DMV_RFQ__FOD24-2103_SECTION_III.pdf

Department of Motor Vehicles RFQ #FOD24-2103, Section III

Exhibit A, Page 1 of 12

STATEMENT OF WORK

A. CONTRACT DESCRIPTION AND SCOPE

The Contractor will provide the Department of Motor Vehicles (DMV) the rental of postage systems, including all labor, tools, materials, equipment (including replacement meters), supervision, travel, shipping and handling costs, taxes, delivery, set up and removal of equipment, repairs, insurance, and permit fees necessary to maintain the postage systems in good working condition for term of this Agreement. The Contractor will provide equipment at the locations listed in Exhibit D, Field Office Locations.

The Contractor shall commence work under this Agreement on the specified start date provided by the DMV Project Manager following the execution of this Agreement by the State. The DMV Project Manager shall provide the Contractor with written notification of the start date prior to the Contractor commencing work under this Agreement.

The DMV may suspend services at any time during the term of this Agreement upon three

(3) calendar days’ written notice to the Contractor. The DMV may choose to reinstate suspended services at any time during the term of this Agreement and shall provide ten

(10) calendar days’ written notice to the Contractor. The DMV does not guarantee a minimum or maximum use of this Agreement.

The services shall be provided during DMV business hours, Monday through Friday, 8:00 am - 5:00 pm, except State holidays. The specific service day and time shall be coordinated with the DMV Office Manager at each office location indicated in Exhibit D, Field Office Locations.

B. CONTRACT TERM

The term of this contract shall be twenty-five (25) months. Upon the contract start date, the first month (30 calendar days) is a “Contract Transition” period for onboarding of the new Contractor as required in Section E, #2, Contract Transition. In the event the contract is awarded to the DMV’s postage system rental incumbent, the one (1) month Contract Transition period will not be required and rental of the postage systems will begin on April 1, 2025 for a twenty-four month term.

It is understood that no funds sufficient for the purpose of this order have been appropriated until such time as the budget for each fiscal year covered by the agreement has been adopted by the Legislature and signed by the Governor.

C. CONTRACTOR’S RESPONSIBILITIES

1. The Contractor shall assume responsibility for completion of work identified in Exhibit

A, Statement of Work and in accordance with Exhibit C, Information Security and Privacy Provisions (04/2022).

Exhibit A, Page 2 of 12

2. The Contractor Official responsible for overseeing completion of services and to whom all communications relative to those services be addressed is:

Name: TO BE DETERMINED

Telephone Number:

Email Address:

3. The Contactor must provide only one contact to address all of the DMV’s service needs. The DMV will not accept more than one (1) Contractor contact as it will delay completion of the DMV’s service requests.

4. The Contractor shall comply with all applicable health and safety laws and regulations at the Contractor’s own expense. Upon notice by the DMV, the Contractor shall also comply with the DMV’s specific health and safety requirements and policies. The Contractor also agrees to include in any subcontract related to the performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice by the DMV, the DMV’s specific health and safety requirements and policies.

5. Contractor shall comply with the Department of Transportation Federal Motor Carrier Safety Administration Non-Discrimination Assurances located at:

https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/

6. Small Business Participation and DVBE Participation Reporting Requirements:

A. If for this Contract the Contractor made a commitment to achieve small business participation, then the Department requires the Contractor upon completion of this Contract to report the actual percentage of small business participation that was achieved. (Govt. Code § 14841)

B. If for this Contract the Contractor made a commitment to achieve the disabled veteran business enterprise (DVBE) participation goal, then, pursuant to Mil. & Vets. Code § 999.5(d), upon completion of this Contract, the Department requires the Contractor to certify using the Prime Contractor’s Certification – DVBE Subcontracting Report (STD 817), all of the following:

1. The total amount the prime Contractor received under the Contract;

2. the name, address, Contract number and certification ID number of the

DVBE(s) that participated in the performance of this Contract;

3. the amount and percentage of work the prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor;

4. that all payments under the Contract have been made to the DVBE(s); and

5. the actual percentage of DVBE participation that was achieved. Upon request, the prime Contractor shall provide proof of payment for the work.

Exhibit A, Page 3 of 12

C. If for this Contract the Contractor made a commitment to achieve the DVBE participation goal, the Department will withhold $10,000 from the final payment, or the full final payment if less than $10,000, until the Contractor complies with the certification requirements above. The Contractor shall e- mail the STD 817 to dmvasdsbdvbeadvocate@dmv.ca.gov.

D. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 calendar days but not more than 30 calendar days from the date of written notice, the prime contractor refuses to comply with the certification requirements, the Department shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets. Code § 999.7).

