40DHHS-S3926-Data Use and Cloud Service Agreement 2026 AVS RFP Attachment.docx

Cloud Service & Web Service Requirements and Data Use Agreement for the Division of Social Services (DSS) THIS ATTACHMENT IS A SEPARATE AGREEMENT IN CONNECTION WITH THE MAIN CONTRACT BETWEEN: THE STATE of NEVADA, DIVISION OF SOCIAL SERVICES (DSS) AND CONTRACTOR.

This Cloud Service & Web Service AND Data Use Agreement (“CSWS-DUA”) is effective as of the date of the Contract into which it is incorporated (“Effective Date”), by and between the DSS and Contractor.

Purpose and Order of Precedence: The purpose of this CSWS-DUA is to facilitate access to, maintenance, storage, processing, , or transmission of any information/data with Contractor, and describe Contractor’s rights and obligations with respect to any information/data and the limited purposes for which the Contractor may receive, maintain, store, process, or have access to this information/data. As of the Effective Date of this CSWS-DUA, if any provision of the Contract conflicts with this CSWS-DUA, this attachment holds authority. All standards contained within will be updated periodically, as State, Federal, and industry security standards change.

1. With respect to ALL information/data, Contractor shall:

A. The Contractor shall manage and control all information/data in strict compliance with all applicable State and Federal governing standards and documents. The Contractor shall access, create, maintain, receive, process, transmit or destroy all information/data in a secure manner that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses or disclosures. Contractor shall strictly adhere to the process and protocols for handling information/data as described in this agreement and listed below, including any subsequent updates or amendments.

B. Implement, update, and document privacy, security and breach notice policies and procedures.

C. Create a communication plan for any PII/FTI breaches or security incidents.

D. Have and make available a cybersecurity incident response plan prior to conducting work under the Contract and upon request.

E. Certify persons with access to the information/data each have a demonstrated need to know and have access to information/data solely to the minimum extent necessary to accomplish the required tasks in this contract and all the certified persons have agreed in writing to be bound by the disclosure and use limitations pertaining to the information/data contained in this CSWS-DUA.

F. Contractor and its subcontractors shall always maintain an accurate list of individuals who have been granted access to the information/data at any point in time, and supply that list to DSS upon request. The contractor shall notify DSS of any staff departures no later than 24 hours of separation.

G. Prior to this Contract’s completion date, provide a certificate of disposition for all information/data acquired during the project.

H. Cooperate in any audit DSS requests having provided advance written notice of the audit and potential for Contractor support, whether it is a state or federal audit, Contractor agrees/acknowledges that full participation and cooperation is critical in achieving a successful audit. Full participation and cooperation in an audit includes, but is not limited to, Contractor providing proof of system, media or device security and/or encryption to DSS up to 14 days after DSS' written request in response to a compliance investigation, audit, or the discovery of a breach. DSS may also request production of proof of security at other times as necessary to satisfy state and federal monitoring requirements and audits.

I. Designate and identify a person or persons, as Privacy Official and Information Security Official, each of whom is authorized to act on behalf of Contractor and is responsible for the development and implementation of the privacy and security requirements in this CSWS-DUA. Contractor shall provide name and current address, phone number and e-mail address for such designated officials to DSS upon execution of this CSWS-DUA and prior to any change. Upon written notice from DSS, Contractor shall promptly remove and replace such official(s) if such official(s) is not performing the required functions.

2. Contractor shall comply with the following certifications, protocols, and processing:

A. Cloud Service Certification

1. Cloud Service providers utilized by DSS must meet the Nevada State Standards for Cloud Computing (Document ID S.5.06.01 – Cloud Services) requirements based on the Service Type; Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), or Function as a Service (FaaS).

