25NS0093_RFP_Primary_Solicitation_Final.pdf

STATE OF CALIFORNIA GAVIN NEWSOM, Governor

PUBLIC UTILTIES COMMISSION

505 VAN NESS AVENUE

SAN FRANCISCO, CA 94102

California Public Utilities Commission (CPUC) Request for Proposal (RFP), Primary Number 25NS0093

For:

Audit Services of Communication Carriers

December 30, 2025

The California Public Utilities Commission (CPUC) invites you to review and respond to this Solicitation. In submitting your response, you must comply with the instructions found herein.

This is an open solicitation for all private entities, universities or governmental agencies.

The Contractor shall conduct audits of revenues required to be remitted to CPUC and of program-related costs and activities for the high-risk utilities identified through a risk assessment methodology. As population of high-risk utilities identified through a risk assessment, it is substantial.

These audits are required pursuant to PU Code section 314.5 which states the Commission shall conduct an audit of every high-risk telephone corporation, as determined by the commission, at least once every 10 years. In addition, PU Code Section 274 requires routine audits of revenues and program-related costs incurred by high-risk communication carriers. Due to extensive statutory requirements and limited dedicated staff resources to complete this work, CPUC is not in compliance with the audit requirements outlined in PU Code sections 274 and 314.5. This is critical to aid the CPUC's compliance with PU Code sections 274 and 314.5 and to provide additional audit oversight over the regulated communication utilities to facilitate CPUC accomplishing its oversight mandate. This RFP will help mitigate CPUC's risk of non-compliance and provide assurances whether utilities use ratepayer funds according to laws and CPUC's requirements.

Before submitting a response to this solicitation, interested parties should read and review the entire solicitation including any attachments, all referenced web addresses, and any regulations, orders, and statutes cited.

Note that all agreements entered into with the State of California will include by reference General Terms and Conditions (GTC 02/2025) and Contractor Certification Clauses (CCC 4/2017) that may be viewed and downloaded at the following internet site:

https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List- Folder/Standard-Contract-Language.

If you do not have Internet access, a hard copy can be provided by contacting the point of contact listed below. By submitting a proposal your firm agrees to the terms and conditions stated in this RFP and the proposed contract.

Any questions regarding the solicitation or terms and conditions of the proposed contract must be submitted by the deadline listed in the key action dates. Terms and conditions will not be negotiated after contract award.

https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List-Folder/Standard-Contract-Language https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List-Folder/Standard-Contract-Language

California Public Utilities Commission RFP Number 25NS0093

Responses are due January 30th, 2026 by 10:00AM Pacific Time.

CPUC Point of Contact:

Tanya Ibarra

Tanya.ibarra@cpuc.ca.gov

TABLE OF CONTENTS

1. SCOPE OF WORK AND CONTRACT TERMS

EXHIBIT A – SCOPE OF WORK

AUDIT OBJECTIVES

TYPES OF PROGRAMS SUBJECT TO AUDIT

TYPES OF ENGAGEMENTS TO BE CONDUCTED

AUDIT AUTHORITY

B. CONTRACTOR QUALIFICATIONS ................ ERROR! BOOKMARK NOT DEFINED.

C. CONTRACT DURATION AND SCOPE

D. TASKS

E. DELIVERABLES

F. ADDITIONAL SERVICES AFTER FINAL REPORTS

G. UARCD/CPUC RESPONSIBILITIES

H. PUBLIC DISCLOSURE

I. CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

EXHIBIT B – BUDGET DETAIL AND PAYMENT PROVISIONS

EXHIBIT C – GENERAL TERMS AND CONDITIONS (GTC 02/2025)

