Attachment_A_STATE_OF_WISCONSIN_SECURITY_RIDER.docx.pdf

State of Wisconsin |Security Rider v7 1

ATTACHMENT A: STATE OF WISCONSIN SECURITY

RIDER

The following terms and conditions are specific to Cloud Computing including SaaS, IaaS and PaaS. These terms shall supplement the Federal Resources Corporation contract. In the event of a conflict between the terms of this State of Wisconsin Security Rider Attachment A, and the Contract for Governance, Risk and Compliance Tools, 505ENT- M26-GRCTOOLS-01 , the State of Wisconsin Security Rider shall control.

1. Definitions:

1.1“Agency” or “State Agency” means an office, department, agency, institution of higher education, association, society or other body in State of Wisconsin government created or authorized to be created by the State Constitution or any law, which is entitled to expend moneys appropriated by law, including the legislature and the courts, but not including an authority, as defined in Wis. Stat. s. 16.70(2).

1.2 “Cloud Computing” means the definitions set forth in NIST Special Publication 800-

145 - The NIST Definition of Cloud Computing.

1.3 “Contractor” means the Contractor and its employees, Subcontractors, agents and affiliates who are providing the Cloud Computing services to the State .

1.4 “Data Breach” means any unauthorized access, destruction, loss, theft, use, modification, or disclosure of State Data.

1.5 “Deliverables” means all project materials, including goods, software licenses, data, and documentation created during the rendering of services hereunder. Deliverables shall be the property of the State of Wisconsin unless otherwise specified in the Contract.

1.6 “Individually Identifiable Health Information” means information that is a subset of health information, including demographic information collected from an individual, and

(1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

1.7 “Non-Public Data” means data, other than Personal Data, that is not subject to distribution to the public as Public Information. It is deemed to be sensitive and confidential by the State because it contains information that is exempt by statute, ordinance or administrative rule from access by the public as Public Information.

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 2

1.8 “Personal Data” or “Personally Identified Information or PII”, means an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if the element is not publicly available information and is not encrypted, redacted, or altered in any manner that renders the element unreadable:

(a) the individual’s Social Security number; (b) the individual’s driver’s license number or state identification number; (c) the individual’s date of birth; (d) the number of the individual’s financial account, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual’s financial account; (e) the individual’s DNA profile; or (f) the individual’s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation, and any other information protected by state or federal law.

1.9 “Platform as a Service (PaaS)” The capability provided to the State is to deploy onto the cloud infrastructure the State created or acquired applications developed by using programming languages and tools supported by the provider. For these applications, the

State does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

1.10 “Proprietary Information” means information, including a formula, pattern, compilation, program, device, method, technique or process to which all the following apply:

a. The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.

b. The information is the subject of efforts to maintain its secrecy that are reasonable under the circumstances.

1.11 “Protected Health Information” (PHI) means Individually Identifiable Health

Information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C.

1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer.

1.12 “Public Information” means information that (i) is collected, assembled or maintained under a law or ordinance or in connection with the transaction of official business by a governmental body or for a governmental body; and (ii) the governmental body owns or to which it has a right of access.

1.13 “Recovery Point Objective (RPO)” means the point in time that data can be recovered and/or systems restored when service is restored after an interruption. The

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 3

Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup of State Data immediately preceding the interruption.

1.140 “Recovery Time Objective (RTO)” means the period of time within which information technology services, systems, applications and functions must be recovered following an unplanned interruption.

1.152 “State” means the government of the State of Wisconsin, its employees and authorized representatives, including without limitation any department, agency, or other unit of the government of the State of Wisconsin.

1.16 “State Data” means all rights, title, and interest in content that State employees, agents and end users upload, create or modify pursuant to the Contract, including Non- Public Data, Personal Data, and data protected from unauthorized disclosure by state or federal regulations, and any items or materials originated or prepared specifically and exclusively for the State under the Contract including, but not limited to: formulae, algorithms, data, commercials, media, tapes, labels, trademarks, ideas, terms, designs, patterns, music, models, devices, sets, drawings, props, specifications, designations, reports, card decks, listings, and any intellectual property as is specifically and exclusively developed for the State from the time of payment. State Data also includes user identification information and metadata which may contain State Data or from which State Data may be ascertainable.

