ACQ1048-1_Contract_-_ES_S.pdf

STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

GENERAL SERVICES DIVISION

OFFICE OF PROCUREMENT SERVICES

4200 SURFACE ROAD, COLUMBUS, OH 43228-1395

OPTIONAL USE CONTRACT FOR: ELECTRONIC POLLBOOKS

CONTRACT No.: ACQ1048-1

CONTRACT ID: CTR016168

EFFECTIVE DATES: 8/3/2023 to 12/31/2025

SUPPLIER: ELECTION SYSTEMS & SOFTWARE LLC

The Department of Administrative Services has accepted bids submitted in response to Invitation to Bid No. SRC0000011272. The evaluation of the bid response(s) has been completed. The bidder(s) listed herein have been determined to be the responsive and responsible bidder(s) and have been awarded a contract for the items(s) listed. The respective bid response, including the Instructions to Bidders and Standard Terms and Conditions, special contract terms and conditions, any bid addenda, specifications, pricing schedules and any attachments and exhibits incorporated by reference and accepted by DAS become a part of this Contract.

This Contract is effective beginning and ending on the dates noted above unless, prior to the expiration date, the Contract is renewed, terminated or cancelled in accordance with the Contract Terms and Conditions.

CONTRACT RENEWAL. This Contract may be renewed after the ending date of the Contract solely at the discretion of the Contracting Agency for a period of one month. Any further renewals will be by mutual agreement between the Contractor and the Contracting Agency for any number of times and for any period of time. The cumulative time of all mutual renewals may not exceed December 31, 2029 unless the Contracting Agency determines that additional renewal is necessary.

This Contract is available to the Ohio Secretary of State and Ohio County Boards of Election (agencies), as applicable.

Agencies are eligible to make purchases of the listed supplies and/or services in any amount and at any time as determined by the agency. The State makes no representation or guarantee that agencies will purchase the volume of supplies and/or services as advertised in the Invitation to Bid.

This Contract and any Amendments thereto are available from the OhioBuys public portal at the following address:

https://supplier-emarketplace.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

Signed: _____________________________________________________________________

Kathleen C. Madden, Director Date

SPECIFICATIONS AND REQUIREMENTS

1.1 SCOPE: This Contract is for State of Ohio County Boards of Election to purchase Electronic Pollbook equipment and services.

1.2 APPLICABLE DOCUMENTS: This Contract will only be awarded to Contractors for Electronic Pollbook equipment certified by the Ohio Secretary of State.

1.3 SPECIFICATIONS: Electronic Pollbook equipment certified by the Ohio Secretary of State.

1.4 DELIVERY: Delivery of equipment will be negotiated between the Ohio County Boards of Election and the Contractor.

1.5 WARRANTY: The minimum warranty for Electronic Pollbook equipment will be the manufacturer warranty. The

Contractor may provide additional warranties and optional extended warranties.

1.6 WORK HOURS: All on-site work hours will be at the discretion of the County Boards of Election.

STANDARD TERMS AND CONDITIONS

State of Ohio Standard Terms and Conditions (revised 10/18/22) will apply to this Contract.

CONTRACT SPECIFIC TERMS AND CONDITIONS

ORDER OF PRIORITY

The order of priority of the Contract will be the following: 1.) Specifications and Requirements; 2) Contract Specific Terms and Conditions; 3) Standard Terms and Conditions.

EVALUATION

Bids will be evaluated to ensure they are responsive and responsible.

CONTRACT AWARD

A contract will be awarded to all responsive and responsible Bidders.

OHIO SECRETARY OF STATE SECURITY SUPPLEMENT

The Ohio Secretary of State Security Supplement attached as Exhibit 1 is incorporated into the Contract.

ADDITIONAL INSURANCE REQUIREMENTS

Professional Liability

Technology Professional Liability (Errors and Omissions) Insurance appropriate to the Contractor’s profession, with limits not less than $2,000,000 per occurrence or claim, $2,000,000 aggregate. Coverage must be sufficiently broad to respond to the duties and obligations as is undertaken by Contractor in this Contract and must cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract.

Cyber Liability

Cyber liability (first and third party) with limits not less than $5,000,000 per claim, $10,000,000 aggregate. Coverage must be sufficiently broad to respond to the duties and obligations as is undertaken by Contractor in this Contract and must include, but not be limited to, claims involving infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage must provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with limits sufficient to respond to these obligations.

COOPERATIVE PURCHASING CONTRACT

This Contract may be utilized by Cooperative Purchasing Members. “Cooperative Purchasing Members” or “Co-op Members” are entities that qualify for participation in the State’s cooperative purchasing program under Section 125.04 of the Ohio Revised Code (“ORC”) and that have completed the steps necessary to participate in that program. They may include Ohio political subdivisions, such as counties, townships, municipal corporations, school districts, conservancy districts, township park districts, park districts created under Chapter 1545 of the ORC, regional transit authorities, regional airport authorities, regional water and sewer districts, and port authorities. They also may include any Ohio county board of elections, state institutions of higher education, private fire companies, private, nonprofit emergency medical service organizations, and chartered nonpublic schools.

