ADSPO16-00006008-Nationwide-AmendmentNo.12-FINAL.pdf

CONTRACT AMENDMENT

Contract No.: ADSPO16-157096 Description: Deferred Compensation and Defined Contribution Plans Contractor: Nationwide Retirement Solutions Inc.

Contract Amendment No.

Twelve (12)

In accordance with the Uniform Terms and Conditions, Section 5.1 (Amendments), and the Special Terms and Conditions, Paragraph 3.1 (Term of Contract) the above-referenced Contract is hereby amended as follows:

1) Effective the date of this amendment, Provision 19.4 below is added to Section 19 (Information Security and

Data Privacy) is added to the Special Terms and Conditions.

19.4 Additional Security Requirements.

19.4.1 Contractor shall comply with all commercially reasonable security requirements requested by the State in writing.

19.4.2 If an Arizona Risk and Authorization Management Program (AZRamp) is required, it will generally follow these steps, each of which shall be completed by the Contractor upon request by the State:

19.4.2.1 Contractor shall submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet with its Offer within 30 days. The Arizona Baseline Infrastructure Security Controls assessment spreadsheet as found at: https://azdohs.gov/file/4357, and mitigate gaps or install compensating controls for any issues of concern identified by State.

19.4.2.2 Contractor shall provide Information Security documentation for the AZRamp assessment to include System Security Plan (SSP), Written Information Security Programs (WISP), or supporting written IT policies for review of the assessment within 30 days.

19.4.3 Note regarding the confidential treatment of Contractor information:

19.4.3.1 The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDAs) for release to review submitted SSPs, WISPs, or written IT policies will not be considered.

19.4.3.2 Submitted SSPs, WISPs, or written IT policies are deleted and not retained after AZRamp Authorization is granted.

19.4.3.3 Procedures for submission of documents considered confidential or proprietary are identified within this RFP.

19.4.3.4 Special secure transfer of documents related to this AZRamp review process may be made by contacting: AsetAssurance@azdoa.gov to make special arrangements for the transfer of these documents.

19.4.3.5 If applicable to this Solicitation, Contractor shall complete and submit with the Offer an unedited and signed State of Arizona Health Insurance Portability and Accountability Act (HIPAA) Business Associate Addendum (BAA).

19.4.3.6 All contract awards are contingent on the successful completion of the AZRamp 125 Low Impact (public information) or the AZRamp 325 Moderate (Confidential, PII, or PHI) Impact Control spreadsheet titled “Arizona Infrastructure Security Controls 2017 (Excel),” to be determined by the Enterprise Security, Privacy & Risk Compliance team. Low (Column E) and

DocuSign Envelope ID: 09C6FB4D-48DA-48AB-A843-D27D71B80633

Description: Deferred Compensation and Defined Contribution Plans Contractor: Nationwide Retirement Solutions Inc.

Contract

Moderate (Column F) Impact controls spreadsheet can be located here:

https://azdohs.gov/file/4356.

19.4.3.7 ASRS reserves the right to conduct risk assessments, or hire a third party to conduct risk assessments of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s). Additionally, upon request, Contractor agrees to provide evidence of 3rd party attack and penetration testing and to provide a System and Organization Controls for Service Organization (or industry-standard successors) (“SOC”) report.

19.4.3.8 Contractor shall comply with all applicable State and Federal laws and regulations, including, but not limited to, material and applicable sections within the following (please note that the links are provided for convenience only and may change):

19.4.3.9 State of Arizona statewide policies, standards and procedures:

https://azdohs.gov/information-technology-it-policies-standards-and-procedures;

19.4.3.10 Contractor’s Information Security Program shall comply with the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity, the International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC) 27000 family of standards, or other similar industry standards for information security.Tax Information Security Guidelines For Federal, State and Local Agencies: Safeguards for Protecting Federal Tax Returns and Return Information (IRS Publication 1075): https://www.irs.gov/pub/irs-pdf/p1075.pdf;

19.4.3.11 Criminal Justice Information Services Security Policy (CJIS):

https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center;

19.4.3.12 Centers for Medicare & Medicaid Services (CMS), Minimum Acceptable Risk Standards for Exchanges (MARS-E):

https://www.cms.gov/CCIIO/Resources/Regulations-and- Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk- Standards-for-Exchanges-11102015.pdf;

19.4.3.13 A.R.S. Title 41, Chapter 41. Arizona Department of Homeland Security;

19.4.3.14 A.R.S. §18-104 - Arizona Department of Administration, Arizona Strategic Enterprise Technology (ADOA-ASET), Powers and duties of the agency:

https://www.azleg.gov/arsDetail/?title=18;

19.4.3.15 A.R.S. §18-105 - Statewide Information Security and Privacy Office (SISPO):

https://www.azleg.gov/viewdocument/?docName=http%3A//www.azleg.gov/ ars/18/00105.htm;

19.4.3.16 A.R.S. §18-551 - Definitions Information Security Including PII:

https://www.azleg.gov/ars/18/00551.htm;

Description: Deferred Compensation and Defined Contribution Plans Contractor: Nationwide Retirement Solutions Inc.

