EVT0010873_Bid_Documents.pdf

Office of Procurement and Contracts 900 SW Jackson St., Room 1001 North Topeka, KS 66612

Phone: 785-296-2376 Fax: 785-296-7240 https://admin.ks.gov/offices/procurement-contracts

Adam Proffitt, Secretary Todd Herman, Director Laura Kelly, Governor

Request for Quote (RFQ)

Bid Event Number: EVT0010873

Requisition ID: 252179

Date Posted: July 9, 2026

Closing Date: August 5, 2026, 2:00 PM CST

Procurement Officer: Michelle Brown Telephone: 785-296-2401 E-Mail Address: Michelle.r.brown@ks.gov Web Address: http://admin.ks.gov/offices/procurement-contracts

Agency: Kansas Department of Transportation (KDOT)

Item: Benchtop XRF Spectrometer

This Bid Event was recently posted to the Procurement and Contracts Internet website.

The document can be downloaded by going to the following website:

http://admin.ks.gov/offices/procurement-contracts

It shall be the bidder's responsibility to monitor this website on a regular basis for any changes/amendments.

Questions/Addenda: Questions requesting clarification of the bid must be submitted in writing to the Procurement Officer indicated above:

Before the end of the day, on Wednesday, July 22, 2026

Answers to questions will be available in the form of an addendum on the Procurement and Contracts' website, http://admin.ks.gov/offices/procurement-contracts.

It shall be the responsibility of all participating bidders to acquire any and all addenda and additional information as it is made available from the web site cited above. Vendors/Bidders not initially invited to participate in this Bid Event must notify the Procurement Officer (Event Contact) of their intent to bid at least 24 hours prior to the event's closing date/time. Bidders are required to check the website periodically for any additional information or instructions.

mailto:Michelle.r.brown@ks.gov http://admin.ks.gov/offices/procurement-contracts

Event ID: EVT0010873

Vendor Bid Submission

The Kansas Department of Administration, Office of Procurement and Contracts is currently open to the public and accepting both emailed and hand delivered bids.

All emailed bids must be submitted to Procurement@ks.gov. All bids submitted must be received by the Office of Procurement and Contracts by the specific bid closing date and time of 2:00PM CST.

Please note that you will receive an email that your documents were received, if you do not receive an email there may be an issue, please call 785-296-2376 to confirm that your bid package was received electronically.

Vendor Response Checklist

The following checklist is provided to assist bidders in ensuring all requirements are met and all required submissions are included with the bid. Bidders are instructed to utilize this list for their own convenience to ensure compliance.

THE FOLLOWING INSTRUCTIONS AND FORMS MUST BE

COMPLETED AND SUBMITTED WITH YOUR BID RESPONSE

If you do not submit them with your bid it may result in the rejection of the proposal

Completed Bidder Registration submitted prior to bid submission.

Requirements forms for Bid Proposal

Completed and signed Signature Sheet / page 3 of this document.

Completed Immigration Reform and Control Certification / page 4 of this document.

Completed Sexual Harassment Form / page 5 of this document.

Completed Boycott of Israel / page 6 of this document

Completed Certification of Procurement / page 7 of this document

Completed Tax Clearance Certificate / instructions located page 8 of this document.

Signed Copy of any Amendment(s), if applicable/ Located on the Bid Solicitation Website

- Bidding Event Information - Under EVT0010873

Completed and signed Event Details document / Located on the Bid Solicitation Website -

Bidding Event Information - Under EVT0010873

Any other documentation bidder wants to include.

Completed Cost Sheet / page 20 of this document.

NOTE: In order to properly and completely respond to this Proposal, bidders MUST carefully review ALL sections and respond as required.

mailto:Procurement@ks.gov https://supplier.sok.ks.gov/psc/sokfsprdsup/SUPPLIER/ERP/c/SCP_PUBLIC_MENU_FL.SCP_PUB_BID_CMP_FL.GBL?& https://supplier.sok.ks.gov/psc/sokfsprdsup/SUPPLIER/ERP/c/SCP_PUBLIC_MENU_FL.SCP_PUB_BID_CMP_FL.GBL?&

Signature Sheet

Item: Benchtop XRF Spectrometer Agency: Kansas Department of Transportation (KDOT) Closing Date: August 5, 2026, 2:00 PM CST

By submission of a bid and the signatures affixed thereto, the bidder certifies all products and services proposed in the bid meet or exceed all requirements of this specification as set forth in the request and that all exceptions are clearly identified.

Legal Name of Person, Firm or Corporation

Mailing Address City & State Zip

Toll Free Telephone Local

Cell Phone Fax Number

Tax Number

CAUTION: If your tax number is the same as your Social Security Number (SSN), you must leave this line blank.

DO NOT enter your SSN on this signature sheet. If your SSN is required to process a contract award, including any tax clearance requirements, you will be contacted by an authorized representative of the Office of Procurement and Contracts at a later date.

