ESBD_563015_1790361758894_Attachment 3 - Data Use Agreement.pdf

RFQ No. 3202600207 Page 1 of 21 Attachment 3: Data Use Agreement v. Dec 2025

Request for Qualifications (RFQ) Attachment 3 – Data Use Agreement Data Use Agreement between the Texas Workforce Commission and

Contractor This Data Use Agreement (DUA) is effective as of the date of the Contract

(Effective Date) into which it is incorporated, by and between the Texas

Workforce Commission (TWC) and Contractor (Contract).

ARTICLE 1. PURPOSE; APPLICABILITY; ORDER OF

PRECEDENCE

The purpose of this DUA is to facilitate access to, creation, receipt, maintenance, use, disclosure, or transmission of Confidential Information with Contractor, and describe Contractor’s rights and obligations with respect to the Confidential Information and the limited purposes for which the Contractor may create, receive, maintain, use, disclose or have access to Confidential Information. This DUA also describes TWC’s remedies in the event of Contractor’s noncompliance with its obligations under this DUA.

TWC requires its contractors to comply with the terms of this DUA to safeguard all Confidential Information.

As of the Effective Date of this DUA, if any provision of the Contract conflicts with this DUA, this DUA controls.

ARTICLE 2. DEFINITIONS

For the purposes of this DUA, the following terms have the following meanings:

Authorized Purpose means the specific purpose or purposes described in the Contract for Contractor to fulfill its obligations under the Contract, or any other purpose expressly authorized by TWC in writing in advance.

RFQ No. 3202600207 Page 2 of 21

Authorized User means a person:

1. Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze

Confidential Information pursuant to this DUA;

2. For whom Contractor warrants and represents has a demonstrable need to create, receive, maintain, use, disclose or have access to the Confidential Information; and

3. Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA.

Breach means an impermissible use or disclosure of electronic or non-electronic sensitive personal information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of

Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identify theft, or medical identity theft. Any suspicion or actual event of acquisition, access, use, disclosure, or loss of Confidential Information other than as permitted by this

DUA shall be presumed to be a Breach unless Contractor demonstrates to

TWC, based on a risk assessment approved by TWC, that there is a low probability that the Confidential Information has been compromised.

Confidential Information means any communication or record

(whether oral, written, electronically stored or transmitted, or in any other form) describing an individual or entity provided to or made available to Contractor or that Contractor may create, receive, maintain, use, disclose or have access to on behalf of TWC or during the course of performance under the base contract, including this Data Use Agreement. Confidential information may be subject to federal or state laws or regulations, and any

RFQ No. 3202600207 Page 3 of 21 subsequent amendments thereto, including, but not limited to, any or all of the following:

1. Unemployment Compensation records as defined in the

Texas Unemployment Compensation Act and related federal laws and regulations, including 20 C.F.R. 603;

2. Vocational Rehabilitation Services records as defined in 34 C.F.R. 361;

3. Education records as defined in the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g; 34 C.F.R. Part 99;

4. Federal Tax Information as defined in Internal Revenue Code

§6103 and Internal Revenue Service Publication 1075;

5. Personal Identifying Information (PII) as defined in Tex.

Business and Commerce Code, Chapter 521;

6. Sensitive Personal Information (SPI) as defined in Tex. Business and Commerce Code, Chapter 521;

7. Social Security Administration Data, including, without limitation, Medicaid information means disclosures of information made by the

Social Security Administration or the Centers for Medicare and

Medicaid Services from a federal system of records for administration of federally funded benefit programs under the

Social Security Act, 42 U.S.C., Chapter 7;

8. All privileged work product;

9. All information designated as confidential under the constitution and laws of the State of Texas and of the United States, including the Texas Health & Safety Code and the Texas Public Information

Act, Tex. Government Code, Chapter 552.

Destroy, Destruction, for Confidential Information, means:

RFQ No. 3202600207 Page 4 of 21

1. Paper, film, or other hard copy media have been shredded or destroyed such that the Confidential Information cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction.

2. Electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88, Rev. 2, "Guidelines for Media Sanitization," such that the Confidential

Information cannot be retrieved.

Discover, Discovery means the first day on which a Breach becomes suspected or known to Contractor, or, by exercising reasonable diligence would have been suspected or known to Contractor.

Legally Authorized Representative of an individual, including as provided in 42 C.F.R. §435.923 (authorized representative); 45 C.F.R.

§164.502(g)(1) (personal representative); Tex. Occ. Code § 151.002(6);

Tex. H. & S. Code § 166.164 (medical power of attorney); 34 C.F.R. §

361.5(c)(31) (individual’s representative); and Tex. Estates Code § 22.031

(representative).

Required by Law means a mandate contained in law that compels an entity to use or disclose Confidential Information that is enforceable in a court of law, including court orders, warrants, subpoenas or investigative demands.

Security Incident means a breach or suspected breach of system security as defined by Section 521.053, Tex. Business & Commerce Code;

or the introduction of ransomware, as defined by Section 33.023, Tex.

Penal Code, into a computer, computer network, or computer system.

Workforce means employees, volunteers, trainees or other persons whose performance of work is under the direct control of a party, whether or not they are paid by that party.

RFQ No. 3202600207 Page 5 of 21

ARTICLE 3. CONTRACTOR'S DUTIES REGARDING

CONFIDENTIAL INFORMATION

Section 3.01 Obligations of Contractor

Contractor agrees that:

A. With respect to ALL Confidential Information, Contractor shall:

1. Exercise reasonable care and no less than the same degree of care Contractor uses to protect its own confidential, proprietary and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized

Purpose or as Required by Law. Contractor will access, create, maintain, receive, use, disclose, transmit or Destroy Confidential

Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses.

2. Establish, implement, and maintain appropriate procedural, administrative, physical, and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the

Confidential Information, in accordance with applicable laws or regulations relating to Confidential Information, to prevent any unauthorized use or disclosure of Confidential Information as long as Contractor has such Confidential Information in its actual or constructive possession.

3. Implement, update as necessary, and document privacy, security and Breach notice policies and procedures and an incident response plan to address a Breach, to comply with the privacy, security and breach notice requirements of this DUA prior to conducting work under the Contract. Contractor shall produce, within three (3) business days of a request by TWC, copies of its

RFQ No. 3202600207 Page 6 of 21 policies and procedures and records relating to the use or disclosure of Confidential Information.

4. Obtain TWC’s prior written consent to disclose or allow access to any portion of the Confidential Information to any person, other than Authorized Users who are members of Contractor’s Workforce and who have completed training in confidentiality, privacy, security, and the importance of promptly reporting any Breach to

Contractor's management. Contractor shall produce evidence of completed training to TWC upon request. TWC, at its election, may assist Contractor in training and education on specific or unique

TWC processes, systems and/or requirements. All of Contractor’s

Authorized Users, Workforce and Subcontractors with access to a state computer system or database will complete a cybersecurity training program certified under Tex. Government Code § 2063.102 by the Texas Cyber Command.

5. Establish, implement, and maintain appropriate sanctions against any member of its Workforce who fails to comply with this DUA, the Contract or applicable law. Contractor shall maintain evidence of sanctions and produce it to TWC each time a sanction is imposed and when TWC requests information related to sanctions.

6. Obtain prior written approval of TWC to disclose or provide access to any Confidential Information on the basis that such act is

Required by Law, so that TWC may have the opportunity to object to the disclosure or access and seek appropriate relief. If TWC objects to such disclosure or access, Contractor shall refrain from disclosing or providing access to the Confidential Information until

TWC has exhausted all alternatives for relief.

7. Certify that its Authorized Users each have a demonstrated need to

RFQ No. 3202600207 Page 7 of 21 know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose and that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in this DUA. Contractor shall maintain at all times an updated, complete, accurate list of Authorized Users and supply it to TWC upon request.

