Appendix A - Required BIT Contract Clauses.pdf

Appendix A Bureau of Information and Telecommunications

Required IT Contract Terms

Any contract resulting from this RFP will include the State’s required IT terms and conditions as listed below, along with any additional terms and conditions as negotiated by the parties. Due to the changing landscape of IT security and data privacy, the State reserves the right to add additional IT terms and conditions or modify the IT terms and conditions listed below to the resulting contract:

Pursuant to South Dakota Codified Law § 1-33-44, the Bureau of Information and Telecommunications ("BIT") oversees the acquisition of office systems technology, software, and services; telecommunication equipment, software, and services; and data processing equipment, software, and services for departments, agencies, commissions, institutions, and other units of state government. As part of its duties as the Executive Branch’s centralized IT agency, BIT requires the contract terms and conditions of this Exhibit XX. For purposes of this Exhibit, [Vendor Name] will be referred to as the “Vendor.”

It is understood and agreed to by all parties that BIT has reviewed and approved only this Exhibit.

Due to the ever-changing security and regulatory landscape in IT and data privacy, before renewal of this Agreement BIT must review and approve the clauses found in this Exhibit as being the then current version of the clauses and if any additional required clauses are needed. Changes to clauses in this Exhibit must be approved in writing by all parties before they go into effect and a renewal of this Agreement is possible.

The Parties agree, when used in this Exhibit, the term “Vendor” will mean the Vendor and the Vendor’s employees, subcontractors, agents, assigns, and affiliated entities.

Section I. Confidentiality of Information

For purposes of this paragraph, “State Proprietary Information” will include all information disclosed to the Vendor by the State. The Vendor will not disclose any State Proprietary Information to any third person for any reason without the express written permission of a State officer or employee with authority to authorize the disclosure. The Vendor must not: (i) disclose any State Proprietary Information to any third person unless otherwise specifically allowed under this Agreement; (ii) make any use of State Proprietary Information except to exercise rights and perform obligations under this Agreement; (iii) make State Proprietary Information available to any of its employees, officers, agents, or third party consultants except those who have a need to access such information and who have agreed to obligations of confidentiality at least as strict as those set out in this Agreement. The Vendor is held to the same standard of care in guarding State Proprietary Information as it applies to its own confidential or proprietary information and materials of a similar nature, and no less than holding State Proprietary Information in the strictest confidence. The Vendor must protect the confidentiality of the State’s information from the time of receipt to the time that such information is either returned to the State or destroyed to the extent that it cannot be recalled or reproduced. The Vendor agrees to return all information received from the State to the State’s custody upon the end of the term of this Agreement, unless otherwise agreed in a writing signed by both parties. State Proprietary Information will not include information that:

A. was in the public domain at the time it was disclosed to the Vendor, B. was known to the Vendor without restriction at the time of disclosure from the State, C. that was disclosed with the prior written approval of State’s officers or employees having authority to disclose such information, D. was independently developed by the Vendor without the benefit or influence of the State’s information, and E. becomes known to the Vendor without restriction from a source not connected to the State of South Dakota.

State’s Proprietary Information can include names, social security numbers, employer numbers, addresses and other data about applicants, employers or other clients to whom the State provides services of any kind. The Vendor understands that this information is confidential and protected under State law. The Parties mutually agree that neither of them nor any subcontractors, agents, assigns, or affiliated entities will disclose the contents of this Agreement except as required by applicable law or as necessary to carry out the terms of the Agreement or to enforce that Party’s rights under this Agreement. The Vendor acknowledges that the State and its agencies are public entities and thus may be bound by South Dakota open meetings and open records laws. It is therefore not a breach of this Agreement for the State to take any action that the State reasonably believes is necessary to comply with South Dakota open records or open meetings laws.

Section II. Cyber Liability Insurance

The Vendor will maintain cyber liability insurance with liability limits in the amount of $ to protect any and all State Data the Vendor receives as part of the project covered by this agreement including State Data that may reside on devices, including laptops and smart phones, utilized by Vendor employees, whether the device is owned by the employee or the Vendor. If the Vendor has a contract with a third-party to host any State Data the Vendor receives as part of the project under this Agreement, then the Vendor will include a requirement for cyber liability insurance as part of the contract between the Vendor and the third-party hosting the data in question. The third-party cyber liability insurance coverage will include State Data that resides on devices, including laptops and smart phones, utilized by third-party employees, whether the device is owned by the employee or the third-party Vendor. The cyber liability insurance will cover expenses related to the management of a data breach incident, the investigation, recovery and restoration of lost data, data subject notification, call management, credit checking for data subjects, legal costs, and regulatory fines. Before beginning work under this Agreement, the Vendor will furnish the State with properly executed Certificates of Insurance which shall clearly evidence all insurance required in this Agreement and which provide that such insurance may not be canceled, except on 30 days prior written notice to the State. The Vendor will furnish copies of insurance policies if requested by the State. The insurance will stay in effect for three years after the work covered by this Agreement is completed.

