3-Att B IT Terms and Conditions.docx.docx

ATTACHMENT B: STATE OF UTAH STANDARD INFORMATION TECHNOLOGY TERMS AND CONDITIONS

This is for a contract of information technology products and services and must be accompanied by the State of Utah Standard Terms and Conditions for Goods and Services as Attachment A. In addition to the definitions in this Attachment B, the definitions in Attachment A apply to this attachment. If a term is defined in both Attachment A and Attachment B, the definition in Attachment B will govern. All policies referenced by number in this Attachment B are available at https://dts.utah.gov/policies. Other policies are available upon request.

1. DEFINITIONS:

a. “Access to Secure State Facilities, Data, or Technology” means Contractor will (a) enter upon secure premises controlled, held, leased, or occupied by State of Utah; (b) maintain, develop, or have access to any deployed hardware, software, firmware, or other technology that is in use by State of Utah; or (c) have access to or receive State Data or State confidential information, or both.

b. “Authorized Persons” means the Contractor’s employees, officers, partners, Subcontractors, or agents of Contractor who need Access to Secure State Facilities, Data, or Technology to enable the Contractor to perform its responsibilities under this Contract.

c. “Contract Period” means the term of this Contract, as set forth in the Contract Signature Page(s).

d. “Custom Deliverables” means the product that Contractor is required to design, develop, or customize and deliver to DTS as specifically described under this Contract or an associated statement of work for which all interest and title shall be transferred to and owned by DTS. This includes every invention, design, development, customization, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registrable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor pursuant to this Contract.

e. “Data Breach” means the unauthorized access to or acquisition of State Data that compromises the security, confidentiality, or integrity of State Data.

f. “DTS” means the Utah Department of Government Operations Division of Technology Services.

g. “Federal Criminal Background Check” means a fingerprint-based, nationwide background check conducted and processed by the FBI.

h. “Federal Data” means all information that originated with a federal entity, including federal tax information.

i. “Good” means any deliverable not classified as a Custom Deliverable or Service.

j. “Intellectual Property Rights” means all rights to patents, utility models, mask works, copyrights, trademarks, trade secrets, and other protection afforded by law to inventions, models, designs, technical information, and applications.

k. “Non-Public Data” means records or data that are not subject to distribution to the public. Access is restricted because it includes information that is protected by state or federal law. Non-Public Data includes, but is not limited to, a person’s name; government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information; or Protected Health Information.

l. “Procurement Item” means a Good, a supply, a service, Custom Deliverable, construction, or technology that Contractor is required to deliver to the State of Utah under this Contract, including software and Software as a Service.

m. “Protected Health Information” (PHI) is as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and its implementing regulations.

n. “Security Incident” means the attempted unauthorized access to State Data that may result in the use, disclosure, or theft of State Data. An incident does not include unsuccessful pings and port scans.

o. “Services” means the furnishing of labor, time, or effort by Contractor, and may include installation, configuration, implementation, technical support, warranty maintenance, and other support services.

p. “Single Sign On” means the authentication and authorization system operated by the State of Utah for accessing resources operated either by the State or a third party on behalf of the State.

q. “X [Software, Platform, Infrastructure, Network, etc.] as a Service” means an application running on a Contractor’s or State’s cloud infrastructure, which is accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email), or a program interface. The State does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings

r. “State Data” means Data that is created, controlled, maintained, owned, or in any way originating with or on behalf of the State of Utah, and all data that is the output of computer processing or other electronic manipulation of any data created, controlled, maintained, or in any way originating with the State of Utah, regardless of where such data or output is stored or maintained, including confidential information and Non-Public Data.

s. “Subcontractors” includes contractors, manufacturers, distributors, suppliers, or consultants, at any tier, that are under the direct or indirect control or responsibility of Contractor, including a person or entity that is, or will be, providing goods or performing services pursuant to this Contract.

General Provisions

2. SOVEREIGN IMMUNITY: The State of Utah does not waive any protection, right, defense or immunity under the Governmental Immunity Act of Utah, Utah Code §§ 63G-7-101 to 904, as amended, the Eleventh Amendment to the Constitution of the United States, or otherwise, from any claim or from the jurisdiction of any court.

If a claim must be brought in a federal forum, then it must be brought and adjudicated exclusively within the United States District Court for the District of Utah. This paragraph only applies to a claim brought against DTS or the State of Utah to the extent Congress has abrogated the State of Utah’s sovereign immunity and this paragraph is not consent by DTS or the State of Utah to be sued in federal court.