2. MINIMUM QUALIFICATIONS

3. ADMINISTRATIVE INFORMATION

4. SUBMISSION REQUIREMENTS

5. PREFERENCE AND INCENTIVE PROGRAMS

6. EVALUATION CRITERIA AND PROCESS

7. AWARD AND CONTRACT EXECUTION

8. REQUIRED ATTACHMENTS

ATTACHMENT 1 – SOLICITATION CHECKLIST

ATTACHMENT 2 – CONFLICT OF INTEREST STATEMENT

ATTACHMENT 3 – REFERENCES SHEET

ATTACHMENT 4 – PAYEE DATA RECORD

ATTACHMENT 5 – PAYEE DATA RECORD SUPPLEMENT

ATTACHMENT 6 – CONTRACTOR CERTIFICATION CLAUSES

ATTACHMENT 7 – DARFUR CONTRACTING ACT FORM

ATTACHMENT 8 – BIDDER DECLARATION FORM

ATTACHMENT 9 – DVBE DECLARATION FORM

ATTACHMENT 10 – COMMERCIALLY USEFUL FUNCTION CERTIFICATION

ATTACHMENT 11 – IRAN CONTRACTING ACT FORM

ATTACHMENT 12 – CALIFORNIA CIVIL RIGHTS LAW CERTIFICATION

ATTACHMENT 13 – COST SHEET

ATTACHMENT 14 – SAMPLE STANDARD AGREEMENT

1. SCOPE OF WORK AND CONTRACT TERMS

EXHIBIT A – SCOPE OF WORK

A. Background

California Public Utilities Commission’s (CPUC) Utility Audits, Risk and Compliance Division (UARCD) is seeking an outside independent firm (Contractor) to conduct audits of communication carriers and utility companies selected through a risk-assessment process by CPUC of their costs and activities or revenues reported, as stipulated in Public Utilities (PU) Code sections 274 and 314.5. PU Code section 274 states the Commission shall apply a risk-based methodology to conduct audits or reviews of program-related costs and activities or revenues required to be collected. In addition, PU Code section 314.5 states the Commission shall conduct an audit of every high-risk telephone corporation, as determined by the Commission, at least once every 10 years. Contractor must conduct the audits to accomplish specific objectives as discussed and agreed to by the CPUC in accordance with Generally Accepted Government Auditing Standards (GAGAS) issued by the Comptroller General of the United States.

Types of Programs Subject to Audit

The CPUC administers total of six Public Purpose Programs (PPPs) which may be selected for an audit. The list of PPPs under CPUC’s purview is as follows:

• California High-Cost Fund-A (CHCF-A)—provides a source of supplemental revenue to small local exchange carriers for the purpose of minimizing any basic telephone service rate disparity between rural and metropolitan areas.

• California High-Cost Fund-B (CHCF-B)—provides subsidies to carriers of last resort for providing basic local telephone service to residential customers in high-cost areas.

• California LifeLine Program (LifeLine)—provides discounted home phone and cell phone services to qualified households.

• Deaf and Disabled Telecommunications Program (DDTP)—provides devices to deaf or hearing-impaired consumers.

• California Teleconnect Fund (CTF)—provides a 50 percent discount on select communications services to schools, libraries, hospitals, and other non-profit organizations.

• California Advanced Services Fund (CASF)—supports the deployment of broadband facilities and adoption of broadband services in unserved and underserved areas of the state through project specific grant funding.

In addition, utility-reported Surcharges and Revenues might be selected for an audit. Surcharges collected, reported, and remitted by communication carriers provide funding for California’s six PPPs by collecting a flat-rate surcharge per each access line. This surcharge applies to all telephone customers regardless of whether they subscribe to traditional wireline phone (landlines), Voice over Internet Protocol (VoIP) or wireless service.

Audit Objectives The specific audit objectives will depend on the type of program and related costs and activities or revenues reported being evaluated. Examples of the audit objectives include the following:

• California LifeLine Program

To determine whether Utility claims from the California LifeLine Fund for the audit period were accurate, properly supported, for eligible consumers, and allowable costs and activities; and whether Utility applied the applicable California LifeLine discount in accordance with General Order (GO) 153 sections 5 and 9, PU Code section 878, Commission Decisions (D.) 14-01-036 and D. 10-11-033, and other applicable California LifeLine Program’s rules, regulations, and requirements.

• California Teleconnect Fund

To determine whether Utility claims from the California Teleconnect Fund for the audit period were accurate, properly supported, incurred for eligible participants, services, and activities; and Utility applied the applicable California Teleconnect Fund discount to the eligible participants, in accordance with PU Code sections 280 and 884, Commission Decisions (D.) 96-10-066, D.15-07-007, and D.19-04-013, and other applicable California Teleconnect Fund Program’s rules, regulations, and requirements.

• Surcharges and Revenues To determine whether Utility accurately assessed, classified, and reported to CPUC the number of access lines; Utility accurately assessed, collected, and reported to CPUC the Public Purpose Program (PPP) surcharges; and Utility timely reported and remitted PPP surcharges collected to CPUC, for the audit period in accordance with PU Code section 879, Commission Decisions (D.) 22-10-021 and D.98-01-023, and other applicable rules, regulations, and requirements.

Types of Engagements to be Conducted The specific type of engagement to be conducted is examination engagements or performance audits in accordance with either GAGAS attestation standards or GAGAS performance audit standards to accomplish the set audit objectives.

Audit Authority The general audit authority is outlined in the PU Code sections 314.5, 314.6, 581, 582, 584, and more specifically 274. Various relevant CPUC Decisions and regulations can be found at Proceedings and Rulemaking (ca.gov).

B. Contract Duration and Scope

The duration of this contract is to continue for three (3) years commencing the date of the execution of this agreement.

C. Tasks

1. Contractor must conduct the examination engagements or performance audits in accordance with GAGAS (attestation standards or performance audits standards based on the specific type of engagement (examination engagement or performance audit) as deemed necessary and selected by the Contractor and agreed with the CPUC to accomplish the set audit objectives).

2. Contractor is to complete four (4) performance audits or examination engagements in each year, totaling twelve (12) audits for the duration of the contract.