Section III. Rejection or Ejection of Vendor

The State, at its option, may require the vetting of any of the Vendor, and the Vendor‘s subcontractors, agents, Assigns, or affiliated entities. The Vendor is required to assist in this process as needed.

The State reserves the right to reject any person from participating in the project or require the Vendor to remove from the project any person the State believes is detrimental to the project or is considered by the State to be a security risk. The State will provide the Vendor with notice of its determination, and the reasons for the rejection or removal if requested by the Vendor. If the State signifies that a potential security violation exists with respect to the request, the Vendor must immediately remove the individual from the project.

Section IV. Domain Name Ownership

Any website(s) that the Vendor creates as part of this Agreement must have the domain name registered by and owned by the State. If, as part of this Agreement, the Vendor is providing a service that utilizes a website with the domain name owned by the Vendor, the Vendor must give 30 days’ written notice before abandoning the site. If the Vendor intends to sell the site to another party, the Vendor must give the State 30 days’ written notice and grant the State the right of first refusal. For any site or domain, whether hosted by the Vendor or within the State web infrastructure, any and all new web content should first be created in a development environment and then subjected to security scan before being approved for a move up to the production level.

This paragraph does not include websites developed for the Vendor’s internal use.

Section V. Software Functionality and Replacement

The software licensed by the Vendor to the State under this Agreement will provide the functionality as described in the software documentation, which the Vendor agrees to provide to the State prior to or upon the execution of this Agreement.

The Vendor agrees that:

A. If, in the opinion of the State, the Vendor reduces or replaces the functionality contained in the licensed product and provides this functionality as a separate or renamed product, the State will be entitled to license such software product at no additional license or maintenance fee.

B. If, in the opinion of the State, the Vendor releases an option, future product, purchasable product or other release that has substantially the same functionality as the software product licensed to the State, and it ceases to provide maintenance for the older software product, the State will have the option to exchange licenses for such replacement product or function at no additional charge. This includes situations where the Vendor discontinues the licensed product and recommends movement to a new product as a replacement option regardless of any additional functionality the replacement product may have over the licensed product.

Section VI. Service Bureau

Consistent with use limitations specified in the Agreement, the State may use the product to provide services to the various branches and constitutional offices of the State of South Dakota as well as county and city governments, tribal governments, and school districts. The State will not be considered a service bureau while providing these services and no additional fees may be charged unless agreed to in writing by the State.

Section VII. Federal Intellectual Property Bankruptcy Protection Act

The Parties agree that the State will be entitled to all rights and benefits of the Federal Intellectual Property Bankruptcy Protection Act, Public Law 100-506, codified at 11 U.S.C. 365(n), and any amendments thereto. The State also maintains its termination privileges if the Vendor enters bankruptcy.

Section VIII. Non-Disclosure and Separation of Duties

The Vendor will enforce separation of job duties and require non-disclosure agreements of all staff that have or can have access to State Data or the hardware that State Data resides on. The Vendor will limit staff knowledge to those staff whose duties that require them to have access to the State Data or the hardware the State Data resides on.

Section IX. Cessation of Business

The Vendor will notify the State of impending cessation of its business or that of a tiered provider and the Vendor’s contingency plan. This plan should include the immediate transfer of any previously escrowed assets and data and State access to the Vendor’s facilities to remove or destroy any state-owned assets and data. The Vendor will implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the State.

The Vendor will provide a fully documented service description and perform and document a gap analysis by examining any differences between its services and those to be provided by its successor. The Vendor will also provide a full inventory and configuration of servers, routers, other hardware, and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the State. The Vendor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and impact on the State, all such work to be coordinated and performed in advance of the formal, final transition date.

Section X. Legal Requests for Data

Except as otherwise expressly prohibited by law, the Vendor will:

A. Immediately notify the State of any subpoenas, warrants, or other legal orders, demands or requests received by the Vendor seeking State Data maintained by the Vendor, B. Consult with the State regarding the Vendor’s response, C. Cooperate with the State’s requests in connection with efforts by the State to intervene and quash or modify the legal order, demand or request, and D. Upon the State’s request, provide the State with a copy of both the demand or request and its proposed or actual response.

