CDM Smith Clarification .pdf

January 13, 2023

CDM Smith, Inc Attention: Raman Gopalan, PE,Project Manager 11811 North Tatum Boulevard, Suite 3030 Phoenix, AZ 85028 Sent by email: gopalanr@cdsmith.com

Re: Request for Clarification-Solicitation No. BPM004287- Statewide Asbestos, Lead, and Mold Consultant and Abatement Services, and Lead Service Line Consultant Services.

Dear Mr. Gopolan, Thank you for participating in the above referenced Request for Proposal (RFP). Pursuant to A.R.S. 41- 2534, A.A.C. R2-7-C313, Clarification of Offers, the following is being submitted to your Firm as a respondent to the statewide asbestos, lead, and mold consulting and abatement services, and Lead Service Line Consulting solicitation. A request for clarification is to provide a greater understanding of the offer. Clarifications are not negotiations and/or material changes to the request for proposal.

A request for clarification shall not be considered a determination that the offer is susceptible for award. The following questions are presented for your consideration and clarification. The questions in Category A require a written response to ADEQ no later than Tuesday, January 17, at 5:00PM Arizona time. Category B is more informational, and no written response is required unless exceptions are taken to the additional Special Terms and Conditions.

Category A

1. Pricing Sheet

a. Subconsultant- Trinnex setup fee per instance (agency/utility). Please clarify the use of

(agency/utility) in this context. Hypothetically, how many agencies/ utilities

b. Please clarify the meaning of “reproduction” in this context.

2. Deliverables

a. The proposal states that an export of the database will be provided in the format requested. Is there going to be a separate cost for exporting data? If yes, what would that be?

Category B- Special Terms and Conditions

Due to the nature of CDM Smith’s proposed solution for a Lead Service Line Consultant services, the following Special Terms and Conditions will be incorporated into the solicitation and become part of any resultant contract, and are hereby presented for your review.

The Arizona Baseline Security Controls sheet, together with any exceptions taken to the Special terms and conditions shall be submitted to the procurement officer, utilizing the attached Attachment 4 Supplements no later than January 19, 2023 at 12:00PM, Arizona local time, clearly identifying the specific paragraphs of the terms and conditions where the exceptions occur. Any exceptions not included in such a section shall be without force and effect in any resulting Contract unless such exception is specifically accepted by the Procurement Officer in a written statement. CDM Smith’s preprinted or standard terms will not be considered by the State as a part of any resulting Contract

The following terms and conditions will be incorporated into and become part of any contract enter into upon and if awarded.

1. Data and Information Handling

1.1. Applicability. Article 1 applies to the extent the Work includes handling of any (1) State’s proprietary and sensitive data or (2) confidential or access-restricted information obtained from State or from others at State’s behest.

1.2. Data Protection and Confidentiality of Information. Contractor warrants that it will establish and maintain procedures and controls acceptable to State for ensuring that State’s proprietary and sensitive data is protected from unauthorized access and information obtained from State or others in performance of its contractual duties is not mishandled, misused, or inappropriately released or disclosed. For purposes of this paragraph, all data created by Contractor in any way related to the Contract, provided to Contractor by State, or prepared by others for State are proprietary to State, and all information by those same avenues is State’s confidential information. To comply with the foregoing warrant:

1.2.1. Contractor shall: (a) notify State immediately of any unauthorized access or inappropriate disclosures, whether stemming from an external security breach, internal breach, system failure, or procedural lapse; (b) cooperate with State to identify the source or cause and respond to each unauthorized access or inappropriate disclosure; and (c) notify State promptly of any security threat that could result in unauthorized access or inappropriate disclosures; and https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_2017_v2_0_0.xls

1.2.2. Contractor shall not: (a) release any such data or allow it to be released or divulge any such information to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b) respond to any requests it receives from a third party for such data or information, and instead route all such requests to State’s designated representative.

