Appendix_Z4_-_Security-Terms_and_Conditions.docx

Security Supplemental Terms and Conditions

EXHIBIT _ to Agreement between the COUNTY OF SACRAMENTO, hereinafter referred to as "COUNTY," and _____________________, HEREINAFTER referred to as "CONTRACTOR"

I. DEFINITIONS

a. Application Programming Interface (API): A set of functions and procedures allowing the creation of applications that access the features or data of an operating system, application, or other service.

b. CONTRACTOR: The contractor and its employees, subcontractors, agents and affiliates who are providing the services agreed to under this Agreement.

c. COUNTY Data: All data created or in any way originating with the COUNTY, and all data that is the output of computer processing or other electronic manipulation of any data that was created by or in any way originated with the COUNTY, whether such data or output is stored on the COUNTY’s hardware, the CONTRACTOR’s hardware, hardware owned by subcontractors of the CONTRACTOR, or exists in any system owned, maintained or otherwise controlled by the COUNTY, the CONTRACTOR, or subcontractors of the CONTRACTOR.

d. Data Breach: The misappropriation of COUNTY Data in the custody of the CONTRACTOR or the compromise of the security, confidentiality or integrity of the COUNTY Data Processing System maintained by the CONTRACTOR.

e. Cloud Solution: The use of Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), and others storing, processing, and/or transmitting of COUNTY Data in environments outside the control of the COUNTY.

f. FedRAMP: Federal Risk and Authorization Management Program. Information about FedRAMP can be found at www.fedramp.gov.

g. Hybrid Solution: The use of both a Cloud Solution and On-Premise Solution.

h. Internet Protocol (IP) address: A numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.

i. On-Premise Solution: The use of a solution that is installed and run on computers that are on the COUNTY’s premise.

j. StateRAMP: State Risk and Authorization Management Program. Information about StateRAMP can be found at www.stateramp.org.

k. COUNTY Contacts:

CIO@saccounty.gov

Group:(916) 874-5171 iso@saccounty.gov

II. COMPLIANCE

a. Cloud Solution

1. The CONTRACTOR shall achieve FedRAMP or StateRAMP Ready Status for the Cloud Service being provided within 90 days of the Agreement execution. Upon issuance of this Agreement, the CONTRACTOR must achieve full FedRAMP or StateRAMP authorization for the applicable security control category within 12 months. The CONTRACTOR must comply with required continuous monitoring to maintain FedRAMP or StateRAMP authorizations.

2. The COUNTY reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor’s environment. The CONTRACTOR must respond to all flaws discovered that could affect performance to FedRAMP or StateRAMP specifications. CONTRACTOR must provide a timeframe acceptable to the COUNTY to resolve the identified issue and/or implement a compensating control.

3. Any deviation from these requirements must be approved by the COUNTY Chief Information Security Officer or designee in writing.

b. On-Premises Solution

1. The CONTRACTOR shall ensure that applicable Information Systems the CONTRACTOR provides as a part of this agreement are capable of running the following security tools:

2. The COUNTY reserves the right to conduct audits, risk assessments, vulnerability assessments, and penetration tests of the CONTRACTOR’s solution.

3. The CONTRACTOR must respond within 30 days to all Critical and Important flaws discovered that could affect the security of the solution.

4. CONTRACTOR must resolve the identified issue and/or implement a compensating control within 90 days.

5. Any deviation from these requirements must be approved by the COUNTY Chief Information Security Officer or designee in writing.

c. Hybrid Solution The CONTRACTOR must comply with both Cloud Solution and On-Premises Solution requirements for corresponding system components.

III. NON-DISCLOSURE

The CONTRACTOR shall require commercially reasonable non-disclosure agreements with applicable employees and subcontractors, and limit COUNTY Data knowledge to that which is necessary to perform job duties involved in the performance of this Agreement.