3. The contractor is independent as to where it deems necessary to perform the work, whether at the contractor’s location or visits to carriers or the CPUC as the contractor deems necessary.

4. The contractor will recommend which type of engagement is necessary to meet the set audit objectives. CPUC will make the final determination as to which type of engagement is best to accomplish the set audit objectives. Contractor shall either conduct examination engagements or performance audits.

5. The contractor is responsible for planning and conducting the audits and providing the written reports to UARCD as stipulated in the Deliverables section.

D. Deliverables

1. Audit Plan and Program - Provide an audit plan and program including dates of milestones, adherence to GAGAS attestation or performance standards (such as documenting procedures designed to detect fraud), sampling methodology, and detailed audit procedures to the Contract Manager for approval no later than four (4) weeks after the contract start date. The audit plan and program shall include the following:

a) Detailed description of the Contractor’s approach and methodology for each deliverable.

b) List of major activities, tasks and sub-tasks, and milestones for each Deliverable.

c) Discuss any challenges with meeting the requirements in the scope of work and how the Contractor plans to address these challenges.

d) List of resources and personnel necessary for each deliverable.

2. Monthly Status Reports - Provide the Contract Manager with monthly written progress reports after the start of the audit, updating the status of the audit, achievements/progress made since last progress report, the issues/challenges encountered, potential findings, and the interim period and cumulative actual hours and costs incurred for each audit.

a) Standing Meetings – The Contractor will coordinate and attend twelve project coordination group meetings with the CPUC staff, Contract Manager, and other involved parties on as needed basis to discuss the status of tasks and critical items with CPUC, discuss and vet methodological or data issues, resolve administrative and reporting matters concerning the contract, etc. The update shall include audit progress in relation to the approved audit plan, summary of issues, targets, possible findings, and projected achievements.

3. Draft Audit Reports - Submit an electronic Microsoft word copy of each draft audit report to the Contract Manager for review and approval at least 10 days prior to submitting the draft report to the auditee for comments. Each draft audit report shall include:

a) Transmittal letter

b) An Executive Summary

c) Background Section on the communication carrier and program

d) Audit Objective and Scope

e) Audit Methodology

f) Conclusion or Audit Results Paragraph

g) Follow Up on Prior Audit Findings Paragraph

h) Views of Responsible Officials Paragraph

i) Audit Findings and Recommendations

The Contractor shall issue and submit the first draft audit report to the auditee and UARCD no later than eight (8) months after the contract commencement date.

4. Evaluation of the Carriers/Utilities’ Responses to Draft Audit Reports - Evaluate each of the

Carrier/Utility’s responses, if any, to the draft report and incorporate the Contractor’s evaluation and rebuttals into each final audit report as necessary. Describe modifications made, if any, that are incorporated into the final audit report.

5. Final Audit Reports - Submit an electronic PDF copy of each final audit report to the Contract Manager for review and approval at least 7 days before issuance of the final audit report. Each final audit report shall include:

a) Transmittal letter

b) An Executive Summary

c) Background Section on the communication carrier and program

d) Audit Objective and Scope

e) Audit Methodology

f) Conclusion or Audit Results Paragraph

g) Follow Up on Prior Audit Findings Paragraph

h) Audit Findings and Recommendations

i) Views of Responsible Officials

j) Contractor’s Evaluation of Communication Carrier’s Comments

The Contractor must complete a total of twelve (12) audits of communication carriers and provide twelve (12) final written audit reports by September 30, 2029, (36 months after the commencement of the contract). T h e Contractor must complete no fewer than four (4) audits and issue no fewer than four (4) final audit reports each year for the duration of this three-year contract.

E. Additional Services After Final Reports

The Contract Manager may, at his/her sole discretion, require one or more additional services if Contractor’s audit findings warrant additional resolutions, such as resolving disputes with audited utilities or responding to inquiries from Commissioners or Contract Manager. For each additional service required by the Contract Manager, Contract Manager will provide a minimum of five (5) business day advance notice to the Contractor.

Additional services are for services after the issuance of the final audit/examination report, including:

• Conducting post audit work, if necessary, due to changed circumstances

• Participating in special meetings with decision-makers and stakeholders

• Testifying as an expert witness in hearings

• Responding to questions and disputes from audited entities

• Meeting with audited entities’ and/or CPUC legal staff

• Providing copies of records supporting audit findings

Upon Contract Manager’s request, Contractor is required to submit its work plan of additional services, which includes detailed tasks and procedures to accomplish the additional services, estimated time spent on each task and/or procedure, total estimated time to complete each additional service, and dates of milestones, to the Contract Manager for its approval by the due date agreed upon by both the Contract Manager and the Contractor.

F. Deliverable Format

All draft written deliverables shall be provided electronically in Microsoft Word format and e-mailed to the CPUC Contract Manager. All final written deliverables shall be provided electronically in PDF format and e-mailed to the CPUC Contract Manager.

