EVT0010957_-_Attachment_A_-_Data_Security_Agreement_.pdf

Attachment A

Department for Children and Families

DATA SECURITY ATTACHMENT

The following provisions shall apply to all successful bidders engaged in the supply of Department for Children and Families (DCF), herein referred to as “AGENCY,” for the Data Security Attachment, goods and/or services. The following provisions will be incorporated into and made part of the contract between Bidder and AGENCY. By submitting the bid, the Bidder acknowledges that it has the capability to adhere to and will be bound by the following provisions as well as any other terms and conditions outlined in the solicitation.

1. General Statements

a. Contractor acknowledges that it receives and/or has access to AGENCY computers, communication systems, data, and/or networks for the purposes set forth in the Contract. Contractor agrees to ensure that any information or data required to be delivered pursuant to the Contract shall be delivered through systems and infrastructure approved by AGENCY and consistent with industry best practices pertaining to security. Best practices shall include, but are not limited to, alignment with the NIST Cybersecurity Framework (CSF 2.0), NIST SP 800-53 Rev. 5 Moderate baseline, and Center for Internet Security (CIS) Critical Security Controls. Contractor shall implement encryption for data in transit and at rest using FIPS 140-3 validated cryptographic modules, enforce multi-factor authentication for administrative and remote access, and apply least privilege and role-based access controls. If any data is made available or accessible to Contractor, its employees, agents, or contractors, pertaining to AGENCY’s business or financial affairs, or to AGENCY’s projects or transactions, Contractor will not store, copy, analyze, monitor, or otherwise use that data except for the purposes set forth in the Contract for the benefit of AGENCY.

b. Subject to any other express agreement between the Parties with respect to the Contract, Contractor has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect AGENCY’s data, services, and infrastructure in its environments or under its control against accidental, unauthorized, or unlawful access, disclosure, alteration, loss, or destruction, as set out below. These measures shall include, at a minimum: • Documented access control policies and audit trails; • Regular vulnerability scanning and timely patch management; • Business continuity, incident response, and disaster recovery plans reviewed annually; • Intrusion detection and prevention mechanisms; • Endpoint protection that includes anti-malware, EDR, and behavioral analytics; • Change management, secure configuration baselines, and continuous monitoring; and • Verification of security posture through annual independent assessments or SOC 2 Type II audits.

c. To the extent AGENCY’s data includes personal data, the implementation of and compliance with these measures and any additional security measures set out herein are designed to provide an appropriate level of security in respect of the processing of the personal data and shall at all times comply fully with all applicable laws, regulations, and government orders relating to Restricted-Use Information and data privacy with respect to any such data that Contractor receives or has access to under the Contract or in connection with the performance of any services for AGENCY. Contractor will otherwise protect Restricted-Use Information and will not use, disclose, or transfer such Restricted-Use Information across borders. Contractor shall ensure compliance with HIPAA, IRS Publication 1075 (for FTI), CJIS Security Policy (for criminal justice data), GLBA (for financial information), and the Kansas ITEC 7000-series standards.

d. Contractor shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state, and local laws and regulations. Specifically, Contractor will fully comply with all Kansas statutes, regulations, and policies including the requirements in: i. K.S.A 75-7244. ii. S.B. 291 as published in Session Laws 2024, ch. 95, eff. July 1, 2024. iii. Applicable Kansas IT policies and standards adopted under the authority of the Kansas Information Technology Executive Council (ITEC), including the 7000 Series “Security.” iv. All applicable federal and state confidentiality statutes protecting personally identifiable, financial, or health-related data.

2. Definitions

a. “Accepted Working Condition” (AWC) is the condition of the application in the Production Environment after the initial use of that application in the Production Environment.

b. “Authorized Personnel” means Contractor’s employees who have a need to know or otherwise access Restricted-Use Information to enable Contractor to perform its obligations under this Contract.

c. “Change Request” (CR) is any activity that alters the scope, objectives, deliverables, requirements, basic architecture, cost or schedule of the service, solution, or interface system; or an activity that creates an impact/change to a current application in production, software configuration, or hardware configuration.

d. “Contract” is the legal agreement between AGENCY and the Contractor to which this document is incorporated.

e. “Criminal Justice Information Services” (CJIS) is data provided to AGENCY by the Federal Bureau of Investigation or the Kansas Bureau of Investigation that includes sensitive information about criminal activities, investigations, and individuals involved in the criminal justice system. CJIS data shall include but is not limited to: (1) biometric data; (2) identity history data; (3) biographic data; and

(4) case history data.

