6._EDD_ICMS_RFP_Attachments_and_Exhibits.pdf

DRAFT

EXHIBIT E: EDD Special Terms and Conditions

1. CONTRACT APPROVAL

The Contract is not effective until it has been approved by the State. The Contractor may not commence performance under this Contract until it has been approved by the State.

Should the Contractor begin work prior to receiving a copy of the approved Contract, any work performed prior to execution of the contract shall be considered as having been done at the Contractor's own risk and as a volunteer.

2. LOBBYING RESTRICTIONS

The Contractor must certify lobbying activities and disclose lobbying activities by completing the Certification Regarding Lobbying and Disclosure of Lobbying Activities and submit it with the Offer. The forms shall be completed by the reporting entity, whether sub-awardee or prime Federal recipient, at the initiation or receipt of a covered Federal action, or a material change to a previous filing, pursuant to title 31 U.S.C. Section 1352. See +attachment for lobbying activities.

3. CERTIFICATION REGARDING DEBARMENT

Debarment, suspension, ineligibility and voluntary exclusion of lower tier covered transaction certification is required for this procurement by the regulations implementing Executive Order 12549, Debarment and Suspension, 29 CFR Part 98, Section 98.510, participants’ responsibilities. The regulations were published as Part VII of the May 26, 1988, Federal Register (Pages 19160-19211).

4. WORKFORCE INNOVATION AND OPPORTUNITY ACT

The Contractor agrees to conform to the nondiscrimination provisions of the Workforce Innovation and Opportunity Act (WIOA) and other federal nondiscrimination requirements as referenced in 29 CFR, Part 37 and 38.

5. PUBLIC CONTRACT CODE

The Contractor is advised that he/she has certain duties, obligations, and rights under the Public Contract Code §§ 10335 – 10381 and 10410 - 10412, with which the Contractor should be familiar. These Public Contract Code sections can be viewed at:

http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10335 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10381 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10410

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10335 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10381 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PCC&sectionNum=10410

6. NOTICES

All notices relating to this Contract shall be in writing and shall be sent to the respective Contract Managers set forth in this Contract, SECTION 5. CONTRACT CONTACTS. All such notices shall be deemed delivered if deposited, postage prepaid, in the United States mail and sent to the parties’ last known address.

7. AVOIDANCE OF CONFLICTS OF INTEREST BY CONTRACTOR

A. Consultants are advised that that Political Reform Act prohibits public officials, which include consultants, from making, participating in making, or in any way attempting to use his official position to influence a governmental decision in which he knows or has reason to know he has a financial interest. (Government Code § 87100; see Government Code § 81000 and Government Code § 1090 et seq.). For purposes of this Contract, consultants are defined as any individual performing work under this Contract.

B. The Contractor shall make all reasonable efforts to ensure that no conflict of interest exists between its officers, agents, employees, consultants or members of its governing body.

C. The Contractor shall prevent its officers, agents, employees, consultants or members of its governing body from using their positions for purposes that are, or give the appearance of being, motivated by a desire for private gain for themselves or others such as those with whom they have family, business, or other ties.

D. During the performance of this Contract, should the Contractor become aware of a financial conflict of interest that may foreseeably allow an individual or organization involved in this Contract to materially benefit from the State’s adoption of an action(s) recommended as a result of this Contract, the Contractor must inform the State in writing within 10 working days.

E. The EDD may request additional information regarding a consultant’s economic interests. If the additional information is not provided to the satisfaction of the EDD, then the Contractor must provide a substitute consultant with similar credentials to resolve the potential conflict as provided in paragraph D.

F. Consultants are advised that the Fair Political Practices Commission has jurisdiction to enforce the Political Reform Act and may seek civil and criminal prosecution for violations of the act, including failure to disclose financial interests. Other penalties for violating the Political Reform Act could include fines, conviction of a misdemeanor, disqualification from serving in public office or as a lobbyist, and being responsible for the costs of the litigation, including attorney’s fees.

G. All consultants providing work under this Contract shall include a completed Statement of Economic Interests, Form 700 (http://www.fppc.ca.gov/Form700.html) at the time of award. In addition, consultants shall file a Form 700 annually by April 1, thereafter during the life of the Contract. Each new and/or substitute consultant shall file a Form 700 prior to performing any work on the contract.

H. Consultants are advised that they may amend their Form 700 at any time and that amending an

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024 http://www.fppc.ca.gov/Form700.html incorrect or incomplete report may be considered evidence of good faith by the Fair Political Practices Commission.

8. SUBCONTRACTOR LANGUAGE

Nothing contained in this Contract shall create any contractual relationship between the State and any subcontractor, and no subcontract shall relieve the Contractor of its responsibilities and obligations hereunder. The Contractor is fully responsible to the State for the act and omissions of its subcontractor and of persons either directly or indirectly employed by any of them.

The Contractor’s obligation to pay its subcontractors is independent from the State’s obligation to make payment to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor.

9. BACKGROUND INVESTIGATION

The EDD shall conduct a background investigation of the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors, unless the EDD determines such individuals are not subject to a background investigation. Individuals must voluntarily consent to a background check and the EDD reserves the right to disapprove any individual from performing services under the scope of the Contract.

Investigations will be conducted to ascertain whether a Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors have any state or federal convictions, or are currently released from custody on bail or on their own recognizance pending trial. The background investigation will include fingerprinting and an inquiry to the California Department of Justice (DOJ) and the Federal Bureau of Investigations (FBI) to disclose Criminal Offender Record Information (CORI). The EDD will absorb the cost of the fingerprinting services.

10. EVALUATION OF CONTRACT/CONTRACTOR

For IT Services over $500,000, within sixty (60) days after the completion of the Contract, the EDD Contract Manager shall complete a written evaluation of Contractor’s performance under the Contract. A copy of the STD 971 must be emailed to the State Department of Technology at form971@state.ca.gov and shall remain in the contract file for 36 months. If the Contractor did not satisfactorily perform the work, a copy of the evaluation form will be sent to the Contractor within fifteen

(15) working days of the completion of the evaluation. (PCC 12102.3). You may view the form here:

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std971.pdf

11. OWNERSHIP RIGHTS

All data, documents, software and other artifacts produced under the contract become the sole property of

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024 mailto:form971@state.ca.gov https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std971.pdf

EDD with an exception for preexisting materials to remain owned by the Contractor.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024

EXHIBIT F: PROTECTION OF CONFIDENTIALITY

1. PROTECTION OF CONFIDENTIALITY

Federal and state confidentiality laws, regulations, and administrative policies classify all the Employment Development Department (EDD) information provided under this Agreement as confidential. The federal and state laws prohibit disclosure of the EDD’s confidential information to the public and mandate its protection against loss and against unauthorized access, use, disclosure, modification, or destruction.

The EDD Data Recipient must therefore, agree to the following security and confidentiality requirements:

1.1. ADMINISTRATIVE SAFEGUARDS

a. Adopt policies and procedures to ensure use of the EDD’s confidential information solely for purposes specifically authorized under this Agreement that meet the requirements of section §603.10, Title 20 of the Code of Federal Regulations.

b. Warrant by execution of this Agreement, that no person or selling agency has been employed or retained to solicit or secure this Agreement upon agreement or understanding for a commission, percentage, brokerage, or contingent fee. In the event of a breach or violation of this warranty, the EDD shall have the right to annul this Agreement without liability, in addition to other remedies provided by law.

c. Warrant and certify that in the performance of this Agreement, the EDD Data Recipient will comply with all applicable statutes, rules and/or regulations, and Agreement information security requirements, including but not limited to the following:

• California Unemployment Insurance Code §1094 (Disclosure Prohibitions)

• Title 20, Code of Federal Regulations §603.9 and §603.10 (Federal Unemployment Compensation Safeguards and Security Requirements)

• California Civil Code §1798, et seq. (Information Practices Act)

• California Penal Code §502 (Computer Fraud Act )

• Title 5, U.S. Code §552a (Federal Privacy Act Disclosure Restrictions)

• Title 42, U.S. Code §503 (Social Security Act)

• Title 18, U.S. Code §1905 (Disclosure of Confidential Information)

d. Agree to indemnify the EDD against any loss, cost, damage or liability resulting from violations of these applicable statutes, rules and/or regulations by the EDD Data Recipient, and Agreement information security requirements that meet section 5305.8 of the State Administrative Manual.

OR

(Use below for Federal Agencies if the Federal Balanced Budget Act applies) In order to comply with the Anti-Deficiency Act, 31 U.S.C. § 1341, indemnification agreements with federal government contractors, if otherwise authorized, must include a limitation on the amount of liability and must state both that the liability is further limited to the amount of appropriated funds

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

available at the time payment must be made, and that the contracting agency implies no promise that Congress will appropriate additional funds to meet any deficiency in the event of loss.

e. Protect the EDD’s information against unauthorized access, at all times, in all forms of media.

Access and use the information obtained under this Agreement only to the extent necessary to assist in the valid administrative needs of the program receiving such information, and only for the purposes defined in this Agreement.

f. Keep all the EDD’s confidential information completely confidential. Make this information available to authorized personnel on a "need-to-know" basis, and only for the purposes authorized under this Agreement. “Need-to-know” refers to those authorized personnel who need information to perform their official duties in connection with the use of the information authorized by this Agreement.

g. Immediately upon discovery, notify the EDD Cybersecurity Division at InformationSecurityOffice@edd.ca.gov, that there may have been a breach in security which has or may have resulted in the disclosure of confidential information. For purposes of this section, immediately is defined within 24 hours of discovery of the breach.

The notification must include a detailed description of the incident (such as time, date, location, and circumstances) and identify the EDD Data Recipient personnel responsible (name, title and contact information) for handling breach disclosures. Please do not include any confidential information in the notification.

h. The EDD shall maintain the right to participate in the investigation of a security incident involving its data or conduct its own independent investigation. The EDD Data Recipient shall cooperate fully in such investigations.

1.2. MANAGEMENT SOLUTIONS

a. Acknowledge that the confidential information obtained by the EDD Data Recipient under this Agreement remains the property of the EDD.

b. Instruct all personnel assigned to work with the information provided under this Agreement regarding the following:

• Confidential nature of the EDD information.

• Requirements of this Agreement.

• Sanctions specified in federal and state unemployment compensation laws and any other relevant statutes against unauthorized disclosure of confidential information provided by the EDD.

c. Require that all personnel assigned to work with the information provided by the EDD complete the EDD Vendor/Contractor Confidentiality Statement (Exhibit E-1).

d. Permit the EDD to make on-site inspections to ensure that the terms of this Agreement are being met. Make available to the EDD staff, on request and during on-site reviews, copies of the EDD Vendor/Contractor Confidentiality Statement (Exhibit E-1) completed by personnel assigned to work with the EDD’s confidential information, and hereby made a part of this Agreement.

e. Maintain a system of records sufficient to allow an audit of compliance with the requirements

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

under subsection (e) of this part. Permit the EDD to make on-site inspections to ensure that the requirements of federal and state privacy, confidentiality and unemployment compensation statutes and regulations are being met including but not limited to §1137(a)(5)(B) of the Social Security Act.

1.3. USAGE, DUPLICATION, AND REDISCLOSURE SAFEGUARDS

a. Use the EDD’s confidential information only for purposes specifically authorized under this Agreement. The information is not admissible as evidence in any action or special proceeding except as provided under section 1094(b) of the UIC. Section §1095(u) of the UIC does not authorize the use of the EDD’s confidential information by any private collection agency.

b. Extraction or use of the EDD information for any purpose outside the purposes stated in this Agreement is strictly prohibited. The information obtained under this Agreement shall not be reproduced, published, sold, or released in original or any other form not specifically authorized under this Agreement.

c. Disclosure of any of the EDD information to any person or entity not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with the EDD’s confidential information shall not reveal or divulge to any person or entity any of the confidential information provided under this Agreement except as authorized or required by law. The EDD Data Recipient shall immediately notify and work cooperatively with the EDD to respond timely and correctly to public records act requests that it receives related to information obtained under this Agreement.

Access to public records is governed by the California Public Records Act, Government Code §7920-7931.

1.4. PHYSICAL SAFEGUARDS

a. Take precautions to ensure that only authorized personnel are given access to physical, electronic and on-line files. Store electronic and hard copy information in a place physically secure from access by unauthorized persons. Process and store information in electronic format, such as magnetic tapes or discs, in such a way that unauthorized persons cannot retrieve the information by means of computer, remote terminal, or other means.

b. Secure and maintain any computer systems (network, hardware, and software applications) that will be used in the performance of this Agreement. This includes ensuring that all security patches, upgrades, and anti-virus updates are applied as appropriate to secure data that may be used, transmitted, or stored on such systems in the performance of this Agreement.

c. Store all the EDD’s confidential documents in a physically secure manner at all times to prevent unauthorized access.

d. Store the EDD’s confidential electronic records in a secure central computer facility. Where in-use on a shared computer system or any shared data storage system, ensure appropriate information security protections are in place. The EDD Data Recipient shall ensure that appropriate security

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024 https://www.ssa.gov/OP_Home/ssact/title11/1137.htm https://www.ssa.gov/OP_Home/ssact/title11/1137.htm access controls, storage protections and use restrictions are in place to keep the confidential information in the strictest confidence and shall make the information available to its own personnel on a "need-to-know” basis only.

e. Store the EDD’s confidential information in encrypted format when recorded on removable electronic storage media, or on mobile computing devices such as a laptop computer.

f. Maintain an audit trail and record data access of authorized users and authorization level of access granted to the EDD’s data, based on job function.

g. Direct all personnel permitted to use the EDD’s data to avoid leaving the data displayed on their computer screens where unauthorized users may view it. Personnel should retrieve computer printouts as soon as they are generated so that the EDD’s data is not left unattended in printers where unauthorized personnel may access them.

h. Dispose of confidential information obtained from the EDD, and any copies thereof made by the EDD Data Recipient, after the purpose for which the confidential information is disclosed is served. Disposal means return of the confidential information to the EDD or destruction of the information utilizing an approved method of confidential destruction, which includes electronic deletion (following Department of Defense specifications) shredding, burning, or certified or witnessed destruction.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT G: Safeguarding Contract Language Administrative Requirements

The following administrative requirements must be completed before services are performed in accordance with the Contract. The Contractor is responsible for any costs or expenses related to time for completing these items. The Employment Development Department (EDD) may terminate the Contract and be relieved of any payments should the Contractor fail to perform the requirements of the Background Investigation at the time and in the manner described below:

a. Background Investigation

Pursuant to Government Code section 1044, the EDD shall conduct a background investigation of the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who will have access to Federal Tax Information (FTI) as part of their duties under this Agreement; and reserves the right to disapprove any individual from performing services under the scope of this Agreement. The Background Investigation will include fingerprinting and an inquiry to the California Department of Justice (DOJ) and the Federal Bureau of Investigations (FBI) to disclose Criminal Offender Record Information (CORI). Investigations are conducted to ascertain whether a Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors have any state or federal convictions, or are currently released from custody on bail or on their own recognizance pending trial.

Each Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who are to perform services under this Agreement must voluntarily consent to a Background Investigation.

Fingerprint rolling fees and Background Investigation costs will be borne by the EDD if the preferred fingerprint rolling vendor is utilized. If the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors choose to go to a non-preferred Live Scan fingerprint vendor, the costs will be borne by the Contractor, payable at the time of fingerprinting and will not be reimbursed by the EDD. Previous clearances and/or investigations conducted by other agencies will not be accepted as an alternative to the EDD's Background Investigation.

Once this Contract is awarded, it is the responsibility of the Contractor to provide a list of names of individuals who will be working on site at an EDD location or working remotely with access to EDD information (data) and/or information assets (servers, workstations, routers, switches, printers, etc.)

to the Contract Monitor. The Contractor will be provided BCIA 8016 forms for its employees, contractors, agents, volunteers, vendors, or subcontractors to utilize for their fingerprint rolling at an EDD preferred fingerprint rolling vendor. The EDD will receive the CORI reports from DOJ and evaluate the information provided against the EDD’s established criteria. The Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors must successfully pass a background investigation pursuant to the EDD’s criteria prior to the EDD issuing a badge or access to the EDD’s data.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

Within 5 business days, the Contractor shall notify the EDD Contract Monitor when its employee, contractor, agent, volunteer, vendor, or subcontractor, working under this Agreement is terminated, not hired, or reassigned to other work. Within 5 business days, the Contractor shall notify the EDD Contract Monitor when its new employee, contractor, agent, volunteer, vendor, or subcontractor is assigned to work under this Agreement in order for the EDD to commence conducting a background investigation of its new employee, contractor, agent, volunteer, vendor, or subcontractor.

b. Annual Information Security Awareness and Privacy Training

California state policy requires that the EDD must provide for the proper use and protection of its information assets and arrange for basic security and privacy awareness training (SAM sections 5305.1, 5320.1, 5320.2, 5320.3, SIMM 5330-B) for new users and annually thereafter. Therefore, the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who access state resources must complete the designated EDD online annual Information Security Awareness and Privacy Training prior to accessing EDD information assets and/or beginning work on a contract.

The EDD University will set up a training account. While the training course is provided by the EDD, any expenses, including Contractor time, related to new and/or annual Information Security Awareness and Privacy Training will be the responsibility of the Contractor.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT H: Safeguarding Contract Language for Technology Services

I. PERFORMANCE

In performance of this Contract, the Contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements:

1. All work will be done under the supervision of the Contractor or the Contractor's employees.

2. The Contractor and the Contractor's employees, Contractors, agents, volunteers, vendors, or subcontractors must meet the background check requirements provided in EXHIBIT G:

Safeguarding Contract Language Administrative Requirements of this Contract.

3. Any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this Contract.

Disclosure to anyone other than an officer or employee of the Contractor will be prohibited.

4. All returns and return information will be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.

5. The Contractor certifies that the data processed during the performance of this Contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the Contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the Contractor certifies that any Internal Revenue Service (IRS) data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.

6. Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the agency or his or her designee. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and will provide the agency or his or her designee with a statement containing the date of destruction, description of material destroyed, and the method used.

7. All computer systems receiving, processing, storing or transmitting federal tax information (FTI) must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

8. No work involving FTI furnished under this Contract will be subcontracted without prior written approval of the IRS.

9. The Contractor will maintain a list of employees authorized access. Such list will be provided to the agency and, upon request, to the IRS reviewing office. (See Section 10.0, State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

Reporting Improper Inspections or Disclosures of the IRS Publicaion 1075) The agency will have the right to void the Contract if the Contractor fails to provide the safeguards described above.

II. CRIMINAL/CIVIL SANCTIONS

1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRCs 7213 and 7431 and set forth in 26 C.F.R. § 301.6103(n)-1.

2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need-to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC 7213A and 7431 and set forth in 26 C.F.R. § 301.6103(n)-1.

3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. § 552(a). Specifically, 5 U.S.C. § 552(a)(i)(1), which is made applicable to Contractors by 5 U.S.C. § 552(a)(m)(1), provides that any officer or employee of a Contractor, who by virtue of his/her employment or official position, has possession of or access to agency

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

4. Granting a Contractor access to FTI must be preceded by certifying that each individual understands the agency's security policy and procedures for safeguarding IRS information.

Contractors must maintain their authorization to access FTI through annual recertification.

The initial certification and recertification must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A. (See Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure of the IRS Publicaiont 1075). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10.0, Reporting Improper Inspections or Disclosures of the IRS Publicaion 1075) For both the initial certification and the annual certification, the Contractor must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the Contractor to inspect facilities and operations performing any work with FTI under this Contract for compliance with requirements defined in IRS Publication 1075. The IRS' right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology assets that access, store, process or transmit FTI. On the basis of such inspection, corrective actions may be required in cases where the Contractor is found to be noncompliant with Contract safeguards.

* Language used throughout this Exhibit is derived from IRS Publicaion 1075

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

May 29, 2024 https://www.irs.gov/pub/irs-pdf/p1075.pdf

EXHIBIT I: Security and Data Protection

Contractor shall certify to the State compliance with applicable industry standards and guidelines, including but not limited to relevant security provisions of the California State Administrative Manual (SAM), California Statewide Information Management Manual (SIMM), The National Institute of Standards and Technology (NIST) 800-53 v5 and Federal Information Processing Standard (FIPS) Publication 199 which protect and minimize risk to the State. At a minimum, provision shall cover the following:

1. The Contractor assumes responsibility of the confidentiality, integrity and availability of the data under its control. The Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards at all times during the term of the Agreement to secure such data from data breach or loss, protect the data and information assets from breaches, introduction of viruses, disabling of devices, malware and other forms of malicious or inadvertent acts that can disrupt the State’s access to its data or affects the integrity of that data.

2. Confidential, sensitive or personal information shall be encrypted in accordance with SAM 5350.1 and SIMM 5305-A.

3. The Contractor shall comply with statewide policies and laws regarding the use and protection of information assets and data. Unauthorized use of data by Contractor or third parties is prohibited.

4. Signed Security and Confidentiality Statement for all personnel assigned during the term of the Agreement.

5. Apply security patches and upgrades and keep virus protection software up- to-date on all information asset on which data may be stored, processed, or transmitted.

6. The Contractor shall notify the State data owner immediately if a security incident involving the information asset occurs.

7. The State data owner shall have the right to participate in the investigation of a security incident involving its data or conduct its own independent investigation. The Contractor shall allow the State reasonable access to security logs, latency statistics, and other related security data that affects this Agreement and the State’s data, at no cost to the State.

8. The Contractor shall be responsible for all costs incurred by the State due to security incident resulting from the Contractor’s failure to perform or negligent acts of its personnel, and resulting in an unauthorized disclosure, release, access, review, destruction; loss, theft or misuse of an information asset. If the contractor experiences a loss or breach of data, the contractor shall immediately report the loss or breach to the State. If the State data owner determines that notice to the individuals whose data has been lost or breached is appropriate, the contractor will bear any and all costs associated with the notice or any mitigation selected by the data owner. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data.

9. The Contractor shall immediately notify and work cooperatively with the State data owner to respond timely and correctly to public records act requests.

10. The Contractor will dispose of records of State data as instructed by the State during the term of

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

this agreement. No data shall be copied, modified, destroyed or deleted by the Contractor other than for normal operation or maintenance during the Agreement period without prior written notice to and written approval by the State.

11. Remote access to data from outside the territorial United States, including remote access to data by authorized support staff in identified support centers, is prohibited unless approved in advance by the State.

12. The physical location of Contractor’s data center where the Data is stored shall be within the territorial United States.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT J: Add, Delete, or Substitute Staff Request Form

Contractor Name

Contractor Phone No.

Date

Project Name Contract Number

Personnel To Be Added

Personnel Replaced Proposed Effective

Date Classification

Resume Meets MQs and Requirements

Personnel To Be Deleted

Date Effective Reason

Reason:

Reason:

Reason:

Reason:

Comments/Special Instructions Please note:

State Acceptance Contractor Acceptance

Division/Project Contractor (if other than an individual, state

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

whether a corporation, partnership, etc.)

By (Authorized Signature) By (Authorized Signature)

Printed Name of Person Signing Printed Name of Person Signing

Title Title

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT K: DELIVERABLE EXPECTATION DOCUMENT (DED)

CONTRACTOR NAME:

EDD CONTRACT NUMBER: DED NUMBER:

DELIVERABLE TITLE:

DELIVERABLE START DATE:

DELIVERABLE END DATE:

CONTRACTOR PERSONNEL/

CLASSIFICATION ASSIGNED

TO DELIVERABLE:

ESTIMATED HOURS FOR

COMPLETION:

TOTAL COST OF

DELIVERABLE:

DESCRIPTION OF TASKS AND DELIVERABLE:

DESCRIPTION OF ACCEPTANCE CRITERIA:

Deliverable Expectation Document has been reviewed and agreed upon and all work associated with this DED will be performed in accordance with the DED and the provisions of the Contract.

AUTHORIZED AND APPROVED:

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

Contractor Contract Manger (Print Name):

Contractor Contract Manager / Date:

EDD Contract Manager (Print Name):

EDD Contract Manager / Date:

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT L: Deliverable Acceptance Document (DAD)

CONTRACTOR NAME:

EDD CONTRACT

NUMBER:

DAD NUMBER:

DELIVERABLE TITLE:

TOTAL COST OF

APPROVED

DELIVERABLE:

DESCRIPTION OF TASKS AND DELIVERABLE (Should summarize deliverable as appropriate)

STATE ACCEPTANCE / REJECTION STATEMENT (For deficiencies that are not material, indicate conditions of acceptance, as applicable)

Upon approval, this deliverable is mutually agreed to and hereby incorporated into the contract.

Contractor Contract Manger (Print Name):

Contractor Contract Manager / Date:

EDD Contract Manager (Print Name):

EDD Contract Manager / Date:

Note: All invoices must be accompanied by an EDD approved Deliverable Acceptance Document (DAD) and deliverable. If an invoice is submitted without an approved DAD, EDD's Contract Manager shall take no action until said document is received.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT M: Work Authorization Process/Form

The following deliverables will be produced in accordance with this Work Authorization and the provisions of the Contact.

part 1: general information

Work Authorization Number

Purpose/Objective/Goal

Schedule of Deliverable Completion

Contractor Personnel to be Assigned (Classification)

State Responsibilities

Acceptance Criteria

Contract Number part 2: work authorization fixed cost

Task # Deliverable Description Total Hours Hourly Rate Total Cost

Total

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

part 3: approval signatures

Contractor Signature: Date of Approval:

Contractor Title:

EDD Signature: Date of Approval:

EDD Printed Name:

EDD Title:

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT N: Work Authorization Acceptance Form part 1: general information

EDD Contract Number

Project Name

Project Criticality Rating

Program Branch

Controlling Division

Author

Type of Acceptance Phase or Major Task Acceptance Final Product Acceptance

PART 2: LIST OF COMPLETED TASKS

Task # Task Description Planned

Completion Date

Actual

Completion Date

Variance

(# of Days) part 3: reason(s) for variance(s)

Task # Describe the reason(s) for variance(s) from the schedule baseline (if applicable)

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

part 4: approval signature(s)

The Tasks Listed In Part 2 Are:

Approved As Is

Approved With Changes Describe Changes:

Denied - Does Not Meet Expectations Explain Detail:

Contractor Signature: Date of Approval:

Contractor Printed Name:

Contractor Title:

EDD Signature: Date of Approval:

EDD Printed Name:

EDD Title:

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT O: Translation Vendors

The Contractor shall ensure that Unemployment Insurance customers with Limited English

Proficiency (LEP) have meaningful access and equal opportunity to participate in its services.

The Contractor shall provide services under this contract, which may include, but are not limited to oral and written language translation. Communication with customers shall occur, and could take the following methods: telephone, email, online portal, or in person.

If the Contractor provides services by telephone or in person, the Contractor shall employ or contract with a language support services vendor or vendors capable of providing oral language services and communications in at least the following languages: English, Spanish, Armenian, Tagalog, Cantonese, Mandarin, Vietnamese, and Korean. The Contractor’s language support services vendor(s) shall be approved by the EDD. The Contractor shall bear its own costs associated with its language support services vendor(s).

If the Contractor, or its support services vendor(s), cannot obtain interpretation in the customer’s preferred spoken language at the time of the call, Contractor shall work with the Contract Monitor to determine if the EDD has another resource for the specified language and interpretation.

If the Contractor, or its support services vendor(s), cannot obtain interpretation in the customer’s language at the time of the call after good faith efforts to acquire language services, Contractor shall ensure that the customer receives a return telephone or relay call in the customer’s preferred spoken language, within a reasonable timeframe of the original contact with Contractor.

If the Contractor provides services by email or online portal, on or after December 1, 2022, the Contractor shall employ or contract with a language support services vendor(s) capable of providing written translation of all static, non-personalized documents containing unemployment insurance Vital Information in the following languages which include, but are not limited to: English, Spanish, Armenian, Tagalog, Simplified and Traditional Chinese, Vietnamese, Korean, Arabic, Farsi, Punjabi, Russian, Japanese, Hindi, Khmer, and Thai. The Contractor’s language support services vendor(s) shall be approved by the EDD. The Contractor shall bear its own costs associated with its language support services vendor(s).

The Contractor, or its support services vendors, shall not rely on ad hoc interpreters or translators (untrained and untested bilingual persons who are providing informal interpreter support).

Language translators shall meet the minimum standard of qualifications as outlined in the solicitation documents.

Upon a customer’s request, the Contractor, or its support services vendor(s), shall read EDD documents

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

and notices aloud to customers in their preferred language within a reasonable timeframe of the request.

Contractor shall not rely on interpreters to simplify documents or provide explanations to a customer.

The Contractor, or its support services vendor(s), will ensure interpreters and translators abide by professional interpreter and translator ethics, including confidentiality, impartiality, and accuracy; and will have received professional training and provide an ongoing demonstration of qualifications to serve in the role of interpreter and/or translator.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

EXHIBIT P: ICM System Interfaces

The table below describes the integrations that will be needed as part of the ICMS solution. These interfaces will be reviewed and updated during the Design / Discovery phase of this project.

System Internal / External

Interaction Type Interaction Direction

PURPOSE FOR THE

INTERFACE

Benefits Check Printing

Internal Paper Check Information

Single direction, ICM to System

Data for printing of benefit checks

1099G Printing Internal Data Exchange Single direction, ICM to System

Data for 1099G Printing

Noticing and Mail Service

Internal Data Exchange Single direction, ICM to System

Documents for printing/sending notices

New Employee Registration (NER)

Internal New Employee Cross Matches

Bi-Directional Provide information for verification of any new employees registered by employers

Pitney Bowes Internal Mail Exchange Bi-Directional Standard Mailing Address Verification Services

DocuSign Internal Document Verification

Bi-Directional Verification for customers who apply via phone or paper, and create a portal profile after the fact

Document Management System (DMS)

Internal Data Exchange Bi-Directional Exchange and reference documents through the DMS solution.

Accounting and Compliance Enterprise System

(ACES)

Internal Information Exchange

Bi-Directional Benefit interface charge file for tax-rated employers, to produce the DE 428T.

Exchanging of over-payment information. ACEScurrently provides account management and collection functions for the State's employment tax program.

Investigation Division Information

Internal Fraud Information Bi-Directional Interface to EDD's fraud investigation system.

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

System Internal / External

Interaction Type Interaction Direction

PURPOSE FOR THE

INTERFACE

System (IDIS) Base Wage System / Wage Gathering System

Internal Wage Information Bi-Directional Base wage data to determine and calculate the claimant's eligibility for UI, DI and PFL claims.

Salesforce Work- Sharing

Internal Data / Information Exchange

Bi-Directional Interface for employer and claimant information

AskEDD Internal Information Exchange

Single direction, System to ICM

Respond to messages from the ICMS solution.

Salesforce Knowledge Management System (KMS)

Internal Information Exchange

Bi-Directional ICMS knowledge management information sent and received.

Contact Center Internal Data / Information Exchange

Bi-Directional Respond to customer inquiries and concerns, access customer data to provide information

Data Warehouse Internal Data Exchange Single direction, ICM to System

Benefits data to the data warehouse

Portals (Salesforce Multiple Claims Per Address, Salesforce Shared Claimant Portal, Medical Provider Portal, Employer Portal)

Internal Data / Information Exchange

Bi-Directional Receive information gathered on the portals for benefits processing.

Sending information updates to the portals based on the ICMS processing and staff responses.

CalJobs Internal Labor Market Information

Bi-Directional File contains UI claimant data for those claimants who filed a UI claim and met the selection criteria for CalJobs referrals

Department of Child Support Services

External Identity Verification

Bi-Directional Child Support Intercept

Identity Verification Services

External Identity Verification

Bi-Directional Identity proofing of the claimants

Department of External Data Exchange Bi-Directional Provide information related to

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

External

Interaction Type Interaction Direction

PURPOSE FOR THE

INTERFACE

Labor (DOL) the annual audit of UI benefits.

ACH Payments External Payment Information

Bi-Directional Processes credit card payments from claimants for over-payment reimbursement.

The payment information is then sent back to EDD benefit accounting

NASWA Integrity Data Hub

External Data Exchange Bi-Directional Interfaced to be used for interstate fraud detection

Franchise Tax Board (FTB)

External Data Exchange Bi-Directional FTB can leverage claimant's state taxes, lottery winnings and unclaimed property to offset an EDD over-payment

Bank Payments External Payment Exchange

Bi-Directional Sending and receiving payment information.

Department of Consumer Affairs

(DCA)

External Provider Verification

Single direction, System to ICM

Doctor License file to validate the doctor's medical licenses.

National Directory of New Hires

External Payment Information

Bi-Directional Mandated for UI Fraud detection. Data crossmatch with UI payments to see if claimants are collecting wages out of state.

Fi$Cal External Payment Information

Single direction, ICM to System

Produce the Monthly Payment History Extract File for Fiscal Program's Division, Updates to/from benefit accounting system to/from fund accounting system

State Compensation Insurance Fund

(SCIF)

External Claim Information Single direction, System to ICM

Receive the claim data from

SCIF

California External Income, Referral, Bi-Directional Send Quarterly UI Benefit

State of California Employment Development Department

Pre-Solicitation

DRAFT

RFP 3362

External

Interaction Type Interaction Direction

PURPOSE FOR THE

INTERFACE

Department of Health and Human Services (CA

DHHS)

and Clinical Information information to CA DHHS

Social Security Administration

(SSA)

External Identity Verification

Bi-Directional SSA Verification via Interstate Connection System when a claim is re-opened

Electronic benefit payments

External Payment Information

Single direction, ICM to…