E. A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code § 999.5(d); Govt. Code § 14841).

F. Contractor agrees to comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Mil. & Vets. Code, including, but not limited to, the requirements of Section 999.5(d). (PCC Code § 10230).

7. Contractor shall comply with Executive Order N-6-22, Economic Sanctions Against Russia. The Executive Order is available at the following website:

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive- Order.pdf.

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals.

“Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

8. During the term of the contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAI technology, including GenAI from third parties or subcontractors.

Contractor shall immediately complete the GenAI Reporting and Factsheet (STD 1000) to notify the State of any new or previously unreported GenAI technology. At the direction of the State, Contractor shall discontinue the use of any new or previously undisclosed GenAI technology that materially impacts functionality, risk or contract performance, until use of such GenAI technology has been approved by the State. Failure to disclose GenAI use to the State and submit the GenAI Reporting and Factsheet (STD 1000) may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAI and/or failure to submit the GenAI Reporting and Factsheet (STD 1000) as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief

Exhibit A, Page 4 of 12 to which it may be entitled to as a result of such non-disclosure. The State reserves the right to amend the contract, without additional cost, to incorporate GenAI Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.

9. The Contractor shall provide to the DMV Contract Manager a copy of the insurances listed below within 10 calendar days after contract award. The State requires that the Certificate Holder on the Certificate of Insurance include the DMV’s address as:

Department of Motor Vehicles, 2415 1st Avenue, Sacramento, CA 95818, and the DMV Contract Number.

A. General Provisions Applying To All Insurance Policies

1. Coverage Term:

Coverage shall be in force for the entire term of this contract. If insurance expires during the term of this contract, a new certificate of Insurance shall be received by the DMV at least ten (10) business days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of this contract.

2. Policy Cancellation of Termination and Notice of Non-Renewal:

The Contractor shall provide to the DMV, within five (5) business days following receipt by the Contractor, a copy of any cancellation or non- renewal of insurance required under this contract. In the event the Contractor fails to keep the required insurance coverage in effect at all times, the DMV may, in addition to any other remedies it may have, terminate this contract upon the occurrence of such event.

3. Deductible

The Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause

Any required insurance specified under this contract shall be primary, and not excess or contributory to any other insurance carried by the DMV.

5. Insurance Carrier Required Rating

All insurance companies shall carry a rating acceptable to the Department of General Services (DGS), Office of Risk and Insurance Management (ORIM). Per DGS ORIM, an acceptable rating is “A” or better, and financial size category of “VII” or better to the latest edition of the A.M. Best Key Rating Guide. If the Contractor is self-insured for a portion or all of its insurance, a review of the Contractor’s financial information, including a letter of credit, may be required.

6. Endorsements

Any required endorsement shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

Exhibit A, Page 5 of 12

7. Inadequate Insurance

Inadequate insurance or lack of insurance does not negate the Contractor’s obligations under this contract.

B. Commercial General Liability

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is commercial general liability insurance presently in effect for the Contractor with limits of not less than $1,000,000.00 per occurrence for bodily injury and property damage liability combined. The policy shall include coverage for liabilities arising out of premises operations, independent contractors, products/completed operations, personal and advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

2. The insurance policy shall include the following additional insured endorsement that shall be supplied under form acceptable to DGS, ORIM:

The State of California, its officers, agents and employees are included as additional insured, but only with respect to work performed for the State of California.

C. Automobile Liability

By signing this contract, the Contractor certifies that the Contractor and any of their employees or subcontractors using a vehicle in the performance of work under this contract possesses valid automobile liability coverage in accordance with California Vehicle Code Sections 16450 to 16457, inclusive. The DMV reserves the right to request proof at any time.

D. Workers Compensation

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor, if the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California. The Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract. Employer’s liability limits of not less than $1,000,000.00 are required. If the Contractor does not employ any person, in any manner, so as to not become subject to the Workers Compensation Laws of California, the Contractor shall complete and submit to the DMV Contract Administrator, a Workers Compensation Exemption Certification form.

2. In the event the Contractor becomes subject to the Workers Compensation Laws of California during the term of this contract as a result of hiring employees to perform required services under this contract, the Contractor shall provide the DMV within ten (10) calendar days of hiring employee, with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor. The Contractor shall maintain

Exhibit A, Page 6 of 12 statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract.

Employer’s liability limits of not less than $1,000,000.00 are required.

3. The Contractor’s workers compensation insurance policy shall be endorsed with a waiver of subrogation in favor of the State of California in the event the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California.

D. DMV’S RESPONSIBILITIES

1. The DMV shall comply with all USPS regulations regarding the use of the postage systems and the printing of postage.

2. Provide access to the DMV staff, management, offices, and operation areas as required to complete the tasks defined under this contract.

