DPS Cyber Security

Contract Exhibit

OGC APPROVED – 9/11/25

DPS Cyber Security Contract Exhibit v2.0 Page 1 of 30

1. Cloud Security Requirements and Certifications

Req ID Requirement Response

1.1 Do you (by yourself or through your subcontractor) meet

the TX-RAMP requirements for the solution provided in the response at the appropriate level as required by the solicitation and DPS Cyber Security?

☐ Yes

☐ No

☐ N/A (No Cloud Components/On Prem)

If no, please provide the date in which you will obtain the required TX-RAMP Certification.

Click or tap here to enter text.

1.2 Please select the TX-RAMP level obtained for the solution provided in the response. Provide the certification number and expiration date below.

☐ Provisional

☐ TX-RAMP Level 1

☐ TX-RAMP Level 2

TX-RAMP Certification Number and Expiration Date. If Provisional, please provide the timeframe in which a full TX-RAMP certification will be obtained:

1.3 Do you (by yourself or through your subcontractor) meet

the FedRAMP requirements for the solution provided in the response at the appropriate level as required by the solicitation and DPS CJIS Security Office?

☐ Yes

☐ No

☐ N/A (Does Not Interface with CJI Data)

If no, please provide the date in which you will obtain the required FedRAMP Certification.

Click or tap here to enter text.

1.4 Please select the FedRAMP level obtained by the Vendor

for the solution provided in the response. Provide the Package ID and most recent annual assessment date below.

☐ FedRAMP Low

☐ FedRAMP Moderate

☐ FedRAMP High

FedRAMP Package ID and Most Recent Annual Assessment Date:

Click or tap here to enter text.

1.5 Are there any additional Cloud Security Certifications that have been obtained for the solution provided in the response (STAR, StateRAMP, etc.)? If so, please provide details below.

☐ Yes

☐ No

If yes, please provide cloud certification details.

DPS Cyber Security Contract Exhibit v2.0 Page 2 of 30

2. Identification and Authentication Requirements

2.1 Is Active Directory based authentication or SAML2 Identity Provider/Service Provider authentication provided?

If no, please provide an explanation, any compensating controls, and plans to reach compliance with the requirement.

2.2 Are user accounts established and administered using a

role-based scheme and are those role assignments tracked and monitored?

2.3 Are users uniquely identified and prevented from

establishing multiple concurrent active sessions?

Click or tap here to enter text.

2.4 Is two-factor authentication required for all user accounts? ☐ Yes

Click or tap here to enter text.

2.5 Is System user functionality separated from administrator functionality, and are users required to establish sessions with administrative privileges to view and access administrator functionality?

DPS Cyber Security Contract Exhibit v2.0 Page 3 of 30

2.6 Do systems prevent further access by initiating a session lock or termination after a maximum of 30 minutes of inactivity and does the session lock or termination remain in effect until the user reestablishes access using appropriate identification and authentication procedures?

Click or tap here to enter text.

2.7 Does the system require reauthentication of the user at

least once per 12 hours during an extended usage session?

Click or tap here to enter text.

2.8 Does the system enforce a rate-limit of no more than three consecutive invalid access attempts by a user? After three consecutive invalid attempts, does the system automatically lock the account/node for a ten-minute time period unless released by DPS’s Administrator?

DPS Cyber Security Contract Exhibit v2.0 Page 4 of 30

2.9 Does the system adhere to all of the following password

attributes when creating and authenticating a user’s unique ID. If no, please list which attributes are not met in the comment box below.

a) Passwords must be a minimum of 15 characters up to at least 64 characters maximum and may contain, but are not required to contain any of the following elements: uppercase characters, lowercase characters, numeric characters, special characters (such as $, ^, #,

b) When passwords are created, passwords must be checked against the following before allowing a password to be used:

i. Passwords found in compromised credential databases

ii. Previously used passwords

iii. Commonly used passwords and passphrases

iv. DPS business terms

v. Geographical locations;

c) Passwords must be continuously monitored to check for evidence of password compromise or breach. Upon discovery, an immediate password change must be forced upon the user;

d) Do not force passwords to expire at pre-defined intervals (45, 60, or 90 days);

e) Not be transmitted in clear text outside the Secure Location;

f) Not be displayed in clear text when entered;

g) Passwords must be salted and hashed when stored, and never be stored in plain text, electronically or physically;

h) Allow users “paste” functionality when entering password to allow for the use of password managers.

