CTR078978 Participants Workbooks and Materials for ADCRR and ADJC.pdf

Direct Contract

CTR078978

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

CONTRACTOR IS STRONGLY ENCOURAGED TO READ THE ENTIRE CONTRACT

Table of Contents

Scope of Work 2

Exhibits

Exhibit 1 - ADCRR Locations 4

Special Terms and Conditions 6

Addendum A - Contractor Insurance Requirements 9

Addendum B - Warranties and Requirements Related to Arizona Information

Technology Statewide Policies, Standards, and Procedures 13

Uniform Terms and Conditions 10.5 17

Contract Signature Page 31

Attachments

Attachment 1 - Proposed Subcontractors 32

Attachment 2 - Questionnaire 33

Direct Contract, Table of Contents | Revision No. 1 | Revised 03-24 | Page 1 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Scope of Work

1. Purpose and Background

1.1. Purpose: To allow the Arizona Department of Corrections, Rehabilitation, and Reentry (ADCRR) to enter into a

Contract(s) for the specified Participants’ Workbooks and Materials for ADCRR and Arizona Department of Juvenile Corrections (ADJC).

1.2. Legal Authority: In accordance with the Sole Source Procurement Arizona Revised Statutes (A.R.S.) §41-2536 and Arizona Administrative Code (A.A.C.) R2-7-E301, the State establishes this contract with The Change Companies dba Train for Change to provide the materials as described herein.

1.3. Background: The Change Companies has provided the Participants’ Workbooks and Materials for Interactive

Journaling to ADCRR since October of 2019. This is a copyrighted program, wherein the materials are curriculum developed, manufactured and distributed only through The Change Companies dba Train for Change, with no approved retailers/distributors.

2. Service or Materials Description

The Contractor shall

2.1. Requirements/Specifications:

2.1.1. Produce and deliver Participants’ Workbooks and Materials for the Interactive Journaling Series solely developed and copyrighted by The Change Companies dba Train for Change to the ADCRR and ADJC locations upon receipt of a purchase order as requested.

2.1.1.1. This includes student workbooks, facilitator manuals, and additional worksheets needed to teach the curriculum for Interactive Journaling classes.

2.1.2. Deliver the herein specified Participants’ Workbooks and Materials for the Interactive Journaling Series to the following locations;

2.1.2.1. Exhibit 1, ADCRR locations

2.1.2.2. Arizona Department of Juvenile Corrections

Adobe Mountain School 2800 W. Pinnacle Peak Road Phoenix, Arizona 85027

2.2. Contractor Requirements:

2.2.1. Ensure that the Participants’ Workbooks and Materials are currently identified/listed on the National Registry of Evidence-Based Programs and Practices (NREPP), see Attachment 2 - Questionnaire.

2.2.2. Ensure that the Interactive Journaling methodology will continue to be recognized through the term of this contract as an evidence-based practice through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the National Institute of Justice (NIJ), see Attachment 2 - Questionnaire.

2.2.2.1. Should this recognition not continue, notification to the ADCRR Procurement Office is required.

Direct Contract, Scope of Work | Revision No. 1 | Revised 03-24 | Page 2 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

2.2.3. Provide a Manufacturer's Price List/Catalog of Participants’ Workbooks and Materials identifying pricing, see Attachment 2 - Questionnaire.

2.2.4. Consider offering a Percent (%) of Discount offered off the Manufacturer's Price List/Catalog and provide it on Attachment 2 - Questionnaire.

3. ADCRR shall:

3.1. Issue a Purchase Order prior to the ordering or receipt of any contracted materials.

Direct Contract, Scope of Work | Revision No. 1 | Revised 03-24 | Page 3 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Exhibit 1 – ADCRR Locations

Direct Contract, Exhibit 1 | Revision No. 1 | Revised 03-24 | Page 4 of 33

ARIZONA STATE PRISONS & FACILITIES

Arizona State Prison Complex - Douglas Physical Address 6911 N. BDI Blvd.

