Addendum #2 10-1-2026.pdf

Date Printed: Oct 1, 2026 Page: 1 FORM ID: WV-PRC-CRFQ-002 2020/05

Department of Administration Purchasing Division 2019 Washington Street East Post Office Box 50130 Charleston, WV 25305-0130

State of West Virginia Centralized Request for Quote

Info Technology

Proc Folder: 1978722 Reason for Modification:

Doc Description: OER-WV Excavator Environmental Advisory Service Addendum #2 is issued to publish agency responses to vendor submitted questions and publish SAAS Addendum.

Proc Type: Central Master Agreement

Date Issued Solicitation Closes Solicitation No Version

2026-10-01 2026-10-08 13:30 CRFQ 0313 DEP2700000004 3

BID RECEIVING LOCATION

BID CLERK

DEPARTMENT OF ADMINISTRATION

PURCHASING DIVISION

2019 WASHINGTON ST E

CHARLESTON WV 25305

US

VENDOR

Vendor Customer Code:

Vendor Name :

Address :

Street :

City :

State : Country : Zip :

Principal Contact :

Vendor Contact Phone: Extension:

FOR INFORMATION CONTACT THE BUYER

Joseph (Josh) E Hager III

(304) 558-2306 joseph.e.hageriii@wv.gov

Vendor Signature X FEIN# DATE

All offers subject to all terms and conditions contained in this solicitation

Date Printed: Oct 1, 2026 Page: 2 FORM ID: WV-PRC-CRFQ-002 2020/05

ADDITIONAL INFORMATION

The West Virginia Purchasing Division is soliciting bids on behalf of West Virginia Department of Environmental Protection. Office of Environmental Remediation (WVDEP/OER) to establish a contract to create and maintain a West Virginia Excavator Environmental Advisory Service and Property Transfer Monitoring Service per the attached specifications and terms and conditions.

INVOICE TO SHIP TO

ENVIRONMENTAL

PROTECTION

STATE OF WEST VIRGINIA

OFFICE OF

ENVIRONMENTAL

REMEDIATION

JOBSITE - SEE

SPECIFICATIONS

601 57TH ST SE

CHARLESTON WV No City WV

US US

Line Comm Ln Desc Qty Unit Issue Unit Price Total Price 1 West Virginia Excavator Environmental

Advisory Service

1.00000 EA

Comm Code Manufacturer Specification Model #

77101700

Extended Description:

Please enter the total bid amount from the Exhibit A Pricing Pager into Commodity Line 1.

SCHEDULE OF EVENTS

Line Event Event Date

Revised 6/8/2012

SOLICITATION NUMBER: [Insert RFQ, RFP No.] Addendum Number: [Insert Number]

The purpose of this addendum is to modify the solicitation identified as [insert RFQ, RFP No.] (“Solicitation”) to reflect the change(s) identified and described below.

Applicable Addendum Category:

[ ] Modify bid opening date and time

[ ] Modify specifications of product or service being sought

[ ] Attachment of vendor questions and responses

[ ] Attachment of pre-bid sign-in sheet

[ ] Correction of error

[ ] Other

Description of Modification to Solicitation:

Additional Documentation: Documentation related to this Addendum (if any) has been included herewith as Attachment A and is specifically incorporated herein by reference.

Terms and Conditions:

1. All provisions of the Solicitation and other addenda not modified herein shall remain in full force and effect.

2. Vendor should acknowledge receipt of all addenda issued for this Solicitation by completing an Addendum Acknowledgment, a copy of which is included herewith.

Failure to acknowledge addenda may result in bid disqualification. The addendum acknowledgement should be submitted with the bid to expedite document processing.

ATTACHMENT A

RFI: Questions from vendors for CRFQ DEP27*04

Q.1. Website, hosting, and information-security requirements

Please identify the State’s requirements for hosting location, system availability, user authentication, accessibility, data encryption, backup and disaster recovery, audit logging, record retention, incident reporting, and cybersecurity review. Please confirm whether the website must comply with a specified accessibility standard and whether WVDEP will provide a domain, branding requirements, or identity-management integration.

A.

Hosting, Domain, Branding, Identity-management Integration: Responsibility of Vendor.

System availability: 99% uptime.

