Attachment L - Non-Disclosure Agreement.pdf

4050 Esplanade Way Tallahassee, FL 32399-0950

Ron DeSantis, Governor Pedro Allende, Secretary

ATTACHMENT L

CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

BETWEEN

FLORIDA DEPARTMENT OF MANAGEMENT SERVICES

AND

<CONTRACTOR>

This Confidentiality and Non-Disclosure Agreement (“Agreement”) is between the Florida Department of Management Services (“Department”), a state agency, and <CONTRACTOR NAME> (“Recipient”), referred to herein collectively as the “Parties” and individually as a “Party.”

WHEREAS, Recipient has or will enter into Contract No. DMS-24/25-199, State University System Optional Retirement Program (SUSORP) 403(B) and Senior Management Service Optional Annuity Program (SMSOAP) 401(A);

WHEREAS, in furtherance of providing these services and/or commodities, Recipient may access, receive, or create Confidential Information from the Department; and

WHEREAS, the Department maintains certain protections on such Confidential

Information and desires to set forth the terms Recipient is required to adhere to.

NOW THEREFORE, for the mutual and valuable consideration acknowledged by both Parties, the Parties agree as follows:

1. Definitions.

(a) Access: Means the ability or authorization to create, inspect, transmit, approach, instruct, communicate with, store, retrieve, or otherwise make use of any Confidential Information, regardless of type, form, or nature of storage. “Access” to a computer system or network includes local and remote access.

(b) Affiliates: Any agents, affiliates, partners, subcontractors, resellers, distributors, dealers, or other entities associated with Recipient that have Access to the Confidential Information.

(c) Agreement-related Materials: Materials created or provided by Recipient while performing the Agreement.

(d) Confidential Information: Information that is restricted from public disclosure based on federal or State laws and regulations including, but not limited to, those related to privacy, confidentiality, security, personally identifying information, personal health, business or trade secret information, and other information exempt from state public records law. “Confidential Information” includes information disclosed, orally or otherwise, before, on, or after this Agreement effective date by the Department to Recipient, and whether or not marked, designated, or otherwise identif ied as “confidential.” Any information derived from Confidential Information and/or created by Recipient pursuant to this Agreement which must be restricted from public disclosure based on federal or State laws and regulations shall be

DMS-24/25-199

SUSORP/SMSOAP Page 2 of 7 considered Confidential Information subject to the restrictions set forth in this Agreement.

Specifically, Recipient will receive and may create or learn of information which include network schematics, hardware and software configurations, or encryption, or which identify detection, investigation, or response practices for suspected or confirmed IT security incidents, including suspected or confirmed breaches, the disclosure of which would facilitate unauthorized access, modification, disclosure, or destruction of information, IT resources, or information relating security, which are confidential and exempt from public disclosure pursuant to section 282.318(5), Florida Statutes (F.S.).

(e) State: The State of Florida.

2. Term and Termination. This Agreement is effective upon signature by both Parties. This

Agreement may be terminated by the Department when determined to be in the best interest of the State of Florida by providing Recipient with advance written notice.

3. Confidential Information Use. Use of the Confidential Information shall be limited to the provisions set forth herein and to the extent necessary to provide the services and/or commodities. The Department retains full rights and title to all Confidential Information provided by it, and any information derived therefrom. Recipient has no ownership rights to the Confidential Information provided under this Agreement, or any information derived therefrom.

4. Recipient Obligations. Recipient shall: 1) maintain the confidentiality of all the

Confidential Information pursuant to this Agreement, as required herein, 2) comply with all federal and State laws and regulations related to information privacy and security, and 3) ensure that any Affiliates comply with the preceding two requirements as to any Confidential Information shared with or otherwise Accessed by the Affiliate. Recipient shall take all measures necessary to protect against improper Access to and/or disclosure or theft of the Confidential Information and will ensure only those individuals performing services contemplated in this Agreement will be permitted to Access the Confidential Information. Recipient shall perform the following measures to preserve the privacy, security, confidentiality, integrity, and accessibility of the Confidential Information which includes, but is not limited to:

(a) Using the Confidential Information only to provide services and/or commodities as contemplated in this Agreement and not otherwise using the Confidential Information for Recipient’s own benefit or the benefit of others, or in violation of any applicable laws or regulations;

(b) Not creating derivative works based upon the Confidential Information, copying the Confidential Information, or publishing or disclosing the Confidential Information to any individual or entity except in accordance with this Agreement;