2. The State of Nevada provides documents to assist in assessing the service security requirements, based on the Service Type:

a. Documents are located at Universal Resource Location (URL): https://www.it.nv.gov/governance/security-policies-standards--procedures/

i. S.5.06.01 Cloud Services S.

ii. 5.06.01.1F Cloud Services Assessment Worksheet

3. Federal Compliance

a. Contractor must implement and maintain security controls required by IRS Publication 1075 when FTI is in scope for the current work effort. Proof of Publication 1075 compliance must be provided to the DSS Information Security Officer (ISO).

b. Contractor must implement and maintain information security controls aligned with applicable National Institute of Standards and Technology (NIST) framework, including but not limited to NIST SP 800-53, NIST SP 800-171, as applicable to the services provided being provided.

c. Service providers must be able to prove their security posture by providing third party certification which demonstrates the minimum NIST Cloud Computing Standard has been implemented, based on Service Type, e.g. annual SOC 2 report. Proof of Security Level must be provided to the DSS Information Security Officer (ISO).

d. GovRAMP certification is a baseline requirement. Additionally, FedRAMP certification is required if a service provider transports, processes, or stores Federal or federally verified and/or validated data, or if it connects to DSS applications and/or information systems. Review the FedRAMP website for more FedRAMP program information: https://www.FedRAMP.gov.

B. TCP/IP Connection Protection (Cloud and Web Services)

1. Transmission of data between the Service Provider and DSS must enforce TLS 1.2 (or greater) tunneling protocol using current FIPS 140 compliant encryption to protect data in transit.

2. Security certificate standards:

a. Certificates must be signed by an official Certificate Authority.

b. Certificates must be created with 2048-bit keys (or greater).

c. Certificates must expire every 12 months to prevent long-term connection authorizations without re-issuing of certificates.

3. All connections to, or from DSS networks must be limited to approved business scope and functionality regardless of direction.

a. Endpoints must NOT hold a consistent connection to the DSS endpoint longer than is required to complete the transaction or transaction batch.

b. The connecting system must be responsible for terminating its own connection when the service has completed the transaction(s) with DSS.

c. Connections will be terminated by DSS when idle for more than 30 minutes.

4. DSS and the contractor will create an authorized allow lists of necessary IP addresses.

a. All configurations must be presented, discussed, and approved by DSS prior to attempting implementation or connection to DSS systems.

C. Data Storage Protection

1. DSS data stored within a Cloud Service must comply with the following:

a. Be located within the Continental United States (CONUS).

b. Be accessed only by users approved in writing by authorized DSS personnel.

c. Be established with the principle of least-privileged access.

d. Include at a minimum Multi-Factor Authentication (MFA)

e. Implement access controls as identified, defined and documented by DSS.

f. All access controls must comply with requirements of DSS.

g. Be actively monitored for intrusion, modification, and/or destruction of the data storage system and data.

i. Host intrusion systems and malware protection systems must be utilized with signature checks occurring at least weekly.

ii. Monitor for unusual or unauthorized activities and conditions.

h. Notification Requirement: If the cloud service provider intends to move data to another location or datacenter not identified in the contract, the provider must give DSS 6 months advanced notice. This will allow adequate time for the State contract amendment process.

i. Provide Data Isolation: Software, data, and services that receive, process, store, or transmit data must be isolated within the cloud environment from other customers’ data.

j. Provide an Enforceable Service Level Agreement (SLA) to DSS that establishes expected service availability and connectivity to the data with a minimum 99.9% uptime.

k. Provide Data Encryption in Transit: Data must be encrypted in transit within the cloud environment. All mechanisms used to encrypt data must be compliant with current FIPS 140 standards.

l. Provide Data Encryption at Rest: All data must be encrypted at rest. All mechanisms used to encrypt data must be compliant with current FIPS 140 standards.

m. Sanitize Decommissioned Storage Devices: Storage devices must be securely sanitized or destroyed using methods acceptable by NIST 800-88 current rev.

n. Provide Risk Assessment: The agency must conduct an annual assessment of the security risk on all information systems used for receiving, processing, storing, or transmitting data. Risk assessments must be conducted annually and prior to implementing a new cloud environment.

D. Data Removal

1. Data will not be allowed to remain in a contractor’s system for more than 30 days past contract end date or previously agreed upon modified end date.

2. The contractor is responsible for proper handling of the data until the data has been moved and permanently deleted from the system and the system storage has been sanitized.

3. The system storage must be sanitized in accordance with Section 2.C of this document.

4. The contractor is responsible for moving the data to an acceptable location using an agreed upon format as determined by DSS and the contractor.

a. This process must be resolved prior to the contract end date. Technology, data formats, and data storage systems will change over time, therefore this is best decided closer to the end of contract, rather than in the beginning.