Douglas, AZ 85607

Arizona State Prison Complex - Eyman/South Unit Physical Address 1305 East Butte Avenue Florence, AZ 85132

Arizona State Prison Complex - Eyman Physical Address 4374 E. Butte Avenue Florence, AZ 85132

Arizona State Prison Complex - Lewis Physical Address 26700 South Hwy. 85 Buckeye, Arizona 85326

Arizona State Prison Complex - Perryville Physical Address 2015 North Citrus Road Goodyear, AZ 85395

Arizona State Prison Complex - Phoenix Physical Address 2500 E. Van Buren Street Phoenix, AZ 85008

Arizona State Prison Complex - Safford Physical Address 896 S. Cook Road Safford, AZ 85546

Arizona State Prison Complex - Safford / Fort Grant Unit Physical Address 15500 S. Fort Grant Road Safford, AZ 85643

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Direct Contract, Exhibit 1 | Revision No. 1 | Revised 03-24 | Page 5 of 33

Arizona State Prison Complex - Safford / Globe Unit Physical Address 1000 Fairgrounds Road Globe, AZ 85501

Arizona State Prison Complex - Tucson Physical Address 10000 South Wilmot Road Tucson, Arizona 85756

Arizona State Prison Complex - Winslow Physical Address 2100 S. Highway 87 Winslow, AZ 86047

Arizona State Prison Complex - Winslow / Apache Physical Address 38322 U.S. Highway 180 St. Johns, AZ 85936

Arizona State Prison Complex - Yuma Physical Address 7125 E. Cesar Chavez Blvd.

San Luis, AZ 85349

Maricopa Reentry Center (MRC) Physical Address 24601 N. 29th Ave.

Phoenix, AZ 85027

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Special Terms and Conditions

1.0 Definitions

1.1 “Attachment” means any item which requires the Contractor to submit as part of the Offer.

1.2 “Contract Terms and Conditions” The Special Terms and Conditions and the Uniform Terms and Conditions taken collectively.

1.3 "Contract Amendment" means a written document signed by the Procurement Officer that is issued for the purpose of making changes in the Contract.

1.4 “Contractor” The Person identified on the Contract Signature Page who has entered into the Contract with the State.

1.5 “Contractor Indemnitor” Contractor or any of its owners, officers, directors, agents, employees, or Subcontractors.

1.6 “Days” means calendar days unless otherwise specified.

1.7 “Exhibit” means any item labeled as an Exhibit in the Contract or placed in the Exhibits section of the Contract generally containing maps, schematics, examples of reports, or other documents that will be used to perform the requirements of the Scope of Work after contract award.

1.8 “Gratuity” means a payment, loan, subscription, advance, deposit of money, services, or anything of more than nominal value, present or promised, unless consideration of substantially equal or greater value is received.

1.9 “Materials” means all property, including equipment, supplies, printing, insurance and leases of property but does not include land, a permanent interest in land or real property or leasing space.

1.10 “Procurement Officer” means the person, or his or her designee, duly authorized by the State to enter into and administer Contracts and make written determinations with respect to the Contract.

1.11 “State” means any department, commission, council, board, bureau, committee, institution, agency, government corporation or other establishment or official of the executive branch or corporation commission of the State of Arizona that executes the Contract.

1.12 “State Fiscal Year” means the period beginning with July 1 and ending June 30.

1.13 “Subcontract” means any Contract, express or implied, between the Contractor and another party or between a Subcontractor and another party delegating or assigning, in whole or in part, the making or furnishing of any Materials or any Services required for the performance of the Contract.

1.14 “Subcontractor” means a person who contracts to perform work or render Services to a Contractor or to another Subcontractor as a part of a Contract with the State.

Direct Contract, Special Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 6 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

2.0 Contract Interpretations

2.1 [Reserved]

3.0 Contract Administration and Operation

3.1 Term of Contract. The term of the Contract will commence on the date indicated on the Contract Signature

Page and continue for twelve (12) months unless canceled, terminated, or permissibly extended.

3.2 Contract Extensions. State may, at its discretion, request for a mutual agreement to extend the initial

Contract term in increments of one (1) or more months and do so one or more times, provided that the maximum aggregate term of the Contract including extensions cannot exceed the maximum aggregate term of five (5) years.

3.3 Eligible Agency. This contract is a single-agency contract for the sole use of the Arizona Department of

Corrections, Rehabilitation, and Reentry and the Arizona Department of Juvenile Corrections.

4.0 Costs and Payments

4.1 Pricing: As outlined in the Manufacturer's Price List/Catalog.

5.0 Contract Changes

5.1 [Reserved]

6.0 Risk and Liability

6.1 Risk of Loss. Contractor shall bear all risk of loss to Materials while in pre-production, production, storage, transit, staging, assembly, installation, testing, and commissioning, if and as those duties are within the scope of the Work, until they have been accepted as conforming by State in the particular location and situation specified in the Order, or as specified generally elsewhere in the Contract if the Order does not provide particulars, provided that, risk of loss for nonconforming Materials will remain with Contractor notwithstanding acceptance to the extent the loss stems from the nonconformance.