User Authentication: The vendor shall support third-party multi-factor authentication integration with the public jurisdiction third-party identity provider to safeguard personal data and non-public data.

Accessibility: Must be WCAG 2.1 Level AA compliant

Backup and Disaster Recovery: “3-2-1” backup strategy

Data Encryption: All personally identifiable information including but not limited to: caller name, caller address, caller email, or caller phone number should be encrypted in transit and at rest.

Audit Logging: At minimum, user login attempts, logout, and other auth operations should be audit logged.

Record Retention: Records would only need to be retained for the duration of the contract. Vendor may be requested to export data to .csv or other standard format

Incident Reporting: Any security incidents should notify DEP staff (DLR and ITS) and WVOT Security.

Cybersecurity review: We usually mandate industry best practices for security posture and don't usually review beyond the technical architecture for hosted solutions. For on-prem solutions, we deploy to our baseline standards:

- TLS everywhere + zero trust

- Encryption in transit and at rest

- Secure passwords between stack components (e.g. between application and DB, service accounts, etc.)

The vendor must follow the WV Office of Technology SaaS Addendum

Q.2. Historical ticket and advisory volumes

Please provide, for each of the last three to five years, the number of original tickets, update tickets, tickets intersecting monitored sites or buffer zones, and advisories generated. If available, please provide monthly volumes and the approximate percentage received outside normal business hours.

https://www.state.wv.us/admin/purchase/Documents/WVCloud-SaaSProcurementAddendum.pdf

A. Here is the last 4 years of Dig Ticket and Dig Advisory Data. WVDEP started screening out Update Tickets in late 2025/Early 2026. We do not maintain records on update tickets. We do not have the ability to readily calculate after-hour ticket volumes.

2022 Tickets Audits Advisories

January 69 31 60

February 83 28 74

March 132 31 128

April 106 30 95

May 139 31 127

June 122 30 113

July 117 31 110

August 154 31 134

September 131 30 118

October 148 31 141

November 120 30 114

December 129 32 121

Totals 1450 366 1335

2023 Tickets Audits Advisories

January 136 31 128

February 159 28 132

March 127 31 117

April 87 30 76

May 117 31 111

June 116 30 107

July 156 31 118

August 151 31 142

September 107 30 98

October 145 31 117

November 181 30 137

December 175 31 133

Totals 1657 365 1416

2024 Tickets Audits Advisories

January 158 31 107

February 166 29 112

March 220 31 170

April 318 30 204

May 395 31 230

June 260 30 186

July 245 31 179

August 251 31 213

September 220 30 207

October 210 31 200

November 214 30 191

December 181 31 174

Totals 2838 366 2173

2025 Tickets Audits Advisories

January 174 31 149

February 276 28 228

March 309 31 282

April 280 30 242

May 221 31 206

June 314 30 241

July 338 31 320

August 333 31 300

September 322 30 303

October 365 31 340

November 322 30 288

December 349 31 323

Totals 3603 365 3222

2026 Tickets Audits Advisories

January 296 31 274

February 359 28 232

March 362 31 186

April 404 30 191

May 403 31 194

June 413 30 223

July

August

September

October

November

December

Totals 2237 181 1300

Q.3. · Property-review schedule and WVDEP approval timing

Please identify the expected dates for the annual parcel-data update and the two semiannual property reviews, notifications, and mailings.

A. The annual parcel data update must be completed within the first 6 months of the contract so the semiannual property reviews can be done twice within the annual contract period.

Q.4. · Required reports under General Terms §39

The solicitation checks the requirement for reports requested by the Agency or Purchasing Division.

Please identify the reports currently anticipated, their required content, format, frequency, and delivery deadline, and confirm that those reporting costs must be included in the Exhibit A pricing.

A. To date, no reports have been generated by the current vendor at the request of the Agency or

Purchasing Division. There is no pre-developed reporting format. This clause in the contract would only be for the purpose of auditing or addressing billing discrepancies. Otherwise, the Office of

Environmental Remediation maintains and reports its own data for the Agency’s or Purchasing Division’s needs.

Q.5. · Evaluation and contract-value formula

Exhibit A labels the quantities and totals for Items 1 and 2 as applying “each year,” while listing those items only once and listing the Property Transfer Monitoring Service separately for four years. Please provide the precise formula the State will use to calculate the Total Bid Amount. Should Items 1 and 2 be multiplied by four for evaluation, or included only once? Please also clarify whether the Commodity Line

1 amount will be an evaluation amount, a first-year amount, or a maximum four-year contract amount.

