Appendix 9_Information and Security.pdf

APPENDIX 9: Information and Security

Request for Proposals

RFP-2026-0911

Washington State

Roadway Toll Systems

Modernization Programs

Offered by

Washington State Department of

Transportation

Roadway Toll Systems Project Appendix 9 Information and Security

9-i

State of Washington Contract No. ___ Department of Transportation

Table of Contents

APPENDIX 9. INFORMATION AND SECURITY .................................................................. 9-1

9.3.1 GENERAL IT WARRANTY ...................................................................................................9-2

9.3.2 SOFTWARE WARRANTY ....................................................................................................9-2

9.3.3 IT REMEDY ...........................................................................................................................9-3

9.4.1 CONFIDENTIAL INFORMATION ..........................................................................................9-3

9.4.2 CLOUD SERVICE AND HOSTED SERVICE CUSTOMER DATA ........................................9-4

9.4.3 USER DATA ..........................................................................................................................9-4

9.4.4 DERIVED DATA ....................................................................................................................9-4

9.4.5 DATA ENCRYPTION ............................................................................................................9-5

9.4.6 DATA DISPOSAL ..................................................................................................................9-5

9.5.1 APPLICATION SECURITY ...................................................................................................9-5

9.5.2 COMPUTER SECURITY .......................................................................................................9-5

9.5.3 SECURITY AUDIT ................................................................................................................9-5

9.5.4 SECURITY INCIDENT ..........................................................................................................9-5

9.5.5 SECURITY INCIDENT ............................................. 9-ERROR! BOOKMARK NOT DEFINED.

9.5.6 AUTHENTICATION ...............................................................................................................9-6

9.6.1 NETWORK ACCESS ............................................................................................................9-6

9.6.2 ACCEPTABLE USE ..............................................................................................................9-6

9.7.1 DATA OWNERSHIP AND USE .............................................................................................9-7

9.7.2 OFFSHORING OF SOFTWARE AND DATA ........................................................................9-7

9.7.3 DATA BACKUP .....................................................................................................................9-7

9.7.4 RETURN OF DATA ...............................................................................................................9-7

9.7.5 DATA RETENTION ...............................................................................................................9-8

9.7.6 ARTIFICIAL INTELLIGENCE ................................................................................................9-8

9-1

State of Washington Contract No. ___ Department of Transportation

Appendix 9. Information and Security

9.1 Introduction

Vendor, also referred to as Contractor for the purposes of this document, will provide all Products and/or perform all Services for or on behalf of WSDOT in full compliance with WaTech’s SEC series policies and standards, located at: https://watech.wa.gov/policies

WaTech provides an overall framework for security of IT systems that fall within the State of

Washington’s responsibility. These policies and standards are for state agencies and vendors providing services to those agencies and are therefore applicable to this project.

This document covers the high-level requirements within these policies and standards and it is the

Vendor’s responsibility to review them in detail at the WaTech website.

9.2 Policies and Standards

Contractor shall comply with the following WaTech policies, standards, and guidance:

• SEC-02 - Security Assessment and Authorization Policy

• SEC-03 - IT Security and Privacy Awareness Training Policy

• SEC-04 - Asset Management Policy

• SEC-04-01-S - Data Backup and Recovery Standard

• SEC-04-02-S - Media Sanitization and Disposal Standard

• SEC-04-03-S - Configuration Management Standard

• SEC-04-04-S - Firewall Standard

• SEC-05 - Change Management Policy

• SEC-06-02-S - Remote Access Standard

• SEC-07 - Physical and Environmental Protection Policy

• SEC-08 - Data Sharing Policy

• SEC-08-01-S - Data Classification Standard

• SEC-08-02-S - Encryption Standard

• SEC-09 - IT Security Audit and Accountability Policy

• SEC-011 - Information Security Risk Management Policy

• SEC-11-01-S - Risk Assessment Standard

• SEC-11-02-S - Vulnerability Management Standard

• SEC-12 - Information Technology Disaster Recovery Planning Policy

• SEC-13 - International Travel Technology Policy https://watech.wa.gov/policies https://watech.wa.gov/policies/security-assessment-and-authorization-policy https://watech.wa.gov/policies/it-security-and-privacy-awareness-training-policy https://watech.wa.gov/policies/asset-management-policy https://watech.wa.gov/policies/data-backup-and-recovery-standard https://watech.wa.gov/policies/media-sanitization-and-disposal-standard https://watech.wa.gov/policies/configuration-management-standard https://watech.wa.gov/policies/firewall-standard https://watech.wa.gov/policies/change-management-policy https://watech.wa.gov/policies/remote-access-standard https://watech.wa.gov/policies/physical-and-environmental-protection-policy https://watech.wa.gov/policies/data-sharing-policy https://watech.wa.gov/policies/data-classification-standard https://watech.wa.gov/policies/encryption-standard https://watech.wa.gov/policies/it-security-audit-and-accountability-policy https://watech.wa.gov/policies/information-security-risk-management-policy https://watech.wa.gov/policies/risk-assessment-standard https://watech.wa.gov/policies/vulnerability-management-standard https://watech.wa.gov/policies/information-technology-disaster-recovery-planning-policy https://watech.wa.gov/policies/international-travel-technology-policy

9-2

State of Washington Contract No. ___ Department of Transportation

• SEC-13-01-S - International Travel Technology Standard

9.3 Warranty

9.3.1 GENERAL IT WARRANTY

Contractor warrants, that all hardware, software, and firmware associated with Services ( “IT

Services”) will not: (a) contain any viruses, malicious code, Trojan horse, worm, time bomb, self-help code, back door, or other software code or routine designed to: (i) damage, destroy, or alter any software or hardware; (ii) reveal, damage, destroy, or alter any data; (iii) disable any computer program automatically; or (iv) permit unauthorized access to any software or hardware; (b) contain any third party software (including software that may be considered free software or open source software) that (i) may require any software to be published, accessed, or otherwise made available without the consent of Purchaser, or (ii) may require distribution, copying, or modification of any software free of charge; and (c) infringe on any patent, copyright, trademark, or other proprietary or intellectual property right of any third party or misappropriate any trade secret of any third party

(“IT Warranty”). The IT Warranty will expire twelve (12) months after the date IT Services are complete, as applicable.

9.3.2 SOFTWARE WARRANTY

Current Version of Software and System Obsolescence. Contractor represents and warrants that it used the latest version of the SaaS/PaaS/software when developing the system for the

Agency. Contractor represents and warrants that, except as provided in this Section, the Software, hardware, equipment, and all other components of the System shall not become obsolete during the term of this Contract. Contractor’s pricing has included the cost of replacing obsolete software, hardware, and equipment through planned obsolescence by the applicable manufacturer and/or licensor. In the case that any such Software, hardware, or equipment becomes obsolete during the term of this Contract, Contractor will replace the affected components with functional equivalents that are subject to maintenance and support by the applicable manufacturer and/or licensor without additional cost to Agency.

System Functionality. Contractor represents and warrants that the operation of the System shall meet all Agency specifications as provided in this Contract and relevant exhibits and attachments following its acceptance by Agency. Contractor warrants that it will maintain the System to meet the standards set forth in this Contract. Contractor shall repair or replace any aspect or functionality of the System source code that does not meet applicable specifications as provided herein at no additional charge during configuration. Contractor also represents and warrants that the System will possess all the features and functions described in the documentation provided to Agency under this Contract and that the System will operate without any defects introduced or caused by the Contractor after a software upgrade or bug fix. Contractor shall immediately correct any System functionality that is not in compliance with such representations and warranties at no cost to

Agency.

Contractor Performance. Contractor also represents and warrants that:

(a) Contractor shall operate the System in a professional manner, with high quality, knowledge, and experience in business and systems integrations, maintenance, support, and operations.

https://watech.wa.gov/policies/international-travel-technology-standard

9-3

State of Washington Contract No. ___ Department of Transportation

(b) Contractor shall perform all services required pursuant to the Contract in a professional manner, with high quality.

(c) Contractor shall give highest priority to the performance of the System.

(d) Time shall be of the essence in connection with performance of the System.

(e) Contractor shall promptly and correctly re-perform services which are not in compliance with this Contract at no cost to Agency during configuration.