1.3. Personally Identifiable Information. Without limiting the generality of paragraph 1.2, Contractor warrants that it will protect any personally identifiable information (“PII”) belonging to State’s employees or other contractors or members of the general public that it receives from State or otherwise acquires in its performance under the Contract. For purposes of this paragraph:

1.3.1. PII has the meaning given in the [federal] Office of Management and Budget (OMB) Memorandum M-17-12 Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017; and

1.3.2. “protect” means taking measures to safeguard personally identifiable information and prevent its breach that are functionally equivalent to those called for in that OMB memorandum and elaborated on in the [federal] General Services Administration (GSA) Directive CIO P 2180.1 GSA Rules of Behavior for Handling Personally Identifiable Information.

NOTE (1): For convenience of reference only, the OMB memorandum is available at:

https://dpcld.defense.gov/Privacy/Authorities-and-Guidance/

NOTE (2): For convenience of reference only, the GSA directive is available at:

https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-

2. Information Technology Work

2.1. Applicability. Article 2 applies to any Invitation for Bids, Request for Proposals, or Request for Quotations for "Information Technology," as defined In A.R.S. §18-101(6) “…all computerized and auxiliary automated information processing, telecommunications and related technology, including hardware, software, vendor support and related services, equipment and projects,” if and to the extent that the Work is or includes Information Technology.

https://dpcld.defense.gov/Privacy/Authorities-and-Guidance/ https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-

2.2. Background Checks. Each Contractor's personnel who is an applicant for an information technology position must undergo the security clearance and background check procedure, which includes fingerprinting, as required by A.R.S. § 41-710, Eligible Agency, or Co-Op Buyer.

Contractor shall obtain and pay for the security clearance and background check. Contractor personnel who will have administrator privileges on a State network must additionally provide identity and address verification and undergo State-specified training for unescorted access, confidentiality, privacy, and data security

2.3. Information Access

2.3.1. System Measures. Contractor shall employ appropriate system management and maintenance, fraud prevention and detection, and encryption application and tools to any systems or networks containing or transmitting State’s proprietary data or confidential information.

2.3.2. Individual Measures. Contractor personnel shall comply with applicable State policies and procedures regarding data access, privacy, and security, including prohibitions on remote access and obtaining and maintaining access identifications (IDs) and passwords. Contractor is responsible to State for ensuring that any State access IDs and passwords are used only by the person to whom they were issued. Contractor shall ensure that personnel are only provided the minimum only such level of access necessary to perform his or duties. Contractor shall, on request, provide a current register of the access IDs and passwords and corresponding access levels currently assigned to its personnel.

2.3.3. Access Control. Contractor is responsible to State for ensuring that hardware, software, data, information, and that has been provided by State or belongs to or is in the custody of State and is accessed or accessible by Contractor personnel is only used in connection with carrying out the Work and is never commercially exploited in any manner whatsoever not expressly permitted under the Contract. State may restrict access of Contractor personnel, or instruct Contractor to restrict their access, if in its determination the requirements of this subparagraph are not being met.

2.4. Pass-Through Indemnity

2.4.1. Indemnity from Third Party. For computer hardware or software included in the Work as discrete units that were manufactured or developed solely by a third party, Contractor may satisfy its indemnification obligations under the Contract by, to the extent permissible by law, passing through to State such indemnity as it receives from the third-party source (each a “Pass-Through Indemnity”) and cooperating with State in enforcing that indemnity. If the third party fails to honor its Pass-Through Indemnity, or if a Pass-Through Indemnity is insufficient to indemnify State Indemnitees to the extent and degree, Contractor is required to do by the Uniform Terms and Conditions, then Contractor shall indemnify, defend and hold harmless State Indemnitees to the extent the Pass-Through Indemnity does not.