f. “Cybersecurity Incident” shall have the meaning ascribed to it in 75-7244.

g. “Data Center” shall mean a facility physically located in the United States of America where the servers, software, and/or hardware parts of Contractor’s service are located.

h. “Data Security Incident” means a situation where AGENCY reasonably believes that there has been (1) the loss or misuse (by any means) of Restricted-Use Information, (2) the inadvertent, unauthorized and/or unlawful processing, corruption, modification, transfer, sale or rental of Restricted-Use Information; (3) any other act or omission that compromises the security, confidentiality, or integrity of Restricted-Use Information or (4) any breach of any data protection requirements in relation to the processing of Restricted-Use Information by Contractor or any current or former employees of Contractor.

i. “Destroy” means shredding, permanently erasing and deleting, degaussing, or otherwise modifying Restricted-Use Information in paper, electronic, or other means so as to make it unreadable, unreconstructible, and indecipherable.

j. “Information Security Incident” includes Data Security Incident and Cybersecurity Incident as defined in this Attachment. Information Security Incident does not include unsuccessful access attempts or similar events that do not compromise the security or privacy of the supplier’s systems, including pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

k. “Information System” is a set of components, including hardware, software, data, people, and processes, that work together to collect, store, process, and distribute information.

l. “Non-Production Data” is data used for testing, development, or training, and not for live business operations or real users. Non- Production Data includes but is not limited to anonymized or sample data that does not contain Restricted-Use Information.

m. “Personal Financial Information” (PFI) is any non-public personally identifiable financial information that an entity collects about an individual in order to provide a financial product or service.

n. “Personally Identifiable Information” (PII) is any information that can be used on its own or with other information to identify or locate a single person, including but not limited to social security number, passport number, driver's license number, taxpayer identification number, patient identification number, and financial account or credit card number.

o. “Production Data” is any data, including but not limited to information, figures, statistics, records, documents, or results, derived directly or indirectly from a Production Environment. This may include data from a development environment where it originates from or current/historic data from a Production Environment.

p. “Production Environment” is the operational environment in which a software application or system is deployed and used by end users to perform their intended tasks.

q. “Protected Health Information” (PHI) is any information, in any form or medium, held or transmitted, about health status, provision of health care, or payment for health care that is created or collected by a covered entity or its business associates and can be linked to a specific individual.

r. “Restricted-Use Information” (RUI) includes CJIS, PFI, PII, and PHI as defined in this Attachment.

s. “Vulnerability Scan” is the process of identifying weaknesses in information system components that could be used to compromise networks, systems, databases, or applications. Vulnerability scanning includes but is not limited to scanning for patch levels, scanning for functions, ports, protocols, and services that should not be accessible to users or devices, and scanning for improperly configured or incorrectly operating information flow control mechanisms.

t. “Data Processing Agreement (DPA)” means a written instrument between Contractor and AGENCY establishing rights and obligations regarding data protection, access, and processing of Restricted-Use Information, aligned with applicable state and federal laws.

u. “Encryption Key Management” means the generation, protection, storage, rotation, and destruction of cryptographic keys in accordance with FIPS 140-3 validated modules and NIST SP 800-57 guidance.

v. “Multi-Factor Authentication (MFA)” means authentication requiring two or more of the following: something you know (password or PIN), something you have (token or device), and something you are (biometric).

w. “Penetration Test” means an authorized simulated cyber-attack designed to evaluate security defenses, performed annually by qualified independent assessors following NIST SP 800-115 and OWASP standards.

x. “Security Compliance Documentation” means evidence, certifications, or audit reports (e.g., SOC 2 Type II, ISO 27001, FedRAMP Moderate) that demonstrate the Contractor’s compliance with applicable information security standards.

3. Security Governance

a. Security Awareness and Training. Contractor shall maintain an effective information security awareness, training, and education program, informing all employees, subcontractors, and other relevant parties of their information security obligations. Contractor shall have an information security policy that is communicated to and available to its staff. Contractor shall ensure that employees and subcontractors involved in the Contract maintain a requisite level of competence in the relevant information security systems technology. Determination of requisite level of competence shall be in AGENCY’s discretion and shall satisfy the following minimum standards:

i. Contractor’s information security systems awareness training must meet the minimum requirements for IT security procedures and State of Kansas, Kansas Information Technology Executive Council (ITEC), Office of Information Technology Services (OITS), and AGENCY policies, statutes and standards including ITEC 7000 Series.

