4-Attachment-B-Technology-Only-Standard-Terms-and-Conditions.pdf

ATTACHMENT B

SUMMIT COUNTY STANDARD INFORMATION TECHNOLOGY TERMS AND CONDITIONS

This is for a contract of information technology products and services and must be accompanied by the Summit County (“County”) Standard Terms and Conditions for Goods and Services as Attachment A. In addition to the definitions in this Attachment B, the definitions in Attachment A apply to this attachment. If a term is defined in both Attachment A and Attachment B, the definition in Attachment B will govern.

1. DEFINITIONS:

a. “Access to Secure County Facilities, Data, or Technology” means Contractor will (a) enter upon secure premises controlled, held, leased, or occupied by County; (b) maintain, develop, or have access to any deployed hardware, software, firmware, or other technology that is in use by County; or (c) have access to or receive County Data or confidential information.

b. “Authorized Persons” means the Contractor’s employees, officers, partners, Subcontractors, or agents of Contractor who need Access to Secure County Facilities, Data, or Technology to enable the Contractor to perform its responsibilities under this Contract.

c. “Background IP” means intellectual property (IP) owned or controlled prior to the effective date of this Contract or that IP developed or acquired from activities independent of the services performed under this Contract, including but not limited to

(a) methodologies, processes, technologies, algorithms, software, or development tools used in performing the Services, and (b) processes and reusable reports, designs, charts, plans, specifications, documentation, forms, templates, or output which are supplied or otherwise used by or on behalf of Contractor in the course of performing the Services or creating the Custom Deliverables, other than portions that specifically incorporate proprietary or confidential information or Custom Deliverables of the County.

d. “Contract Period” means the term of this Contract, as set forth in the Contract Signature Page(s).

e. “Custom Deliverables” means the product that Contractor is required to design, develop, or customize and deliver to the County as specifically described under this Contract or an associated statement of work for which all interest and title shall be transferred to and owned by the County. This includes every invention, design, development, customization, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor pursuant to this Contract.

f. “Data Breach” means the unauthorized access to or acquisition of County Data that compromises the security, confidentiality, or integrity of County Data.

g. “Federal Criminal Background Check” means a fingerprint-based, nationwide background check conducted and processed by the FBI.

h. “Good” means any deliverable not classified as a Custom Deliverable or Service.

i. “Intellectual Property Rights” means all rights to patents, utility models, mask works, copyrights, trademarks, trade secrets, and other protection afforded by law to inventions, models, designs, technical information, and applications.

j. “Non-Public Data” means records or data that are not subject to distribution to the public. Access is restricted because it includes information that is protected by state or federal law. Non-Public Data includes, but is not limited to, a person’s name; government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information; or Protected Health Information.

k. “Procurement Item” means a Good, a supply, a service, Custom Deliverable, construction, or technology that Contractor is required to deliver to the County under this Contract, including software and Software as a Service.

l. “Protected Health Information” (PHI) is as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and its implementing regulations.

m. “Security Incident” means the attempted unauthorized access to County Data that may result in the use, disclosure, or theft of County Data. An incident does not include unsuccessful pings and port scans.

n. “Services” means the furnishing of labor, time, or effort by Contractor, and may include installation, configuration, implementation, technical support, warranty maintenance, and other support services.

o. “Single Sign On” means the authentication and authorization system operated by the County for accessing resources operated either by the County or a third party on behalf of the County.

p. “Software as a Service (SaaS)” means an application running on a Contractor’s or County’s cloud infrastructure, which is accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email), or a program interface. The County does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings

q. “County Data” means Data that is created, controlled, maintained, owned, or in any way originating with or on behalf of the County, and all data that is the output of computer processing or other electronic manipulation of any data created, controlled, maintained, or in any way originating with the County, regardless of where such data or output is stored or maintained, including confidential information and Non-Public Data.

r. “Subcontractors” includes contractors, manufacturers, distributors, suppliers, or consultants, at any tier, that are under the direct or indirect control or responsibility of Contractor, including a person or entity that is, or will be, providing goods or performing services pursuant to this Contract.

