CWDB_Request_for_Offer_No_106324.pdf

Support and Continued Development of the Cal-E-Force System and Applications for the California Workforce

Development Board (CWDB)

Technology, Digital and Data Consulting Master Service Agreement

Request for Offer (RFO) #106324

Date: September 12, 2024

State of California Employment Development Department/California Workforce Development Board

RFO EDD/CWDB #106324

TDDC MSA

Page i

INVITATION

You are invited to review and respond to this Request for Offer (RFO) #106324 for Support and Continued Development of Cal-E-Force System (CEF) and Applications for the CWDB. The Employment Development Department (EDD), on behalf of CWDB, is issuing this RFO. The services and products required are delineated in Section 1 Scope of Work (SOW) of this RFO.

The term of the resulting Agreement will be a one-time contract, running from October 7, 2024 (or upon final approval) through February 28, 2025.

This RFO does not constitute a commitment by the State of California to award a contract. The State reserves the right to reject any or all Offers received if the State determines that it is in the State’s best interest to do so.

All documents submitted in response to this RFO will become the property of the State of California and will be regarded as public records under the California Public Records Act (Government Code section 6250 et seq.) and subject to review by the public.

To be considered for this RFO, the Respondent must hold a current Technology, Digital and Data Consulting Master Service Agreement (TDDC MSA), issued by the Department of General Services (DGS), and provide a copy with the response. This RFO and the selected Contractor’s Offer will be attached and incorporated by reference into the resulting Agreement. The Contractor’s TDDC MSA, by reference, will be made part of any Agreement resulting from this RFO. The Agreement will be governed by, and shall incorporate the terms and conditions of, the Respondent’s TDDC MSA. The Respondent must be able to provide all the service line items.

The EDD/CWDB must receive both your TDDC MSA and your Offer by 5:00 PM PST on September 27, 2024. Offers not received by this date and time will be rejected.

If you wish to participate, follow the instructions in this RFO and send your offer via email to the Procurement Official below:

Cory Buttler, Associate Contract Analyst Email: BOPSDContractsExternal@edd.ca.gov mailto:BOPSDContractsExternal@edd.ca.gov

RFO EDD/CWDB #106324

TDDC MSA

Page ii

INSTRUCTIONS FOR RESPONSE

Please read the enclosed document carefully. This RFO contains the requirements that interested Contractors must meet in order to submit a responsive Offer. It provides information regarding the format in which Offers must be submitted, the material to be included, the requirements that must be met to be eligible for consideration, and the Contractor’s responsibilities.

Offers submitted in response to this RFO must contain all data/information requested and must conform to the format prescribed. It is the Respondent’s responsibility to provide all required data and other information deemed necessary for the State’s team to determine and verify the Consultant’s ability to perform the tasks and activities defined in Section I, Scope of Work (SOW). Offers may be disqualified if they fail to respond completely to RFO requirements and subsequent Addenda.

EDD/CWDB will compare Offers submitted in response to this RFO using best value methodology with cost as one of the criteria for award.

The following attachments are incorporated by reference as part of this RFO:

General Provisions - Information Technology (GSPD-401-IT, revised 6/21/22):

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model- Language/IT/ITGeneralProvisions062122.pdf

Cloud Computing General Provisions - Software as a Service (SaaS) (Effective 6/21/22):

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model- Language/CloudComputing_SaaSGeneralProvisions062122.pdf

Respondents must submit the Offer in a format compatible with the standard software applications (i.e., Microsoft Office, Adobe Acrobat). EDD’s/CWDB’s current standard software applications include Microsoft (MS) Windows 7, MS Office Professional (including Outlook) 2010, Adobe Acrobat XI Pro, Visio 2003, and MS Project 2010.

Signatures may be submitted in electronic form or as a scan of a signed original.

The EDD/CWDB must receive your TDDC MSA and Offer by 5:00 PM PST on September 27, 2024.

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/IT/ITGeneralProvisions062122.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/IT/ITGeneralProvisions062122.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CloudComputing_SaaSGeneralProvisions062122.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CloudComputing_SaaSGeneralProvisions062122.pdf