3. The DMV Contract Manager responsible for overseeing the Contractor’s performance and the Contractor’s completion of requested services is:

Name: TO BE DETERMINED

Telephone Number:

Email Address:

E. CONTRACTOR TASKS/DELIVERABLES

1. Equipment

The postage systems must comply with the following specifications:

a. Must have Intelligent Mail Indicia (IMI) technology to meet the United States Postal Service’s (USPS) IMI standards. The postage systems shall utilize IMI technology at the start of this Agreement in order to mitigate any transitional period from an Information Based Indicia Program (IBIP) to IMI.

b. Must have an integrated differential digital scale capable of calculating postage rates up to 15 lbs.

c. Must have an automatic feeder.

d. Must have a digital meter.

e. Must weigh no more than 45 lbs., allowing for movement/placement in the offices.

2. Contract Transition

a. The first and last 30 days of this Agreement are hereby identified as “Contract Transition” for transitioning the performance of services under existing DMV postage rental system agreement(s) to the new postage rental system agreement(s) with different vendors (when applicable) in order to prevent service interruptions. During this period, the Contractor shall communicate with DMV IT the network requirements.

Exhibit A, Page 7 of 12

b. Within ten (10) business days of the contract start date, the Contractor shall submit a transition schedule as provided in Exhibit E, Transition Schedule, to the DMV Contract Manager identifying all contracted locations and proposed dates of transition during the first 30 days. No transition will be required if the Contractor is the same Contractor under the DMV’s existing postage rental system agreement (incumbent).

c. During the first 30 days of this Agreement, the Contractor agrees to transition the performance of services required under this Agreement from other contractors under existing DMV agreements when applicable and as follows:

1. The Contractor must transition a minimum of 20 offices per day to ensure transition is completed within the one (1) month contract transition period.

2. The Contractor’s first invoice shall be pro-rated in accordance with the actual date the Contractor began performing services at an office following completion of transition, and be separated for the transition period only.

d. During the last 30 days of this Agreement term, the Contractor agrees to transition the performance of services required under this Agreement to other contractors under other agreements, when applicable and as follows:

1. The Contractor shall continue to provide services at an office under this Agreement until transition to another vendor under another agreement has been completed or the contract expires, whichever occurs first.

2. The Contractor’s last invoice shall be pro-rated in accordance with the actual date the Contractor stopped performing services at an office following completion of transition or contract expiration.

3. Reports

a. Postage Equipment Report: The Contractor must provide, due to the DMV Contract Manager within 30 days of the contract start date, Exhibit F, Postage Equipment Data Report, including the RU#, Office, account#, make/model, serial number, and beginning postage meter balance. An updated Postage Equipment Data Report is required when equipment is removed or replaced.

b. Meter Balance Report: The Contractor must provide, due to the DMV Contract Manager monthly, Exhibit G, Monthly Postage Meter Account Balance, including the RU#, Office, account#, beginning balance, amount added, date added, postage used, postage returned, and ending balance.

c. Consumables Purchased Report: The Contractor must provide, due to the DMV Contract Manager monthly, Exhibit H, Monthly Consumables Purchased Report, including date of purchase, RU#, Office, account#, item, cost, discount, taxes/fees.

Exhibit A, Page 8 of 12

4. Equipment Capability Requirements

a. All Postage Systems shall include integrated differential digital scales for calculating postage rates up to 15 lbs, automatic envelope feeders capable of processing a high volume of mail/bundles, high-speed internet connection (LAN), and USPS IMI approved postage technology.

b. Grade I, II, III, Commercial Drive Test Center (CDTC) and Admin Region I (Redding, CA) offices shall have a Postage Systems that can process a minimum of 60 envelope mails per minute.

c. Grade IV, V, Driver License Processing Center (DLPC), Industry Business Center (IBC) and Admin Region V (Thousand Oaks, CA) offices shall have a Postage Systems that can process a minimum of 95 envelopes per minute.

5. Delivery, Installation, and Removal

a. Contractor shall contact the DMV Office Manager for each location identified in Exhibit D, Field Office Locations for coordination of equipment installation and/or removal.

b. Contractor shall work with DMV Contract Manager to coordinate installation.

c. The on-site setup and start-up services shall be provided by the Contractor to ensure equipment is running properly and adjusted to manufacturer specifications.

d. Installation shall include, at no additional cost to DMV, delivery of two (2) additional ink cartridges, and two (2) rolls or packs of meter strips for each location listed in Exhibit D, Field Office Locations.

