CTR062780_Amendment2.pdf

Contract Amendment

DCS IT Maintenance and Operation Services

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Contract #: CTR062780

Amendment #: 2

This amendment serves to revise the referenced contract by extending the contract term to October 31, 2028, in accordance with Section 3.3, Contract Extensions of the Special Terms and Conditions. Additionally, this amendment modifies the scope of work as outlined in Section 5.1, Contract Amendments.

1. The duration of the contract period is hereby extended to October 31, 2028.

2. Client is hereby changed in the scope of work as ‘AZ DCS’

3. Amending the Scope of Work with the following:

I. Adding to 2.1:

“AZ DCS may add additional services for any projects within the CCWIS through the execution of a Work Order.”

II. Adding to 4.3.2:

“…The Contractor shall provide the AZ DCS a report that will include overall program costs, including a breakdown of the cost of those services that the Contractor is managing (e.g. Program Management Services, Managed Cloud Services, Operational Support Services, Routine Application Support and Minor Enhancement Services, Major Enhancement and Solution Architecture Services, Business Analytics and Reporting Services) on behalf of AZ DCS as part of this service and the identification of opportunities for cost management and/or increased efficiency through configuration or other changes.”

III. Adding to 4.6.1:

“The Contractor shall provide a core support team at fixed monthly costs, with the ability to scale up or down resources quarterly based on the current in-production Guardian application software at a level sufficient to address the current or anticipated volume of routine defects and minor enhancements found in the current AZ DCS backlog. Adjustments to the team composition and efforts shall be discussed and approved during quarterly reviews, allowing the parties to right-size resources and costs to actual needs. DCS and IBM will collaborate on a rolling 30/60/90 day forecast to accommodate lead time to scale up or down the IBM staff.”

IV. Adding 4.6.16:

“Minor enhancements will be billed per deliverable and authorized through a Work Order, which will be valid for six months or issued on an as-needed basis. This model

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 may be reviewed quarterly to identify enhancements suitable for outcome-based pricing. DCS and IBM will collaborate on a rolling 30/60/90 day forecast to accommodate lead time to scale up or down the IBM staff.”

V. Revising 4.7.1:

“The Contractor shall provide a full software development team (including software engineers, analysts, solution architect, testers, product owner, etc.) with a capacity of 12,000 development hours per quarter with the ability to scale up or down quarterly based on project volume, criticality, and available budget. Team Capacity, aligned with the level of effort, shall be proposed and approved through submitted Work Orders specifying the allocation of development hours and resources. Authorization to perform work shall be granted exclusively through an executed and signed work order, which shall remain valid for a period of six (6) months or be issued on an as-needed basis. The work order may include up to twenty percent (20%) additional funds to accommodate scope changes that occur after the execution of the work order; the justification for this request shall be discussed and approved by AZ DCS. Work orders should be discussed during monthly planning meetings or as otherwise agreed upon in writing. The team should be dedicated to the development of larger, more complex enhancements and system architecture changes. In addition to the primary list of projects specified in the work order, a set of optional projects shall be included to be undertaken should the primary projects be delayed or stalled. IBM shall conduct regular reviews with AZ DCS to assess project requirements and any changes to scope. DCS and IBM will collaborate on a rolling 30/60/90 day forecast to accommodate lead time to scale up or down the IBM staff.”

VI. Inserting 4.7.2 and updating the following provisions to incorporate this addition:

“If fewer than the contracted hours are used in a given quarter, AZ DCS may apply unused hours to the following quarter. The quarterly carry-forward effort should not exceed 20%. No financial penalties or minimums shall apply to underutilization of the baseline quarterly capacity. It is the intention of AZ DCS to consume the entire 12,000 hours of the quarterly baseline capacity, acknowledging that it is a target driven by operational needs.”

VII. Revising 4.7.3:

“The Contractor shall provide a mechanism for AZ DCS to temporarily increase the size of the development team(s) up to 1.05M USD or equal to 10,000 hours per quarter on a temporary, as-needed basis to increase capacity when needed to

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 address high priority and/or urgent requests that cannot be handled by the development team in a timely manner.”