8. Provide, and shall cause its agents to provide, to TWC periodic written confirmation of compliance with controls and the terms and conditions of this DUA.

9. Return to TWC or Destroy, at TWC’s election and at Contractor’s expense, all Confidential Information received from TWC or created or maintained by Contractor or any of Contractor’s agents on TWC's behalf upon the termination or expiration of this DUA, if reasonably feasible and permitted by law. Contractor shall certify in writing to TWC that all such Confidential Information has been

Destroyed or returned to TWC, and that Contractor and its agents have retained no copies thereof.

10. Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destroy any Confidential Information if federal or state law, or TWC record retention policy, or a litigation hold notice prohibits such Destruction. If such return or

Destruction is not reasonably feasible, or is impermissible by law, Contractor shall immediately notify TWC of the reasons such return or Destruction is not feasible and agree to extend the protections of this DUA to the Confidential Information for as long as

Contractor maintains such Confidential Information.

11. Complete and return with the Contract to TWC, the TWC Security

RFQ No. 3202600207 Page 8 of 21 and Privacy Inquiry attached as Form 5 to this RFQ. The Security and Privacy Inquiry identifies basic privacy and security controls with which Contractor must comply to protect Confidential

Information. Contractor shall comply with periodic security controls compliance assessment and monitoring by TWC as required by state and federal law, based on the type of Confidential

Information Contractor creates, receives, maintains, uses, discloses, or has access to and the Authorized Purpose and level of risk. Contractor's security controls shall be based on the National

Institute of Standards and Technology (NIST) Special Publication

800-53, Rev. 5. Contractor shall update its security controls assessment whenever there are significant changes in security controls for TWC Confidential Information and shall provide the updated document to TWC. TWC also reserves the right to request updates as needed to satisfy state and federal monitoring requirements.

12. Only conduct secure transmissions of Confidential Information whether in paper, oral or electronic form. A secure transmission of electronic Confidential Information in motion includes secure File

Transfer Protocol (SFTP) or encryption at an appropriate level as required by rule, regulation or law. Confidential Information at rest requires encryption. All electronic data transfer and communications of Confidential Information shall be through secure systems.

13. Contractor shall provide proof of system, media, or device security and/or encryption to TWC no later than 48 hours after TWC's written request in response to a compliance investigation, audit, or the Discovery of a Breach.

14. Designate and identify a person or persons, as Privacy Official and

RFQ No. 3202600207 Page 9 of 21

Information Security Official, each of whom is authorized to act on behalf of Contractor and is responsible for the development and implementation of the privacy and security requirements in this

DUA. Contractor shall provide name and current address, phone number and e-mail address for such designated officials to TWC upon execution of this DUA and prior to any change. Upon written notice from TWC, Contractor shall promptly remove and replace such official(s) if such official(s) is not performing the required functions.

15. Make available to TWC any information TWC requires to fulfill

TWC's obligations to provide access to, or copies of, Confidential

Information in accordance with applicable laws, regulations or demands of a regulatory authority relating to Confidential

Information. Contractor shall provide such information in a time and manner reasonably agreed upon or as designated by the applicable law or regulatory authority.

16. IF CONTRACTOR IS A “COVERED ENTITY” PURSUANT TO HEALTH

INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996

(HIPAA) AND TRANSFERS DATA TO TWC, THE CONTRACTOR IS

RESPONSIBLE FOR OBTAINING THE DATA SUBJECT’S INFORMED

CONSENT AND FOR NOTIFYING THE DATA SUBJECT THAT ANY

INFORMATION THAT IS “PROTECTED HEALTH INFORMATION”

PURSUANT TO HIPAA WHILE IT IS HELD BY THE COVERED

ENTITY WILL NO LONGER BE SUBJECT TO HIPAA PROTECTIONS

ONCE IT IS TRANSFERRED TO TWC.

