ATTACHMENT_J._DOJ_Contractor_Security.pdf

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

Company or Organization (Print or Type):

Contractor’s Full Legal Name (Print or Type):

Contractor’s Phone Number:

Contractors must complete all sections. DOJ will not process this Security CND Agreement with blank areas. Please attach supporting documentation if necessary.

DOJ CONTRACTOR SECURITY CND AGREEMENT

The California Department of Justice (herein after referred to as DOJ) collects, stores, and disseminates confidential and sensitive information from the law enforcement community and the public to administer the various programs for which it has responsibility. This information is maintained according to provisions of various laws and regulations including the Information Practices Act, the Public Records Act, the State Administrative Manual (SAM), the Department of Justice Administrative Manual (DOJAM) and in reference to associated DOJ IT security policies. DOJ is committed to protect its information and systems from unauthorized access, use or disclosure. The following agreement has been established to address the security and confidentiality of DOJ information systems including but not limited to California Law Enforcement Telecommunications System (CLETS), California Justice Information Systems (CJIS), Law Enforcement Agency (LEA), and other DOJ systems.

1. A Contractor is hereby defined as any person, or company that undertakes a contract to provide materials or labor to perform a service for DOJ. A contractor can also be a vendor, organization (public or private), permanent or designated employee of any such entity who works directly or indirectly for DOJ. The authorized contractor, vendor, or organization, will be allowed to perform work within DOJ's network, information systems, files, databases or applications whether in a conceptual, pilot or operational form.

2. Based upon the degree of access required, and the sensitivity of the information, DOJ requires a background check of any contractor, sub-contractors, or individuals assigned to a project. As a condition of employment, the initial or continued contractual relationship may be contingent upon the successful completion of a background check.

DOJ Contract Number:

Intent of Contract (Items/Services to be provided):

Contractor's Signature: Date:

3. A Contractor may access DOJ systems or its information only when authorized by DOJ management in order to fulfill contractual requirements. Contractors may not access or use information from the DOJ network, information systems, applications, or from any databases accessible through the DOJ network, for any unauthorized purpose.

4. Upon approval with authorization in writing from DOJ Management, contractors may only disclose information or release information in reference to DOJ files, to individuals that DOJ management has authorized to receive it. Contractors shall not divulge or make use of DOJ confidential or proprietary information, data, or records for any unauthorized purpose. Such use maybe subject to civil or criminal action.

5. Contractors are prohibited from modifying, deleting or destroying existing data on DOJ's network or any of DOJ's systems. Contractors are also prohibited from unauthorized actions that would adversely affect the performance or security of any DOJ system, or cause any disruption within DOJ's network, systems, or applications.

6. Contractors will not remove any DOJ work related materials from the DOJ work site or office location without prior written authorization from a DOJ Department or Division's Project Manager or officiating management. Work in progress is to be stored and maintained on DOJ's network or in areas designated for such storage.

7. Contractors must take precautions to protect DOJ's information, networks, systems, applications, databases or other resources from unauthorized access, use or disclosure. Precautions include, but are not limited to, the following: a. DOJ requires that all contractors use a DOJ state owned computer or encrypted laptop while working onsite or offsite and when accessing sensitive or confidential data including but not limited to Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA), and CJIS data. To maintain security all DOJ owned assets will have anti-virus software installed on them and will receive the latest security updates.

b. The Contractor must ensure that their, DOJ owned desktop, laptop or other mobile devices such as a cell phone, tablet or PDA that is used to review or access DOJ information, data or files is locked at all times when left unattended or stored in a secure place where no one could gain access to the device.

c. Unauthorized disclosure of DOJ system access to anyone at any time is strictly prohibited.

d. DOJ network or system account passwords should never be shared with others including DOJ staff or other contracting or sub-contracting staff.

e. The Contractor must promptly report to the DOJ ISO and DOJ Security Guard Station of any suspicious or unauthorized individual(s) observed in their work area.

f. Documents, files, spreadsheets, code, diagrams, spreadsheets, etc, shall only be stored on

DOJ approved devices or systems. Documents shall also be stored in an approved location or in a secure place such as a locked cabinet, drawer or office, or other secure designated location authorized by DOJ management. Saving files on a contractor's desktop or laptop for file-sharing such as, peer-to-peer, Google drive, Dropbox, etc., or on USB drives, CD-ROMs or in a cloud environment is strictly prohibited.

