Attachment B

DATA SECURITY

1. Data Protection Requirements. In carrying out its activities under the Agreement, each Party will observe and comply with all applicable data privacy and data protection Laws. In addition, when accessing or handling any GTA data that contains “personally identifiable information,” Contractor will comply with GTA rules that have been disclosed to Contractor relating to the use and disclosure of such information.

2. GTA Data Generally. As between the Parties, GTA Data will be and remain the property of GTA or its applicable customers. Contractor may not use GTA Data for any purpose other than to render the Services. No GTA Data will be sold, assigned, leased or otherwise disposed of to third parties or commercially exploited by or on behalf of Contractor (or any of its subcontractors). Neither Contractor nor any of its subcontractors may possess or assert any lien or other right against or to GTA Data.

Without limiting the generality of the foregoing, (a) Contractor may use GTA Data only as strictly necessary to render the Services and must restrict access to such information to Contractor Personnel on a strict need-to-know basis, and (b) Contractor will not download, copy, transmit or make available any GTA Data to any third party, except as expressly permitted by the Agreement.

3. Data Security.

3.1 Risk of Data Loss. When GTA Data is in Contractor’s possession or under Contractor’s control and an event occurs that prevents or hinders the access to or reliable use of such GTA Data, Contractor will re-create or restore such data immediately, or in any case, as soon as reasonably practicable, to the last scheduled back-up applicable to such GTA Data in accordance with Contractor’s responsibilities under the Agreement. Any such re-creation or restoration will be at Contractor’s expense and GTA will not be subject to any charge in connection therewith.

3.2 Data Security Measures.

(a) Contractor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of GTA Data. Such security measures shall be in accordance with (a) GTA rules (including Internal Revenue Code 6103 et seq., IRS Publication1075, Social Security Administration Data Security Standard, Criminal Justice Information System Data Security Standard, HITECH Act and HIPAA Security Rules, MARS-E and the Affordable Care Act, and FERPA), (b) the Federal Information Security Management Act (or FISMA), 44 U.S.C.

§ 3541, et seq., and

(c) to the extent applicable, the National Institute of Standards and Technology (NIST) 800-53 standards.

(b) Except as may be expressly agreed otherwise by GTA, all GTA Data “at rest” in Contractor’s systems or otherwise within Contractor’s control must reside within the United States at all times.

(c) To the extent Contractor removes GTA Data from any media that is taken out of service that is under Contractor’s control, Contractor will securely erase such media in accordance with GTA rules. Under no circumstances will Contractor use or re-use media on which GTA Data has been stored to store data of any other customer of Contractor or to deliver data to a third party, including another customer of Contractor, unless such GTA has been securely erased in accordance with GTA rules.

3.3 Backups and Availability of GTA Data. GTA will have the right to establish backup security for any GTA Data and to keep backup files for such GTA Data in its possession if it chooses. Contractor will provide GTA with downloads of GTA Data, as requested or directed by GTA, to enable GTA to maintain such backup copies. GTA Data will be returned or otherwise provided to GTA (and its other customers), upon request, in the form and format as requested by GTA (or such other customers).

Contractor will never refuse for any reason, including GTA’s material breach of the Agreement, to provide GTA (and such customers) with the GTA Data in accordance with this Section.

4. Security Incident.

4.1 Contractor will promptly notify GTA in the event of any actual, attempted, suspected, threatened, or reasonably foreseeable circumstance or incident that compromises, or could reasonably be expected to compromise, the security of any “personally identifiable information” (as such term is defined under applicable Law), including any circumstance pursuant to which applicable Law requires notification to be given to affected individuals or regulators.

4.2 If Contractor’s breach of the Agreement (including this Exhibit 3) results in any incident described in Section 4.1 above, then Contractor shall reimburse GTA for any reasonable associated expenses, including the cost of any required legal compliance (e.g., notices required by applicable Law), the expenses related to the investigation and remediation of the incident, and any identity protection services made available to affected individuals.

