All Appendices but F.pdf

SOUTH DAKOTA DMV LICENSE PLATES v7

ITI Call Center • 833.939.2383 • iticallcenter@it i4dmv.com

DEALER 77

MC

AMATEUR RADIO PERSONALDEALER 88COMMERCIAL RADIO DEALER 77 EMBLEM EMBLEM

MC

LOW SPEED VEHICLEDEALER AUCTION 99 PERSONAL

MC

BIT CONSERVATION OFFICERBUSSTANDARD COUNTY STANDARD COUNTY

MC

CITY CIVIL AIR PATROL COMMUNITY SERVICE

PROVIDER

CHEYENNE RIVER SIOUX

TRIBE EXEMPT

COUNTY CROW CREEK SIOUX

TRIBE EXEMPT

EVOC FIRE MARSHALEXEMPT

MC

DRIVER EDUCATION EXEMPT TRAILER

SMALL

FENCE FIRE DEPARTMENTEXEMPT TRAILER

LARGE

FLANDREAU SANTEE SIOUX

TRIBE EXEMPT

HIGHWAY PATROL HIGHWAY PATROL

MC

LAKE AREA TECH PARK RANGERLOWER BRULE SIOUX

TRIBE EXEMPT

MITCHELL TECH MOTOR CARRIER OGLALA SIOUX

TRIBE EXEMPT

MASS TRANSIT ROSEBUD SIOUX

TRIBE EXEMPT

SCHOOL SISSETON WAHPETON

OYATE EXEMPT

SOUTH DAKOTA HOUSING

ASSOCIATION

AIR FORCE ACTIVE DUTYSOUTHEAST TECH STATE WESTERN DAKOTA TECH YANKTON SIOUX

TRIBE EXEMPT

STANDING ROCK SIOUX

TRIBE EXEMPT

AIR FORCE VETERANAIR FORCE ACTIVE DUTY

MC

AIR FORCE CROSS AIR FORCE CROSS

MC

AIR FORCE VETERAN

MC

ARMY VETERANAIR FORCE WOMAN

VETERAN MC

ARMY ACTIVE DUTY ARMY ACTIVE DUTY

MC

AIR FORCE WOMAN

VETERAN

BRONZE STARARMY VETERAN

MC

BRONZE STAR

MC

ARMY WOMAN VETERAN ARMY WOMAN VETERAN

MC

BRONZE STAR WITH VALOR

COAST GUARD VETERANBRONZE STAR WITH VALOR

MC

COAST GUARD ACTIVE DUTY COAST GUARD ACTIVE DUTY

MC

DISABLED VETERANCOAST GUARD VETERAN

MC

DISABLED VETERAN

MC

COAST GUARD WOMAN

VETERAN

COAST GUARD WOMAN

VETERAN MC

DISTINGUISHED FLYING

CROSS

DISTINGUISHED FLYING

CROSS MC

GOLD STARDISTINGUISHED SERVICE

CROSS

DISTINGUISHED SERVICE

CROSS MC

GOLD STAR

MC

LEGION OF MERIT LEGION OF MERIT MC MARINE VETERAN MARINE VETERAN

MC

MARINE ACTIVE DUTY MARINE ACTIVE DUTY

MC

MARINE WOMAN

VETERAN

NAVY ACTIVE DUTYMARINE WOMAN

VETERAN MC

MEDAL OF HONOR ARMY NATIONAL GUARD NAVY VETERANNAVY ACTIVE DUTY

MC

NAVY VETERAN

MC

NAVY CROSS NAVY CROSS

MC

NAVY WOMAN VETERAN NAVY WOMAN VETERAN

MC

PRISONER OF WAR

MC

PEARL HARBOR SURVIVOR PRISONER OF WAR SILVER STAR

MC

PURPLE HEART PURPLE HEART

MC

SILVER STAR SPACE FORCE VETERANSPACE FORCE ACTIVE DUTY SPACE FORCE ACTIVE

DUTY MC

SPACE FORCE VETERAN

MC

SPACE FORCE WOMEN

VETERAN

SPACE FORCE WOMAN

VETERAN MC

DISABLED PERSON

MC

FIREFIGHTERDISABLED PERSONAPPORTIONED CONSTRUCTION DIGNITY DIGNITY

MC

COMMERCIAL HABITAT CONSERVATION

HABITAT CONSERVATION

MC

STANDING ROCK SIOUX

TRIBE VETERAN

YANKTON SIOUX

TRIBE

YANKTON SIOUX

TRIBE VETERAN

STANDING ROCK SIOUX

TRIBE

OGLALA LAKOTA SIOUX

TRIBE VETERAN

ROSEBUD SIOUX

TRIBE VETERAN

SISSETON WAHPETON

OYATE

SISSETON WAHPETON

OYATE VETERAN

ROSEBUD SIOUX

TRIBE

LOWER BRULE SIOUX

TRIBE VETERAN

LOWER BRULE SIOUX

TRIBE VETERAN

OGLALA LAKOTA SIOUX

TRIBE

FLANDREAU SANTEE SIOUX

TRIBE VETERAN

LOWER BRULE SIOUX

TRIBE

LOWER BRULE SIOUX

TRIBE

TRAILER ID/

COMMERCIAL TRAILER

FLANDREAU SANTEE SIOUX

TRIBE

TRAILER TRANSPORTER CHEYENNE RIVER SIOUX

TRIBE VETERAN

CROW CREEK SIOUX

TRIBE

CROW CREEK SIOUX

TRIBE VETERAN

CHEYENNE RIVER SIOUX

TRIBE

TRAILER TRAILER

MC

HISTORICAL

MC

RETIRED FIREFIGHTERMOBILE MANUFACTURED

HOME DEALER

PRORATE PRORATE TRAILERDEALER TRAILERCONSTRUCTION TRAILERSPECIAL INTEREST SPECIAL INTEREST

PERSONALIZED

HISTORICAL

Appendix A

APPENDIX B

Current POD Printer Allocations by County Office Location (and the Pierre DOR office location)