Contract

19.4.3.17 A.R.S. §18-552 - Notification of security system breaches; requirements;

enforcement; civil penalty; preemption; exceptions:

https://www.azleg.gov/ars/18/00552.htm;

19.4.3.18 Arizona Executive Order 2008-10 – Mitigating Cyber Security Threats:

https://aset.az.gov/node/192;

19.4.3.19 SIPC Memorandum of Understanding (MOU): https://www.sipc.org/about-sipc/ ;

19.4.3.20 State Environmental policies: https://azdeq.gov/LawsAndRules;

19.4.3.21 Family Education Rights Privacy Act (FERPA):

https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html?src=rn;

19.4.3.22 Driver’s Privacy Protection Act (DPPA): https://azdot.gov/motor-vehicles/driver-services/driver-license-information/motor-vehicle-records;

19.4.3.23 Incident Response Reporting program and system:

https://aset.az.gov/sites/default/files/P8240%20Incident%20Response%20Pl anning_Sept2018_0.pdf ;

19.4.3.24 Privacy Incident Reporting policy and standards:

https://aset.az.gov/sites/default/files/STANDARD%208240%20INCIDENT% 20RESPONSE%20PLANNING.pdf ;

19.4.3.25 State of Arizona Library, Archives and Public Records, Records Management Division, General Retention Schedules https://azlibrary.gov/arm/policies ; and

19.4.3.26 Payment Card Industry (PCI) Security Standards including but not limited to Supplemental Documents, Information Supplements and Validation Requirements: https://www.pcisecuritystandards.org

All other requirements, terms, and conditions remain unchanged.

Contractor hereby acknowledges receipt and understanding of this Contract Amendment.

This Contract Amendment is hereby executed this date by the Arizona State Retirement System.

Signature

Signature

Athena Elliston

Name

Name

Chief Procurement Officer

Title Date Title Date

1/8/24

C. Alexis Cousineau

1/11/2024 | 7:06:05 AM PST

Operations Director

Certificate Of Completion Envelope Id: 09C6FB4D48DA48ABA843D27D71B80633 Status: Completed

Subject: Complete with DocuSign: ADSPO16-00006008-Nationwide-AmendmentNo.12-FINAL.pdf

Source Envelope:

Document Pages: 3 Signatures: 1 Envelope Originator:

Certificate Pages: 1 Initials: 0 Andrew Mertz

AutoNav: Enabled

EnvelopeId Stamping: Enabled

Time Zone: (UTC-08:00) Pacific Time (US & Canada)

10 West Nationwide Blvd.

Columbus, OH 43215

MERTZA@nationwide.com

IP Address: 174.105.78.21

Record Tracking Status: Original

1/8/2024 7:29:54 AM

Holder: Andrew Mertz

MERTZA@nationwide.com

Location: DocuSign

Signer Events Signature Timestamp C. Alexis Cousineau c.a.cousineau@nationwide.com

Operations Director

Security Level: Email, Account Authentication (None) Signature Adoption: Pre-selected Style

Using IP Address: 23.245.114.160

Sent: 1/8/2024 7:32:01 AM

Resent: 1/9/2024 10:37:42 AM

Resent: 1/11/2024 6:54:05 AM

Viewed: 1/11/2024 7:01:40 AM

Signed: 1/11/2024 7:06:05 AM

Electronic Record and Signature Disclosure:

Not Offered via DocuSign

In Person Signer Events Signature Timestamp

Editor Delivery Events Status Timestamp

Agent Delivery Events Status Timestamp

Intermediary Delivery Events Status Timestamp

Certified Delivery Events Status Timestamp

Carbon Copy Events Status Timestamp

Witness Events Signature Timestamp

Notary Events Signature Timestamp

Envelope Summary Events Status Timestamps Envelope Sent Hashed/Encrypted 1/8/2024 7:32:01 AM

Envelope Updated Security Checked 1/11/2024 6:54:05 AM

Envelope Updated Security Checked 1/11/2024 6:54:05 AM

Certified Delivered Security Checked 1/11/2024 7:01:40 AM

Signing Complete Security Checked 1/11/2024 7:06:05 AM

Completed Security Checked 1/11/2024 7:06:05 AM

Payment Events Status Timestamps