Ability to Perform. Contractor represents that it has and warrants that it shall have the capability and capacity to provide and operate the System it has agreed to provide to Agency, and that it shall secure all Third-Party Software licenses, if necessary, to operate the System in accordance with the terms of the Contract.

No Viruses/Malware. Contractor represents and warrants their cloud services do not contain any virus, ransomware, trap door, back door, time bomb, Trojan horse, worm, file infectors, or other malware. Should malicious code be identified during, before or after deployment of the System, the

Contractor must notify the Agency, remedy the issue, and provide what was done to remedy the issue to the Agency.

Agency Configurations. Any system configurations made by the Agency (either during testing or after acceptance) shall not void any warranties provided by Contractor in this Contract.

9.3.3 IT REMEDY

If IT Services do not comply with the IT Warranty, or if any defect or nonconformance develops during the IT Warranty Period, Contractor, at Agency’s election, promptly will: (a) re-perform or correct the non-conforming IT Services at no additional cost to Agency; or (b) refund the amounts paid for IT Services.

9.4 Confidential Information and Data

9.4.1 CONFIDENTIAL INFORMATION

(a) Confidential Information. For purposes of this Contract, “Confidential Information” includes, but is not limited to, information that is deemed confidential under federal or state law, personal information as defined in RCW 42.56.590, as well as any information identified, in writing, by Purchaser as confidential or protected.

(b) Protection of Confidential Information. Notwithstanding any provision to the contrary, Contractor’s use of Confidential Information will be in compliance with all applicable state and federal law. At a minimum, Contractor shall maintain records documenting: (i) the Confidential

Information received pertaining to this Contract; (ii) the purpose(s) for which the Confidential

Information was received; (iii) who received and maintained the Confidential Information; and

(iv) final disposition of the Confidential Information. Purchaser reserves the right to monitor, audit, and/or investigate Contractor’s use of Confidential Information used, collected, or acquired by Supplier pursuant to this Contract.

9-4

State of Washington Contract No. ___ Department of Transportation

(c) Contractor Obligation – Confidential Information. Contractor shall: (i) hold Confidential

Information in strictest confidence and not make use of Confidential Information for any purpose other than the performance of this Contract; (ii) release Confidential Information only to authorized employees or agents requiring such information for the purpose of performing this

Contract and who have executed an appropriate nondisclosure agreement or data sharing agreement as approved by Purchaser; (iii) implement and maintain physical, electronic, and managerial safeguards to prevent unauthorized access to Confidential Information including, but not limited to, storing Confidential Information on secure servers with access to the data strictly controlled and limited to staff with appropriate training and clearance; and (iv) ensure that all Confidential Information is encrypted in transmission from and to Contractor, at rest in the data base or other data facility maintained or used by Contractor, and when transmitted to authorized recipients using NIST FIPS approved encryption for the confidentiality and integrity of data at rest and data in transit.

(d) Contractor Obligation – Expiration or Termination. Upon expiration or termination of this

Purchase Order, Contractor, at Purchaser’s direction, timely will: (i) Certify to Purchaser that all

Confidential Information has been destroyed; or (ii) return all Confidential Information to

Purchaser; or (iii) take whatever other actions Purchaser requires of Contractor to protect such

Confidential Information.

9.4.2 CLOUD SERVICE AND HOSTED SERVICE CUSTOMER DATA

“Customer Data” means any and all information, data, materials, works, expressions, or other content, including any that are (a) uploaded, submitted, posted, transferred, transmitted, or otherwise provided or made available by or on behalf of Purchaser or any Authorized User for processing by or through the Services, or (b) collected, downloaded, or otherwise received by

Contractor or the Services for Purchaser or any Authorized User pursuant to this Contract or at the written request or instruction of Purchaser or such Authorized User. Customer Data includes all

User Data, Derived Data, and Confidential Information.

9.4.3 USER DATA

“User Data" means any and all information reflecting the access or use of the Services by or on behalf of Agency or any Authorized User, including any end user profile-, visit-, session-, impression-, click through-, or click stream-data, and any Derived Data based on or derived from any of the foregoing.