DPS Cyber Security Contract Exhibit v2.0 Page 5 of 30

3. Audit and Accountability

3.1 Are audit logs provided that capture all of the following system events? If no, please list which system events are not met in the comment box below.

a) Account creation, modification, disabling, and termination actions

b) Successful and unsuccessful System log-on attempts

c) Successful and unsuccessful attempts to access, create, write, delete, or change permission on a user account, file, directory, or other System resource

d) Successful and unsuccessful attempts to change account passwords

e) Successful and unsuccessful actions by privileged accounts

f) Successful and unsuccessful attempts for users to access, modify, or destroy the audit log

3.2 Is all of the following information provided with each

audited event? If no, please indicate which information is not provided in the comment box below.

a) Date and time of the event;

b) The component of the System (e.g., software component, hardware component) where the event occurred;

c) IP address;

d) Type of event;

e) User/subject identity; and

f) Outcome (success or failure) of the event.

DPS Cyber Security Contract Exhibit v2.0 Page 6 of 30

3.3 Are audit logs retained for a period of at least one year? ☐ Yes

Click or tap here to enter text.

3.4 Do audit record time stamps use internal system clocks? ☐ Yes

Click or tap here to enter text.

3.5 Are audit records and audit tools protected from

unauthorized access, modification, and deletion?

3.6 Will real-time alerts be provided to appropriate DPS

personnel in the event of any inappropriate or unusual activity as defined by DPS, or audit processing failure? Are alert recipients and delivery methods configurable and manageable by DPS System Administrators?

Click or tap here to enter text.

3.7 Does the solution protect against an individual falsely

denying having performed a particular action (non-repudiation)?

DPS Cyber Security Contract Exhibit v2.0 Page 7 of 30

3.8 Does the system display an approved use notification

message or banner before granting access to the System?

The notification must contain an approved DPS logo and state:

a) Users are accessing a DPS system;

b) System usage will be monitored, recorded, and subject to audit;

c) Unauthorized use of the system is prohibited and subject to criminal and civil penalties;

d) A description of the authorized use of the system; and

e) Use of the system indicates consent to monitoring and recording.

DPS Cyber Security Contract Exhibit v2.0 Page 8 of 30

4. System Security

4.1 Is DPS-approved virus protection software implemented

and configured at all system entry and exit points with the following attributes?

a) The virus protection software must not be disabled or bypassed.

b) The settings for the virus protection software must not be altered in a manner that will reduce the effectiveness of the software.

c) The automatic update frequency of the virus protection software must not be altered to reduce the frequency of updates.

4.2 Are security testing and flaw remediation implemented

during system development to ensure software and firmware security defects are corrected before installation in the production environment?

4.3 Are information inputs validated and controls implemented to prevent the injection of malicious input?

DPS Cyber Security Contract Exhibit v2.0 Page 9 of 30

4.4 Does the system generate error messages that provide

information necessary for corrective actions without revealing information that could be exploited by adversaries?

Click or tap here to enter text.

4.5 Are controls in place to safeguard the system’s memory

from unauthorized code execution?

4.6 Is communication at the external boundary of the system

controlled and monitored to prevent unauthorized connections and protect against or limit the effects of denial-of-service attacks?

Click or tap here to enter text.

4.7 Does the system prevent unauthorized and unintended

information transfer via shared system resources, such as registers, main memory, and hard disks?

Click or tap here to enter text.

4.8 Are separate execution domains maintained for each

executing system process, so that one process cannot modify the executing code of another process?

DPS Cyber Security Contract Exhibit v2.0 Page 10 of 30

4.9 Is a continuous security program established and

maintained as part of the Services? Will the security program be reviewed and adjusted when a risk is assessed or discovered by the vendor, selected third party, or by

DPS?

Does the security program enable DPS (or its selected third party) to:

a) Define the scope and boundaries, policies, and organizational structure of an information security management system;

b) Conduct periodic risk assessments to identify threats and vulnerabilities specific to DPS;

c) Receive an unredacted copy of a recent vulnerability scan (no older than 30 days);

d) Implement appropriate mitigating controls;

e) Implement training programs;

f) Manage resources;

g) Monitor and test the security program to ensure its effectiveness?