1.17 “Security Incident” means the possible or actual unauthorized access to Personal Data State Data or Non-Public Data the Contractor believes could reasonably result in the use, disclosure or theft of the State’s unencrypted Personal Data, State Data or Non-Public Data within the possession or control of the Contractor. A Security Incident may or may not turn into a Data Breach.

1.18 “Service Level Agreement” or (“SLA”) means a written agreement between both the State and the Contractor that is subject to the terms and conditions in this document that unless otherwise agreed to includes but is not limited to (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) security responsibilities and notice requirements, (5) how disputes are discovered and addressed, and (6) any remedies for performance failures.

1.19 “Software-as-a-Service” (SaaS) means the capability provided to the State to use the Contractor’s applications running on a hosted (or “cloud”) infrastructure. The applications are owned, delivered and managed remotely by one or more providers and accessible from various client devices through a thin-client interface such as a Web browser (e.g., Web-based email) or a program interface. The provider delivers software based on one set of common code and data definitions that is consumed in a one-to-many model by all contracted customers at any time on a pay-for-use basis or as a subscription based on use metrics. The State does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage or even individual application

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 4 capabilities, with the possible exception of limited user-specific application configuration settings.

1.20 “Subcontractor” means an entity that enters into an agreement with the Contractor for the purpose of providing Deliverables or rendering services to the State.

2. Data Ownership: The State will own all right, title and interest in the State Data that is related to the services provided by Federal Resources Corporation. The Contractor shall not access State user accounts or State Data, except (1) during data center operations, (2) in response to service or technical issues, (3) as required by the express terms of Federal Resources Corporation and/or SLA, or (4) at the State’s written request.

Contractor shall not collect, access, or use State Data except as strictly necessary to provide Service to the State. No information regarding the State’s Data may be disclosed, provided, rented or sold to any third party for any reason. Contractor shall promptly notify the State upon receipt of any requests that require access to State Data. Requests for access to data that Contractor receives should be immediately directed to the State. Contractor shall not release data to any third parties without the express written permission of the State, or by an order of a court of competent jurisdiction. Upon request, Contractor shall cooperate with the State to provide information to third parties. This obligation shall survive and extend beyond the term of this Contract.

All data provided by the State shall remain the property of the State. Contractor shall acquire no rights or licenses, including without limitation intellectual property rights or licenses, to use the data for its own purposes by virtue of this Contract or otherwise. Contractor may use the data provided by the State solely for the purposes of carrying out its obligations under this Contract and the administration and management of their respective services. Notwithstanding the above, usage data, storage utilization and similar statistical and consumption data relating to use of the services by the State is not the State’s data/information and nothing in this Contract shall be construed as restricting Contractor’s rights or interest in such service usage data. State Data as defined herein shall be used solely for the purposes of carrying out its obligations under this Contract and not sold, shared or otherwise provided, directly or indirectly to a third party without the express written permission of the State.

All data stored by or accessed by the Contractor that is the result of any processing of State Data shall be the property of the State. The State shall have the ability to access the data except during downtime as may be provided in the SLA.

3. Data Protection: Protection of personal privacy and data shall be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of State Data. To this end, the Contractor shall safeguard the confidentiality, integrity and availability of State Data and comply with the following conditions:

a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of State

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 5

Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own Personal Data and Non-Public Data of similar kind.

b. All State Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the State Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the Service Level

Agreement (SLA), or otherwise made a part of this Contract.

c. Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit.

The State shall identify data it deems as Non-Public Data to the Contractor. The level of protection and encryption for all Non-Public Data shall be identified by the State.

d. At no time shall any data or processes — that either belong to or are intended for the use of the

State or its officers, agents or employees — be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

e. If the State allows Non-Public Data to be accessed by Contractor personnel by mobile devices, the data shall be encrypted on the mobile devices. Hashing and encryption techniques will be used when sensitive data is stored in all data stores, and secure data transfer protocols. – TLS/SSL with a server certificate, HTTPS, and WS-Security, or SFTP - will be used when data is transferred from one component to another.

f. The Contractor shall not use any information collected relating to the services issued from this

Contract for any purpose other than fulfilling the services.