Aurora: 3 Beadle: 5 Bennett: 4 Bon Homme: 3 Brookings: 9 Brown: 7 Brule: 3 Buffalo: 3 Butte: 5 Campbell: 3 Charles Mix: 3 Clark: 4 Clay: 3 Codington: 8 Corson: 3 Custer: 3 Davison: 5 Day: 4 Deuel: 3 Dewey: 3 Dewey Sat.: 3 Pierre: 12 Douglas: 3 Edmunds: 3 Fall River/ Shannon: 4 Faulk: 3 Gettysburg: 4 Grant: 3 Gregory: 3 Haakon: 3 Hamlin: 3 Hand: 2 Hanson: 3 Harding: 3

Hughes: 3 Hutchinson: 3 Hyde: 3 Jackson: 3 Jerauld: 3 Jones: 3 Kingsbury: 3 Lake: 3 Lawrence: 7 Lincoln: 13 Lyman: 3 Marshall: 3 McCook: 9 McPherson: 3 Meade: 8 Meade Sat.: 3 Mellette: 3 Miner: 3 Minnehaha: 31 Moody: 3 Pennington: 40 Perkins: 3 Roberts: 4 Sanborn: 3 Spink: 3 Stanley: 3 Sully: 3 Tripp/ Todd: 3 Turner: 7 Union: 3 Walworth: 3 Yankton: 5 Ziebach: 3

APPENDIX C

SECTION I – PERFORMANCE STANDARDS

REFLECTIVE SHEETING FOR DIGITAL LICENSE PLATE PRODUCTION

A. SUBSTRATE

The sheeting shall be laminated to aluminum substrate recommended by the sheeting manufacturer.

B. DIFFUSE DAYTIME COLOR

Through instrumental color testing, the diffuse daytime color of the reflective sheeting shall conform to color requirements as determined spectrophotometrically in accordance with ASTM E-1164 and E-1349, utilizing either 45/0 or 0/45 degree illumination/viewing conditions as described in E- 1164 and E-1349 for retroreflective materials. Chromaticity and the Luminance Factor based on CIE tristimulus values for the 2° observer and illuminant D65 shall be calculated in accordance with ASTM E-308.

The color specification limits for white license plate sheeting are listed on the following chart.

C. COLOR SPECIFICATION

Chromaticity Coordinates

Pairs White Corner Points Luminance Factor x y Y% 1 .303 .287 42 min.

2 .368 .353 3 .340 .380 4 .274 .316

D. ADHESIVE AND PROTECTIVE LINER:

1. The precoated adhesive shall form a durable bond to flat conversion coated license plate surfaces as recommended by the reflective sheeting manufacturer.

2. The protective liner attached to the adhesive shall be removable by peeling without soaking in water or other solvents and shall be easily removed after accelerated conditioning for four hours at 150°F (66°C) under weight of 2.5 lbs. per square inch (1.14KG per 6.45 sq. cm). The liner shall be non-printed to permit reuse.

E. INK JET PRINTING

1. The reflective sheeting shall be printable with UV Inks supplied by the Vendor.

2. The Vendor shall provide a complete line of UV Inks that allow the license plate shop to print the graphic designs and variable information required by the State.

F. PROTECTIVE CLEAR OVERLAMINATE

The Vendor shall provide a protective clear film that will be laminated to the sheeting in-line with the UV Ink printing process. Printed sheeting with the protective clear film shall pass all performance tests as delineated in Section II.B.

G. INVENTORY CONTROL

To assist PI with inventory control, the sheeting manufacturer shall mark the sheeting with an integral, directional image that incorporates the lot number so that PI can employ first in - first out principles.

SECTION II - FINISHED LICENSE PLATES

Test panels shall be prepared in accordance with Section III, Para. A.

A. RETROREFLECTIVE CHARACTERISTICS

The coefficient of retroreflection for the sheeting shall be measured on flat, clean, finished license plate test panels prepared per Section III and shall have the following minimum values at 0.2° observation angle, expressed as candelas per lux per square meter of material. Measurements shall be conducted in accordance with ASTM E-810, “Standard Test Method for Coefficient of Retroreflection of Retroreflective Sheeting”.

Measurements on reflective sheeting with a preprinted graphic design shall be taken in an unprinted sheeting area.

Color Entrance Angle -4° 40°

White 50 16

B. RESISTANCE TO ACCELERATED WEATHERING

1. The sheeting shall be weather resistant and show no appreciable discoloration, crazing, cracking, blistering, lifting or dimensional change and the surface shall continue to be essentially smooth to provide direct application of validation stickers, determined after the following accelerated weathering tests:

2. Laboratory testing – 2,000 hours in Xenon arc weatherometer using ASTM G 155 - Type BH, Cycle 1. Samples shall maintain 70% of retroreflective table values shown in II, B. 1.