VIII. Revising 4.7.7:

“The Contractor shall work with AZ DCS to submit work order requests that are evaluated by the Contractor so that the Contractor can provide a firm fixed level of effort and cost proposal. Depending on the level of effort and the available capacity of the major enhancement development team, work orders may be determined to be ‘no cost’, meaning they are sequenced in the current capacity of the development team as a minor enhancement or ‘additional cost’, meaning the work will be done by additional resources outside of the fixed capacity of Guardian Application maintenance team. A sample form/template is provided at the end of this section for illustrative purposes.”

IX. Removing 4.9.3 and updating the subsequent provisions to reflect this removal.

X. Adding 11.2.5 of Pricing

“Where necessary, funds and payments may be reallocated between services based on related projects subject to the approval from the ADCS during governance meetings held between the parties.”

XI. Adding 11.12 to the Special Terms & Conditions:

“IBM’s DPA (reference # Z126-7870_05_ZZ_05-2025) and Data Processing Exhibit are hereby incorporated as Appendix A to the Agreement. The DPA and the DPA Exhibit apply to IBM's processing of personal data on behalf of the AZ

DCS.”

XII. Adding 11.13 to the Special Terms & Conditions “Information Security Roles and Responsibilities. This document is hereby incorporated as an Appendix C to the Agreement.”

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Appendix A : Data Processing Addendum

(a) This Data Processing Addendum (DPA) and its applicable DPA Exhibits apply to the Processing of Personal Data by IBM on behalf of AZ DCS (AZ DCS Personal Data) in order to provide services (Services) pursuant to the Agreement between AZ DCS and IBM. This DPA is incorporated into the Agreement and the DPA Exhibits for each Service will be provided in the applicable Transaction Document (TD). In the event of conflict, the DPA Exhibit prevails over the DPA which prevails over the rest of the Agreement.

(b) Capitalized terms used have the meanings given below.

(i) Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing Personal Data.

(ii) Data Subject means a natural person who can be identified, directly or indirectly.

(iii) Data Protection Laws means all legislation and regulations applicable to the Processing of Personal Data under the Agreement.

(iv) Non-Adequate Countries means countries not providing an adequate level of data protection pursuant to Data Protection Laws or a decision of a Supervisory Authority.

(v) Personal Data means any information relating to a Data Subject.

(vi) Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, AZ DCS Personal Data.

(vii) Process or Processing means any operation or set of operations performed on AZ DCS Personal Data, including storage, use, access and reading.

(viii) Processor means a natural or legal person which Processes AZ DCS Personal Data on behalf of AZ

DCS.

(ix) Subprocessor means any other Processor IBM engages to Process AZ DCS Personal Data.

(x) Supervisory Authority means an independent public authority responsible for monitoring the application of the applicable Data Protection Laws.

● Processing

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

● AZ DCS is: (a) a Controller of AZ DCS Personal Data; or (b) acting as Processor on behalf of other Controllers and has been instructed by and obtained the authorization of the relevant Controller(s) for the Processing of AZ DCS Personal Data by IBM as AZ DCS’s subprocessor as set out in this DPA. AZ DCS appoints IBM as Processor to Process AZ DCS Personal Data. If there are other Controllers, AZ DCS will identify and inform IBM of any such other Controllers if required by the applicable Data Protection Laws.

● A list of categories of Data Subjects, types of AZ DCS Personal Data and Processing activities is set out in the applicable DPA Exhibit for each Service.

The duration of the Processing corresponds to the duration of the Service. The purpose and subject matter of the Processing is the provision of the Service as described in the Agreement.

● IBM will Process AZ DCS Personal Data to provide, secure the Service according to AZ DCS’s documented instructions or as otherwise set out in the Agreement. The scope of AZ DCS’s instructions for the Processing of AZ DCS Personal Data is defined by the Agreement, and, if applicable, by AZ DCS’s use of the features of the Service.