2.4.2. Notification of Claims. State shall notify Contractor promptly of any claim to which a Pass-Through Indemnity might apply. Contractor, with reasonable consultation from State, shall control of the defense of any action on any claim to which a Pass-Through Indemnity applies, including negotiations for settlement or compromise, provided that:

2.4.2.1. State reserves the right to elect to participate in the action at its own expense;

2.4.2.2. State reserves the right to approve or reject any settlement or compromise on reasonable grounds and if done so timely; and

2.4.2.3. State shall in any case cooperate in the defense and any related settlement negotiations.

2.5. Systems and Controls. In consideration for State having agreed to permit Pass-Through Indemnities in lieu of direct indemnity, Contractor agrees to establish and keep in place systems and controls appropriate to ensure that State funds under this Contract are not knowingly used for the acquisition, operation, or maintenance of Materials or Services in violation of intellectual property laws or a third party’s intellectual property rights.

2.6. Redress of Infringement

2.6.1. Replace, License, or Modify. If Contractor becomes aware that any Materials or Services infringe, or are likely to be infringing, on any third party’s intellectual property rights, then Contractor shall, at its sole cost and expense and in consultation with State, either:

2.6.1.1. replace any infringing items with non-infringing ones;

2.6.1.2. obtain for State the right to continue using the infringing items; or

2.6.1.3. modify the infringing items so that they become non-infringing, so long as they continue to function as specified following the modification.

2.6.2. Cancellation Option. In every case under 2.6.1, if none of those options can reasonably be accomplished, or if the continued use of the infringing items is impracticable, State may cancel the relevant Order or terminate the Contract, and Contractor shall take back the infringing items. If State does cancel the Order or terminate the Contract, Contractor shall refund to State:

2.6.2.1. for any software created for State under the Contract, the amount State paid to Contractor for creating it;

2.6.2.2. for all other Materials, the net book value of the product provided according to generally accepted accounting principles; and

2.6.2.3. for Services, the amount paid by State or an amount equal to twelve (12) months of charges, whichever is less.

2.6.3. Exceptions. Contractor will not be liable for any claim of infringement based solely on any of the following by a State Indemnitee:

2.6.3.1. modification or use of Materials other than as contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor;

2.6.3.2. operation of Materials with any operating software other than that supplied by Contractor or authorized or proposed by a Contractor Indemnitor; or

2.6.3.3. combination or use with other products in a manner not contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor.

2.7. First Party Liability Limitation

2.7.1. Limit. Subject to the provisos that follow below and unless stated otherwise in the Special Terms and Conditions, State’s and Contractor’s respective first party liability arising from or related to the Contract is limited to the greater of $1,000,000 (one million dollars) or three (3) times the purchase price of the specific Materials or Services giving rise to the claim.

2.7.2. Provisos. This paragraph limits liability for first party direct, indirect, incidental, special, punitive, and consequential damages relating to the Work regardless of the legal theory under which the liability is asserted. This paragraph does not limit liability arising from any:

2.7.2.1. Indemnified Claim against which Contractor has indemnified State Indemnitees under paragraph 6.2;

2.7.2.2. claim against which Contractor has indemnified State Indemnitees under paragraph 6.3; or

2.7.2.3. provision of the Contract calling for liquidated damages or specifying amounts or percentages as being at-risk or subject to deduction for performance deficiencies.

2.7.3. Purchase Price Determination. If the Contract is for a single-agency and a single Order (or if no Order applies), then “purchase price” in Subparagraph 2.7.1 above means the aggregate Contract price current at the time of Contract expiration or earlier termination, including all Contract Amendments having an effect on the aggregate price through that date. In all other cases, “purchase price” above means the total price of the Order for the specific equipment, software, or services giving rise to the claim, and therefore a separate limit will apply to each Order.

2.7.4. No Effect on Insurance. This paragraph does not modify the required coverage limits, terms, and conditions of, or any insured’s ability to claim against any insurance that Contractor is required by the Contract to provide, and Contractor shall obtain express endorsements that it does not.

2.8. Information Technology Warranty

2.8.1. Specified Design. Where the Scope of Work for information technology, Work provides a detailed design specification or sets out specific performance requirements, Contractor warrants that the Work will provide all functionality material to the intended use stated in the Contract, provided that, the foregoing warranty does not extend to any portions of the Materials that are:

2.8.1.1. modified or altered by anyone not authorized by Contractor to do so;

2.8.1.2. maintained in a way inconsistent to any applicable manufacturer recommendations; or

2.8.1.3. operated in a manner not within its intended use or environment.