A. Item 1) Excavator Environmental Advisory Service: Contract pricing is only done per year so the “Total (each year)” bid amount and the Total Bid Amount will use the same number. *Note the “price per ticket” will ultimately be the figure used to determine the bid amount.

B. Item 2) Is the total bid amount of both setting up the property transfer monitoring service AND conducting the Property Transfer Monitoring Service for the first year.

C. Item 3) Assumes that no further setup costs are needed and only the Property Transfer Monitoring Service will be offered in the subsequent contract years. So we anticipate Item 3 having a lower total amount than Item 2 due to the system already being setup at that point.

Q.6. · Original versus Update Ticket classification

The prior solicitation’s Addendum No. 1 stated that WVDEP could not readily audit the percentage of original versus update tickets. The current Exhibit A nevertheless requires separate unit prices for those tickets. Please define the WV811 field or transaction type that determines whether a ticket is billed as an original Dig Ticket or an Update Ticket, explain how quantities will be verified for invoicing, and confirm whether every subsequent update to an original ticket is separately billable.

A. The “Type” field is used to establish whether a dig ticket is a normal, update, dig up, emergency, etc. ticket. If vendor wishes to submit a different bid amount for an update ticket vs. a normal ticket, then the vendor would need to differentiate the types and number of tickets on their invoice. The vendor may bid the same amount for both update and normal dig tickets.

Currently, as many as 40% of Dig Tickets currently generated are Update Tickets. The number of Update Tickets per billing cycle or per year is determined by the number of large, long-term projects taking place around LUC sites. Additionally, changes to the WV811 system in September 2026 regarding the expiration of dig tickets may influence the number of update dig tickets generated per billing cycle or per year. *Note the “price per normal ticket” and/or “price per update ticket” will ultimately be the figure used to determine the bid amount and not the total anticipated number of tickets per year.

Q.7. · Advisories for Update Tickets

Information issued with the prior solicitation indicated that WVDEP had requested that advisories no longer be generated for Update Tickets. Current §4.1.4 requires an advisory when a “Dig Ticket” intersects a site or buffer. Please confirm whether the successful Vendor must generate a new advisory for an Update Ticket and, if so, whether the one-hour deadline applies to every update.

A. The successful vendor will not need to generate a new advisory of Update Tickets. The one hour deadline only applies to dig tickets that require the creation of a Dig Advisory, so update tickets would not be required to meet the one-hour deadline.

Q.8. · Hours covered by the one-hour SLA

Please confirm whether the one-hour advisory deadline in §4.1.4 applies 24 hours per day, seven days per week, including weekends and State and federal holidays. Please identify any permitted maintenance, WV811 outage, incomplete-ticket, or other exceptions and the required turnaround for advisories manually requested under §4.1.5.2.

A. The one-hour advisory deadline does not make any exceptions for work hours, weekends, or

Holidays. Exceptions would be made for permitted maintenance, system outages, incomplete tickets, or other events outside of the vendor’s control.

Q.9. · Incumbent-system transition and data availability

The incumbent’s prior submission states that WVDEP sites, contacts, historical tickets, advisories, and mapping layers are presently maintained in the incumbent’s proprietary DigClean system. Please identify all data, files, ticket history, advisory history, WV811 registrations, contact records, and other materials that the State will provide to a successor Vendor; the required export formats; whether historical migration is mandatory; and the transition and go-live schedule.

A. Historical data migration is not necessary or mandatory. Current Georeferenced site data and associated project manager contact information will be submitted to the vendor before the contract start date so the system will be fully operational at the contract start date.

Q.10. · Property-data responsibility and volumes

Please clarify whether WVDEP will provide both current and historical ownership and parcel-boundary information or whether the Vendor must obtain current data from the West Virginia GIS Technical

Center, county assessors, or other sources. Please provide the current number of monitored sites, polygons and tax parcels, the counties represented, and historical semiannual counts of ownership changes and letters mailed. If owner mailing information is missing or inaccurate in public records, what additional research is required of the Vendor?