G. UARCD/CPUC Responsibilities

1. UARCD will provide access to business and technical documents as necessary for the contractor to complete the tasks identified in the department’s purchase document or contract.

2. UARCD shall select the specific communication carrier along with communication carriers’ related program to be audited, or revenues reported to be audited based on a risk assessment process determined by the CPUC. The audits are to ensure that program related costs and activities or revenues reported are in compliance with all applicable laws and CPUC regulations.

3. It shall be the State’s sole determination as to whether a deliverable has been successfully completed and acceptable to the State. There must be a signed acceptance document for each deliverable before invoices can be processed for payment.

4. Acceptance criteria shall consist of the following:

Reports on written deliverables are completed as specified and approved.

If a deliverable is not accepted, the State shall provide the rationale in writing within seven

(7) days of receipt of the deliverable or upon completion of acceptance testing period.”

H. Public Disclosure

The information submitted by each utility selected for audit to the Contractor during the audit will be subject to public disclosure unless the audited entity complies with the specific requirements set forth in General Order (GO) 66-D, including but not limited to submitting a signed declaration explaining the specific legal authority and facts justifying confidential treatment of the specific information submitted. Supporting documents submitted with any claim of confidentiality must include both: (a) a “Confidential version” with the alleged confidential information highlighted and (b) a “Public version” with the alleged confidential information redacted.

All final reports produced by the Contractor will be posted to the CPUC public website.

I. Confidentiality and Non-Disclosure Agreement

The Contractor will be required to sign a non-disclosure agreement.

EXHIBIT B – BUDGET DETAIL AND PAYMENT PROVISIONS

1. Invoicing and Payment

A. Payments

As compensation for the services specified in Exhibit A and upon receipt and approval of Contractor invoices by the CPUC, the Contractor shall be entitled to a sum not to exceed the total dollar amount noted on the STD 213 and/or its Amendment. Payments shall be deliverable based on the price set forth and specified in Exhibit B-1, Cost Sheet which is attached hereto and made a part of this Agreement.

If Contractor discovers it has received an overpayment, Contractor must notify the State and refund the overpayment immediately.

B. Invoice Details

Each invoice shall include the following details:

I. Contract Number II. Contractor Name

III. Contractor Billing Address IV. Itemized Cost Per Deliverable V. A Summary of each Deliverable worked on including the Names and

Number of Hours worked by each Team Member.

VI. Total Invoice Amount

VII. Invoice Number VIII. Invoice Date

IX. Service Date(s) X. Contact Information

XI. Retention Amount to be Withheld XII. SB/DVBE Certification Number [if applicable]

Any invoiced items which are not included in the accepted Cost Sheet, will automatically be rejected, and denied for payment.

Should an invoice be disputed, Contractor will correct any/all disputed items on the invoice and resubmit the invoice as indicated above. Failure to provide and resubmit corrected invoice will result in a delay of payment.

C. Invoice Submission

Contractor shall submit the invoice in duplicate (including original invoice) not more frequently than monthly in arrears to:

APInvoice@cpuc.ca.gov

OR

mailto:APInvoice@cpuc.ca.gov

Fiscal Office, Room 3000 505 Van Ness Avenue

San Francisco, CA 94102 ATTN: Account Payable Technician

D. Travel

Travel costs will not be reimbursed by CPUC separately. Contractor’s rates shall include all travel expenses required to perform the services in accordance with this Agreement.

E. Reporting Requirement of Small Business and DVBE Subcontractors

The Contractor invoices shall include a subtotal that enumerates the amounts spent on DGS certified Small Business and DGS certified DVBE subcontractors for the period of the invoice, and a total-to-date for Small Business and DVBE spending. This requirement is in addition to reporting requirement of Section 19 of Exhibit C, General Terms and Conditions.

Pursuant to Mil. & Vet. Code Section 999.7, ten thousand dollars ($10,000) will be withheld from the final payment, or the full final payment if less than ten thousand dollars ($10,000), until the prime contractor complies with the certification requirements of subdivision (d) of Mil. & Vet. Code Section 999.5. This requires the Prime contractor to fill out and submit a STD 817 form certifying the actual amount paid to DVBE subcontractors. Prime contractor shall be given 30 days’ notice to cure the defect. If, after 30 calendar days from the date of notice, the prime contractor refuses to comply with the certification requirements, CPUC shall permanently deduct ten thousand dollars ($10,000) from the final payment, or the full payment if less than ten thousand dollars ($10,000).

F. Retention of Records and Audit Requirement

The Contractor’s invoices will be subject to a financial audit by CPUC at any time within three (3) years of completion of the work.

2. Budget Contingency Clause

A. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, the CPUC shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

B. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the CPUC shall have the option to either cancel this Agreement with no liability occurring to the CPUC or offer an agreement amendment to Contractor to reflect the reduced amount.

3. Prompt Payment Clause

Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927.