3. DRUG-FREE WORKPLACE: Contractor shall abide by DTS’s drug-free workplace policies if it has access to Non-Public Data, or while it is on DTS’s or the State of Utah’s premises.

4. CODE OF CONDUCT: If Contractor is working at facilities controlled or owned by DTS or the State of Utah, Contractor shall follow and enforce DTS Policy 2000-0001 Code of Conduct, DTS Policy 1000-0003 Acceptable Use of Information Technology Resources and the agency applicable code of conduct. Contractor will ensure that each employee working at such facilities receives a copy of the policies and applicable codes of conduct.

5. WEBSITE BRANDING: Contractor shall only use the DTS, approved executive branch agency, and/or State of Utah logo on websites produced under terms of this Contract. This provision is separate from and in addition to the publicity clause in the state’s general terms and conditions, such as those contained in Attachment A.

6. CONTRACTOR’S INSURANCE RESPONSIBILITY: The Contractor shall maintain the following insurance coverage:

a. If Procurement Item is Software as a Service, Cyber Security Coverage from an insurance company authorized to do business in the State of Utah. The insurance policy must cover data breach and privacy/cyber liability including technology errors and omissions and professional liability. The limits will be no less than $5,000,000.00 aggregate.

7. RIGHT TO MONITOR PERFORMANCE AND AUDIT

a. Audit: Contractor shall, upon written notification permit DTS, or a third party designated by DTS, to perform an assessment, audit, examination, or review of all of Contractor’s sites and environments related to DTS records or State Data - including physical, technical, and virtual sites and environments - in order to confirm Contractor’s compliance with this Contract; associated scopes of work; and applicable laws, regulations, and industry standards. Contractor shall fully cooperate with such assessment by providing access to knowledgeable personnel; physical premises; records; technical and physical infrastructures; and any other person, place, or object which may assist DTS or its designee in completing such assessment. Upon request, Contractor shall provide the results of any audit performed by or on behalf of Contractor that would assist DTS or its designee in confirming Contractor’s compliance with this Contract; associated scopes of work; and applicable laws, regulations, and industry standards. If Federal Data is involved, this provision may not be waived to restrict Federal audit requirements

b. Monitor Performance: DTS reserves the right to monitor Contractor’s performance, perform plan checks, plan reviews, other reviews, and/or comment upon the Services of Contractor. This includes Contractor’s Subcontractors, if any. Results of any evaluation may be made available to the Contractor upon Contractor’s request.

c. Contract Compliance. Upon DTS’s or the State’s request, Contractor shall return a signed attestation of compliance which will be provided by DTS. Contractor shall return the attestation within 30 days of its receipt of DTS’s or the State’s request to do so. If Contractor's performance involves the payment card industry, Contractor will obtain a third-party PCI compliance report annually and submit the same to the State upon request. In no event shall the PCI compliance report be more than 12 months old at the time it is provided to the State.

8. SURVIVORSHIP: The contractual provisions that will remain in effect after expiration or termination of this Contract are: (a) Secure Protection and Handling of State Data; (b) Data Breach Responsibilities; (c) ownership in Custom Deliverables; (d) ownership, protection, and use of records, including residuals of such records; and (e) Ownership, Protection, and Use of Confidential Federal, Utah, or Local Government Internal Business Processes, including residuals of such confidential business processes; (f) Ownership, Protection, and Return of Documents and Data Upon Contract Termination or Completion; (g) conflict of terms; and (h) any other terms that by their nature would survive the expiration, completion, or termination of this contract.

9. COMPLIANCE WITH ACCESSIBILITY STANDARDS: Contractor shall comply with the Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973. Contractor shall comply with Utah Administrative Code R895-14-3(3), which states that contractors developing websites, hardware, or software for State agencies are required to comply with applicable accessibility guidelines.

10. TIME IS OF THE ESSENCE: The Services shall be completed and Goods and Custom Deliverables delivered by any applicable deadline stated in this Contract. Time is of the essence.

11. STANDARD OF CARE: For Services of Contractor which require licenses and certifications, such Services shall be performed in accordance with the standard of care exercised by licensed members of their respective professions having substantial experience providing similar services which similarities include the type, magnitude, and complexity of the Services that are the subject of this Contract.

