicitation. Accordingly, bids that do not include this bidder certification regarding federal and WTSC specific requirements shall be deemed non-responsive.

2. Bidder, by submitting this certification document, certifies that it complies with each of the federal requirements set forth herein and that, during the performance of the resulting Contract, if awarded, shall comply with each of the federal requirements set forth herein.

3. Submit this document as a single Microsoft Word or PDF document to awilliams@wtsc.wa.gov.

Bidder, through the duly authorized undersigned, makes this certification as a required element of submitting a responsive bid. Bidder certifies, to the best of its knowledge and belief that the following are true, complete, correct, and made in good faith:

Federal Requirements

FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA)

In accordance with FFATA, the Bidder shall, upon request, provide WTSC the names and total compensation of the five most highly compensated officers of the entity, if the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in federal awards, received $25,000,000 or more in annual gross revenues from federal awards, and if the public does not have access to information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 or section 6104 of the Internal Revenue Code of 1986.

FEDERAL NONDISCRIMINATION (Title VI, 42 U.S.C. § 2000d et seq.)

Bidder, if awarded a Contract, certifies that, during the performance of such Contract, bidder, as Contractor, agrees:

1. To comply with all federal statutes and implementing regulations relating to nondiscrimination (“Federal Nondiscrimination Authorities”). These include but are not limited to:

mailto:awilliams@wtsc.wa.gov

• Title VI of the Civil Rights Act of 1964 (42 U.S.C. 2000d et seq., 78 stat. 252), (prohibits discrimination on the basis of race, color, national origin);

• 49 CFR part 21 (entitled Non-discrimination in Federally-Assisted Programs of the Department of Transportation—Effectuation of Title VI of the Civil Rights Act of 1964);

• 28 CFR section 50.3 (U.S. Department of Justice Guidelines for Enforcement of Title VI of the Civil Rights Act of 1964);

• The Uniform Relocation Assistance and Real Property Acquisition Policies Act of 1970, (42 U.S.C. 4601), (prohibits unfair treatment of persons displaced or whose property has been acquired because of Federal or Federal-aid programs and projects);

• Federal-Aid Highway Act of 1973, (23 U.S.C. 324 et seq.), and Title IX of the Education Amendments of 1972, as amended (20 U.S.C. 1681-1683 and 1685-1686) (prohibit discrimination on the basis of sex);

• Section 504 of the Rehabilitation Act of 1973, (29 U.S.C. 794 et seq.), as amended, (prohibits discrimination on the basis of disability) and 49 CFR part 27;

• The Age Discrimination Act of 1975, as amended, (42 U.S.C. 6101 et seq.), (prohibits discrimination on the basis of age);

• The Civil Rights Restoration Act of 1987, (Pub. L. 100-209), (broadens scope, coverage and applicability of Title VI of the Civil Rights Act of 1964, The Age Discrimination Act of 1975 and Section 504 of the Rehabilitation Act of 1973, by expanding the definition of the terms "programs or activities" to include all of the programs or activities of the Federal aid recipients, subrecipients and contractors, whether such programs or activities are Federally-funded or not);

• Titles II and III of the Americans with Disabilities Act (42 U.S.C. 12131-12189) (prohibits discrimination on the basis of disability in the operation of public entities, public and private transportation systems, places of public accommodation, and certain testing) and 49 CFR parts 37 and 38;

• Executive Order 12898, Federal Actions to Address Environmental Justice in Minority Populations and Low-Income Populations (preventing discrimination against minority populations by discouraging programs, policies, and activities with disproportionately high and adverse human health or environmental effects on minority and low-income populations);

• Executive Order 13166, Improving Access to Services for Persons with Limited English Proficiency (requiring that recipients of Federal financial assistance provide meaningful access for applicants and beneficiaries who have limited English proficiency (LEP));

• Executive Order 13985, Advancing Racial Equity and Support for Underserved Communities through the Federal Government (advancing equity across the Federal government); and

• Executive Order 13988, Preventing and Combating Discrimination on the Basis of Gender Identity or Sexual Orientation (clarifying that sex discrimination includes discrimination on the grounds of gender identity or sexual orientation).