2.8.2. COTS Software. With respect to Materials provided under the Contract that are commercial-off-the-shelf (COTS) software, Contractor warrants that:

2.8.2.1. to the extent possible, it will test the software before delivery using commercially available virus detection software conforming to current industry standards;

2.8.2.2. the COTS software will, to the best of its knowledge, at the time of delivery be free of viruses, backdoors, worms, spyware, malware, and other malicious code that could hamper performance, collect unlawfully any personally identifiable information, or prevent products from performing as required by the Contract; and

2.8.2.3. it will provide a new or clean install of any COTS software that State has reason to believe contains harmful code.

2.8.3. Payment has no Effect. The warranties in this paragraph are not affected by State’s inspection, testing, or payment.

2.9. Specific Remedies. Unless expressly stated otherwise elsewhere in the Contract, State’s remedy for breach of warranty under paragraph 2.8 includes, at State’s discretion, re-performance, repair, replacement, or refund of any amounts paid by State for the nonconforming Work, plus (in every case) Contractor’s payment of State’s additional, documented, and reasonable costs to procure materials or services equivalent in function, capability, and performance that was first called for. For clarification of intent, the foregoing obligations are limited by the limitation of liability in paragraph 2.7. If none of the foregoing options can reasonably be effected, or if the use of the materials by State is made impractical by the nonconformance, then State may seek any remedy available to it under law.

2.10. Section 508 Compliance. Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this Contract shall comply with A.R.S. §18-131 and §18-132 and Section 508 of the Rehabilitation Act of 1973, which requires that employees and members of the public shall have access to and use of information technology that is comparable to the access and use by employees and members of the public who are not individuals with disabilities.

2.11. Cloud Applications. The following are required for Contractor of any cloud solution that hosts State data outside of the State’s network or transmits and/or receives State data.

2.11.1. Submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet as found at: https://azdohs.gov/information-technology-it-policies-standards-and-procedure, and mitigate or install compensating controls for any issues of concern identified by State. Contractor is required to provide any requested documentation supporting the review of the assessment. The assessment shall be re-validated on a minimum annual basis.

2.11.2. State reserves the right to conduct penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

2.11.3. Contractor must submit a copy of system logs from the cloud system to the State of Arizona security team on a regular basis to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3. Contractor must employ a government-rated cloud compartment to better protect sensitive or regulated State data.

4. Insurance Requirements

Indemnification Clause To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as "Indemnitee") from and against any and all claims, actions, liabilities, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of Contractor's directors, officers, agents, employees, volunteers or subcontractors. This indemnity includes any claim or amount arising or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to conform to any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all Claims. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable.

This indemnification will survive the termination of the above listed contract with the Contractor.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

https://aset.az.gov/resources/policies-standards-and-procedures https://azdohs.gov/information-technology-it-policies-standards-and-procedure https://azdohs.gov/information-technology-it-policies-standards-and-procedure

Technology Errors & Omissions Insurance

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. Such insurance shall cover any, and all errors, omissions, or negligent acts in the delivery of products, services, and/or licensed programs under this contract.

b. Coverage shall include copyright infringement, infringement of trade dress, domain name, title or slogan.

c. In the event that the Tech E&O insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained or an extended discovery period will be exercised for a period of two (2) years, beginning at the time work under this Contract is completed.

Network Security (Cyber) and Privacy Liability

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. Such insurance shall include, but not be limited to, coverage for third party claims and losses with respect to network risks (such as data breaches, unauthorized access or use, ID theft, theft of data) and invasion of privacy regardless of the type of media involved in the loss of private information, crisis management and identity theft response costs. This should also include breach notification costs, credit remediation and credit monitoring, defense and claims expenses, regulatory defense costs plus fines and penalties, cyber extortion, computer program and electronic data restoration expenses coverage (data asset protection), network business interruption, computer fraud coverage, and funds transfer loss.

b. In the event that the Network Security and Privacy Liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained, or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

c. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to vicarious liability of the insured arising out of the activities performed by or on behalf of the Contractor.

d. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

Addendum B to the Special Terms and Conditions

Warranties and Requirements Related to

Arizona Information Technology Statewide Policies, Standards, and Procedures

1. Security Standards

1.1. Security of the State’s systems and data are of utmost importance to the State. In order to assure security from a personnel and operations perspective, Contractor shall comply with all requirements, in their entirety, as described in the statewide enterprise architecture; statewide Information Technology security policies, standards, and procedures; and any applicable agency-specific Information Technology security policies, standards, and procedures.

