Attachment_1_Exhibit_D-_Special_Terms_and_Conditions.docx

State Controller’s Office IFB Number 0000034673 Standard Agreement, Exhibit D

ATTACHMENT 1 EXHIBIT D: SPECIAL TERMS AND CONDITIONS

A. Insurance Requirements

The Contractor shall display evidence of the following coverage on an Acord certificate:

1. Commercial General Liability Insurance – The Contractor shall maintain general liability on an occurrence form with limits not less than $1 million per occurrence for bodily injury and property damage liability combined with a $2 million annual policy aggregate. The policy shall include coverage for liabilities arising out of premises, operations, independent contractors, products, completed operations, personal and advertising injury, and liability assumed under an insured agreement. This insurance shall apply separately to each insured against whom claim is made, or suit is brought subject to the Contractor’s limit of liability. The policy shall include the State of California, its officers, agents, employees, Adval Properties dba AKT Properties, as additional insureds. The additional insured endorsement must be provided.

2. Workers’ Compensation and Employer’s Liability – The Contractor shall maintain statutory workers’ compensation insurance issued and shall furnish to SCO a certificate of insurance evidencing workers’ compensation insurance and employer’s liability for all its employees who will be engaged in the performance of the Agreement. In addition, employer’s liability limits of $1 million are required. By signing this agreement, the Contractor acknowledges compliance with these regulations. A Waiver of Subrogation or Right to Recover endorsement in favor of the State of California, State Controller’s Office must be attached to the certificate.

3. Automobile Liability – Contractor shall maintain motor vehicle liability with limits not less than $1 million combined single limit per accident. Such insurance shall cover liability arising out of a motor vehicle including owned, hired, and non-owned motor vehicles. Should the scope of the Agreement involve transportation of hazardous materials, evidence of an MCS-90 endorsement or its equivalent is required. The policy must name The State of California, its officers, agents, and employees as additional insured, but only with respect to work performed under the Agreement. If contractor will not have any commercially owned vehicles used during the life of this agreement, by signing this agreement, the Contractor certifies that the Contractor and any employees, subcontractors or servants possess valid automobile coverage in accordance with California Vehicle Code Sections 16450 to 16457, inclusive. The State reserves the right to request proof at any time.

4. Cyber Liability Insurance – Contractor shall maintain Cyber Liability with limits of not less than $15 million covering claims involving notification costs, privacy violations, information theft, damage to or destruction of electronic information, intentional and/or unintentional release of private information, and alteration of electronic information, extortion, and network security.

The certificate of insurance must include the following general provisions stating:

1. The Contractor shall comply with all requirements outlined in Insurance Requirements and General Provisions. No payments will be made under this agreement until contractor fully complies with all requirements.

2. Coverage Term – Coverage needs to be in force for the complete term of the Agreement. If insurance expires during the term of the Agreement, a new certificate must be received by the State at least 10 days prior to the expiration of this insurance. Any new insurance must comply with the original agreement terms of the Agreement.

3. Policy Cancellation or Termination & Notice of Non-Renewal – The Contractor is responsible to notify the State within five business days of any cancellation, non-renewal, or material change that affects required insurance coverage. Certificates of insurance are subject to the approval of the Department of General Services (DGS) and the Contractor agrees no work or services will be performed prior to obtaining such approval. In the event the Contractor fails to keep in effect at all times the specified insurance coverage, the State may, in addition to any other remedies it may have, terminate this agreement upon the occurrence of such event, subject to the provisions of this agreement.

4. Premiums, Assessments and Deductible – The Contractor is responsible for any premiums, policy assessments, deductibles or self-insured retentions contained within their insurance program. SCO will not be responsible for any premiums or assessment on the policy.

5. Primary Clause – Any required insurance contained in this agreement shall be primary, and not excess or contributory, to any other insurance carried by the State.

6. Insurance Carrier Required Rating – All insurance companies must carry an AM Best rating of at least “A-“ with a financial category rating of no lower than VII. If the Contractor is self-insured for a portion or all of its insurance, review of financial information including a letter of credit may be required.

7. Endorsements – Any required endorsements requested by the State must be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

8. Inadequate Insurance – Inadequate or lack of insurance does not negate the Contractor’s obligations under the Agreement.