6. Setup, Startup, and Training on Postage Systems

a. Contractor will provide on-site setup, startup service, and training by manufacturer-trained technicians to ensure equipment is running properly and adjusted to manufacturer specifications. The training session shall be provided to a minimum of two (2) DMV staff at each location and cover the operation and maintenance of the system.

b. The equipment shall be delivered fully serviced and ready to operate.

c. After the initial delivery, DMV shall pay for consumable parts and supplies at the manufacturer’s published rate minus 10 percent, via a different payment mechanism. Payment for consumable parts and supplies will not be through this Agreement.

d. Contractor shall provide one (1) copy of the equipment operational manual in digital format to each location listed on Exhibit D, Field Office Locations. All manuals and instructions shall be in the English language. Compact Disc (CD) versions will not be acceptable. If there are special tools required to operate the equipment, one (1) set shall be provided to each location listed in Exhibit D, Field Office Locations.

Exhibit A, Page 9 of 12

7. Equipment Parts Replacement

a. Equipment parts determined to be unserviceable by the Contractor shall be replaced with new or equivalent to new equipment parts by the Contractor at no additional cost to the DMV, as approved by the DMV Office Manager.

Unserviceable equipment parts that are replaced by the Contractor shall become the property of the Contractor.

8. Rented or Loaned Equipment

a. If equipment needs to be removed from the premises for repair, the Contractor shall provide loaner equipment of comparable production capability for the period of time the equipment is being repaired at no additional cost to the DMV. The DMV shall require replacement/loaner equipment when repair cannot be completed within sixteen (16) working hours of the first service call response at no additional cost to DMV.

b. The DMV shall be relieved of all risks of loss or damage during the entire time the equipment is in the possession of the DMV, except when the loss or damage is due to fault or negligence on the part of the DMV. Rented or loaned equipment will be returned to the Contractor in the condition it was received, less normal wear and tear, provided there is no loss or damage due to fault or negligence on the part of the DMV.

9. Equipment Additions or Deletions

a. Equipment additions or deletions throughout the term of this Agreement will be accomplished by way of a written notification letter by the DMV Contract Manager to the Contractor. Equipment being added shall have the same or better capabilities as the equipment stipulated in this Agreement. The cost will be the same as indicated in Exhibit B, Cost Data Sheet.

10. Care/Use of Equipment

a. The Contractor agrees to provide maintenance, repair, and replacement services for Contractor provided equipment throughout the term of this Agreement to ensure that Contractor-provided equipment remains in good operating condition at all times. The DMV agrees to use reasonable care in the handling and operation of Contractor-provided equipment. The DMV shall not use special attachments, printing plates, or other devices unless approved by the Contractor. The DMV shall only use the supplies offered by or meeting the published specifications of the Contractor. The DMV shall pay for consumable parts and supplies at the manufacturer’s published rate minus 10 percent, except for the initial delivery of the mail system consumable items which are included in this contract, via a different payment mechanism.

Payment for consumable parts and supplies will not be from this Agreement.

Exhibit A, Page 10 of 12

11. Service Calls

a. The Contractor shall respond to equipment maintenance and/or repair service calls placed by the DMV during regular DMV business hours (8:00AM to 5:00PM, Monday through Friday). When the DMV places a service call to the Contractor during regular DMV business hours, the Contractor shall, within four (4) DMV business hours, respond with an estimated time arrival for a service representative to be dispatched. The time for arrival must be within twenty-four

(24) hours of DMV's equipment maintenance and/or service call during DMV business hours. The Contractor shall not perform services on state holidays, as indicated at DMV website: https://www.dmv.ca.gov/portal/dmv/dmv/offices.

12. Trained Technicians

a. Maintenance shall be performed by manufacturer-trained and qualified technician(s).

13. Postage Metering By Phone

a. All postage meters provided by the Contractor must be capable of having postage filled or refilled via a toll-free telephone call at no additional cost to the DMV.

b. Postage Meter Refilling: Contractor shall email the DMV Contract manager a receipt after filling or refilling postage meters. The receipt shall include the date of request, field office name, meter number, name of DMV rep, amount added, and beginning/ending meter balance.

c. Postage Meter Balance: Postage meters shall not have a balance more than $1000.

d. Postage Meter Refund: Contractor must provide the process for the DMV to request postage refunds. The Contractor, upon the request of the DMV, must provide a refund for any unused postage balance on a meter.

14. Software

a. The Contractor shall provide, install, and maintain all software and hardware that is necessary to update changes, and update those changes to the postal zip code tables and postal rates at no additional cost to the DMV.

15. Relocations

a. The Contractor shall be notified in writing by the DMV within two weeks of any changes to the reporting unit locations listed in the attached Exhibit D, Field Office Locations.

b. Contractor shall move the equipment to the new location specified by the DMV Project Manager, at no additional cost to the DMV.