TABLE OF CONTENTS

1 SCOPE OF WORK

1.1 SCOPE

1.2 Salesforce as the Platform

1.3 PROJECT PHASES AND TIMEFRAMES

1.4 DELIVERABLES

1.5 PREMIER SUCCESS ELEMENTS

2 BUDGET DETAIL AND PAYMENT PROVISIONS

2.1 INVOICING AND PAYMENT

2.2 BUDGET CONTINGENCY CLAUSE

2.3 PROMPT PAYMENT CLAUSE

2.4 WORK AUTHORIZATION PROCESS

3 SPECIAL TERMS AND CONDITIONS

3.1 SETTLEMENT OF DISPUTES

3.2 FORCE MAJEURE

3.3 AGENCY LIABILITY

3.4 WORKFORCE INNOVATION AND OPPORTUNITY ACT

3.5 ADVANCE WORK

3.6 TERMINATION CLAUSE

3.7 EXECUTIVE ORDER N-6-22 RUSSIAN SANCTIONS

3.8 GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REQUIREMENTS

3.9 PROTECTION OF CONFIDENTIALITY

3.10 SAFEGUARDING CONTRACT LANGUAGE – ADMINISTRATIVE REQUIREMENTS

3.11 SAFEGUARDING CONTRACT LANGUAGE FOR TECHNOLOGY SERVICES

4 ATTACHMENTS

4.1 ATTACHMENT 1 – REQUIRED ATTACHMENT CHECKLIST

4.2 ATTACHMENT 2 – PRICE TABLE

4.3 ATTACHMENT 3 - PAYEE DATA RECORD (STD 204)

4.4 ATTACHMENT 4 – WORKERS’ COMPENSATION CERTIFICATION

4.5 ATTACHMENT 5 – PROOF OF REGISTRATION – CALIFORNIA SECRETARY OF STATE ... 27

4.6 ATTACHMENT 6 – CERTIFICATION REGARDING LOBBYING

4.7 ATTACHMENT 7 – DISCLOSURE OF LOBBYING ACTIVITIES

4.8 ATTACHMENT 8 – CERTIFICATION REGARDING DEBARMENT

4.9 ATTACHMENT 9 – CONFIDENTIALITY STATEMENT

4.10 ATTACHMENT 10 – VENDOR/CONTRACTOR CONFIDENTIALITY STATEMENT

4.11 ATTACHMENT 11 – INDEMNITY AGREEMENT

4.12 ATTACHMENT 13 – IRAN CONTRACTING ACT CERTIFICATION

4.13 ATTACHMENT 14 – CALIFORNIA CIVIL RIGHTS LAWS CERTIFICATION

4.14 ATTACHMENT 15 – BIDDER DECLARATION

4.15 ATTACHMENT 16 – GEN AI DISCLOSURE & FACTSHEET

4.16 ATTACHMENT 17 – COMPLETE COPY OF THE COMPANY’S SLP CONTRACT

ATTACHMENT A – IMPLEMENTATION APPROACH for CAL-E-FORCE

4.12 ATTACHMENT 12 – DATA DESTRUCTION CERTIFICATION FORM

RFO EDD/CWDB #106324

TDDC MSA

1 SCOPE OF WORK

1.1 SCOPE

The Salesforce Lightning Government Cloud is the platform for the Cal-E-Force (CEF) System that includes two (2) deployed applications – Cal-E-Program (CEP) and Cal-E-Grants (CEG).

Cal-E-Grants is continuing to add additional Grants and Grant Management modules, and Cal- E-Program is in the enhancement phase. The Cal-E-Grant application is supported by California Workforce Development Board (CWDB) and also used by the Employment Training Panel (ETP), and Division of Apprenticeship Standards (DIR DAS). All these applications are part of the one Salesforce “org” environment.

Salesforce will deliver, provide and support the necessary environments for the CWDB Online solution that will be used by both internal and external users. It will include a full complement of environment sandboxes, security modules, and analytic and interface tools. It also includes plug-in modules for forms generation and e-signature. Salesforce will provide technical services in support of these environments during both development of CWDB solutions and during production. Once in production a full range of internal and external licenses are maintained to access the system.

The implementation services are needed to: (1) reconfigure the current “org” as new functionality is deployed; (2) enhance the current Cal-E-Program system based on change control items; Panel updates, Application redo, etc.; (3) Continue to build out the full functionality for a Grant Management System for each of the Grant types; (4) develop analytic tools that can access the viability of grant programs; (5) enhance the human resource and fiscal planning modules; (6) other changes as needed to be CWDB and ETP business needs and Labor and Workforce Development Agency (LWDA) directives; and (7) provide executive level management support to coordinate the many moving development activities.

As part of the Best Value to CWDB/EDD, the selected reseller will provide the specific services needed to complete the defined implementation services specified in Approved Work Authorizations. To meet the work authorization schedule and deliverables, minimum qualifications for the technical labor categories are defined. Lastly, they must have worked with Grants solutions for government agencies. No resources will be considered without this knowledge and experience. It is understood that these resources are not the staff of the product resellers and that multiple resellers can provide the same individual resources. Specific Response to these requirements should be provided as Attachment A – Implementation Approach for Cal-E-Force.