6.2 General Contractor Indemnification and Insurance Requirements

6.2.1 Contractor Indemnification (Not Public Agency). To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court

Direct Contract, Special Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 7 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that the Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable.

In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona.

6.2.2 Public Agency Language Only. Each party (as 'indemnitor') agrees to indemnify, defend, and hold harmless the other party (as 'indemnitee') from and against any and all claims, losses, liability, costs, or expenses (including reasonable attorney's fees) (hereinafter collectively referred to as 'claims') arising out of bodily injury of any person (including death) or property damage but only to the extent that such claims which result in vicarious/derivative liability to the indemnitee, are caused by the act, omission, negligence, misconduct, or other fault of the indemnitor, its officers, officials, agents, employees, or volunteers."

6.2.3 Insurance Requirements: Addendum A to the Special Terms and Conditions: Contractor Insurance

Requirements is incorporated herein as part of the Special Terms and Conditions.

7.0 Warranties

7.1 Warranties and Requirements Related to Information Technology. Addendum B: Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures is incorporated herein as part of the Special Terms and Conditions.

8.0 General Provisions for Materials

8.1 [Reserved]

9.0 General Provisions for Services

9.1 [Reserved]

10.0 Data and Information Handling

10.1 [Reserved]

11.0 Information Technology Work

11.1 [Reserved]

Direct Contract, Special Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 8 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Addendum A - Contractor Insurance Requirements

1. Indemnification Clause

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that the Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

2. Insurance Requirements

2.1. The Contractor will be required to provide the following Certification of Insurance upon return of signed documents. The Contractor must furnish the State certification from insurer(s) for coverage in the minimum amount as stated below. The coverage shall be maintained in full force and effect during the term of this Contract and shall not serve to limit any liabilities or any other Contractor obligations.

2.2. Contractor and subcontractors shall procure and maintain, until all of their obligations have been discharged, including any warranty periods under this Contract, insurance against claims for injury to persons or damage to property arising from, or in connection with, the performance of the work hereunder by the Contractor, its agents, representatives, employees or subcontractors.

2.3. The Insurance Requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State of Arizona in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that arise out of the performance of the work under this Contract by the Contractor, its agents, representatives, employees or subcontractors, and the Contractor is free to purchase additional insurance.

Direct Contract, Addendum A | Revision No. 1 | Revised 03-24 | Page 9 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3. Minimum Scope and Limits of Insurance

The Contractor shall provide coverage with limits of liability not less than those stated below.

3.1. Commercial General Liability (CGL) – Occurrence Form

Policy shall include bodily injury, property damage, and broad form contractual liability coverage.

● General Aggregate $2,000,000

● Products - Completed Operations Aggregate $1,000,000

● Personal and Advertising Injury $1,000,000

● Damage to Rented Premises $50,000

● Each Occurrence $1,000,000

a. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by or on behalf of the Contractor.

b. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

3.2. Workers’ Compensation and Employers’ Liability

Policy shall include bodily injury, property damage, and broad form contractual liability coverage.

● Workers’ Compensation Statutory

● Employers' Liability

○ Each Accident $1,000,000

○ Disease – Each Employee $1,000,000

○ Disease – Policy Limit $1,000,000

a. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

b. This requirement shall not apply to each Contractor or subcontractor that is exempt under A.R.S. § 23-901, and when such Contractor or subcontractor executes the appropriate waiver form (Sole Proprietor or Independent Contractor).

4. Additional Insurance Requirements

The policies shall include, or be endorsed to include, as required by this written agreement, the following provisions:

4.1. The Contractor's policies, as applicable, shall stipulate that the insurance afforded the Contractor shall be primary and that any insurance carried by the Department, its agents, officials, employees or the State of Arizona shall be excess and not contributory insurance, as provided by A.R.S. § 41-621(E).

Direct Contract, Addendum A | Revision No. 1 | Revised 03-24 | Page 10 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

4.2. Insurance provided by the Contractor shall not limit the Contractor’s liability assumed under the indemnification provisions of this Contract.