ii. At the execution of the Contract and, thereafter, upon receipt of any written request by AGENCY, Contractor shall provide Contractor’s information security policy, evidence of the security awareness, training, and education program to AGENCY, and a letter warranting all of Contractor’s employees, and any other individuals acting on behalf of Contractor or under Contractor’s direction, successfully completed Health Insurance Portability and Accountability Act (HIPAA) and IT security awareness training prior to accessing AGENCY data. The letter shall also provide details of the topics the training employees have completed.

iii. Contractor shall ensure all personnel complete refresher security training annually, including modules on phishing, social engineering, data handling, and incident response.

iv. If Contractor’s training does not meet the requisite level of competence requirements as determined by AGENCY, employees of the vendor will be required to complete the AGENCY Vendor IT Security Training before access is granted to AGENCY data.

b. Security Roles and Responsibilities. i. Contractor shall define, document, and maintain roles and responsibilities related to information security, incident response, and privacy compliance for all services or solutions provided. ii. Contractor shall enforce user identification, authentication, and access control based on the principle of least privilege, including quarterly access reviews of privileged accounts. iii. All personnel with logical or physical access to AGENCY systems or data shall receive annual role-based training specific to their job function. iv. Contractor shall maintain and review its information security responsibility matrix at least annually or upon major organizational changes and provide it to AGENCY upon request.

c. Change Management. Contractor shall ensure that all changes to proposed services, solutions, or interfaces are authorized according to change management policies. Contractor will maintain the service, solution, or interface in the Accepted Working Condition (AWC) with respect to the version of all related hardware/software that may affect the service, solution, or interface. Contractor is not obligated to upgrade service, solution, or interface to meet upgrades of any hardware/software made by AGENCY unless a Change

Request (CR) is completed. All project deliverables formally approved or baselined will be governed by a change management request to be approved by the Parties. Contractor will maintain a development environment that will allow them to provide modifications to the service, solution, or interface as demonstrated in the AWC. An impact analysis and other testing shall be conducted before software is installed or changes are put in production. Results of the impact analysis and testing shall be orderly documented and retained for no less than five (5) years.

4. Physical & Environmental Security

Contractor shall support physical and environmental security measures, including securing data on a secure server, in locked data cabinets within a secure facility located within the United States of America.

a. All AGENCY data must be contained in secure, environmentally controlled Data Centers located in the United States of America.

Data Centers shall be owned, operated, and controlled by Contractor. If the Data Center is not owned, operated, and controlled by Contractor (including leased facilities), then Contractor must receive AGENCY approval in writing for Contractor’s use of alternate Data Centers. Contractor will identify and notify AGENCY of the locations of all Data Centers used to host AGENCY data. Contractor shall ensure that all AGENCY data is always stored, processed, and maintained within the United States of America. Contractor shall further ensure that no AGENCY data is accessed by Contractor’s employees, contractors, or any other individuals under Contractor’s control from outside of the United States.

b. Data Centers must implement physical environmental controls that mitigate or prevent damage from water, fire, temperature, and humidity for Information Systems that process, store, or transmit RUI. Contractor must ensure sufficient power protection is available for critical Information Systems to perform an orderly shutdown. Contractor shall ensure 24×7 monitored access controls, CCTV surveillance, visitor logging, and at least SOC 2 Type II or FedRAMP Moderate equivalency certification.

c. Contractor must restrict physical access to Data Centers that process, store, or transmit RUI to Authorized Personnel only.

Contractor must maintain a list, which shall be reviewed and updated as user access privileges change or at least annually, of all Authorized Personnel with physical access to Data Centers that process, store, or transmit RUI. Contractor must require Authorized Personnel to authenticate themselves prior to entry to Data Centers that process, store, or transmit RUI. Visitors must be escorted and logged, with access records retained for a minimum of one (1) year.

5. Data Security & Management

a. Contractor shall at all times implement and maintain physical, electronic, and organizational security measures in accordance with the best practices and highest industry standards to protect AGENCY’s data, materials, and any deliverables against any unauthorized access, use, destruction, loss, disclosure, or improper alteration. These measures shall include, without limitation: defense-in-depth network architecture; hardened baselines aligned with CIS Benchmarks; least privilege and segregation of duties; secure software development lifecycle (SSDLC) practices (threat modeling, code review, SAST/DAST/IAST); and continuous monitoring with timely remediation.

b. Contractor shall ensure Contractor’s Data Center and/or cloud environment is secure with industry-standard encryption techniques that meet all legal requirements for data stored at rest and in transit. Contractor shall ensure TLS 1.2+ with modern cipher suites, Perfect Forward Secrecy where supported, and encryption at rest using FIPS 140-3 validated modules. Contractor shall ensure Secure Socket Layers (SSL/TLS) configuration per industry best practices, session and port management, certificate lifecycle management (including rotation and revocation), and documented key-management procedures (generation, storage, rotation, escrow, and destruction) aligned to NIST SP 800-57.