17. Comply with the following laws and standards if applicable to the type of Confidential Information and Contractor's

Authorized Purpose:

RFQ No. 3202600207 Page 10 of 21

• Title 1, Part 10, Chapter 202, Subchapter B, Texas Administrative Code;

• The Privacy Act of 1974;

• OMB Memorandum 17-12;

• The Federal Information Security Management Act of

2014 (FISMA);

• Internal Revenue Publication 1075 – Tax Information

Security Guidelines for Federal, State and Local Agencies;

• NIST Special Publications 800-53 and 800-53A –

Recommended Security Controls for Federal Information

Systems and Organizations, as currently revised;

• NIST Special Publication 800-47, Rev. 1 – Security

Guide for Interconnecting Information Technology

Systems;

• NIST Special Publication 800-88, Rev. 2, Guidelines for Media Sanitization;

• NIST Special Publication 800-111, Guide to Storage of

Encryption Technologies for End User Devices containing

PHI;

• Federal Information Processing Standards 140-3 (or more recent validated mechanisms)

• Family Educational Rights and Privacy Act

• Tex. Business and Commerce Code, Chapter 521;

• Any other State or Federal law, regulation, or administrative rule relating to the specific TWC program area that Contractor supports on behalf of TWC.

RFQ No. 3202600207 Page 11 of 21

18. Be permitted to use or disclose Confidential Information for the proper management and administration of Contractor or to carry out Contractor’s legal responsibilities, except as otherwise limited by this DUA, the Contract, or law applicable to the Confidential

Information, if:

(a) Disclosure is Required by Law;

(b) Contractor obtains reasonable assurances from the person to whom the information is disclosed that the person shall:

i. Maintain the confidentiality of the

Confidential Information in accordance with this DUA;

ii. Use or further disclose the information only as

Required by Law or for the Authorized Purpose for which it was disclosed to the person; and

iii. Notify Contractor in accordance with Section 4.01 of a

Breach of Confidential Information that the person

Discovers or should have Discovered with the exercise of reasonable diligence.

B. With respect to ALL Confidential Information, Contractor shall NOT:

1. Attempt to re-identify or further identify Confidential Information that has been de-identified or attempt to contact any persons whose records are contained in the Confidential Information, except for an Authorized Purpose, without express written authorization from TWC.

2. Engage in prohibited marketing or sale of Confidential

Information without the express written consent of TWC.

RFQ No. 3202600207 Page 12 of 21

ARTICLE 4. BREACH NOTICE, REPORTING

AND CORRECTION REQUIREMENTS

Section 4.01. Cooperation and Financial Responsibility.

(A) Contractor shall, at Contractor’s expense, cooperate fully with TWC in investigating, mitigating, reporting, and issuing notifications as directed by TWC for any Breach of Confidential Information.

(B) After Discovery of a Breach, Contractor shall make Confidential

Information in Contractor’s possession available to TWC (or to others at TWC’s written request) as needed to comply with the requirements of any applicable law, regulation, or federal policy directive.

(C) Contractor’s obligation begins at the Discovery of a Breach and continues as long as related activity continues, until all effects of the Breach are mitigated to TWC’s satisfaction (the "incident response period").

Section 4.02. Initial Breach Notice.

For federal information obtained from a federal system of records, including Federal Tax Information and Social Security Administration Data

(which includes Medicaid and other governmental benefit program

Confidential Information), Contractor shall notify TWC of the Breach within the first consecutive clock hour of Discovery. The Contract shall specify whether Confidential Information is obtained from a federal system of records. For all other types of Confidential Information Contractor shall notify TWC of the Breach not more than 12 chronological hours after

Discovery. Contractor shall initially report to TWC's Privacy and Security

Officers via email at: ciso@twc.texas.gov and mailto:ciso@twc.texas.gov

RFQ No. 3202600207 Page 13 of 21 privacy.office@twc.texas.gov, with a copy to the TWC Contract Manager and, if applicable, the TWC division contact listed in the Contract.