4. Data Location: The Contractor shall provide its services to the State and its end users solely from data centers in the U.S. Storage of State Data at rest shall be located solely in data centers in the U.S. The

Contractor shall identify the location(s) of its data centers where State Data will be processed or stored.

This includes locations for Subcontractor and/or business partner processing storage locations, locations of backup data, and disaster recovery locations. The Contractor shall not allow its personnel or contractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its personnel and contractors to access State Data remotely only as required to provide technical support.

The Contractor shall provide email notification to designated State point of contact(s) of any changes to the location of State Data.

5. Security Incident or Data Breach Notification: Such notice shall include, to the best of Contractor’s knowledge at that time, the persons affected, their identities, and the State Data disclosed.

a. Incident Response: Contractor may need to communicate with outside parties regarding a

Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, required by law, or the Contract.

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 6

b. Security Incident Reporting Requirements: The Contractor shall report a Security Incident to the State identified contact within 72 hours based on the standards set by NIST 800-61 without reasonable delay, or as defined in the SLA or Contractors System Security Plan (“SSP”).

Discussing Security Incidents with the State should be handled as urgent, as part of Contractor’s communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed Data

Breach that affects the security of any of State Data, the Contractor shall (1) within four (4) hours and without out reasonable delay notify the State, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner.

6. Personal Data Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor, including its third- party affiliates as applicable. After any such Data Breach, Contractor will, at its expense, perform a security audit. The audit results shall be sent from the auditor directly to the State and the Contractor immediately upon completion.

a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate State identified contact in accordance with the agreed upon security plan or security procedures or in the absence thereof by the steps detailed below, if it reasonably believes there has been a Security Incident involving Personal Data. Notification reports shall include the following:

1) The date of the Data Breach;

2) The date of the discovery of the Data Breach;

3) The total number individuals affected by the Data Breach;

4) Any information about the circumstances of the Data Breach;

5) A description of probable causes of the Data Breach;

6) The name of person(s) assigned to review and investigate;

7) A description of all data used or disclosed (such as a full name, social security number, date of birth, home address, financial account number);

8) The names of persons and organizations involved in the use, access or breach, including a description of unauthorized persons known or reasonably believed to have improperly used or disclosed data;

9) A description of where the data or is believed to have been improperly transmitted, sent, or utilized;

10) The actions the Contractor has undertaken upon discovery of the incident and will undertake to mitigate any harmful effect of the improper use or disclosure, with approval by the State;

11) A corrective action plan that includes steps the Contractor has taken or will take to prevent future similar incidents from occurring, with approval by the State;

12) Any other details necessary to complete an assessment of the risk of harm to the Individual, and;

13) Any other information as requested by the State.

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 7

b. Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release as reasonably determined by the State and pursuant to Wisconsin Statute 134.98, the Contractor shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for Data Breaches in the United States

(currently $201 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute17 at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

7. Notification of Legal Requests: The Contractor shall contact the State upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the State’s data under this Contract, or which in any way might reasonably require access to the data of the State. The

Contractor shall not respond to subpoenas, service of process and other legal requests related to the

State without first notifying and obtaining the approval of the State, unless prohibited by law from providing such notice.

8. Termination and Suspension of Service:

8.1. In the event of a termination of the Contract, the Contractor shall implement an orderly return of

State Data in a CSV or another mutually agreeable format at a time agreed to by the parties, or allow the State to extract its data and perform the subsequent secure disposal of State Data per NIST 800-

88 Revision 1.

8.2. During any period of service suspension, the Contractor shall not take any action to intentionally erase or otherwise dispose of any State Data.

8.3. In the event of termination of any services or the Contract in entirety, the Contractor shall not take any action to intentionally erase the State’s data for a period of:

• 30 days after the effective date of termination, if the termination is in accordance with the contract period or if the termination is for convenience

• 60 days after the effective date of termination, if the termination is for cause

After such period, the Contractor shall have no obligation to maintain or provide any State Data and shall thereafter, unless legally prohibited, delete all State Data in its systems or otherwise in its possession or under its control per NIST 800-88 Revision 1.