1.2 Salesforce as the Platform

Salesforce was determined the best fit for the development of the Cal-E-Force systems. It helps CWDB and other Labor agencies target the right audience and deliver to market a solution in an iterative method. The Salesforce Government Cloud platform is secure, including top standards like FedRAMP, DoD IL2/4, and SOC. CWDB will be including the license for the Salesforce Shield product to add additional security features. With the use of Salesforce, CWDB can become more responsive, effective, and efficient. As part of the agreement, Salesforce will provide:

for CWDB – development, training, staging and production

RFO EDD/CWDB #106324

TDDC MSA

Customer Support Plans Advisory Services Learning and Tutorials Free Online Training In-Class Learning Certification Communities Trailblazer Community & Partner Community Resources Documentation Knowledge Base Contact Support Admin Network

Salesforce will continue to provide its standard support elements associated with a top tier client account. They will continue to oversee the configuration of the environments for CWDB and will review the major deliverables of the Cal-E-Force development and deployment phases.

This will be done to ensure Salesforce standards for application development – the use of declarative process rather than customer code. CWDB will utilize a blend of licenses and will also use the Salesforce Community Licenses for external customers that access the environments as part of applying for and managing an CWDB contract.

1.3 PROJECT PHASES AND TIMEFRAMES

Each work authorization will define a specific phases and/or deliverable. Each will have a set timeframe. It is anticipated that there will be at least 9 Work Authorization packages for the various activities needed to be completed this next year.

RFO EDD/CWDB #106324

TDDC MSA

1.3.1 Item List

Provided here and reflected on Attachment 2 – Price List are the required part numbers. Please note that the implementation services will be purchases based on signed work authorizations (Ref #1 through #5).

The work authorization process is included this RFO as Section 2.4 – Work Authorization process.

Implementation Services - Core and Grants

Software Engineer

Senior Enterprise Architect

Business Intelligence Analyst

Project Manager

Technical Architect

1.4 DELIVERABLES

Salesforce will provide the following deliverables:

Implementation Support – As needed use the features of premier support.

User Training – Salesforce will make recommendations on classes to be taken for

CWDB to gain proficiency. As needed specific assistance with gaining skills as Administrators and Developers will be provided. Salesforce will provide access to its on line training tools and products.

Post-Implementation Support – Salesforce will provide post-implementation technical and user support as required. In addition, Salesforce customer support team will provide the additional development support to continue to automate CWDB processes.

Implementation Services – will be driven by work authorizations for specific work packages. All works will be within the Salesforce “org” and/or with the plug-in packages

RFO EDD/CWDB #106324

TDDC MSA

that are provided

1.5 PREMIER SUCCESS ELEMENTS

This RFO includes the required services needed for Cal-E-Force System. The core of the CWDB solution is the Implementation Services , represented on the Price List as Line Items 1-

5. GENERAL

CWDB will be able to submit cases over the Web or by telephone. Sales Force Dot Com (SFDC) will use reasonable efforts to respond to each case. Actual resolution time will depend on the nature of the case and the resolution. A resolution may consist of a fix, workaround or other solution in SFDC's reasonable determination.

CWDB’s Designated Contacts shall:

Oversee Customer’s support case activity, Develop and deploy troubleshooting processes within Customer’s organization, and Resolve password reset, username and lockout issues for Customer. CWDB will ensure that Designated Contacts:

Have completed, at a minimum, the basic Services administration course currently titled “Administration Essentials,” which is included at no additional charge as part of online training, Have completed any supplemental training appropriate for the Designated Contact’s specific role or Customer’s usage of the Services, Are knowledgeable about the applicable Services in order to help resolve, and to assist SFDC in analyzing and resolving, technical issues, and

Have a basic understanding of any problem that is the subject of a case, and the ability to reproduce the problem in order to assist SFDC in diagnosing and triaging it.

Co-ordinate Success Program activities with SFDC Success Program representatives, as applicable

1.5.1 SUPPORT PROCESSES

Telephone (Salesforce) Support - Telephone support in English is available twenty-four hours a day, seven days a week. Telephone support in French, German, Italian and Spanish is available from 8:00 a.m. to 6:00 p.m. GMT, excluding weekends and holidays.

Main toll- free Customer Support telephone number is 1-866-614-7375

Submitting a Case - CWDB Users may submit a case in any of the following ways:

In the Services by logging in, clicking “Help & Training,” clicking “Contact Support,” and clicking “Open a Case,” then providing the requested information and clicking “Submit.” Premier and Premier+ cases are priority-routed to the appropriate support teams.

By telephone call to Customer Support as described above. For Severity Level 1 issues, Customer must call Customer Support.

Severity Levels and Response Time - Issues will be categorized and handled according to an assigned severity level. The case severity level is selected by the User at time of case submission, see standard Salesforce support documentation.

Key Support Teams – the following teams will be available:

RFO EDD/CWDB #106324

TDDC MSA

Developer Support. CWDB will have access to developer support staff.