If a purchase is made from this Contract by an entity that is not properly registered with the State’s Cooperative Purchasing Program, it may be a violation of law, may be contrary to the entity’s competitive bidding requirements, and will be a breach of this Contract by the Contractor. If a Cooperative Purchasing Member relies upon this Contract to issue a purchase order or other ordering document, the Cooperative Purchasing Member “steps into the shoes” of the State under this Contract. The Cooperative Purchasing Member’s order and this Contract are between the Contractor and the Cooperative Purchasing Member. The Contractor must look solely to the Cooperative Purchasing Member for performance, including payment. The Contractor agrees to hold the state of Ohio harmless with regard to Cooperative Purchasing Member’s orders and Cooperative Purchasing Member’s performance. DAS may cancel this Contract and may seek remedies if the Contractor fails to honor its obligations under an order from a Cooperative Purchasing Member.

CONTRACTOR REVENUE SHARE

The Contractor must pay to the State a share of the sales transacted under this Contract as a fee to the State to cover the estimated costs the State will incur in administering this Contract and the Services offered under it (“Revenue Share”).

The Contractor must remit the Revenue Share in U.S. dollars within 30 days after the end of the quarterly reporting period. The Revenue Share that the Contractor must pay under this Contract equals ¾ of 1% of the total quarterly sales reported. The Revenue Share must be included in the prices reflected in any order and reflected in the total amount charged to the State, and the Contractor may not add a surcharge to orders under this Contract to cover the cost of the Revenue Share.

The Contractor must remit any amount due as the result of a quarterly or closeout sales report at the time the quarterly or closeout sales report is submitted to the Department of Administrative Services, Office of State Purchasing. To ensure the payment is credited properly, the Contractor must identify the payment as a “State of Ohio Revenue Share” and include this Contract number, total report amount, and reporting period covered.

Contractor will pay the Revenue Share by check remittance, both normal and overnight, credit card payment via the State’s epayment portal, or ACH payment, if approved by the State, using the instructions below

Check remittance:

Follow the remittance instructions on the required Quarterly Sales Report and Revenue Share Remittance Form at the following link, https://das.ohio.gov/revenueshareform.

Credit Card Payments:

To pay by credit card, use the following link, https://epay.das.ohio.gov/Payment, select “Revenue Share” as the payment type and follow the on-screen prompts.

ACH Payments:

If this payment method is approved by the State, the State will provide payment instructions to Contractor.

If the full amount of the Revenue Share is not paid within 30 days after the end of the applicable reporting period, the non-payment will constitute a contract debt to the State. The State may setoff any unpaid Revenue Share from any amount owed to the Contractor under this Contract and employ all other remedies available to it under Ohio law for the non-payment of the Revenue Share. Additionally, if the Contractor fails to pay the Revenue Share in a timely manner, the failure will be a breach of this Contract, and the State may terminate this Contract for cause as set forth herein and seek damages for the breach.

PROHIBITION OF THE EXPENDITURE OF PUBLIC FUND FOR OFFSHORE SERVICES

No State Cabinet Agency, Board or Commission will enter into any contract to purchase services provided outside of the United States or that allows State data to be sent, taken, accessed, tested, maintained, backed-up, stored, or made available remotely outside (located) of the United States, unless a duly signed waiver from the State has been attained. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid for services the Contractor performs outside of the United States for which it did not receive a waiver. The State does not waive any other rights and remedies provided to the State in the Contract.

Further, no State agency, board, commission, State educational institution, or pension fund will make any purchase from or investment in any Russian institution or company. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid to Contractor for purchases or investments in a Russian institution or company in violation of this paragraph. The provisions of this paragraph will expire when the applicable Executive Order is no longer effective.

The Contractor must complete the Contractor/Subcontractor Affirmation and Disclosure Form affirming the Contractor understands and will meet the requirements of the above prohibition. During the performance of this Contract, if the Contractor changes the location(s) disclosed on the Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

CONTRACTOR QUARTERLY SALES REPORT

The Contractor must report the quarterly dollar value (in U.S. dollars and rounded to the nearest whole dollar) of the sales to Cooperative Purchasing Members under this Contract by calendar quarter (e.g. January-March, April-June, July- September and October-December). The dollar value of the sale is the price paid by the Contract user for the products and/or services listed on the purchase order or other encumbering document, as recorded by the Contractor.

To submit this quarterly sales report, the Contractor is responsible for obtaining access to OhioBuys and must report the quarterly dollar value of sales to Cooperative Purchasing Members to the Department of Administrative Services (DAS) via the Internet using OhioBuys at the following web address supplier-emarketplace.ohio.gov . If no sales occur, the Contractor must report zero. The report must be submitted no later than thirty (30) days following the completion of the reporting period.