IRS 1075 Publication (September 30, 2016)

CONTRACT LANGUAGE FOR TECHNOLOGY SERVICES

I. PERFORMANCE

In performance of this contract, the contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements:

(1) All work will be done under the supervision of the contractor or the contractor's employees.

(1) The contractor and the contractor’s employees with access to or who use FTI must meet the background check requirements defined in IRS Publication 1075.

(2) Any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Disclosure to anyone other than an officer or employee of the contractor will be prohibited.

(3) All returns and return information will be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.

(4) The contractor certifies that the data processed during the performance of this contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the contractor certifies that any IRS data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.

(5) Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the agency or his or her designee. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency or his or her designee with a statement containing the date of destruction, description of material destroyed, and the method used.

(6) All computer systems receiving, processing, storing or transmitting FTI must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls.

All security features must be available and activated to protect against unauthorized use of and access to Federal Tax Information.

(7) No work involving Federal Tax Information furnished under this contract will be subcontracted without prior written approval of the IRS.

(8) The contractor will maintain a list of employees authorized access. Such list will be provided to the agency and, upon request, to the IRS reviewing office.

(9) The agency will have the right to void the contract if the contractor fails to provide the safeguards described above.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract. Inspection by or disclosure to anyone without an official need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each individual understands the agency’s security policy and procedures for safeguarding IRS information. Contractors must maintain their authorization to access FTI through annual recertification. The initial certification and recertification must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For both the initial certification and the annual certification, the contractor must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. On the basis of such inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with contract safeguard.

Contracting with State Entities

The following provisions are applicable to State offices, agencies, departments boards, bureaus, commissions, institutions, agencies, boards, commissions, and other entities of the state procuring goods and/or services pursuant to O.C.G.A. § 50- 5-50 et seq. (“State Entities”).

Please be advised that State Entities are unable to agree to certain revisions to the standard state contract. Revisions that would provide an unfair competitive advantage, including but not limited to those that materially change the terms or the requirements of the solicitation, will be rejected by the State. Please note that this guidance is not all-inclusive, and State Entities reserve the right to negotiate all terms and conditions. If a supplier and a State Entity are unable to come to mutually agreeable terms, the supplier will not be awarded a contract.

1. Indemnification and/or hold harmless.

As provided under O.C.G.A § 50-5-64.1(a)(1)(A), contracts shall not contain a term that requires State Entities to defend, indemnify, or hold harmless another person (the term “person” also includes “corporations,” see O.C.G.A. § 1-3-3 and O.C.G.A. § 1-2-1). Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term. Moreover, State Entities are prohibited by the Georgia Constitution from agreeing to any such provision as they have been determined to violate the prohibition against gratuities, , pledges of the State’s credit, and an unauthorized waiver of sovereign immunity. (Ga. Const. Art. VII, § IV, ¶ VIII; Ga. Const. Art. III. Sec. VI, Par.

VI; 1980 Op. Att'y Gen. 80-67; 1974 Op. Att'y Gen. 74-115; 1980 Op. Att'y Gen. 80-67.)

2. The Georgia Attorney General Represents the State of Georgia.

Pursuant to Ga. Const Art. V, § III, ¶ IV and O.C.G.A. § 45-15-3, the Attorney General represents the state of Georgia.

Additionally, O.C.G.A § 50-5-64.1(a)(2)(A) provides that contracts shall not contain a term that provides for a person other than the Attorney General to serve as legal counsel for the state or for any agency, authority, board, bureau, commission, department, institution, or any entity thereof. Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term.

3. Warranty/Guarantee.

Any provision that requires a State Entity to unconditionally assure or promise a certain result or outcome. The Attorney General has advised that warranty provisions requiring State Entities to provide a warranty violate the prohibition against pledges of the State's credit and the prohibition against gratuities by the State. The reason is that resources may have to be expended to satisfy such warranty or guarantee.