Success Manager. CWDB will have access to Success Managers. The CWDB

Success Manager will be product and market experts who engage with CWDB. They will assist with Salesforce product adoption and utilization, including sharing advice and guidance related to optimizing Customer’s ongoing use of Salesforce. CWDB is responsible for evaluating any advice or guidance received from SFDC and for implementing any such advice and guidance.

Accelerators. CWDB will be provided access to Accelerators. Accelerators are designed to provide tailored recommendations and/or best practice guidance on Customer’s applicable Salesforce subscriptions. CWDB may consume Accelerators one at a time, per instance.

Configuration Services. For CWDB, SFDC will perform the configuration services listed on the Help and Training website, accessible via help.salesforce.com or login to the applicable Service, upon request and as available by product. SFDC administrators will work in tandem with the Customer’s Designated Contacts to execute the configuration services based on Customer’s design specifications.

Customer is responsible for gathering business and functional requirements, design specifications, change management approvals, and documentation of configuration, and for designing and/or delivering training materials. SFDC will provide a complimentary User subscription to Customer for use by the SFDC administration team.

https://help.salesforce.com/articleView?id=000239782&amp%3Btype=1

RFO EDD/CWDB #106324

TDDC MSA

2 BUDGET DETAIL AND PAYMENT PROVISIONS

The following provisions will be included in the resultant Agreement.

2.1 INVOICING AND PAYMENT

1. The total amount of this Agreement shall not exceed _TBD _.

2. Payment will be made in arrears. Invoices will be submitted not more frequently than monthly.

3. All invoices must be submitted to:

California Workforce Development Board Attn: Asha Lata Invoinces@cwdb.ca.gov

2.2 BUDGET CONTINGENCY CLAUSE

It is mutually understood between the parties that this Agreement may have been written before ascertaining the availability of congressional and legislative appropriation of funds, for the mutual benefit of both parties, in order to avoid program and fiscal delays which would occur if the Agreement were executed after that determination was made.

This Agreement is valid and enforceable only if (1) sufficient funds are made available by the State Budget Act of the appropriate State Fiscal Year(s) covered by this Agreement for the purposes of this program; and (2) sufficient funds are made available to the State by the United States Government for the Fiscal Year(s) covered by this Agreement for the purposes of this program. In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by the Congress and Legislature or any statute enacted by the Congress and Legislature which may affect the provisions, terms, or funding of this Agreement in any manner.

It is mutually agreed that if the Congress and/or Legislature does not appropriate sufficient funds for the program, this Agreement shall be amended to reflect any reduction in funds.

The EDD/CWDB has the option to invalidate the Agreement under the 30-day cancellation clause or to amend the Agreement to reflect any reduction of funds.

2.3 PROMPT PAYMENT CLAUSE

Payment will be made in accordance with, and within the time specified in, Government Code, Title 1, Division 3, Chapter 4.5, Section 927 et seq.

mailto:Invoinces@cwdb.ca.gov

RFO EDD/CWDB #106324

TDDC MSA

2.4 WORK AUTHORIZATION PROCESS

The following rules shall apply for Work Authorizations (WAs):

2.4.1 General

Project milestones not described in the Contract shall be defined and agreed to through an approved WA. Milestones not specified in the purchase order or via an approved WA, may not be invoiced under the Agreement and are completed at the Contractor’s expense.

2.4.2 Content

Each WA shall contain a statement of the purpose, objective, or goals to be performed by the Contractor, the job classification or approximate skill level of the personnel to be made available by the Contractor, an identification of all milestones to be met by the Contractor and delivered to the State, an identification of all significant materials to be delivered by the State to the Contractor, a time schedule for the provisions of these services by the Contractor, Acceptance Criteria for the Milestones(s) produced, the name or identification of the Contractor personnel assigned, Contractor’s work hours required to produce the key milestones/objectives, and the total fixed cost of the WA.

2.4.3 Rates and Cost

The Contractor shall base prices for WAs on the reasonable number of staff hours required multiplied by the Contractor rates listed in Attachment 2 – Price List as appropriate. The Contractor shall not invoice the State in excess of the agreed upon cost total of the WA. The Contractor shall not charge the State for preparing a WA.

2.4.4 Approval

All WAs must be in writing and signed by the EDD/CWDB Executive prior to starting work. The terms and conditions of the Contract shall apply to all such WAs. In no event shall a WA be deemed to be a separate contract.

2.4.5 Form

The Contractor shall prepare a Work Authorization (WA) acceptance form for each WA (see attached form).