DPS Cyber Security Contract Exhibit v2.0 Page 11 of 30

5. Maintenance

5.1 Prior to use, will any maintenance tools used for diagnostic or repair actions be submitted for approval by DPS?

5.2 Are nonlocal (remote) maintenance sessions uniquely

authenticated, all maintenance and diagnostic activities logged, and sessions and network connections terminated when maintenance is complete?

5.3 Prior to the removal of the information system or system

components from the secure hosting location for off-site maintenance or repairs, will written approval be obtained from DPS?

Click or tap here to enter text.

5.4 Is all equipment sanitized to remove all information from associated media prior to removal from the secure hosting location for off-site maintenance or repairs?

Click or tap here to enter text.

5.5 Are security controls checked to verify that the controls are still functioning properly following maintenance or repair actions?

DPS Cyber Security Contract Exhibit v2.0 Page 12 of 30

5.5 Will upgrades, patches, and other maintenance be

scheduled with DPS?

5.6 Will you ensure that all maintenance personnel who

maintain the system are authorized by DPS prior to performing maintenance?

DPS Cyber Security Contract Exhibit v2.0 Page 13 of 30

6. System/Solution Assurance

6.1 Are security updates applied to correct any security defect, vulnerability, or exploit in the System/Solution in accordance with DPS Cyber Security requirements based on the level of risk

6.2 Will the System/Solution be kept up to date with all

supporting software updates, security updates, and patches?

6.3 Are systems that are no longer supported by the

manufacturer replaced or upgraded within three months from the official manufacturer end of support date.

Click or tap here to enter text.

6.4 Will the System Security Documentation (SSD) be

periodically reviewed and updated upon request from DPS?

Click or tap here to enter text.

6.5 Will DPS’s System Security Documentation be protected

from unauthorized access, disclosure, or release in accordance with the Subsection entitled “General Confidentiality Requirements?”

DPS Cyber Security Contract Exhibit v2.0 Page 14 of 30

6.6 Will documentation be provided, at the request of DPS, for the System that describes user and administrator guidance regarding the implementation and operation of security controls?

Click or tap here to enter text.

6.7 Prior to system acceptance, will all security requirements be met and implemented with any exceptions formally approved by DPS?

DPS Cyber Security Contract Exhibit v2.0 Page 15 of 30

7. Physical and Environmental Protection

7.1 Is physical access to the System containing DPS’s data

restricted to authorized personnel with appropriate clearances and access authorizations?

7.2 Are physical access authorizations enforced for all physical access points, and are all individual access authorizations verified before granting access to the facility where the system resides?

If no, please an explanation, any compensating controls, and plans to reach compliance with the requirement.

7.3 Is entry to the facility containing the System controlled using physical access devices or guards?

Click or tap here to enter text.

7.4 When access devices are lost, combinations are

compromised, or individuals are transferred or terminated are combinations and access devices changed?

DPS Cyber Security Contract Exhibit v2.0 Page 16 of 30

7.5 Are appropriate environmental controls maintained in the

facility containing the System? Appropriate environmental controls include maintaining and monitoring heat and humidity levels, fire suppression and detection systems supported by an independent energy source, water shutoff and isolation valves, and uninterruptable power systems capable of supporting the System in the event of a primary power System Failure.

If no, please list which environmental controls are not maintained along with an explanation, any compensating controls, and plans to reach compliance with the requirement.

7.6 Will you collaborate with DPS on security monitoring and

incident response, define points of contact on both sides, establish monitoring and response procedures, set escalation thresholds, and conduct training?

7.7 If requested, will you provide a quarterly report to DPS’s CISO of the security incidents that Vendor has identified and taken measures to resolve?

Click or tap here to enter text.

7.8 If answering Yes to the previous question (7.7):

Will the vendor also provide updates to those security incidents?

DPS Cyber Security Contract Exhibit v2.0 Page 17 of 30

8. Data Security

8.1 Is DPS data marked, handled, and stored in compliance with the data classification and retention policy as defined by

DPS?

8.2 Does this System, vendor or any subcontractors require

access to DPS’s network; DPS’s data; or the network processing, transporting, or storing of DPS’s data?

If yes, please provide an explanation as to what network and data access is required.

8.3 If answering Yes to the previous question (8.2):

Has a CJIS Security Addendum been completed and signed by the vendor?

Have all employees requiring access to DPS’s network or data signed the FBI Certification to the CJIS Security Addendum and passed a fingerprint-based background check?

☐ N/A

Click or tap here to enter text.