1.2. Contractor shall follow the correct, current version of these policies, standards, and procedures.

The current website for some of these policies, standards, and procedures is: Information Technology Policies, Standards and Procedures. Note that this link is provided for convenience only.

1.3. For security reasons, some state facilities require non-state personnel to have escorts. If required by the state facility, Contractor personnel shall only be allowed inside of a State facility if accompanied by an escort designated by the State. This is applicable in Correctional facilities, Public Safety facilities, State Lottery, and other facilities as designated by the State.

2. Security Framework

2.1. The State of Arizona information security policies and standards follow the National Institute of

Standards and Technology (NIST) Cyber Security Framework (CSF) and NIST SP 800-53 Rev. 5 Security and Privacy Guidelines may currently be located at:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.

2.2. The State has established a process to assess risk associated with storing, processing and/or transmitting State of Arizona data with external, non-State of Arizona, entities. The Arizona Risk and Authorization Management Program (AZRamp) was developed to ensure State and contractors meet these requirements. All contractors responding to State solicitations must successfully complete the AZRamp risk assessment based upon the data classification involved as determined by the data owner and Arizona Strategic Enterprise Technology (ASET) Department. Failure to successfully complete AZRamp assessment will be deemed as breach of contract.

https://azdohs.gov/information-technology-it-policies-standards-and-procedures https://azdohs.gov/information-technology-it-policies-standards-and-procedures https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

2.3. In the State’s sole discretion, the State may also accept current FedRamp and StateRamp certifications as evidence that the Contractor has met the State's risk assessment requirements.

2.4. Other forms of Cybersecurity Frameworks (CSF), Trust Documents, Self-Attestations, including, but not limited to, ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance, may be reviewed as part of the State’s risk assessment, but are not exclusive or conclusive evidence that the Contractor has met the State’s risk assessment requirements.

3. Additional Security Requirements

3.1. Contractor shall comply with all security requirements requested by the State.

3.2. If an Arizona Risk and Authorization Management Program (AZRamp) is required, it will generally follow these steps, each of which shall be completed by the Contractor upon request by the State:

3.2.1. Contractor shall submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet with its clarification. The Arizona Baseline Infrastructure Security Controls assessment spreadsheet as found at:

https://azdohs.gov/file/4357, and mitigate gaps or install compensating controls for any issues of concern identified by State.

3.2.2. Contractor shall provide Information Security documentation for the AZRamp assessment to include System Security Plan (SSP), Written Information Security Programs (WISP), or supporting written IT policies for review of the assessment.

3.2.3. Note regarding the confidential treatment of Contractor information:

3.2.3.1. The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDA) for release to review submitted SSP’s, WISP ’s, or written IT policies will not be considered.

3.2.3.2. Submitted SSP’s, WISP’s, or written IT policies are deleted and not retained after AZRamp Authorization is granted.

3.2.3.3. Procedures for submission of documents considered confidential or proprietary are identified within this RFP.

3.2.3.4. Special secure transfer of documents related to this AZRamp review process may be made by contacting: AsetAssurance@azdoa.gov to make special arrangements for the transfer of these documents.

3.2.4. If applicable to this Solicitation, Contractor shall complete and submit with the Offer an unedited and signed State of Arizona Health Insurance Portability and Accountability Act (HIPAA) Business Associate Addendum (BAA).