E-Mail

Signature Date

Typed Name Title

In the event the contact for the bidding process is different from above, indicate contact information below.

Bidding Process Contact Name

Mailing Address City & State Zip

Toll Free Telephone Local

Cell Phone Fax Number

E-Mail

If awarded a contract and purchase orders are to be directed to an address other than above, indicate mailing address and telephone number below.

Award Contact Name

Mailing Address City & State Zip

Toll Free Telephone Local

Cell Phone Fax Number

E-Mail

Certification Regarding Immigration Reform & Control

All Contractors are expected to comply with the Immigration and Reform Control Act of 1986 (IRCA), as may be amended from time to time. This Act, with certain limitations, requires the verification of the employment status of all individuals who were hired on or after November 6, 1986, by the Contractor as well as any subcontractor or sub-subcontractor. The usual method of verification is through the Employment Verification (I-9) Form. With the submission of this bid, the Contractor hereby certifies without exception that Contractor has complied with all federal and state laws relating to immigration and reform. Any misrepresentation in this regard or any employment of persons not authorized to work in the United States constitutes a material breach and, at the State’s option, may subject the contract to termination and any applicable damages.

Contractor certifies that, should it be awarded a contract by the State, Contractor will comply with all applicable federal and state laws, standards, orders and regulations affecting a person’s participation and eligibility in any program or activity undertaken by the Contractor pursuant to this contract. Contractor further certifies that it will remain in compliance throughout the term of the contract.

At the State’s request, Contractor is expected to produce to the State any documentation or other such evidence to verify Contractor’s compliance with any provision, duty, certification, or the like under the contract.

Contractor agrees to include this Certification in contracts between itself and any subcontractors in connection with the services performed under this contract.

Signature, Title of Contractor: Date:

Policy Regarding Sexual Harassment

WHEREAS sexual harassment and retaliation for sexual harassment claims are unacceptable forms of discrimination that must not be tolerated in the workplace; and

WHEREAS state and federal employment discrimination laws prohibit sexual harassment and retaliation in the workplace; and

WHEREAS officers and employees of the State of Kansas are entitled to working conditions that are free from sexual harassment, discrimination, and retaliation; and

WHEREAS the Governor and all officers and employees of the State of Kansas should seek to foster a culture that does not tolerate sexual harassment, retaliation, and unlawful discrimination.

NOW THEREFORE, pursuant to the authority vested in me as Governor of the State of Kansas, I hereby order as follows:

1. All Executive Branch department and agency heads shall have available and shall regularly review and update at least every three years or more frequently as necessary, their sexual harassment, discrimination, and retaliation policies. Such policies shall include components for confidentiality and anonymous reporting, applicability to intern positions, and training policies.

2. All Executive Branch department and agency heads shall ensure that their employees, interns, and contractors have been notified of the state’s policy against sexual harassment, discrimination, or retaliation, and shall further ensure that such persons are aware of the procedures for submitting a complaint of sexual harassment, discrimination, or retaliation, including an anonymous complaint.

3. Executive Branch departments and agencies shall annually require training seminars regarding the policy against sexual harassment, discrimination, or retaliation. All employees shall complete their initial training session pursuant to this order by the end of the current fiscal year.

4. Within ninety (90) days of this order, all Executive Branch employees, interns, and contractors under the jurisdiction of the Office of the Governor shall be provided a written copy of the policy against sexual harassment, discrimination, and retaliation, and they shall execute a document agreeing and acknowledging that they are aware of and will comply with the policy against sexual harassment, discrimination, and retaliation.

5. Matters involving any elected official, department or agency head, or any appointee of the Governor may be investigated by independent legal counsel.

6. The Office of the Governor will require annual mandatory training seminars for all staff, employees, and interns in the office regarding the policy against sexual harassment, discrimination, and retaliation, and shall maintain a record of attendance.

7. Allegations of sexual harassment, discrimination, or retaliation within the Office of the Governor will be investigated promptly, and violations of law or policy shall constitute grounds for disciplinary action, including dismissal.

8. This Order is intended to supplement existing laws and regulations concerning sexual harassment and discrimination and shall not be interpreted to in any way diminish such laws and regulations. The Order provides conduct requirements for covered persons and is not intended to create any new right or benefit enforceable against the State of Kansas.

9. Persons seeking to report violations of this Order, or guidance regarding the application or interpretation of this Order, may contact the Office of the Governor regarding such matters.

Agreement to Comply with the Policy Against Sexual Harassment, Discrimination, and Retaliation.

I hereby acknowledge that I have received a copy of the State of Kansas Policy Against Sexual Harassment, Discrimination, and Retaliation established by Executive Order 18-04 and agree to comply with the provisions of this policy.