Contractor shall provide to TWC all information reasonably available to

Contractor about the Breach. Contractor shall provide contact information to TWC for Contractor's single point of contact who will communicate with

TWC both on and off business hours during the incident response period.

Section 4.03. Twelve Chronological Hours’ Notice.

No later than twelve (12) chronological hours after Discovery, or a time within which Discovery reasonably should have been made by Contractor of a Breach of Confidential Information, Contractor shall provide written notification to TWC of all reasonably available information about the

Breach, and Contractor's investigation, including, to the extent known to

Contractor:

1. The date the Breach occurred;

2. The date of Contractor's Discovery;

3. A brief description of the Breach, including how it occurred and who is responsible (or hypotheses, if not yet determined);

4. A brief description of Contractor's investigation and the status of the investigation;

5. A description of the types and amount of Confidential

Information involved;

6. Identification of and number of all individuals reasonably believed to be affected, including first and last name of the individual and if applicable, the Legally authorized representative, last known address, age, telephone number, and email address if it is a preferred contact method;

mailto:privacy.office@twc.texas.gov

RFQ No. 3202600207 Page 14 of 21

7. Contractor’s initial risk assessment of the Breach demonstrating whether individual or other notices are required by applicable law or this DUA for TWC approval, including an analysis of whether there is a low probability of compromise of the Confidential

Information or whether any legal exceptions to notification apply;

8. Contractor's proposed strategy, which shall be subject to TWC’s prior written approval, regarding the steps individuals and/or

Contractor on behalf of individuals, should take to protect the affected individuals from potential harm, including Contractor’s assessment of whether notifications, credit protection, and/or claims monitoring is required or recommended, along with any other specific protections recommended for any Legally

Authorized Representative to take on behalf of an individual with special capacity or circumstances;

9. The steps Contractor has taken to mitigate the harm or potential harm caused (including without limitation the provision of sufficient resources to mitigate);

10. The steps Contractor has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Breach;

11. Identify, describe, or estimate of the persons, Workforce, or individuals and any law enforcement that may be involved in the

Breach;

12. Provide a reasonable schedule for Contractor to regularly update

TWC regarding Contractor’s response to the Breach, which shall not be less than every three (3) business days or as otherwise directed by TWC in writing;

13. Provide TWC with all information Contractor has about risk estimations, reporting, notification, if any, mitigation, corrective

RFQ No. 3202600207 Page 15 of 21 action, root cause analysis and when such activities are expected to be completed. If such information is not immediately available, Contractor shall provide such information to TWC as soon as it becomes available; and

14. Any reasonably available, pertinent information, documents or reports related to a Breach that TWC requests following

Discovery.

Section 4.04. Investigation, Response and Mitigation.

(A) Contractor shall immediately conduct a full and complete investigation, respond to the Breach, commit necessary and appropriate staff and resources to expeditiously respond, and report as required to TWC for incident response purposes and for purposes of TWC’s compliance with report and notification requirements, to the satisfaction of TWC.

(B) Contractor shall complete or participate in a risk assessment as directed by TWC following a Breach, and provide the final assessment, corrective actions and mitigations to TWC for review and approval.

(C) Contractor shall fully cooperate with TWC to respond to inquiries and/or proceedings by state and federal authorities, persons and/or individuals about the Breach.

(D) Contractor shall fully cooperate with TWC's efforts to seek appropriate injunctive relief or otherwise prevent or curtail such

Breach, or to recover or protect any Confidential Information, including complying with reasonable corrective action or measures, as specified by TWC in a Corrective Action Plan if directed by TWC under the Contract.

RFQ No. 3202600207 Page 16 of 21

Section 4.05. Breach Notification to Individuals and Reporting to Authorities.

(A) TWC may direct Contractor to provide Breach notification to individuals, regulators or third parties, as specified by TWC following a Breach.