12. HARDWARE WARRANTY: THE STATE OF UTAH DOES NOT ACCEPT ANY PROCUREMENT ITEM “AS-IS”. Contractor warrants all hardware portions of any Good or Custom Deliverable that it directly or indirectly provides for a period of one year. All warranties granted to DTS by the uniform commercial code of the state of Utah apply to this contract. Product liability disclaimers and/or warranty disclaimers from contractor or its suppliers are rejected. Contractor warrants that the hardware: (a) will perform as specified in the response; (b) will live up to all specific claims listed in the response; (c) will be suitable for the ordinary purposes for which the hardware is used; (d) will be suitable for any special purposes that DTS has relied on contractor’s skill or judgment to consider when it advised DTS about the hardware in the response; (e) the hardware has been properly designed and manufactured; and (f) is free of significant defects.

13. SOFTWARE WARRANTY: THE STATE OF UTAH DOES NOT ACCEPT ANY PROCUREMENT ITEM “AS-IS”. Contractor warrants for a period of one year from the date of acceptance that the software portions of the Goods and Custom Deliverable, including Software as a Service, that Contractor directly or indirectly provides will: (a) perform in accordance with the specific claims provided in the Response and all specifications and documentation for the software; (b) be suitable for the ordinary purposes for which such goods and custom deliverables are used; (c) be suitable for any special purposes that DTS has relied on Contractor’s skill or judgment to consider when it advised the State about the Goods or Custom Deliverables; (d) have been properly designed and manufactured; and (e) be free of significant defects. Contractor shall provide DTS with bug fixes and inform DTS of any known software bugs or software defects that may affect the state’s use of the software.

14. WARRANTY REMEDIES: Upon breach of the hardware or software warranty, Contractor will promptly repair or replace (at no charge to DTS) the nonconforming Goods or Custom Deliverables. If the repaired and/or replaced products are inadequate, Contractor will refund the full amount of any payments that have been made during the warranty period for the failed products. These remedies are in addition to any other remedies provided by law or equity.

15. DEVELOPMENT, TEST, AND PRODUCTION ENVIRONMENTS: If Goods or Services under this Contract are Contractor-hosted, the Contractor will include three environments throughout the term of the Contract: a development, test, and production environment. Regular refreshes to the database or application or both will be requested. To perform an application refresh, all developers involved in the project, whether from the Contractor or the State, will need to approve in writing the refresh request to prevent any code from being deleted without a prior backup. The cost to configure and maintain these environments is included in the Contract price and will not be charged beyond the amount noted on the Contract Cover Page.

a. If a development or test region is promoted to production, that region must have all of the required security and privacy controls and audit requirements prior to promotion.

b. If the application cannot perform a production refresh after the application is live, then a secondary environment for testing must be created by Contractor.

c. If the Contractor chooses not to provide the three separate environments required by the first paragraph of this section 16, the Contractor must configure the production environment with dummy or test accounts that have the ability to go through the full application process without causing or creating data or cost discrepancies. Additionally, a device or mechanism, such as a feature flag/banner announcement to call out new features to the user, or canary releases to allow for gradual release to smaller sets of users, must be included. Logging must be enabled in order to identify and diagnose issues and to fulfill audit and regulatory requirements, including security frameworks such as NIST and OWASP. A/B testing, automated testing, and incremental rollouts should also be considered and clarified in lettered additions to this Section 16 (e.g. “d,” “e,” etc.). A way of communicating upcoming changes via notification, alerts, emails, and updates must be available. Contractor will make clearly defined fallback strategies and rollback plans available prior to any code promotion.

License and Ownership

16. General License: For any software, including SaaS, delivered that is not considered a Custom Deliverable, Contractor grants DTS a non-exclusive, non-transferable, right to use, without the right to sublicense, such software for DTS’s and the State of Utah’s internal business operation under this Contract. If the software is perpetual, Contractor grants DTS a non-exclusive, non-transferable, irrevocable, perpetual right to use and copy, without the right to sublicense, for DTS’s and the State of Utah’s internal business operation under this Contract.

17. OWNERSHIP AND USE OF RECORDS: DTS and the State of Utah shall own exclusive title to all information and data gathered, reports developed, and conclusions reached by DTS in performance of this Contract. Contractor may not use, except as specified in the SOW, information gathered, reports developed, or conclusions reached by DTS in performance of this Contract without the express written consent of DTS. This includes information in anonymized or aggregated formats.

