EO504_IT_System_and_Data_Security_Disclosure_and_Commitment_Form.docx

Executive Order 504 Information Technology System and Data Security Disclosure and Commitment Form

For the purpose of ensuring that the successful Bidder protects the security, confidentiality, and integrity of electronic personal information and the systems that hold such information, this form is required to be included in Solicitations of Information Technology Services, either in the form of Requests for Quotes (“RFQs”) or Requests for Responses (“RFRs”)(except for solicitations posted under the Staff Augmentation category of Statewide Contract ITS43, or its successor contract), where the contractor will be a holder of or have access to personal data or personal information pursuant to MGL c. 66A, MGL c. 93H and Executive Order 504.

Bidder’s Security Practices and History:

Bidders are required to provide the following information which will be evaluated by the procuring entity:

(1) their own and their proposed subcontractors’ respective internal security procedures and policies applicable to work performed by them for customers (attach additional sheets if necessary):

(2) the particulars of any circumstances over the past five (5) years in which the bidder or its proposed subcontractor(s) has caused a breach of the security, confidentiality or integrity of a customer’s data (attach additional sheets if necessary):

System and Data Security:

Section 6 of the Commonwealth Terms and Conditions states:

“Confidentiality. The Contractor shall comply with M.G.L. C. 66A if the Contractor becomes a "holder" of "personal data". The Contractor shall also protect the physical security and restrict any access to personal or other Department data in the Contractor's possession, or used by the Contractor in the performance of a Contract, which shall include, but is not limited to the Department's public records, documents, files, software, equipment or systems.”

In addition to the foregoing requirements, the Bidder AGREES by submitting this form with their bid response that, as part of its work effort under the agreement entered pursuant to this solicitation, the Bidder will be required to use the following Commonwealth personal data under MGL ch. 66A and/or personal information under MGL ch. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified tasks (Department must list here the categories of such data or information that the Contractor will be required to use or work on or with):

For purposes of this work effort, electronic personal data and personal information includes data provided by the Department to the winning bidder which may physically reside at a location owned and/or controlled by the Commonwealth or Department or winning bidder. In connection with such data, the winning bidder will implement the maximum feasible safeguards reasonably needed to:

· Ensure the security, confidentiality and integrity of electronic personal data and personal information;

· Prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network;

· Prevent unauthorized physical access to any information technology resources involved in the winning bidder’s performance of a contract entered under this solicitation;

· Prevent interception and manipulation of data during transmission to and from any servers; and

· Notify Department immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.”

By submitting this form in a response to an RFR or RFQ, the Bidder agrees to all of these terms and to ITD’s Executive Order 504: Procurement Standards and Procedures and certifies under the pains and penalties of perjury that the information that they have provided above is correct.