When providing Services, IBM will not further combine, use, retain or disclose AZ DCS Personal Data outside of the direct business relationship between IBM and AZ DCS or for any purpose other than to perform the Services and business purposes specified in the Agreement. IBM will not sell or share AZ DCS Personal Data as required by the applicable Data Protection Laws.

● AZ DCS may provide further instructions regarding the Processing of AZ DCS Personal Data (Additional Instructions) as described in Section 10.2 and IBM will use commercially reasonable efforts to follow any Additional Instructions.

If IBM notifies AZ DCS that an Additional Instruction is not feasible or that IBM can no longer meet its obligations as Processor, the parties shall work together to find an alternative. If IBM notifies AZ DCS that no alternative is feasible, AZ DCS may terminate the affected Service, in accordance with any applicable terms of the Agreement. If IBM believes an instruction violates the applicable Data Protection Laws, IBM will immediately inform AZ DCS, and may suspend the performance of such instruction until AZ DCS has modified or confirmed its lawfulness in documented form.

● AZ DCS shall serve as a single point of contact for IBM. As other Controllers may have certain direct rights against IBM, AZ DCS undertakes to exercise all such rights on their behalf and to obtain all necessary permissions from the other Controllers. IBM shall be discharged of its obligation to inform or notify another Controller when IBM has provided such information or notice to AZ DCS.

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Similarly, IBM will serve as a single point of contact for AZ DCS with respect to its obligations as a Processor under this DPA.

● Each party will comply with its respective obligations under the applicable Data Protection Laws for the processing of AZ DCS Personal Data and is responsible for determining the requirements of laws or regulations applicable to its own business. AZ DCS will not use the Services in a manner that would violate applicable Data Protection Laws.

● Technical and Organizational Measures AZ DCS and IBM agree that IBM will implement and maintain the technical and organizational measures set forth in the applicable DPA Exhibit (TOMs) which ensure a level of security appropriate to the risk for IBM’s scope of responsibility. TOMs are subject to technical progress and further development. Accordingly, IBM reserves the right to modify the TOMs provided that the functionality and security of the Services are not degraded.

● Data Subject Rights and Requests IBM will inform AZ DCS of requests from Data Subjects exercising their Data Subject rights addressed directly to IBM, where the Data Subject has provided information to identify AZ DCS. If not, IBM will ask the Data Subject to redirect its request to AZ DCS. AZ DCS shall be responsible to handle such requests of Data Subjects. IBM will reasonably assist AZ DCS in handling such Data Subject requests in accordance with Section 10.2.

● Third Party Requests and Confidentiality

● IBM will not disclose AZ DCS Personal Data to any third party, unless authorized by the AZ DCS or required by law. If a government or Supervisory Authority demands access to AZ DCS Personal Data:

● IBM will notify AZ DCS of such request to enable AZ DCS to take all necessary actions to communicate directly with the relevant authority and respond to such request.

● If IBM is prohibited by law to notify AZ DCS of such request, it will make best reasonable efforts to challenge such prohibition and it commits to providing the minimum amount of information permissible when responding, based on a reasonable interpretation of the order.

● IBM will provide to AZ DCS general information relative to any such request received from a government or Supervisory Authority during the preceding 12-month period.

● IBM requires all of its personnel authorized to Process AZ DCS Personal Data to commit themselves to the requirements of this section.

● Audit

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Subject to the appropriate confidentiality and Section 10.2, IBM shall allow for, and contribute to, audits conducted by AZ DCS or another auditor mandated by AZ DCS, who shall be not a direct competitor of IBM, including inspections to the extent required by the applicable Data Protection Laws, in accordance with the following procedures:

● IBM will provide AZ DCS or its mandated auditor with the most recent certifications and/or summary audit report(s), which IBM has procured to regularly test, assess and evaluate the effectiveness of the TOMs.

● IBM will reasonably cooperate with AZ DCS by providing available additional information concerning the TOMs, to help AZ DCS better understand such TOMs.

● If further information is needed by AZ DCS to comply with its own or other Controllers audit obligations or a competent Supervisory Authority’s request, AZ DCS will inform IBM in writing to enable IBM to provide such information or to grant access to it.