3. Outdoor accelerated testing – Samples shall be placed in a 24 month unprotected outdoor exposure, facing the equator and positioned vertically. Retroreflective measurements, taken after cleaning, shall result in 70% or more retention of the table values shown in II, B. 1.

C. RAINFALL PERFORMANCE

The Coefficient of Retroreflection of the same finished license plate test panels, measured on the same flat area of the test panels, totally wet by rain, shall not be less than 90 percent of the values specified above. The photometric performance during rainfall shall be determined as follows:

1. Test set-up for rainfall performance:

2. Place the test panel in an upright position 6 inches (15.2 cm) below and 4 inches (10.1 cm) in front of the nozzle as shown above

3. Apply sufficient water pressure so that the upper surface of the spray envelope strikes the top of the panel.

4. With water falling on the panel, measure the coefficient of retroreflection. Wet performance measurements shall be conducted at 0.2° observation and -4° entrance angles in accordance with ASTM E-810.

D. DAYTIME/NIGHTTIME COLOR

To assist in positive daytime/nighttime identification of license plates, the color of the reflective background of the sheetings, including any pre-printed design or digitally printed design, shall be similar in daylight and by illumination at night.

E. FLEXIBILITY-EMBOSSING

1. The sheeting shall, when correctly applied to treated aluminum, conform to the minimum/maximum tolerances for an embossed rim or flange as used by the manufacturing facility that supplies finished plates to the state and as recommended by the sheeting manufacturer.

2. Finished license plates shall show no appreciable wrinkling, cracking, or squirming at or around the embossed rim or flange.

F. CLEANABILITY

1. Finished license plates, manufactured in accordance with the recommendations of the reflective sheeting manufacturer, shall be easily cleansed of normal dirt accumulation by washing with water and mild detergent. A test panel shall be sprayed with water-suspended soils collected from the underside of vehicle fenders, mixed with water in the proportion of five pounds (2.27 kg) of soil to one gallon (3.78 liters) of water, and poured through a paint strainer.

2. The mixture shall then be sprayed onto the panel while particles are in suspension.

After the panel is thoroughly dry, it shall be cleaned by washing with a mixture of water and mild detergent, rinsed with clean water and wiped dry for examination. The panel shall show no appreciable difference when compared to a new clean panel.

G. SOLVENT RESISTANCE

1. License plate panels prepared per III.A shall be sufficiently solvent resistant to withstand exposure to mineral spirits and turpentine in accordance with the test method described in this section without wrinkling, puckering or edge lifting.

2. Test panels shall be 1 inch x 6 inch strips cut from license plate blanks. Strips of the license plate shall be exposed as follows: mineral spirits and turpentine - submerged in a container with 4 inches of solvent for 10 minutes.

3. Samples shall be allowed to dry and be examined for any wrinkling, puckering, blistering, or edge lifting. Failure of samples shall be cause for rejections.

SECTION IV - TEST PANELS AND QUALITY CONFORMANCE

A. TEST PANELS

Finished license plate test panels 6” x 12” (15.2cm x 30.5cm) must be provided for testing and evaluation within ten (10) calendar days if required by the state, and shall be produced of the same materials, on the same equipment and by the same general processes of substrate preparation as the production plates, in accordance with the sheeting manufacturer’s recommendations. Test panels shall be provided with and without thermal transfer printed graphics and variable information as required by the state.

B. QUALITY CONFORMANCE

Failure of the reflective sheeting to meet any requirement specified herein shall be cause for refusal to accept materials until evidence has been provided by the manufacturer that corrective action has been taken to eliminate deficiencies.

SECTION III - PERFORMANCE LIFE & WARRANTIES

A. PERFORMANCE LIFE

1. Reflective sheeting applied and processed into finished license plates according to the sheeting manufacturer’s instruction shall be considered to perform effectively for the service life specified (excluding those plates showing mechanical damage) if:

a. The plates show no fading, cracking, blistering or peeling which will significantly impair the intended visibility or legibility of the plate, and if

b. The clean rear plate retains at least 9 candlepower per foot-candle per plate (.84 candelas per lux per plate) for the length of the intended issue being bid (up to a period of 5 years). Measurements shall be taken in clean, white, unprinted areas of rear plates.

2. Measurements shall be conducted at 0.2° observation angle and -4° entrance angle. Coefficient of Luminous Intensity shall be measured using the test method outlined in ASTM E-810 except that the coefficient of luminous intensity shall be determined in accordance with ASTM E-808-01 Para. 3.2.2 and ASTM E-809-02 Para. 12.3. Note: Reflective license plates with a digitally printed graphic design may not meet this requirement as large graphic printed areas may affect the reflectivity levels of the finished license plates.

B. WARRANTY PROVISIONS

1. The sheeting shall be imaged with a directional, integral warranty mark, so as to be traceable to the specific manufacturer’s production run numbers from which the material originated. If at any time during the specified performance life of the reflective material provided, a one half of one percent sample of clean, rear plates produced from a given production run (identified by the integral warranty mark) reveals that 10 percent or more of that sample are found to be defective in visual or brightness performance requirements as defined herein, the Vendor shall be responsible for replacement of all plates manufactured from that specific lot of material.