9. Subcontractors – In the case of the Contractor’s utilization of subcontractors to complete the contracted scope of work, the Contractor shall include all subcontractors as insureds under the Contractor’s insurance or supply evidence of subcontractor’s insurance to the State equal to policies, coverages and limits required of the Contractor.

10. Available Coverage/Limits – All coverage and limits available to the Contractor shall also be available and applicable to the State.

11. Satisfying an SIR – All insurance required by this agreement must allow the State to pay and/or act as the Contractor’s agent in satisfying any self-insured retention (SIR). The choice to pay and/or act as the Contractor’s agent in satisfying any SIR is at the State’s discretion.

B. Licenses and Permits

1. The Contractor shall be an individual or firm licensed to do business in California and shall obtain at his/her expense all license(s) and permit(s) required by law for accomplishing any work required in connection with this agreement.

2. If you are a contractor located within the State of California, a business license from the city/county in which you are headquartered is necessary; however, if you are a corporation, a copy of your incorporation documents/letter from the Secretary of State’s Office can be submitted. If you are a contractor outside the State of California, you will need to submit to SCO a copy of your business license or incorporation papers for your respective state showing that your company is in good standing in that state.

3. In the event, any license(s) and/or permit(s) expire at any time during the term of this agreement; the Contractor agrees to provide SCO a copy of the renewed license(s) and/or permit(s) within 30 days following the expiration date. In the event the Contractor fails to keep in effect at all times all required license(s) and permit(s), SCO may, in addition to any other remedies it may have, terminate this agreement upon occurrence of such event.

C. Excise Tax

The State of California is exempt from federal excise taxes, and no payment will be made for any taxes levied on employees’ wages. The State will pay for any applicable State of California or local sales or use taxes on the services rendered or equipment or parts supplied pursuant to this agreement. California may pay any applicable sales and use tax imposed by another state.

D. Potential Subcontractors

Nothing contained in this agreement or otherwise, shall create any contractual relationship between the State and any subcontractors, and no subcontract shall relieve the Contractor of his responsibilities and obligations hereunder. The Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by the Contractor. The Contractor’s obligation to pay its subcontractors is an independent obligation from the State’s obligation to make payments to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor.

E. Background Checks

During the term of the Agreement, the Contractor must notify SCO immediately upon becoming aware of any of their staff being arrested or convicted of a criminal violation not previously documented as part of the initial background check. The Contractor shall, at the request of SCO, immediately remove the relevant person(s) from conducting duties related to the Agreement at no cost to SCO. Failure to replace person(s) promptly is grounds for termination, if necessary, pursuant to Section 7 of the General Terms and Conditions (GTC 04/2017), Termination for Cause. Any additional or replacement staff added to the Agreement will be subject to the same terms.

The Contactor shall bear the risk and potential penalties of delays resulting from the removal of their staff. If the Contractor fails to notify SCO, SCO has the right to terminate the Agreement for cause.

F. Proprietary Rights

Neither party’s ownership rights, including but not limited to, any intellectual property rights in or used by the Contractor to perform the Services nor any intellectual property rights in or to client’s data, shall be transferred pursuant to this agreement. This section shall survive termination of this agreement.

G. Travel

Travel expenses from the Contractor’s headquarters location to SCO work sites in the Sacramento area WILL NOT BE COMPENSATED UNDER THIS AGREEMENT. However, the Contractor will be reimbursed for pre-approved, necessary travel expenses incurred in a region or area other than the Sacramento area in performing services under this agreement. All approved travel and related expenses shall be compensated in accordance with the California Department of Human Resources (CalHR), Rules for Reimbursement for Excluded Employees and is available at website: https://www.calhr.ca.gov/employees/Pages/travel-reimbursements.aspx.

Reimbursable expenses shall be supported by documentation. Such documentation shall be attached to each invoice. Invoices will include a detailed explanation of the work performed.

H. Information Technology, Data, and Security

1. SCO Data and Resource Ownership

All data, resources and materials provided by SCO shall remain the sole and exclusive property of SCO, including all applicable rights to patents, copyrights, trademarks, trade secrets or other proprietary property rights. Additionally, all rights, titles and interest in and to any data and materials relating to SCO business will remain the property of SCO whether or not supplied to Contractor. Nothing in this agreement shall be construed as conveying any rights or interest in the data, resource or material to Contractor. Contractor shall not utilize, retain, or transfer SCO data, resources or materials to any individual or entity without the express written permission of SCO. Upon termination of this agreement, the Contractor agrees to provide the data or material to SCO, or, at SCO request, certify in writing that said data or material in all formats in the Contractor’s (and the Contractor’s employees, agents, and subcontractors) custody, has been destroyed in compliance with NIST SP 800-88.