IV. DATA OWNERSHIP

a. The COUNTY solely and exclusively owns and retains all right, title and interest, whether express or implied, in and to any and all COUNTY data. CONTRACTOR neither has nor acquires, any right, title or interest, whether express or implied, in and to COUNTY data.

b. CONTRACTOR will only use COUNTY data for the purposes set forth in this Agreement. CONTRACTOR will only access COUNTY data as necessary for performance of this Agreement. CONTRACTOR will not access COUNTY user accounts except to respond to service or technical problems or at the COUNTY’s specific request.

c. All COUNTY data, including copies, summaries and derivative works thereof, must be remitted, in a mutually agreeable format and media, to the COUNTY by the CONTRACTOR upon request or upon completion, termination or cancellation of this Agreement. The foregoing sentence does not apply if the COUNTY Chief Information Security Officer or delegate authorizes in writing the CONTRACTOR to sanitize and/or destroy the data in a manner acceptable to the COUNTY and the CONTRACTOR certifies in writing the sanitization and/or destruction of the data.

d. Within 90 days following any remittance of COUNTY Data to the COUNTY, CONTRACTOR shall, unless otherwise instructed by the COUNTY in writing, sanitize and/or destroy any remaining data in a manner acceptable to the COUNTY, and certify in writing that the sanitization and/or destruction of the data has occurred. Any such remittance, sanitization or destruction will be at the CONTRACTOR’s sole cost and expense.

V. DATA LOCATION

The CONTRACTOR shall provide its services to the COUNTY solely from data centers in the United States (U.S.). Storage of COUNTY Data at rest shall be located solely in data centers in the U.S. The CONTRACTOR shall not allow its personnel or contractors to store COUNTY Data on portable devices, including but not limited to personal computers, except for devices that are used and kept only at its U.S. data centers and used for this Agreement. The CONTRACTOR shall permit its personnel and contractors to access COUNTY Data remotely only as required to provide technical support. The CONTRACTOR may provide technical user support on a 24/7 basis using a follow-the-sun model, unless otherwise prohibited in this Agreement.

VI. NOTIFICATION OF LEGAL REQUESTS

a. The CONTRACTOR shall immediately notify COUNTY upon receipt of any subpoenas, service of process, litigation holds, discovery requests and other legal requests related to all data given to CONTRACTOR by COUNTY in the performance of this Agreement, and in no event later than 24 hours after it receives the request.

b. CONTRACTOR shall not respond to legal requests related to COUNTY without first notifying COUNTY other than to notify the requestor that the information sought is potentially covered under a non-disclosure agreement.

c. CONTRACTOR shall retain and preserve COUNTY Data in accordance with the COUNTY’s instruction and requests, including, without limitation, any retention schedules and/or litigation hold orders provided by the COUNTY to CONTRACTOR, independent of where the COUNTY Data is stored, at CONTRACTOR’S sole cost and expense.

VII. SECURITY BREACHES

a. Upon becoming aware of a potential, suspected, or actual Data Breach involving COUNTY data, the CONTRACTOR shall without undue delay (and in no event later than 72 hours of becoming aware of such Data Breach) inform the COUNTY and provide written details of the Data Breach, including the type of data affected, the identity of affected person(s), the likely consequences of the Data Breach, any other information the COUNTY may reasonably request concerning the affected persons, and the measures taken or proposed to be taken to address it, as soon as such information becomes known or available to the CONTRACTOR.

b. The CONTRACTOR will promptly take reasonable steps to contain, investigate and mitigate any Data Breach. CONTRACTOR will provide timely information about the Data Breach including, but not limited to, the nature and consequences of the Data Breach; the measures taken and/or proposed by CONTRACTOR to mitigate or contain the Data Breach; the status of the CONTRACTOR investigation of the Data Breach; a contact point from which additional information may be obtained; and the categories and approximated number of data records concerned, if available.

c. CONTRACTOR’s communications with COUNTY in connection with a Data Breach shall not be construed as an acknowledgment by CONTRACTOR of any fault or liability with respect to the Data Breach.

d. The parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons and/or the relevant legal authorities, except as otherwise required by applicable law. In the event of a Personal Data Breach, the CONTRACTOR will provide timely information and cooperation as the COUNTY may require to fulfill COUNTY’S Data Breach reporting obligations under applicable law; take such measures and actions as are appropriate to remedy or mitigate the effects of the Data Breach; and shall keep COUNTY up-to-date about all developments in connection with the Data Breach.

e. CONTRACTOR shall perform all requirements in the above subsections (a)-(d) of this section at CONTRACTOR’S sole cost and expense.