2. Not to participate directly or indirectly in the discrimination prohibited by any federal non- discrimination law or regulation, as set forth in Appendix B of 49 CFR Part 21 and herein.

3. To keep and permit access to its books, records, accounts, other sources of information, and its facilities as required by the WTSC, USDOT, or NHTSA in a timely, complete, and accurate way. Additionally, the Bidder must comply with all other reporting, data collection, and evaluation requirements, as prescribed by law or detailed in program guidance.

4. That, in the event a contractor/funding recipient fails to comply with any nondiscrimination provisions in this Contract, the WTSC will have the right to impose such contract sanctions as it or NHTSA determine are appropriate, including but not limited to withholding payments to the Bidder under the Contract until the Bidder complies, and/or cancelling, terminating, or suspending a contract or funding agreement, in whole or in part.

5. In accordance with the Acts, the Regulations, and other pertinent directives, circulars, policy, memoranda, and/or guidance, the Bidder hereby gives assurance that it will promptly take any measures necessary to ensure that: “No person in the United States shall, on the grounds of race, color, or national origin, be excluded from participation in, be denied the benefits of, or be otherwise subjected to discrimination under any program or activity, for which the Recipient receives Federal financial assistance from DOT, including NHTSA”.

To insert this clause, including all paragraphs, in every sub-contract and sub-agreement and in every solicitation for a sub-contract or sub-agreement that receives federal funds under this program.

DRUG-FREE WORKPLACE

In accordance with the Drug-Free Workplace Act of 1988 (41 USC 8103 and 42 USC 12644), the Bidder shall:

1. Publish a statement notifying employees that the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance is prohibited in the Bidder's workplace and shall specify the actions that will be taken against employees for violation of such prohibition.

2. Establish a drug-free awareness program to inform employees about the dangers of drug abuse in the workplace; the Bidder’s policy of maintaining a drug-free workplace; any available drug counseling, rehabilitation, and employee assistance programs; and the penalties that may be imposed upon employees for drug violations occurring in the workplace.

3. Make it a requirement that each employee engaged in the performance of the grant be given a copy of the statement required by this section.

4. Notify the employee in the statement required by this section that, as a condition of employment under the grant, the employee will abide by the terms of the statement, notify the employer of any criminal drug statute conviction for a violation occurring in the workplace no later than five days after such conviction, and notify the WTSC within 10 days after receiving notice from an employee or otherwise receiving actual notice of such conviction.

5. Take one of the following actions within 30 days of receiving notice under paragraph 1. of this section, with respect to any employee who is so convicted: take appropriate personnel action against such an employee, up to and including termination, and/or require such employee to participate satisfactorily in a drug abuse assistance or rehabilitation program approved for such purposes by a federal, state, or local health, law enforcement, or other appropriate agency.

6. Make a good faith effort to continue to maintain a drug-free workplace through implementation of all of the paragraphs above.

POLITICAL ACTIVITY (HATCH ACT)

The Bidder will comply with provisions of the Hatch Act (5 U.S.C. 1501-1508) which limits the political activities of employees whose principal employment activities are funded in whole or in part with Federal funds.

FEDERAL LOBBYING

The undersigned certifies, to the best of his or her knowledge and belief, that:

1. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.

2. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form- LLL, "Disclosure Form to Report Lobbying," in accordance with its instructions.

3. The undersigned shall require that the language of this certification be included in the award documents for all sub-award at all tiers (including subcontracts, subgrants, and contracts under grant, loans, and cooperative agreements) and that all subrecipients shall certify and disclose accordingly.