A. WVDEP maintains current LUC boundary ownership data in an excel file, but the data is incomplete. All other parcel data and historical ownership data is kept in copies of past Land Use Covenants. WVDEP does not maintain data regarding historical counts of ownership change. WVDEP does not have a standard system of notification of new owners of Land Use Covenant responsibilities, so no letters have been mailed. There are approximately 367 monitored sites consisting of 566 polygons (including engineering control areas). The number of tax parcels is unknown.

Q.11. · Qualification §§3.3 and 3.4

For §3.3, please confirm whether “interface with the West Virginia 811 system” requires an automated statewide technical interface capable of submitting mapping data and receiving tickets, or whether experience receiving and responding to WV811 notices through an existing project account is sufficient.

For §3.4, please identify acceptable evidence of five years’ experience and confirm whether qualifying experience may be demonstrated through the Vendor’s proposed personnel and subcontractors.

A. §3.3: The vendor must have working knowledge and experience of how to package and submit mapping information to the WV811 system as well as how to receive and process Dig Tickets from the WV811 system. This capability must be ready on day one of the contract. WVDEP does not know how the current contractor interfaces with the WV811 system or which systems are currently automated or how they are automated.

§3.4: WVDEP understands that the vendor may not readily have documentation of qualifying experience. Some possible documents may include business registration documents or historical invoices/purchase orders for similar services. A written summary of qualifying services may be submitted. Qualifying experience may be demonstrated through the Vendor’s proposed personnel and/or subcontractors. WVDEP wants to ensure that the winning bidder has the capability, capacity, and expertise to implement a contract of this scope and magnitude on the start date of the contract so necessary services are not interrupted.

Version 11-1--19

Software as a Service Addendum

1. Definitions:

Acceptable alternative data center location means a country that is identified as providing equivalent or stronger data protection than the United States, in terms of both regulation and enforcement. DLA Piper’s Privacy Heatmap shall be utilized for this analysis and may be found at https://www.dlapiperdataprotection.com/index.html?t=world-map&c=US&c2=IN.

Authorized Persons means the service provider’s employees, contractors, subcontractors or other agents who have responsibility in protecting or have access to the public jurisdiction’s personal data and non-public data to enable the service provider to perform the services required.

Data Breach means the unauthorized access and acquisition of unencrypted and unredacted personal data that compromises the security or confidentiality of a public jurisdiction’s personal information and that causes the service provider or public jurisdiction to reasonably believe that the data breach has caused or will cause identity theft or other fraud.

Individually Identifiable Health Information means information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Non-Public Data means data, other than personal data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the public jurisdiction because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information.

Personal Data means data that includes information relating to a person that identifies the person by first name or first initial, and last name, and has any of the following personally identifiable information (PII): government-issued identification numbers (e.g., Social Security, driver’s license, state identification card); financial account information, including account number, credit or debit card numbers; or protected health information

(PHI).

Protected Health Information (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer.

https://www.dlapiperdataprotection.com/index.html?t=world-map&c=US&c2=IN https://www.dlapiperdataprotection.com/index.html?t=world-map&c=US&c2=IN

Public Jurisdiction means any government or government agency that uses these terms and conditions. The term is a placeholder for the government or government agency.

Public Jurisdiction Data means all data created or in any way originating with the public jurisdiction, and all data that is the output of computer processing or other electronic manipulation of any data that was created by or in any way originated with the public jurisdiction, whether such data or output is stored on the public jurisdiction’s hardware, the service provider’s hardware or exists in any system owned, maintained or otherwise controlled by the public jurisdiction or by the service provider.

Public Jurisdiction Identified Contact means the person or persons designated in writing by the public jurisdiction to receive security incident or breach notification.

Restricted data means personal data and non-public data.

Security Incident means the actual unauthorized access to personal data or non-public data the service provider believes could reasonably result in the use, disclosure or theft of a public jurisdiction’s unencrypted personal data or non-public data within the possession or control of the service provider. A security incident may or may not turn into a data breach.

Service Provider means the contractor and its employees, subcontractors, agents and affiliates who are providing the services agreed to under the contract.

Software-as-a-Service (SaaS) means the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin-client interface such as a Web browser (e.g., Web-based email) or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

2. Data Ownership: The public jurisdiction will own all right, title and interest in its data that is related to the services provided by this contract. The service provider shall not access public jurisdiction user accounts or public jurisdiction data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of this contract or (4) at the public jurisdiction’s written request.