EXHIBIT C – GENERAL TERMS AND CONDITIONS (GTC 02/2025)

The General Terms and Conditions, GTC 02/2025 will be included and adhere to in the Agreement by reference to the following link:

https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List- Folder/Standard-Contract-Language

If Contractor does not have Internet access, a hard copy will be provided by contacting the State’s Contract Manager listed in the Scope of Work.

https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List-Folder/Standard-Contract-Language https://www.dgs.ca.gov/OLS/Resources/Page-Content/Office-of-Legal-Services-Resources-List-Folder/Standard-Contract-Language

EXHIBIT D, SPECIAL TERMS AND CONDITIONS

1. Excise Tax

The State of California is exempt from federal excise taxes, and no payment will be made for any taxes levied on employees' wages. The State will pay for any applicable State of California or local sales or use taxes on the services rendered or equipment or parts supplied pursuant to this Agreement. California may pay any applicable sales and use tax imposed by another state.

2. Dispute Resolution

A dispute for purposes of this section is a disagreement between Contractor and CPUC in the performance of the Agreement, which is unable to be resolved between Contractor and Program Staff (“Dispute”). In the event of a Dispute, Contractor shall file a "Notice of Dispute" with the California Public Utilities Commission, Executive Director, or designee within ten (10) days of discovery of the problem. Within ten (10) days, the Executive Director or designee shall meet with the Contractor and Contract Manager for purposes of resolving the dispute. The decision of the Executive Director or designee shall be final.

In the event of a dispute, the language contained within this Agreement shall control over any other.

State reserves the right to issue an order to stop work in the event that a dispute should arise, The stop work order will be in effect until the dispute has been resolved.

3. Subcontracts

A. No work shall be subcontracted without the prior approval of the State’s Contract Manager.

Upon termination of any subcontract, the State shall be notified immediately.

B. If the terminated subcontractor is a DVBE, the contractor must replace that subcontractor with another DVBE subcontractor, and such replacement must be approved by the Commission. Failure to adhere to DVBE Participation will be reported to DGS DVBE program for possible enforcement action, including without limitation be cause for contract termination and recovery of damages under the rights and remedies due the state under the default section of the contract.

C. Nothing contained in this Agreement or otherwise, shall create any contractual relation between the State and any subcontractors, and no subcontract shall relieve the Contractor of his responsibilities and obligations hereunder. The Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by the Contractor. The Contractor's obligation to pay its subcontractors is an independent obligation from the State's obligation to make payments to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor.

D. It is the intention of the parties than no subcontractors shall be deemed an employee of the State. Contractor agrees to take any and all actions necessary to comply with this intention.

E. Failure of a subcontractor to perform for any reason shall not relieve Contractor of the responsibility for competent and timely performance of duties under this contract.

4. Commission Staff

Commission staff will be permitted to work side by side with Contractor’s staff to the extent and under conditions directed by the Commission’s Contract Manager. In this connection, Commission staff will be given access to all data, working papers, etc., which Contractor may seek to utilize.

Contractor will not be permitted to use State personnel for the performance of services which are the responsibility of Contractor.

5. Commencement of Work

Performance will start not later than five (5) business days, or on the express date set by the State and the Contractor, after all approvals have been obtained and the agreement is fully executed. Should the Contractor fail to commence work at the agreed upon time, the State upon five (5) days written notice to the Contractor, reserves the right to terminate the agreement. In addition, the Contractor will be liable to the State for the difference between Contractor's bid price and the actual cost of performing work by another contractor.

6. Ownership of Data

Data developed for this contract shall become the property of the State. Contractor shall not disclose data without the permission of the Commission’s Contract Manager. Each report shall also become the property of the State and shall not be disclosed except in such manner and such time as the Commission’s Contract Manager may direct, with the exception of data which have become part of the public records of the State, as discussed in section 8.

7. Confidentiality and Data Safeguards

DEFINITIONS:

7.1 Confidential Information means any non-public information, whether in written, oral, graphic, electronic or any other form, including without limitation, unpublished financial information, state plans and practices, and projections, and marketing data, business, financial, technical information, user manuals, forecasts, analyses, software and processes, or information which would be deemed by a reasonable person to be confidential or proprietary in nature.

Confidential Information also means an individual’s health, genetic or biometric information, race, ethnic origin, sexual orientation, religious or political, beliefs/affiliation, or criminal record.

The contracting state agency may also designate information as “Confidential” or “Proprietary.”

7.2 Personal Information as set forth in Civil Code section 1798.3, subdivision (a) of the California Information Practices Act (§1798 et. seq) means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, their name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual.

7.3 State Data means all information and data owned by the State and submitted to, processed by, or stored by the Contractor and includes, but is not limited to, all data/information that originated with the State, all data/information provided by the State, and data/information generated, manipulated, produced, reported by or otherwise emanating from or by applications run by the State. State Data encompasses Confidential Information and Personal Information.

7.4 Security Incident means any actual or suspected unauthorized access, destruction, loss, theft, use, modification, or disclosure of State Data.