Signature and Date: Printed Name:

Certification of Company Not Currently Engaged in a Boycott of Goods or Services from Israel

In accordance with HB 2482, 2018 Legislative Session, the State of Kansas shall not enter into a contract with a Company to acquire or dispose of goods or services with an aggregate price of more than $100,000, unless such Company submits a written certification that such Company is not currently engaged in a boycott of goods or services from Israel that constitutes an integral part of business conducted or sought to be conducted with the State.

As a Contractor entering into a contract with the State of Kansas, it is hereby certified that the Company listed below is not currently engaged in a boycott of Israel as set forth in HB 2482, 2018 Legislature.

Signature, Title of Contractor Date

Printed

Name of Company

Certification of Company Not Currently Engaged in

The Procurement or Obtainment of Certain Equipment, Services, or Systems

WHEREAS, pursuant to Public Law 115-232, Section 889 of the John S. McCain National Defense Authorization Act of 2019, “covered telecommunications equipment or services” is defined as:

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities).

(2) Video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company (or any subsidiary or affiliate of such entities).

(3) Telecommunications or video surveillance services provided by such entities or using such equipment.

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the

Secretary of Defense, in consultation with the Director of the National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

WHEREAS, a “covered foreign country” means any of the following: (1) The People’s Republic of China,

(2) The Russian Federation, or (3) any country that is a state sponsor of terrorism1.

WHEREAS, foreign adversaries are increasingly creating and exploiting vulnerabilities in covered telecommunications equipment which store and communicate vast amounts of sensitive information and support infrastructure and emergency services, in order to commit malicious cyber-enabled actions;

WHEREAS, the unrestricted acquisition or use in the State of Kansas of covered telecommunications equipment designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries augments the ability of foreign adversaries to create and exploit vulnerabilities in technological equipment, services, or systems; and

WHEREAS, the State of Kansas has an interest in protecting itself against threats related to foreign adversary’s exploitation of vulnerabilities in covered telecommunications equipment.

THEREFORE, Contractor certifies that it shall not provide or procure to the State of Kansas or any agency thereof any covered telecommunications equipment either in whole or in part of any product or during the commission of any service.

FURTHERMORE, and notwithstanding any other contracts or agreements with Contractor, if Contractor has violated, misrepresented, or otherwise fails to comply with this certification document as determined by the State, the State may terminate any contract without penalty with Contractor immediately.

By signing the below, Contractor acknowledges and agrees to comply with the provisions of this policy.

CONTRACTOR

Signature, Title Date

1 Designations of a “state sponsor of terrorism” may be found at the U.S. Department of State website at:

https://www.state.gov/state-sponsors-of-terrorism/ https://www.state.gov/state-sponsors-of-terrorism/

Tax Clearance Instructions

A “Tax Clearance” is a comprehensive tax account review to determine and ensure that the account is compliant with all primary Kansas Tax Laws administered by the Kansas Department of Revenue (KDOR) Director of Taxation. Information pertaining to a Tax Clearance is subject to change(s), which may arise as a result of a State Tax Audit, Federal Revenue Agent Report, or other lawful adjustment(s).

To obtain a Tax Clearance Certificate, you must:

• Go to http://www.ksrevenue.org/taxclearance.html to request a Tax Clearance Certificate

• Return to the website the following working day to see if KDOR will issue the certificate

• If issued an official certificate, print it and attach it to your signed renewal document

• If denied a certificate, engage KDOR in a discussion about why a certificate wasn’t issued

Contractors must submit a current Tax Clearance Certificate along with the signed Renewal Document. No renewal will be processed unless a current Tax Clearance Certificate is submitted.

Per KSA 75-3740-(c), the Director of Purchases may reject the bid of any bidder who is in arrears on taxes due the State of Kansas. The Secretary of the Kansas Department of Revenue is authorized to exchange such information with the Director of Purchases as is necessary to determine a bidder’s tax clearance status, notwithstanding any other provision of law prohibiting disclosure of the contents of taxpayer records or information.

Please Note: Individual and business applications are available. For applications entered prior to 5:00 PM Monday through Friday, results typically will be available the following business day.

Tax clearance requests may be denied if the request includes incomplete or incorrect information.

Please Note: You will need to sign back into the KDOR website to view and print the official tax clearance certificate.

Information about Tax Registration can be found at the following website:

http://www.ksrevenue.org/busregistration.html http://www.ksrevenue.org/taxclearance.html http://www.ksrevenue.org/busregistration.html

Submission of Proposals

The Kansas Department of Administration, Office of Procurement and Contracts is currently open to the public and accepting both emailed and hand delivered bids.

All emailed bids must be submitted to Procurement@ks.gov . All bids submitted must be received by the Office of Procurement and Contracts by the specific bid closing date and time of 2:00PM CST.

Please note that you will receive an email that your documents were received, if you do not receive an email there may be an issue, please call 785-296-2376 to confirm that your bid package was received electronically.

All hand delivered bids must be received in our office prior to 2:00PM CST on the closing date at the address below to be considered.