8.4. The State shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an

SLA.

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 8

8.5. Upon termination of services or the Contract in its entirety, unless legally prohibited, Contractor shall securely dispose of all State Data in all its forms, in its systems or otherwise in its possession or under its control including but not limited to disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the State. State Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the State upon completion.

9. Background Checks: Upon the request of the State, the Contractor shall conduct criminal background checks and not utilize any staff, including Subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud. The

Contractor shall promote and maintain an awareness of the importance of securing the State Data among the Contractor’s employees and agents. If any of the stated personnel providing services is not acceptable to the State in its sole opinion as a result of the background or criminal history investigation, the State, in its’ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate t any related service Contract.

10. Access to Security Logs and Reports: The Contractor shall provide reports to the State in a format as specified upon request or as detailed in an SLA agreed to by both the Contractor and the State. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this Contract.

11. Contract Audit: The Contractor shall allow the State to audit conformance to the Contract terms.

The State may perform this audit or contract with a third party at its discretion and at the State’s expense. The State or its authorized representatives will have full and complete access during normal business hours and upon reasonable notice, to perform an operational audit of the Contractor’s performance of the services, and related books and records pertaining to any sums to be paid hereunder or facts relative to any claim against the Contractor which may be chargeable to The State or its property. The Contractor shall provide the State and its authorized representatives with such information and assistance as needed to perform the audits.

12. Data Center Audit: State and federal program regulations, laws and IT standards require information technology providers to operate within the regulatory environment that the Agency is required to operate (State data privacy laws, federal regulation of Protected Health Information

(HIPAA) and laws related to Personally Identifiable Information (PII), etc.). In order to ensure that the system security is adequate and that there are no gaps in control coverage, the State may request to review CSP’s audit reports detailing the provider’s security provisions.

The Contractor shall perform an independent audit of its data centers at least annually at its expense and provide an un-redacted version of the audit report upon request to the State. The Contractor may remove its Proprietary Information from the un-redacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit. The audit report or

SOC2 report shall be provided to the State Identified Contact as detailed in this Contract in both electronic and hardcopy format.

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 9

During the term of the Contract, application security and vulnerability audits shall be conducted as agreed to by the State and Contractor. Contractor and State shall cooperate in the planning and execution of application security tests and audits. Alternatively, the State may, at its expense, conduct or have conducted by a third party, application security and vulnerability audits. Examples of possible audits include but are not limited to:

1. Vulnerability scan;

2. Full Penetration, a test required to attempt a compromise of the system.

Contractor shall provide the State Identified Contact with a complete copy of the audits and the results of the above audits, certifications, scans, and tests within seven (7) Business Days of the Contractor’s receipt of such results.

13. System Maintenance and Upgrade Notice: The Contractor shall give a minimum forty- eight (48) hour advance notice, or as included in the SLA to the State of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software, or firmware with a newer or better version to bring the system up to date or to improve its characteristics. It usually includes a new version number.

Contractor shall make updates and upgrades available to State at no additional costs when Contractor makes such updates and upgrades generally available to its users.

No update, upgrade or other charge to the Service may decrease the Service’s functionality, adversely affect State’s use of or access to the Service or increase the cost of the Service to the State.

Contractor shall notify the State at least sixty (60) days in advance prior to any major update or upgrade.

14. Security: The Contractor shall disclose its system security plans (SSP) or security processes and technical architecture to the State such that intrusion protection can be attained between the State and the Contractor. For example: virus checking and port sniffing — the State and the Contractor shall understand each other’s roles and responsibilities.

15. Non-disclosure and Separation of Duties: The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of State Data to that which is necessary to perform job duties.

16. Import and Export of Data: The State shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Contractor. This includes the ability for the

State to import or export data to/from other Contractors. Contractor shall specify if State is required to provide its’ own tools for this purpose, including the optional purchase of Contractors tools if

Contractors applications are not able to provide this functionality directly.