18. OWNERSHIP AND USE OF DATA: DTS and the State of Utah shall own and retain unlimited rights to use, disclose, or duplicate all information and data (copyrighted or otherwise) specifically developed, derived, documented, stored, or furnished by Contractor for DTS under this Contract. Contractor, and any Subcontractors under its control, expressly agrees not to use Non-Public Data without prior written permission from DTS and appropriate officials of the State of Utah.

19. OWNERSHIP, PROTECTION, AND USE OF CONFIDENTIAL FEDERAL, UTAH, OR LOCAL GOVERNMENT INTERNAL BUSINESS PROCESSES AND PROCEDURES: In the event that DTS provides Contractor with confidential federal or state business processes, policies, procedures, or practices, pursuant to this Contract, Contractor shall hold such information in confidence, in accordance with applicable laws and industry standards of confidentiality, and not copy, reproduce, sell, assign, license, market, transfer, or otherwise dispose of, give, or disclose such information to third parties or use such information for any purpose whatsoever other than the performance of this Contract. The improper use or disclosure by any party of protected internal federal or state business processes, policies, procedures, or practices is prohibited. Confidential federal or state business processes, policies, procedures, or practices shall not be divulged by Contractor or its Subcontractors, except for the performance of this Contract, unless prior written consent has been obtained in advance from DTS.

20. OWNERSHIP, PROTECTION, AND RETURN OF DOCUMENTS AND DATA UPON CONTRACT TERMINATION OR COMPLETION: All documents and data pertaining to work required by this Contract will be the property of DTS and the State of Utah, and must be delivered to DTS upon its request at any time during the Contract Period, as well as within thirty (30) working days after termination or expiration of this Contract, and without restriction or limitation to their future use. Any State Data returned under this section must either be in the format as originally provided, in a format that is readily usable by DTS, or formatted in a way that it can be used. Contractor will pay the costs for returning documents and data to DTS except as specified in this Contract.

Technical Support

21. UPDATES AND UPGRADES: Any upgrades and updates provided by Contractor are subject to the terms of this Contract. If Software is on premises, DTS reserves the right to accept updates and upgrades at its discretion and to determine if such updates comply with the Security requirements in the Contract. Contractor shall keep any applicable hardware, software, middleware, and application plugins up to date and in a state of good repair. All patches, critical vulnerabilities, and/or hardware issues must be addressed based on response times by criticality as laid out in the SOW. If the State hosts the solution, then Contractor may request such maintenance from the DTS hosting team.

22. BUG FIXING AND REMOTE DIAGNOSTICS: Contractor shall use commercially reasonable efforts to provide work-around solutions or patches to reported software problems. If software is on premises, Contractor may perform remote diagnostics to work on reported problems with DTS’s prior written authorization. If DTS declines remote diagnostics, Contractor and DTS may agree to on-site technical support, subject to the terms of the Contract.

23. TECHNICAL SUPPORT AND MAINTENANCE: If technical support and maintenance is required by the Contract, Contractor will use commercially reasonable efforts to respond to DTS in a reasonable time, and in all events, in accordance with the specific timeframes detailed in the Contract, when DTS makes technical support or maintenance requests.

24. ELECTRONIC DELIVERY: Contractor may electronically deliver any Good or Custom Deliverable to DTS or provide any Good and/or Custom Deliverable for download from the Internet. Contractor shall ensure the confidentiality of electronic deliveries in transit. Contractor warrants that all electronic deliveries will be sent with all reasonable security measures in place to ensure deliverable is free of known malware, bugs, Trojan horses, etc.

25. TRANSITION ASSISTANCE: Upon termination or expiration of the Contract, Contractor shall reasonably cooperate with other parties in connection with all Goods and Services to be delivered, including any successor contractor to whom data is transferred. The Contractor shall assist DTS in exporting and extracting data, in a format usable without the use of the Procurement Item and as agreed to between the parties, at no additional cost. Any transition service requested by DTS involving knowledge transfer and support beyond that described in this paragraph prior to this sentence may be subject to a statement of work at Contractor’s then current rates, agreed upon between the Parties and added by amendment to this Contract.