2. Access Control

a. All individuals accessing, processing, or manipulating SCO data shall utilize an SCO managed device that meets the SCO's security standards and configurations. These devices include, but are not limited to, laptops, desktops, mobile devices, or any other computing equipment provided by SCO for business purposes, unless prior approval has been obtained from the SCO Contract Owner, SCO Chief Information Officer (CIO) and the SCO Chief Information Security Officer (CISO).

b. In exceptional circumstances where the use of a non-SCO managed device is utilized to interact with SCO data without direct interaction with the SCO environment, the Contractor must adhere to additional security requirements as defined by SCO.

c. The Contractor must ensure the continuous logging, monitoring, and auditing of SCO Data in the Contractor environment.

d. The Contractor (and the Contractor’s agents or subcontractors) shall allow SCO access to security logs, latency statistics, and other related security data that affect this agreement and SCO data and resources, at no cost to SCO.

3. Data Classification and Handling

a. All data categorized as anything other than “public” by SCO and made available to the Contractor in order to carry out this agreement, or which becomes available to the Contractor in carrying out this agreement, shall be protected by the Contractor from unauthorized use and disclosure through the observance of the same or more effective procedural requirements as specified in this agreement.

b. The Contractor shall not be required to keep SCO data confidential that is or becomes publicly available, is already rightfully in Contractor’s possession, is independently developed by Contractor outside the scope of this agreement or is rightfully obtained from third parties.

c. The Contractor receiving SCO data agrees that the data obtained will be kept in the strictest confidence. The Contractor receiving SCO data recognizes it’s their responsibility to protect the confidentiality of the data in their custody as provided by law and ensure that such data is disclosed only to those individuals and for such purposes as are authorized by law and this agreement.

d. The Contractor employees, agents, and subcontractors who may have access to SCO data will be required to have on file annually a signed confidentiality statement, approved by SCO, attesting to the fact that he/she is aware of the data categorization and the penalties for unauthorized disclosure thereof under applicable state and federal law.

e. The Contractor receiving SCO data shall take all necessary measures to ensure the integrity of the SCO data. This includes implementing appropriate security controls, such as encryption, data validation, and monitoring, to prevent unauthorized modification or tampering of the data.

f. The Contractor receiving SCO data shall implement a Role-Based Access Control (RBAC) methods that identify the access rights and permissions for staff members based on their designated roles and responsibilities.

g. The Contractor shall adhere to the principle of least privilege, which means that staff members shall only be granted access privileges necessary to fulfill their job requirements.

h. The Contractor shall maintain an Access Control List (ACL) that outlines the authorized users with privileges to access SCO-specific systems, networks, or data. The ACL shall be regularly reviewed, updated, and documented to ensure accuracy and adherence to RBAC and the principle of least privilege.

i. The Contractor shall implement Separation of Duties (SoD) to prevent any single individual from having excessive control over sensitive SCO data. SoD ensures that different tasks and responsibilities related to the handling of SCO data are assigned to multiple individuals.

j. The Contractor shall maintain a collaborative Data Control Log (DCL) as a part of their data control and transparency measures. The DCL should comprehensively capture crucial details prior to the transfer of SCO data to the third-party environment. These details include the document name, third-party business justification, third-party storage location, and users being granted access (must be on the ACL).

k. The Contractor shall be required to log all interactions with SCO Data in the third-party environment. The logging mechanism should capture relevant details such as the date, time, user ID, activity performed, and the SCO data accessed or modified.

l. The Contractor shall regularly monitor and review the logs of interactions with SCO data to ensure compliance with the agreed-upon access controls and to detect any unauthorized or suspicious activities. These logs should be available for auditing purposes, enabling SCO to verify compliance with the agreed-upon requirements and to investigate any potential security incidents or breaches.

m. The Contractor shall maintain records and documentation of their implementation of the agreed-upon requirements. These records should be made available to SCO upon request as proof of compliance and adherence to the agreed-upon requirements.