3. Data Protection and Privacy: Protection of personal privacy and data shall be an integral part of the business activities of the service provider to ensure there is no inappropriate or unauthorized use of public jurisdiction information at any time. To this end, the service provider shall safeguard the confidentiality, integrity and availability of public jurisdiction information and comply with the following conditions:

a) The service provider shall implement and maintain appropriate administrative, technical and physical security measures to safeguard against unauthorized access, disclosure or theft of personal data and non-public data. In Appendix A, the public jurisdiction shall indicate whether restricted information will be processed by the service provider. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the service provider applies to its own personal data and non-public data of similar kind. The service provider shall ensure that all such measures, including the manner in which personal data and non-public data are collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws, as well as the terms and conditions of this Addendum and shall survive termination of the underlying contract.

b) The service provider represents and warrants that its collection, access, use, storage, disposal and disclosure of personal data and non-public data do and will comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations, policies and directives.

c) The service provider shall support third-party multi-factor authentication integration with the public jurisdiction third-party identity provider to safeguard personal data and non-public data.

d) If, in the course of its engagement by the public jurisdiction, the service provider has access to or will collect, access, use, store, process, dispose of or disclose credit, debit or other payment cardholder information, the service provider shall at all times remain in compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) requirements, including remaining aware at all times of changes to the PCI DSS and promptly implementing all procedures and practices as may be necessary to remain in compliance with the PCI DSS, in each case, at the service provider’s sole cost and expense. All data obtained by the service provider in the performance of this contract shall become and remain the property of the public jurisdiction.

e) All personal data shall be encrypted at rest and in transit with controlled access.

Unless otherwise stipulated, the service provider is responsible for encryption of the personal data.

f) Unless otherwise stipulated, the service provider shall encrypt all non-public data at rest and in transit, in accordance with recognized industry practice. The public jurisdiction shall identify data it deems as non-public data to the service provider.

g) At no time shall any data or process – that either belong to or are intended for the use of a public jurisdiction or its officers, agents or employees — be copied, disclosed or retained by the service provider or any party related to the service provider for subsequent use in any transaction that does not include the public jurisdiction.

h) The service provider shall not use or disclose any information collected in connection with the service issued from this proposal for any purpose other than fulfilling the service.

i) Data Location. For non-public data and personal data, the service provider shall provide its data center services to the public jurisdiction and its end users solely from data centers in the U.S. Storage of public jurisdiction data at rest shall be located solely in data centers in the U.S. The service provider shall not allow its personnel or contractors to store public jurisdiction data on portable devices, including personal computers, except for devices that are used and kept only at its

U.S. data centers. With agreement from the public jurisdiction, this term may be met by the service provider providing its services from an acceptable alternative data center location, which agreement shall be stated in Appendix A. The Service Provider may also request permission to utilize an acceptable alternative data center location during a procurement’s question and answer period by submitting a question to that effect. The service provider shall permit its personnel and contractors to access public jurisdiction data remotely only as required to provide technical support.

4. Security Incident or Data Breach Notification: The service provider shall inform the public jurisdiction of any confirmed security incident or data breach.

a) Incident Response: The service provider may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as defined by law or contained in the contract. Discussing security incidents with the public jurisdiction shall be handled on an urgent as-needed basis, as part of service provider communication and mitigation processes defined by law or contained in the contract.

b) Security Incident Reporting Requirements: The service provider shall report a confirmed Security Incident as soon as practicable, but no later than twenty-four

(24) hours after the service provider becomes aware of it, to: (1) the department privacy officer, by email, with a read receipt, identified in Appendix A; and, (2) unless otherwise directed by the public jurisdiction in the underlying contract, the WVOT Online Computer Security and Privacy Incident Reporting System at https://apps.wv.gov/ot/ir/Default.aspx, and (3) the public jurisdiction point of contact for general contract oversight/administration. The following information shall be shared with the public jurisdiction: (1) incident phase (detection and analysis; containment, eradication and recovery; or post-incident activity), (2) projected business impact, and, (3) attack source information.

c) Breach Reporting Requirements: Upon the discovery of a data breach or unauthorized access to non-public data, the service provider shall immediately report to: (1) the department privacy officer, by email, with a read receipt, identified in Appendix A; and, (2) unless otherwise directed by the public jurisdiction in the underlying contract, the WVOT Online Computer Security and Privacy Incident Reporting System at https://apps.wv.gov/ot/ir/Default.aspx, and the public jurisdiction point of contact for general contract oversight/administration.