2. The sheeting manufacturer shall be responsible for all replacement costs associated with a specific lot; a maximum liability assessment of $5.00 per plate will be invoked for failed plates associated with a specific lot. Reimbursement of the State shall be in dollars and/or materials equal to the assessed damage, at the State’s discretion.

3. To assure effective identification, the warranty marks shall be approximately

1.125 inches in diameter on standard 6” x 12” plates and shall be of a design mutually agreed upon by the State and the sheeting manufacturer. The manufacturer may vary the number, design and placement of the marks for motorcycle or smaller license plate sizes.

4. The warranty marks shall be verifiable on a license plate once properly affixed to the vehicle’s designated mounting area, from an approximate head-on distance of six (6) feet; warranty marks shall not be observable at 2 feet or 20 feet or when the viewer steps to one side from the head-on viewing position so as not to compete or conflict with vital plate information.

5. The warranty marks shall be verifiable under both ambient light and retroreflected light at night, shall not interfere or conflict with the plate design or aesthetics, and shall not alter sheeting colors or reduce sheeting brightness below specified levels.

C. SECURITY MARKS

1. The Retroreflective sheeting shall have buried beneath the surface, a mark which deters counterfeiting and identifies the manufacture and lot of manufacture. The mark shall be a design mutually agreed upon by the jurisdiction and sheeting manufacturer.

SECTION IV - PROCESSING

The reflective sheeting processing shall be in accordance with the recommendations of the manufacturer. All processing procedures for reflective material, thermal transfer ribbons and clear protective laminate must be compatible, or made compatible at the Vendor’s expense, with equipment and procedures currently employed by the State.

APPENDIX C – COST PROPOSAL

COST PROPOSAL REQUIREMENTS:

1. Shipping and Packaging Costs. The Vendor is responsible for all shipping and packaging costs related to the fulfillment center for license plates, registrations, and any applicable printed decals or placards.

2. United States Postal Service. The Vendor must use the United States Postal Service current rates as of the time of submission of this cost proposal.

3. Bulk Freight. Bulk freight costs for license plate distribution to county offices (except Minnehaha County and Pennington County) will be billed to the state.

4. Invoice. Vendors must submit a copy of the invoice that would be used for billing under the Vendor’s proposal.

5. Alternate materials or technologies proposed. A cost sheet must be submitted for each alternate plate production method or alternate materials and technologies proposed.

A. Plate Production Cost (Materials & Equipment cost)

Category Unit of Measurement

Price

Automobile/Prorate Truck Per plate set $ Large Trailer Plate Per plate $ Motorcycle/Small Trailer Per plate $

B. Printing and Fulfillment Center Costs

Category Price per Unit*

Fulfillment center postage and packaging cost (Bulk license plates sent to County offices)

Fulfillment center postage and packaging cost (License Plates/Registration mailed directly to customer)

Printing cost (Registrations and decals at County & State offices using Print on Demand

Printing Cost (Registrations and decals at Fulfillment Center) Any other service cost**

*Please specify the unit used for pricing

**Please specify the nature/unit of any other service cost included

Appendix E Bureau of Information and Telecommunications

Required IT Contract Terms

Any contract resulting from this RFP will include the State’s required IT terms and conditions as listed below, along with any additional terms and conditions as negotiated by the parties. Due to the changing landscape of IT security and data privacy, the State reserves the right to add additional IT terms and conditions or modify the IT terms and conditions listed below to the resulting contract:

Pursuant to South Dakota Codified Law § 1-33-44, the Bureau of Information and Telecommunications ("BIT") oversees the acquisition of office systems technology, software, and services; telecommunication equipment, software, and services; and data processing equipment, software, and services for departments, agencies, commissions, institutions, and other units of state government. As part of its duties as the Executive Branch’s centralized IT agency, BIT requires the contract terms and conditions of this Exhibit XX. For purposes of this Exhibit, [Vendor Name] will be referred to as the “Vendor.”

It is understood and agreed to by all parties that BIT has reviewed and approved only this Exhibit.

Due to the ever-changing security and regulatory landscape in IT and data privacy, before renewal of this Agreement BIT must review and approve the clauses found in this Exhibit as being the then current version of the clauses and if any additional required clauses are needed. Changes to clauses in this Exhibit must be approved in writing by all parties before they go into effect and a renewal of this Agreement is possible.

The Parties agree, when used in this Exhibit, the term “Vendor” will mean the Vendor and the Vendor’s employees, subcontractors, agents, assigns, and affiliated entities.

Section I. Confidentiality of Information

For purposes of this paragraph, “State Proprietary Information” will include all information disclosed to the Vendor by the State. The Vendor will not disclose any State Proprietary Information to any third person for any reason without the express written permission of a State officer or employee with authority to authorize the disclosure. The Vendor must not: (i) disclose any State Proprietary Information to any third person unless otherwise specifically allowed under this Agreement; (ii) make any use of State Proprietary Information except to exercise rights and perform obligations under this Agreement; (iii) make State Proprietary Information available to any of its employees, officers, agents, or third party consultants except those who have a need to access such information and who have agreed to obligations of confidentiality at least as strict as those set out in this Agreement. The Vendor is held to the same standard of care in guarding State Proprietary Information as it applies to its own confidential or proprietary information and materials of a similar nature, and no less than holding State Proprietary Information in the strictest confidence. The Vendor must protect the confidentiality of the State’s information from the time of receipt to the time that such information is either returned to the State or destroyed to the extent that it cannot be recalled or reproduced. The Vendor agrees to return all information received from the State to the State’s custody upon the end of the term of this Agreement, unless otherwise agreed in a writing signed by both parties. State Proprietary Information will not include information that:

A. was in the public domain at the time it was disclosed to the Vendor, B. was known to the Vendor without restriction at the time of disclosure from the State, C. that was disclosed with the prior written approval of State’s officers or employees having authority to disclose such information, D. was independently developed by the Vendor without the benefit or influence of the State’s information, and E. becomes known to the Vendor without restriction from a source not connected to the State of South Dakota.