8.4 Will the Vendor, its subcontractors, and its staff with access to DPS’s data complete and provide proof of DIR certified security awareness training annually for the term of the contract including renewals? This training is mandatory.

DPS Cyber Security Contract Exhibit v2.0 Page 18 of 30

8.5 Is all DPS data and metadata maintained within the

conterminous United States of America?

8.6 Is data prevented from being exported to a location

external to the hosting environment unless prior written permission from DPS is obtained?

8.7 Does the solution protect the confidentiality of DPS’s

information by encrypting all data transmitted outside or stored outside the secure network?

Click or tap here to enter text.

8.8 When cryptography (encryption) is employed within

information systems, the System must perform all cryptographic operations using Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3 validated cryptographic modules with approved modes of operation. Please indicate which FIPS standards are used.

☐ FIPS 140-2

☐ FIPS 140-3

If cryptographic operations are not FIPS 140-2 or 140-3 compliant, please provide an explanation, and plans to reach compliance with the requirement.

8.8 When TLS is used, it must be at least version 1.2 Please

indicate which version of TLS is used.

☐ TLS 1.2

☐ TLS 1.3

If the version of TLS used is below 1.2, please provide an explanation, and plans to reach compliance with the requirement.

DPS Cyber Security Contract Exhibit v2.0 Page 19 of 30

8.9 Does the solution produce, control, and distribute

cryptographic keys using NIST-approved key management technology and processes?

The key management process is subject to audit by DPS.

Click or tap here to enter text.

8.10 Does all equipment provided to DPS by the Vendor that is equipped with hard disk drives (e.g., computers, telephones, printers, fax machines, scanners, multifunction devices) as well as all removable storage media (USBs, flash drives, tape drives, etc.) have the capability to securely erase data written to the hard drive or media device prior to final disposition of such equipment, either at the end of the equipment’s useful life or the end of the related services agreement for such equipment?

DPS Cyber Security Contract Exhibit v2.0 Page 20 of 30

9. Wireless Network Security The following requirements specify the minimum set of security measures required on WLAN-enabled portable electronic devices (PEDs) that transmit, receive, process, or store sensitive or confidential information.

Req ID Requirement Response

9.1 Are personal firewall services in use for all WLAN enabled PEDs?

9.2 Are antivirus services in use for all WLAN enabled PEDs?

9.3 Is data-in-transit via WLAN enabled PEDs protected by a

minimum 128 bit end-to-end encryption that meets FIPS 140-2 or 140-3?

Click or tap here to enter text.

9.4 Is FIPS 140-2 or 140-3 compliant data-at-rest encryption

enabled on WLAN enabled PEDs in a manner that requires the PED be powered on with credentials successfully authenticated in order for the data to be deciphered?

Click or tap here to enter text.

9.5 Are wireless access points installed in a protected

environment to prevent tampering or theft?

DPS Cyber Security Contract Exhibit v2.0 Page 21 of 30

9.6 Are wireless network connections periodically checked or

validated to prevent against rogue access points?

DPS Cyber Security Contract Exhibit v2.0 Page 22 of 30

10. Mobile Device Management Mobile Device Management (MDM) facilitates the implementation of sound security controls for mobile devices and allows for centralized oversight of configuration control, application usage, and device protection and recovery. Mobile devices that transmit, receive, process, or store sensitive or confidential information must have MDM implemented. The MDM solution must include the core features outlined in this section.

Req ID Requirement Response

10.1 Does the MDM solution implement the ability to push

security policies to managed devices and ensure the authenticity and integrity of the transaction?

10.2 Does the MDM solution implement the ability to query the device for its configuration information and ensure the authenticity and integrity of the transaction?

10.3 Does the MDM solution implement the ability to modify

device configuration and ensure the authenticity and integrity of the transaction?

Click or tap here to enter text.

10.4 Does the MDM solution implement asset management

(track/enable/disable) for the mobile devices being managed via the MDM server?

DPS Cyber Security Contract Exhibit v2.0 Page 23 of 30

10.5 Does the MDM solution manage proxy access to network

resources via the connection of the mobile device to the MDM server?

10.6 Does the MDM solution query managed devices on the

status of their security policy compliance and implement a specified mediation function based on compliance status?

10.7 Does the MDM solution generate audit record reports from mobile device audit records?

Click or tap here to enter text.