4. Venue.

As provided under O.C.G.A § 50-5-64.1(a)(2)(B), contracts shall not contain a term that provides for a venue for any action or dispute other than the Superior Court of Fulton County, Georgia. Any such provision in a contract shall be deemed void and the contract shall otherwise enforceable as if it did not contain such term. See also O.C.G.A. § 50- 21-1.

5. Governing Law.

As provided under O.C.G.A § 50-5-64.1(a)(2)(C), contracts shall not contain a term that provides for the contract to be construed in accordance with the laws of another state. Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term.

6. Requirements that the Department pay taxes, interest, penalty fees or cancellation charges, litigation costs, or attorney's fees.

• ATTORNEY'S FEES/COSTS. State Entities will not agree to pay attorney’s fees or costs. The rationale is that such a payment would pledge the credit of the state in violation of Ga. Const. Art. VII, § IV, ¶ VIII and would be a violation of the gratuities clause of the Georgia Constitution. See Ga. Const. Art. III, § VI, ¶ VI.

• DAMAGES. The inclusion of indirect, consequential, or incidental damages payable by a State Entity are generally not acceptable.

• INTEREST. Except as otherwise explicitly permitted by law, the Department and State Entities will not agree to pay interest. The Attorney General has advised the Department that payment of interest would pledge the credit of the state, be prohibited by the gratuities clause of the constitution, and that the Department lacks statutory authority to agree to the payment of interest.

• LATE PAYMENT/CANCELLATION CHARGES. State Entities do not agree to pay late payment charges. This policy stems from an opinion of the Attorney General that late payment charges are in the nature of penalty/gratuity which the State is constitutionally prohibited from paying. Agreeing to pay such charges would also pledge the credit of the state in violation of the constitution. 1974 Op. Att'y Gen. 74-115.

• TAXES. The State is exempt from most taxes and generally will not agree to contract language which requires the payment of taxes. State Entities will not agree to reimburse the supplier for the payment of taxes. However, State Entities will agree to language that states "the State Entity will pay taxes lawfully imposed upon it.”

7. Binding arbitration or waiver of jury trial.

As provided under O.C.G.A § 50-5-64.1(a)(2)(D), contracts shall not contain a term that provides for binding arbitration.

Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term. Further, State Entities do not maintain the authority to agree to waiver of a jury trial, as State law provides that the Attorney General has exclusive authority and control over all matters of litigation or potential litigation involving State agencies. Pre-litigation contractual waivers of jury trial are not enforceable in Georgia. Bank South, N.A.

v. Howard, 264 Ga. 339 (1994).

8. Any provision requiring a State Entity to be bound by terms and conditions that are unknown at the time of signing the agreement.

As provided under O.C.G.A § 50-5-64.1(a)(1)(B), contracts shall not contain a term that requires State Entities to be bound by terms and conditions that are unknown at the time of signing such contract or which may be unilaterally changed. Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term.

State Entities will not agree to contract provisions that incorporate additional obligations by references to terms and conditions located at a specific web address, as those provisions may be unilaterally changed.

https://advance.lexis.com/api/document/collection/statutes-legislation/id/5YYC-7H71-FJDY-X19D-00008-00?cite=Ga.%20Const.%20Art.%20III%2C%20%C2%A7%20VI%2C%20Para.%20VI&context=1000516

9. Best efforts provisions that require the expenditure of any funds or efforts necessary to meet the obligations of a contract, even if such efforts exceed the dollar amount of the contract.

State Entities will not agree to best efforts provisions that require the expenditure of any funds or efforts necessary to meet the obligations of a contract which exceed the dollar amount of the contract. Similar to warranties and/or guarantees, such provisions violate the prohibition against pledging the State's credit. (Refer to discussion of warranties above for more information).

10. Contractual provisions which require a State Entity to accept the risk of loss of items or goods during delivery.

As a general rule, State Entities do not accept risk of loss until receipt of the items or goods.

11. Contractual clauses that require a State Entity to purchase insurance policies.

State law provides for the Department of Administrative Services to procure insurance for State entities. State Entities are covered by the Tort Claims Act and the State of Georgia Broad Form Insurance that is administered by the Department of Administrative Services. O.C.G.A. § 50-21-34(a) provides that tort claims against the state may only be paid from insurance provided under the Tort Claims Act. DOAS will not name an additional insured under these policies.