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

g. Immediately notify the DOJ ISO and the Network Information Security Unit (NISU) of any security incidents involving data or any incident regarding breaches of data. If the breach involves criminal offender record information or CLETS then the Communications Administration Program shall also be notified.

8. Immediately notify DOJ ISO or NISU of any security incidents or data breaches that involve criminal offender record information, CLETS, confidential, sensitive, PII or HIPAA data.

9. Contractors shall obtain written approval from the DOJ Project Manager or DOJ management before downloading confidential, sensitive, PII or HIPAA data information to a contractor's PC or Laptop.

10. Upon conclusion of the authorized work interval, all designated equipment, software, information, materials, or proprietary/intellectual property shall be returned to DOJ. All documents that the contractor has developed, worked on, created or revised should be returned within two working days or with proof of destruction of all documents furnished to the DOJ's Project manager or officiating management with oversight responsibility for the project.

By reading and signing, I acknowledge that I have read and understood, and received a copy of this Confidentiality Non-Disclosure Agreement form stated above as well as the requirements set forth in DOJ Administrative Manual Chapter 15 Sections 15100 through 15772. I understand that failure to comply with this agreement may constitute grounds for disciplinary action up to and including contract termination and/or administrative, civil, or criminal action in accordance with applicable statutes. In complying with the aforementioned, I further understand that there is no expectation of privacy when utilizing the DOJ network, systems or resources, as they are being audited and monitored.

Additional Certification Declaration for Contractors Accessing Criminal History Information

I hereby certify that I have read and am familiar with the contents of 1) the Security Addendum;

2) the Criminal Justice Information Services Security Policy; and 3) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.

I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered in to the contract incorporating the Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization, accessing it by exceeding authorization, accessing it for an improper purpose, using, disseminating, or re-disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re-disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

DOJ Senior Official Having Responsibilities Over This Contract Agreement

Typed Name

Date

Signature

Title

8.0.1291.1.339988.308172

CA DOJ

Pre-Registration Notice PAGE of

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

.\DOJ WHT & BLKLOGO.jpg Official Seal of the Office of the Attorney General

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

Contractors must complete all sections. DOJ will not process this Security CND Agreement with blank areas. Please attach supporting documentation if necessary.

DOJ CONTRACTOR SECURITY CND AGREEMENT

The California Department of Justice (herein after referred to as DOJ) collects, stores, and disseminates confidential and sensitive information from the law enforcement community and the public to administer the various programs for which it has responsibility. This information is maintained according to provisions of various laws and regulations including the Information Practices Act, the Public Records Act, the State Administrative Manual (SAM), the Department of Justice Administrative Manual (DOJAM) and in reference to associated DOJ IT security policies. DOJ is committed to protect its information and systems from unauthorized access, use or disclosure. The following agreement has been established to address the security and confidentiality of DOJ information systems including but not limited to California Law Enforcement Telecommunications System (CLETS), California Justice Information Systems (CJIS), Law Enforcement Agency (LEA), and other DOJ systems.

1. A Contractor is hereby defined as any person, or company that undertakes a contract to provide materials or labor to perform a service for DOJ. A contractor can also be a vendor, organization (public or private), permanent or designated employee of any such entity who works directly or indirectly for DOJ. The authorized contractor, vendor, or organization, will be allowed to perform work within DOJ's network, information systems, files, databases or applications whether in a conceptual, pilot or operational form.

2. Based upon the degree of access required, and the sensitivity of the information, DOJ requires a background check of any contractor, sub-contractors, or individuals assigned to a project. As a condition of employment, the initial or continued contractual relationship may be contingent upon the successful completion of a background check.

3. A Contractor may access DOJ systems or its information only when authorized by DOJ management in order to fulfill contractual requirements. Contractors may not access or use information from the DOJ network, information systems, applications, or from any databases accessible through the DOJ network, for any unauthorized purpose.

4. Upon approval with authorization in writing from DOJ Management, contractors may only disclose information or release information in reference to DOJ files, to individuals that DOJ management has authorized to receive it. Contractors shall not divulge or make use of DOJ confidential or proprietary information, data, or records for any unauthorized purpose. Such use maybe subject to civil or criminal action.

5. Contractors are prohibited from modifying, deleting or destroying existing data on DOJ's network or any of DOJ's systems. Contractors are also prohibited from unauthorized actions that would adversely affect the performance or security of any DOJ system, or cause any disruption within DOJ's network, systems, or applications.