Department of Administration Procurement and Contracts

Proposal # EVT0010873

Closing Date: August 5, 2026, 2:00 PM CST 900 SW Jackson, Room 1001 North Topeka, KS 66612-1286

Bids are not considered received until they are date and time stamped in the Office of Procurement and Contracts. The Office of Procurement and Contracts will not be responsible for late deliveries.

It is the responsibility of the bidder to ensure the bid date and time is met and the EVT number and company name is included in the subject line of the email. Bidders are encouraged to submit bids to the above email address no later than 1:45PM on the bid closing date. This allows time for staff to receive the bid and log it into our system prior to the bid closing at 2:00PM CST.

Invitation for Bids (IFB), Requests for Quotations (RFQ) and A-Bids (ARCH) submissions will be publicly read as needed via telecom on the specified Bid Event Closing date beginning at 2:30pm CST.

Join on your computer or mobile app Click here to join the meeting Or call in (audio only) +1 785-414-8630, 780766580# United States, Topeka, KS Phone Conference ID: 780 766 580#

Tab sheet requests for Invitation for Bids (IFB), Requests for Quotes (RFQ) and A-Bids (ARCH) can be requested by emailing tabsheets@ks.gov. Please include the EVT or A-Bid number on your request. Tab sheets will be emailed within five (5) business days of the request.

NOTE: In order to respond to this Invitation for Bid, bidders must carefully review all sections and respond as required properly and completely.

For questions regarding confirmation that your bid has been received by the Office of Procurement and Contracts, please call 785-296-2376.

https://admin.ks.gov/offices/procurement-contracts mailto:Procurement@ks.gov https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGQ4OTg3NTYtODEwYS00OWJiLTllYTMtY2NlOTA5MjMxMDIx%40thread.v2/0?context=%7b%22Tid%22%3a%22dcae8101-c92d-480c-bc43-c6761ccccc5a%22%2c%22Oid%22%3a%221f80ed87-f92a-4df7-8e39-64ea24e21473%22%7d tel:+17854148630,,780766580 mailto:tabsheets@ks.gov https://admin.ks.gov/offices/procurement-contracts

Electronic Payment Requirement with Hardship Exception

All payments due under this Agreement shall be made via electronic funds transfer (EFT) to the account designated by the receiving party. The State shall bear any fees associated with the transfer.

Payment shall be deemed complete upon receipt by the receiving party’s financial institution. The receiving party agrees to complete the State’s DA-130, Authorization for Electronic Deposit of Supplier Payment, through a Docusign process within 14 days of the receipt of the electronic form.

Notwithstanding the foregoing, if the receiving party determines that electronic payment would create a financial or operational hardship, the receiving party may request the State to make payment by alternative means. Such request must be submitted in writing and approved by the State, which shall not unreasonably withhold consent.

Such request should be sent to:

Kansas Department of Administration Procurement and Contracts 900 SW Jackson, Room 1001 North Topeka, Kansas 66612-1286

1. SPECIFICATIONS

Benchtop XRF (X-ray Fluorescence) Spectrometer

Kansas Department of Transportation (KDOT) is seeking bids for a Benchtop XRF (X-ray Fluorescence) spectrometer.

Contract Term: One time purchase.

Description:

This is an analytical instrument used for non-destructive, simultaneous elemental analysis of materials. It identifies elements by detecting the characteristic energy of X-rays emitted from a sample after excitation, allowing for fast, qualitative, and quantitative analysis of solids, liquids, and powders.

This equipment will be used for CCRL (Cement and Concrete Reference Laboratory) and AASHTO PSP (Proficiency Sample Program) testing.

Required Specifications:

• XRF, not ARL +XRF

• This equipment must meet ASTM C114 specifications (the standards the specifies test methods for the chemical analysis of hydraulic cement).

• Fused puck testing on cement

• Benchtop

• Not high-capacity testing

• Detector with an energy resolution at Mn K-alpha of <135 eV.”

Maintenance/Warranty:

There must be a warranty provided with the system. This warranty must be for 1 year to include any servicing of parts, systems, labor, and for firmware updates to the software. This warranty price must be included in the total price of the system.

SHOW MFR. & MODEL OFFERED: _________________________________________

Please include Manufacturing Codes and what, if there are any, Exceptions to the Specifications per section on this form.

EXCEPTIONS TO

MFG. CODE SPECIFICATION SPECIFICATIONS

XRF Spectrometer:

_____________ _____________ The system must be an XRF model and not the ARL+XRF..

_____________ _____________ This system is a low, not high-capacity unit, with low sample throughput, lower power x-ray source, (lower power tubes 50W-200W), and usage frequency is intermittent/Lab QC

_____________ _____________ Fused puck testing in cement (which is preparing the cement sample using a borate fusion W method resulting in a solid, homogeneous glass disk (or puck) rather than a pressed power pellet. This technique is used for high-precision, industrial grade analysis.