12. No Automatic renewals for agreements obligating state appropriated funds.

As provided under O.C.G.A § 50-5-64.1(a)(2)(E), contracts shall not contain a term that provides for an automatic renewal such that state funds are or would be obligated in subsequent fiscal years. Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term. Automatic renewals also pledge the credit of the state in violation of the constitution. 1974 Op. Att'y Gen. 74-115.

13. Multiyear Lease, Lease Purchase, and Purchase Contracts.

Pursuant to O.C.G.A. § 50-5-64, Multiyear agreements must meet the following requirements:

(1) unless (a) all funds required for the contract are maintained by the State Entity in hand at the time of contract execution (meaning that the State Entity has all funds necessary to pay the multiyear obligations and no additional appropriation or revenue are necessary for the State Entity to meet its contractual payment obligations) and (b) all such funds are obligated via State Entity accounting up front, typically via Purchase Order Incumbrance: See 1980 Att’y Gen Op. 80-163

(2) Standard form – O.C.G.A. § 50-5-64(a) requires that leases and lease purchase agreements shall only be executed on a standard form developed by DOAS.

(3) Termination of Contract – Contract terminates absolutely at the close of the fiscal year in which it is executed and the fiscal year for any renewals. O.C.G.A. § 50-5-64(a)(1).

(4) No Automatic Renewals - Contract terminates at the end of each fiscal year and can only be renewed by positive action taken by the agency. O.C.G.A. § 50-5-64(a)(2).

(5) Funding – Contract terminates immediately when funding is no longer available. Agency makes determination as to whether funds are unavailable at its sole discretion. O.C.G.A. § 50-5-64(a)(3).

(6) Listing of Obligation – Contract must list total obligation for the fiscal year and any obligations for renewals. O.C.G.A. § 50-5-64(a)(4).

(7) Title - Title to any goods or equipment remain with the supplier until fully paid by the agency.

O.C.G.A. § 50-5-64(a)(5). However, for lease purchases agreements, O.C.G.A. § 50-5-65(b) allows agencies to accept

(8) title upon execution of the DOAS standard form. Agencies can also transfer title back to the vendor if the agreement is not fully consummated.

(9) Interest – Lease Agreement can provide for the payment of interest. O.C.G.A. § 50-5-64(d).

(10)

14. No liens, security interest, or UCC Filings.

The execution or levy against state funds or property is not permitted as there is no waiver of sovereign immunity for such actions in the Constitution or by the General Assembly, security interests, or UCC filings. Agencies only have powers conferred by the legislature. State agencies do not have the authority to grant security interests in public property. Dekalb County v. J&A Pipeline Co., 263 Ga. 645 (1993).

15. Unconditional contract payments.

Agencies generally cannot agree to unconditional payments. Any assignment of the Supplier’s right to receive payment must be subject to all of the Agency’s defenses. As a practical matter, if a dispute arises, the agency needs to be able to resolve the dispute. This is particularly problematic in financing agreements, as a dispute may arise between the vendor providing the equipment and the agency and yet the Agreement requires the agency to continue paying the financing company. This may constitute as a gratuity, which is prohibited under the State Constitution. See Ga. Const. Art. III. § VI, ¶ VI). Additionally, State Entities are prohibited from incurring debt except as provided by law.

Ga. Const. Art. VII, Sec. IV, Par. I; Ga. Const. Art. VII, Sec. IV, Par. VIII; O.C.G.A. § 50-17-24.

16. No upfront payments for goods/services.

State Entities are generally not authorized to make payment prior to receipt of goods/services. (Pursuant to the State of Georgia Accounting Procedures Manual, payables for normal operating expenditures should be recognized when the goods and services have been received. Accounting Manual Reference: Section: Vendor Management; Subsection:

Payment Method).