General Provisions

2. SOVEREIGN IMMUNITY: The County does not waive any protection, right, defense or immunity under the Governmental Immunity Act of Utah, Utah Code §§ 63G-7-101 to 904, as amended, or otherwise, from any claim or from the jurisdiction of any court.

If a claim must be brought in a federal forum, then it must be brought and adjudicated exclusively within the United States District Court for the District of Utah. This paragraph is not consent by the County to be sued in federal court.

3. DRUG-FREE WORKPLACE: Contractor shall abide by the County’s drug-free workplace policies while on the County’s premises.

4. WEBSITE BRANDING: Contractor shall only use the Summit County logo on websites produced under terms of this Contract.

5. CONTRACTOR’S INSURANCE RESPONSIBILITY: The Contractor shall maintain the following insurance coverage:

a. If Procurement Item is Software as a Service, Cloud Insurance Coverage from an insurance company authorized to do business in the State of Utah. The insurance policy must cover data breach and privacy/cyber liability including technology errors and omissions and professional liability. The limits will be no less than $5,000,000.00 aggregate.

b. A Certificate of Insurance, showing up-to-date coverage, shall be on file with the County before the Contract may commence. Failure to provide proof of insurance as required will be deemed a material breach of this Contract.

c. Contractor’s failure to maintain this insurance requirement for the Contract Period will be grounds for immediate termination.

6. RIGHT TO MONITOR PERFORMANCE AND AUDIT

a. Audit: Contractor shall, upon written notification permit the County, or a third party designated by the County, to perform an assessment, audit, examination, or review of all of Contractor’s sites and environments related to County records or Data - including physical, technical, and virtual sites and environments - in order to confirm Contractor’s compliance with this Contract; associated scopes of work; and applicable laws, regulations, and industry standards. Contractor shall fully cooperate with such assessment by providing access to knowledgeable personnel; physical premises; records;

technical and physical infrastructures; and any other person, place, or object which may assist the County or its designee in completing such assessment. Upon request, Contractor shall provide the results of any audit performed by or on behalf of Contractor that would assist the County or its designee in confirming Contractor’s compliance with this Contract; associated scopes of work; and applicable laws, regulations, and industry standards. If Federal data is involved, this provision may not be waived to restrict Federal audit requirements

b. Monitor Performance: The County reserves the right to monitor Contractor’s performance, perform plan checks, plan reviews, other reviews, and/or comment upon the Services of Contractor. This includes Contractor’s Subcontractors, if any. Results of any evaluation may be made available to the Contractor upon Contractor’s request.

7. SURVIVORSHIP: The contractual provisions that will remain in effect after expiration or termination of this Contract are: (a) Secure Protection and Handling of County Data; (b) Data Breach Responsibilities; (c) Ownership in Custom Deliverables; (d) Ownership, Protection, and Use of Records, including Residuals of such records; and (e) Ownership, Protection, and Use of Confidential Federal, Utah, or Local Government Internal Business Processes, including residuals of such confidential business processes; (f) Ownership, Protection, and Return of Documents and Data Upon Contract Termination or Completion; (g) Conflict of Terms; and

(h) any other terms that by their nature would survive the expiration, completion, or termination of this contract.

8. Compliance with Accessibility Standards: Contractor shall comply with the Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973.

9. TIME IS OF THE ESSENCE: The Services shall be completed, and Goods and Custom Deliverables delivered by any applicable deadline stated in this Contract. Time is of the essence.

10. STANDARD OF CARE: For Services of Contractor which require licenses and certifications, such Services shall be performed in accordance with the standard of care exercised by licensed members of their respective professions having substantial experience providing similar services which similarities include the type, magnitude, and complexity of the Services that are the subject of this Contract.

11. DATA BREACH. In the event of a data breach, liability for notification and remedial costs and damages shall be the responsibility of the Party whose environment was breached.

12. HARDWARE WARRANTY: SUMMIT COUNTY DOES NOT ACCEPT ANY PROCUREMENT

ITEM “AS-IS”. Contractor warrants all hardware portions of any Good or Custom Deliverable that it directly or indirectly provides for a period of one year. All warranties granted to the County by the uniform commercial code of the State of Utah apply to this contract. Product liability disclaimers and/or warranty disclaimers from contractor or its suppliers are rejected.