4. Confidentiality of SCO Data

a. All financial, statistical, personal, technical, and other data and materials relating to SCO operations, which are designated confidential or sensitive by SCO and made available to the Contractor in order to carry out this agreement, or which becomes available to the Contractor in carrying out this agreement, shall be protected by the Contractor from unauthorized use and disclosure through the observance of the same or more effective procedural requirements as specified in this agreement.

b. The Contractor shall not, however, be required to keep confidential data or materials which are or become publicly available, are already rightfully in the Contractor’s possession, are independently developed by the Contractor outside the scope of this agreement or are rightfully obtained from third parties.

c. The Contractor receiving SCO data agrees that the data obtained will be kept in the strictest confidence and shall make data available to its own employees, agents, and subcontractors only on a “need to know” basis. The “need to know” standard is met by authorized employees who need the data to perform their official duties in connection with the uses of the data authorized by this agreement.

d. The Contractor receiving SCO data recognizes its/their responsibility to protect the confidentiality of the data in its/their custody as provided by law and ensure that such data is disclosed only to those individuals and for such purposes as are authorized by law and this agreement.

e. The Contractor employees, agents, and subcontractors who may have access to SCO confidential or sensitive data will be required to have on file annually a signed confidentiality statement, approved by SCO, attesting to the fact that he/she is aware of the confidential or sensitive data and the penalties for unauthorized disclosure thereof under applicable state and federal law.

5. Data Storage, Transmission, Security Procedures, and Practices

Contractor's data storage, transmission, security procedures and practices are subject to audit by the SCO to ensure compliance with this agreement, NIST standards, and applicable California state laws.

6. Location of SCO Data

a. Unless otherwise stated in the Statement of Work and approved in advance by SCO, the physical location of SCO data retained or stored by the Contractor (and contractor’s employees, agents, and subcontractors) shall be within the continental United States.

b. Contractor grants the SCO and its designees the right to audit and confirm compliance with data location restrictions, including on-site inspections of relevant facilities and systems as reasonably required. Violations of the data location provisions shall be grounds for immediate termination of this agreement.

7. Information Security

a. In addition to the Compliance with the Statutes and Regulations provision set forth in the General Provisions, the Contractor (and the Contractor’s agents or subcontractors) shall certify to SCO:

1) The sufficiency of its security standards, tools, technologies and procedures under this agreement.

2) Compliance with the following:

a) The California Information Practices Act (Civil Code Sections 1798 et seq.).

b) Compliance with the moderate security impact level privacy and security control guidelines specified in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 (Rev.5).

c) Privacy provisions of the Federal Privacy Act of 1974.

d) Federal Information Processing Standards Publication Standards for Security Categorization of Federal Information and Information Systems (FIPS 199).

e) Federal Information Processing Standards Publication Standards Minimum Security Requirements for Federal Information and Information Systems (FIPS 200).

b. The Contractor (and the Contractor’s agents or subcontractors) shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards in accordance with section a. above at all times during the term of this agreement to secure such data from data breach, protect the data and resources from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt SCO data and resources.

c. The Contractor (and the Contractor’s agents or subcontractors) shall allow SCO reasonable access to security logs, latency statistics, and other related security data that affect this agreement and SCO data and resources, at no cost to SCO.

d. The Contractor (and the Contractor’s agents or subcontractors) assumes responsibility for the security and confidentiality of SCO data and resources under its control.

e. No SCO data shall be copied, modified, destroyed or deleted by the Contractor (and the Contractor’s agents or subcontractors) other than for normal operation or maintenance of the Contractor (and the Contractor’s agent’s or subcontractor’s) systems or business process during the Agreement period without prior written notice to and written approval by SCO.

f. Remote access to SCO data and resources from outside the continental United States, including remote access to data by authorized contractor support staff in identified support centers (and the Contractor’s employees, agents, and subcontractors), is prohibited unless approved in advance by the SCO Chief Information Security Officer.

g. The Contractor (and the Contractor’s agents or subcontractors) shall comply with all applicable SCO administrative, technical, and information security policies and standards while utilizing SCO resources, services and facilities while performing services under this agreement.

8. Encryption

SCO data classified as confidential, sensitive, or personal information shall be encrypted while electronically transported or stored (at rest). Encryption methodologies must meet Federal Information Processing Standards (FIPS). When SCO data is being sent via electronic mail (email), encryption must be employed.

