Appendix N Exhibits A-B.xlsx
XLSX spreadsheet 55 KB Posted
- Solicitation number
- BPM055358
- Issued by
- Prince George's County, Maryland
About this file
This file is a Data Privacy and Security Agreement (DPSA) Exhibits worksheet from Prince George's County Public Schools (PGCPS) in Maryland, designed as a collaborative tool for vendors responding to RFP PUR26-039 for a behavioral framework and interventions platform serving Pre-K through 12th grade students. The spreadsheet contains three primary components: Exhibit A Part 1 (Data Schedule), Exhibit A Part 2 (Vendor Security Standards), and Exhibit B (Subprocessor List). Vendors are required to complete each section by identifying their product and company name, specifying which data fields they will store, process, access, or use, and indicating whether each data element is required, optional, or not used. For each data field used, vendors must provide a clear purpose directly linked to student learning or system security, consistent with Maryland law (MD 4-131), which strictly prohibits student data use for non-educational profiling or commercial gain. The data categories covered include student assessment, attendance, demographics, discipline, enrollment, special indicators, contact information, identifiers, transcripts, transportation, and user data. Vendors must also document their third-party security review status, selecting from SOC 2 Type 2, SOC 2 Type 1, ISO 27001 Certificate, independent audit report, or detailed custom security responses, with reports required to be less than 18 months old.
The completed worksheet serves as a working document to be incorporated into the final DPSA prior to vendor signature and must be returned alongside the remainder of the DPSA submission. PGCPS will review each required and optional field, indicating acceptance, decline, pending status, or not applicable designation, and will contact vendors regarding any pending items requiring discussion or clarification. The subprocessor list requires vendors to document all currently approved subprocessors with complete field information, or to indicate if no subprocessors are utilized. This exhibit framework ensures vendor compliance with PGCPS data governance standards and provides transparency regarding data handling practices, security protocols, and third-party involvement in service delivery for the SEL and student intervention platform.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Addendum 1 for RFP PUR-26-039 PDF.pdf | ||
| Addendum 2 for RFP PUR-26-039.pdf | ||
| RFP PUR26-039 Framework and Interventions (FINAL).pdf | ||
| RFP26-039 Attachment_A_Cost_Proposal.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Directions
PRINCE GEORGE’S COUNTY PUBLIC SCHOOLS
DATA PRIVACY AND SECURITY AGREEMENT (DPSA) - EXHIBITS A and B
| bit.ly/PGCPS_DPSAExhibitA |
| Purpose: |
| This spreadsheet provides a working version of Exhibit A from the Prince George’s County Public Schools Data Privacy and Security Agreement for collaborative discussion between the vendor and PGCPS. Exhibit A comprises the Data Schedule and the Vendor Security Standards. The final, agreed-upon version will be incorporated into the official Data Privacy and Security Agreement before the signature request. |
| Directions: |
| 1. Download this file |
| 2. Edit the file name to include the name of your product |
| 3. Complete each tab - ensure your vendor name and product name are included. |
| Exhibit A Part 1- Data Fields |
| The Data Schedule is an inventory of the data the vendor will store, process, access, or use in providing services to the Institution. |
- For each data field you will store, process, access or use:
- Place an X to indicate if the field is “required” or “optional”.
- Specify if the data will be used on an individual level or in an aggregated form, as applicable,
- Include a clear purpose for each data field.
- Each purpose should be clearly linked to student learning or system security as Maryland law (MD § 4-131) strictly prohibits the use of student data for non-educational profiling or commercial gain.
- If a data field will not be used, select "Not used"
| Exhibit A Part 2 - Vendor Security Standards |
| Indicate which type of Third Party Security Review applies. If SOC 2 or ISO 27001, a copy of the most recent report (less than 18 months old) will be required. |
Provide a clear, detailed response for each section.
| Exhibit B - Subprocessor List |
| Please list all currently approved Subprocessors below and complete all fields.If no subprocessors are used, select the checkbox in the DPSA. |
| This information is REQUIRED and may be entered directly into the DPSA or using this worksheet. If entered here, it will be exported and incorporated into the final PDF of the DPSA. |
| 4. Submit |
| - Return this spreadsheet when returning the rest of the DPSA. |
| 5. PGCPS Review and Return |
| - For each required or optional field, PGCPS will indicate if it is: Accepted, Declined, Pending, N/A |
- If needed, PGCPS will contact the vendor to discuss "Pending" items.
- The finalized version of Exhibit A will be included in the PDF version of the DPSA prior to final vendor signatures.
https://bit.ly/PGCPS_DPSAExhibitA ExhibitA (Pt1) Data Fields
| Exhibit A (Part 1) - Schedule of Institution Data | |
| VENDOR NAME | PRODUCT NAME |
For each data element, place an "X" in the relevant column (Required, Optional, Not Used).