3.2.5. All contract awards are contingent on the successful completion of the AZRamp 125 Low Impact (public information) or the AZRamp 325 Moderate (Confidential, PII, or https://azdohs.gov/file/4357

PHI) Impact Control spreadsheet titled “Arizona Infrastructure Security Controls 2017 (Excel),” to be determined by the

3.3. The State reserves the right to conduct risk assessments, vulnerability assessments, black-box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s).

3.4. Upon request, Contractor shall submit copies of system logs from Contractor’s environment to the State of AZ security team in the format requested to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3.5. Contractor shall comply with all applicable State and Federal laws and regulations, including, but not limited to, the following (please note that the links are provided for convenience only and may change):

3.5.1. State of Arizona statewide policies, standards and procedures:

https://azdohs.gov/information-technology-it-policies-standards-and-procedures;

3.5.2. Federal Information Security Modernization Act of 2014 (FISMA):

https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma;

3.5.3. OMB Circular A-130:

https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource;

3.5.4. National Cyber Strategy of the United States of America:

https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure;

3.5.5. A.R.S. Title 41, Chapter 41. Arizona Department of Homeland Security;

3.5.6. A.R.S. §18-104 - Arizona Department of Administration, Arizona Strategic Enterprise

Technology (ADOA-ASET), Powers and duties of the agency:

https://www.azleg.gov/arsDetail/?title=18;

3.5.7. A.R.S. §18-105 - Statewide Information Security and Privacy Office (SISPO):

https://www.azleg.gov/viewdocument/?docName=http%3A//www.azleg.gov/ars/1 8/00105.htm;

3.5.8. A.R.S. §18-551 - Definitions Information Security Including PII:

https://www.azleg.gov/ars/18/00551.htm;

https://azdohs.gov/information-technology-it-policies-standards-and-procedures https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.azleg.gov/arsDetail/?title=18 https://www.azleg.gov/viewdocument/?docName=http%3A//www.azleg.gov/ars/18/00105.htm https://www.azleg.gov/viewdocument/?docName=http%3A//www.azleg.gov/ars/18/00105.htm https://www.azleg.gov/ars/18/00551.htm

3.5.9. A.R.S. §18-552 - Notification of security system breaches; requirements;

enforcement; civil penalty; preemption; exceptions:

https://www.azleg.gov/ars/18/00552.htm;

3.5.10. Arizona Executive Order 2008-10 – Mitigating Cyber Security Threats:

https://aset.az.gov/node/192;

3.5.11. SIPC Memorandum of Understanding (MOU): https://www.sipc.org/about-sipc/;

3.5.12. State Environmental policies: https://azdeq.gov/LawsAndRules;

3.5.13. Incident Response Reporting program and system:

https://aset.az.gov/sites/default/files/P8240%20Incident%20Response%20Planning _Sept2018_0.pdf;

3.5.14. Privacy Incident Reporting policy and standards:

https://aset.az.gov/sites/default/files/STANDARD%208240%20INCIDENT%20RESPO NSE%20PLANNING.pdf;

3.5.15. State of Arizona Library, Archives and Public Records, Records Management Division, General Retention Schedules https://azlibrary.gov/arm/policies.

If you have any questions or concerns, please do not hesitate to contact me at forbin.merrilyn@azdeq.gov or 602-771-4779. Thank you for your time and consideration on this matter.

Sincerely, Merrilyn Forbin Senior Procurement Specialist https://www.azleg.gov/ars/18/00552.htm https://aset.az.gov/node/192 https://www.sipc.org/about-sipc/ https://azdeq.gov/LawsAndRules https://aset.az.gov/sites/default/files/P8240%20Incident%20Response%20Planning_Sept2018_0.pdf https://aset.az.gov/sites/default/files/P8240%20Incident%20Response%20Planning_Sept2018_0.pdf https://aset.az.gov/sites/default/files/STANDARD%208240%20INCIDENT%20RESPONSE%20PLANNING.pdf https://aset.az.gov/sites/default/files/STANDARD%208240%20INCIDENT%20RESPONSE%20PLANNING.pdf https://azlibrary.gov/arm/policies

Addendum B to the Special Terms and Conditions