E. Security Incident Reporting

1. Security incidents involving the service provider’s cloud must be communicated to DSS upon confirmation but no later than 4 hours after discovery with as much detail known at that time.

2. At a minimum, weekly incident status calls must be conducted between Contractor and DSS beginning when the incident has been confirmed. Daily communication is encouraged and required when critical information is discovered.

3. Security incidents will require immediate isolation from DSS until the situation is resolved. This requirement is to minimize the potential of the incident infecting DSS systems.

4. A final incident report must be provided and reviewed with DSS within thirty (30) calendar days from the conclusion of the security incident.

5. DSS Office of Information Security, Contact Information:

a. Attn: Office of Information Security, Division of Social Services, State of Nevada

b. Address: 1470 College Parkway, Carson City, NV 89706

c. Email: infosecadmin@dss.nv.gov

d. Email/letter subject line: Security Incident Notification involving DSS Data or Interface at {Cloud Service Provider Name/Program Name}

F. Re-Use of Data

1. DSS retains all rights to any data shared with the cloud services provider. DSS data shall not be used to train AI models. Use of shared data is restricted to purposes explicitly allowed in the contract. These prohibitions include, but are not limited to, any actions by contractor(s) that would result in profit creation from the data DSS provides or is responsible for.

2. DSS must acquire written permission to share or alter data. This includes usage, transfer, and/or storage of said data. Any changes could require new data sharing agreements or updating of existing data sharing agreements.

G. Failures to Comply and Repercussions (Cloud and Web Services)

1. Failure to maintain security to these standards will result in a review of the compliance gaps by DSS and the Service Provider’s technical management. All gaps must be resolved and brought into compliance as soon as reasonably possible within the following timeframes:

a. Critical vulnerabilities present an immediate risk to DSS, requiring a fix within 24-48 hours.

b. High vulnerabilities that pose significant risk but are not critical must be remediated within 14 calendar days.

c. Medium vulnerabilities must be remediated within 60 calendar days.

d. Low vulnerabilities that pose minimal risk must be addressed within calendar 120 days.

2. DSS and the contractors they use are under strict Federal regulations for reporting data or system security breaches in a timely manner. Failure to report data breaches to DSS within specified time frames will result in:

a. Immediate termination of all connections between DSS networks and the Cloud/Web Service system; and

b. Requires a review of reporting procedures with the Service Provider and DSS within three (3) working days.

3. With respect to ALL information/data, Contractor shall NOT:

A. Unless expressly permitted by law or this agreement, contractors and other involved parties shall not attempt to identify any de-identified information or contact any individuals discovered in the data without prior written authorization from DSS.

B. Engage in marketing, sale, or use of the information/data to train AI. The Contractor shall not share, publish, or otherwise release any findings or conclusions derived from any analysis of the information/data without prior written approval from DSS.

C. Permit or enter into any agreement with a Subcontractor to create, receive, maintain, use, disclose, have access to or transmit information/data, on behalf of DSS without written permission from DSS. It is mandatory the Subcontractor execute the CSWS-DUA Agreement. Contractor is directly responsible for its Subcontractors’ compliance with, and enforcement of, this CSWS-DUA.

4. Data Breach Provisions:

A breach of any data including but not limited to PII, Internal Revenue Service (IRS) / Federal Tax Information (FTI), Centers for Medicaid and Medicare Services (CMS), or Social Security Administration (SSA) data must be reported within 1 hour of discovery to the DSS Privacy Officer, DSS Information Security Officer, and DSS IT Management.

A. Initial Breach Notice: Contractor must provide details of the breach, including, but not limited to:

1. The date the breach occurred.

2. The date of the Contractor and, if applicable, Subcontractor’s discovery.

3. A brief description of the breach, and if known, how it occurred and who is responsible.

4. A brief description of the Contractor’s investigations and the status of that investigation.

5. A description of the types and amount of confidential Information involved.

6. Minimal information regarding the individuals affected by the breach.

B. Triage Breach Response Reporting

1. Contractor’s initial risk assessment shall contain enough detail for DSS to determine which entities must be notified in accordance with applicable law, Federal or State policies. Including evidence of data publicly exposed, exfiltrated, or otherwise compromised.