_____________ _____________ The detector must have an energy resolution at Mn K-alpha of <135eV.

WARRANTY:

_____________ _____________ The bidder agrees to guarantee the design, material and workmanship of the unit bid according to the standard factory warranty, and for a one-year term from date of acceptance.

_____________ ______________ A copy of the warranty shall accompany the bid.

_____________ _____________ Warranty coverage shall include costs associated with servicing of the hardware and software along with any technical support.

Kansas Department of Transportation Data

Security Attachment

The following provisions shall apply to all successful bidders engaged in the supply of Kansas Department of Transportation (KDOT) herein referred to as “AGENCY”, for the Data Security Attachment, good and/or services.

The following provisions will be incorporated into and made part of the contract between Bidder and Agency. By submitting the bid, the Bidder acknowledges that it has the capability to adhere to and will be bound by the following provisions as well as any other terms and conditions outlined in the solicitation.

1. General Statements.

a. Contractor acknowledges that it receives and/or has access to AGENCY computers, communication systems, data, and/or networks for the purposes set forth in the Contract. Contractor agrees to ensure that any information or data required to be delivered pursuant the Contract shall be delivered through systems and infrastructure approved by AGENCY and shall be consistent with industry best practices pertaining to security. If any data is made available or accessible to Contractor, its employees, agents, or contractors, pertaining to AGENCY’s business or financial affairs, or to AGENCY’s projects or transactions, Contractor will not store, copy, analyze, monitor, or otherwise use that data except for the purposes set forth in the Contract for the benefit of AGENCY.

b. Subject to any other express agreement between the Parties with respect to the Contract, Contractor has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect AGENCY’s data, services, and infrastructure in its environments or under its control against accidental, unauthorized or unlawful access, disclosure, alteration, loss, or destruction, as set out below.

c. To the extent AGENCY’s data includes personal data, the implementation of and compliance with these measures and any additional security measures set out herein are designed to provide an appropriate level of security in respect of the processing of the personal data and shall at all times comply fully with all applicable laws, regulations, and government orders relating to Restricted-Use Information and data privacy with respect to any such data that Contractor receives or has access to under the Contract or in connection with the performance of any services for AGENCY. Contractor will otherwise protect Restricted-Use Information and will not use, disclose, or transfer across borders such Restricted-Use Information.

d. Contractor shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state and local laws and regulations. Specifically, Contractor will fully comply with all Kansas statutes, regulations, and policies including the requirements in:

i. K.S.A 75-7244.

ii. S.B. 291 as published in Session Laws as published in Session Laws 2024, ch. 95, eff. July 1, 2024

iii. Applicable Kansas IT policies and standards adopted under the authority of the Kansas Information Technology Executive Council (ITEC), including 7000 Series “Security”

2. Definitions.

a. “Accepted Working Condition” (AWC) is the condition of the application in the Production Environment after the initial use of that application in the Production Environment.

b. “Authorized Personnel” means Contractor’s employees who have a need to know or otherwise access Restricted-Use Information to enable Contractor to perform its obligations under this Contractor.

c. “Change Request” (CR) is any activity that alters the scope, objectives, deliverables, requirements, basic architecture, cost or schedule of the service, solution, or interface system; or an activity that creates an impact/change to a current application in production, software configuration, or hardware configuration.

d. “Contract” is the legal agreement between AGENCY and the Contractor to which this document is incorporated into.

e. “Criminal Justice Information Services” (CJIS) is data provided to AGENCY by the Federal Bureau of Investigation or the Kansas Bureau of Investigation that includes sensitive information about criminal activities, investigations, and individuals involved in the criminal justice system. CJIS data shall include but is not limited to: (1) biometric data; (2) identity history data; (3) biographic data; and (4) case history data.

f. “Cybersecurity Incident” shall have the meaning ascribed to it in 75-7244.

g. “Data Center” shall mean a facility physically located in the United States of America where the servers, software, and/or hardware parts of Contractor’s service are located in.

h. “Data Security Incident” means a situation where Aggregator reasonably believes that there has been (1) the loss or misuse (by any means) of Restricted-Use Information, (2) the inadvertent, unauthorized and/or unlawful processing, corruption, modification, transfer, sale or rental of Restricted-Use Information; (3) any other act or omission that compromises the security, confidentiality, or integrity of Restricted-Use Information or (4) any breach of any data protection requirements in relation to the processing of Restricted-Use Information by Contractor any current or former employees of Contractor.

i. “Destroy” means shredding, permanently erasing and deleting, degaussing, or otherwise modifying Restricted Use Information in paper, electronic, or other means so as to make it unreadable, unreconstructible, and indecipherable.

j. “Information Security Incident” includes Data Security Incident and Cybersecurity Incident as defined in this Attachment. Information Security Incident does not include unsuccessful access attempts or similar events that do not compromise the security or privacy of the Supplier’s systems, including pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

k. “Information System” is a set of components, including hardware, software, data, people, and processes, that work together to collect, store, process, and distribute information.