The Contractor shall also submit a close-out report within one hundred and twenty (120) days after the expiration of this Contract. The Contract expires upon the physical completion of the last outstanding task or delivery order of the Contract.

The close-out report must cover all sales not shown in the final quarterly report and reconcile all errors and credits. If the Contractor reported all contract sales and reconciled all errors and credits on the final quarterly report, then the Contractor should show zero “0” sales in the close-out report.

If the Contractor fails to submit sales reports, falsifies reports or fails to submit sales reports in a timely manner, DAS may terminate this Contract.

CONTRACTOR ELECTRONIC POLLBOOK PERFORMANCE REQUIREMENTS:

Contractors must meet the following performance standards.

Reporting and notice requirements:

Upon receiving the electronic pollbooks, the county boards must conduct acceptance testing to ensure the function and state of the equipment. Contractor must remedy any issues communicated to the Contractor that are found during acceptance testing as soon as possible.

Contractor must submit to the Ohio Secretary of State status reports for each county client pursuant to this section.

Such report may be in the form of a spreadsheet and should be submitted to OhioBVME@OhioSoS.gov. If electronic pollbooks are used solely for Election Day voting, the status reports must be submitted for each county 10 days prior to any Election Day and include the following:

The date and/or status for the logic and accuracy testing of the electronic pollbook system, if the Vendor is performing the logic and accuracy testing;

The date the final database of registered voters was delivered to the county;

The method by which the county will perform final updates to the loaded records to ensure all absentee voters are properly notated;

The contact information for Contractor onsite support personnel being utilized by the counties, if applicable;

and

A description of any identified Contractor concerns with any individual county and equipment performance or support prior to the upcoming election.

Once early voting has begun, if the county utilizes the electronic pollbook system to check-in voters, status reports containing the information in the above bullet point shall be submitted weekly to the email address above for each county through the end of the early voting period.

If an issue exists in the performance of the electronic pollbook system that results in the inability to check-in voters as intended and not otherwise caused by human error (an “Issue”), the Ohio Secretary of State must be immediately notified, and such notification shall be made no later than the day the issue occurs.

Contractor must immediately report any widespread Issue to the Secretary of State’s office that occurs on Election Day. A widespread Issue is the same Issue that affects more than three polling locations.

Contractor shall submit to the Ohio Secretary of State an after-action report 10 days after Election Day describing any Issues that resulted during early voting and election day, along with recommended fixes that the Contractor, State, or counties, as applicable, should implement to improve election day outcomes.

Contractor shall provide to the Secretary of State and the BOE notification of any certified updates or upgrades to operating systems or software installed on the electronic pollbooks as soon as possible after Contractor implements the certified updates or upgrades.

Contractor shall provide advanced written notice as soon as possible, but at least six months in advance, of any applicable software reaching end of life (or other timeframe in accordance with the manufacturer’s end of life policy, if different).

Contractor Customer Support Obligations:

Contractor shall provide the counties a generic logic and accuracy checklist. Subject to the counties engaging Contractor to do so, Contractor can assist counties in reviewing and, if necessary, revising logic and accuracy testing procedures to ensure the proper steps are followed for each particular election's requirements (i.e., difference in processing early in-person voters and Election Day voters, or the difference between voter check-in for a primary vs. a general election).

Contractor must provide basic customer support (including a toll-free customer support phone number for the counties to call and helpdesk e-mail support) to the counties that is included in the base cost of the equipment provided under this Contract.

Contractor must offer options to counties for additional support. Additional support options must include, but are not limited to, Election Day support, election setup support, and on-site support during election operations. Additional support options offered must be provided in Contractor’s response to the solicitation and include information on pricing and maximum response times. Upon completion of any such additional support, Contractor shall invoice the requesting county using the pricing in this Contract.

INVITATION TO BID INSTRUCTIONS

Instructions, Terms and Conditions for Bidding that apply to the solicitation.

EXHIBIT 1

Ohio Secretary of State Security Supplement

I. Introduction

This security supplement establishes additional actions that the Contractor must employ to defend the security and integrity of the County Boards of Elections (“BOE”) infrastructure. In addition to the reporting requirements in the Contract, all reports, notices, and disclosures required to be sent to the BOE shall be emailed to the email addresses provided by the BOE.

II. Protection of Board of Elections’ Data

A. All solutions shall operate at the moderate level baseline as defined in the current published version of National Institute of Standards and Technology (“NIST”) CSF and CIS control framework for elections, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications. The electronic pollbook environment shall provide the BOE with 24/7 monitoring of the services through a real-time web-based “dashboard” that enables them to monitor, in real or near real time, Contractor’s performance of the established service level agreements and promised operational parameters.