17. Responsibilities and Uptime Guarantee: The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 10 environments are the responsibilities of the Contractor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime) and provide service to customers as defined in the SLA.

18. Subcontractor Disclosure: The State is required to assess and manage granting access to State systems to any third party, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar Contract with the Contractor, providing services to the

Contractor, and the State needs to identify all entities which will be involved in providing the contracted services. The Contractor shall be responsible for all actions of its strategic business partners and all

Subcontractors and successor entities of Contractor will be subject to the terms of this agreement.

Partners are not permitted access to State Data unless needed to perform their functions. A current list of the CSP’s 3rd party providers must be made available to the State. Any additions or subtractions must be communicated via email to the State’s contract administrator.

19. Right to Remove Individuals: The State shall have the right at any time to require that the

Contractor remove from interaction with the State any Contractor representative who the State believes is detrimental to its working relationship with the Contractor. The State shall provide the Contractor with notice of its determination, and the reasons it requests the removal. If the State signifies that a potential security violation exists with respect to the request, the Contractor shall immediately remove such individual. The Contractor shall not assign the person to any aspect of the Contract or future work orders without the State’s consent.

20. Business Continuity and Disaster Recovery Plan: The Contractor shall provide a business continuity and disaster recovery plan upon request and ensure that the State’s Recovery Time Objective (RTO) and

Recovery Point Objective (RPO) as detailed in Exhibit A: Service Level Agreement (SLA) is met or as detailed in a separate SLA. Contractor must work with the State to perform an annual disaster recovery test and act to correct any issues detected during the test in a time frame mutually agreed between the

Contractor and the State.

Contractor shall utilize data redundancy techniques to prevent data loss. This includes utilizing redundant array of independent disks (RAID) or mirroring approaches and backing up all databases used by the State. Safeguards must be in place to ensure that all applicable Recovery Time Objective (RTO) and Recovery Point Objective (RPO) objectives can be met. Offsite replication or backups will be performed in a secure, environmentally controlled facility in accordance with disaster recovery requirements.

In the event of disaster or catastrophic failure that results in data loss or loss of access to data, Contractor shall immediately notify the State. The notification shall include:

1. The scale and quantity of the loss of data or access;

2. What has been done or will be done to recover the data and mitigate any negative effects;

3. What corrective action has been taken or will be taken to prevent future data loss.

21. Notice of Disaster Recovery (DR) Testing:

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 11

Timely notification of disaster recovery testing, as well as testing results, shall be provided to the State.

The Contractor will provide not less than a 30-day notice of any disaster recovery testing. DR testing can only be executed during the maintenance window on Sundays between the hours of 12AM and 8 AM CST. Specific tasks the State is to perform as part of the DR test will be provided by the Contractor. The State may choose to conduct its own verification tasks as part of the DR test. DR test results will be provided to the State within 3 days after the test.

22. Identity Management and Single Sign-on: The Contractor’s solution shall integrate with the State’s identity management process using one of the two methods below:

1. The State’s trust boundary will be extending into the Contractor’s domain using an identity management system with role-based user authentication and authorization. Contractor will synchronize with the State’s active directory using federation or single sign-on technology.

2. A strong password sign- on for application-level security will be used. The password must be “strong” in accordance with industry standards and cannot be the same password as the user’s previous 8 passwords.

23. Integration and API Interfaces: The Contractor shall provide secured methods to access State Data.

1. The State must be able to access and retrieve its data stored in the cloud at any time in its sole discretion. The State shall have the right to access all data, regardless of who created the content and for what purpose.

2. Application Program Interfaces (APIs) developed by the Contractor will use Web services

(both REST and SOAP) as underlying mechanisms for communication with DB components.

Comma-separated values (CSV), Extensible Markup Language (XML), and Java Script Object

Notation (JSON) will be used as underlying data structure formats for both input and output data exchanged between communicating components.

3. OAuth security framework will be used for authentication/authorization tasks, or other security frameworks agreed to by the State.