l. “Non-Production Data” is data used for testing, development, or training, and not for live business operations or real users. Non-Production Data includes but is not limited to anonymized or sample data that does not contain Restricted-Use Information.

m. “Personal Financial Information” (PFI) is any non-public personally identifiable financial information that an entity collects about an individual in order to provide a financial product or service.

n. “Personally Identifiable Information” (PII) is any information that can be used on its own or with other information to identify or locate a single person. PII shall include but not be limited to a person’s social security number (SSN), passport number, driver's license number, taxpayer identification number, patient identification number, and financial account or credit card number.

o. “Production Data” is any data, including but not limited to information, figures, statistics, records, documents, or results, derived directly or indirectly from a Production Environment. This may include data from a development environment where it originates from or current/historic data from a Production Environment.

p. “Production Environment” is the operational environment in which a software application or system is deployed and used by end users to perform their intended tasks.

q. “Protected Health Information” (PHI) is any information, in any form or medium, held or transmitted, about health status, provision of health care, or payment for health care that is created or collected by a covered entity or the business associates of a covered identity and can be linked to a specific individual.

r. “Restricted-Use Information” (RUI) includes CJIS, PFI, PII, and PHI as defined in this Attachment.

s. “Vulnerability Scan” is the process of identifying weaknesses in information system components that could be used to compromise networks, systems, databases, or applications. Vulnerability scanning includes but is not limited to scanning for patch levels, scanning for functions, ports, protocols, and services that should not be accessible to users or devices, and scanning for improperly configured or incorrectly operating information flow control mechanisms.

3. Security Governance.

a. Security Awareness and Training. Contractor shall maintain an effective information security awareness, training, and education program, informing all employees, subcontractors, and other relevant parties of their information security obligations. Contractor shall have an information security policy that is communicated to and available to its staff. Contractor shall ensure that employees and subcontractors involved in the Contract maintain a requisite level of competence in the relevant information security systems technology.

Determination of requisite level of competence shall be in AGENCY’s discretion and shall satisfy the following minimum standards:

i. Contractor’s information security systems awareness training must meet the minimum requirements for IT security procedures and State of Kansas, Kansas Information Technology Executive Council (ITEC), Office of Information Technology Services (OITS) and AGENCY policies, statutes and standards including ITEC 7000 Series.

ii. At the execution of the Contract and, thereafter, upon receipt of any written request by AGENCY, Contractor shall provide Contractor’s information security policy, evidence of the security awareness, training, and education program to AGENCY, and a letter warranting all of Contractor’s employees, and any other individuals acting on behalf of Contractor or under Contractor’s direction, successfully completed Health Insurance Portability and Accountability Act (HIPAA) and IT security awareness training prior to accessing AGENCY data. The letter shall also provide details of the of topics the training employees have completed.

If Contractor’s training does not meet the requisite level of competence requirements as determined by AGENCY, employees of the vendor will be required to complete the AGENCY Vendor IT Security Training before access is granted to AGENCY data.

b. Security Roles and Responsibilities. If providing a service, solution, software, data hosting, or an interface to AGENCY, Contractor shall:

i. Define, and document roles and responsibilities related to information security for the service, solution, software, data hosting, or interface;

ii. Implement user identification and access controls designed to limit access to users in accordance with the principles of least privilege;

iii. Ensure that all personnel with physical or logical access to the service, solution, software, data hosting, or interface will receive industry standard annual security awareness training;

iv. Maintain documentation regarding roles and responsibilities related to information security for the service, solution, software, or interface and review and update this document at least once per year;

and

v. At the execution of the Contract and, thereafter, upon receipt of any written request by AGENCY, Contractor shall provide such documentation to AGENCY.

c. Change Management. Contractor shall ensure that all changes to proposed services, solutions, or interfaces are authorized according to change management policies. Contractor will maintain the service, solution, or interface in the AWC with respect to the version of all related hardware/software that may affect the service, solution, or interface. Contractor is not obligated to upgrade service, solution, or interface to meet upgrades of any hardware/software made by AGENCY unless a CR is completed. All project deliverables formally approved or baselined will be governed by a change management request to be approved by the Parties.

Contractor will maintain a development environment that will allow them to provide modifications to the service, solution, or interface as demonstrated in the AWC. An impact analysis and other testing shall be conducted before software is installed or changes are put in production. Results of the impact analysis and testing shall be orderly documented.

4. Physical & Environmental Security. Contractor shall support physical and environmental security measures, including securing data on a secure server, in locked data cabinets within a secure facility located within the United States of America. Contractor shall adhere to the following:

a. All AGENCY data must be contained in secure, environmentally controlled Data Centers located in the United States of America. Data Centers shall be owned, operated, and controlled by Contractor. If the Data Center is not owned, operated, and controlled by Contractor (including leased facilities), then Contractor must receive AGENCY approval in writing for Contractor’s use of alternate Data Centers.