Contractor warrants that the hardware: (a) will perform as specified in the response; (b) will live up to all specific claims listed in the response; (c) will be suitable for the ordinary purposes for which the hardware is used; (d) will be suitable for any special purposes that the County has relied on contractor’s skill or judgment to consider when it advised the County about the hardware in the response; (e) the hardware has been properly designed and manufactured;

and (f) is free of significant defects.

13. SOFTWARE WARRANTY: SUMMIT COUNTY DOES NOT ACCEPT ANY PROCUREMENT

ITEM “AS-IS”. Contractor warrants for a period of one year from the date of acceptance that the software portions of the Goods and Custom Deliverable, including Software as a Service, that Contractor directly or indirectly provides will: (a) perform in accordance with the specific claims provided in the response and all specifications and documentation for the software;

(b) be suitable for the ordinary purposes for which such goods and custom deliverables are used; (c) be suitable for any special purposes that the County has relied on contractor’s skill or judgment to consider when it advised the County about the Goods or Custom Deliverables;

(d) have been properly designed and manufactured; and (e) be free of significant defects.

Contractor shall provide the County with bug fixes, including informing the County of any known software bugs or software defects that may affect the County’s use of the software.

14. WARRANTY REMEDIES: Upon breach of the hardware or software warranty, Contractor will repair or replace (at no charge to the County) the nonconforming Goods or Custom Deliverables. If the repaired and/or replaced products are inadequate, Contractor will refund the full amount of any payments that have been made during the warranty period for the failed products. These remedies are in addition to any other remedies provided by law or equity.

License and Ownership

15. General License: For any Software, including SaaS, delivered that is not considered a Custom Deliverable, Contractor grants the County a non-exclusive, non-transferable, right to use, without the right to sublicense, such Software for the County’s internal business operation under this Contract. If the Software is perpetual, Contractor grants the County a non-exclusive, non-transferable, irrevocable, perpetual right to use, copy, and, without the right to sublicense, for the County’s internal business operation under this Contract.

16. OWNERSHIP AND USE OF RECORDS: The County shall own exclusive title to all information and data gathered, reports developed, and conclusions reached by the County in performance of this Contract. Contractor may not use, except in meeting its obligations under this Contract, information gathered, reports developed, or conclusions reached by the County in performance of this Contract without the express written consent of the County.

17. OWNERSHIP AND USE OF DATA: The County shall own and retain unlimited rights to use, disclose, or duplicate all information and data (copyrighted or otherwise) specifically developed, derived, documented, stored, or furnished by Contractor for the County under this Contract. Contractor, and any Subcontractors under its control, expressly agrees not to use Non-Public Data without prior written permission from the County.

18. OWNERSHIP, PROTECTION, AND USE OF CONFIDENTIAL FEDERAL, UTAH, OR LOCAL

GOVERNMENT INTERNAL BUSINESS PROCESSES AND PROCEDURES: In the event that the County provides Contractor with confidential federal, state, or County business processes, policies, procedures, or practices, pursuant to this Contract, Contractor shall hold such information in confidence, in accordance with applicable laws and industry standards of confidentiality, and not copy, reproduce, sell, assign, license, market, transfer, or otherwise dispose of, give, or disclose such information to third parties or use such information for any purpose whatsoever other than the performance of this Contract. The improper use or disclosure by any party of protected internal federal, state, or County business processes, policies, procedures, or practices is prohibited. Confidential federal, state, or County business processes, policies, procedures, or practices shall not be divulged by Contractor or its Subcontractors, except for the performance of this Contract, unless prior written consent has been obtained in advance from the County.

19. OWNERSHIP, PROTECTION, AND RETURN OF DOCUMENTS AND DATA UPON

CONTRACT TERMINATION OR COMPLETION: All documents and data pertaining to work required by this Contract will be the property of the County and must be delivered to the County within thirty (30) working days after termination or expiration of this Contract, and without restriction or limitation to their future use. Any County Data returned under this section must either be in the format as originally provided, in a format that is readily usable by the County or formatted in a way that it can be used. The costs for returning documents and data to the County are included in this Contract.