DATA PRIVACY AND CONFIDENTIALITY:

7.5 Contractor shall not collect, use, retain, disclose, sell or otherwise make use of State Data for Contractor’s own commercial purposes or in a way that does not comply with the purpose of this Contract or applicable law. If an applicable law requires Contractor to disclose State Data, the Contactor must first inform the State of the legal requirement and give State an opportunity to object or challenge the requirement, unless the applicable law prohibits such notice.

7.6 Contractor shall ensure confidentiality and security of State Data. Contractor shall ensure that all its personnel as well as personnel of its subcontractors with access to State Data comply with security and confidentiality obligations set forth in the Contract.

7.7 Contractor will not disclose State Data or allow access to such information to any third party without the State’s prior written consent; provided, however, that Contractor may disclose State Data to its affiliates and subcontractors for purposes of providing the services to the State under this Contract. Contractor will be liable for all actions by the subcontractor related to the use, processing and/or disclosure of State Data.

7.8 Contractor will return or render permanently unreadable and unrecoverable all State Data at the end of this Contract or upon the State’s written request unless State Data must be retained by Contractor to comply with applicable laws. Erasure or destruction of all State Data in Contractor’s possession shall be in accordance with State’s standard for data destruction, which State shall provide to Contractor. If requested, Contractor shall provide certification of destruction to State.

DATA PROTECTION:

7.9 Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards in accordance with applicable laws, policies, and regulations at all times during the Contract term to protect State Data, systems, and services, from unauthorized or unlawful use, access, modification, disclosure or destruction, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts.

7.10 Unless otherwise specified in the Contract or Statement of Work, upon discovery or reasonable belief of any Security Incident, Contractor shall notify the State in writing by the fastest means available, in no event greater than 48 hours after such discovery or belief.

Contractor’s notification shall identify, to the full extent known to Contractor:

a. The nature of the Security Incident;

b. The State Data improperly accessed, used, or disclosed;

c. The individual records improperly accessed, used, or disclosed if Confidential

Information or Personal Information is involved;

d. The person(s) who improperly accessed, used, disclosed or received State Data;

e. What Contractor has done or will do to quarantine and remediate the Security Incident;

and

f. What corrective action(s) Contractor has taken or will take to prevent future Security

Incidents.

7.11 Contractor shall take prompt corrective action to mitigate any risks or damages involved with the Security Incident.

7.12 If Contractor experiences a Security Incident, the State shall determine whether notification to any individuals whose State Data has been improperly accessed, lost or breached is appropriate. If Confidential Information or Personal Information is reasonably believed to have been improperly accessed or acquired by an unauthorized person as a result of a Security Incident that is not due to the fault of the State or any person or entity under the control of the State, Contractor shall bear any and all costs associated with the State’s notification obligations as required by all applicable laws and regulations, as well as the cost of credit monitoring.

Contractor shall immediately investigate the Security Incident and shall share the investigation report with the State. The State or its authorized agents reserve the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the State, its agents, and law enforcement.

7.13 If the State determines that the data loss or Security Incident is significant, at the discretion of the State, Contractor will, at its expense, have an independent, industry-recognized, State-approved third party perform an information security audit. Contractor shall immediately share the audit results with the State upon Contractor’s receipt of such results. Contractor will provide the State with written evidence of planned remediation within thirty (30) days from receipt of the audit results and promptly modify its security measures.

SURVIVAL:

7.14 These privacy, confidentiality, and protection obligations of Contractor, its, agents, successors, and/or assigns, continues for so long as Contractor has access to State Data, including required retention or storage timeframes after Contract termination or expiration.

The Contractor, by signing this agreement recognizes they may be required to have access to data, information and documents within the knowledge and possession of various entities under the regulatory jurisdiction of the Commission. The Contractor recognizes that some of this data, information and documents may be proprietary, confidential, or privileged in nature.

8. Non-Disclosure

The requirements of this Section are in addition to, not in substitution of any separate Non- Disclosure Agreement or similar agreement which may be required by Commission Staff prior to accessing CPUC data, information, or documents.

The Contractor further recognizes that Commission Staff has broad statutory authority to compel the production of such information subject to the provisions of Public Utilities Code 583 and General Order 66-D. The Contractor understands that these legal provisions generally preclude public disclosure of information obtained in confidence except during the course of a public hearing or with permission of the Commission.

The Contractor acknowledges that it has received read Public Utilities Code Section 583 and General Order 66-D and agrees to be subject to and to fully comply with these legal provisions https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=583.&lawCode=PUC https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=583.&lawCode=PUC https://www.cpuc.ca.gov/-/media/cpuc-website/proceedings-and-rulemaking/documents/d-2109020-correcting-d-2008031-go-66d.pdf in discharging its responsibilities. Such compliance includes abiding by the terms of prohibiting public disclosure of confidential information and submitting to the jurisdiction of the Commission for the purposes of enforcing Public Utilities Code Section 583.