Contractor will identify and notify AGENCY of the locations of all Data Centers used to host AGENCY data.

Contractor shall ensure that all AGENCY data is always stored, processed, and maintained within the United States of America. Contractor shall further ensure that no AGENCY Data is accessed by Contractor’s employees, contractors, or any other individuals under Contractor’s control from outside of the United States.

b. Data Centers must implement physical environmental controls that mitigate or prevent damage from water, fire, temperature, and humidity for Information Systems that process, store, or transmit RUI. Contractor must ensure sufficient power protection is available for critical Information Systems to perform an orderly shutdown.

c. Contractor must restrict physical access to Data Centers that process, store, or transmit RUI to Authorized Personnel only. Contractor must maintain a list, which shall be reviewed and updated as user access privileges change or at least annually, of all Authorized Personnel with physical access to Data Centers that process, store, or transmit RUI. Contractor must require Authorized Personnel to authenticate themselves prior to entry to Data Centers that process, store or transmit RUI. If Contractor allows visitors to Data Centers that process, store or transmit RUI, then visitors must always be escorted by Authorized Personnel. Contractor must log all visitor access to Data Centers that process, store or transmit RUI.

5. Data Security & Management.

a. Contractor shall at all times implement and maintain physical, electronic and organizational security measures in accordance with the best practices and highest industry standards to protect Agency’s data, materials, and any deliverables against any unauthorized access, use, destruction, loss, disclosure, or improper alteration.

b. Contractor shall ensure Contractor’s Data Center and/or cloud environment is secure with industry standard encryption techniques that meets all legal requirements for data stored at rest and in transit. Contractor shall ensure Secure Socket Layers (SSL) configuration per industry best practices, session, and port management.

c. Contractor shall ensure that external connections incorporated into the Data Center and/or cloud have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Contractor.

Contractor shall ensure that the Data Center will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through.

d. Contractor shall utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to AGENCY data. Contractor shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files.

e. Contractor shall ensure that any service, software, solution, data hosting, or an interface is capable of auditing the following events: (1) successful and unsuccessful account logon events; (2) account management events; (3) object access; (4) policy change; (5) privilege functions; (6) process tracking and system events; (7) all administrator activity; (8) authentication checks; (9) authorization check; (10) data deletions; (11) data access; (12) data changes; and (13) permission changes.

f. Contractor shall ensure that the service, software, solution, data hosting, or interface employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the service, software, solution, data hosting, or an interface to support organizational processes for investigation, alerting and response to suspicious activities. Contractor shall ensure that the service, software, solution, data hosting, or interface supports exporting of log files to AGENCY for review and analysis.

g. Contractor will maintain a complete asset inventory of its infrastructure, network, applications, and cloud environments. Contractor will also maintain an inventory of all its media on which AGENCY’s data is stored.

Access to the inventories of such media will be restricted to that Parties’ Authorized Personnel.

h. Contractor shall provide and maintain a backup of AGENCY data that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives.

Contractor shall store a daily incremental and weekly full back backup of AGENCY’s data within the United States of America. Contractor will maintain a disaster recovery plan. At the execution of the Contract and upon written request by AGENCY, Contractor shall provide such plan to AGENCY.

i. Contractor shall implement a contingency plan designed to maintain the access to AGENCY data and to prevent the unintended destruction or loss of data. The contingency plan should provide a predefined frequency, consistent with recovery time and recovery point objectives for disaster recovery and archival purposes of AGENCY data at a secure facility located within the United States of America.

j. Contractor shall ensure that all AGENCY Production Data remains in the United States of America.

Contractor shall further ensure no Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States. Contractor shall ensure that all AGENCY Non-Production Data remains in the United States of America. Contractor shall further ensure no Non-Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States.

k. If applicable, upon completion, termination, or expiration of the Contract, or at the request of AGENCY, Contractor shall promptly return all media supplied by AGENCY, accompanied by a letter which certifies all private and/or confidential data and software supplied by AGENCY have been removed from all Contractor’s equipment, files, and backup. Contractor shall also dispose of any data in accordance with Paragraph 8.

l. In the event the Contractor ceases doing business, dissolves, ceases to provide all services as defined in the Contract, makes a general assignment for benefit of creditors, has a receiver appointed for any reason, suffers a foreclosure, attachment or levy on any significant business assets, admits its inability to pay debts as they mature or becomes the debtor in any bankruptcy proceeding, the Parties agree to enter into a separate statement of work at a negotiated rate for all work performed in connection with a data migration project to migrate AGENCY’s data. Both Parties agree to negotiation of the separate statement of work in good faith. Should Contractor fail to abide by the terms of this paragraph and not enter a separate statement of work, AGENCY reserves the right to obtain all of AGENCY’s data that AGENCY or its affiliates have created, store, uploaded, and or modified within thirty (30) days of notification and at no cost to AGENCY.