Technical Support

20. UPDATES AND UPGRADES: Any upgrades and updates provided by Contractor are subject to the terms of this Contract. If Software is on premises, the County reserves the right to accept updates and upgrades at its discretion and to determine if such updates comply with the Security requirements in the Contract.

21. BUG FIXING AND REMOTE DIAGNOSTICS: Contractor shall use commercially reasonable efforts to provide work-around solutions or patches to reported software problems. If Software is on premises, Contractor may perform remote diagnostics to work on reported problems with the County’s prior written authorization. If the County declines remote diagnostics, Contractor and the County may agree to on-site technical support, subject to the terms of the Contract.

22. TECHNICAL SUPPORT AND MAINTENANCE: If technical support and maintenance is required by the Contract, Contractor will use commercially reasonable efforts to respond to the County in a reasonable time, and in all events, in accordance with the specific timeframes detailed in the Contract, when the County makes technical support or maintenance requests.

23. ELECTRONIC DELIVERY: Contractor may electronically deliver any Good or Custom Deliverable to the County or provide any Good and/or Custom Deliverable for download from the Internet. Contractor shall ensure the confidentiality of electronic deliveries in transit.

Contractor warrants that all electronic deliveries will be sent with all reasonable security measures in place to ensure deliverable is free of known malware, bugs, Trojan horses, etc.

24. TRANSITION ASSISTANCE: Upon termination or expiration of Contract, Contractor shall reasonably cooperate with other parties in connection with all Goods and Services to be delivered, including any successor contractor to whom data is transferred. The Contractor shall assist the County in exporting and extracting data, in a format usable without the use of the Procurement Item and as agreed to between the parties, at no additional cost. Any transition service requested by the County involving additional knowledge transfer and support may be subject to a statement of work at Contractor’s then current rates, agreed upon between the Parties and added by amendment to this Contract.

Security

25. CRIMINAL BACKGROUND SCREENING: Each employee of Contractor and Subcontractor who will be granted unescorted Access to Secure County Facilities or unprotected County

Data, or any Access to Technology must successfully complete a Federal Criminal Background Check prior to being granted such Access. Contractor or the applicable employee shall provide the County with sufficient personal information (at Contractor’s expense) so that a Federal Criminal Background Check may be completed by the County, at the County’s expense. The County will provide Contractor with forms which must be filled out by Contractor and returned to the County. Each employee of Contractor or a Subcontractor who will have Access to Secure County Facilities, County Data, or Technology must be fingerprinted by the County or local law enforcement a minimum of one week prior to needing access. At the time of fingerprinting, said employee shall disclose all felony or misdemeanor convictions. the County will conduct a Federal Criminal Background Check based upon the fingerprints and personal information provided and use this same information to complete a Name Check in the Utah Criminal Justice Information System (UCJIS) at least every two years. the County may revoke Access to Secure County Facilities, Data, and Technology granted in the event of any negative results. Contractor and the employee or subcontractor shall immediately notify the County if an arrest or conviction for a felony or misdemeanor of any person that has Access to Secure County Facilities, County Data or Technology occurs during the Contract Period. the County will determine in its discretion if such person’s Access to Secure County Facilities, County Data, or Technology shall remain in effect. Felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred.

26. SECURE PROTECTION AND HANDLING OF COUNTY DATA: If Contractor is given access to or will be storing County Data, the protection of County Data shall be an integral part of the business activities of Contractor, and Contractor shall ensure that there is no inappropriate or unauthorized use of County Data. Contractor shall safeguard the confidentiality, integrity, and availability of the County Data and comply with the conditions outlined below. the County reserves the right to verify Contractor’s adherence to the following conditions to ensure they are met:

a. Network Security: Contractor shall maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third-party penetration testing. Contractor shall maintain network security and ensure that Contractor network security policies conform to one of the following:

2) The Current standards set forth and maintained by the National Institute of Standards and Technology in SP 800-53 found at https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final; or

3) Any generally recognized comparable standard that Contractor then applies to its own network and pre-approved by the County in writing.

b. County Data Security: Contractor shall protect and maintain the security of County Data with protection that is at least as good as or better than that maintained by the County. These security measures included but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification). the County reserves the right to determine if Contractor’s level of protection meets the County’s security requirements.

c. County Data Transmission: Contractor shall ensure all transmission or exchange of system application data with the County and/or any other parties expressly designated by the County, shall be encrypted and take place via secure means (ex. HTTPS or FTPS).