B. Contractor shall obtain an annual audit that meets the American Institute of Certified Public Accountants (“AICPA”)

Statements on Standards for Attestation Engagements (“SSAE”) No. 18, Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. All audits will be at the sole expense of Contractor and the results shall be provided to the BOE within 30 days of its completion each year upon request subject to non-disclosure agreements.

At no cost to the BOE, Contractor shall immediately remedy any, critical, or high risk findings and other vulnerabilities, as mutually agreed upon between the parties identified in each audit as they pertain to the services provided under this Contract.

C. “Sensitive Data” constitutes any type of computerized data that presents a high or moderate degree of risk if released or disclosed without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which the BOE has discretion under the law to release data, particularly when the release shall be made only according to State of Ohio policy or procedure. The Sensitive Data may be certain types of personally identifiable information (“PII”) that is also sensitive; such as medical information, social security numbers, financial account numbers, or data obtained from the Bureau of Motor Vehicles or other governmental entities. The computerized data may also contain other types of information not associated with a particular individual such as security and infrastructure records. BOE data is considered Sensitive Data under this Contract.

To protect Sensitive Data as described in this Contract, Contractor shall:

1. Adopt a written policy defining procedures for how Contractor shall detect, evaluate, and respond to adverse events that may indicate an incident or an attempt to attack or access Sensitive Data or the infrastructure associated with Sensitive Data. A written copy of this policy shall be provided to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov upon request subject to non-disclosure agreements.

2. Maintain in confidence all Sensitive Data Contractor may obtain, maintain, process, or otherwise receive from or through the BOE in the course of this Contract.

3. Use and permit employees, officers, agents, and independent contractors to only use any Sensitive Data received from the BOE solely for those purposes expressly contemplated by the Contract.

4. Not sell, rent, lease, disclose, or permit employees, officers, agents, and independent contractors to sell, rent, lease, or disclose, any such Sensitive Data to any third party, except as expressly permitted under this Contract or required by applicable law, regulation, or court order.

5. Take all commercially reasonable steps to:

i. Protect the confidentiality of Sensitive Data received from the BOE; and

ii. Establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to Sensitive Data received by Contractor from the BOE.

6. Provide access to Sensitive Data only to those individual employees, officers, agents, and Independent Contractors who require access to such information in connection with the performance of Contractor’s obligations under this Contract.

7. Upon request by the BOE, promptly destroy or return to the BOE, in a format agreed to between the parties, all

Sensitive Data received from or through the BOE.

8. Contractor shall cooperate with any reasonable attempt by the BOE to monitor Contractor’s compliance as agreed upon between the parties.

9. Notify the BOE of the location in which Contractor will be performing the work for this Contract, and all the locations where Sensitive Data will be stored.

10. Comply with all existing State of Ohio and county data security policies, standards and procedures in County and State data contracts as the date of this agreement designed to ensure the following:

i. Security and confidentiality of Sensitive Data.

ii. Protection against anticipated threats or hazards to the security or integrity of Sensitive Data.

iii. Protection against the unauthorized access to, disclosure of, or use of Sensitive Data.

11. Suggest and develop modifications to existing data security policies and procedures or draft new data security policies and procedures when gaps are identified.

12. Store and maintain all Sensitive Data within the United States of America unless expressly authorized in writing by the BOE.

III. Contractor Electronic Mail

A. All Contractor email accounts shall utilize Domain-based Message Authentication, Reporting and Conformance (“DMARC”) services. DMARC provides email owners the ability to protect their email from unauthorized use by verifying authenticity. A key component of DMARC is Domain Keys Identified Mail (“DKIM”). The purpose of implementing DMARC and DKIM is to protect domains from being used in business email compromise attacks, phishing emails, email scams and other cyber threat activities. Additional information regarding DMARC services can be found at: https://cyber.dhs.gov/bod/18-01/#introduction-to-email-authentication.

B. Contractor’s email services shall utilize Sender Policy Framework (“SPF”). SPF can direct mail servers to reject mail not coming from a validated source.

C. Contractor email accounts used by employees providing support to the BOE shall use Multi-Factor Authentication

(“MFA”). Any MFA solution used must follow NIST 800-63B standards, and can be achieved by using smart cards, certificates, one time use password tokens or biometrics. MFA using text messaging or simple message service (“SMS”) is not permitted.

IV. Network Protection

A. As to the electronic pollbook environment, Contractor shall deploy network protection steps to ensure protection of any computers or servers used in direct support Sensitive Data on the electronic pollbook environment. Contractor’s system and devices, at a minimum, shall be protected by a firewall segmenting Sensitive Data from the corporate network. This firewall shall have intrusion prevention features enabled between all systems and the rest of the corporate network.

B. This firewall, along with the firewall used to protect the corporation from the internet, shall be configured using “least privilege” and “deny by default” methodology. Least privilege constitutes that only authorized services intended to allow Contractor to provide services to the BOE may be configured on this firewall. Deny by default constitutes that all other services or devices not explicitly allowed shall be denied by the firewall.