State’s Proprietary Information can include names, social security numbers, employer numbers, addresses and other data about applicants, employers or other clients to whom the State provides services of any kind. The Vendor understands that this information is confidential and protected under State law. The Parties mutually agree that neither of them nor any subcontractors, agents, assigns, or affiliated entities will disclose the contents of this Agreement except as required by applicable law or as necessary to carry out the terms of the Agreement or to enforce that Party’s rights under this Agreement. The Vendor acknowledges that the State and its agencies are public entities and thus may be bound by South Dakota open meetings and open records laws. It is therefore not a breach of this Agreement for the State to take any action that the State reasonably believes is necessary to comply with South Dakota open records or open meetings laws.

Section II. Cyber Liability Insurance

The Vendor will maintain cyber liability insurance with liability limits in the amount of $ to protect any and all State data the Vendor receives as part of the project covered by this agreement including State data that may reside on devices, including laptops and smart phones, utilized by Vendor employees, whether the device is owned by the employee or the Vendor. If the Vendor has a contract with a third-party to host any State data the Vendor receives as part of the project under this Agreement, then the Vendor will include a requirement for cyber liability insurance as part of the contract between the Vendor and the third-party hosting the data in question. The third-party cyber liability insurance coverage will include State Data that resides on devices, including laptops and smart phones, utilized by third-party employees, whether the device is owned by the employee or the third-party Vendor. The cyber liability insurance will cover expenses related to the management of a data breach incident, the investigation, recovery and restoration of lost data, data subject notification, call management, credit checking for data subjects, legal costs, and regulatory fines. Before beginning work under this Agreement, the Vendor will furnish the State with properly executed Certificates of Insurance which shall clearly evidence all insurance required in this Agreement and which provide that such insurance may not be canceled, except on 30 days prior written notice to the State. The Vendor will furnish copies of insurance policies if requested by the State. The insurance will stay in effect for three years after the work covered by this Agreement is completed.

Section III. Rejection or Ejection of Vendor

The State, at its option, may require the vetting of any of the Vendor, and the Vendor‘s subcontractors, agents, Assigns, or affiliated entities. The Vendor is required to assist in this process as needed.

The State reserves the right to reject any person from participating in the project or require the Vendor to remove from the project any person the State believes is detrimental to the project or is considered by the State to be a security risk. The State will provide the Vendor with notice of its determination, and the reasons for the rejection or removal if requested by the Vendor. If the State signifies that a potential security violation exists with respect to the request, the Vendor must immediately remove the individual from the project.

Section IV. Domain Name Ownership

Any website(s) that the Vendor creates as part of this Agreement must have the domain name registered by and owned by the State. If, as part of this Agreement, the Vendor is providing a service that utilizes a website with the domain name owned by the Vendor, the Vendor must give 30 days’ written notice before abandoning the site. If the Vendor intends to sell the site to another party, the Vendor must give the State 30 days’ written notice and grant the State the right of first refusal. For any site or domain, whether hosted by the Vendor or within the State web infrastructure, any and all new web content should first be created in a development environment and then subjected to security scan before being approved for a move up to the production level.

This paragraph does not include websites developed for the Vendor’s internal use.

Section V. Software Functionality and Replacement

The software licensed by the Vendor to the State under this Agreement will provide the functionality as described in the software documentation, which the Vendor agrees to provide to the State prior to or upon the execution of this Agreement.

The Vendor agrees that:

A. If, in the opinion of the State, the Vendor reduces or replaces the functionality contained in the licensed product and provides this functionality as a separate or renamed product, the State will be entitled to license such software product at no additional license or maintenance fee.

B. If, in the opinion of the State, the Vendor releases an option, future product, purchasable product or other release that has substantially the same functionality as the software product licensed to the State, and it ceases to provide maintenance for the older software product, the State will have the option to exchange licenses for such replacement product or function at no additional charge. This includes situations where the Vendor discontinues the licensed product and recommends movement to a new product as a replacement option regardless of any additional functionality the replacement product may have over the licensed product.

Section VI. Service Bureau

Consistent with use limitations specified in the Agreement, the State may use the product to provide services to the various branches and constitutional offices of the State of South Dakota as well as county and city governments, tribal governments, and school districts. The State will not be considered a service bureau while providing these services and no additional fees may be charged unless agreed to in writing by the State.

Section VII. Federal Intellectual Property Bankruptcy Protection Act

The Parties agree that the State will be entitled to all rights and benefits of the Federal Intellectual Property Bankruptcy Protection Act, Public Law 100-506, codified at 11 U.S.C. 365(n), and any amendments thereto. The State also maintains its termination privileges if the Vendor enters bankruptcy.

Section VIII. Non-Disclosure and Separation of Duties

The Vendor will enforce separation of job duties and require non-disclosure agreements of all staff that have or can have access to State Data or the hardware that State Data resides on. The Vendor will limit staff knowledge to those staff whose duties that require them to have access to the State Data or the hardware the State Data resides on.