Security

26. CRIMINAL BACKGROUND SCREENING/DRUG TESTING AND SECURITY TRAINING: Each employee of Contractor and Subcontractor who will be granted unescorted Access to Secure State Facilities or State Data, or any Access to Technology must successfully complete a Federal Criminal Background Check, in accordance with DTS Policy 2000-0014 Background Investigations, prior to being granted such Access. Contractor or the applicable employee shall provide DTS with sufficient personal information (at Contractor’s expense) so that a Federal Criminal Background Check may be completed by DTS, at DTS’s expense. DTS will provide Contractor with forms which must be filled out by Contractor and returned to DTS. Each employee of Contractor or a Subcontractor who will have Access to Secure State Facilities, State Data, or Technology must be fingerprinted by DTS or local law enforcement a minimum of one week prior to needing access. At the time of fingerprinting, said employee shall disclose all felony or misdemeanor convictions. DTS will conduct a Federal Criminal Background Check based upon the fingerprints and personal information provided and use this same information to complete a Name Check in the Utah Criminal Justice Information System (UCJIS) at least every two years. Contractor and the employee or subcontractor shall immediately notify DTS if an arrest or conviction for a felony or misdemeanor of any person that has Access to Secure State Facilities, State Data or Technology occurs during the Contract Period. Additionally, each employee, consultant of Contractor, and Subcontractor who will be granted unescorted access to Secure State Facilities, State Data, or Technology must successfully complete a 10-panel drug test at Contractor’s expense with the pass/fail results of the drug test provided to the State of Utah’s hiring manager prior to such access being granted. DTS may revoke Access to Secure State Facilities, Data, and Technology in the event the results of a drug test are positive. DTS will determine in its discretion if such person’s Access to Secure State Facilities, State Data, or Technology shall remain in effect. Contractor’s employees and any Subcontractors who have unescorted Access to Secure State Facilities or to State or Federal Data or any Access to Technology will complete at no additional cost any required security training as requested by the State. Felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred.

27. SECURE PROTECTION AND HANDLING OF STATE DATA: If Contractor is given access to or will be storing State Data, the protection of State Data shall be an integral part of the business activities of Contractor, and Contractor shall ensure that there is no inappropriate or unauthorized use of State Data. Contractor shall safeguard the confidentiality, integrity, and availability of the State Data and comply with the conditions outlined below. DTS reserves the right to verify Contractor’s adherence to the following conditions to ensure they are met:

a. Network Security: Contractor shall maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third-party penetration testing. Contractor shall maintain network security and ensure that Contractor network security policies conform to one of the following:

1) Those standards the State of Utah applies to its own network, found outlined in DTS Policy 5000-0002 Enterprise Information Security Policy, which is based on NIST SP 800-53;

2) The Current standards set forth and maintained by the National Institute of Standards and Technology in SP 800-53 found at https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final; or

3) Any generally recognized comparable standard that Contractor then applies to its own network and pre-approved by DTS in writing.

b. State Data Security: Contractor shall protect and maintain the security of State Data with protection that is at least as good as or better than that maintained by the State of Utah as identified in DTS Policy 5000-0002. These security measures included but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification). Data access must incorporate the principles of test privilege and be physically and technologically controlled. DTS reserves the right to determine if Contractor’s level of protection meets the State’s security requirements.

c. State Data Transmission: Contractor shall ensure all transmission or exchange of system application data with DTS and the State of Utah and/or any other parties expressly designated by the State of Utah, shall be encrypted and take place via secure means (ex. HTTPS or FTPS). Transmission of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x).

d. State Data Storage: All State Data will be stored and maintained in data centers in the United States. State Data is required to be encrypted in transit and at rest. State Data may only be processed on or transferred to Contractor-owned portable or laptop computing device or portable storage medium if such device is whole disk encrypted, or used and kept only at Contractor’s United States data centers, including if such medium is part of the Contractor's designated backup and recovery process. In no case may such devices or State Data leave the United States.

e. Access: Contractor may permit its employees and Subcontractors to remotely access non-State Data as required to provide technical support.

f. State Data Encryption: Contractor shall store all data provided to Contractor, including State Data, as well as any backups made of that data, in encrypted form based on the current TLS standard and include all data as part of a designated backup and recovery process. Encryption of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x).