16. Equipment Disposal

a. In the event the Contractor determines that an installed piece of equipment is no longer serviceable, the Contractor shall remove and dispose of the equipment from DMV’s property according to all Federal, State, and Local laws

Exhibit A, Page 11 of 12 at no cost to the DMV.

17. Loss/Damage

a. In the event that the Contractor provides written authorization to the DMV to relocate rented equipment on behalf of the Contractor, the DMV shall be relieved from all risks of loss or damage to all equipment/parts during periods of transportation by the DMV.

18. Uniform Clothing

a. The Contractor shall require all employees, including supervisors, to wear distinctive uniform clothing while performing services under this Agreement.

The Contractor shall assure that every employee and supervisor is in uniform when on-site at a DMV office. Uniform clothing shall clearly identify the Contractor’s name in a manner that is easily identifiable via a permanently affixed badge or monogram.

F. PAYMENT TERMS AND INVOICING REQUIREMENTS

1. The DMV will not be obligated to pay on an invoice until the status reports and timesheets required herein are received by the DMV Contract Manager. The DMV may dispute an invoice that does not comply with this Contract’s requirements, including requirements for invoices, timesheets and status reports, and a dispute notice given on that basis shall satisfy the requirements of the California Prompt Payment Act.

2. Project costs related to items such as travel, per diem, and travel time to the designated base of operation for the engagement are costs to be included within the contractor rates. DMV will not pay for such costs as a separate item.

3. Invoice(s) shall include all of the following:

a. Contractor’s name as indicated within this Agreement, address, telephone number, fax number, and email address.

b. Name, address, and telephone number of the DMV representative or office indicated within this Agreement to whom the invoice is being mailed or delivered.

c. Date the invoice was prepared.

d. Period of time covered by the invoice.

e. The Agreement number.

f. Office name and address where services were provided.

g. Brief description of the type of services for which the DMV is being billed.

h. Total number of days in the billing period that the Contractor was required to perform services.

i. Dates within the billing period that the Contractor failed to render required services.

j. Total amount invoiced (include calculations showing how the total amount invoiced was determined by including any pro-rata reduction amounts if

Exhibit A, Page 12 of 12 applicable).

4. Invoices shall be emailed to: ACCT_INV@dmv.ca.gov

NOTE: Delivery of an invoice shall be deemed completed when a copy of the invoice has been emailed to the email address shown above.

5. In addition to any other remedy available under this Agreement or applicable law, the DMV may dispute an invoice or invoices submitted by the Contractor and withhold amounts owed by the Contractor to the DMV under this Agreement, including but not limited to amounts owed for breach, amounts owed as liquidated damages, and amounts owed due to overpayments from amounts claimed by the Contractor on invoices submitted to the DMV and otherwise owed by the DMV to the Contractor under this Agreement.

G. AMENDMENTS

1. Should, during the course of this contract, it become necessary to modify the terms of this Statement of Work (Exhibit A), those modifications shall be through a written amendment to the contract.

2. A written contract amendment shall not be effective until fully executed by both parties. No oral understanding or agreement not incorporated through the proper contractual process shall be binding on either the Contractor or the DMV.

3. Contractor resources will not be expended, at a cost to the DMV, in excess of the authorized contract cost.

4. Any amendment to the contract not in the scope of the contract will require a fully approved Non-Competitively Bid justification.

Exhibit B, Page 1 of 1

COST DATA SHEET

1. For services rendered as required under this Agreement, and upon receipt and approval of the invoice(s) and any associated timesheets, status reports, or any other required documentation of work completed, the DMV agrees to compensate the Contractor at the Cost listed in #2 below (all taxes included), on a monthly basis in arrears. All payments are subject to pro-rata reduction for days on which services are not rendered as required under this Agreement.

2. Payment shall be made per postage system as shown in the table below:

Description

(a) Postage System

Quantity

(b) Postage System

Unit Cost

(c) Monthly

Cost (a x b = c)

1. Postage System Rental that processes high volume mail of at least sixty (60) pieces of mail per minute for office grades I, II, and III, the Commercial Drive Test Center (CDTC), and the Admin Region I (Redding, CA) offices, as described in Exhibit A.

109 $ $

2. Postage System Rental that processes high volume mail of at least ninety-five (95) pieces of mail per minute for office grades IV and V, Driver Licensing Processing Center (DLPC), Industry Business Center (IBC), and the Admin Region V (Thousand Oaks, CA) offices, as described in Exhibit A.