● To the extent it is not possible to otherwise satisfy an audit right mandated by applicable law or expressly agreed by the Parties, only legally mandated entities (such as a governmental regulatory agency having oversight of AZ DCS's operations), AZ DCS or its mandated auditor may conduct an onsite visit of the IBM facilities used to provide the Service, during normal business hours and only in a manner that causes minimal disruption to IBM’s business, subject to coordinating the timing of such visit in order to reduce any risk to IBM’s other customers.

● Return or Deletion of AZ DCS Personal Data Upon termination or expiration of the Agreement IBM will either delete or return AZ DCS Personal Data in its possession as set out in the respective DPA Exhibit, unless otherwise required by applicable law.

● Subprocessors

● AZ DCS authorizes the engagement of the Subprocessors listed in the respective DPA Exhibit. IBM will notify AZ DCS in advance of any addition or replacement of the Subprocessors, as reported in the applicable DPA Exhibit or in the Agreement. Within 30 days after IBM’s notification, AZ DCS may object on the basis that such Subprocessor does not provide sufficient guarantees to meet the requirements under the applicable Data Protection Laws. AZ DCS’s objection shall be in writing and include AZ DCS’s specific reasons for its objection and options to mitigate, if any. If AZ DCS does not object within such period, the additional or replacement Subprocessor may be commissioned to Process AZ DCS Personal Data. IBM shall impose substantially similar but no less protective data protection obligations as set out in this DPA on any approved Subprocessor prior to the Subprocessor initiating any Processing of AZ DCS Personal Data.

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

● If AZ DCS reasonably objects to the addition of a Subprocessor and IBM cannot reasonably accommodate AZ DCS’s objection, IBM will notify AZ DCS. AZ DCS may terminate the affected Services, otherwise the parties shall cooperate to find a feasible solution in accordance with the dispute resolution process, as set out in the Agreement, if applicable.

● Transborder Data Processing and Country Required Terms

● In the case of a transfer of AZ DCS Personal Data to Non-Adequate Countries, the parties shall cooperate to ensure compliance with the applicable Data Protection Laws by relying on the Transborder Data Processing document available at https://www.ibm.com/support/customer/csol/terms/?id=Z126-8005 or this DPA, as applicable. If AZ DCS believes the measures are not sufficient to satisfy the legal requirements, AZ DCS shall notify IBM and the parties shall work together to find an alternative.

● Depending on the applicable Data Protection Laws, the parties can be subject to additional country required terms available at https://www.ibm.com/support/customer/csol/terms/?id=Z126-8005 (Country Required Terms).

● Personal Data Breach IBM will notify AZ DCS without undue delay after becoming aware of a Personal Data Breach with respect to the Services. IBM will promptly investigate the Personal Data Breach if it occurred on IBM infrastructure or in another area IBM is responsible for and will assist AZ DCS as set out in Section 10.

● Assistance

● IBM will assist AZ DCS by technical and organizational measures for the fulfillment of AZ DCS’s obligation to comply with the rights of Data Subjects and in compliance with AZ DCSs obligations relating to the security of Processing, the notification and communication of a Personal Data Breach and the data protection impact assessment, including prior consultation with the responsible Supervisory Authority, if required, taking into account the nature of the processing and the information available to IBM.

1.2 AZ DCS will make a written request for any assistance, or any Additional Instructions, referred to in this DPA. IBM may charge AZ DCS no more than a reasonable charge to perform such assistance or an Additional Instruction, such charges to be set forth in a quote and agreed in writing by the parties, or as set forth in an applicable change control provision of the Agreement. If AZ DCS does not agree to the quote, the parties agree to reasonably cooperate to find a feasible solution in accordance with the dispute resolution process.

https://www.ibm.com/support/customer/csol/terms/?id=Z126-8005

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Data Processing Addendum Exhibit This Data Processing Addendum Exhibit (DPA Exhibit) specifies the DPA for the identified Service.

11. Processing IBM will Process AZ DCS Personal Data for the Service, as described in the Agreement, including the DPA and this DPA Exhibit.