g. Authentication: Any portable or laptop computer that has access to State of Utah resources shall be equipped with strong and secure password protection. All systems that require authentication must use the Single Sign On solution operated by the State of Utah. This may be accomplished through federation using standard authentication protocols or direct integration into the vendor supplied application. If the Goods or Services, or both, are to be accessed or used by both Internal (state employees, contractors, etc.) and External (public, etc.) users, then the Goods and Services must be able to be integrated with multiple identity providers at the same time.

h. Confidential Information Certification: Contractor may be required to sign a Confidential Information Certification form prior to being given access to certain confidential computerized records, if required by agency or Federal policies.

i. State Data Re-Use: All data exchanged shall be used expressly and solely for the purpose enumerated in this Contract. No State Data of any kind may be transmitted, exchanged, or provided to other contractors or third parties except on a case-by-case basis as specifically agreed to in writing by DTS.

j. State Data Destruction: No sooner than 60 days but no later than 90 days following the expiration or termination of this Contract and only after ensuring compliance with Section 20 (Ownership, Protection, and Return of Documents and Data) of this Attachment B, Contractor shall erase, destroy, and render unreadable all State Data from all non-state computer systems and backups, and certify in writing that these actions have been completed within thirty (30) days of the expiration or termination of this Contract or within seven (7) days of the request of DTS, whichever shall come first, unless DTS provides Contractor with a written directive otherwise. DTS’s written directive may require that certain data be preserved in accordance with applicable law.

k. Services Shall Be Performed Within the United States: ALL OF THE SERVICES REQUIRING ACCESS TO STATE DATA SHALL BE PERFORMED WITHIN THE BORDERS AND JURISDICTION OF THE UNITED STATES.

l. User Support: Contractor is permitted to provide technical user support, subject to 23(k) on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited by this contract.

m. Federal Data Protection: Contractor must store all Federal Data in a manner that, at all times, is physically and electronically secure from access by unauthorized persons. Contractor must employ both physical and technological barriers to prevent unauthorized retrieval of Federal Data via computer, remote terminal, or other means. Federal Data should be subject to separation-of-duties protocols and provided only to those with a need to know.

28. DATA BREACH. In the event of a data breach, liability for notification and remedial costs and damages shall be the responsibility of the Party whose environment was breached.

29. SECURITY INCIDENT OR DATA BREACH NOTIFICATION: As required by Utah Code 13-44-202 or any other law, upon discovery of any Security Incident or Data Breach, Contractor shall provide the notification to DTS in the most expedient time possible without unreasonable delay. It is within DTS’s discretion to determine whether any attempted unauthorized access is a Security Incident or a Data Breach.

a. Incident Response: Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement and seeking external expertise as mutually agreed upon, defined by law, or contained in this Contract. Discussing Security Incidents with DTS should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes, defined by law, or contained in this Contract.

b. Security Incident Reporting Requirements: Contractor shall promptly report a Security Incident to DTS.

c. Breach Reporting Requirements: As required by Utah Code 13-44-202 or any other law, Contractor shall immediately notify DTS of a Data Breach that affects the security of State Data.

30. DATA BREACH RESPONSIBILITIES: Contractor shall comply with all applicable laws that require the notification of individuals in the event of a Data Breach or other events requiring notification in accordance with DTS Policy 5000-0002 Enterprise Information Security Policy. In the event of a Data Breach or other event requiring notification under applicable law (Utah Code § 13-44-101 thru 301 et al), Contractor shall: (a) cooperate with DTS by sharing information relevant to the Data Breach; (b) promptly implement necessary remedial measures, if necessary; and (c) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in relation to the Data Breach. If the Data Breach requires public notification, all communication shall be coordinated with DTS.

31. COMPLIANCE WITH NIST 800.53 If Contractor is developing software for the State or providing Goods or Custom Deliverables or performing Services which have the potential to cause any form of outage or to modify any State of Utah infrastructure, Contractor shall comply with current standards set forth and maintained by the National Institute of Standards and Technology, NIST 800-53 or ISO 27001 and/or FedRamp for cloud solutions, as applicable.

32. USE OF AI OR STATE SUB DOMAIN: Contractor must inform the State of Utah of any generative Artificial Intelligence (“AI”) in the Goods or Services being contracted for prior to providing those Goods or Services to the State. Additionally, Utilization of generative AI in the creation of Goods and Services impacting the State’s Intellectual Property Rights shall include annotations sufficient to comply with DTS POLICY 4000-0008 Enterprise Generative AI Policy.

(Revision Date: 11 January 2024)