9. Information Security Control Review

SCO retains the right to conduct information security control reviews of the Contractor (and the Contractor’s agents, and subcontractors) use of SCO data and the security controls established to protect the confidentiality, integrity, and accountability of SCO data. SCO will provide a minimum of seven days’ notice of the review being conducted. SCO warranties the Contractor that information derived from the information security control review will be protected from public disclosure under the terms of California Government Code § 7929.210.

10. Security Incident or Violation

a. The Contractor and its employees, agents, or subcontractors shall immediately notify the SCO Contact of any actual or suspected theft, loss, damage, unauthorized destruction, unauthorized modification, or unintentional or inappropriate release of any SCO data classified as confidential or sensitive retained in electronic, paper, or any other digital or non-digital medium.

b. The obligations and responsibilities outlined in the agreed upon requirements shall survive the termination or expiration of the agreement, ensuring continued adherence to these requirements even after the Contractor's engagement with SCO has ended.

c. The Contractor shall take:

1) Prompt corrective action to mitigate any risks or damages involved with the breach or security incident and to protect the operating environment; and

2) Any action pertaining to a breach required by applicable federal and state laws, including, specifically, California Civil Code section 1798.29 [California Civil Code 1798.29, subdivision (e), California Civil Code 1798.82, subdivision (f)].

11. Data Sanitization

The Contractor shall destroy all SCO data and any documents created in the execution of this agreement in accordance with the guides outlined in NIST Special Publication 800-88, Revision 1 located at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf.

12. Secure Areas

Computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this agreement must be placed so that they may not be viewed by the public or other unauthorized persons as described in the Agreement.

13. Supervision of Data

SCO data shall not be left unattended at any time, unless it is physically locked in a file cabinet, file room, desk or office; and monitored through a security camera system. Unattended means that information is not being observed by an employee authorized to access the information. SCO data shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

14. Escorting Visitors

Visitors to areas where SCO data is contained shall be escorted and SCO data shall be kept out of sight while visitors are in the area.

15. Removal of Data

SCO data must not be removed from the premises of the Contractor except with express written permission of SCO.

16. Disaster Recovery

The Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of electronic SCO data in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this agreement for more than 24 hours.

17. Data Backup Plan

The Contractor must have established documented procedures to securely backup SCO data to maintain retrievable exact copies of SCO data. The backups shall be encrypted. The plan must include a regular schedule for making backups, storing backup’s offsite, an inventory of backup media, and the amount of time to restore SCO data should it be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite storage of SCO data.

18. Confidentiality Statement

All persons that will be working with SCO data must sign a confidentiality statement. The statement must include at a minimum, General Use, Security and Privacy safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to SCO data. The statement must be renewed annually. The Contractor shall retain each person’s confidentiality statement for SCO inspection for a period of three years following agreement termination.

19. Lower Tier Transactions

The terms of this exhibit shall apply to all agreements, subcontracts, and subawards, and the information privacy and security requirements the Contractor is obligated to follow with respect to SCO data disclosed to the Contractor, or collected, created, maintained, stored, transmitted, or used by the Contractor for or on behalf of SCO, pursuant to the Contractor’s agreement with SCO. When applicable, the Contractor shall incorporate the relevant provisions of this exhibit into each subcontract or subaward to its agents, subcontractors, or independent consultants.

20. Security Assessment Questionnaire

To help the State of California understand the level of security risk when conducting a business process, if at any point during the term of the Agreement it becomes necessary for SCO data to be moved from the SCO environment to the Contractor’s environment, the Contractor is required to complete a Qualys Security Assessment Questionnaire (SAQ) prior. The absolute minimum requirements that SCO must address to comply with applicable laws, regulations and agreements, which shall include all successor publications encompasses:

a. Information Practices Act of 1977 (IPA).

b. California Assembly Bill 2135 Information Security 2021/2022.

c. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 - Security and Privacy Controls for Information Systems and Organizations Moderate Baseline Version 5.0.

d. Federal Information Processing Standards (FIPS) 199 for Security Categorization of Federal Information and Information Systems.

e. FIPS 200 Minimum Security Requirements for Federal Information and Information Systems.

f. Health Insurance Portability and Accountability Act (HIPAA).

g. Health Information Technology for Economic and Clinical Health Act (HITECH) 2009.

The SAQ is a self-reporting tool designed for conducting business process control assessments to reduce the chance of security breaches and compliance violations. The Contractor will be required to answer all questions in the SAQ and provide documentation that allows SCO to verify the accuracy of responses.