(B) Contractor must comply, at its sole expense, with all applicable legal and regulatory requirements in the time, manner and content of any notification to individuals, regulators or third-parties, or any notice required by other state or federal authorities, including without limitation, notifications required by the Texas Business and

Commerce Code and other applicable laws. Contractor must obtain

TWC’s prior written approval of all such notifications as set forth in subsection (C). Notice letters will be in Contractor's name and on

Contractor's letterhead, unless otherwise directed by TWC, and will contain contact information, including the name and title of

Contractor's representative, an email address and a toll-free telephone number, for the individual to obtain additional information.

(C) If notifications must be sent under subsection 4.05(B), Contractor shall provide TWC with (i) draft notifications for TWC’s approval prior to distribution and (ii) copies of distributed and approved communications after distribution.

(D) Contractor shall have the burden of demonstrating to the satisfaction of TWC that any required notification was timely made. If there are delays outside of Contractor's control, Contractor shall provide written documentation to TWC of the reasons for the delay.

(E) If TWC directs Contractor to provide notifications, TWC shall, in

RFQ No. 3202600207 Page 17 of 21 the time and manner reasonably requested by Contractor, cooperate and assist with Contractor’s information requests necessary to make such notifications.

ARTICLE 5. GENERAL PROVISIONS

Section 5.01. Ownership of Confidential Information Contractor acknowledges and agrees that the Confidential Information is and shall remain the property of TWC. Contractor agrees it acquires no title or rights to the Confidential Information.

Section 5.02. TWC Commitment and Obligations TWC will not request Contractor to create, maintain, transmit, use, or disclose PHI in any manner that would not be permissible under applicable law if done by TWC.

Section 5.03. TWC Right to Inspection At any time upon reasonable notice to Contractor, or if TWC determines that Contractor has violated this DUA, TWC, directly or through its agent, will have the right to inspect the facilities, systems, books, and records of

Contractor to monitor compliance with this DUA. For purposes of this subsection, TWC’s agent(s) include, without limitation, the TWC Office of the Inspector General, the Office of the Attorney General of Texas, the

State Auditor’s Office, outside consultants, legal counsel, or other designee.

Section 5.04. Term; Termination of DUA; Survival This DUA will be effective on the date on which Contractor executes the

Contract and will terminate upon termination of the Contract and as set forth herein; provided, however, that Contractor’s obligations to keep the

RFQ No. 3202600207 Page 18 of 21

Confidential Information confidential and to use the Confidential

Information only for the Authorized Purpose and not for any other purpose shall survive termination of the Contract and this DUA. If the Contract is extended, this DUA is extended to run concurrent with the Contract.

(A) If TWC determines that Contractor has violated a material term of this DUA; TWC may in its sole discretion:

1. Exercise any of its rights including but not limited to reports, access and inspection under this DUA and/or the Contract; or

2. Require Contractor to submit to a corrective action plan, including a plan for monitoring and plan for reporting as TWC may determine necessary to maintain compliance with this

DUA; or

3. Provide Contractor with a reasonable period to cure the violation as determined by TWC; or

4. Terminate the DUA and Contract immediately and seek relief in a court of competent jurisdiction in Travis County, Texas.

Before exercising any of these options, TWC will provide written notice to Contractor describing the violation and the action it intends to take.

(B) The duties of Contractor under this DUA survive the expiration or termination of this DUA until all the Confidential Information is

Destroyed or returned to TWC, as required by this DUA.

Section 5.05. Injunctive Relief

(A) Contractor acknowledges and agrees that TWC may suffer irreparable injury if Contractor fails to comply with any of the terms of this DUA with respect to the Confidential Information or a

RFQ No. 3202600207 Page 19 of 21 provision of other applicable laws or regulations.

(B) Contractor further agrees that monetary damages may be inadequate to compensate TWC for Contractor's failure or threatened failure to comply. Accordingly, Contractor agrees that

TWC will, in addition to any other remedies available to it at law or in equity, be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages, to enforce the terms of this DUA or in response to Contractor’s threat to not comply with this DUA.