10.8 Does the MDM solution maintain the ability to remotely

wipe a device in the event it is lost or stolen?

Click or tap here to enter text.

10.9 Does the MDM solution receive alerts and other

notifications from managed mobile devices?

Click or tap here to enter text.

10.10 Does the MDM solution download and store mobile device

audit records?

DPS Cyber Security Contract Exhibit v2.0 Page 24 of 30

10.11.1 Does the MDM provide application management, including the ability create an allow list, for applications installed on managed mobile devices?

Click or tap here to enter text.

10.11.2 Does the MDM solution ensure the authenticity and

integrity of the transaction in the three MDM categories mentioned in 10.11.1?

DPS Cyber Security Contract Exhibit v2.0 Page 25 of 30

11. Access to Internal DPS Network and Systems As a condition of gaining remote access to any internal DPS network and systems, Vendor must comply with DPS policies and procedures, including DPS General Manual Chapter 25 (Cyber Security) and

Chapter 26 (Information Resource Policy). DPS’s remote access request procedures require Vendor to submit a Remote Access Request form for DPS’s review and approval.

a. DPS’s CISO must approve remote access technologies provided by Vendor.

b. Individuals who are provided with access to DPS’s network are required to complete DPS’s Security Awareness Training on an annual basis during the term of the contract and during any renewal period.

c. Vendor must secure its own connected systems in a manner consistent with DPS requirements.

d. DPS reserves the right to audit the security measures in effect on Vendor’s connected systems without prior warning.

e. DPS also reserves the right to immediately terminate network and system connections not meeting such requirements.

12. DPS Information Protection Requirements

a. Vendor, its employees, and any subcontractors must comply with all applicable requirements that relate to the protection or disclosure of DPS Information. DPS Information includes all data and information:

1) Submitted to Vendor by or on behalf of DPS;

2) Obtained, developed, or produced by Vendor in connection with the Contract;

3) Communicated verbally whether intentionally or unintentionally; or

4) To which Vendor has access in connection with the Services provided under the

Contract.

b. Such DPS Information may include taxpayer, vendor, and other state agency data held by DPS.

c. DPS will process all waiver requests in accordance with DPS’s Information Protection Policies, Standards & Guidelines, and must be approved by the CISO.

d. DPS reserves the right to take appropriate action to protect DPS’s network and information including the immediate termination of System access.

e. Vendor must ensure that any sensitive or confidential DPS Information in the custody of Vendor is properly sanitized or destroyed when the information is no longer required to be retained by DPS or Vendor in accordance with the Contract.

f. Electronic media used for storing any sensitive or confidential DPS Information must be sanitized by clearing, purging, or destroying in accordance with NIST Special Publication 800-88 Guidelines for Media Sanitization. Vendor must maintain a record documenting the removal and completion of all sanitization procedures with the following information:

DPS Cyber Security Contract Exhibit v2.0 Page 26 of 30

1) Date and time of sanitization/destruction;

2) Description of the item(s) and serial number(s) if applicable;

3) Inventory number(s); and

4) Procedures and tools used for sanitization/destruction.

g. No later than 60 calendar days from contract expiration or termination, Vendor must complete the sanitization and destruction of the data and provide to DPS all sanitization documentation.

13. General Confidentiality Requirements

a. All information provided by DPS to Vendor or created by Vendor in performing the obligations under the Contract is confidential and may not be used by Vendor or disclosed to any person or entity, unless such use or disclosure is required for Vendor to perform work under the Contract.

The obligations of this section do not apply to information that Vendor can demonstrate:

1) Is publicly known at the time of disclosure or subsequently becomes publicly known through no fault of Vendor;

2) Vendor discovered, learned, or created independently by Vendor or by a rightfully possessing and disclosing third party or by any other legitimate means;

3) Is required to be disclosed by law or final order of a court of competent jurisdiction or regulatory authority, but Vendor must furnish prompt written notice of such required disclosure and must reasonably cooperate with DPS at DPS’s cost and expense, in any effort made by DPS to seek a protection order or other appropriate protection of its confidential information.

b. Vendor must notify affected parties in writing of any unauthorized release of confidential information:

1) DPS must be notified immediately (but no later than four hours ) when Vendor knows or should have known of such unauthorized release;

2) Other affected parties must be notified within two business days of when Vendor knows or should have known of such unauthorized release.