Section XI. eDiscovery

The Vendor will contact the State upon receipt of any electronic discovery, litigation holds, discovery searches, and expert testimonies related to, or which in any way might reasonably require access to State Data. The Vendor will not respond to service of process, and other legal requests related to the State without first notifying the State unless prohibited by law from providing such notice.

Section XII. Audit Requirements

The Vendor warrants and agrees it is aware of and complies with all audit requirements relating to the classification of State Data the Vendor stores, processes, and accesses. Depending on the data classification, this may require the Vendor to grant physical access to the data hosting facilities to the State or a federal agency. The Vendor will notify the State of any request for physical access to a facility that hosts or processes State Data by any entity other than the State.

Section XIII. Annual Risk Assessment

The Vendor will conduct an annual risk assessment or when there has been a significant system change. The Vendor will provide verification to the State’s contact upon request that the risk assessment has taken place. At a minimum, the risk assessment will include a review of the:

A. Penetration testing of the Vendor’s system;

B. Security policies and procedures;

C. Disaster recovery plan;

D. Business Associate Agreements; and E. Inventory of physical systems, devices, and media that store or utilize ePHI for completeness.

If the risk assessment provides evidence of deficiencies, a risk management plan will be produced. Upon request by the State, the Vendor will send a summary of the risk management plan to the State’s contact. The summary will include completion dates for the risk management plan’s milestones. Upon request by the State, the Vendor will send updates on the risk management plan to the State’s contact. Compliance with this Section may be met if the Vendor provides proof to the State that the Vendor is FedRAMP Certified and has maintained FedRAMP Certification.

Section XIV. Independent Audit

The Vendor will disclose any independent audits that are performed on any of the Vendor’s systems tied to storing, accessing, and processing State Data. This information on an independent audit(s) must be provided to the State in any event, whether the audit or certification process is successfully completed or not. The Vendor will provide a copy of the findings of the audit(s) to the State. Compliance with this Section may be met if the Vendor provides a copy of the Vendor’s SOC 2 Type II report to the State upon request.

Section XV. Service Level Agreements

The Vendor warrants and agrees that the Vendor has provided to the State all Service Level Agreements (SLA) related to the deliverables of the Agreement. The Vendor further warrants that it will provide the deliverables to the State in compliance with the SLAs.

Section XVI. Access Attempts

The Vendor will log all access attempts, whether failed or successful, to any system connected to the hosted system which can access, read, alter, intercept, or otherwise impact the hosted system or its data or data integrity. For all systems, the log must include at least: login page used, username used, time and date stamp, incoming IP for each authentication attempt, and the authentication status, whether successful or not. Logs must be maintained not less than 7 years in a searchable database in an electronic format that is un-modifiable. At the request of the State, the Vendor agrees to grant the State access to those logs to demonstrate compliance with the terms of this Agreement and all audit requirements related to the hosted system.

Section XVII. Access to State Data

Unless this Agreement is terminated, the State’s access to State Data amassed pursuant to this Agreement will not be hindered if there is a:

A. Contract dispute between the parties to this Agreement, B. There is a billing dispute between the parties to this Agreement, or C. The Vendor merges with or is acquired by another company.

Section XVIII. Password Protection

All aspects of the Vendor’s products provided to the State pursuant to this Agreement will be password protected. If the Vendor provides the user with a preset or default password, that password cannot include any Personally Identifiable Information (PII), data protected under the Family Educational Rights and Privacy Act (FERPA), Protected Health Information (PHI), Federal Tax Information (FTI), or any information defined under federal or state law, rules, or regulations as confidential information or fragment thereof. On an annual basis, the Vendor will document its password policies for all Vendor employees to ensure adequate password protections are in place. The process used to reset a password must include security questions or Multifactor Authentication. Upon request, the Vendor will provide to the State the Vendor’s password policies, logs, or administrative settings to demonstrate the password policies are actively enforced.

Section XIX. Provision of Data

State Data is any data produced or provided by the State as well as any data produced or provided for the State by the Vendor or a third-party.

Upon notice of termination by either party or upon reaching the end of the term of this Agreement, the Vendor will provide the State all current State Data in a non-proprietary format. In addition, the Vendor agrees to extract any information (such as metadata, which includes data structure descriptions, data dictionary, and data) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. If the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Upon the effective date of the termination of this Agreement, the Vendor will again provide the State with all current State Data in a non-proprietary format. In addition, the Vendor will again extract any information (such as metadata) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. As before, if the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Section XX. Threat Notification

A credible security threat consists of the discovery of an exploit that a person considered an expert on Information Technology security believes could be used to breach any aspect of a system that is holding State Data or a product provided by the Vendor. Upon becoming aware of a credible security threat with the Vendor’s product(s) and or service(s) being used by the State, the Vendor or any subcontractor supplying product(s) or service(s) to the Vendor needed to fulfill the terms of this Agreement will notify the State within two business days of any such threat. If the State requests, the Vendor will provide the State with information on the threat.