17. Drug Free Workplace.

Pursuant to O.C.G.A. § 50-24-3 and § 50-24-4, the State Entities must include in contracts with contractors as defined in O.C.G.A. § 50-24-2 specific certifications regarding the provision of a drug free workplace and prohibition against engaging in certain activities relating to unlawful drug-related activities.

18. Confidentiality.

As provided under O.C.G.A § 50-5-64.1(a)(3), contracts shall not contain a term that is inconsistent with the provisions of Article 4 of Chapter 18 of Title 50, relating to open records. Any such provision in a contract shall be deemed void and the contract shall be otherwise enforceable as if it did not contain such term.

Any confidentiality provisions in a contract must be subject to the Georgia Open Records Act, O.C.G.A. § 50-18-70 et seq., as State Entities are public agencies of the State of Georgia and subject to other requirements of law or court order. Additionally, the Georgia Department of Administrative Services generally considers pricing information to be subject to public disclosure. See State Rd. & Tollway Auth. v. Elec. Transaction Consultants Corp., 306 Ga. App. 487 (2010).

19. No Boycott of Israel.

Pursuant to O.C.G.A. §50-5-85, the state shall not enter into a contract with a total value of $1,000 or greater with an individual or company if the contract is related to construction or the provision of services, supplies, or information technology unless the contract includes a written certification that such individual or company is not currently engaged in, and agrees for the duration of the contract not to engage in, a boycott of Israel.

20. Joint Ownership.

In general, the State is constitutionally prohibited from becoming a joint owner or stockholder in or with any individual, company, association, or corporation. Therefore, State Entities are generally prohibited from agreeing to joint ownership of intellectual property. See Ga. Const. Art. VII § IV, VIII.

21. E-Verify.

Pursuant to O.C.G.A. § 13-10-91, a public employer shall not enter into a contract for the performance of services unless the contractor registers and participates in the federal work authorization program. If a supplier is providing services under a contract with a total compensation amount of $2,500 or greater, (even if such services will be performed outside of the State of Georgia), DOAS requires a notarized affidavit from the supplier attesting to the following:

(A) The affiant has registered with, is authorized to use, and uses the federal work authorization program;

(B) The user identification number and date of authorization for the affiant;

(C) The affiant will continue to use the federal work authorization program throughout the contract period;

and

(D) The affiant will contract for the physical performance of services in satisfaction of such contract only with subcontractors who present an affidavit to the contractor with the same information required by subparagraphs (A), (B), and (C) of this paragraph.

Additional information regarding the State’s E-verify requirements can be found at:

http://www.audits.ga.gov/NALGAD/IllegalImmigrationReformandEnforcementAct.html

22. Benefits Based Funded Contracts (aka Cost Savings Contracts).

Benefits Based Funding Contracts, also referred to as “Cost Savings Contracts” are contracts where private companies assume financial risk for the success of a project and are then paid by the State Entity from the calculated savings or revenue gains generated from the project. While these projects may be appealing because they are designed to fund improvement initiatives without placing an additional financial burden on the State Entity, there are legal constraints in implementing these types of contracts. For example, unless specifically authorized in the Constitution, the State’s credit cannot be pledged. Any liability which is not required to be discharged by money already in the treasury, or by taxes to be levied during the year in which the contract under which the liability arises was made, is a debt within the meaning of the constitution. A contract violating the Constitutional prohibition on pledging the State’s credit is void.

Additionally, Public officials may not charge fees or collect money except as authorized by law. Except under limited circumstances, monies collected by a state agency must be deposited into the general fund of the state treasury.

Money may be withdrawn from the treasury only by appropriation made by law. Appropriations may not be “earmarked” for any special purpose and all revenues not contractually obligated lapse at the end of the year.

O.C.G.A. § 50-5-77 was implemented to increase flexibility in procuring benefits based funded contracts. In the event that the provisions of O.C.G.A. § 50-5-77 cannot be met for this type of contract, the Department of Law should be consulted for further guidance.

http://www.audits.ga.gov/NALGAD/IllegalImmigrationReformandEnforcementAct.html