Section IX. Cessation of Business

The Vendor will notify the State of impending cessation of its business or that of a tiered provider and the Vendor’s contingency plan. This plan should include the immediate transfer of any previously escrowed assets and data and State access to the Vendor’s facilities to remove or destroy any state-owned assets and data. The Vendor will implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the State.

The Vendor will provide a fully documented service description and perform and document a gap analysis by examining any differences between its services and those to be provided by its successor. The Vendor will also provide a full inventory and configuration of servers, routers, other hardware, and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the State. The Vendor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and impact on the State, all such work to be coordinated and performed in advance of the formal, final transition date.

Section X. Legal Requests for Data

Except as otherwise expressly prohibited by law, the Vendor will:

A. Immediately notify the State of any subpoenas, warrants, or other legal orders, demands or requests received by the Vendor seeking State Data maintained by the Vendor, B. Consult with the State regarding the Vendor’s response, C. Cooperate with the State’s requests in connection with efforts by the State to intervene and quash or modify the legal order, demand or request, and D. Upon the State’s request, provide the State with a copy of both the demand or request and its proposed or actual response.

Section XI. eDiscovery

The Vendor will contact the State upon receipt of any electronic discovery, litigation holds, discovery searches, and expert testimonies related to, or which in any way might reasonably require access to State Data. The Vendor will not respond to service of process, and other legal requests related to the State without first notifying the State unless prohibited by law from providing such notice.

Section XII. Audit Requirements

The Vendor warrants and agrees it is aware of and complies with all audit requirements relating to the classification of State Data the Vendor stores, processes, and accesses. Depending on the data classification, this may require the Vendor to grant physical access to the data hosting facilities to the State or a federal agency. The Vendor will notify the State of any request for physical access to a facility that hosts or processes State Data by any entity other than the State.

Section XIII. Annual Risk Assessment

The Vendor will conduct an annual risk assessment or when there has been a significant system change. The Vendor will provide verification to the State’s contact upon request that the risk assessment has taken place. At a minimum, the risk assessment will include a review of the:

A. Penetration testing of the Vendor’s system;

B. Security policies and procedures;

C. Disaster recovery plan;

D. Business Associate Agreements; and E. Inventory of physical systems, devices, and media that store or utilize ePHI for completeness.

If the risk assessment provides evidence of deficiencies, a risk management plan will be produced. Upon request by the State, the Vendor will send a summary of the risk management plan to the State’s contact. The summary will include completion dates for the risk management plan’s milestones. Upon request by the State, the Vendor will send updates on the risk management plan to the State’s contact. Compliance with this Section may be met if the Vendor provides proof to the State that the Vendor is FedRAMP Certified and has maintained FedRAMP Certification.

Section XIV. Independent Audit

The Vendor will disclose any independent audits that are performed on any of the Vendor’s systems tied to storing, accessing, and processing State Data. This information on an independent audit(s) must be provided to the State in any event, whether the audit or certification process is successfully completed or not. The Vendor will provide a copy of the findings of the audit(s) to the State. Compliance with this Section may be met if the Vendor provides a copy of the Vendor’s SOC 2 Type II report to the State upon request.

Section XV. Service Level Agreements

The Vendor warrants and agrees that the Vendor has provided to the State all Service Level Agreements (SLA) related to the deliverables of the Agreement. The Vendor further warrants that it will provide the deliverables to the State in compliance with the SLAs.

Section XVI. Access Attempts

The Vendor will log all access attempts, whether failed or successful, to any system connected to the hosted system which can access, read, alter, intercept, or otherwise impact the hosted system or its data or data integrity. For all systems, the log must include at least: login page used, username used, time and date stamp, incoming IP for each authentication attempt, and the authentication status, whether successful or not. Logs must be maintained not less than 7 years in a searchable database in an electronic format that is un-modifiable. At the request of the State, the Vendor agrees to grant the State access to those logs to demonstrate compliance with the terms of this Agreement and all audit requirements related to the hosted system.

Section XVII. Access to State Data

Unless this Agreement is terminated, the State’s access to State Data amassed pursuant to this Agreement will not be hindered if there is a:

A. Contract dispute between the parties to this Agreement, B. There is a billing dispute between the parties to this Agreement, or C. The Vendor merges with or is acquired by another company.

Section XVIII. Password Protection

All aspects of the Vendor’s products provided to the State pursuant to this Agreement will be password protected. If the Vendor provides the user with a preset or default password, that password cannot include any Personally Identifiable Information (PII), data protected under the Family Educational Rights and Privacy Act (FERPA), Protected Health Information (PHI), Federal Tax Information (FTI), or any information defined under federal or state law, rules, or regulations as confidential information or fragment thereof. On an annual basis, the Vendor will document its password policies for all Vendor employees to ensure adequate password protections are in place. The process used to reset a password must include security questions or Multifactor Authentication. Upon request, the Vendor will provide to the State the Vendor’s password policies, logs, or administrative settings to demonstrate the password policies are actively enforced.

Section XIX. Provision of Data

State Data is any data produced or provided by the State as well as any data produced or provided for the State by the Vendor or a third-party.