Section XXI. Security Incident Notification for Non-Health Information

The Vendor will implement, maintain, and update Security Incident procedures that comply with all State standards and Federal and State requirements. A Security Incident is a violation of any BIT security or privacy policies or contract agreements involving sensitive information, or the imminent threat of a violation. The BIT security policies can be found in the Information Technology Security Policy (“ITSP”) attached as BIT Attachment 1. The State requires notification of a Security Incident involving any of the State’s sensitive data in the Vendor’s possession. State Data is any data produced or provided by the State as well as any data produced or provided for the State by a third-party. The parties agree that, to the extent probes and reconnaissance scans common to the industry constitute Security Incidents, this Agreement constitutes notice by the Vendor of the ongoing existence and occurrence of such Security Incidents for which no additional notice to the State will be required. Probes and scans include, without limitation, pings and other broadcast attacks in the Vendor’s firewall, port scans, and unsuccessful log-on attempts, if such probes and reconnaissance scans do not result in a Security Incident as defined above. Except as required by other legal requirements the Vendor will only provide notice of the incident to the State. The State will determine if notification to the public will be by the State or by the Vendor.

The method and content of the notification of the affected parties will be coordinated with, and is subject to approval by the State, unless required otherwise by legal requirements. If the State decides that the Vendor will be distributing, broadcasting to or otherwise releasing information on the Security Incident to the news media, the State will decide to whom the information will be sent, and the State must approve the content of any information on the Security Incident before it may be distributed, broadcast, or otherwise released. The Vendor must reimburse the State for any costs associated with the notification, distributing, broadcasting, or otherwise releasing information on the Security Incident.

A. The Vendor must notify the State contact within 12 hours of the Vendor becoming aware that a Security Incident has occurred. If notification of a Security Incident to the State contact is delayed because it may impede a criminal investigation or jeopardize homeland or federal security, notification must be given to the State within 12 hours after law-enforcement provides permission for the release of information on the Security Incident.

B. Notification of a Security Incident at a minimum is to consist of the nature of the data exposed, the time the incident occurred, and a general description of the circumstances of the incident.

If all of the information is not available for the notification within the specified time period, the Vendor must provide the State with all of the available information along with the reason for the incomplete notification. A delay in excess of 12 hours is acceptable only if it is necessitated by other legal requirements.

C. At the State’s discretion within 12 hours the Vendor must provide to the State all data available including:

1. name of and contact information for the Vendor’s Point of Contact for the Security

Incident,

2. date and time of the Security Incident,

3. date and time the Security Incident was discovered,

4. description of the Security Incident including the data involved, being as specific as possible,

5. the potential number of records, and if unknown the range of records,

6. address where the Security Incident occurred, and

7. the nature of the technologies involved. If not all of the information is available for the notification within the specified time period, the Vendor must provide the State with all of the available information along with the reason for the incomplete information. A delay in excess of 12 hours is acceptable only if it is necessitated by other legal requirements.

D. If the Security Incident falls within the scope of South Dakota Codified Law Chapter 22-40, the Vendor is required to comply with South Dakota law.

The requirements of subsection D of this Section do not replace the requirements of subsections A, B, and C, but are in addition to them.

Section XXII. Handling of Security Incident for Non-Health Information

At the State’s discretion, the Vendor will preserve all evidence regarding a security incident including but not limited to communications, documents, and logs. The Vendor will also:

A. fully investigate the incident, B. cooperate fully with the State’s investigation of, analysis of, and response to the incident, C. make a best effort to implement necessary remedial measures as soon as it is possible, and D. document responsive actions taken related to the Security Incident, including any post-incident review of events and actions taken to implement changes in business practices in providing the services covered by this Agreement.

If, at the State’s discretion the Security Incident was due to the actions or inactions of the Vendor and at the Vendor’s expense the Vendor will use a credit monitoring service, call center, forensics company, advisors, or public relations firm whose services are acceptable to the State. At the State’s discretion the Vendor will offer two years of credit monitoring to each person whose data was compromised. The State will set the scope of any investigation. The State reserves the right to require the Vendor undergo a risk assessment where the State will determine the methodology and scope of the assessment and who will perform the assessment (a third-party vendor may be used). Any risk assessment required by this Section will be at the Vendor’s expense.