Transmission of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x).

d. County Data Storage: All County Data will be stored and maintained in data centers in the United States. County Data is required to be encrypted in transit and at rest. County Data may only be processed on or transferred to Contractor-owned portable or laptop computing device or portable storage medium if such device is whole disk encrypted or used and kept only at Contractor’s United States data centers, including if such medium is part of the Contractor's designated backup and recovery process. In no case may such devices or County Data leave the United States.

e. Access: Contractor may permit its employees and Subcontractors to remotely access non-County Data as required to provide technical support.

f. County Data Encryption: Contractor shall store all data provided to Contractor, including County, as well as any backups made of that data, in encrypted form based on the current TLS standard and include all data as part of a designated backup and recovery process. Encryption of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x

g. Authentication: Any portable or laptop computer that has access to the County network or stores any non-public County data shall be equipped with strong and secure password protection. All systems that require authentication must use the single sign on solution operated by the County. This may be accomplished through federation using standard authentication protocols or direct integration into the vendor supplied application.

h. Confidential Information Certification: Contractor may be required to sign a Confidential Information Certification form prior to being given access to certain confidential computerized records, if required by agency or Federal policies.

i. County Data Re-Use: All data exchanged shall be used expressly and solely for the purpose enumerated in this Contract. No County Data of any kind may be transmitted, exchanged, or provided to other contractors or third parties except on a case-by-case basis as specifically agreed to in writing by the County.

j. County Data Destruction: Upon expiration or termination of this Contract, Contractor shall erase, destroy, and render unreadable all County Data from all non-County computer systems and backups, and certify in writing that these actions have been completed within thirty (30) days of the expiration or termination of this Contract or within seven (7) days of the request of the County, whichever shall come first, unless the County provides Contractor with a written directive. The County may require that certain data be preserved in accordance with applicable law.

k. Services Shall Be Performed Within United States: ALL OF THE SERVICES REQUIRING

ACCESS TO COUNTY DATA SHALL BE PERFORMED WITHIN THE BORDERS AND

JURISDICTION OF THE UNITED STATES.

l. User Support: Contractor is permitted to provide technical user support, subject to 23(k) on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited by this contract.

27. SECURITY INCIDENT OR DATA BREACH NOTIFICATION: As required by Utah Code 13-44- 202 or any other law, upon discovery of any Security Incident or Data Breach shall provide the notification in the most expedient time possible without unreasonable delay. It is within the County’s discretion to determine whether any attempted unauthorized access is a Security Incident or a Data Breach.

a. Incident Response: Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement and seeking external expertise as mutually agreed upon, defined by law or contained in this Contract.

Discussing Security Incidents with the County should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes, defined by law or contained in this Contract.

b. Security Incident Reporting Requirements: Contractor shall promptly report a Security Incident to the County.

c. Breach Reporting Requirements: As required by Utah Code 13-44-202 or any other law, Contractor shall immediately notify the County of a Data Breach that affects the security of County Data.

28. DATA BREACH RESPONSIBILITIES: Contractor shall comply with all applicable laws that require the notification of individuals in the event of a Data Breach or other events requiring notification. In the event of a Data Breach or other event requiring notification under applicable law (Utah Code § 13-44-101 thru 301 et al), Contractor shall: (a) cooperate with the County by sharing information relevant to the Data Breach; (b) promptly implement necessary remedial measures, if necessary; and (c) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in relation to the Data Breach. If the Data Breach requires public notification, all communication shall be coordinated with the County.

29. COMPLIANCE WITH NIST 800.53 If Contractor is developing software for the County or providing Goods or Custom Deliverables or performing Services which have the potential to cause any form of outage or to modify the County’s infrastructure, Contractor shall comply with current standards set forth and maintained by the National Institute of Standards and Technology, NIST 800-53 or ISO 27001.

(Revision Date: August 1, 2022)