5. Breach Responsibilities: This section only applies when a data breach occurs with respect to personal data within the possession or control of the service provider.

a) Immediately after being awarded a contract, the service provider shall provide the public jurisdiction with the name and contact information for an employee of service provider who shall serve as the public jurisdiction’s primary security contact and shall be available to assist the public jurisdiction twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a data breach. The service provider may provide this information in Appendix A.

https://apps.wv.gov/ot/ir/Default.aspx https://apps.wv.gov/ot/ir/Default.aspx https://apps.wv.gov/ot/ir/Default.aspx https://apps.wv.gov/ot/ir/Default.aspx

b) Immediately following the service provider’s notification to the public jurisdiction of a data breach, the parties shall coordinate cooperate with each other to investigate the data breach. The service provider agrees to fully cooperate with the public jurisdiction in the public jurisdiction’s handling of the matter, including, without limitation, at the public jurisdiction’s request, making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law and regulation.

c) Within 72 hours of the discovery, the service provider shall notify the parties listed in 4(c) above, to the extent known: (1) date of discovery; (2) list of data elements and the number of individual records; (3) description of the unauthorized persons known or reasonably believed to have improperly used or disclosed the personal data; (4) description of where the personal data is believed to have been improperly transmitted, sent, or utilized; and, (5) description of the probable causes of the improper use or disclosure.

d) The service provider shall (1) cooperate with the public jurisdiction as reasonably requested by the public jurisdiction to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, if necessary, and prevent any further data breach at the service provider’s expense in accordance with applicable privacy rights, laws and regulations and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

e) If a data breach is a direct result of the service provider’s breach of its contract obligation to encrypt personal data or otherwise prevent its release, the service provider shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by state or federal law; (3) a credit monitoring service (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach (or other similar publication if the named publication has not issued an updated average per record per cost in the last 5 years at the time of the data breach); and (5) complete all corrective actions as reasonably determined by service provider based on root cause. The service provider agrees that it shall not inform any third party of any data breach without first obtaining the public jurisdiction’s prior written consent, other than to inform a complainant that the matter has been forwarded to the public jurisdiction’s legal counsel and/or engage a third party with appropriate expertise and confidentiality protections for any reason connected to the data breach. Except with respect to where the service provider has an independent legal obligation to report a data breach, the service provider agrees that the public jurisdiction shall have the sole right to determine: (1) whether notice of the data breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others, as required by law or regulation, or otherwise in the public jurisdiction’s discretion; and (2) the contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation. The service provider retains the right to report activity to law enforcement.

6. Notification of Legal Requests: The service provider shall contact the public jurisdiction upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the public jurisdiction’s data under this contract, or which in any way might reasonably require access to the data of the public jurisdiction. The service provider shall not respond to subpoenas, service of process and other legal requests related to the public jurisdiction without first notifying the public jurisdiction, unless prohibited by law from providing such notice.

7. Termination and Suspension of Service:

a) In the event of a termination of the contract, the service provider shall implement an orderly return of public jurisdiction data within the time period and format specified in the contract (or in the absence of a specified time and format, a mutually agreeable time and format) and after the data has been successfully returned, securely and permanently dispose of public jurisdiction data.

b) During any period of service suspension, the service provider shall not take any action to intentionally erase any public jurisdiction data.

c) In the event the contract does not specify a time or format for return of the public jurisdiction’s data and an agreement has not been reached, in the event of termination of any services or agreement in entirety, the service provider shall not take any action to intentionally erase any public jurisdiction data for a period of:

• 10 days after the effective date of termination, if the termination is in accordance with the contract period

• 30 days after the effective date of termination, if the termination is for convenience

• 60 days after the effective date of termination, if the termination is for cause

After such period, the service provider shall have no obligation to maintain or provide any public jurisdiction data and shall thereafter, unless legally prohibited, delete all public jurisdiction data in its systems or otherwise in its possession or under its control.

d) The public jurisdiction shall be entitled to any post-termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of the Contract.

e) The service provider shall securely dispose of all requested data in all of its forms, such as disk, CD/ DVD, backup tape and paper, when requested by the public jurisdiction. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the public jurisdiction.