74 $ $

Monthly Total: $

2 Year Agreement Total (Monthly Total x 24) $

3. In the event the Contractor fails to render services required under this Agreement on a required workday during a monthly service period during the term of this Agreement, the total amount the DMV will compensate the Contractor for services rendered during the service period shall be reduced. The total reduction per service period shall be calculated as follows:

(Total workdays services required under this Agreement were not rendered during service period) divided by (Total number of required workdays for the service period) multiplied by (the monthly service period rate) equals (Total reduction for the service period)

Exhibit C, Page 1 of 8

INFORMATION SECURITY AND PRIVACY PROVISIONS (04/2022)

In the performance of this Agreement, [Contractor] agrees to protect all Department of Motor Vehicles (DMV) information by implementing the necessary controls to comply with State mandated security and privacy requirements provided in California State Administrative Manual (SAM), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), Government Code §11015.5 and

§11019.9, Vehicle Code, and California Information Practices Act (IPA) Civil Code §1798 et seq. The Contractor further agrees to implement the minimum administrative, physical, technical, and safeguards identified in this Agreement. The Contractor shall protect DMV information for the terms and length of this Agreement and while in possession of, maintaining, or accessing DMV information. The Contractor shall ensure any third parties adhere to these same provisions.

A. DEFINITIONS – For purposes of this Exhibit, the following definitions shall apply:

1. Contractor shall generally refer to any entity, private or public organization hired or working in conjunction with or for DMV to provide deliverables.

2. Data shall mean a representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

3. DMV Information shall refer to DMV provided data.

4. Confidential Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

5. Personal Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

6. Sensitive Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

7. Personnel shall refer to any Contractor employees, volunteers, contractors, sub-contractors commissioned, employed by, or otherwise engaged in the performance of work associated with the Contractor.

8. Systems shall refer to workstations, laptops, servers, network, and other information processing components managed and hosted by Contractor which process, store, or transmit DMV information.

9. Users shall refer to any Contractor personnel with access to DMV information.

Exhibit C, Page 2 of 8

B. ADMINISTRATIVE SAFEGUARDS

1. DATA OWNERSHIP

DMV information provided under this Agreement remains DMV exclusive property. Confidential, sensitive, and personal information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without written permission from the DMV.

The Contractor recognizes its responsibility to protect the confidentiality of information in their custody as provided by law and ensure such information is disclosed only to those individuals, and of such purpose as authorized by the respective laws.

The Contractor shall have a non-exclusive right to use and process the disclosed information for the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of this data does not transfer ownership of information to the Contractor.

2. USE OF INFORMATION

The Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement shall be used solely for the purposes described in this Agreement and agrees to implement policies and procedures to ensure the confidentiality of said information.

The Contractor further agrees that information obtained under this Agreement shall not be reproduced, published, sold, or released in original or any other form for any purpose other than identified in this Agreement. Only the minimum necessary amount of DMV information required to perform necessary business functions may be processed, stored, or transmitted.

The Contractor shall not use any DMV information that identifies real individuals for any purpose not described in this Agreement including for testing, training, or research.

3. BACKGROUND CHECKS

Contractor Personnel who may access DMV information, must undergo a thorough background check, with evaluation of the results to assure that there is no indication that the worker may present a risk to the security or integrity of confidential data or a risk for theft or misuse of confidential data. The Contractor shall retain background check documentation for a period of three (3) years following contract termination.

Exhibit C, Page 3 of 8

4. STATEMENT OF CONFIDENTIALITY AND REQUIREMENTS

Information maintained by DMV is confidential under this Agreement and exempt from disclosure under the provisions of California Public Records Act (Government Code §6250-6265), the California Elections Code §2194), and other applicable state or federal laws.

The Contractor further understands and acknowledges that under California Penal Code §502, it is a public offense to knowingly and without permission alter, damage, delete, destroy, copy, or otherwise use any DMV data. Such action can be prosecuted civilly or criminally and is punishable by fine and/or imprisonment.

The Contractor shall ensure that all users sign a confidentiality statement each year, attesting to the fact that he/she is aware of the confidential nature of the data and penalties for unauthorized disclosure under applicable state and federal law. Copies of signed confidentiality statements must be made available to the DMV CISO upon request.

5. INFORMATION SECURITY AND PRIVACY AWARENESS TRAINING

The Contractor shall ensure that all users must receive information security and privacy awareness training prior to accessing such information, and annually thereafter. Information security and privacy awareness training must contain instructional components such as, but not limited to, information about the confidential nature of information, laws and regulations protecting the confidentiality of information, user responsibility for protecting the information, and the consequences and legal liability of unauthorized use, access, or disclosure of said information. Upon request, the Contractor must provide the DMV Chief Information Security Officer (CISO) or Privacy Officer with a copy of its information security and privacy awareness training components and certification of its annual information security and privacy awareness training completion.