The Contractor further recognizes that the data, information and documents obtained during the course of its work for the Commission may be subject to other requirements for nondisclosure which include, but are not limited to, attorney work product privilege, the official information privilege, the attorney-client privilege, and other prohibitions precluding disclosure of confidential information and Contractor may not disclose such data, information and documents without the prior written consent of the Commission or its Staff..

The Contractor agrees not to disclose any information regarding its work to third parties except with the Commission Staff’s express prior written consent, and to return all data, information and documents obtained during the course of the Agreement immediately upon request or termination. The Contractor agrees to immediately notify the Commission Staff of any inquiries from third parties which request disclosure of any data, information, or documents.

The Contractor will not comment publicly to the press or any other media regarding its work, or the Commission’s action on the same, except to the Commission Staff, Signatory’s own personnel and/or subcontractors involved in the completion of tasks under this agreement, or at a public hearing, or in response to questions from a legislative committee.

In addition, the Signatory agrees that prior to commencement of any work associated with this Agreement, the signatory shall: (1) provide a copy of this section of the Agreement, Public Utilities Code Section 583 and General Order 66-D to all who will be performing tasks under this Agreement; and (2) inform all those working under this Agreement that they are bound by these legal provisions and must comply with the Confidentiality of Data Agreement/Nondisclosure Section.

Ninety days after any document submitted has become a part of the public records of the State, Contractor may at its own expense, publish or utilize the same but shall include the following legend:

LEGAL NOTICE

This report was prepared as an account of work sponsored by the California Public Utilities Commission. It does not necessarily represent the views of the Commission or any of its employees except to the extent, if any, that it has formally been approved by the Commission at a public meeting. For information regarding any such action, communicate directly with the Commission at 505 Van Ness Avenue, San Francisco, California 94102. Neither the Commission nor the State of California, nor any officer, employee, or any of its contractors or subcontractors makes any warranty, express or implied, or assumes any legal liability whatsoever for the contents of this document.

9. Termination for Convenience

State may at its option terminate this contract, with or without cause, at any time upon giving thirty (30) days’ notice in writing to Contractor. In such event, Contractor agrees to adhere to the instructions provided in such termination notice, including immediately stopping work, and to use all reasonable efforts to mitigate its expenses and obligations hereunder. In such event, State shall pay Contractor for all services satisfactorily rendered prior to such notice of termination and for all reasonable expenses incurred by Contractor prior to said termination which are not included in charges for service rendered prior to termination and which could not by reasonable efforts of Contractor have been avoided.

10. Termination in Event of Breach

In the event of any breach of this contract after notice and failure to cure a default, the State may without any prejudices to any of its other legal remedies terminate this contract upon five days’ written notice to the Contractor.

11. Waiver

No waiver of any breach of this contract shall be held to be a waiver of any other or subsequent breach. All remedies afforded in this contract shall be taken and construed as cumulative: that is, in addition to every other remedy provided herein or by law. The failure of State to enforce at any time any of the provisions of this agreement, or to require at any time performance by Contractor of any of the provisions thereof, shall in no way be construed to be a waiver of such provision nor in any way to affect the validity of this agreement or any part thereof or the right of State to thereafter enforce each and every such provision.

12. Gratuities

A. The State may, by written notice to the Contractor, terminate the right of Contractor to proceed under this contract if it is found, after notice and hearing by the State or by Executive Director of the Public Utilities Commission or duly authorized representative, that gratuities were offered or given by the Contractor, or any agent or representative of the Contractor, to any officer or employee of the State with a view toward securing a contract, securing favorable treatment with respect to award amendment, or the evaluation of performance of such contract, provided that the facts upon which either the Commission or the Executive Director makes such findings may be reviewed in any competent court.

B. In the event this contract is terminated, State shall be entitled (i) to pursue the same remedies against Contractor as it could pursue in the event of the breach of the contract by the Contractor, and (ii) to a penalty in addition to any other damages to which it may be entitled by law, and to exemplary damages in an amount which shall be not less than three nor more than ten times the cost incurred by the Contractor in providing any such gratuities to any such officer or employee.

The rights and remedies of State provided in this clause shall not be exclusive and are in addition to any other rights and remedies provided by law or under this contract.

13. Conflict of Interest

Contractor agrees to refrain from entering into any relationship which could result in a conflict of interest in the performance of this Agreement; and to notify the Commission’s Contract

Manager promptly of any potential conflict of interest, including subcontractors. The Commission may exercise its option to terminate this Agreement if a conflict is found.

14. Complete Agreement

Other than as specified herein, no document or communication passing between the parties hereto shall be deemed a part of this Agreement.

15. Captions

The clause headings appearing in this agreement have been inserted for the purpose of convenience and ready reference. They do not purport to and shall not be deemed to define, limit, or extend the scope or intent to the clauses to which they appertain.