8. Background Checks: The service provider shall conduct criminal background checks in compliance with W.Va. Code §15-2D-3 and not utilize any staff to fulfill the obligations of the contract, including subcontractors, who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty.

The service provider shall promote and maintain an awareness of the importance of securing the public jurisdiction’s information among the service provider’s employees and agents.

9. Oversight of Authorized Persons: During the term of each authorized person’s employment or engagement by service provider, service provider shall at all times cause such persons to abide strictly by service provider’s obligations under this Agreement and service provider’s standard policies and procedures. The service provider further agrees that it shall maintain a disciplinary process to address any unauthorized access, use or disclosure of personal data by any of service provider’s officers, partners, principals, employees, agents or contractors.

10. Access to Security Logs and Reports: The service provider shall provide reports to the public jurisdiction in CSV format agreed to by both the service provider and the public jurisdiction. Reports shall include user access (successful and failed attempts), user access IP address, user access history and security logs for all public jurisdiction files and accounts related to this contract.

11. Data Protection Self-Assessment: The service provider shall perform a Cloud Security Alliance STAR Self-Assessment by completing and submitting the “Consensus Assessments Initiative Questionnaire” to the Public Jurisdiction Identified Contact. The service provider shall submit its self-assessment to the public jurisdiction prior to contract award and, upon request, annually thereafter, on the anniversary of the date of contract execution. Any deficiencies identified in the assessment will entitle the public jurisdiction to disqualify the bid or terminate the contract for cause.

12. Data Center Audit: The service provider shall perform an audit of its data center(s) at least annually at its expense and provide a redacted version of the audit report upon request. The service provider may remove its proprietary information from the redacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit. Any deficiencies identified in the report or approved equivalent will entitle the public jurisdiction to disqualify the bid or terminate the contract for cause.

13. Change Control and Advance Notice: The service provider shall give 30 days, advance notice (to the public jurisdiction of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its characteristics.

14. Security:

a) At a minimum, the service provider’s safeguards for the protection of data shall include: (1) securing business facilities, data centers, paper files, servers, back-up systems and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability; (2) implementing network, device application, database and platform security; 3) securing information transmission, storage and disposal; (4) implementing authentication and access controls within media, applications, operating systems and equipment; (5) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law; and (6) providing appropriate privacy and information security training to service provider’s employees.

b) The service provider shall execute well-defined recurring action steps that identify and monitor vulnerabilities and provide remediation or corrective measures. Where the service provider’s technology or the public jurisdiction’s required dependence on a third-party application to interface with the technology creates a critical or high risk, the service provider shall remediate the vulnerability as soon as possible. The service provider must ensure that applications used to interface with the service provider’s technology remain operationally compatible with software updates.

c) Upon the public jurisdiction’s written request, the service provider shall provide a high-level network diagram with respect to connectivity to the public jurisdiction’s network that illustrates the service provider’s information technology network infrastructure.

15. Non-disclosure and Separation of Duties: The service provider shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of public jurisdiction data to that which is absolutely necessary to perform job duties.

16. Import and Export of Data: The public jurisdiction shall have the ability to securely import, export or dispose of data in standard format in piecemeal or in entirety at its discretion without interference from the service provider. This includes the ability for the public jurisdiction to import or export data to/from other service providers identified in the contract (or in the absence of an identified format, a mutually agreeable format).

17. Responsibilities: The service provider shall be responsible for the acquisition and operation of all hardware, software and network support related to the cloud services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the service provider.

18. Subcontractor Compliance: The service provider shall ensure that any of its subcontractors to whom it provides any of the personal data or non-public data it receives hereunder, or to whom it provides any personal data or non-public data which the service provider creates or receives on behalf of the public jurisdiction, agree to the restrictions, terms and conditions which apply to the service provider hereunder.

19. Right to Remove Individuals: The public jurisdiction shall have the right at any time to require that the service provider remove from interaction with public jurisdiction any service provider representative who the public jurisdiction believes is detrimental to its working relationship with the service provider. The public jurisdiction shall provide the service provider with notice of its determination, and the reasons it requests the removal.