Upon notice of termination by either party or upon reaching the end of the term of this Agreement, the Vendor will provide the State all current State Data in a non-proprietary format. In addition, the Vendor agrees to extract any information (such as metadata, which includes data structure descriptions, data dictionary, and data) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. If the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Upon the effective date of the termination of this Agreement, the Vendor will again provide the State with all current State Data in a non-proprietary format. In addition, the Vendor will again extract any information (such as metadata) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. As before, if the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Section XX. Threat Notification

A credible security threat consists of the discovery of an exploit that a person considered an expert on Information Technology security believes could be used to breach any aspect of a system that is holding State Data or a product provided by the Vendor. Upon becoming aware of a credible security threat with the Vendor’s product(s) and or service(s) being used by the State, the Vendor or any subcontractor supplying product(s) or service(s) to the Vendor needed to fulfill the terms of this Agreement will notify the State within two business days of any such threat. If the State requests, the Vendor will provide the State with information on the threat.

Section XXI. Security Incident Notification for Non-Health Information

The Vendor will implement, maintain, and update Security Incident procedures that comply with all State standards and Federal and State requirements. A Security Incident is a violation of any BIT security or privacy policies or contract agreements involving sensitive information, or the imminent threat of a violation. The BIT security policies can be found in the Information Technology Security Policy (“ITSP”) attached as BIT Attachment 1. The State requires notification of a Security Incident involving any of the State’s sensitive data in the Vendor’s possession. State Data is any data produced or provided by the State as well as any data produced or provided for the State by a third-party. The parties agree that, to the extent probes and reconnaissance scans common to the industry constitute Security Incidents, this Agreement constitutes notice by the Vendor of the ongoing existence and occurrence of such Security Incidents for which no additional notice to the State will be required. Probes and scans include, without limitation, pings and other broadcast attacks in the Vendor’s firewall, port scans, and unsuccessful log-on attempts, if such probes and reconnaissance scans do not result in a Security Incident as defined above. Except as required by other legal requirements the Vendor will only provide notice of the incident to the State. The State will determine if notification to the public will be by the State or by the Vendor.

The method and content of the notification of the affected parties will be coordinated with, and is subject to approval by the State, unless required otherwise by legal requirements. If the State decides that the Vendor will be distributing, broadcasting to or otherwise releasing information on the Security Incident to the news media, the State will decide to whom the information will be sent, and the State must approve the content of any information on the Security Incident before it may be distributed, broadcast, or otherwise released. The Vendor must reimburse the State for any costs associated with the notification, distributing, broadcasting, or otherwise releasing information on the Security Incident.

A. The Vendor must notify the State contact within 12 hours of the Vendor becoming aware that a Security Incident has occurred. If notification of a Security Incident to the State contact is delayed because it may impede a criminal investigation or jeopardize homeland or federal security, notification must be given to the State within 12 hours after law-enforcement provides permission for the release of information on the Security Incident.

B. Notification of a Security Incident at a minimum is to consist of the nature of the data exposed, the time the incident occurred, and a general description of the circumstances of the incident.

If all of the information is not available for the notification within the specified time period, the Vendor must provide the State with all of the available information along with the reason for the incomplete notification. A delay in excess of 12 hours is acceptable only if it is necessitated by other legal requirements.

C. At the State’s discretion within 12 hours the Vendor must provide to the State all data available including:

1. name of and contact information for the Vendor’s Point of Contact for the Security

Incident,

2. date and time of the Security Incident,

3. date and time the Security Incident was discovered,

4. description of the Security Incident including the data involved, being as specific as possible,

5. the potential number of records, and if unknown the range of records,

6. address where the Security Incident occurred, and

7. the nature of the technologies involved. If not all of the information is available for the notification within the specified time period, the Vendor must provide the State with all of the available information along with the reason for the incomplete information. A delay in excess of 12 hours is acceptable only if it is necessitated by other legal requirements.

D. If the Security Incident falls within the scope of South Dakota Codified Law Chapter 22-40, the Vendor is required to comply with South Dakota law.

The requirements of subsection D of this Section do not replace the requirements of subsections A, B, and C, but are in addition to them.

Section XXII. Handling of Security Incident for Non-Health Information

At the State’s discretion, the Vendor will preserve all evidence regarding a security incident including but not limited to communications, documents, and logs. The Vendor will also:

A. fully investigate the incident, B. cooperate fully with the State’s investigation of, analysis of, and response to the incident, C. make a best effort to implement necessary remedial measures as soon as it is possible, and D. document responsive actions taken related to the Security Incident, including any post-incident review of events and actions taken to implement changes in business practices in providing the services covered by this Agreement.

If, at the State’s discretion the Security Incident was due to the actions or inactions of the Vendor and at the Vendor’s expense the Vendor will use a credit monitoring service, call center, forensics company, advisors, or public relations firm whose services are acceptable to the State. At the State’s discretion the Vendor will offer two years of credit monitoring to each person whose data was compromised. The State will set the scope of any investigation. The State reserves the right to require the Vendor undergo a risk assessment where the State will determine the methodology and scope of the assessment and who will perform the assessment (a third-party vendor may be used). Any risk assessment required by this Section will be at the Vendor’s expense.

If the Vendor is required by federal law or regulation to conduct a Security Incident or data breach investigation, the results of the investigation must be reported to the State within 12 hours of the investigation report being completed. If the Vendor is required by federal law or regulation to notify the affected parties, the State must also be notified, unless otherwise required by law.