6. EMPLOYEE ACCESS TO INFORMATION

The Contractor agrees that information shall be kept in the strictest confidence and only made available to authorized personnel on a “need-to-know” business basis, and only for the purposes authorized under this Agreement. The term “need-to-know” refers to those authorized persons who need information to perform their official duties in connection with the purpose described in the Agreement.

The Contractor shall maintain records of all authorized users and the authorization level of access granted to the information obtained under this Agreement with the purpose described in this Agreement.

Exhibit C, Page 4 of 8

7. RISK ASSESSMENT

A risk assessment must be conducted annually on all Contractor systems which process, store or transmit DMV information. Risk assessments must be documented at least every three (3) years or upon significant change to the system or environment. Risk assessment results must be provided to the CISO within 30 days of completion.

8. INCIDENT REPORTING

The Contractor shall immediately notify the DMV CISO/Designee of any actual or suspected security event involving DMV information accessed or obtained under this Agreement. The Contractor shall cooperate fully with DMV to comply with the incident reporting requirements within Civil Code section 1798.29 and SAM section 5340.4.

The Contractor shall thoroughly investigate all unauthorized or suspected unauthorized access, use, and/or disclosure of information obtained under this Agreement. DMV reserves the right to participate in the investigation of any information security incident involving its data and may conduct its own independent investigation, and the Contractor shall cooperate fully in such investigation.

The Contractor shall provide a preliminary report within three (3) working days of discovery of breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as any pertinent preliminary information. The Contractor shall then provide a full written report of the investigation to the DMV CISO and Privacy Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure.

DMV reserves the right to take corrective action at any time.

9. BREACH OR DISCLOSURE OF DMV INFORMATION

Disclosure of any DMV information to any person or entity not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with DMV’s confidential information shall not reveal, share, or divulge to any person or entity any of the confidential information provided under this Agreement, except as authorized or required by law.

DMV shall not be held liable for any breach of Contractor systems that results in the release of any information provided by DMV. Contractor agrees to indemnify and hold harmless DMV, its officers, and representatives from and against any liability, losses, costs, damages, or expenses (including but not limited to attorney fees) resulting from any claims arising from the performance of this Agreement, including but not limited to any and all liability, damages, Exhibit C, Page 5 of 8 costs, expenses, or attorney fees resulting from a breach of security of the system as defined in the California IPA unless such damages are determined to be the result of the negligence of DMV, its officers, employees, or representatives.

If the Contractor experiences a loss or breach of data, the Contractor shall immediately report the loss or breach to DMV. If DMV determines that notice to the individuals whose data has been lost or breached is appropriate, the Contractor shall bear any, and all costs associated with the notice, or any mitigation selected by the data owner. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data.

C. PHYSICAL SAFEGUARDS

1. ACCESS CONTROL

The Contractor shall ensure information in all forms, such as, but not limited to CDs, DVDs, USB flash drives, or other removable media must be stored in areas physically secure and free from access by unauthorized persons as described in this Agreement.

The Contractor shall ensure computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement must not be viewed by the public or other unauthorized persons as described in the Agreement.

2. SUPERVISION OF DATA

DMV information in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information. DMV information in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

3. ESCORTING VISITORS

Visitors to areas where DMV information is contained shall be escorted and DMV information shall be kept out of sight while visitors are in the area.

4. REMOVAL OF DATA

DMV information must not be removed from the premises of the Contractor except with express written permission.

Exhibit C, Page 6 of 8

D. TECHNICAL SAFEGUARDS

1. DATA RETENTION AND DESTRUCTION

DMV information must be retained for the minimum necessary to perform the required business function.

All data received by the Contractor under this Agreement and any data created, copied, attributed to data received shall be destroyed when no longer needed for the business function for which they were obtained, or within 10 calendar days of termination of this Agreement. Data must be destroyed in accordance with the requirements specified NIST Special Publication (SP) 800-88, Guidelines for Media Sanitization.

2. ENCRYPTION

Confidential, sensitive, or personal information must be encrypted in accordance with Federal Information Processing Standards 140-3, Security Requirements for Cryptographic Modules.

3. DATA AT REST AND IN TRANSIT

All Contractor systems that process, store, or transmit DMV confidential, sensitive, or personal information at rest and in transit must be encrypted in accordance with the security and privacy provisions specified within this Agreement.

4. ENDPOINT PROTECTION

All Contractor systems that process, store, or transmit DMV information must install and actively use endpoint protection with automatic updates scheduled at least daily.

5. VULNERABILITY MANAGEMENT

All Contractor systems which store, process, or transmit DMV information must be scanned for vulnerabilities monthly, and when new vulnerabilities potentially affecting the system are identified and reported. Vulnerabilities by severity must be remediated within the following timeframe.