5. Notice of Cancellation

Applicable to all insurance policies required within the Insurance Requirements of this Contract, Contractor’s insurance shall not be permitted to expire, be suspended, be canceled, or be materially changed for any reason without thirty (30) days prior written notice to the State of Arizona. Within two (2) business days of receipt, Contractor must provide notice to the State of Arizona if they receive notice of a policy that has been or will be suspended, canceled, materially changed for any reason, has expired, or will be expiring. Such notice shall be sent directly to the Department and shall be mailed, emailed, hand delivered or sent by facsimile transmission to

Arizona Department of Corrections Procurement Office, M/C 55302 701 E. Jefferson Phoenix, AZ 85034

6. Acceptability of Insurers

Contractor’s insurance shall be placed with companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers. Insurers shall have an “A.M.

Best” rating of not less than A- VII. The State of Arizona in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

7. Verification of Coverage

Contractor shall furnish the State of Arizona with certificates of insurance (valid ACORD form or equivalent approved by the State of Arizona) evidencing that Contractor has the insurance as required by this Contract. An authorized representative of the insurer shall sign the certificates.

7.1. All such certificates of insurance and policy endorsements must be received by the State before work commences. The State’s receipt of any certificates of insurance or policy endorsements that do not comply with this written agreement shall not waive or otherwise affect the requirements of this agreement.

7.2. Each insurance policy required by this Contract must be in effect at, or prior to, commencement of work under this Contract. Failure to maintain the insurance policies as required by this Contract, or to provide evidence of renewal, is a material breach of contract.

7.3. All certificates required by this Contract shall be sent directly to the Department. The State of Arizona project/contract number and project description shall be noted on the certificate of insurance. The State of Arizona reserves the right to require complete copies of all insurance policies required by this Contract at any time.

Direct Contract, Addendum A | Revision No. 1 | Revised 03-24 | Page 11 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

8. Subcontractors

Contractor’s certificate(s) shall include all subcontractors as insureds under its policies or Contractor shall be responsible for ensuring and/or verifying that all subcontractors have valid and collectable insurance as evidenced by the certificates of insurance and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum Insurance Requirements identified above. The Department reserves the right to require, at any time throughout the life of this contract, proof from the Contractor that its subcontractors have the required coverage.

9. Approval and Modifications

The Contracting Agency, in consultation with State Risk, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary.

Such action will not require a formal Contract amendment but may be made by administrative action.

10. Exceptions

In the event the Contractor or subcontractor(s) is/are a public entity, then the Insurance Requirements shall not apply.

Such a public entity shall provide a certificate of self-insurance. If the Contractor or subcontractor(s) is/are a State of Arizona agency, board, commission, or university, none of the above shall apply.

Direct Contract, Addendum A | Revision No. 1 | Revised 03-24 | Page 12 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Addendum B - Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures

1. Security Standards

1.1. Security of the State’s systems and Data are of utmost importance to the State. In order to assure security from a personnel and operations perspective, Contractor shall comply with all requirements, in their entirety, as described in the statewide enterprise architecture; statewide Information Technology security policies, standards, and procedures; and any applicable agency-specific Information Technology security policies, standards, and procedures.

1.2. Contractor shall follow the correct, current version of these policies, standards, and procedures established by the Arizona Department of Homeland Security (AZDOHS) pursuant to their authority under A.R.S. Title 41, Chapter 41. The current website for these policies, standards, and procedures is: Information Technology Policies, Standards and Procedures. Note that this link is provided for convenience only.

1.3. For security reasons, some state facilities require non-state personnel to have escorts. If required by the state facility, Contractor personnel shall only be allowed inside of a State facility if accompanied by an escort designated by the State. This is applicable in Correctional facilities, Public Safety facilities, State Lottery, and other facilities as designated by the State.

2. Security Framework

2.1. The State of Arizona information security policies and standards follow the National Institute of Standards and

Technology (NIST) SP 800-53 Rev. 5 Security and Privacy Guidelines may currently be located at:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.

2.2. The State has established a process to assess risk associated with storing, processing and/or transmitting

State of Arizona Data with external, non-State of Arizona entities. The Arizona Risk and Authorization Management Program (AZRamp) was developed to ensure State and contractors meet these requirements. All contractors responding to State solicitations must successfully complete the AZRamp risk assessment based upon the Data classification involved as determined by the Data owner and AZDOHS Cyber Command. Failure to successfully complete AZRamp assessment will be deemed as breach of contract.

2.3. In the State’s sole discretion, the State may also accept current FedRamp and StateRamp certifications as evidence that the Contractor has met the State's risk assessment requirements.

2.4. Other forms of Cybersecurity Frameworks (CSF), Trust Documents, Self-Attestations, including, but not limited to, ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance, may be reviewed as part of the State’s risk assessment, but are not exclusive or conclusive evidence that the Contractor has met the State’s risk assessment requirements.