6. Contractors will not remove any DOJ work related materials from the DOJ work site or office location without prior written authorization from a DOJ Department or Division's Project Manager or officiating management. Work in progress is to be stored and maintained on DOJ's network or in areas designated for such storage.

7. Contractors must take precautions to protect DOJ's information, networks, systems, applications, databases or other resources from unauthorized access, use or disclosure. Precautions include, but are not limited to, the following: a. DOJ requires that all contractors use a DOJ state owned computer or encrypted laptop while working onsite or offsite and when accessing sensitive or confidential data including but not limited to Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA), and CJIS data. To maintain security all DOJ owned assets will have anti-virus software installed on them and will receive the latest security updates.

b. The Contractor must ensure that their, DOJ owned desktop, laptop or other mobile devices such as a cell phone, tablet or PDA that is used to review or access DOJ information, data or files is locked at all times when left unattended or stored in a secure place where no one could gain access to the device.

c. Unauthorized disclosure of DOJ system access to anyone at any time is strictly prohibited.

d. DOJ network or system account passwords should never be shared with others including DOJ staff or other contracting or sub-contracting staff.

e. The Contractor must promptly report to the DOJ ISO and DOJ Security Guard Station of any suspicious or unauthorized individual(s) observed in their work area.

f. Documents, files, spreadsheets, code, diagrams, spreadsheets, etc, shall only be stored on DOJ approved devices or systems. Documents shall also be stored in an approved location or in a secure place such as a locked cabinet, drawer or office, or other secure designated location authorized by DOJ management. Saving files on a contractor's desktop or laptop for file-sharing such as, peer-to-peer, Google drive, Dropbox, etc., or on USB drives, CD-ROMs or in a cloud environment is strictly prohibited.

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

PAGE of

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

.\DOJ WHT & BLKLOGO.jpg Official Seal of the Office of the Attorney General

g. Immediately notify the DOJ ISO and the Network Information Security Unit (NISU) of any security incidents involving data or any incident regarding breaches of data. If the breach involves criminal offender record information or CLETS then the Communications Administration Program shall also be notified.

8. Immediately notify DOJ ISO or NISU of any security incidents or data breaches that involve criminal offender record information, CLETS, confidential, sensitive, PII or HIPAA data.

9. Contractors shall obtain written approval from the DOJ Project Manager or DOJ management before downloading confidential, sensitive, PII or HIPAA data information to a contractor's PC or Laptop.

10. Upon conclusion of the authorized work interval, all designated equipment, software, information, materials, or proprietary/intellectual property shall be returned to DOJ. All documents that the contractor has developed, worked on, created or revised should be returned within two working days or with proof of destruction of all documents furnished to the DOJ's Project manager or officiating management with oversight responsibility for the project.

By reading and signing, I acknowledge that I have read and understood, and received a copy of this Confidentiality Non-Disclosure Agreement form stated above as well as the requirements set forth in DOJ Administrative Manual Chapter 15 Sections 15100 through 15772. I understand that failure to comply with this agreement may constitute grounds for disciplinary action up to and including contract termination and/or administrative, civil, or criminal action in accordance with applicable statutes. In complying with the aforementioned, I further understand that there is no expectation of privacy when utilizing the DOJ network, systems or resources, as they are being audited and monitored.

Additional Certification Declaration for Contractors Accessing Criminal History Information I hereby certify that I have read and am familiar with the contents of 1) the Security Addendum;

2) the Criminal Justice Information Services Security Policy; and 3) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.

I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered in to the contract incorporating the Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization, accessing it by exceeding authorization, accessing it for an improper purpose, using, disseminating, or re-disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re-disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

PAGE of

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

.\DOJ WHT & BLKLOGO.jpg Official Seal of the Office of the Attorney General

DEPARTMENT OF JUSTICE (DOJ) CONTRACTOR SECURITY

CONFIDENTIALITY AND NON-DISCLOSURE (CND) AGREEMENT

PAGE of

DEPARTMENT OF JUSTICE

CJIS 003

(Orig. 10/2022)

STATE OF CALIFORNIA

.\DOJ WHT & BLKLOGO.jpg Official Seal of the Office of the Attorney General DOJ Senior Official Having Responsibilities Over This Contract Agreement