6. Data Privacy.

a. Contractor will implement and maintain a written information security program that contains appropriate security measures to safeguard the RUI of AGENCY’s data that the Contractor receives, stores, maintains, processes, or otherwise accesses in connection with the provision of services hereunder.

b. Contractor shall not disclose to any other person, firm, or corporation or entity (other than to AGENCY) or use for its own benefit, except as provided in the Contract, any data and/or confidential information it receives from AGENCY. Contractor shall return any and all data furnished by AGENCY and its affiliates within 30 days of the request of AGENCY in whatever form(s) it is maintained by Contractor. On the termination of the Contract, Contractor will not use any of such data or any material derived from the data for any purpose and will destroy such data or material except as otherwise expressly stated by this attachment or the Contract. In the event Contractor discloses any of AGENCY’s proprietary and/or RUI, AGENCY may immediately terminate the Contract and pursue legal action recourse. The restrictions and obligations contained herein shall continue in perpetuity from the date of the Contract unless AGENCY provides a written release to Contractor.

c. Except to the extent the information is proven to be publicly known through no breach or misappropriation, and except to the extent a statute, rule or regulation requires AGENCY to make information publicly available, all software, documentation, interfaces and other components of the service provided by Contractor is confidential information of Contractor, and may not be disclosed or used by AGENCY, except solely for its own internal business purposes.

7. Information Security Incidents.

a. Contractor shall maintain an incident response program that implements incident handling for information security incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes. The incident response program must have the capability to support automated mechanisms for supporting incident handling processes.

b. Contractor is responsible for all Information Security Incidents that is processed by, or on behalf of, Contractor. Contractor shall immediately notify AGENCY (within twelve hours) in writing whenever Contractor reasonably believes that there has been an Information Security Incident. After providing such notice, Contractor will investigate the Information Security Incident, and immediately take all necessary steps to eliminate or contain any exposure of RUI and keep AGENCY advised of the status of such Information Security Incident and all matters related thereto. Contractor further agrees to provide, at Contractor’s sole cost, reasonable assistance and cooperation requested by AGENCY, in the furtherance of any correction, remediation, or investigation of any such Information Security Incident and/or the mitigation of any damage, including any notification required by law or that AGENCY may determine appropriate to send to individuals impacted or potentially impacted by the Information Security Incident. In addition, within a reasonable time frame of identifying or being informed of an Information Security Incident, Contractor shall develop a plan and submit to AGENCY for review a plan that reduces the likelihood of a recurrence of such Information Security Incident.

c. Contractor agrees to adhere to all Information Security Incident reporting in accordance with K.S.A. 75-7244, including utilizing the Incident Reporting Form on the Kansas Office of Information Technology Services website.

8. Destruction of Data. Unless otherwise specified in the Contract, Contractor agrees that upon termination of the Contract or upon request by AGENCY, Contractor shall erase, destroy, and render unrecoverable all AGENCY and AGENCY affiliate data and certify in writing that these actions have been completed within a time frame communicated to Contractor by an authorized agent of AGENCY. At a minimum, media sanitization is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization Special Publication 800-88r1. Records of all sanitizations involving AGENCY data shall maintained for five (5) years. In the case that any data must be retained for Federal Reporting purposes beyond the termination of the Contract, the Parties shall arrange for the proper transfer, storage, archiving and schedule for deletion of such data.

9. Vulnerability Scans & Security Audit.

a. Contractor shall conduct Vulnerability Scans on networks, systems, databases, or applications that create, maintain, process, transmit, or store data hosting AGENCY RUI on a regular basis (no less than every thirty days). Contractor shall perform quarterly Vulnerability Scans using an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) and shall provide AGENCY with the results of those scans.

b. If a Vulnerability Scan identifies vulnerabilities in Contractor’s networks, systems, databases, or applications, Contractor is expected to remediate them or, in the rare cases where that is not possible, implement approved and documented compensating controls to reduce risk. In cases where a vulnerability introduces heightened risk to data exposure, AGENCY may disconnect, disable and/or block the device from accessing AGENCY systems until remediation or risk mitigation takes place.

c. Contractor shall ensure performance of a security audit at least once annually.

10. Generative AI. Contractor shall comply with the State of Kansas Generative Artificial Intelligence (AI) Policy

(Memorandum No. P8200.00).

a. Contractor shall ensure that responses generated from generative AI outputs shall be reviewed by knowledgeable human operators for accuracy, appropriateness, privacy, and security before being acted upon or disseminated.

b. Contractor shall ensure RUI or any other confidential AGENCY data shall not be utilized in generative AI queries or for building or training proprietary generative AI programs unless explicitly approved by AGENCY with consultation from the Chief Information Security Officer.

c. At the execution of the Contract, Contractor shall disclose Contractor’s utilization of generative AI…