Direct Contract, Addendum B | Revision No. 1 | Revised 03-24 | Page 13 of 33 https://azdohs.gov/information-technology-it-policies-standards-and-procedures https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3. Additional Security Requirements

3.1. The contractor shall comply with all security requirements requested by the State.

3.2. If an Arizona Risk and Authorization Management Program (AZRamp) is required, it will generally follow these steps, each of which shall be completed by the Contractor upon request by the State:

3.2.1. Contractor shall submit a completed Arizona Baseline Infrastructure Security Controls Prerequisite assessment spreadsheet with its Offer. The Arizona Baseline Infrastructure Security Controls Prerequisite assessment spreadsheet as found at:

https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_pre-requisite__0_0.xls, and mitigate gaps or install compensating controls for any issues of concern identified by State.

3.2.2. The contractor shall provide Information Security documentation for the AZRamp assessment to include System Security Plan (SSP), Written Information Security Programs (WISP), or supporting written IT policies for review of the assessment.

3.2.3. Note regarding the confidential treatment of Contractor information:

3.2.3.1. The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDA) for release to review submitted SSPs, WISPs, or written IT policies will not be considered.

3.2.3.2. Submitted SSPs, WISPs, or written IT policies are deleted and not retained after AZRamp Authorization is granted.

3.2.3.3. Procedures for submission of documents considered confidential or proprietary are identified within this RFP.

3.2.3.4. Special secure transfer of documents related to this AZRamp review process may be made by contacting: GRC@AZDOHS.gov to make special arrangements for the transfer of these documents.

3.2.4. If applicable to this Solicitation, Contractor shall complete and submit with the Offer an unedited and signed State of Arizona Health Insurance Portability and Accountability Act (HIPAA) Business Associate Addendum (BAA).

3.2.5. All contract awards are contingent on the successful completion of the AZRamp 125 Low Impact

(public information) or the AZRamp 325 Moderate (Confidential, PII, or PHI) Impact Control spreadsheet titled “Arizona Infrastructure Security Controls 2017 (Excel),” to be determined by the Enterprise Security, Privacy & Risk Compliance team. Low (Column E) and Moderate (Column F) Impact controls spreadsheet can be located here:

https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_2017_v2_0_0.xls.

Direct Contract, Addendum B | Revision No. 1 | Revised 03-24 | Page 14 of 33 https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_pre-requisite__0_0.xls mailto:GRC@AZDOHS.gov https://aset.az.gov/sites/default/files/Arizona%20Baseline%20Security%20Controls%202017_v2.xls https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_2017_v2_0_0.xls

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3.3. The State reserves the right to conduct risk assessments, vulnerability assessments, black-box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. The contractor will be alerted in advance and arrangements made for an agreeable time. The contractor shall respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s).

3.4. Upon request, Contractor shall submit copies of system logs from Contractor’s environment to the State of AZ security team in the format requested to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3.5. Contractor shall comply with all applicable State and Federal laws and regulations, including, but not limited to, the following (please note that the links are provided for convenience only and may change):

3.5.1. State of Arizona statewide policies, standards and procedures:

https://azdohs.gov/information-technology-it-policies-standards-and-procedures;

3.5.2. Federal Information Security Modernization Act of 2014 (FISMA):

https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma;

3.5.3. OMB Circular A-130:

https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130 -managing-information-as-a-strategic-resource;

3.5.4. National Cyber Strategy of the United States of America:

https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrast ructure;

3.5.5. Health Insurance Portability and Accountability Act (HIPAA) including Business Associate Agreement/

Health Information Technology for Economic and Clinical Health Act (HITECH):

https://www.hhs.gov/hipaa/index.html;

3.5.6. Tax Information Security Guidelines For Federal, State and Local Agencies: Safeguards for Protecting

Federal Tax Returns and Return Information (I.R.S. Publication 1075):

https://www.irs.gov/pub/irs-pdf/p1075.pdf;

3.5.7. Criminal Justice Information Services Security Policy (CJIS):

https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center;

3.5.8. Centers for Medicare & Medicaid Services (CMS), Minimum Acceptable Risk Standards for Exchanges (MARS-E):

https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minim um-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf;

Direct Contract, Addendum B | Revision No. 1 | Revised 03-24 | Page 15 of 33 https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.hhs.gov/hipaa/index.html https://www.irs.gov/pub/irs-pdf/p1075.pdf http://https https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3.5.9. A.R.S. §18-104 - Arizona Department of Administration, Arizona Strategic Enterprise Technology