Section 5.06. Indemnification

CONTRACTOR SHALL INDEMNIFY, DEFEND AND HOLD HARMLESS TWC

AND ITS RESPECTIVE EXECUTIVES, COMMISSIONERS, EMPLOYEES,

SUBCONTRACTORS, AGENTS (INCLUDING OTHER STATE AGENCIES

ACTING ON BEHALF OF TWC) OR OTHER MEMBERS OF TWC (EACH OF THE

FOREGOING HEREINAFTER REFERRED TO AS

AN “INDEMNIFIED PARTY”) AGAINST ALL ACTUAL AND DIRECT LOSSES

SUFFERED BY THE INDEMNIFIED PARTY AND ALL LIABILITY TO THIRD

PARTIES ARISING FROM OR IN CONNECTION WITH ANY BREACH OF THIS

DUA OR FROM ANY ACTS OR OMISSIONS RELATED TO THIS DUA BY

CONTRACTOR OR ITS EMPLOYEES, DIRECTORS, OFFICERS, OR AGENTS

OR OTHER MEMBERS OF CONTRACTOR’S WORKFORCE. THE DUTY TO

INDEMNIFY, DEFEND AND HOLD HARMLESS IS INDEPENDENT OF THE

DUTY TO INSURE. UPON DEMAND, CONTRACTOR SHALL REIMBURSE TWC

FOR ANY AND ALL LOSSES, LIABILITIES, LOST PROFITS, FINES,

PENALTIES, COSTS OR EXPENSES (INCLUDING COSTS OF REQUIRED

NOTICES, INVESTIGATION, AND MITIGATION OF A BREACH, FINES OR

PENALTIES IMPOSED ON AN INDEMNIFIED PARTY BY A REGULATORY

AUTHORITY, AND REASONABLE ATTORNEYS’ FEES) WHICH MAY BE

RFQ No. 3202600207 Page 20 of 21

IMPOSED UPON ANY INDEMNIFIED PARTY TO THE EXTENT CAUSED BY

AND WHICH RESULTS FROM THE CONTRACTOR’S FAILURE TO MEET ANY

OF ITS OBLIGATIONS UNDER THIS DUA. CONTRACTOR’S OBLIGATION TO

DEFEND, INDEMNIFY AND HOLD HARMLESS ANY INDEMNIFIED PARTY

WILL SURVIVE THE EXPIRATION OR TERMINATION OF THIS DUA.

Section 5.07. Insurance

(A) In addition to any insurance required in the Contract, at TWC's option, TWC may require Contractor to maintain, at its expense, the special and/or custom first- and third-party insurance coverages, including without limitation data breach, cyber liability, crime theft and notification expense coverages, with policy limits sufficient to cover any liability arising under this DUA, naming the

State of Texas, acting through TWC, as an additional named insured and loss payee, with primary and noncontributory status.

(B) Contractor shall provide TWC with written proof that required insurance coverage is in effect, at the request of

TWC.

Section 5.08. Entirety of the Contract This DUA is incorporated by reference into the Contract and, together with the Contract, constitutes the entire agreement between the parties. No change, waiver, or discharge of obligations arising under those documents will be valid unless in writing and executed by the party against whom such change, waiver, or discharge is sought to be enforced.

Section 5.09. Automatic Amendment and Interpretation Upon the effective date of any amendment or issuance of additional regulations to any law applicable to Confidential Information, this DUA will

RFQ No. 3202600207 Page 21 of 21 automatically be amended so that the obligations imposed on TWC and/or

Contractor remain in compliance with such requirements. Any ambiguity in this DUA will be resolved in favor of a meaning that permits TWC and

Contractor to comply with laws applicable to Confidential Information.

Section 5.10. Notices; Requests for Approval All notices and requests for approval related to this DUA must be directed to the TWC Chief Information Security Officer at ciso@twc.texas.gov, the TWC

Privacy Officer at privacy.office@twc.texas.gov, with a copy to the TWC

Contract Manager.

mailto:ciso@twc.texas.gov mailto:privacy.office@twc.texas.gov