Critical (3 business days or less) High (21 days) Medium (60 days) Low (90 days)

The CISO must be notified within 24 hours if critical vulnerabilities cannot be remediated within the required timeframe.

Exhibit C, Page 7 of 8

6. INTRUSION DETECTION

All Contractor systems which store, process, or transmit DMV information that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

7. WARNING BANNERS

All Contractor systems which store, process, or transmit DMV information must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.

8. IDENTIFICATION and AUTHENTICATION All users accessing DMV information from Contractor systems must be assigned uniquely identified accounts.

9. PASSWORD CONTROLS

Contractor system user account passwords must be a minimum 15 characters and must be composed of a minimum one character each from the following four groups:

a. Upper case letters (A-Z)

b. Lower case letters (a-z)

c. Arabic numerals (0-9)

d. Non-alphanumeric characters (punctuation symbols) Passwords must be changed at least every 180 days.

10. USER ACCOUNT MANAGEMENT

Contractor system user accounts must be immediately disabled or deleted upon personnel termination or a change in assigned duties which no longer require access to DMV information.

11. MULTI FACTOR AUTHENTICATION

Multi factor authentication must be enabled for all Contractor system users accessing DMV information.

12. SESSION LOCK

Contractor systems must not be left unattended and logged on. Systems must be configured to prevent access by initiating a session lock after no more than 10 minutes of inactivity. Session locks must be retained until the user reestablishes access using established identification and authentication procedures.

Exhibit C, Page 8 of 8

13. CHANGE CONTROL

The Contractor shall notify the DMV 30 days prior of any changes to systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit DMV information. The DMV shall notify the Contractor of any changes to DMV systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit information in the performance of this Agreement at the discretion of the DMV.

14. AUDITING

The Contractor shall maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Said logs must be made available to the DMV upon request.

To determine compliance with Agreement terms, the Contractor shall permit DMV authorized individuals to perform audit or inspections during regular business hours of hosted Contractor systems located on Contractor premises. Contractor shall permit audits or inspections with seven (7) days prior notice.

Exhibit D, Page 1 of 6

FIELD OFFICE LOCATIONS

RU# Field Office REG Address City Zip 537 Alturas I 903 West C St Alturas 96101

587 Arleta V 14400 Van Nuys Blvd Arleta 91331

661 Arvin IV 317 Campus Dr Arvin 93203

570 Auburn III 11722 Enterprise Dr Auburn 95603

529 Bakersfield IV 3120 F St Bakersfield 93301

682 Bakersfield IBC IV 5800 District Blvd Bakersfield 93313

679 Bakersfield SW IV 7000 Schirra Ct Bakersfield 93313

582 Barstow VII 528 East Virginia Way Barstow 92311

576 Bell Gardens VI 6801 South Garfield Ave Bell Gardens 90201

606 Bellflower VI 9520 East Artesia Blvd Bellflower 90706

585 Bishop IV 1115 West Line St Bishop 93514

528 Blythe VIII 430B South Broadway Blythe 92225

597 Brawley VIII 173 W. Main St Brawley 92227

550 Capitola II 4200 Capitola Rd Capitola 95010

625 Carmichael III 5209 North Ave Carmichael 95608

520 Chico I 107 Parmac Rd, Ste 1 Chico 95926

613 Chula Vista VIII 30 North Glover Ave Chula Vista 91910

830 Clearlake I 15930 Dam Rd, Unit B Clearlake 95422

580 Clovis IV 2103 Shaw Ave Clovis 93612

603 Coalinga IV 406 East Elm Ave Coalinga 93210

564 Colusa I 1025 Bridge St, Ste B Colusa 95932

581 Compton VI 2111 South Santa Fe Ave Compton 90221

523 Concord III 2070 Diamond Blvd Concord 94520

534 Corte Madera I 75 Tamal Vista Blvd Corte Madera 94925

628 Costa Mesa VII 650 West 19th St Costa Mesa 92627

524 Crescent City I 1475 Parkway Dr Crescent City 95531

514 Culver City VI 11400 West Washington Blvd Los Angeles 90066

599 Daly City II 1500 Sullivan Ave Daly City 94015

598 Davis III 505 Pole Line Rd Davis 95618 615 Delano* IV 631 Jefferson St Delano 93215 669 El Cajon VIII 1450 Graves Ave El Cajon 92021

527 El Centro VIII 233 North Imperial Ave El Centro 92243

556 El Cerrito II 6400 Manila Ave El Cerrito 94530

685 El Monte VI 4000 Arden Dr El Monte 91731 526 Eureka* I…