9.4.4 DERIVED DATA

“Derived Data” means new data sets and/or data element(s) resulting from the creation, generation, and/or processing of some or all of the Data and Confidential Information sent by Agency to the

Contractor [and/or its Subgrantees/subcontractors] through aggregation, algorithmic manipulation, or other processes; provided, however, that the Derived Data cannot be reverse engineered, associated with, or otherwise linked (directly or indirectly) to Purchaser or the Customer Data and

Confidential Information.

9-5

State of Washington Contract No. ___ Department of Transportation

9.4.5 DATA ENCRYPTION

Contractor shall use NIST FIPS approved encryption for the confidentiality and integrity of data at rest and data in transit. Contractors will maintain any validation or attestation reports that the encryption product creates. Any reports are subject to the Agency’s audit in accordance with this

Contract.

9.4.6 DATA DISPOSAL

Upon expiration or termination of this Contract, Contractor, at Agency’s direction, timely will: (i)

Certify to Agency that all Confidential Information has been destroyed; or (ii) return all Confidential

Information to Agency; or (iii) take whatever other actions Agency requires of Contractor to protect such Confidential Information. For disposal of data at a minimum, Contractor shall perform media sanitization according to the standards enumerated by National Institute of Standards and

Technology (NIST) Special Publications (SP) 800-88 Rev.1 Guidelines for Media Sanitization or compliance with WaTech policy SEC-04-02-S.

9.5 Data Security

9.5.1 APPLICATION SECURITY

Contractor shall regularly maintain and support its software and subsequent upgrades, updates, patches, and bug fixes such that the software is and remains secure from known vulnerabilities.

9.5.2 COMPUTER SECURITY

Contractor shall maintain its computers that access Data by ensuring the operating system and software are updated and patched monthly, such that they remain secure from known vulnerabilities. Contractor computer device(s) must also be installed with an Anti-Malware solution and signatures updated no less than monthly.

9.5.3 SECURITY AUDIT

See Appendix 5, Section 5.2.9 Information Technology Security Audit, for security audit requirements.

9.5.4 SECURITY INCIDENT

Security Incident means the successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system. Any

Security Incident may constitute a Data Breach under this Contract.

If the Contractor does not have full details about the Security Incident, it will report what information it has and provide full details within fifteen (15) business days of discovery. To the extent possible, the initial report must include:

1. The nature of the unauthorized use or disclosure, including a brief description of what happened, the date of the event(s), and the date of discovery;

9-6

State of Washington Contract No. ___ Department of Transportation

2. A description of the types of Data and Confidential Information involved;

3. The investigative and remedial actions that the Contractor or its Subgrantee/subcontractor took and/or will take to prevent and mitigate harmful effects and protect against recurrence;

and

4. Any details necessary for a determination of whether the Security Incident is a Data Breach which requires notification under RCW 19.255.010, RCW 42.56.590, or any other applicable

Data Breach notification requirement; and

5. Any other information that the Contractor has which Agency requests.

The Contractor must also take all reasonable actions to mitigate the risk of loss related to the Data and Confidential Information and comply with any notification or other requirements imposed by applicable law or Agency.

9.5.5 AUTHENTICATION

Contractor solution must utilize user authentication in alignment with Appendix 4, Section 4.3.6.1

System Security.

9.6 Network Use

9.6.1 NETWORK ACCESS

During its performance of this Contract, Contractor may be granted access to Purchaser’s computer and telecommunication networks (“Networks”). As a condition of Network use, Contractor shall:

(a) use the Networks in compliance with all applicable laws, rules, and regulations; (b) use software, protocols, and procedures as directed by Purchaser to access and use the Networks; (c) only access Network locations made available to Contractor by Purchaser; (d) not interfere with or disrupt other users of the Networks; (e) assure the transmissions over the Networks by Contractor

(i) do not contain any libelous, defamatory, profane, offensive, obscene, pornographic, or unlawful material, and (ii) are not used to perform any illegal activities, including but not limited to, encouraging, selling, or soliciting illegal drugs, gambling, pornography, prostitution, robbery, spreading computer worms or viruses, hacking into computer systems, or trafficking credit card codes; and (f) upon termination or expiration of the Contract, relinquish all IP addresses or address blocks assigned to them on the Networks. Additionally, Contractor shall comply with Purchaser’s

IT policies.