Duration of Processing Upon termination of the Service, IBM will NOT retain AZ DCS Personal Data as part of system backup.

Processing Activities The nature of Processing consists of the following IBM Processing activities based on AZ DCS’s instructions:

● Monitoring – Applications, infrastructure logging

● Operations – Provision, maintenance, or management of applications, Cloud infrastructure services

● Development – Design, development, build, or test

● Consulting – Advisory, analytics, or other consulting

● Debugging – identifying and repairing errors that impair intended functionality

AZ DCS Personal Data The lists in this Section 2, are information about the Categories of Data Subjects, the Types of AZ DCS Personal Data, and Special Categories of Personal Data that can be generally processed within the Service.

Categories of Data Subjects The following lists the Categories of Data Subjects whose Personal Data can be processed within the Service:

● AZ DCS's customers

Types of Personal Data and Special Categories of Personal Data

IBM will process the Types of AZ DCS Personal Data and Special Categories of Personal Data of the identified Categories of Data Subjects listed in accordance with the Agreement. AZ DCS will notify IBM of any required changes to the lists by project change request process. If changes to the lists in this Section 2.2 require changes of the agreed Processing, AZ DCS shall provide Additional Instructions to IBM as set out in the DPA.

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Types of Personal Data

The following lists the Types of AZ DCS Personal Data that can be processed within the Service:

● Capabilities and Qualifications of the Individual

● Education and Professional Certifications

● Profession and Employment Information

● Professional Affiliations

● Characteristics of the Individual

● Demographic

● Economic and Financial

● Nationality and Citizenship

● Opinion

● Personal Preference and Interest

● Habits and Activities of the Individual

● Behavior

● Consumed Resources

● Identity of the Individual

● Government Identities

● Identification Number

● Individual

● Online Access and Authentication Credentials

● Online Connection and Network Connectivity Data

● Online Identifier

● Person Name

● Technology Identifiers

● Telephony

● Location of the Individual

● Appointments, Schedules, Calendar Entries

● Environment of the Individual

● Physical Location of the Individual

Special Categories of Personal Data The following lists the Special Categories of Personal Data that can be processed within the Service:

● Personal Data revealing racial or ethnic origin

● Personal Data revealing political opinions

● Personal Data revealing religious or philosophical beliefs

● Personal Data revealing trade union membership

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

● Genetic or biometric data

● Data concerning health

● Data concerning a natural person’s sex life or sexual orientation

● Personal Data relating to criminal convictions and offences

Technical and Organizational Measures The technical and organizational measures (TOMs) applicable to the AZ DCS Personal Data reported under Section 2.2 are described in IBM’s Data Security and Privacy Principles (http://ibm.com/terms/?id=z126-7745) (DSP) which shall apply to the extent relevant to the scope of the Service.

Deletion and return of AZ DCS Personal Data IBM hereby certifies that all AZ DCS Personal Data are deleted at the end of the duration of Processing, unless Processing is solely on AZ DCS’s infrastructure and IBM does not hold any copy.

If instructed in writing prior to expiration or termination of the Service, IBM will return a copy of AZ DCS Personal Data that is accessible to IBM within a reasonable period and in a reasonable format.

Subprocessors IBM may use the following Subprocessor(s) in the Processing of AZ DCS Personal Data:

a. IBM companies:

IBM Company and Location

Processing Activities Types of Personal Data and Special Categories of Personal Data

Technical and Organizational Measures

None

b. Third Party Subprocessors:

Third Party Subprocessor and Location

Processing Activities Types of Personal Data and Special Categories of Personal Data

Technical and Organizational

Measures

Collabera Refer section 1.2 above Refer section 2.2 above Refer section 3 above

Infinite Refer section 1.2 above Refer section 2.2 above Refer section 3 above

Artech Refer section 1.2 above Refer section 2.2 above Refer section 3 above

Digitech Refer section 1.2 above Refer section 2.2 above Refer section 3 above

Boston IT Refer section 1.2 above Refer section 2.2 above Refer section 3 above http://ibm.com/terms/?id=z126-7745

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

c. Subprocessor Updates:

This DPA Exhibit will be updated for any intended additional or replacement of Subprocessors by: IBM Project Manager will notify AZ DCS by e-mail

Transborder Data Processing In the case of a transfer of AZ DCS Personal Data to a Non-Adequate Country, the parties shall cooperate to ensure compliance with the applicable Data Protection Laws requirements as set out in the Transborder Data Processing document available at https://www.ibm.com/support/customer/csol/terms/?id=Z126-8005

IBM Privacy Contact The IBM privacy contact can be contacted at ChiefPrivacyOffice@ca.ibm.com.

mailto:ChiefPrivacyOffice@ca.ibm.com

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

Appendix C: Information Security Roles and Responsibilities

Table Personal Information (“PI”) is any information any information relating to an identified or identifiable individual.

Sensitive Personal Information (“SPI”) refers to information that is considered "sensitive" due to the risks that such information could be misused to significantly harm an individual in a financial, employment or social way.

Business Sensitive Information (“BSI”) refers to is any information protected by a AZ DCS or other company as important to their business, the improper exposure or use of which could harm them.

IBM and AZ DCS will perform the responsibilities shown below in the Information Security Roles and Responsibilities table as applicable to the services being provided in the Statement of Work per their respective scope of responsibility.

Control Area INFORMATION SECURITY ROLES AND RESPONSIBILITIES IBM AZ DCS

1 Security Policy a

Determine appropriate information security policy requirements based on business objectives, assessment of risk, and interpretation of legal, regulatory and contractual obligations to:

● validate that the workstation or workstation images and application security controls meet AZ DCS requirements driven by security policy and risk acceptance.

● identify security requirements for new applications; and

● request exceptions to the base Roles and Responsibilities as defined in this table, as needed.

R b Notify IBM if AZ DCS information security requirements change through Project Change Control Procedure, as defined by the Statement of Work so that parties may assess if and how to implement, including impact to cost, scope or schedule.

R c Review the Roles and Responsibilities as defined by this table during any contractual change in scope to the engagement. R d Review the Roles and Responsibilities as defined by this table with AZ DCS, during any contractual change in scope to the engagement. R e

Respond to exception or Project Change Requests from AZ DCS and determine if such requests result in additional or modified Services or changes to information security Roles and Responsibilities, all of which will be managed through the Project Change Control Procedure as defined by the Statement of Work.

R

2 Organization of Information Security a Designate a knowledgeable AZ DCS focal point for information security-related activities . R b Provide contact information for the primary contact and for an authorized secondary contact. R

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 c Coordinate all information security activities with third parties other than those contracted by IBM. R d

Designate a knowledgeable IBM focal point for information security-related activities including:

● Interfacing with the AZ DCS focal point on security requirements.

● Implementation of security requirements for which IBM is responsible in accordance with the negotiated and agreed to Roles and Responsibilities (as defined by this table).

R e Provide contact information for the primary contact and for an authorized secondary contact. R f Coordinate security activities with third parties contracted by IBM (as defined by this table). R

3 Asset Management a Be responsible for its information assets, including software, physical assets, and services. R b Identify and communicate to IBM any AZ DCS data designated as confidential, business-sensitive information (BSI), personal information (PI), and sensitive personal information (SPI) to which IBM will have access.

R c Provide data for testing that does not contain PI/SPI/BSI. R d

Be responsible for identifying, providing and funding the appropriate information security controls and communicating relevant requirements to IBM for:

● Data transmitted via public telecommunications facilities or services.

● Transport of confidential information, personal information, sensitive personal information and business sensitive information (e.g., encryption, transport over secure lines); and

● Storing of confidential information, personal information, sensitive personal information and business. sensitive information (e.g., encryption of data on portable media or other special handling or treatment).

● Printing of AZ DCS information.

● Data discard or destruction requirements.

R e Follow approved Project Change Control Procedure (defined in the IBM Consulting Statement of Work) for security related changes. R f

Handle information identified by the AZ DCS as confidential, business sensitive, personal and sensitive personal in accordance with the following controls:

● On applications, protect AZ DCS data by access controls as specified under IBM Responsibilities, in Area 6, ‘Access Control’.