RFO EDD/CWDB #106324

TDDC MSA

SAMPLE FORM WORK AUTHORIZATION/ACCEPTANCE FORM

These milestones will be produced in accordance with this Work Authorization and the provisions of Contract Number M106324-7100 Work Authorization Number:

Purpose/Objective/Goal:

Description of Work:

Schedule of Work Completion:

Contractor Personnel to be Assigned/Job Classification or Skill Level:

State Responsibilities:

Acceptance Criteria:

Work Authorization Cost:

Payment Amounts and Terms

Services Description Total Hours Hourly Rate Total Cost

Total $

Signature:

[Contractor Name and Title] Date [CWDB Name and Title] Date

RFO EDD/CWDB #106324

TDDC MSA

3 SPECIAL TERMS AND CONDITIONS

The following terms and conditions will be included in the resultant Agreement

3.1 SETTLEMENT OF DISPUTES

In the event of a dispute between EDD/CWDB and the Contractor over any part of this Agreement, the dispute may be submitted to non-binding arbitration upon the consent of both EDD/CWDB and the Contractor. An election for arbitration pursuant to this provision shall not preclude either party from pursuing any remedy for relief otherwise available.

3.2 FORCE MAJEURE

Neither party shall be liable to the other for any delay in or failure of performance, nor shall any such delay in or failure of performance constitute default, if such delay or failure is caused by “Force Majeure.” As used in this section, “Force Majeure” is defined as follows: Acts of war (e.g., riots and strikes) and acts of God (e.g., such as earthquakes, floods, and other natural disasters) such that performance is impossible.

3.3 AGENCY LIABILITY

The Contractor warrants by execution of this Agreement, that no person or selling agency has been employed or retained to solicit or secure this Agreement upon agreement or understanding for a commission, percentage, brokerage, or contingent fee, excepting bona fide employees or bona fide established commercial or selling agencies maintained by the Contractor for the purpose of securing business. For breach or violation of this warranty, the State shall, in addition to other remedies provided by law, have the right to annul this Agreement without liability, paying only for the value of the work actually performed, or otherwise recover the full amount of such commission, percentage, brokerage, or contingent fee.

3.4 WORKFORCE INNOVATION AND OPPORTUNITY ACT

Contractor agrees to conform to nondiscrimination provisions of the Workforce Innovation and Opportunity Act (WIOA) and other federal nondiscrimination requirements as referenced in 29 CFR, Parts 37 and 38.

3.5 ADVANCE WORK

Should the Contractor begin work before receiving a copy of the approved Agreement, any work performed before approval shall be considered as having been done at the Contractor's own risk and as a volunteer.

3.6 TERMINATION CLAUSE

This Agreement may be terminated by EDD/CWDB by notifying the Contractor in writing 30 days prior to the effective date of termination.

3.7 EXECUTIVE ORDER N-6-22- RUSSIAN SANCTIONS

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals.

“Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. The EO

RFO EDD/CWDB #106324

TDDC MSA

directs state agencies to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. Accordingly, should the State determine the Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities that shall be grounds for termination of this Agreement. The State shall provide the Contractor advance written notice of such termination, allowing the Contractor at least 30 calendar days to provide a written response. Termination shall be at the sole discretion of the State.

3.8 GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REQUIREMENTS

During the term of the contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAI technology, including GenAI from third parties or subcontractors. Contractor shall immediately complete the GenAI Reporting and Factsheet (STD 1000) to notify the State of any new or previously unreported GenAI technology. At the direction of the State, Contractor shall discontinue the use of any new or previously undisclosed GenAI technology that materially impacts functionality, risk or contract performance, until use of such GenAI technology has been approved by the State.

Failure to disclose GenAI use to the State and submit the GenAI Reporting and Factsheet (STD 1000) may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAI and/or failure to submit the GenAI Reporting and Factsheet (STD 1000) as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief to which it may be entitled to as a result of such non-disclosure.

The State reserves the right to amend the contract, without additional cost, to incorporate GenAI Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.

RFO EDD/CWDB #106324

TDDC MSA

3.9 PROTECTION OF CONFIDENTIALITY

Federal and state confidentiality laws, regulations, and administrative policies classify all the Employment Development Department (EDD) information provided under this Agreement as confidential. The federal and state laws prohibit disclosure of the EDD’s confidential information to the public and mandate its protection against loss and against unauthorized access, use, disclosure, modification, or destruction.