This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352, title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

STATE LOBBYING

None of the funds under this program will be used for any activity specifically designed to urge or influence a State or local legislator to favor or oppose the adoption of any specific legislative proposal pending before any State or local legislative body. Such activities include both direct and indirect (e.g., "grassroots") lobbying activities, with one exception. This does not preclude a State official whose salary is supported with NHTSA funds from engaging in direct communications with State or local legislative officials, in accordance with customary State practice, even if such communications urge legislative officials to favor or oppose the adoption of a specific pending legislative proposal.

DEBARMENT AND SUSPENSION

Instructions for Lower Tier Certification

1. Bidder (hereinafter in this section referred to as the “lower tier participant”), by providing the certification set out below, agrees to comply with the requirements of 2 CFR part 180 and 23 CFR part 1200.

2. The certification in this clause is a material representation of fact upon which reliance is placed if a Contract is awarded. If it is later determined that the lower tier participant knowingly rendered an erroneous certification, in addition to other remedies available to the federal government, the department or agency with which this transaction originated may pursue available remedies, including suspension and/or debarment.

3. The prospective lower tier participant shall provide immediate written notice to the person to which bidder’s bid is submitted if at any time the prospective lower tier participant learns that its certification was erroneous when submitted or has become erroneous by reason of changed circumstances.

4. The terms covered transaction, civil judgement, debarment, suspension, ineligible, participant, person, principal, and voluntarily excluded, as used in this clause, are defined in 2 CFR parts 180 and 1200. You may contact the person to whom this bid is submitted for assistance in obtaining a copy of those regulations.

5. The prospective lower tier participant agrees by submitting its bid that, should the proposed covered transaction be entered into, it shall not knowingly enter into any lower tier covered transaction with a person who is proposed for debarment under 48 CFR Part 9, subpart 9.4, debarred, suspended, declared ineligible, or voluntarily excluded from participation in this covered transaction, unless authorized by the department or agency with which this transaction originated.

6. The lower tier participant further agrees that, if awarded a Contract, it will include the clause titled “Instructions for Lower Tier Certification” including the “Certification Regarding Debarment, Suspension, Ineligibility and Voluntary Exclusion - Lower Tier Covered Transaction,” without modification, in all lower tier covered transactions and in all solicitations for lower tier covered transactions, and will require lower tier participants to comply with 2 CFR part 180 and 23 CFR part 1200.

7. A participant in a covered transaction may rely upon a certification of a prospective participant in a lower tier covered transaction that it is not proposed for debarment under 48 CFR part 9, subpart 9.4, debarred, suspended, ineligible, or voluntarily excluded from the covered transaction, unless it knows that the certification is erroneous. A participant is responsible for ensuring that its principals are not suspended, debarred, or otherwise ineligible to participate in covered transactions. To verify the eligibility of its principals, as well as the eligibility of any prospective lower tier participants, each participant may, but is not required to, check the System for Award Management Exclusions website (https://www.sam.gov/).

8. Nothing contained in the foregoing shall be construed to require establishment of a system of records in order to render in good faith the certification required by this clause.

The knowledge and information of a participant is not required to exceed that which is normally possessed by a prudent person in the ordinary course of business dealings.

9. If a participant in a covered transaction knowingly enters into a lower tier covered transaction with a person who is proposed for debarment under 48 CFR part 9, subpart 9.4, suspended, debarred, ineligible, or voluntarily excluded from participation in this transaction, in addition to other remedies available to the Federal government, the department or agency with which this transaction originated may pursue available remedies, including suspension or debarment.

Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary Exclusion -- Lower Tier Covered Transactions:

1. The prospective lower tier participant certifies, by submission of this proposal, that neither it nor its principals are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction by any federal department or agency.

2. Where the prospective lower tier participant is unable to certify to any of the statements in this certification, such prospective participant shall attach an explanation to this proposal.

BUY AMERICA ACT

The Bidder will comply with the Buy America requirement (23 U.S.C. 313) when purchasing items using federal funds. Buy America requires the Bidder to purchase only steel, iron, and manufactured products produced in the United States, unless the Secretary of Transportation determines that such domestically produced items would be inconsistent with the public interest, that such materials are not reasonably available and of a satisfactory quality, or that inclusion of domestic materials will increase the cost of the overall project contract by more than 25 percent. In order to use federal funds to purchase foreign produced items, the WTSC must submit a waiver request that provides an adequate basis and justification, and which is approved by the Secretary of Transportation.