C. Electronic pollbooks that have the software capability to transmit data are prohibited from doing so over the internet.

If a BOE is going to utilize the ability to transmit data, all data must be transmitted over a virtual private network (“VPN”) using MFA or a secured access point name (“APN”).

D. All Contractor firewalls shall be configured to log both allowed and denied traffic. All logs from the firewall to the electronic pollbook environment shall be sent to Contractor’s SIEM software. Upon request of the BOE or the Secretary of State’s Office, any log information shall be forwarded to the Secretary of State subject to non-disclosure agreements.

V. Vulnerability Management and Application Security

Contractor shall implement a vulnerability management program that will identify all vulnerabilities. The vulnerability management program shall:

A. Perform scans on at least a weekly basis against Contractor’s internal computer network and the electronic pollbook environment network using an automated tool. This tool shall be able to detect when new systems are added to the local network, or if the authorized systems have a new port or protocol activated that was not validated against the system baseline. Scanning shall occur on Contractor’s internal computer and electronic pollbook environment network.

B. Issue an automated alert to the Contractor identifying all vulnerabilities. Records that these scans have been performed and remediated shall be kept in accordance with a Contractor retention policy. All such records shall be retained for at least one year. The BOE or Secretary of State’s Office may request these records at any time to ensure that Contractor maintains compliance with this provision all records may be produced upon request subject to non-disclosure agreements.

C. On a weekly basis, Contractor’s internal computer network and the electronic pollbook environment network shall be scanned using a Security Content Automation Protocol (“SCAP”) compliant vulnerability scanner. A written copy of the vulnerability scanner report shall be provided, in a format, agreed to between the BOE and Contractor, to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov upon request subject to non-disclosure agreements.

D. Remediate critical and high vulnerabilities identified on Contractor systems used to support the BOE and shall promptly notify the BOE of any such remediation. Notification shall, at a minimum, be provided in the form of a formal communication via email to the email addresses provided by the BOE and the Ohio Secretary of State Help Desk at Vulnerability@OhioSOS.gov. This disclosure shall also include a remediation plan that will allow for such critical and high vulnerabilities to be remediated in a timely manner, as follows:

1. “Critical” and “High” vulnerabilities, as defined by NIST’s National Vulnerability Database (“NVD”) Common

Vulnerability Scoring System (“CVSS”), related to the BOE’s system shall be remediated within 15 calendar days after an initial investigation is performed subject to certification requirements.

2. All other vulnerabilities shall be remediated within a reasonable time of initial detection.

E. If Contractor develops applications, they shall abide by the Secure Software Development Lifecycle to ensure applications do not introduce risk into the organization. All applications shall comply with the BOE’s respective application security policies.

F. Contractor shall implement a public-facing vulnerability disclosure policy that is displayed on the Contractor’s website and a process to remediate reported vulnerabilities in a timely period, i.e., less than 120 days of report.

Reported relevant high and critical vulnerabilities shall be disclosed to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov within the first 30 days of the initial report. A written copy of this policy shall be provided to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov up on request.

VI. Whitelisting and Secure Baseline Images

A. Only authorized devices shall be connected to Contractor’s network. Contractor shall ensure that device whitelisting is performed at the network switch level, or at a minimum verify that all unused network ports are disabled, and connected devices are authorized. “Port security,” which prevents unauthorized devices from forwarding packets on the network, requires a managed switch. Network switch(es) shall log all port activity to Contractor’s SIEM. Upon request of the BOE, any log information shall be forwarded to the BOE’s SIEM subject to non-disclosure agreements.

B. All systems used by Contractor to support the BOE shall utilize secure baseline master images. These baseline images shall ensure that only required software is installed on the computer, and that those images are secure.

C. Contractor shall ensure that only permitted software is installed on the pollbook system. Application whitelisting shall be deployed on the pollbook systems in order to support this function. The whitelisting solution shall deny any program that is not explicitly allowed. This provides additional protection from malware and other harmful programs.

VII. Access Control

A. Contractor shall limit the number of individuals assigned administrative access to the electronic pollbook environment computers and configure system access to remove default credential assignments. Contractor users shall not sign into accounts on a normal basis with administrative privileges on the workstations. Users with administrative privileges shall maintain two separate user accounts: a standard user account and an administrative account. The administrative account is to be only used for administrative actions. Accounts with administrative privileges shall only be used on a limited basis, and only when it is required for system administrative functions. At no point in time shall an administrative account on a workstation also be used to access the internet.

B. Access control restrictions also constitute least privilege in accordance with Article IV herein, and strong passwords in accordance with Article X below. All such restrictions shall be enforced for all devices or systems where authentication is performed within the electronic pollbook environment; including but not limited to active directory, local accounts, service accounts, and remote access accounts.