● AZ DCS data on portable storage media is not allowed unless explicitly allowed in this SOW.

● When information is printed at IBM locations, keep printed information identified by AZ DCS as confidential, business sensitive, personal and sensitive personal in a locked container or physically controlled area.

● Only use information for the purposes of providing services in this SOW.

● Only share information with authorized parties as allowed in this SOW.

R

4 Human Resources Security a Address information security in the hiring, termination and personnel management processes for AZ DCS personnel. R

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 b Provide security awareness training to AZ DCS personnel and other network or system users authorized by AZ DCS. R c Identify and provide to IBM any AZ DCS-specific personnel requirements such as background checks or others applicable by law. R d Identify and provide to IBM any AZ DCS-specific security training required for IBM personnel. R e Take appropriate management action if there is a misuse of authority by any AZ DCS personnel. R f Address AZ DCS security requirements in joining and leaving the project, and in personnel management processes for IBM personnel. R g Provide the current IBM security education package to IBM personnel joining the project. R h Address agreed-to personnel requirements as described in this SOW. R i Take appropriate management action if there is a misuse of an IBM employee’s granted authorizations. R

5 Physical and Environmental Security a Secure work areas and restrict access from the general public at AZ DCS sites where IBM personnel will work R b Identify and provide to IBM any AZ DCS-specific information security requirements for printing, storing and transmitting AZ DCS information. R c Define where IBM personnel will work:

● IBM locations or AZ DCS sites.

● Define remote or work at home options.

R d Supply and manage secure workstation or workstation image(s) including endpoint protection software, firewall protection, and whole-disk encryption for workstations or workstation images provided by AZ DCS to IBM personnel.

R e Respond to virus attacks and initiate corrective action on workstations or workstation images provided by AZ DCS to IBM personnel. R f Define requirements for return of assets and removal of access rights to AZ DCS physical assets upon IBM personnel termination or change of employment. R g Provide and manage physical security of IBM owned workstations. R h Perform workplace security inspections of IBM personnel at IBM sites and AZ DCS sites (related to execution of this SOW) where IBM personnel will work from. R i Provide security for work areas and restrict access from the general public at IBM sites. R j Supply and install IBM endpoint protection software and upgrades for IBM supplied workstations or workstation images. R

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 k Respond to virus attacks and initiate corrective action on IBM supplied workstations or workstation images. R l Install whole-disk encryption on IBM-supplied workstations. R

6 Access Control a Authorize, administer and manage user IDs and passwords for AZ DCS managed applications, systems and subsystems. R b Provide unique login IDs and passwords to IBM personnel for AZ DCS managed applications, systems and subsystems. R c Define access control requirements and process and administer logical access for network infrastructure systems and devices under AZ DCS management. R d Define access control requirements for AZ DCS applications, databases and other AZ DCS software on systems across all environments (development, test, production). R e Define what constitutes privileged access and access control requirements for users with privileged access to AZ DCS applications, databases and other AZ DCS software on systems across all environments (development, test, production).

R f Administer revocation of access for AZ DCS managed applications, systems and subsystems as appropriate, based on validation activities and when requested by IBM. R g Define revocation requirements for AZ DCS applications, databases and other AZ DCS software on systems across all environments (development, test, production). R h Be responsible for revalidating the employment status and business need for access to AZ DCS applications and systems for AZ DCS personnel. R i Be responsible for revalidating the business need for IBM personnel access to AZ DCS managed applications, systems and subsystems, periodically but at least every 12 months. R j Be responsible for implementing access changes to AZ DCS managed applications, systems and subsystems based on input from IBM employment validation activities for IBM personnel. R k If Shared IDs are applicable to this scope of work, revalidate shared IDs assigned to IBM with access to AZ DCS applications, databases and other AZ DCS software on systems across all environments (development, test, production), periodically but at least every 6 months.

R l

Validate User ID baseline inventory and share results of updates made to User IDs used by IBM staff.

Retain evidence of completion for two revalidation cycles.