CERTIFICATION ON CONFLICT OF INTEREST

General Requirements No employee, officer or agent of a State or its subrecipient who is authorized in an official capacity to negotiate, make, accept or approve, or to take part in negotiating, making, accepting or approving any subaward, including contracts or subcontracts, in connection with this grant shall have, directly or indirectly, any financial or personal interest in any such subaward. Such a financial or personal interest would arise when the employee, officer, or agent, any member of his or her immediate family, his or her partner, or an organization which employs or is about to employ any of the parties indicated herein, has a financial or personal interest in or a tangible personal benefit from an entity considered for a subaward. Based on this policy:

1. The recipient shall maintain a written code or standards of conduct that provide for disciplinary actions to be applied for violations of such standards by officers, employees, or agents.

a. The code or standards shall provide that the recipient's officers, employees, or agents may neither solicit nor accept gratuities, favors, or anything of monetary value from present or potential subawardees, including contractors or parties to subcontracts.

b. The code or standards shall establish penalties, sanctions or other disciplinary actions for violations, as permitted by State or local law or regulations.

2. The recipient shall maintain responsibility to enforce the requirements of the written code or standards of conduct.

Disclosure Requirements No State or its subrecipient, including its officers, employees or agents, shall perform or continue to perform under a grant or cooperative agreement, whose objectivity may be impaired because of any related past, present, or currently planned interest, financial or otherwise, in organizations regulated by NHTSA or in organizations whose interests may be substantially affected by NHTSA activities. Based on this policy:

1. The recipient shall disclose any conflict of interest identified as soon as reasonably possible, making an immediate and full disclosure in writing to NHTSA. The disclosure shall include a description of the action which the recipient has taken or proposes to take to avoid or mitigate such conflict.

2. NHTSA will review the disclosure and may require additional relevant information from the recipient. If a conflict of interest is found to exist, NHTSA may (a) terminate the award, or (b) determine that it is otherwise in the best interest of NHTSA to continue the award and include appropriate provisions to mitigate or avoid such conflict.

3. Conflicts of interest that require disclosure include all past, present or currently planned organizational, financial, contractual or other interest(s) with an organization regulated by NHTSA or with an organization whose interests may be substantially affected by NHTSA activities, and which are related to this award. The interest(s) that require disclosure include those of any recipient, affiliate, proposed consultant, proposed subcontractor and key personnel of any of the above. Past interest shall be limited to within one year of the date of award. Key personnel shall include any person owning more than a 20 percent interest in a recipient, and the officers, employees or agents of a recipient who are responsible for making a decision or taking an action under an award where the decision or action can have an economic or other impact on the interests of a regulated or affected organization.

PROHIBITION ON USING GRANT FUNDS TO CHECK FOR HELMET USAGE

The State and each subrecipient will not use 23 U.S.C Chapter 4 grant funds for programs to check helmet usage or to create checkpoints that specifically target motorcyclists.

WTSC Specific Requirements

PUBLICITY

The Bidder agrees to submit to the WTSC all advertising and publicity matters relating to this contract wherein the WTSC’S name is mentioned or language used from which the connection of the WTSC’S name may, in the WTSC’S judgment, be inferred or implied. The Bidder agrees not to publish or use such advertising and publicity matters without the prior written consent of the WTSC.

RIGHT OF INSPECTION

The Bidder shall provide right of access to its facilities to the WTSC, or any of its officers, or to any other authorized agent or official of the state of Washington or the federal government, at all reasonable times, in order to monitor and evaluate performance, compliance, and/or quality assurance under this contract.