C. All access control events shall be logged. All access control logs shall be sent to Contractor’s SIEM. Upon request of the BOE or Secretary of State’s Office, any log information shall be forwarded to the Secretary of State subject to non-disclosure agreements.

VIII. Secure Channels for Remote Access

A. All remote access to Contractor’s electronic pollbook environment network by Contractor, Contractor’s vendors, independent contractors, or otherwise, shall use secure remote access technologies such as Transport Layer Security (TLS v1.2 or higher) or IPSEC. MFA is required and shall comply with the requirements set forth in Article X below.

B. Shell based access to hosts or terminals shall use public key authentication or MFA over a secure transport such as

SSH for access to the electronic pollbook environment. Telnet and other “cleartext” protocols are strictly prohibited.

C. All remote access solutions to the electronic pollbook environment shall use a VPN with MFA.

D. All remote access traffic to the electronic pollbook environment shall be encrypted pursuant to the State of Ohio’s data encryption standards and policies. These policies can be found at: https://das.ohio.gov/buying-and-selling/policies.

E. All encryption systems shall comply with NIST Federal Information Processing Standard (“FIPS”) 140-2.

F. All remote access sessions shall be logged and stored in a SIEM. BOE and the Secretary of State’s Office may require that this log information also be forwarded to the Secretary of State SOS subject to non-disclosure agreements.

IX. Strong Passwords/Passphrases and MFA

A. All users of Contractor’s systems supporting BOE accounts shall utilize the following controls:

1. Each user shall have a unique username and password/passphrase.

2. Users are strictly prohibited from sharing passwords/passphrases or multi-factor authentication devices.

3. Subject to system certification, passwords/passphrases shall be complex and comply with the following complexity requirements.

i. Be at least 15 characters in length.

ii. Contain three out of the following four items:

a. Number;

b. Lower-case letter;

c. Upper-case letter; and

d. Symbol.

iii. Does not contain the user’s name or username.

iv. Avoid using simple dictionary words without proper lengths or complexity. Passwords/passphrases should be generated from pass phrases or uncommon word associations. For example, “Buckeyes68!AreBlah.”

iv. Simple letter substitution is NOT considered acceptable. For example, D1ct10n4ry is not a secure password.

4. Contractor shall work with the BOE and State to include the following password requirement in a future certification of the Pollbook and electronic pollbook environment applications: Passphrases shall be encrypted while stored in a format prescribed under NIST 800-53.

B. MFA shall be used for:

2. All accounts accessing or modifying voter registration data and election systems within the electronic pollbook environment.

3. All email access for employees or contractors supporting the BOE.

3. All administrative access to the electronic pollbook environment.

4. All remote access sessions to the electronic pollbook environment.

C. Any MFA solution must comply with the requirements in Section III(C). Examples of MFA that meets these requirements include Microsoft Azure MFA, YubiKey or Google Authenticator.

D. The BOE shall be responsible for purchasing the devices necessary to incorporate the MFA.

X. Wireless Device Security

A. If wireless networks are being used to support the BOE within the electronic pollbook environment, such wireless networks shall leverage WPA2 or later with AES encryption. If pre-shared keys (passwords/passphrases) are pre-configured with wireless networks, the wireless passwords/passphrases shall be changed upon initial deployment and every three months or at any time prescribed by the BOE or the Secretary of State’s Office. Wireless network names (“SSIDs”) shall be hidden and shall not identify the product that they support or reference any board of elections or governmental activity.

B. Wireless access points to the electronic pollbook environment should be updated when manufacturer or firmware updates are made available. At a minimum, Contractor shall check for firmware updates on a monthly basis.

Wireless networks to the electronic pollbook environment shall also be secured with a firewall and intrusion detection system. Upon request of the BOE or the Secretary of State’s Office, any log information shall be forwarded to the SOS subject to non-disclosure agreements.

XI. Malware Management

A. Contractor shall have an endpoint security solution deployed on every workstation and network connected server supporting the electronic pollbook environment. At a minimum, this shall include:

1. Anti-malware to quarantine or delete malicious or suspicious files, rootkits, trojans and spyware.

2. Host passed firewall services, if not using the Windows Firewall.

3. Endpoint detection and response (“EDR”) to intelligently identify and flag activity not covered by current malware signatures.

4. Centralized administrative console to set policy, deploy software and process alerts.

5. Automatic daily updates of all software components and signatures.

6. Root cause analysis with forensics to show how the infection occurred along with actions the malware took.

B. Any infected workstations and servers within the electronic pollbook environment shall be immediately disconnected

(unplugged) from the network but remain powered on until forensically sound evidence capture is appropriately conducted and approved. Contractor shall immediately report the incident to the BOE. Notification shall, at a minimum, be provided in the form of a formal communication via email to the email addresses provided by the BOE and the Ohio Secretary of State Help Desk at SecurityEvent@OhioSOS.gov.