(c) Implementing and maintaining protective administrative, technical, and organizational security measures appropriate to the nature of the Confidential Information to safeguard against unauthorized Access, disclosure, or theft of the Confidential Information;

(d) Maintaining the confidentiality of the Confidential Information under this Agreement in accordance with Department policies and procedures and applicable State and federal laws and regulations;

(e) Storing and safeguarding the Confidential Information in a physically and electronically secure location where Access is limited to authorized persons;

(f) Maintaining an up-to-date list of individuals who are authorized to Access the Confidential Information;

SUSORP/SMSOAP Page 3 of 7

(g) Instructing and requiring all individuals authorized to Access the Confidential Information to adhere to the confidentiality requirements set forth in this Agreement prior to being granted Access to the Confidential Information;

(h) Not allowing, through action or inaction, any Confidential Information to be sent by any medium, transmitted, or to be Accessed outside of the United States. For the purposes of this restriction, “Access” does not include remote support sessions for devices that might contain the Confidential Information; however, during the remote support session the Department requires Recipient to escort the remote support access and maintain visibility of the actions taken during the remote support access. Requests for remote access will be submitted to the Department’s Contract Manager. With approval, third parties may be granted time-limited terminal service access to information technology resources as necessary for fulfillment of related responsibilities. Remote connections are subject to detailed monitoring via two-way log reviews and the use of other tools; and

(i) Performing all actions necessary to assist with all tasks in furtherance of the Department’s efforts to comply with the obligations under Chapters 60FF and 60GG, Florida Administrative Code, as applicable.

5. Liability. By signing this Agreement, Recipient acknowledges Recipient shall be responsible and liable for the acts and omissions of any of Recipient’s employees and/or the Affiliate(s) that result in a violation of this Agreement as if such acts or omissions were Recipient’s acts or omissions. Recipient represents that it will enter into a written agreement with an Affiliate with Access to Confidential Information wherein it shall require the Affiliate agree to be bound by and adhere to the terms of this Agreement.

6. Notice of Breach. Recipient must notify the Department as expeditiously as practicable, but in all instances no later than within one (1) business day, in the event Recipient discovers any incident that involves, or which Recipient reasonably believes may involve, a breach of the Confidential Information which includes any unauthorized Access to or disclosure of the Confidential Information and/or which compromises the security, integrity, or confidentiality of the Confidential Information. Additionally, if the Department shares with Recipient information that is covered by section 501.171, F.S., Recipient is responsible for fulfilling all applicable requirements of section 501.171, F.S., including those that would otherwise be the responsibility of the Department. Recipient agrees to provide the Department with all details associated with all breaches or suspected breaches and to work with the Department to investigate and resolve any breach, implement any necessary remedial measures, and perform all tasks to ensure full compliance with section 501.171, F.S., including, where applicable, providing any breach notif ications to comply with this statutory requirement.

7. Indemnification. Recipient shall defend, indemnify, and hold harmless the Department and the State against all losses, damages, liabilities, deficiencies, actions, judgments, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys’ fees, in connection with any third-party claim, suit, action, or proceeding arising out of or resulting from a violation of any obligation set forth in this Agreement by Recipient (including its employees) or its Affiliates. The Agreement does not constitute a waiver of sovereign immunity or consent by the Department or the State or its subdivisions to suit by third parties. The obligations of this paragraph shall survive the Agreement.

8. Contractual Remedies. Recipient acknowledges that a breach of this Agreement, including disclosure of any of the Confidential Information, will cause irreparable injury to the Department and will entitle the Department to liquidated damages commensurate with

SUSORP/SMSOAP Page 4 of 7 the Department’s internal staffing and administrative costs associated with addressing the breach. This will not preclude the Department from recovering other damages it may suffer as a result of such a violation or seeking other legal remedies that may be available during or after the Agreement term, including obtaining injunctive relief against the breach or threatened breach of these Agreement terms.

9. Recipient Trade Secret Information. If Recipient considers any portion of the

Agreement-Related Materials to be trade secret under sections 688.002 or 812.081, F.S., or otherwise confidential under federal or State law, Recipient must clearly designate that portion of the Agreement-Related Materials as confidential at the time it provides such to the Department and shall provide the Department with a redacted copy.