If the Vendor is required by federal law or regulation to conduct a Security Incident or data breach investigation, the results of the investigation must be reported to the State within 12 hours of the investigation report being completed. If the Vendor is required by federal law or regulation to notify the affected parties, the State must also be notified, unless otherwise required by law.

Notwithstanding any other provision of this Agreement, and in addition to any other remedies available to the State under law or equity, the Vendor will reimburse the State in full for all costs incurred by the State in investigation and remediation of the Security Incident including, but not limited, to providing notification to regulatory agencies or other entities as required by law or contract. The Vendor will also pay all legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Incident.

Section XXIII. Adverse Event

The Vendor must notify the State contact within three days if the Vendor becomes aware that an Adverse Event has occurred. An Adverse Event is the unauthorized use of system privileges, unauthorized access to State Data, execution of malware, physical intrusions and electronic intrusions that may include network, applications, servers, workstations, and social engineering of staff. If the Adverse Event was the result of the Vendor’s actions or inactions, the State can require a risk assessment of the Vendor the State mandating the methodology to be used as well as the scope. At the State’s discretion a risk assessment may be performed by a third party at the Vendor’s expense. State Data is any data produced or provided by the State as well as any data produced or provided for the State by a third-party.

Section XXIV. Browser

The system, site, or application must be compatible with Vendor supported versions of Edge, Chrome, Safari, and Firefox browsers. Silverlight, QuickTime, PHP, Adobe ColdFusion, and Adobe Flash will not be used in the system, site, or application. Adobe Animate CC is allowed if files that require third-party plugins are not required.

Section XXV. Security of Code

Any code written or developed pursuant to the terms of this Agreement must comply with the security requirements of this Agreement.

Section XXVI. Security Acknowledgment Form

The Vendor will be required to sign the Security Acknowledgement Form which is attached to this Agreement as BIT Attachment 2. The signed Security Acknowledgement Form must be submitted to the State and approved by the South Dakota Bureau of Information and Telecommunications and communicated to the Vendor by the State contact before work on the contract may begin.

This Security Acknowledgment Form constitutes the agreement of the Vendor to be responsible and liable for ensuring that the Vendor, the Vendor’s employee(s), and subcontractor’s, agents, assigns and affiliated entities and all of their employee(s), participating in the work will abide by the terms of the Information Technology Security Policy (ITSP) attached to this Agreement.

Failure to abide by the requirements of the ITSP or the Security Acknowledgement Form can be considered a breach of this Agreement at the discretion of the State. It is also a breach of this Agreement, at the discretion of the State, if the Vendor does not sign another Security Acknowledgement Form covering any employee(s) and any subcontractor’s, agent’s, assign’s, or affiliated entities’ employee(s), any of whom are participating in the work covered by this Agreement, and who begin working under this Agreement after the project has begun. Any disciplining of the Vendor’s, Vendor’s employee(s), or subcontractor’s, agent’s, assign’s, or affiliated entities’ employee(s) due to a failure to abide by the terms of the Security Acknowledgement Form will be done at the discretion of the Vendor or subcontractors, agents, assigns, or affiliated entities and in accordance with the Vendor’s or subcontractor’s, agent’s, assign’s, and affiliated entities’ personnel policies. Regardless of the actions taken by the Vendor and subcontractors, agents, assigns, and affiliated entities, the State will retain the right to require at the State’s discretion the removal of the employee(s) from the project covered by this Agreement.

Section XXVII. Background Investigations

The State requires any person who writes or modifies State-owned software, alters hardware, configures software of State-owned technology resources, has access to source code or protected Personally Identifiable Information (PII) or other confidential information, or has access to secure areas to undergo fingerprint-based background investigations. These fingerprints will be used to check the criminal history records of both the State of South Dakota and the Federal Bureau of Investigation. These background investigations must be performed by the State with support from the State’s law enforcement resources. The State will supply the fingerprint cards and prescribe the procedure to be used to process the fingerprint cards. Project plans should allow 2-4 weeks to complete this process.

If work assignments change after the initiation of the project covered by this Agreement so that a new person will be writing or modifying State-owned software, altering hardware, configuring software of State-owned technology resources, have access to source code or protected PII or other confidential information, or have access to secure areas, background investigations must be performed on the individual who will complete any of the referenced tasks. The State reserves the right to require the Vendor to prohibit any person from performing work under this Agreement whenever the State believes that having the person performing work under this Agreement is detrimental to the project or is considered by the State to be a security risk, based on the results of the background investigation. The State will provide the Vendor with notice of this determination.