c. Vendor must maintain all confidential information in confidence during the term of the Contract and after the expiration or termination of the Contract.

d. If Vendor has any questions or doubts as to whether material or information is confidential information, Vendor must obtain the prior written approval of DPS prior to using, disclosing, or releasing such information.

e. Vendor acknowledges that DPS’s non-public and confidential information is unique and valuable, and that DPS may have no adequate remedy at law if Vendor does not comply with its confidentiality obligations under the Contract. Therefore, DPS will have the right, in addition to any other rights it may have, to seek in any court of competent jurisdiction temporary, preliminary, and permanent injunctive relief to restrain any breach, threatened breach, or otherwise to specifically enforce any confidentiality obligations of Vendor if Vendor fails to perform any of its confidentiality obligations under the Contract.

DPS Cyber Security Contract Exhibit v2.0 Page 27 of 30

f. Vendor must immediately return to DPS all non-public and confidential information when the Contract terminates, at such earlier time as when the information is no longer required for the performance of the Contract, or when DPS requests that such information be returned.

g. Information, documentation, and other material in connection with the Contract, including Vendor’s proposal, may be subject to public disclosure pursuant to the Texas Government Code Chapter 552.

h. The FBI and DPS have computer security requirements. Vendor’s and subcontractor’s employees working on this assignment must sign and submit appropriate agreements and abide by these security requirements, within five calendar days of DPS’s request.

14. Personal Information To the extent this subsection does not conflict with the section entitled “General Confidentiality

Requirements,” Vendor must comply with both sections. To the extent this subsection conflicts with the

Subsection entitled “General Confidentiality Requirements,” this section entitled “Personal Information” controls. Personal information does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government. “Personal identifying information” and “Sensitive personal information” are defined by Tex. Bus. & Com. Code Ch. 521. Both are classified as personal information for purposes of this section.

a. Vendor must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any personal information collected or maintained by Vendor under the Contract.

b. “Breach of system security” is defined in Tex. Bus. & Com. Code Sec. 521.053.

c. Vendor must notify DPS and affected parties of any breach of system security immediately (but no later than four hours) after discovering the breach or receiving notification of the breach, if personal information was, or is reasonably believed to have been, acquired by an unauthorized person. However, Vendor must delay providing notice to the affected parties at DPS’s request, if DPS determines that the notification will impede a criminal investigation. Vendor must otherwise comply with all notification requirements in Tex. Bus. & Com. Code Sec. 521.053.

d. In the event of a breach of system security, if personal information was, or is reasonably believed to have been, acquired by an unauthorized person, DPS may assess and enforce cyber insurance coverage requirements, indemnification, duty to defend, liquidated damages, actual damages, sanctions, rights, claims, remedies and other amounts against Vendor in accordance with the contract that includes these Cyber Security Contract Requirements, and in accordance with other applicable law. Vendor understands that there may be constitutional and statutory limitations on DPS to enter into certain terms and conditions imposed by Vendor that contradict these Cyber Security Contract Requirements and that any such terms and conditions will not be binding on DPS except to the extent authorized by the laws and constitution of the State of Texas.

DPS Cyber Security Contract Exhibit v2.0 Page 28 of 30

e. DPS may assess liquidated damages under Section 18 in the amount of the per capita data breach cost for public sector (government) records as listed in the current Ponemon Institute Research Report Cost of Data Breach Study: United States. The number of affected records will be determined at the time of breach, with a not to exceed Liquidated Damages Cap of 100% of the total contract value.

f. The Ponemon Institute Research Report Cost of Data Breach Study: United States may be found at: http://www-03.ibm.com/security/data-breach/.

g. DPS will not hold Vendor responsible or assess liquidated damages due to a breach of system security that DPS determines was caused entirely by someone other than Vendor, Vendor’s subcontractor, or Vendor’s agent. (This clause is not to be interpreted that Vendor is absolved of liability with any other sections pertaining to cyber security or data protection).

h. Any liquidated damages assessed under the Contract may, at DPS’s option, be deducted from any payments due Vendor. DPS has the right to offset any liquidated damages payable to DPS, as specified above, against any payments due to Vendor. If insufficient payments are available to offset such liquidated damages, then Vendor will pay to DPS any remaining liquidated damages within 15 calendar days following receipt of written notice of the amount due.