If the Department is served with a request for discovery of Agreement-Related Materials designated by Recipient as confidential, Recipient will be responsible for filing the appropriate motion or objection in response to the request for discovery. If the Department receives a public record request for Agreement-Related Materials designated by Recipient as confidential, the Department will provide the requestor with the redacted copy and, in the event the requestor asserts a right to the redacted portions, Recipient will be responsible for taking the appropriate legal action in response.

Recipient agrees to protect, defend, indemnify, and hold harmless the Department for all claims, costs, fines, and attorney’s fees arising from or relating to Recipient’s designation of Agreement-Related Materials as confidential.

10. Public Records. Pursuant to section 119.0701(2)(b), F.S., for contracts for services with a contractor acting on behalf of a public agency as defined in section 119.011(2), F.S., the contractor shall:

(a) Keep and maintain public records required by the Department to perform the service.

(b) Upon request from the Department’s custodian of public records, provide the

Department with a copy of the requested records or allow the records to be inspected or copied within a reasonable time at a cost that does not exceed the cost provided in Chapter 119, F.S., or as otherwise provided by law.

(c) Ensure that public records that are exempt or confidential and exempt from public records disclosure are not disclosed except as authorized by law for the duration of the agreement term and following the completion of the agreement if the contractor does not transfer the records to the Department.

(d) Upon completion of the agreement, transfer, at no cost, to the Department all public records in possession of the contractor or keep and maintain public records required by the Department to perform the service. If the contractor transfers all public records to the Department upon completion of the agreement, the contractor shall destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. If the contractor keeps and maintains public records upon completion of the agreement, the contractor shall meet all applicable requirements for retaining public records. All records stored electronically must be provided to the Department, upon request from the Department’s custodian of public records, in a format that is compatible with the information technology systems of the Department.

IF RECIPIENT HAS QUESTIONS REGARDING THE

APPLICATION OF CHAPTER 119, FLORIDA STATUTES, TO

RECIPIENT’S DUTY TO PROVIDE PUBLIC RECORDS

SUSORP/SMSOAP Page 5 of 7

RELATING TO THIS AGREEMENT, CONTACT THE

DEPARTMENT’S CUSTODIAN OF PUBLIC RECORDS AT

PHONE NUMBER 850-487-1082, EMAIL

PublicRecords@dms.fl.gov, or MAILING ADDRESS AT 4050

ESPLANADE WAY, SUITE 160

TALLAHASSEE, FL 32399.

11. Data Destruction. Prior to the termination of this Agreement, Recipient shall assist the

Department in exporting and extracting or destroying, at the Department’s direction, all information obtained from the Department by Recipient or created for the Department by Recipient pursuant to this Agreement at no cost, in a format acceptable to the Department without the need to purchase additional services and/or commodities. Additionally, when the Agreement is terminated, Recipient shall transfer to the Department all such information in all its forms from the Department and shall destroy duplicate records in accordance with section 501.171(8), F.S., and, if applicable, section 119.0701, F.S. This obligation to transfer and destroy information survives the term of this Agreement.

Recipient shall adhere to established information destruction standards, such as those established by the National Institute of Standards and Technology Special Publication 800-88, “Guidelines for Media Sanitization” (2014) , in destroying duplicate information provided by the Department. See http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf. Recipient shall provide the Department with written confirmation of destruction of Confidential Information in accordance with these standards. If Recipient is permitted by the Department to keep Confidential Information upon termination of this Agreement, Recipient shall continue to protect and maintain the confidentiality of the Confidential Information in accordance with applicable State and federal laws, rules, and regulations and such obligations set forth herein shall survive this Agreement.

12. Severability and Waiver. If a court of competent jurisdiction deems any term or condition of this Agreement void or unenforceable, the other provisions are severable to that void provision, and will remain in full force and effect. However, to the fullest extent permitted by law, this Contract shall be construed as if the scope or duration of such provision had been more narrowly drafted so as not to be invalid or unenforceable.

The delay or failure by the Department to exercise or enforce any of its rights under this Agreement shall not constitute a waiver of such rights.

13. Background Screening. In addition to any background screening required by Recipient as a condition of employment, Recipient warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for, each of its employees, subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other person, hereinafter referred to as “Person” or “Persons,” operating under its direction with Access to Confidential Information or who enter the premises or facilities where Confidential Information is stored or Accessible. Recipient is not required to conduct the aforementioned background screening of a Person if that Person does not have Access to Confidential Information and if that Person, whenever at a premise or facility with Confidential Information, is escorted by authorized personnel.