The Bidder shall make available information necessary for WTSC to comply with the client's right to access, amend, and receive an accounting of disclosures of their Personal Information according to the Health

Insurance Portability and Accountability Act of 1996 (HIPAA) or any regulations enacted or revised pursuant to the HIPAA provisions and applicable provisions of Washington State law. Bidder shall upon request make available to the WTSC and the U.S. Secretary of the Department of Health & Human Services all internal policies and procedures, books, and records relating to the safeguarding, use, and disclosure of Personal Information obtained or used as a result of this contract.

SITE SECURITY

As applicable, while on WTSC’s premises or while interacting with WTSC’s personnel, Bidder, its agents, employees, or subcontractors shall comply, in all respects, with WTSC’s physical, fire, access, safety, health, and security requirements and not interfere with WTSC’s operations. Bidder represents and warrants that Bidder, its agents, employees, or subcontractors who access WTSC’s premises shall at all times comply with WTSC’s requirements.

TREATMENT OF ASSETS

1. Title to all property furnished by the WTSC shall remain property of the WTSC. Title to all property furnished by the Bidder, for the cost of which the Bidder is entitled to be reimbursed as a direct item of cost under this contract, shall pass to and vest in the WTSC upon delivery of such property by the Bidder. Title to other property, the cost of which is reimbursable to the Bidder under this contract, shall pass to and vest in the WTSC upon (i) issuance for use of such property in the performance of this contract, or (ii) commencement of use of such property in the performance of this contract, or

(iii) reimbursement of the cost thereof by the WTSC in whole or in part, whichever first occurs.

2. Any property of the WTSC furnished to the Bidder shall, unless otherwise provided herein or approved by the WTSC, be used only for the performance of this contract.

3. The Bidder shall be responsible for any loss or damage to property of the WTSC which results from the negligence of the Bidder, or which results from the failure on the part of the Bidder to administer and protect that property in a reasonable manner and to the extent practicable in all instances.

4. If any WTSC property is lost, destroyed, or damaged, the Bidder shall immediately notify the WTSC and shall take all reasonable steps to protect the property from further damage.

5. The Bidder shall surrender to the WTSC all property described in Section 1 of Treatment of Assets prior to settlement upon completion, termination, or cancellation of the Contract.

6. All reference to the Bidder under this clause shall also include Bidder's employees, agents, or Subcontractors.

CONFIDENTIAL INFORMATION; DATA SECURITY; NETWORK ACCESS

(a) CONFIDENTIAL INFORMATION. For purposes of this Contract, “Confidential Information” includes, but is not limited to, information that is deemed confidential under federal or state law, personal information as defined in RCW 42.56.590, as well as any information identified, in writing, by Purchaser as confidential or protected.

(b) PROTECTION OF CONFIDENTIAL INFORMATION. Notwithstanding any provision to the contrary, Bidder’s use of Confidential Information will be in compliance with all applicable state and federal law. At a minimum, Bidder shall maintain records documenting: (i) the Confidential Information received pertaining to this Contract; (ii) the purpose(s) for which the Confidential Information was received; (iii) who received and maintained the Confidential Information; and (iv) final disposition of the Confidential Information. Purchaser reserves the right to monitor, audit, and/or investigate Bidder’s use of Confidential Information used, collected, or acquired by Supplier pursuant to this Contract.

(c) BIDDER OBLIGATION – CONFIDENTIAL INFORMATION. Bidder shall: (i) hold Confidential Information in strictest confidence and not make use of Confidential Information for any purpose other than the performance of this Contract; (ii) release Confidential Information only to authorized employees or agents requiring such information for the purpose of performing this Contract and who have executed an appropriate nondisclosure agreement or data sharing agreement as approved by Purchaser; (iii) implement and maintain physical, electronic, and managerial safeguards to prevent unauthorized access to Confidential Information including, but not limited to, storing Confidential Information on secure servers with access to the data strictly controlled and limited to staff with appropriate training and clearance; and (iv) ensure that all Confidential Information is encrypted in transmission from and to Bidder, at rest in the data base or other data facility maintained or used by Bidder, and when transmitted to authorized recipients.