Section XXVIII. Information Technology Standards

Any service, software, or hardware provided under this Agreement will comply with State standards which can be found at https://bit.sd.gov/bit?id=bit_standards_overview.

Section XXIX. Product Usage

The State cannot be held liable for any additional costs or fines for mutually understood product usage over and above what has been agreed to in this Agreement unless there has been an audit conducted on the product usage. This audit must be conducted using a methodology agreed to by the State. The results of the audit must also be agreed to by the State before the State can be held to the results. Under no circumstances will the State be required to pay for the costs of said audit.

Section XXX. Security

The Vendor must take all actions necessary to protect State information from exploits, inappropriate alterations, access or release, and malicious attacks.

By signing this Agreement, the Vendor warrants that:

A. All Critical, High, Medium, and Low security issues are resolved. Critical, High, Medium, and

Low can be described as follows:

1. Critical - Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.

2. High - The vulnerability is difficult to exploit; however, it is possible for an expert in Information Technology. Exploitation could result in elevated privileges.

3. Medium - Vulnerabilities that require the attacker to manipulate individual victims via social engineering tactics. Denial of service vulnerabilities that are difficult to set up.

4. Low - Vulnerabilities identified by the State as needing to be resolved that are not Critical, High, or Medium issues.

B. Assistance will be provided to the State by the Vendor in performing an investigation to determine the nature of any security issues that are discovered or are reasonably suspected after acceptance. The Vendor will fix or mitigate the risk based on the following schedule:

Critical and high risk, within 7 days, medium risk within 14 days, low risk, within 30 days.

C. All members of the development team have been successfully trained in secure programming techniques.

D. A source code control system will be used that authenticates and logs the team member associated with all changes to the software baseline and all related configuration and build files.

https://bit.sd.gov/bit?id=bit_standards_overview

E. State access to the source code will be allowed to ensure State security standards, policies, and best practices which can be found at https://bit.sd.gov/bit?id=bit_standards_overview.

F. The Vendor will fully support and maintain the Vendor’s application on platforms and code bases (including but not limited to: operating systems, hypervisors, web presentation layers, communication protocols, security products, report writers, and any other technologies on which the application depends) that are still being supported, maintained, and patched by the applicable third parties owning them. The Vendor may not withhold support from the State for this application nor charge the State additional fees as a result of the State moving the Vendor’s application to a new release of third-party technology if:

1. The previous version of the third-party code base or platform is no longer being maintained, patched, and supported; and

2. The new version to which the State moved the application is actively maintained, patched, and supported.

If there are multiple versions of the applicable code base or platform(s) supported by the third party in question, the Vendor may limit its support and maintenance to any of the applicable third-party code bases or platforms.

If a code base or platform on which the Vendor’s application depends is no longer supported, maintained, or patched by a qualified third party the Vendor commits to migrate its application from that code base or platform to one that is supported, maintained, and patched after the State has performed a risk assessment using industry standard tools and methods. Failure on the part of the Vendor to work in good faith with the State to secure a timely move to supported, maintained, and patched technology will allow the State to cancel this Agreement without penalty.

Section XXXI. Secure Product Development

By signing this Agreement, the Vendor agrees to provide the following information to the State:

A. Name of the person responsible for certifying that all deliverables are secure.

B. Documentation detailing the Vendor’s version upgrading process.

C. Notification process for application patches and updates.

D. List of tools used in the software development environment used to verify secure coding.

E. Based on a risk assessment, provide the State the secure configuration guidelines, specifications and requirements that describe security relevant configuration options and their implications for the overall security of the software. The guidelines, specifications and requirements must include descriptions of dependencies on the supporting platform, including operating system, web server, application server and how they should be configured for security. The default configuration of the software shall be secure.

At the State’s discretion the State will discuss the security controls used by the State with the Vendor upon the Vendor signing a non-disclosure agreement.

Section XXXII. Malicious Code

A. The Vendor warrants that the Agreement deliverables contain no code that does not support an application requirement.

B. The Vendor warrants that the Agreement deliverables contains no malicious code.

https://bit.sd.gov/bit?id=bit_standards_overview

C. The Vendor warrants that the Vendor will not insert into the Agreement deliverables or any media on which the Agreement deliverables is delivered any malicious or intentionally destructive code.

D. In the event any malicious code is discovered in the Agreement deliverables, the Vendor must provide the State at no charge with a copy of or access to the applicable Agreement deliverables that contains no malicious code or otherwise correct the affected portion of the services provided to the State. The remedies in this Section are in addition to other additional remedies available to the State.