The Contractor must therefore, agree to the following security and confidentiality requirements:

A. ADMINISTRATIVE SAFEGUARDS

a. Adopt policies and procedures to ensure use of the EDD’s confidential information solely for purposes specifically authorized under this Agreement that meet the requirements of Title 20, Code of Federal Regulations §603.10.

b. Warrant by execution of this Agreement, that no person or selling agency has been employed or retained to solicit or secure this Agreement upon agreement or understanding for a commission, percentage, brokerage, or contingent fee. In the event of a breach or violation of this warranty, the EDD/CWDB shall have the right to annul this Agreement without liability, in addition to other remedies provided by law.

c. Warrant and certify that in the performance of this Agreement the Contractor will comply with all applicable statutes, rules and/or regulations, and Agreement information security requirements, including but not limited to the following:

California Unemployment Insurance Code §1094 (Disclosure Prohibitions) Title 20, Code of Federal Regulations §603.9 and §603.10 (Federal

Unemployment Compensation Safeguards and Security Requirements) California Civil Code §1798, et seq. (Information Practices Act) California Penal Code §502 (Computer Fraud Act ) Title 5, U.S. Code §552a (Federal Privacy Act Disclosure Restrictions) Title 42, U.S. Code §503 (Social Security Act) Title 18, U.S. Code §1905 (Disclosure of Confidential Information)

d. Pursuant to section 5305.8 of the State Administrate Manual, the EDD Data Recipient shall be responsible for all costs incurred by the EDD due to security incident resulting from the EDD Data Recipient's failure to perform or negligent acts of its personnel, and resulting in an unauthorized disclosure, release, access, review, or destruction, or loss, theft, or misuse of an information asset. If the EDD Data Recipient experiences a loss or breach of data, the EDD Data Recipient shall immediately report the loss or breach to the EDD. If the EDD determines that notice to the individuals whose data has been lost or breached is appropriate, the EDD Data Recipient will bear any, and all costs associated with the notice, or any mitigation selected by the EDD. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data.

e. Protect the EDD’s/CWDB’s information against unauthorized access, at all times, in http://www.leginfo.ca.gov/cgi-bin/waisgate?WAISdocID=36803824002%2B1%2B0%2B0&WAISaction=retrieve

RFO EDD/CWDB #106324

TDDC MSA

all forms of media. Access and use the information obtained under this Agreement only to the extent necessary to assist in the valid administrative needs of the program receiving such information, and only for the purposes defined in this Agreement.

f. Keep all the EDD’s/CWDB’s confidential information completely confidential. Make this information available to authorized personnel on a "need-to-know" basis and only for the purposes authorized under this Agreement. “Need-to-know” refers to those authorized personnel who need information to perform their official duties in connection with the use of the information authorized by this Agreement.

g. Immediately upon discovery, notify the EDD Cybersecurity Division at InformationSecurityOffice@edd.ca.gov, that there may have been a breach in security which has or may have resulted in the disclosure of confidential information. For purposes of this section, immediately is defined within 24 hours of discovery of the breach.

The notification must include a detailed description of the incident (such as time, date, location, and circumstances) and identify the EDD Data Recipient personnel responsible (name, title and contact information) for handling breach disclosures. Please do not include any confidential information in the notification.

h. The EDD shall maintain the right to participate in the investigation of a security incident involving its data or conduct its own independent investigation. The EDD Data Recipient shall cooperate fully in such investigations.

B. MANAGEMENT SAFEGUARDS

a. Acknowledge that the confidential information obtained by the Contractor under this

Agreement remains the property of the EDD/CWDB.

b. Instruct all personnel assigned to work with the information provided under this

Agreement regarding the following:

Confidential nature of the EDD/CWDB information.

Requirements of this Agreement.

Sanctions specified in federal and state unemployment compensation laws and any other relevant statutes against unauthorized disclosure of confidential information provided by the EDD/CWDB.

c. Require that all personnel assigned to work with the information provided by the EDD/ CWDB complete the EDD/CWDB Confidentiality Agreement (Attachment 10):

d. Permit the EDD/CWDB to make on-site inspections to ensure that the terms of this Agreement are being met. Make available to the EDD/CWDB staff, on request and during on-site reviews, copies of the EDD/CWDB Confidentiality Agreement (Attachment 10) completed by personnel assigned to work with the EDD/CWDB’s confidential information, and hereby made a part of this Agreement.

e. Maintain a system of records sufficient to allow an audit of compliance with the requirements under subsection (d) of this part. Permit the EDD/CWDB to make on-site inspections to ensure that the requirements of federal and state privacy, confidentiality and unemployment compensation statutes and regulations are being met including but not limited to §1137(a)(5)(B) of the Social Security Act.

mailto:InformationSecurityOffice@edd.ca.gov http://www.ssa.gov/OP_Home/ssact/title11/1137.htm

RFO EDD/CWDB #106324

TDDC MSA

C. USAGE, DUPLICATION, AND DISCLOSURE SAFEGUARDS

a. Use the EDD/CWDB’s confidential information only for purposes specifically authorized under this Agreement. The information is not admissible as evidence in any action or special proceeding except as provided under §1094(b) of the California Unemployment Insurance Code (CUIC). Section 1095(u) of the CUIC does not authorize the use of the EDD/CWDB’s confidential information by any private collection agency.

b. Extraction or use of the EDD/CWDB information for any purpose outside the purposes stated in this Agreement is strictly prohibited. The information obtained under this Agreement shall not be reproduced, published, sold, or released in original or any other form not specifically authorized under this Agreement.

c. Disclosure of any of the EDD information to any person or entity not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with the EDD’s confidential information shall not reveal or divulge to any person or entity any of the confidential information provided under this Agreement except as authorized or required by law. The EDD Data Recipient shall immediately notify and work cooperatively with the EDD to respond timely and correctly to public records act requests that it receives related to information obtained under this Agreement. Access to public records is governed by the California Public Records Act, Government Code §7920-7931.