(d) BIDDER OBLIGATION – DATA SECURITY. If the Contract involves Purchaser’s Data and/or access to Purchaser’s IT network, Bidder, at its expense, will comply with the data security requirements set forth in Attachment XX – Data Security Requirements.

(e) BIDDER OBLIGATION – EXPIRATION OR TERMINATION. Upon expiration or termination of this Purchase Order, Bidder, at Purchaser’s direction, timely will: (i) Certify to Purchaser that all Confidential Information has been destroyed; or (ii) return all Confidential Information to Purchaser; or https://app.leg.wa.gov/RCW/default.aspx?cite=42.56.590

(iii) take whatever other actions Purchaser requires of Bidder to protect such Confidential Information.

(f) NETWORK ACCESS. During its performance of this Contract, Bidder may be granted access to Purchaser’s computer and telecommunication networks (“Networks”). As a condition of Network use, Bidder shall: (a) use the Networks in compliance with all applicable laws, rules, and regulations; (b) use software, protocols, and procedures as directed by Purchaser to access and use the Networks; (c) only access Network locations made available to Bidder by Purchaser;

(d) not interfere with or disrupt other users of the Networks; (e) assure the transmissions over the Networks by Bidder (i) do not contain any libelous, defamatory, profane, offensive, obscene, pornographic, or unlawful material, and (ii) are not used to perform any illegal activities, including but not limited to, encouraging, selling, or soliciting illegal drugs, gambling, pornography, prostitution, robbery, spreading computer worms or viruses, hacking into computer systems, or trafficking credit card codes; and (f) upon termination or expiration of the Contract, relinquish all IP addresses or address blocks assigned to them on the Networks. Additionally, Bidder shall comply with Purchaser’s IT policies.

DATA SECURITY REQUIREMENTS.

(a) SECURITY COMPLIANCE. Bidder is responsible for establishing an information security program and maintaining physical, technical, administrative, and organizational safeguards, that comply with:

(a) applicable industry standards and guidelines; (b) American Institute of Certified Public Accountants (AICPA) System and Organization Controls (SOC) 1; and (c) Washington Technology Solutions Standards (WaTech). See Policy 141.10 – Securing Information Technology Assets Standards

(b) ANNUAL SECURITY CERTIFICATIONS. Bidder will, at the commencement of this Contract and annually thereafter provide WTSC the following reports and certifications: (a) AICPA Statement of Standards for Attestation Engagement (SSAE) No. 18 SOC 1 Type II fiscal year cycle audit report;

(b) SOC 2 Type I report in accordance with AICPA AT 101; and (c) attestation that Bidder’s Services are in compliance with WaTech Security Policy 141.10 – Securing Information Technology Assets Standards. WTSC may accept, at its sole discretion, alterative reports, audits or reporting formats which WTSC determines to be equivalent or better to the reports and certifications described herein.

(c) DATA BREACH. Bidder must have an incident response process that follows National Institute of Standards and Technology (NIST) of Standards and Technology (NIST) standards and includes breach detection, breach notification and breach response. Upon discovery or reasonable belief of any access, destruction, loss, theft, use or disclosure of WTSC’s Data by an unauthorized party (“Data Breach”), Bidder shall notify WTSC by the fastest means available and also in writing. Bidder shall provide such notification within forty-eight (48) hours after Bidder reasonably believes there has been such a Data Breach. Bidder’s notification shall identify:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What Bidder has done or will do to quarantine and mitigate the Data Breach; and

5) What corrective action Bidder has taken or will take to prevent future Data Breaches.