4. The State’s personnel will have the ability to access the database using commercial tools such as TOAD.

5. The Contractor shall also provide the ability for the State to perform periodic full or partial data extracts of the database as needed to support data warehouse integration, ad hoc analysis, or replication to a State facility.

24. Compliance with Accessibility Standards: The Contractor shall comply with and adhere to

Accessibility Standards of Section 508 of the Rehabilitation Act of 1973.

25. Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 12

Modules for all Personal Data, unless the State approves in writing the storage of Personal Data on a

Contractor portable device to accomplish work as defined in the Statement of Work.

26. Subscription Terms: Contractor grants to the State a license to: (i) access and use services for its business purposes; (ii) for SaaS, use underlying software as embodied or used in the service; and (iii) view, copy, upload and download (as applicable), and use Contractors’ documentation.

No terms, including standard click through license or website terms or use or privacy policy, shall apply to the State unless such terms are included in the Contract or otherwise agreed to in writing by both parties.

27.1 Protected Records: Contractor expressly agrees that it may create, receive from or on behalf of the

State, or have access to, records or record systems that are subject to data protection laws (“Protected

Records"). Contractor represents, warrants, and agrees that it will: (1) hold Protected Records in strict confidence and will not use or disclose Protected Records except as (a) permitted or required by this

Agreement, (b) required by law, or (c) otherwise authorized by the State in writing; (2) safeguard the

Protected Records according to commercially reasonable administrative, physical and technical standards that are no less rigorous than the standards by which Contractor protects its own confidential information; and (3) continually monitor its operations and take any action necessary to assure that the

Protected Records are safeguarded in accordance with the terms of this Agreement. At the request of the State, Contractor agrees to provide the State with a written summary of the procedures Contractor uses to safeguard the Protected Records.

27.2 Protected Records and Compliance: Contractor expressly agrees to comply with data protection laws, regulations, executive orders, policies, standards, or procedures. The list below is a non-exhaustive list of Protected Records:

• Personally-Identifiable Information (PII)

• Protected Health Information (PHI)

• Substance Use Disorder Records, 42 C.F.R. Part 2

• Payment Card Industry Data Security Standard (PCI)

• Covered Financial Information (CFI)

• Federal Educational Rights and Privacy Act information (FERPA)

• Criminal Justice Information (CJI)

• Federal Tax Information (FTI)

• Social Security Administration information (SSN)

• Driver’s Privacy Protection Act information (DPPA)

• Export Controlled Information (ECI)

• Federal Information Security Management Act information (FISMA)

• Controlled Unclassified Information (CUI)

• Attorney-Client Privileged Information

• Interpreter Privileged Information

• Crime Victim Information

• Cybersecurity Information

• Child Critical Incident Information

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23

State of Wisconsin |Security Rider v7 13

• Employee Personnel Records

• Plans or Specifications for State Buildings

• Law Enforcement Records

• Juvenile Records

• Trade Secrets

• EU Residents’ Personal Data (GDPR)

• Children’s Online Privacy Protection Act information (COPPA)

• Passport/Visa Information

28. Secure Data Center Environment: The Contractor will ensure its data center environment always contains physical and operational server security systems. Physical security shall be maintained by the

Contractor such that the data centers have controlled access on a 24 X 7 basis. For operational security, the Contractor will maintain and keep up-to-date Antivirus and firewall software, as well as operating system software patches.

29. Record Retention: The Contractor will comply with NIST approved methods of records retention.

Contractor must comply with all records retention requirements as directed by the State.

30. Support and Maintenance Processes:

Contractor shall agree on service level metrics contained herein. In the alternative, the Contractor and the State shall reach agreement on operational metrics outlined in a separate Service Level Agreement (SLA), as long as said SLA, at a minimum, includes the following:

a) Advance notice and change control for major upgrades and system changes

b) System availability/uptime guarantee/agreed-upon maintenance downtime

c) Recovery Time Objective/Recovery Point Objective

d) Security Vulnerability Scanning

Docusign Envelope ID: B178C9FE-B705-4A1F-9543-618220404B57Docusign Envelope ID: 95676256-3157-43B6-93CB-458EB0982D23