(ADOA-ASET), Powers and duties of the agency: https://www.azleg.gov/arsDetail/?title=18;

3.5.10. A.R.S. §41-4282 - Statewide Information Security and Privacy Office (SISPO):

https://www.azleg.gov/viewdocument/?docName=https://www.azleg.gov/ars/41/04282.htm

3.5.11. A.R.S. §18-551 - Definitions Information Security Including PII:

https://www.azleg.gov/ars/18/00551.htm;

3.5.12. A.R.S. §18-552 - Notification of security system breaches; requirements; enforcement; civil penalty;

preemption; exceptions: https://www.azleg.gov/ars/18/00552.htm;

3.5.13. Arizona Executive Order 2008-10 – Mitigating Cyber Security Threats: https://aset.az.gov/node/428;

3.5.14. SIPC Memorandum of Understanding (MOU): https://www.sipc.org/about-sipc/;

3.5.15. State Environmental policies: https://azdeq.gov/LawsAndRules;

3.5.16. Family Education Rights Privacy Act (FERPA):

https://www.google.com/url?q=https://studentprivacy.ed.gov/topic/family-educational-rights-privacy-act -ferpa&sa=D&source=docs&ust=1759786165768046&usg=AOvVaw1gOs-qZwbFii4XsJQ9X875;

3.5.17. Driver’s Privacy Protection Act (DPPA):

https://azdot.gov/motor-vehicles/driver-services/driver-license-information/motor-vehicle-records;

3.5.18. Incident Response Reporting program and system:

https://azdohs.gov/sites/default/files/p8240-incident-response-planning_0.pdf;

3.5.19. State of Arizona Library, Archives and Public Records, Records Management Division, General

Retention Schedules https://azlibrary.gov/branches/archives-records-management; and

3.5.20. Payment Card Industry (PCI) Security Standards including but not limited to Supplemental Documents, Information Supplements and Validation Requirements:

https://www.pcisecuritystandards.org.

Direct Contract, Addendum B | Revision No. 1 | Revised 03-24 | Page 16 of 33 https://www.azleg.gov/arsDetail/?title=18 https://www.azleg.gov/viewdocument/?docName=https://www.azleg.gov/ars/41/04282.htm https://www.azleg.gov/ars/18/00551.htm https://www.azleg.gov/ars/18/00552.htm https://aset.az.gov/node/428 https://www.sipc.org/about-sipc/ https://azdeq.gov/LawsAndRules https://studentprivacy.ed.gov/topic/family-educational-rights-privacy-act-ferpa https://studentprivacy.ed.gov/topic/family-educational-rights-privacy-act-ferpa https://azdot.gov/motor-vehicles/driver-services/driver-license-information/motor-vehicle-records https://azdohs.gov/sites/default/files/p8240-incident-response-planning_0.pdf https://azlibrary.gov/branches/archives-records-management https://www.pcisecuritystandards.org/

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

Uniform Terms and Conditions 10.5

1. Definition of Terms As used in this Solicitation and any resulting Contract, the terms listed below are defined as follows:

1.1. “AI” means the science and engineering of making machines capable of performing tasks that are typically associated with human intelligence, such as learning and problem-solving, and includes without limitation: AI systems, classic AI, external AI, generative AI, and large language model (LLM) AI.

1.2. “Attachment” means any item the Solicitation which requires the Offeror to submit as part of the Offer.

1.3. “Contract” means the combination of the Solicitation, including the Instructions to Offerors, the Uniform and Special Terms and Conditions, and the Specifications and Statement or Scope of Work; the Offer and any Best and Final Offers; and any Solicitation Amendments or Contract Amendments.

1.4. "Contract Amendment" means a written document signed by the Procurement Officer that is issued for the purpose of making changes in the Contract.

1.5. “Contractor” means any person who has a Contract with the State.

1.6. “Data” means recorded information, regardless of form or the media on which it may be recorded. The term may include technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

1.7. “Days” means calendar days unless otherwise specified.

1.8. “Exhibit” means any item labeled as an Exhibit in the Solicitation or placed in the Exhibits section of the Solicitation generally containing maps, schematics, examples of reports, or other documents that will be used to perform the requirements of the Scope of Work after contract award.

1.9. “Gratuity” means a payment, loan, subscription, advance, deposit of money, services, or anything of more than nominal value, present or promised, unless consideration of substantially equal or greater value is received.