R m Define data protection technique requirements to be used to access AZ DCS applications, databases and other AZ DCS software on systems across all environments (development, test, production), such as data masking and encryption, and supply tools to meet requirements.

R

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012 n Define requirements for secure disposal of AZ DCS information from workstations or storage media. R o Define criteria for IBM personnel termination of access rights to AZ DCS’s logical assets upon conclusion of assignment or change of employment. R p Provide initial (one time) acknowledgment for shared ID’s that will be used by IBM personnel. R q Submit request to revoke access to AZ DCS systems, applications, databases and other AZ DCS software when IBM personnel no longer require access. R r Respond to revalidation of employment status, business need and access privileges to AZ DCS systems, applications, databases, other AZ DCS software assigned to IBM personnel. Submit or notify AZ DCS of access changes needed as a result of revalidation activities.

R s

Provide, respond to revalidation of shared IDs to AZ DCS systems, applications, databases, other AZ DCS software assigned to IBM personnel Retain evidence of completion for two revalidation cycles.

Submit or notify of access changes needed as a result of revalidation activities.

R t Perform a baseline inventory of User IDs to AZ DCS systems, applications, databases, other AZ DCS software assigned to IBM personnel and communicate User ID baseline inventory to AZ DCS for validation.

R u Adhere to AZ DCS data protection technique requirements using tools provided by AZ DCS. R v Dispose of AZ DCS data within IBM's control based on AZ DCS's classification and direction. If AZ DCS has not provided any data disposal direction, then data will be disposed of in a manner consistent with IBM internal practices for IBM confidential information.

R

7 Information Security Incident Management a

Provide a 24/7 contact plan for reporting security incidents.

● Inform IBM of any application and information security incidents involving IBM personnel.

● Provide a AZ DCS security incident coordinator.

● Make decisions on actions to resolve security incidents involving AZ DCS network, systems, personnel or data, including, if appropriate, collection of evidence.

● Interface, as needed, with external entities such as law enforcement, legal or regulatory agencies.

R b Assist AZ DCS in initial security incident evaluation for security incidents involving IBM personnel that are reported by AZ DCS as part of security incident management. R

8 Compliance a Identify and interpret legal, regulatory or contractual security requirements that are applicable to its business and inform IBM of any additional or changed requirements (for example data export or transfer restrictions and privacy laws).

R

State of Arizona Department of Child Safety

Office of Procurement & Contracts

3003 N. Central Avenue, 20th Floor

Phoenix, AZ 85012

ALL OTHER REQUIREMENTS, SPECIFICATIONS, TERMS AND CONDITIONS REMAIN UNCHANGED

This amendment shall be fully executed upon the approval electronically in the state approved e-procurement system by an authorized representative of the Contractor and applied to the contract within the e-procurement system by the Procurement Officer or delegate.

b Provide support for application assessments including AZ DCS audit activities, issue management services and closure of issues after audit (closure of issues impacting cost, schedule, quality may require that the Project Change Control Procedure be followed)

R

9 Separation of Duties a Perform application separation of duties analysis and conflict resolution. R b Implement change management on the separation of duties analysis. R c Perform an annual review of separation of duties analysis. R d Authorize code promotions, data changes and database changes to production. R e Inform AZ DCS of IBM personnel role, responsibility, or access changes. R

10 Patch Management a Perform patch management to maintain all assets, systems, applications in the AZ DCS domain at an acceptable level, except to the extent IBM has accepted responsibility through the SOW. R

11 Security Configuration Management a Perform security configuration for AZ DCS-owned and administered assets, as per AZ DCS process for implementing and maintaining security options, settings, control parameters, and logging

R

12 Secure Software Development / SPbD a Perform security assessment and testing for software deliverables where AZ DCS retains ownership rights (e.g. threat modelling and vulnerability scans). R b Perform security assessment and testing for software deliverables developed where IBM retains ownership rights and AZ DCS is licensed per the terms of the Agreement (e.g. threat modeling and vulnerability scans).

R

13 IT Change Management a Perform code promotion, or release, in the AZ DCS’s production environments R