9.6.2 ACCEPTABLE USE

Contractors shall comply with the state Acceptable Use Policy (USER-02) and Mobile Device

Usage Policy (USER-03) for any IT assets used in performance of the Contract. Any devices

Contractor provides must comply with Non-Agency Issued Device Standard (SEC-04-07-S).

https://watech.wa.gov/sites/default/files/2024-09/User-02%20Acceptable%20Use%20Policy.pdf https://watech.wa.gov/sites/default/files/2024-08/USER-03%20Mobile%20Device%20Usage%20Policy_0.pdf https://watech.wa.gov/sites/default/files/2024-08/SEC-04-07-S%20Non-Agency%20Issued%20Device%20Security%20Standard.pdf

9-7

State of Washington Contract No. ___ Department of Transportation

9.7 Data Management

9.7.1 DATA OWNERSHIP AND USE

Agency’s data (“Data”) shall include data collected, used, processed, stored, or generated as the result of the use of the Services. Data is and shall remain the sole and exclusive property of

Agency. Contractor is provided a limited, non-exclusive license to access and use Data solely for performing its obligations under the Contract. Contractor shall: (a) keep and maintain Data in strict confidence and as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) not use, sell, rent, transfer, distribute, or otherwise disclose or make available Data for Contractor’s own purposes or for the benefit of anyone other than Agency without Agency’ prior written consent; and (c) use NIST FIPS approved encryption for the confidentiality and integrity of Data at rest and Data in transit.

9.7.2 OFFSHORING OF SOFTWARE AND DATA

Contractors must obtain written approval from WSDOT prior to accessing WSDOT’s data from locations outside the United States, or before storing, processing, or transmitting WSDOT’s data outside of the United States.

9.7.3 DATA BACKUP

As part of the Services, Contractor is responsible for maintaining a backup of Data and for an orderly and timely recovery of such Data in the event that the Services may be interrupted.

Contractor shall maintain a contemporaneous backup of Data that can be recovered within two (2) hours at any point in time.

Contractor shall document backup and recovery plan, procedures, and retention schedules for data received from Agency that is processed and stored as part of this Contract.

Agency shall have the right to review and ensure that appropriate, proper backups are being made.

Contractor shall maintain at least two (2) Data backups to ensure recovery should any of the backups not recover properly, one (1) primary and one (1) redundant copy. At least one copy shall be stored in a different region.

Contractor shall maintain Backup logs, backup reports, or other backup audit trails to track backup media; the information, data, or files backed up on the media, the date and time of the backup, and the successful completion of the backup.

See also Appendix 4, Section 4.3.4.8.3 Data Backup and Recovery, and Appendix 3, Section 3.11.7

Disaster Recovery Plan.

9.7.4 RETURN OF DATA

Contractor shall, within one (1) business day of Agency’s request, provide Agency, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Contractor), an extract of the Data in the format specified by Agency.

9-8

State of Washington Contract No. ___ Department of Transportation

9.7.5 DATA RETENTION

Contractor shall retain electronic Data documents based on the appropriate record series/document type defined by either the Washington State Government General Records

Retention Schedule or DES Records Retention Schedule. Upon expiration of the retention period

(and the lifting of an applicable holds) for the record series/document type electronic DES Data shall be destroyed in accordance with the Data Disposal requirements set forth in Section 9.4.6 herein.

9.7.6 ARTIFICIAL INTELLIGENCE

Use of Artificial Intelligence (AI) or Generative AI in applications utilized on this Contract shall be disclosed by the Contractor to WSDOT for approval and documented in the system design documents, with updates incorporated over the life of the contract as appropriate.

Contractor shall not use or retain agency data in any AI systems outside of the express approval of WSDOT.

Contractor shall be aware there are AI policies WSDOT is responsible for following, such as

WaTech DATA-04: DATA-04_AI_Policy.pdf.

END OF APPENDIX

https://watech.wa.gov/sites/default/files/2025-12/DATA-04_AI_Policy.pdf