C. All endpoint security events within the electronic pollbook environment shall be sent directly to Contractor’s SIEM.

XII. Data Encryption

Pursuant to the State of Ohio’s data encryption standards and policies, all data containing social security numbers or driver license numbers shall be encrypted at rest, while being transmitted across the network, or taken off-site via portable media.

Secure transfers shall use compliant encryption algorithms that ensure data has not been altered in transit or at rest. At a minimum, this applies to voter registration data in electronic format that resides within Contractor’s networks and systems.

These encryption policies can be found at: https://das.ohio.gov/buying-and-selling/policies.

All encryption systems shall comply with NIST FIPS 140-2. These FIPS 140-2 compliant systems are listed at:

https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search.

XIII. Penetration and Controls Testing

A. A Security and Data Protection Audit may be performed as mutually discussed and agreed to between the BOE and Contractor. This includes, but is not limited to, a thorough review of Contractor controls, security/privacy functions and procedures, data storage and encryption methods, backup/restoration processes, as well as security penetration testing and validation. The BOE or the Secretary of State’s Office, upon the express request and authorization of the BOE acting on the BOE’s behalf, may utilize a third-party entity agreed to by Contractor to perform a Security and Data Protection Audit to demonstrate that all requirements are met.

B. Contractor shall perform annual penetration testing. Contractor shall grant BOE and the Secretary of State permission to review a full copy of the annual penetration testing, including all findings, and Contractor’s remediation plan for any findings upon request. The penetration testing information shall be provided to the email address provided by the BOE and to the Secretary of State’s Office at VendorSecurity@OhioSOS.gov.

XIV. Criminal Background Checks

A. Contractor shall conduct criminal background checks on all employees or contractors supporting any Sensitive Data upon initiation of employment with Contractor and must also confirm that all current employees supporting the Sensitive Data have completed and passed a background check. Upon request, Contractor shall attest that a background check has been completed and that no disqualifying criminal offenses have been committed.

B. “Sensitive services” constitute those services that:

1. Require access to customer/consumer/agency employee information;

2. Relate to the BOE’s computer networks, information systems, databases, or secure facilities under circumstances that would permit modifications to such systems; or

3. Involve unsupervised access to secure facilities.

C. Contractor shall adopt and maintain a policy to review background checks upon date of hire and when needed or requested by BOE and consider whether any convictions should bar employment. At the request of the BOE or the Secretary of State’s Office, Contractor shall attest that Contractor maintains the policy and provide a copy of such policy upon request.

XV. Physical Security

A. Contractor facilities that support the electronic pollbook environment shall have video surveillance systems monitoring sensitive locations and all egress/ingress locations.

B. All computer systems that support the electronic pollbook environment shall be located in a secure location segmented from general locations where access is restricted to authorized parties whose role is to support said system.

C. Access to those locations shall be logged for historical tracking.

XVI. Supply Chain Risk

A. Contractor must avoid known defects in software and hardware. Contractor must avoid third-party software components with known vulnerabilities when less vulnerable alternatives are available and will not compromise required functionality. Contractor shall favor components and providers exposed to higher standards of rigor from stringent assessments and have a record of fixing discovered vulnerabilities in a timely manner, which in turn allows them to maintain greater long-term stability.

B. Contractor shall not use any products from known hostile nation states or any reseller of their products. Contractor should refer to the following U.S. Department of Commerce website link for a list of vendors that shall not be used:

U.S. Department of Commerce. To search this list, use the search bar and type a company name to verify if that entity is on the “Entity List.” Additionally, Contractor should refer to the following DHS Directive link (https://cyber.dhs.gov/directives/) to maintain awareness of any emergency directives or binding operational directive guidance that could impact vendors, third-party solutions, devices in use at BOE or within the BOE stakeholder base.

C. Contractor shall conduct an annual supply chain risk assessment that is compliant with NIST 800-161. Assessments should be carried out by qualified personnel, independent of design and development. A written copy of this assessment shall be supplied to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov within 30 days of the execution of this Contract.

D. Upon request and subject to non-disclosure requirements, Contractor shall share all software and hardware bills of materials to the State to account for cost and risk of devices. This written copy shall be supplied to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov within 30 days of the execution of this Contract.

E. Contractor shall respond to any BOE and Secretary of State’s Office issued guidance and timelines mandating review, response, and/or mitigation based on federal partner emergency directives, binding operational directives, or trusted third-party information sharing.

XVII. Contractor Responsibilities Related to Reporting of Concerns, Issues, and Security/Privacy Issues

A. If, over the course of the Contract, a Security Incident (defined in XVII(D) below) occurs or is ongoing, whether detected by the BOE, another third-party entity, or Contractor, due to factors that did not exist within an in-scope environment or service prior to the commencement of any contracted service associated with this Contract, Contractor shall:

1. Notify BOE of the issue or acknowledge receipt of the issue within 24 hours of Contractor’s determination of unauthorized access. Notification shall, at a minimum, be conveyed in the form of a formal communication via email to the email addresses provided by the BOE and the Ohio Secretary of State Help Desk at SecurityEvent@OhioSOS.gov.