1.10. “Materials” means all property, including equipment, supplies, printing, insurance and leases of property but does not include land, a permanent interest in land or real property or leasing space.

1.11. “Procurement Officer” means the person, or his or her designee, duly authorized by the State to enter into and administer Contracts and make written determinations with respect to the Contract.

1.12. “Services” means the furnishing of labor, time or effort by a Contractor or Subcontractor which does not involve the delivery of a specific end product other than required reports and performance, but does not include employment agreements or collective bargaining agreements.

1.13. “State” means any department, commission, council, board, bureau, committee, institution, agency, government corporation or other establishment or official of the executive branch or corporation commission of the State of Arizona that executes the Contract.

1.14. “State Fiscal Year” means the period beginning with July 1 and ending June 30.

Direct Contract, Uniform Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 17 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

1.15. “Subcontract” means any Contract, express or implied, between the Contractor and another party or between a

Subcontractor and another party delegating or assigning, in whole or in part, the making or furnishing of any Materials or any Services required for the performance of the Contract.

1.16. “Subcontractor” means a person who contracts to perform work or render Services to a Contractor or to another Subcontractor as a part of a Contract with the State.

2. Contract Interpretation

2.1. Arizona Law. The Arizona law applies to this Contract including, where applicable, the Uniform Commercial Code as adopted by the State of Arizona and the Arizona Procurement Code, Arizona Revised Statutes (A.R.S.) Title 41, Chapter 23, and its implementing rules, Arizona Administrative Code (A.A.C.) Title 2, Chapter 7.

2.2. Implied Contract Terms. Each provision of law and any terms required by law to be in this Contract are a part of this Contract as if fully stated in it.

2.3. Contract Order of Precedence. In the event of a conflict in the provisions of the Contract, as accepted by the State and as they may be amended, the following shall prevail in the order set forth below:

2.3.1. Special Terms and Conditions;

2.3.2. Uniform Terms and Conditions;

2.3.3. Statement or Scope of Work;

2.3.4. Specifications;

2.3.5. Attachments;

2.3.6. Exhibits; then

2.3.7. Any other documents referenced or included in the Solicitation including, but not limited to, any Bid or

Offer documents provided by the Contractor that do not fall into one of the above categories.

2.4. Relationship of Parties. The Contractor under this Contract is an independent Contractor. Neither party to this Contract shall be deemed to be the employee or agent of the other party to the Contract.

2.5. Severability. The provisions of this Contract are severable. Any term or condition deemed illegal or invalid shall not affect any other term or condition of the Contract.

2.6. No Parol Evidence. This Contract is intended by the parties as a final and complete expression of their agreement. No course of prior dealings between the parties and no usage of the trade shall supplement or explain any terms used in this document and no other understanding either oral or in writing shall be binding.

2.7. No Waiver. Either party’s failure to insist on strict performance of any term or condition of the Contract shall not be deemed a waiver of that term or condition even if the party accepting or acquiescing in the nonconforming performance knows of the nature of the performance and fails to object to it.

Direct Contract, Uniform Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 18 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3. Contract Administration and Operation

3.1. Records. Under A.R.S. § 35-214 and § 35-215, the Contractor shall retain and shall contractually require each

Subcontractor to retain any and all Data and other “records” relating to the acquisition and performance of the Contract for a period of five (5) years after the completion of the Contract. All records shall be subject to inspection and audit by the State at reasonable times. Upon request, the Contractor shall produce a legible copy of any or all such records.

3.2. Non-Discrimination. The Contractor shall comply with State Executive Order Nos. 2023-09, 2023-01, 2009-09, and any and all other applicable Federal and State laws, rules and regulations, including the Americans with Disabilities Act.

3.3. Audit. Pursuant to A.R.S. § 35-214, at any time during the term of this Contract and five (5) years thereafter, the Contractor’s or any Subcontractor’s books and records shall be subject to audit by the State and, where applicable, the Federal Government, to the extent that the books and records relate to the performance of the Contract or Subcontract.

3.4. Facilities Inspection and Materials Testing. The Contractor agrees to permit access to its facilities, Subcontractor facilities, and the Contractor’s processes or services, at reasonable times for inspection of the facilities or Materials covered under this Contract as required under A.R.S. § 41-2547. The State shall also have the right to test, at its own cost, the Materials to be supplied under this Contract. Neither inspection of the Contractor’s facilities nor Materials testing shall constitute final acceptance of the Materials or Services. If the State determines non-compliance of the Materials, the Contractor shall be responsible for the payment of all costs incurred by the State for testing and inspection.

3.5. Notices. Notices to the Contractor required by this Contract shall be made by the State to the person indicated on the Offer and Acceptance form submitted by the Contractor unless otherwise stated in the Contract. Notices to the State required by the Contract shall be made by the Contractor to the Solicitation Contact Person indicated on the Solicitation, stated in the Contract, or listed on the State’s eProcurement system. An authorized Procurement Officer and an authorized Contractor representative may change their respective person to whom notice shall be given by written notice to the other and an amendment to the Contract shall not be necessary.

3.6. Advertising, Publishing and Promotion of Contract. The Contractor shall not use, advertise or promote information for commercial benefit concerning this Contract without the prior written approval of the Procurement Officer.

3.7. Continuous Improvement. Contractor shall recommend continuous improvements on an on-going basis in relation to any Materials and Services offered under the Contract, with a view to reducing State costs and improving the quality and efficiency of the provision of Materials or Services. State may require Contractor to engage in continuous improvements throughout the term of the Contract.

3.8. Other Contractors. State may undertake on its own or award other contracts to the same or other suppliers for additional or related work. In such cases, the Contractor shall cooperate fully with State employees and such other suppliers and carefully coordinate, fit, connect, accommodate, adjust, or sequence its work to the related work by others. Where the Contract requires handing-off Contractor’s work to others, Contractor shall cooperate as State instructs regarding the necessary transfer of its work product, Materials, Services, or records to State or the other suppliers. Contractor shall not commit or permit any act that interferes with the State’s or other suppliers’ performance of their work, provided that, State shall enforce the foregoing section equitably among all its suppliers so as not impose an unreasonable burden on any one of them.

Direct Contract, Uniform Terms and Conditions | Revision No. 1 | Revised 03-24 | Page 19 of 33

Participants’ Workbooks and Materials for ADCRR and ADJC

Arizona Department of Corrections, Rehabilitation

& Reentry

3.9. Ownership of Intellectual Property.

3.9.1. Rights In Work Product. All intellectual property originated or prepared by Contractor pursuant to the

Contract, including but not limited to, inventions, discoveries, intellectual copyrights, trademarks, trade names, trade secrets, technical communications, records reports, computer programs and other documentation or improvements thereto, including Contractor’s administrative communications and records relating to the Contract, are considered work product and Contractor’s property, provided that, State has Government Purpose Rights to that work product as and when it was delivered to State.

3.9.2. “Government Purpose Rights” are:

3.9.2.1. the unlimited, perpetual, irrevocable, royalty free, non-exclusive, worldwide right to use, modify, reproduce, release, perform, display, sublicense, disclose and create derivatives from that work product without restriction for any activity in which State is a party;

3.9.2.2. the right to release or disclose that work product to third parties for any State government purpose; and

3.9.2.3. the right to authorize those to whom it rightfully releases or discloses that work product to use, modify, release, create derivative works from the work product for any State government purpose; such recipients being understood to include the federal government, the governments of other states, and various local governments.

3.9.3. “Government Purpose Rights” do not include any right to use, modify, reproduce, perform, release, display, create derivative works from or disclose that work product for any commercial purpose, or to authorize others to do so.

3.9.4. Joint Developments. The Contractor and State may each use equally any ideas, concepts, know-how, or techniques developed jointly during the course of the Contract, and may do so at their respective discretion, without obligation of notice or accounting to the other party.

3.9.5. Pre-existing Material. All pre-existing software and other Materials developed or otherwise obtained by or for Contractor or its affiliates independently of the Contract or applicable Purchase Orders are not part of the work product to which rights are granted State under subparagraph 3.9.1 above, and will remain the exclusive property of Contractor, provided that:

3.9.5.1. any derivative works of such pre-existing Materials or elements thereof that are created pursuant to the Contract are part of that work product;

3.9.5.2. any elements of derivative work of such pre-existing Materials that was not created pursuant to the Contract are not part of that work product; and

3.9.5.3. except as expressly stated otherwise, nothing in the Contract is to be construed to interfere or diminish Contractor’s or its affiliates’ ownership of such pre-existing Materials.

3.9.6. Developments Outside Of Contract. Unless expressly stated otherwise in the Contract, this Section does not preclude Contractor from developing competing Materials outside the Contract, irrespective of any similarity to Materials delivered or to be delivered to State hereunder.

Direct Contract, Uniform Terms and…