c. Contractor shall ensure that external connections incorporated into the Data Center and/or cloud have appropriate security controls including industry-standard intrusion detection and prevention capabilities that will detect and terminate unauthorized activity prior to entering the firewall maintained by Contractor. Contractor shall ensure the Data Center utilizes next-generation firewalls regulating all data entering the internal data network from any external source, enforcing secure connections (e.g., VPN with MFA, IP allow-listing, and just-in-time access) and permitting only authorized data to pass through. Network segmentation and micro-segmentation shall be applied to isolate AGENCY workloads from other tenants and from Contractor internal networks.

d. Contractor shall utilize industry-standard malware protection, incorporating both signature and non-signature-based detection mechanisms (e.g., EDR), on all systems with access to AGENCY data. Contractor shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files. EDR telemetry relevant to AGENCY environments shall be retained for at least one (1) year and made available to AGENCY upon request.

e. Contractor shall ensure that any service, software, solution, data hosting, or interface is capable of auditing the following events: (1) successful and unsuccessful account logon events; (2) account management events; (3) object access; (4) policy change; (5) privilege functions; (6) process tracking and system events; (7) all administrator activity; (8) authentication checks; (9) authorization checks; (10) data deletions; (11) data access; (12) data changes; and (13) permission changes. Audit records shall include user IDs, timestamps, source IPs, success/failure indicators, and object identifiers sufficient to support forensic investigations.

f. Contractor shall ensure that the service, software, solution, data hosting, or interface employs automated mechanisms to centrally review, analyze, and correlate audit and log records from multiple components to support investigation, alerting, and response to suspicious activities. Contractor shall ensure support for exporting logs to AGENCY’s designated SIEM in near real-time and shall retain local logs for at least one (1) year and any incident-related logs for seven (7) years or longer if legally required.

g. Contractor will maintain a complete asset inventory of its infrastructure, network, applications, and cloud environments. Contractor will also maintain an inventory of all media on which AGENCY’s data is stored. Access to the inventories of such media will be restricted to the Parties’ Authorized Personnel. Asset and media inventories shall include ownership, location, data classification, and patch/configuration state, and shall be reviewed at least quarterly.

h. Contractor shall provide and maintain a backup of AGENCY data that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time objectives (RTOs) and recovery point objectives (RPOs). Contractor shall store daily incremental and weekly full backups of AGENCY’s data within the United States of America. Backups shall be encrypted, logically separated from production, regularly tested (no less than semi-annually), and governed by a documented restoration plan. Contractor will maintain a disaster recovery plan and, at execution of the Contract and upon written request by AGENCY, shall provide such plan, including results of the most recent DR test.

i. Contractor shall implement a contingency plan designed to maintain access to AGENCY data and to prevent unintended destruction or loss of data. The contingency plan shall define recovery priorities, roles and responsibilities, communication protocols, and contact trees; and include archival and immutable backup provisions appropriate for RUI. Facilities used for contingency operations shall be located within the United States of America.

j. Contractor shall ensure that all AGENCY Production Data remains in the United States of America. Contractor shall further ensure no Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States. Remote administrative access (if approved) shall be protected with MFA and device posture checks and shall be logged.

k. Contractor shall ensure that all AGENCY Non-Production Data remains in the United States of America. Contractor shall further ensure no Non-Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States. Use of Production Data in Non-Production environments is prohibited unless expressly authorized in writing by AGENCY and properly de-identified/anonymized per AGENCY standards.

l. If applicable, upon completion, termination, or expiration of the Contract, or at the request of AGENCY, Contractor shall promptly return all media supplied by AGENCY, accompanied by a letter certifying all private and/or confidential data and software supplied by AGENCY have been removed from all Contractor equipment, files, and backups. Contractor shall also dispose of any data in accordance with Paragraph 8. Certification shall include the date, method, authoritative signer, and scope of destruction.

m. In the event the Contractor ceases doing business, dissolves, ceases to provide all services as defined in the Contract, makes a general assignment for benefit of creditors, has a receiver appointed for any reason, suffers a foreclosure, attachment, or levy on any significant business assets, admits its inability to pay debts as they mature, or becomes the debtor in any bankruptcy proceeding, the Parties agree to enter into a separate statement of work at a negotiated rate for all work performed in connection with a data migration project to migrate AGENCY’s data. Both Parties agree to negotiate the separate statement of work in good faith. