9-Attachment U - GLO Compliance Package.pdf

Attachment U

GLO COMPLIANCE PACKAGE

GLO INFORMATION SECURITY APPENDIX

1. Definitions

“Breach of Security” or “Breach” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information including data that is encrypted if the person accessing the data has the key required to decrypt the data.

“Personal Identifying Information” or “PII” means information that alone, or in conjunction with other information, identifies an individual, as defined at Tex. Bus. & Com. Code § 521.002(1).

“Sensitive Personal Information” or “SPI” means the information categories listed at Tex. Bus. & Com. Code § 521.002(2).

2. Security and Privacy Compliance

a. Contractor shall keep all PII and SPI received or generated under the Contract and any documents related thereto strictly confidential.

b. Contractor shall comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations and directives.

c. Contractor shall implement administrative, physical, and technical safeguards to protect PII and SPI that are no less rigorous than accepted industry practices including, without limitation, the guidelines in the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework Version 1.1. All such safeguards shall comply with applicable data protection and privacy laws.

d. Harris County shall legally bind any contractors and their subcontractors to the same requirements stated herein and obligations stipulated in the Contract and documents related thereto. Contractor shall ensure that the requirements stated herein are imposed on Contractor’s subcontractor(s).

e. Contractor will not share PII or SPI with any third parties, except as necessary for Contractor’s performance under the Contract.

f. Contractor will ensure that initial privacy and security training, and annual training thereafter, is completed by its employees and contractors, including any subcontractor, that have access to PII or SPI or who create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise personally handle PII or SPI on behalf of Harris County. Contractor agrees to maintain and, upon request, provide documentation of training completion.

g. Any PII or SPI maintained or stored by Contractor or any contractor, including any subcontractor, must be stored on servers or other hardware located within the physical borders of the United States and shall not be accessed outside of the United States.

3. Data Ownership

a. The GLO shall retain full ownership of all data, including PII and SPI, provided to Contractor by Harris County or the GLO.

b. Upon termination of the Contract, Contractor shall promptly return to Harris County and/or the GLO all Harris County-owned or GLO-owned data possessed by Contractor and its employees, agents, or contractors, including any subcontractor. Contractor shall retain no copies or back-up records of Harris County-owned or GLO-owned data. If such return is infeasible, as mutually determined by Harris County and the GLO and Contractor, the obligations set forth in this Appendix, with respect to Harris County-owned or GLO-owned data, shall survive termination of the Contract and Contractor shall limit any further use and disclosure of GLO Data to the purposes that make the return of Harris County-owned or GLO-owned data infeasible. In lieu of the requirements in this Section 3.2, Harris County or the GLO may direct Contractor to destroy any Harris County-owned or GLO-owned data in Contractor’s possession. Any such destruction shall be verified by Contractor and Harris County and/or the GLO.

4. Data Mining

Attachment Y

GLO INFORMATION SECURITY APPENDIX

a. Contractor agrees not to use PII or SPI for unrelated purposes, advertising or advertising-related services, or for any other purpose not explicitly authorized by Harris County in the Contract or any document related thereto.

b. Contractor agrees to take all reasonably feasible physical, technical, administrative, and procedural measures to ensure that no unauthorized use of PII or SPI occurs.

5. Breach of Security

a. Contractor agrees to provide Harris County and/or the GLO with the name and contact information for a Contractor employee which shall serve as the primary data security contact.

b. Upon discovery of a Breach of Security or suspected Breach of Security by the Contractor, Contractor agrees to notify Harris County as soon as possible upon discovery of the Breach of Security or suspected Breach of Security, but in no event shall notification occur later than 24 hours after discovery. Within 72 hours, Contractor agrees to provide, at minimum, a written preliminary report regarding the Breach or suspected Breach to Harris County with root cause analysis including a log detailing the data affected.

c. The initial notification and preliminary report shall be submitted to the GLO Information Security Officer at brandon.rogers@glo.texas.gov.

d. Contractor agrees to take all reasonable steps to immediately remedy a Breach of Security and prevent any further Breach of Security.

e. If the Breach of Security includes SPI, including Social Security Numbers, payment card information, or health information, Contractor agrees to provide affected individuals complimentary access for one (1) year of credit monitoring services.

6. Right to Audit

a. Upon the Harris County’s request and to confirm Contractor’s compliance with this Appendix, Contractor grants Harris County, or the GLO, permission to perform an assessment, audit, examination, investigation, or review of all controls in the Contractor’s, or any of Contractor’s contractors, including any subcontractor’s, physical and/or technical environment in relation to PII or SPI. Contractor agrees to fully cooperate with such assessment by providing access to knowledgeable personnel, physical premises, documentation, infrastructure, and application software that stores, processes, or transports PII or SPI. In lieu of a Harris County or GLO-conducted assessment, audit, examination, investigation, or review, Contractor may supply, upon Harris County or GLO approval, the following reports: SSAE16, ISO/ICE 27001 Certification, FedRAMP Certification, and PCI Compliance Report. Contractor shall ensure that this clause concerning the Harris County and the GLO’s authority to assess, audit, examine, investigate, or review is included in any subcontract it awards.

b. At the GLO’s request, Contractor agrees to promptly and accurately complete a written information security questionnaire provided by Harris County or the GLO regarding Contractor’s business practices and information technology environment in relation to GLO Data.

GLO CONTRACTOR BID CERTIFICATION

GLO Contractor Bid Certification

Subrecipient: Harris County Contract Number:

Contractor Name:

Contractor Address: Phone:

1. I understand that I am bidding on a contract funded with federal dollars and administered by the Texas General Land Office. I understand that debarment by either the State of Texas or the federal government will make me ineligible.

2. I understand that all work must be completed in accordance with federal construction requirements, CDBG and CDBG-DR Program requirements, and state and local requirements, including but not limited to the following, as applicable:

• International Residential Code (IRC) – new construction and reconstruction;

• Housing Quality Standards (HQS) – for rehabilitated properties;

• All local building codes, standards, and specifications; and

• All standards and requirements defined by the Texas General Land Office (GLO), Harris County, the Harris County Engineering Department, and the Harris County Community Services Department

(CSD).

3. I hereby certify that all work performed will meet or exceed applicable codes, standards, and specifications as they apply to the work for which I am submitting a response. I also understand that compliance with applicable minimum codes, standards, and specifications will be considered part of my contract in the event that my offer is accepted by the above-referenced Subrecipient. I understand that all provisions also apply to my subcontractors and their officers, agents and employees, and I shall be liable for acts of non-compliance of subcontractors. I understand that failure to meet or exceed applicable codes, standards, and specifications may result in debarment from future federally funded contracts.

4. I understand that I must provide a 1-2-10 warranty on all work performed, specifically:

• 1 year warranty on the entire home;

• 2 year warranty on mechanical, electrical and plumbing components; and

• 10 year warranty on structural components.

Failure to complete warranty work in a timely manner may result in debarment from future federally funded construction contracts.

5. I understand that up to twenty percent (20%) of project construction funds may be retained for thirty (30) days pending completion of the Final Inspection and Verification. Failure to complete punch list items or warranty work during this time will result in forfeiture of the 20% retainage.

Signature of Contractor

Date

GLO CERTIFICATION OF BIDDER REGARDING CIVIL RIGHTS LAWS AND REGULATIONS

U.S. Department of Housing and Urban Development

INSTRUCTIONS

CERTIFICATION OF BIDDER REGARDING Executive Order 11246 and Federal Laws Requiring Federal Contractor to adopt and abide by equal employment opportunity and affirmative action in their hiring, firing, and promotion practices.

This includes practices related to race, color, gender, religion, national origin, disability, and veterans’ rights.

NAME AND ADDRESS OF BIDDER (include ZIP Code)

CERTIFICATION BY BIDDER

Bidder has participated in a previous contract or subcontract subject to Civil Rights Laws and Regulations.

☐ Yes ☐ No

The undersigned hereby certifies that:

☐ The Section 3 Clause is included in the Solicitation. A written Section 3 plan was prepared and submitted as part of the IFB proceedings (if contract equals or exceeds $100,000).

☐ The Non-Segregated Facilities clause is included in the Solicitation. No segregated facilities will be maintained as required by Title VI of the Civil Rights Act of 1964.

☐ The Equal Employment Opportunity clause is included in the Solicitation (if contract equals or exceeds $10,000).

☐ The Equal Employment Opportunity for Workers With Disabilities clause is included in the Solicitation.

Have you ever been or are you being considered for sanction due to violation of Executive Order 11246, as amended?

☐ Yes ☐ No

NAME AND TITLE OF SIGNER (Please type)

SIGNATURE DATE

GLO CONTRACTOR CERTIFICATION OF EFFORTS TO FULLY COMPLY WITH

EMPLOYMENT AND TRAINING PROVISIONS OF SECTION 3

THE BIDDER REPRESENTS AND CERTIFIES AS PART OF ITS BID/OFFER THAT IT:

☐ Is a Section 3 Business Concern. A Section 3 Business Concern means a business concern:

1. That is 51% or more owned by Section 3 Resident(s); or

2. Whose permanent, full-time employees include persons, at least 30% of whom are currently Section 3 Residents, or

3. That provides evidence of a commitment to subcontract in excess of 25% of the dollar value of all subcontracts to be awarded to Section 3 Business Concerns, that meet the qualifications set forth in paragraphs 1 or 2 herein.

☐ Is NOT a Section 3 Business Concern, but who has and will continue to seek compliance with Section 3 by certifying the following efforts to be undertaken.

EFFORTS TO AWARD SUBCONTRACTOR TO SECTION 3 CONCERNS (Check ALL that apply)

☐ By contacting business assistance agencies, minority contractors’ associations and community organizations to inform them of the contracting opportunities and requesting their assistance in identifying Section 3 businesses which may solicit bids for a portion of the work. Contractors and Subcontractors must post all new hire opportunities with the local Workforce Solutions Center and WorkinTexas.com.

☐ By advertising contracting opportunities by posting notices, which provide general information about the work to be contracted and where to obtain additional information, in the common areas of the applicable development(s) owned and managed by a Housing Authority.

☐ By providing written notice to all known Section 3 Business Concerns of contracting opportunities. This notice should be in sufficient time to allow the Section 3 Business Concerns to respond to bid invitations ☐ By following up with Section 3 Business Concerns that have expressed interest in the contracting opportunities.

☐ By coordinating meetings at which Section 3 Business Concerns could be informed of specific elements of the work for which subcontract bids are being sought.

☐ By conducting workshops on contracting procedures and specific contracting opportunities in a timely manner so that Section 3 Business Concerns can take advantage of contracting opportunities.

☐ By advising Section 3 Business Concerns as to where to seek assistance to overcome barriers such as inability to obtain bonding, lines of credit, financing, or insurance and aiding Section 3 Business in qualifying for such bonding, financing, insurance, etc.

☐ Where appropriate, breaking out contract work into economically feasible units to facilitate participation by Section 3 businesses.

☐ By developing and using a list of eligible Section 3 Business Concerns.

☐ By actively supporting and undertaking joint ventures with Section 3 Businesses.

EFFORTS TO PROVIDE TRAINING AND EMPLOYMENT TO SECTION 3 RESIDENTS

☐ By entering into a “first source” hiring agreements with organizations representing Section 3 Residents.

☐ By establishing training programs, which are consistent with the requirements of the Department of Labor, specifically for Section 3 Residents in the building trades.

☐ By advertising employment and training positions to dwelling units occupied by Category 1 and 2 residents.

☐ By contacting resident councils and other resident organizations in the affected housing development request assistance in notifying residents of the training and employment positions to be filled.

☐ By arraigning interviews and conducting interviews on the job site.

☐ By undertaking such continued job-training efforts as may be necessary to ensure the continued employment of Section 3 Residents previously hired for employment opportunities.

☐ By posting job vacancies in Work-In-Texas or with my local Workforce Solutions Center.

Contractor Name/Business Name: _________________________ Date:_____________________

Authorized Representative Name: ____________________ Signature:_____________________________

Authorized Representative Name: ____________________ Signature:_____________________________