If the public jurisdiction signifies that a potential security violation exists with respect to the request, the service provider shall immediately remove such individual. The service provider shall not assign the person to any aspect of the contract without the public jurisdiction’s consent.

20. Business Continuity and Disaster Recovery: The service provider shall provide a business continuity and disaster recovery plan executive summary upon request. Lack of a plan will entitle the public jurisdiction to terminate this contract for cause.

21. Compliance with Accessibility Standards: The service provider shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973.

22. Web Services: The service provider shall use web services exclusively to interface with the public jurisdiction’s data in near real time when possible.

23. Encryption of Data at Rest: The service provider shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all personal data.

24. Subscription Terms: Service provider grants to a public jurisdiction a license to:

a. Access and use the service for its business purposes;

b. For SaaS, use underlying software as embodied or used in the service; and

c. View, copy, upload, download (where applicable), and use service provider’s documentation.

25. Equitable Relief: Service provider acknowledges that any breach of its covenants or obligations set forth in Addendum may cause the public jurisdiction irreparable harm for which monetary damages would not be adequate compensation and agrees that, in the event of such breach or threatened breach, the public jurisdiction is entitled to seek equitable relief, including a restraining order, injunctive relief, specific performance and any other relief that may be available from any court, in addition to any other remedy to which the public jurisdiction may be entitled at law or in equity. Such remedies shall not be deemed to be exclusive but shall be in addition to all other remedies available at law or in equity, subject to any express exclusions or limitations in this Addendum to the contrary.

AGREED:

Name of Agency:____________________ Name of Vendor:___________________

Signature:__________________________ Signature:___________________________

Title:_____________________________ Title:_______________________________

Date:__________________________ ___ Date:_______________________________

Appendix A

(To be completed by the Agency’s Procurement Officer prior to the execution of the Addendum, and shall be made a part of the Addendum. Required information not identified prior to execution of the Addendum may only be added by amending Appendix A and the Addendum, via Change Order.)

Name of Service Provider/Vendor: ______________________________________________

Name of Agency:______________________________________________________________

Agency/public jurisdiction’s required information:

1. Will restricted information be processed by the service provider?

Yes No

2. If yes to #1, does the restricted information include personal data?

Yes No

3. If yes to #1, does the restricted information include non-public data?

Yes No

4. If yes to #1, may the service provider store public jurisdiction data in a data center in an acceptable alternative data center location, which is a country that is not the U.S.?

Yes No

5. Provide name and email address for the Department privacy officer:

Name: __________________________________________________________

Email address: ___________________________________________________

Vendor/Service Provider’s required information:

6. Provide name and contact information for vendor’s employee who shall serve as the public jurisdiction’s primary security contact:

Name: __________________________________________________________

Email address: ___________________________________________________

Phone Number: __________________ ________________________________

ADDENDUM ACKNOWLEDGEMENT FORM

SOLICITATION NO.:_____________

Instructions: Please acknowledge receipt of all addenda issued with this solicitation by completing this addendum acknowledgment form. Check the box next to each addendum received and sign below.

Failure to acknowledge addenda may result in bid disqualification.

Acknowledgment: I hereby acknowledge receipt of the following addenda and have made the necessary revisions to my proposal, plans and/or specification, etc.

Addendum Numbers Received:

(Check the box next to each addendum received)

[ ] Addendum No. 1 [ ] Addendum No. 6

[ ] Addendum No. 2 [ ] Addendum No. 7

[ ] Addendum No. 3 [ ] Addendum No. 8

[ ] Addendum No. 4 [ ] Addendum No. 9

[ ] Addendum No. 5 [ ] Addendum No. 10

I understand that failure to confirm the receipt of addenda may be cause for rejection of this bid. I further understand that any verbal representation made or assumed to be made during any oral discussion held between Vendor’s representatives and any state personnel is not binding. Only the information issued in writing and added to the specifications by an official addendum is binding.

Company

Authorized Signature

Date

NOTE: This addendum acknowledgement should be submitted with the bid to expedite document processing.

AddendumStandardFormat

1. To publish agency responses to all vendor submitted questions

2. To publish Software as a Service Addendum