Notwithstanding any other provision of this Agreement, and in addition to any other remedies available to the State under law or equity, the Vendor will reimburse the State in full for all costs incurred by the State in investigation and remediation of the Security Incident including, but not limited, to providing notification to regulatory agencies or other entities as required by law or contract. The Vendor will also pay all legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Incident.

Section XXIII. Adverse Event

The Vendor must notify the State contact within three days if the Vendor becomes aware that an Adverse Event has occurred. An Adverse Event is the unauthorized use of system privileges, unauthorized access to State Data, execution of malware, physical intrusions and electronic intrusions that may include network, applications, servers, workstations, and social engineering of staff. If the Adverse Event was the result of the Vendor’s actions or inactions, the State can require a risk assessment of the Vendor the State mandating the methodology to be used as well as the scope. At the State’s discretion a risk assessment may be performed by a third party at the Vendor’s expense. State Data is any data produced or provided by the State as well as any data produced or provided for the State by a third-party.

Section XXIV. Browser

The system, site, or application must be compatible with Vendor supported versions of Edge, Chrome, Safari, and Firefox browsers. Silverlight, QuickTime, PHP, Adobe ColdFusion, and Adobe Flash will not be used in the system, site, or application. Adobe Animate CC is allowed if files that require third-party plugins are not required.

Section XXV. Security of Code

Any code written or developed pursuant to the terms of this Agreement must comply with the security requirements of this Agreement.

Section XXVI. Security Acknowledgment Form

The Vendor will be required to sign the Security Acknowledgement Form which is attached to this Agreement as BIT Attachment 2. The signed Security Acknowledgement Form must be submitted to the State and approved by the South Dakota Bureau of Information and Telecommunications and communicated to the Vendor by the State contact before work on the contract may begin.

This Security Acknowledgment Form constitutes the agreement of the Vendor to be responsible and liable for ensuring that the Vendor, the Vendor’s employee(s), and subcontractor’s, agents, assigns and affiliated entities and all of their employee(s), participating in the work will abide by the terms of the Information Technology Security Policy (ITSP). Failure to abide by the requirements of the ITSP or the Security Acknowledgement Form can be considered a breach of this Agreement at the discretion of the State. It is also a breach of this Agreement, at the discretion of the State, if the Vendor does not sign another Security Acknowledgement Form covering any employee(s) and any subcontractor’s, agent’s, assign’s, or affiliated entities’ employee(s), any of whom are participating in the work covered by this Agreement, and who begin working under this Agreement after the project has begun. Any disciplining of the Vendor’s, Vendor’s employee(s), or subcontractor’s, agent’s, assign’s, or affiliated entities’ employee(s) due to a failure to abide by the terms of the Security Acknowledgement Form will be done at the discretion of the Vendor or subcontractors, agents, assigns, or affiliated entities and in accordance with the Vendor’s or subcontractor’s, agent’s, assign’s, and affiliated entities’ personnel policies. Regardless of the actions taken by the Vendor and subcontractors, agents, assigns, and affiliated entities, the State will retain the right to require at the State’s discretion the removal of the employee(s) from the project covered by this Agreement.

Section XXVII. Background Investigations

The State requires any person who writes or modifies State-owned software, alters hardware, configures software of State-owned technology resources, has access to source code or protected Personally Identifiable Information (PII) or other confidential information, or has access to secure areas to undergo fingerprint-based background investigations. These fingerprints will be used to check the criminal history records of both the State of South Dakota and the Federal Bureau of Investigation. These background investigations must be performed by the State with support from the State’s law enforcement resources. The State will supply the fingerprint cards and prescribe the procedure to be used to process the fingerprint cards. Project plans should allow 2-4 weeks to complete this process.

If work assignments change after the initiation of the project covered by this Agreement so that a new person will be writing or modifying State-owned software, altering hardware, configuring software of State-owned technology resources, have access to source code or protected PII or other confidential information, or have access to secure areas, background investigations must be performed on the individual who will complete any of the referenced tasks. The State reserves the right to require the Vendor to prohibit any person from performing work under this Agreement whenever the State believes that having the person performing work under this Agreement is detrimental to the project or is considered by the State to be a security risk, based on the results of the background investigation. The State will provide the Vendor with notice of this determination.

Section XXVIII. Information Technology Standards

Any service, software, or hardware provided under this Agreement will comply with State standards which can be found at https://bit.sd.gov/bit?id=bit_standards_overview.

Section XXIX. Product Usage

The State cannot be held liable for any additional costs or fines for mutually understood product usage over and above what has been agreed to in this Agreement unless there has been an audit conducted on the product usage. This audit must be conducted using a methodology agreed to by the State. The results of the audit must also be agreed to by the State before the State can be held to the results. Under no circumstances will the State be required to pay for the costs of said audit.

Section XXX. Security

The Vendor must take all actions necessary to protect State information from exploits, inappropriate alterations, access or release, and malicious attacks.

By signing this Agreement, the Vendor warrants that:

A. All Critical, High, Medium, and Low security issues are resolved. Critical, High, Medium, and

Low can be described as follows:

1. Critical - Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.

2. High - The vulnerability is difficult to exploit; however, it is possible for an expert in Information Technology. Exploitation could result in elevated privileges.

3. Medium - Vulnerabilities that require the attacker to manipulate individual victims via social engineering tactics. Denial of service vulnerabilities that are difficult to set up.

4. Low - Vulnerabilities identified by the State as needing to be resolved that are not Critical, High,…