2. Within 24 hours from the communication of the issue from the BOE, present a potential exposure or issue assessment document to the BOE’s account representative and the Secretary of State’s Office Chief Information Security Officer with a high-level assessment as to resolution actions and a plan.

3. Within four calendar days of direction from the BOE, or other mutually agreeable timeframe, implement, to the extent commercially reasonable, measures to minimize the BOE’s exposure to the security or privacy issue until such time as the issue is resolved.

4. Upon approval from the BOE and the Secretary of State’s Office, implement a permanent repair to the identified issue. If the issue was caused solely by the Vendor, then the Vendor shall implement a repair at Vendor’s cost.

5. Notwithstanding the foregoing, during any early voting period and on any Election Day at which the software or hardware purchased under this Contract is in use, Contractor shall notify the BOE and the Secretary of State not later than one hour upon reasonable suspicion or initial detection that a security or privacy issue has arisen.

B. Actual or Attempted Access or Disclosure

If Contractor determines that there is any actual or accidental disclosure of, or actual loss of any Sensitive Data by Contractor or any of its subcontractors (collectively “Disclosure”) and/or any unauthorized intrusions into Contractor’s or any of its subcontractors’ facilities or secure systems that results in the actual access to and/or actual disclosure of State or BOE data (collectively “Intrusion”), Contractor shall immediately:

1. Notify the BOE within 24 hours of Contractor’s determination of unauthorized access. Notification shall, at a minimum, be conveyed in the form of a formal communication via email to the email addresses provided by the BOE and the Ohio Secretary of State Help Desk at SecurityEvent@OhioSOS.gov. Notwithstanding the foregoing, Contractor shall notify the BOE within one hour of Contractor becoming aware of any actual, attempted, or suspected Disclosure or Intrusion during any early voting period and on any Election Day at which the software or hardware under this Contract is used.

2. Investigate and determine if an Intrusion and/or Disclosure has occurred.

3. Fully cooperate with the BOE and the Secretary of State’s Office in determining the effect of the Disclosure or

Intrusion and fully cooperate to mitigate the consequences of the Disclosure or Intrusion.

4. Specify corrective action to be taken.

5. Take corrective action to prevent further Disclosure and/or Intrusion.

C. Unapproved Disclosures and Intrusions: Contractor Responsibilities

1. Contractor shall, as soon as is practical, make a report to the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov including details of the Disclosure and/or Intrusion and the corrective action Contractor has taken to prevent further Disclosure and/or Intrusion. In the event of a Disclosure, Contractor shall cooperate fully with the BOE and the Secretary of State’s Office so that the BOE and Secretary of State’s office can notify the affected persons as to the facts and circumstances of the Disclosure of the Sensitive Data.

Additionally, Contractor shall cooperate fully with all government regulatory agencies and/or law enforcement agencies that have jurisdiction to investigate a Disclosure and/or any known or suspected criminal activity.

2. If over the course of delivering services to the BOE, Contractor becomes aware of an issue that resulted in actual access to secure information and actual disclosure of State or BOE data that was not detected by security and privacy teams, Contractor shall notify the BOE within eight hours. Notification shall, at a minimum, be conveyed in the form of a formal communication via email to the email addresses provided by the BOE and the Ohio Secretary of State Help Desk at SecurityEvent@OhioSOS.gov.

3. In the event of a conflict between the terms and conditions of the Contract and provisions in this security supplement pertaining to security scans and breaches, the notification requirement in this Article shall not supersede any stricter requirements in the Contract, which due to the nature of an active breach shall take precedence over this Article. The BOE may elect to work with Contractor under mutually agreeable terms for those specific resolution services at that time or elect to address the Disclosure and/or Intrusion independent of Contractor.

4. If Contractor identifies a potential issue with maintaining an “as provided” BOE infrastructure element in accordance with a more stringent State of Ohio level security policy, Contractor shall identify and communicate the nature of the issue to the BOE at the email addresses provided by the BOE and the Secretary of State’s Office at VendorSecurity@OhioSOS.gov, and, if possible, outline potential remedies.

D. Security Incident Reporting and Indemnification Requirements

1. Contractor shall immediately report any Security Incident that results in the actual access to or disclosure of State or BOE data as soon as it becomes aware of any such incident to BOE, the Secretary of State’s Office, Multi-State Information Sharing and Analysis Center (“MS-ISAC”) and the Cybersecurity and Infrastructure Security Agency (“CISA”). For the purposes of this document, “Security Incident” constitutes the attempted or successful unauthorized access, use, disclosure, modification, or destruction of Sensitive Data.