2. Contractor’s recommended protective measures for affected individuals, including notifications, credit monitoring, and identity theft protection. This must include specific guidance for Legally Authorized Representatives acting for individuals with special circumstances or limited capacity.

3. The steps Contractor has taken to mitigate the harm or potential harm caused and include any third party and/or law enforcement involvement in the resolution of the breach.

4. The steps Contractor has taken, or will take, to prevent recurrence of a similar breach.

5. Contractor shall provide daily breach response updates unless otherwise directed by DSS in writing. Updates include mitigation steps taken, corrective action, root cause analysis and when such activities are expected to be completed.

6. Any additional information requested by DSS at the time of the incident notification to complete DSS internal incident report.

C. Breach Notification to Individuals and Reporting to the Authorities

1. Contractor’s obligation begins at the discovery of a breach and continues for the duration of related activities, until all impacts of the breach are mitigated to DSS’ satisfaction during the “Incident response period”.

2. Contractor shall, at the Contractor’s expense, cooperate fully with DSS in investigating and mitigating any Breach of Confidential Information.

3. DSS may direct the Contractor to provide breach notification to individuals, regulators or third parties, following a breach. Notification format will be provided at that time.

4. The Contractor must comply with NRS 603A, The Privacy Act, and all applicable legal and regulatory requirements.

5. The Contractor shall provide DSS with draft notifications for approval prior to distribution as well as copies of the distributed and approved communications.

6. Contractor shall have the burden of demonstrating to DSS that any required notification was made timely by providing all information available about the breach no later than 5 p.m. Pacific Time on the third business day after Discovery. To the extent possible, the information should include, but not be limited to:

a. Delivery of first name, last name, and mailing address for every individual affected by the breach using a securely encrypted delivery mechanism.

b. Summary of the breach that will be included with the notifications.

5. General Provisions:

A. Ownership of information/data - Contractor acknowledges and agrees that the information/data is and shall remain the property of DSS. Contractor agrees it acquires no title or rights to the information/data and shall not use DSS data for any training of non-DSS Large Language Models or any other Artificial Intelligence activities not specifically approved in writing by DSS.

B. DSS Commitment and Obligations - DSS will not request Contractor to create, maintain, transmit, use, or disclose Personally Identifiable Information (PII) or other protected information/data in any manner that would not be permissible under applicable law.

C. DSS Right to Inspection - At any time, upon reasonable notice to the Contractor, DSS, directly or through its agent, will have the right to inspect the facilities, systems, books and records of Contractor to monitor compliance with this CSWS-DUA. If DSS determines that Contractor has violated this CSWS-DUA, DSS shall have the right to immediately inspect the facilities, systems, books and records of Contractor for failure to properly secure the information/data in accordance with the CSWS-DUA. For purposes of this subsection, DSS’s agent(s) include, without limitation, any Executive agency in the State of Nevada, Legislative Auditors, the Office of the Attorney General of Nevada, the State Auditor’s Office, outside consultants, any Federal oversight agency or its contractors, legal counsel or other designee.

D. Termination of CSWS-DUA; Survival - This CSWS-DUA will be effective on the date on which Contractor executes the Contract and will terminate upon termination of the Contract and as set forth herein, except for any provisions specifically mentioned herein that will survive termination. If the Contract is extended, this CSES-DUA is extended to run concurrent with the Contract.

(1) If DSS determines that Contractor has violated a material term of this CSWS-DUA; DSS may in its sole discretion:

(a) Exercise any of its rights including but not limited to reports, access and inspection under this CSWS-DUA and/or the Contract; or

(b) Require Contractor to submit to a corrective action plan, including a plan for monitoring and plan for reporting as DSS may determine necessary to maintain compliance with this CSWS-DUA; or

(c) Provide Contractor with a reasonable period to cure the violation as determined by DSS; or

(d) Terminate the CSWS-DUA and Contract immediately and seek relief in a court of competent jurisdiction in Carson City, Nevada. Before exercising any of these options, DSS will provide written notice to Contractor describing the violation and the action it intends to take.