15. Disclosure of Security Incident Without limitation on any other provision of the Contract regarding information security or security breaches, Vendor must provide notice to DPS’s Contract Monitor and the CISO as soon as possible (but no later than four hours) following the discovery or reasonable belief that there has been a Security

Incident.

a. Within four hours of the discovery or reasonable belief of a known or potential Security Incident, Vendor must provide a written report to the CISO detailing the circumstances of the incident, which includes at a minimum:

1) A description of the nature of the Security Incident;

2) The type of DPS information involved;

3) Who may have obtained DPS information;

4) What steps Vendor has taken or will take to investigate the Security Incident;

5) What steps Vendor has taken or will take to mitigate any negative effect of the Security Incident; and

6) A point of contact for additional information.

b. Each day thereafter until the investigation is complete, Vendor must provide the CISO with a written report regarding the status of the investigation and the following additional information as it becomes available:

1) Who is known or suspected to have gained unauthorized access to DPS’s information;

2) Whether there is any knowledge if DPS information has been abused or compromised;

3) What additional steps Vendor has taken or will take to investigate the Security Incident;

4) What steps Vendor has taken or will take to mitigate any negative effect of the Security Incident; and http://www-03.ibm.com/security/data-breach/

DPS Cyber Security Contract Exhibit v2.0 Page 29 of 30

5) What corrective action Vendor has taken or will take to prevent future similar unauthorized use or disclosure.

c. Vendor must confer with the CISO regarding the proper course of the investigation and risk mitigation. DPS reserves the right to conduct an independent investigation of any Security Incident, and should DPS choose to do so, Vendor must cooperate fully by making resources, personnel, and systems access available to DPS and DPS’s authorized representatives.

d. Subject to review and approval of the CISO, Vendor must, at its own cost, provide notice that satisfies the requirements of applicable law to individuals whose personal, confidential, or privileged data were compromised or likely compromised as a result of the Security Incident. If DPS elects to send its own separate notice, then all costs associated with preparing and providing notice will be reimbursed to DPS by Vendor. If Vendor does not reimburse such costs within 30 calendar days of DPS’s written request, DPS will have the right to collect such costs.

16. Cyber Insurance Requirement If required by the Contract to get Cyber insurance, Vendor must maintain sufficient cyber insurance to cover any losses, security breaches, privacy breaches, unauthorized distributions, or releases or uses of any data transferred to or accessed by Vendor under or as a result of the Contract.

a. This insurance must provide sufficient coverage for Vendor, DPS, and affected third parties for the review, repair, notification, remediation, and other response to such events, including data spillage, breaches, or similar incidents.

b. DPS may confer with other state resources such as SORM or TDI to review such coverage(s) prior to approving them as acceptable under the Contract.

c. Vendor must obtain modified coverage(s) as reasonably requested by DPS within ten calendar days of Vendor’s receipt of such request from DPS.

17. Representations and Warranties Related to Software If any software, that is COTS and not a Work for Hire, is provided under the Contract, Vendor represents and warrants each of the following:

a. Vendor has sufficient right, title, and interest in the Software to grant the license required.

b. Contract terms and conditions included in any “clickwrap,” “browsewrap,” “shrinkwrap,” or other license agreement that accompanies any Software (including Software Updates, Software Patch/Fix, or Software Upgrades) provided under the Contract are void and have no effect unless DPS specifically agrees to each licensure term in the fully executed Contract.

c. The Software provided under the Contract does not infringe upon or constitute a misuse or misappropriation of any patent, trademark, copyright, trade secret, or other proprietary right;

DPS Cyber Security Contract Exhibit v2.0 Page 30 of 30

d. Software and any Software Updates, Software Maintenance, Software Patch/Fix, and Software Upgrades provided under the Contract does not contain viruses, malware, spyware, key logger, back door, or other covert communications, or any computer code intentionally designed to disrupt, disable, harm, or otherwise impede in any manner, including aesthetical disruptions or distortions, the operation of the computer program, or any other associated software, firmware, hardware, or computer system, (including local area or wide-area networks), in a manner not intended by its creator(s); and

Software provided under the Contract does not contain any computer code that would disable the

Software or impair in any way its operation based on the elapsing of a period of time, exceeding an authorized number of copies, advancement to a particular date or other numeral, or other similar self-destruct mechanism (sometimes referred to as “time bombs”, “time locks”, or “drop dead” devices) or that would permit Vendor to access the Software to cause such disablement or impairment (sometimes referred to as “trap door” devices).