Recipient warrants that all Persons will have passed the background screening described herein before they have Access to Confidential Information or begin performing services under the Agreement. The look-back period for such background screenings shall be for mailto:PublicRecords@dms.fl.gov http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

SUSORP/SMSOAP Page 6 of 7 a minimum of six (6) years where six (6) years of historical information is available. The minimum background check process will include a check of the following information databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners or a comparable standard:

(a) Social Security Number Trace; and

(b) Criminal Records (Federal, State, and County criminal felony and misdemeanor, national criminal information database for all states which make such information available).

Recipient is responsible for any and all costs and expenses in obtaining and maintaining the criminal background screening information for each Person described above.

Recipient will maintain documentation of the screening in the Person’s file. Recipient will abide by all applicable laws, rules, and regulations including, but not limited to, the Fair Credit Reporting Act and/ any equal opportunity laws, rules, regulations, or ordinances.

If at any time it is determined that a Person has a criminal misdemeanor or felony record, regardless of adjudication (e.g., adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict), within the last six (6) years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, Recipient is required to immediately remove that Person from any position with Access to Confidential Information or directly performing services under the Agreement. The disqualifying offenses are as follows:

(a) Computer related crimes

(b) Information technology crimes;

(c) Fraudulent practices;

(d) False pretenses;

(e) Fraud;

(f) Credit card crimes;

(g) Forgery;

(h) Counterfeiting;

(i) Violations involving checks or drafts;

(j) Misuse of medical or personnel records; and

(k) Felony theft.

If Recipient finds a disqualifying offense for a Person within the last six (6) years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing services under the Agreement or have Access to Confidential Information. Recipient will consider the following factors only in making the determination: i) nature and gravity of the offense, ii) the amount of time that lapsed since the offense, iii) the rehabilitation efforts of the Person, and iv) relevancy of the offense to the job duties of the Person. If Recipient determines that the Person should be allowed Access to Confidential Information, then Recipient shall maintain all criminal background screening information and the rationale for such Access in the Person’s file. Recipient will promptly notify the Department of any determinations made pursuant to this paragraph. The Department reserves the right to require removal of any Persons from performing work on the Agreement for any reason.

Recipient will ensure that all background screening will be refreshed every five (5) years from the time initially performed for each Person during the term of the Agreement.

Recipient shall ensure that all Persons have a responsibility to self -report within three (3) calendar days to Recipient any updated court disposition regarding any disqualifying

SUSORP/SMSOAP Page 7 of 7 offense, regardless of adjudication (e.g., adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict). Recipient shall immediately reassess whether to disallow that Person Access to Confidential Information or from directly performing services under the Agreement. Additionally, Recipient shall require that the Person complete an annual certif ication that they have not received any additional criminal misdemeanor or felony record regardless of adjudication (adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict) for the Disqualifying Offenses and shall maintain that certif ication in the Person’s f ile.

In addition, Recipient shall ensure that all Persons have a responsibility to self -report to Recipient within three (3) calendar days, any arrest for any Disqualifying Offense.

Recipient shall notify the Department within twenty-four (24) hours of all details concerning any reported arrest.

14. Governing Law and Venue. The laws of the State of Florida govern the Agreement. The

Parties submit to the jurisdiction of the courts of the State exclusively for any legal action related to the Agreement which arises during or after the Agreement term. Further, Recipient hereby waives all privileges and rights relating to venue it may have under Chapter 47, F.S., and all such venue privileges and rights it may have under any other statute, rule, or case law, including, but not limited to, those based on convenience.

Recipient hereby submits to venue in the county chosen by the Department.

15. Entire Agreement. This Agreement contains the entire understanding of the Parties regarding the matters set forth herein and shall supersede any prior negotiations or agreements, whether written or oral, with respect thereto.

IN WITNESS WHEREOF, the Parties agree to the terms and conditions of this Agreement and have duly authorized their respective representatives to sign it on the dates indicated below.

FLORIDA DEPARTMENT <CONTRACTOR NAME>

OF MANAGEMENT SERVICES

By: ________________________________ By: ____________________________

Name: _____________________________ Name: _________________________

Title: _______________________________ Title: __________________________

Date: ______________________________ Date: __________________________