(2) If neither termination nor cure is feasible, DSS shall report the violation to the applicable regulatory authorities.

(3) The duties of Contractor or its Subcontractor under this CSWS-DUA survive the expiration or terminated by this CSWS-DUA.

E. Injunctive Relief:

(1) Contractor acknowledges and agrees that DSS may suffer irreparable injury if Contractor or its Subcontractor fails to comply with any of the terms of this CSWS-DUA with respect to the information/data based on laws or regulations applicable to this information/data.

(2) Contractor further agrees that monetary damages may be inadequate to compensate DSS for Contractor's or its Subcontractor's failure to comply. Accordingly, Contractor agrees that DSS will, in addition to any other remedies available to it at law or in equity, be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages, to enforce the terms of this CSWS-DUA.

F. Indemnification:

Contractor shall indemnify, defend and hold harmless DSS and its officials, officers, employees, subcontractors, agents (including other state agencies acting on behalf of DSS) or other persons employed/contracted by the State of Nevada (each of the foregoing hereinafter referred to as “Indemnified Party”) against all actual and direct losses suffered by the Indemnified Party and all liability to third parties arising from or in connection with any breach of this CSWS-DUA or from any acts or omissions related to this CSWS-DUA by Contractor or its employees, directors, officers, Subcontractors, or agents or other persons employed/contracted by the Contractor. The duty to indemnify, defend and hold harmless is independent of the duty to insure. Upon demand, Contractor shall reimburse DSS for any and all losses, liabilities, lost profits, fines, penalties, costs or expenses (including costs of required notices, investigation, and mitigation of a breach, fines or penalties imposed on an Indemnified Party by a regulatory authority, and reasonable attorneys’ fees) which may be imposed upon any Indemnified Party to the extent caused by and which results from the Contractor’s failure to meet any of its obligations under this CSWS-DUA. Contractor’s obligation to defend, indemnify and hold harmless any Indemnified Party will survive the expiration or termination of this Contract and this CSWS-DUA.

G. Insurance:

(1) In addition to any insurance required in the Contract, at DSS's option, DSS may require Contractor to maintain, at its expense, the special and/or custom first- and third-party insurance coverages, including without limitation data breach, cyber liability, crime theft and notification expense coverages, with policy limits sufficient to cover any liability arising under this CSWS-DUA, naming the State of Nevada, acting through DSS, as an additional named insured and loss payee, with primary and noncontributory status.

(2) Contractor shall provide DSS with written proof that required insurance coverage is in effect, at the request of DSS.

H. Governing Law: Jurisdiction: This Contract and the rights and obligations of the parties hereto shall be governed by, and construed according to, the laws of the State of Nevada, without giving effect to any principle of conflict-of-law that would require the application of the law of any other jurisdiction. The parties consent to the exclusive jurisdiction of and venue in the First Judicial District Court, Carson City, Nevada for enforcement of this Contract, and consent to personal jurisdiction in such court for any action or proceeding arising out of this Contract.

I. Entirety of the Contract:

This CSWS-DUA is incorporated by reference into the Contract and, together with the Contract, constitutes the entire agreement between the parties. No change, waiver, or discharge of obligations arising under those documents will be valid unless in writing and executed by the party against whom such change, waiver, or discharge is sought to be enforced.

J. Automatic Amendment and Interpretation:

Upon the effective date of any amendment or issuance of additional regulations to any law applicable to information/data, this CSWS-DUA will automatically be amended so that the obligations imposed on DSS and/or Contractor remain in compliance with such requirements.

Any ambiguity in this CSWS-DUA will be resolved in favor of a meaning that permits DSS and Contractor to comply with laws applicable to information/data.

K. Requests for Approval:

All notices and requests for approvals related to this CSWS-DUA must be directed to the DSS Contracts Unit at dsscontracts@dss.nv.gov.

6. Response to 1.G – Contractor’s Points of Contact A. Contractors’ Privacy Official Name:

Current Street Address:

Phone Number

Fax Number:

Email Address:

B. Contractors’ Information Security Official Name:

Current Street Address:

Phone Number

Fax Number:

Email Address:

Independent Contractor Date

Independent Contractor’s Title

Administrator, Division of Social Services

Title