If a data element is required or optional, include a clear purpose that is linked student learning or system security as Maryland law (MD § 4-131) strictly prohibits the use of student data for non-educational profiling or commercial gain.
| Category | Data Element | Required | Optional | Not Used | Purpose for Use | Accepted by PGCPS |
| Application Technology MetaData | Services |
Communications (e.g., conversations comments, messaging) Services Technology Metadata Services Usage Statistics
| Student Assessment | Observation data |
| Student |
Assessments and Results (specify type)**
| Performance in Program/application |
| Student |
Video or Voice Recording* (specify type and purpose)
| Student Attendance | Student Attendance, School (daily) | |
| Student Attendance, Course (period) | ||
| Communication | Online communication captured (emails, blog entries) | |
| Student Disciplinary Information | Student |
Conduct Data* Student Incident Status* Student Demographics Student Date of Birth Student Ethnicity and/or Race (specify) Student Gender Student Language Information Student Name (first and/or last) Student Place of Birth* Student Pronouns Employee (Teacher/staff) Data Educator/Staff Email address Educator/Staff Name (first and/or last) Educator/Staff ID Number Educator/Staff Mailing address* Educator/Staff Phone Number Educator/Staff Disability Identifier and/or Status* Educator/Staff Health Data / Medical Alerts* Educator/Staff Political or Religious Affiliation* Educator/Staff Social Security Number* Educator/Staff Video or Voice Recording* Student Enrollment Student Gifted Program Status* Student Grade Level Student Graduation Year Student Guidance Counselor Student Homeroom Student Program Membership (specify) Student School Enrollment - Current Student School Enrollment - Past* Student Specific Curriculum Programs*
| Parent/Guardian Information | Parent/Guardian Address* |
| Parent/Guardian |
Email address* Parent/Guardian Name (first and/or last) Parent/Guardian ID number (to link parents to students)* Parent/Guardian Phone Number Student Schedule Student Assigned Courses Student Scheduled Courses Student Scheduled Courses with Teacher Name Student Special Indicators Student Disability Identifier and/or Status* Student Disability Information* Student Economically Disadvantaged Status* Student English Language Learner Identifier* Student Foster Care Status*
| Student Health Data / Medical Alerts* |
| Student |
Houseless Status* Student Low Income Status* Student Military Child Status* Student Specialized Education Services* Student Contact Information Student Email Address Student Mailing Address* Student Phone Number Student Identifiers Student Generated Content Student Survey Responses*
| Provider/app assigned student ID number |
| Student |
Biometric Data* Student District ID number Student Photo* Student Political or Religious Affiliation* Student SIS Identifier/Number Student Social Security Number* Student State ID number Student Username & Password*
| Student Transcript | Student Course Grades / performance scores* |
| Student Transportation | Student Bus Assignment |
| Student Pick Up and/or Drop-off Location* | |
| User Data | User |
Badge or Microcredential Assertion Data User Biographical Information User Gender*
(where user is not student) User Pronouns (where user is not student) User IP Address* User Geolocation information General (e.g., city/state) User Geolocation information Specific (street)* User Mobile Device Identifier* User Mobile Device MAC Address* User Mobile Device Serial Number* User Payment Card Data* User Profile Avatar or Pictures* User Single Sign-On Credentials* Persistent unique identifiers
Defined as identifiers that "can be used to identify, recognize, track, single out, or make references about a student enrolled in prekindergarten through grade 12, the parent or guardian of the student, and any other student of whom the parent or guardian has custody.
(indicate specific purpose)
| Cookie identifiers | |
| Customer numbers | |
| Device identifiers | |
| Hashed e–mail addresses | |
| Hashed phone numbers | |
| Identifiers generated through probabilistic methods | |
| Mobile ad identifiers | |
| Unique pseudonyms and | |
| User aliases | |
| Online behavior or usage of applications linkable to a specific student |
(describe type of information and purpose)
| Student Search Activity | |
| Other Fields Not Listed |
000000&F
000000&A-&P
ExhibitA (Pt 2) Vendor Security
| Exhibit A (Part 2) - Vendor Security Standards | |
| Vendor | 0 |
| Product | 0 |
| Please identify which of the following reports/certifications currently apply to the above product(s) and provide the date of the most recent report/certification. You will be asked to provide a copy. An NDA can be requested, if needed. | |
| SOC 2 Type 2 | |
| SOC 2 Type 1 | |
| ISO 27001 Certificate (with Statement of Applicability) | |
| None of the above, but an independent audit report is available. | |
| None of the above (requires thorough responses below) |
Priovide detailed responses regarding your security standards, for each of the following areas.
Where available, a SOC 2 report or ISO 27001 Certificate (with Statement of Applicability) may be submitted in place of responses. Indicate "Third party report submitted" below, to acknowledge blank fields are not an omission. If a current (<18 months old) report or certificate is not available, provide details responses for each area below.
| Data security |
| Authentication |
| Access Controls |
| Data backup and recovery |
| Incident response |
| Vulnerability management |
| Compliance |
| Physical security |
| Employee awareness |
| Security measures for 3rd party integrations |
000000&F
000000&A-&P
Exhibit B - Subprocessor List
| Exhibit B - Subprocessor List | |
| VENDOR NAME | PRODUCT NAME |
Please list all currently approved Subprocessors below and complete all fields.
If no subprocessors are used, select the checkbox in the DPSA.
Subprocessor Name Subprocessor Address Processing Activities Specific Institution Data Processed Processing and/or Hosting Geographic Location
000000&F
000000&A - &P
File details come from the government source that posted it. Updated .