VIII. ACCESS TO SECURITY LOGS AND REPORTS

The CONTRACTOR shall support logging in a format as agreed to by both CONTRACTOR and the COUNTY. Logging capabilities shall include latency statistics, user access, user access internet protocol (IP) address, application programming interface (API) calls for the COUNTY’s account including the source IP address of the API caller, the request parameters and the response elements returned, user access history and security logs for all COUNTY Data and digital content related to this Agreement. The logs shall be sufficient to enable the COUNTY to perform to the COUNTY’s satisfaction security analysis, resource change tracking and compliance auditing.

IX. SUBCONTRACTOR DISCLOSURE

The CONTRACTOR shall identify in writing to COUNTY as soon as known by CONTRACTOR all of its strategic business partners related to services provided under this Agreement, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the CONTRACTOR, and who shall be involved in any application development and/or operations

X. RIGHT TO REMOVE INDIVIDUALS

The COUNTY shall have the right at any time to require that the CONTRACTOR remove from interaction with COUNTY any CONTRACTOR representative who the COUNTY believes is detrimental to its working relationship with the CONTRACTOR. The COUNTY shall provide the CONTRACTOR with notice of its determination, and the reasons it requests the removal. If the COUNTY signifies that a potential security violation exists with respect to the request, the CONTRACTOR shall immediately remove such individual. The CONTRACTOR shall not assign the person to any aspect of this Agreement or future work orders without the COUNTY’s consent.

XI. TERMINATION AND SUSPENSION OF SERVICE

a. In the event of termination of this Agreement, the CONTRACTOR shall implement an orderly return of COUNTY Data in a mutually agreeable format at CONTRACTOR’s sole cost and expense. The CONTRACTOR shall guarantee the subsequent secure disposal of COUNTY Data.

b. During any period of suspension or contract negotiation or disputes, the CONTRACTOR shall not take any action to intentionally erase any COUNTY Data.

c. In the event of termination of any services or this Agreement in entirety, the CONTRACTOR shall not take any action to intentionally erase any COUNTY Data for a period of 90 days after the effective date of the termination. After such 90-day period, the CONTRACTOR shall have no obligation to maintain or provide any COUNTY Data and shall thereafter, unless legally prohibited, dispose of all COUNTY Data in its systems or otherwise in its possession or under its control at CONTRACTOR’S sole cost and expense. Within this 90- day timeframe, CONTRACTOR will continue to secure and back up COUNTY Data covered under this Agreement.

d. The COUNTY shall be entitled at no additional cost to COUNTY to any post-termination assistance generally made available with respect to the Services unless a unique data retrieval arrangement has been established as part of the Service Level Agreement.

e. When requested by the COUNTY, the provider shall at CONTRACTOR’S sole cost and expense destroy all requested data in all of its forms, for example: disk, CD/DVD, backup tape, and paper. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST) approved methods. - Certificates of destruction shall be provided to the COUNTY at no additional cost to COUNTY.

XII. CONTRACT AUDIT

The CONTRACTOR shall allow the COUNTY to audit conformance to the Agreement terms. The COUNTY may perform this audit or contract with a third party at its discretion and at the COUNTY’s expense.

XIII. WEB ACCESSIBILITY (ONLY APPLICABLE TO WEB-BASED SOLUTIONS)

COUNTY strives to achieve web accessibility by complying with the requirements of Section 508 of the Rehabilitation Act of 1973 §1194.22, as amended (29 U.S.C. Section 794d). County websites (and those provided by 3rd party service providers, aka CONTRACTOR) shall be designed based on standards from the Worldwide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) to make web content accessible to people with disabilities.

It is the responsibility of the CONTRACTOR to become familiar with these guidelines and to apply these standards in designing and creating any official County of Sacramento website. CONTRACTOR shall deliver services in compliance with Worldwide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG).

County of Sacramento: RFP No. 2026-RFP-XXXX Identity Management System - SMF Airport | PROPOSAL PACKAGE & SUBMISSION INSTRUCTIONS -7-image.png