16. Force Majeure

Neither party shall be liable to the other for any delay in or failure of performance, nor shall any such delay in or failure of performance constitutes default, if such delay or failure is caused by “Force Majeure.” As used in this section, “Force Majeure” is defined as follows: Acts of war and acts of god such as earthquakes, floods, and other natural disasters such that performance is impossible.

17. Tax Delinquencies

Public Contract Code Section 10295.4 provides that a State agency shall not enter into any contract for goods or services with a contractor whose name appears on either list of the 500 largest tax delinquencies pursuant to Section 7063 or 19195 of the Revenue and Taxation Code.

Franchise Tax Board (FTB) and California Department of Tax and Fee Administration (CDTFA) will post and periodically update lists of the 500 largest tax delinquencies on their websites as required by law. If the Commission determines that the Contractor or any of its subcontractors are on either the FTB or CDTFA list at any time before or during the contract term, this will be grounds for termination of the contract.

18. Registration with Secretary of State

All business entities doing business within the State must be admitted and registered with the State of California Secretary of State and maintain applicable State of California licenses as required by law. All businesses who do not possess active State of California licenses required to perform the contract services in the scope of work, or who are not admitted or registered with the Secretary of State as required by law during the Agreement term may have their Agreement terminated at the discretion of the Commission.

19. Amendments

A. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, signed by the parties, and approved as required. No oral understanding or agreement not incorporated in this Agreement is binding on any of the parties.

B. CPUC reserves the right to amend this Agreement through a formal written amendment, signed by the parties, for additional time and/or funding.

20. Insurance Requirements

Upon notice of intent to award, the Contractor shall have 10 business days to furnish to the State certificate(s) of insurance and endorsement(s) evidencing that the contractor has met all the insurance requirements outlined below. All coverage shall be maintained in force throughout the contract term.

A. Workers Compensation and Employers Liability

By signing this Agreement, the Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of the Contract. Employer’s liability limits of $1,000,000 are required. The insurer waives any right of recovery the insurer may have against the State because of payments the insurer makes for injury or damage arising out of the work done under contract/permit with the State. A Waiver of Subrogation or Right to Recover endorsement in favor of the State must be attached to the certificate.

B. Commercial General Liability By signing this Agreement, the Contractor shall maintain general liability on an occurrence form with limits not less than $1,000,000 per occurrence and $2,000,000 aggregate for bodily injury and property damage liability. The policy shall include coverage for liabilities arising out of premises, operations, independent contractors, products, completed operations, personal and advertising injury, and liability assumed under an insured Agreement. This insurance shall apply separately to each insured against which claim is made, or suit is brought subject to the Contractor's limit of liability.

C. Professional Liability By signing this Agreement, the Contractor and any subcontractors shall maintain Professional Liability Insurance for damages caused by an error, omission, or any negligent acts in the amount of $1,000,000 per claim, $3,000,000 in the aggregate.

D. General Provisions Applying to All Policies

1. Coverage Term – Coverage needs to be in force for the complete term of the contract. If insurance is set to expire during the term of the contract, a new certificate must be received by the day the new policy goes into effect. Any new insurance must still comply with the original terms of the contract.

2. Policy Cancellation or Termination & Notice of Non-Renewal – Contractor and/or Permittee is responsible to notify the State within five business days before the effective date of any cancellation, non-renewal, or material change that affects required insurance coverage. In the event Contractor and/or Permittee fails to keep in effect at all times the specified insurance coverage, the State may, in addition to any other remedies it may have, terminate this Contract upon the occurrence of such event, subject to the provisions of this Contract.

3. Deductible – Contractor and/or Permittee is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause – Commercial General Liability insurance contained in this contract shall be primary, and not excess or contributory, to any other insurance carried by the State.

5. Insurance Carrier Required Rating – All insurance companies must carry a rating acceptable to the Office of Risk and Insurance Management. If the Contractor and/or Permittee is self-insured for a portion or all of its insurance, review of financial information may be required.

6. Endorsements – Any required endorsements requested by the State must be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

7. Inadequate Insurance – Inadequate or lack of insurance does not negate the contractor and/or Permittee’s obligations under the contract.

8. Available Coverages/Limits - All coverage and limits available to the contractor shall also be available and applicable to the State subject to the types of insurance and coverage limits listed above.

9. Subcontractors - In the case of Contractor and/or Permittee’s utilization of subcontractors to complete the contracted scope of work, contractor and/or Permittee shall include all subcontractors as insured under Contractor and/or Permittee’s insurance or supply evidence of insurance to The State equal to policies, coverages and limits required of Contractor and/or Permittee.

E. The certificate of insurance must include the following provisions:

• The California Public Utilities Commission must be listed as the “Certificate Holder” and list the following:

State of California California Public Utilities Commission Administrative Services Division, Management Services Branch 505 Van Ness Avenue San Francisco, CA 94102

• The State of California, its officers, employees, and servants are hereby listed as additional insured under Commercial General Liability but only with respect to work performed for the…