Section XXXIII. Payment Card Industry Data Security Standard

Any service provider who possesses or interacts with payment card data must stay current with the Payment Card Industry (PCI) Data Security Standards. The Vendor will enter into a contract with one or more service providers for payment card services under this Agreement. The Vendor will provide to the State a written acknowledgement from any such service provider with whom the Vendor contracts for such services under this Agreement which acknowledgement will state that the service provider is committed to maintaining proper security of the payment card data in its possession and is responsible for the security of payment card data the service provider possesses or otherwise stores, processes, or transmits on behalf of the Vendor. The Vendor must ensure that the service provider(s) used by the Vendor meet the Payment Card Industry Data Security Standards. The Vendor will annually review the service provider(s) policies and procedures and supporting documentation. The State at its discretion, can require the Vendor to provide the State with an annual report on the status of compliance of their service provider(s) with the Payment Card Industry Data Security Standards.

Section XXXIV. Payment Card Industry Data Security Standard

The service provider must stay current with the Payment Card Industry (PCI) Data Security Standards. The State requires an acknowledgement from all service providers who possess or interact with payment card holder data that the service provider is committed to maintaining proper security of the payment card holder data in their possession and is responsible for the security of payment card data the service providers possess or otherwise store, process, or transmit on behalf of the State. To assure continued compliance with the current Payment Card Industry Data Security Standard, the State requires that the service provider acknowledge its understanding and acceptance of this requirement and provide an annual report on the service provider’s Payment Card Industry Data Security Standard compliance status.

Section XXXV. Payment Card Industry Qualification Requirements for Qualified

Integrators and Resellers

When having a payment card application implemented, configured, or supported the Vendor and any subcontractor used by the Vendor to fulfil the terms of this Agreement will have successfully met the Payment Card Industry qualification requirements for Qualified Integrators and Resellers (QIR). Should the Vendor or any subcontractor(s) used by the Vendor have their QIR revoked or fail to maintain their QIR the Vendor must immediately cease trying to implement, configuring and or supporting payment card application(s) required by the terms of this Agreement and inform the State Contact. At the State’s discretion the Agreement may be terminated without any further obligation of the State.

Section XXXVI. License Agreements

The Vendor warrants that it has provided to the State and incorporated into this Agreement all license agreements, End User License Agreements (EULAs), and terms of use regarding its software or any software incorporated into its software before execution of this Agreement. Failure to provide all such license agreements, EULAs, and terms of use will be a breach of this Agreement at the option of the State. The parties agree that neither the State nor its end users will be bound by the terms of any such agreements not timely provided pursuant to this paragraph and incorporated into this Agreement. Any changes to the terms of this Agreement or any additions or subtractions must first be agreed to by both parties in writing before they go into effect. This paragraph will control and supersede the language of any such agreements to the contrary.

Section XXXVII. Web and Mobile Applications

A. The Vendor’s application is required to:

1. have no code or services including web services included in or called by the application unless they provide direct, functional requirements that support the State’s business goals for the application,

2. encrypt data in transport and at rest using a mutually agreed upon encryption format,

3. close all connections and close the application at the end of processing,

4. have documentation that is in grammatically complete text for each call and defined variables (i.e., using no abbreviations and using complete sentences) sufficient for a native speaker of English with average programming skills to determine the meaning or intent of what is written without prior knowledge of the application,

5. have no code not required for the functioning of application,

6. have no “back doors”, a back door being a means of accessing a computer program that bypasses security mechanisms, or other entries into the application other than those approved by the State,

7. permit no tracking of device user’s activities without providing a clear notice to the device user and requiring the device user’s active approval before the application captures tracking data,

8. have no connections to any service not required by the functional requirements of the application or defined in the project requirements documentation,

9. fully disclose in the “About” information that is the listing of version information and legal notices, of the connections made, permission(s) required, and the purpose of those connections and permission(s),

10. ask only for those permissions and access rights on the user’s device that are required for the defined requirements of the Vendor’s application,

11. access no data outside what is defined in the “About” information for the Vendor’s application,

12. conform to Web Content Accessibility Guidelines 2.0,

13. have Single Sign On capabilities with the State’s identity provider, and

14. any application to be used on a mobile device must be password protected.