Bidder shall quarantine the Data Breach, ensure secure access to Data, and restore Services as needed to comply with terms and conditions of this Contract. Bidder shall conduct an investigation of the Data Breach and shall share the report of the investigation with WTSC.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwatech.wa.gov%2Fsites%2Fdefault%2Ffiles%2F2023-12%2F141.10_SecuringITAssets_2023_12_Parts_Rescinded.pdf&data=05%7C02%7Cnatalie.lavinsky%40des.wa.gov%7C1e1186d0118a4cbed4dd08dca73e05df%7C11d0e217264e400a8ba057dcc127d72d%7C0%7C0%7C638569133299574088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=dVaTNULZYR0sHU1gJ5ojAor8pWJ5MeizmK%2Bo%2FJB%2Fm4M%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwatech.wa.gov%2Fsites%2Fdefault%2Ffiles%2F2023-12%2F141.10_SecuringITAssets_2023_12_Parts_Rescinded.pdf&data=05%7C02%7Cnatalie.lavinsky%40des.wa.gov%7C1e1186d0118a4cbed4dd08dca73e05df%7C11d0e217264e400a8ba057dcc127d72d%7C0%7C0%7C638569133299574088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=dVaTNULZYR0sHU1gJ5ojAor8pWJ5MeizmK%2Bo%2FJB%2Fm4M%3D&reserved=0

In the event of the Data Breach, Bidder agrees to comply with all applicable state and federal statutory provisions, including but not limited to RCW 19.255.010 and RCW 42.56.590. Where notifications are required to the public or regulators, Bidder shall coordinate and cooperate with

WTSC in the development of a communication plan, and promptly and at no cost, provide advance copies of any notifications for WTSC review before disseminating. If a Data Breach occurs and is found to be the result of Bidder’s acts, omissions or negligence, Bidder shall assume complete responsibility for notification of affected parties, and be liable for all associated costs incurred by WTSC in responding to or recovering from the Data Breach.

(d) TECHNICAL EXAMINATION AND AUDIT. Upon advance written request, Bidder agrees that WTSC or its designated representative shall have reasonable access to Services purchased by WTSC under this contract, its operational documentation, records and databases, including online inspections. The online inspection shall allow WTSC, its authorized agents, or a mutually acceptable third party hired by WTSC, to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans;

2) Web application vulnerability scans;

3) Database application vulnerability scans; and

4) Any other scans to be performed by WTSC or representatives on behalf of WTSC.

Bidder shall allow WTSC reasonable access to Services security logs, latency statistics, and other related Services security data that affect this Contract and WTSC’s Data, at no cost to

WTSC. After any significant Data loss, specific to data stored within the Services platform, or as a result of any disaster or catastrophic failure, Bidder will at its expense have an independent, industry-recognized third party perform an information security audit. This does not apply to data loss resulting from interruptions in the Services stemming from WTSC’s computers, network hardware, internet connectivity, or other elements owned or controlled by WTSC that are reasonably required to use Services. The audit results shall be shared with WTSC within seven (7) days of Bidder’s receipt of such results. Upon Bidder receiving the results of the audit, Bidder will provide WTSC with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.

I hereby certify, under penalty of perjury under the laws of the State of Washington, that the certifications herein are true and correct and that I am duly authorized to make these certifications on behalf of the Bidder listed herein.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapp.leg.wa.gov%2FRCW%2Fdefault.aspx%3Fcite%3D42.56.590&data=05%7C02%7Cnatalie.lavinsky%40des.wa.gov%7C1e1186d0118a4cbed4dd08dca73e05df%7C11d0e217264e400a8ba057dcc127d72d%7C0%7C0%7C638569133299579928%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=C5B%2BPbpMmoQXoZQ8mtTwWnR3XTjUfRcR9N0bRPE3wto%3D&reserved=0

BIDDER NAME: _____________________________________________________

Print Name of Bidder – Print full legal entity name of the firm submitting the Bid

By: ______________________________ Signature of Bidder’s authorized person

Title: ______________________________ Title of person signing certificate

Date: ______________________________

Print Name of person making certifications for Bidder

Place: ________________________________ Print city and state where signed

Return this Exhibit B-3 to the Procurement Coordinator at:

awilliams@wtsc.wa.gov.

mailto:awilliams@wtsc.wa.gov