D. PHYSICAL SAFEGUARDS

a. Take precautions to ensure that only authorized personnel are given access to physical, electronic and on-line files. Store electronic and hard copy information in a place physically secure from access by unauthorized persons. Process and store information in electronic format, such as magnetic tapes or discs, in such a way that unauthorized persons cannot retrieve the information by means of computer, remote terminal, or other means.

b. Secure and maintain any computer systems (network, hardware, and software applications) that will be used in the performance of this Agreement. This includes ensuring that all security patches, upgrades, and anti-virus updates are applied as appropriate to secure data that may be used, transmitted, or stored on such systems in the performance of this Agreement.

c. Store all the EDD/CWDB’s confidential documents in a physically secure manner at all times to prevent unauthorized access.

d. Store the EDD/CWDB’s confidential electronic records in a secure central computer facility. Where in-use on a shared computer system or any shared data storage system, ensure appropriate information security protections are in place. The Contractor shall ensure that appropriate security access controls, storage protections and use restrictions are in place to keep the confidential information in the strictest confidence and shall make the information available to its own personnel on a "need-to-know” basis only.

e. Store the EDD/CWDB’s confidential data in encrypted format when recorded on removable electronic storage media, or on mobile computing devices, such as a

RFO EDD/CWDB #106324

TDDC MSA

laptop computer.

f. Maintain an audit trail and record data access of authorized users and authorization level of access granted to the EDD/CWDB’s data, based on job function.

g. Direct all personnel permitted to use the EDD/CWDB’s data to avoid leaving the data displayed on their computer screens where unauthorized users may view it.

Personnel should retrieve computer printouts as soon as they are generated so that the EDD/CWDB’s data is not left unattended in printers where unauthorized personnel may access them.

h. Dispose of confidential information obtained from the EDD/CWDB, and any copies thereof made by the Contractor, after the purpose for which the confidential information is disclosed is served. Disposal means return of the confidential information to the EDD/CWDB or destruction of the information utilizing an approved method of confidential destruction, which includes electronic deletion (following Department of Defense specifications) shredding, burning, or certified or witnessed destruction.

i. Certify the disposal of the EDD confidential information on the Data Destruction Certification (Attachment 12). The Data Destruction Certification shall be submitted to the EDD Contract Monitor annually, beginning one year from the start date of the agreement. The EDD Data Recipient shall destroy the information in accordance with the retention schedule listed in the Scope of Work / Contract Term (Exhibit A).

RFO EDD/CWDB #106324

TDDC MSA

3.10 SAFEGUARDING CONTRACT LANGUAGE – ADMINISTRATIVE REQUIREMENTS

The following administrative requirements must be completed before services are performed in accordance with the Contract. The Contractor is responsible for any costs or expenses related to time for completing these items. The Employment Development Department (EDD) may terminate the Contract and be relieved of any payments should the Contractor fail to perform the requirements of the Background Investigation at the time and in the manner described below:

a. Background Investigation

Pursuant to Government Code section 1044, the EDD shall conduct a background investigation of the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who will have access to Federal Tax Information (FTI) as part of their duties under this Agreement; and reserves the right to disapprove any individual from performing services under the scope of this Agreement. The Background Investigation will include fingerprinting and an inquiry to the California Department of Justice (DOJ) and the Federal Bureau of Investigations (FBI) to disclose Criminal Offender Record Information (CORI). Investigations are conducted to ascertain whether a Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors have any state or federal convictions, or are currently released from custody on bail or on their own recognizance pending trial.

Each Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who are to perform services under this Agreement must voluntarily consent to a Background Investigation. Fingerprint rolling fees and Background Investigation costs will be borne by the EDD if the preferred fingerprint rolling vendor is utilized. If the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors choose to go to a non-preferred Live Scan fingerprint vendor, the costs will be borne by the Contractor, payable at the time of fingerprinting and will not be reimbursed by the EDD. Previous clearances and/or investigations conducted by other agencies will not be accepted as an alternative to the EDD's Background Investigation.

Once this Contract is awarded, it is the responsibility of the Contractor to provide a list of names of individuals who will be working on site at an EDD location or working remotely with access to EDD information (data) and/or information assets (servers, workstations, routers, switches, printers, etc.) to the Contract Monitor. The Contractor will be provided BCIA 8016 forms for its employees, contractors, agents, volunteers, vendors, or subcontractors to utilize for their fingerprint rolling at an EDD preferred fingerprint rolling vendor. The EDD will receive the CORI reports from DOJ and evaluate the information provided against the EDD’s established criteria. The Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors must successfully pass a background investigation pursuant to the EDD’s criteria prior to the EDD issuing a badge or access to the EDD’s data.

Within 5 business days, the Contractor shall notify the EDD Contract Monitor when its employee, contractor, agent, volunteer, vendor, or subcontractor, working under this

RFO EDD/CWDB #106324

TDDC MSA

Agreement is terminated, not hired, or reassigned to other work. Within 5 business days, the Contractor shall notify the EDD Contract Monitor when its new employee, contractor, agent, volunteer, vendor, or subcontractor is assigned to work under this Agreement in order for the EDD to commence conducting a background investigation of its new employee, contractor, agent, volunteer, vendor, or subcontractor.

b. Annual Information Security Awareness and Privacy Training

California state policy requires that the EDD must provide for the proper use and protection of its information assets and arrange for basic security and privacy awareness training (SAM sections 5305.1, 5320.1, 5320.2, 5320.3, SIMM 5330-B) for new users and annually thereafter. Therefore, the Contractor, its employees, contractors, agents, volunteers, vendors, or subcontractors who access state resources must complete the designated EDD online annual Information Security Awareness and Privacy Training prior to accessing EDD information assets and/or beginning work on a contract. The EDD University will set up a training account. While the training course is provided by the EDD, any expenses, including Contractor time, related to new and/or annual Information Security Awareness and Privacy Training will be the responsibility of the Contractor.

RFO EDD/CWDB #106324

TDDC MSA

3.11 SAFEGUARDING CONTRACT LANGUAGE FOR TECHNOLOGY SERVICES

I. PERFORM A NCE

In performance of this Contract, the Contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements:

(1) All work will be done under the supervision of the Contractor or the Contractor's employees.

(2) The Contractor and the Contractor's employees, Contractors, agents, volunteers, vendors, or subcontractors must meet the background check requirements provided in Exhibit E of this Contract.

(3) Any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this Contract. Disclosure to anyone other than an officer or employee of the Contractor will be prohibited.

(4) All returns and return information will be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.

(5) The Contractor certifies that the data processed during the performance of this Contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the Contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the Contractor certifies that any Internal Revenue Service (IRS) data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the agency or his or her designee. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and will provide the agency or his or her designee with a statement containing the date of destruction, description of material destroyed, and the method used.

(7) All computer systems receiving, processing, storing or transmitting federal tax information (FTI) must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this Contract will be subcontracted without prior written approval of the IRS.

(9) The Contractor will maintain a list of employees authorized access. Such list will be provided to the agency and, upon request, to the IRS reviewing office. (See Section 10.0, Reporting Improper Inspections or Disclosures of the IRS Publication 1075.) The agency will have the right to void the Contract if the Contractor fails to provide the safeguards described above.

RFO EDD/CWDB #106324

TDDC MSA

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRCs 7213 and 7431 and set forth in 26 C.F.R. § 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC 7213A and 7431 and set forth in 26 C.F.R. § 301.6103(n)-1.

(3) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. § 552(a). Specifically, 5 U.S.C. § 552(a)(i)(1), which is made applicable to Contractors by 5 U.S.C. § 552(a)(m)(1), provides that any officer or employee of a Contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a Contractor access to FTI must be preceded by certifying that each individual understands the agency's security policy and procedures for safeguarding IRS information. Contractors must maintain their authorization to access FTI through annual recertification. The initial certification and recertification must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A.

(See Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure of the IRS Publication 1075). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10.0, Reporting Improper Inspections or Disclosures of the IRS Publication 1075.) For both the initial certification and the annual certification, the Contractor must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

RFO EDD/CWDB #106324

TDDC MSA

Ill. INSPECTION

The IRS and the agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the Contractor to inspect facilities and operations performing any work with FTI under this Contract for compliance with requirements defined in IRS Publication 1075. The IRS' right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology assets that access, store, process or transmit FTI.

On the basis of such inspection, corrective actions may be required in cases where the Contractor is found to be noncompliant with Contract safeguards.

* Language used throughout this Exhibit is derived from IRS Publication 1075

RFO EDD/CWDB #106324

TDDC MSA

4 ATTACHMENTS

4.1 ATTACHMENT 1 – REQUIRED ATTACHMENT CHECKLIST

CHECK

ATT # DOCUMENT NAME/DESCRIPTION FORM

PROVIDED

FORM

REQUIRED

1 Required Attachment Checklist YES

2 Price List YES

3 Payee Data Record (STD 204) YES

4 Workers’ Compensation…