B. The Vendor is required to disclose all:

1. functionality,

2. device and functional dependencies,

3. third party libraries used,

4. methods user data is being stored, processed, or transmitted,

5. methods used to notify the user how their data is being stored, processed, or transmitted,

6. positive actions required by the user to give permission for their data to be stored, processed and or transmitted,

7. methods used to record the user’s response(s) to the notification that their data is being stored, processed, or transmitted,

8. methods used to secure the data in storage, processing, or transmission,

9. forms of authentication required for a user to access the application or any data it gathers stores, processes and or transmits,

10. methods used to create and customize existing reports,

11. methods used to integrate with external data sources,

12. methods used if integrates with public cloud provider,

13. methods and techniques used and the security features that protect data, if a public cloud provider is used, and

14. formats the data and information uses.

If the application does not adhere to the requirements given above or the Vendor has unacceptable disclosures, at the State’s discretion, the Vendor will rectify the issues at no cost to the State.

Section XXXVIII. Data Location and Offshore Services

The Vendor must provide its services to the State as well as storage of State Data solely from data centers located in the continental United States. The Vendor will not provide access to State Data to any entity or person(s) located outside the continental United States that are not named in this Agreement without prior written permission from the State. This restriction also applies to disaster recovery; any disaster recovery plan must provide for data storage entirely within the continental United States.

Section XXXIX. Vendor’s Software Licenses

The Vendor must disclose to the State any license for all third-party software and libraries used by the Vendor’s product(s) covered under this Agreement if the State will not be the license holder.

The Vendor is required to provide a copy of all licenses for the third-party software and libraries to the State. No additional software and libraries may be added to the project after this Agreement is signed without notifying the State and providing the licenses to the software and libraries. Open-source software and libraries are also covered by this clause. Any validation of any license used by the Vendor to fulfil the Vendor’s commitments agreed to in this Agreement is the responsibility of the Vendor, not the State.

Section XL. Vendor Training Requirements

The Vendor, Vendor’s employee(s), and Vendor’s subcontractors, agents, assigns, affiliated entities and their employee(s), must successfully complete, at the time of hire a cyber-security training program. The training must include but is not limited to:

A. legal requirements for handling data, B. media sanitation, C. strong password protection, D. social engineering, or the psychological manipulation of persons into performing actions that are inconsistent with security practices or that cause the divulging of confidential information, and

E. security incident response.

Section XLI. Data Sanitization

At the end of the project covered by this Agreement the Vendor, and Vendor’s subcontractors, agents, assigns, and affiliated entities will return the State Data or securely dispose of all State Data in all forms, this can include State Data on media such as paper, punched cards, magnetic tape, magnetic disks, solid state devices, or optical discs. This State Data must be permanently deleted by either purging the data or destroying the medium on which the State Data is found according to the methods given in the most current version of NIST 800-88. Certificates of Sanitization for Offsite Data (See bit.sd.gov/vendor/default.aspx for copy of certificate) must be completed by the Vendor and given to the State contact. The State will review the completed Certificates of Sanitization for Offsite Data. If the State is not satisfied by the data sanitization then the Vendor will use a process and procedure that does satisfy the State.

This contract clause remains in effect for as long as the Vendor, and Vendor’s subcontractors, agents, assigns, and affiliated entities have the State Data, even after the Agreement is terminated or the project is completed.

Section XLII. Use of Portable Devices

The Vendor must prohibit its employees, agents, affiliates, and subcontractors from storing State Data on portable devices, including personal computers, except for devices that are used and kept only at the Vendor’s data center(s). All portable devices used for storing State Data must be password protected and encrypted.

Section XLIII. Remote Access

The Vendor will prohibit its employees, agents, affiliates, and subcontractors from accessing State Data remotely except as necessary to provide the services under this Agreement and consistent with all contractual and legal requirements. The accounts used for remote access cannot be shared accounts and must include multifactor authentication. If the State Data that is being remotely accessed is legally protected data or considered sensitive by the State, then:

A. The device used must be password protected, B. The data is not put onto mobile media (such as flash drives), C. No non-electronic copies are made of the data, and D. A log must be maintained by the Vendor detailing the data which was accessed, when it was accessed, and by whom it was accessed.

The Vendor must follow the State’s data sanitization standards, as outlined in this Agreement’s Data Sanitization clause, when the remotely accessed data is no longer needed on the device used to access the data.

Section XLIV. Data Encryption

If State Data will be remotely accessed or stored outside the State’s IT infrastructure, the Vendor warrants that the data will be encrypted in transit (including via any web interface) and at rest at no less than AES256 level of encryption with at least SHA256 hashing.

Section XLV. Rights, Use, and License of and to State Data

The parties agree that all rights, including all intellectual property rights, in and to State Data will remain the exclusive property of the State. The State grants the Vendor a limited, nonexclusive license to use the State Data solely for the purpose of performing its obligations under this Agreement.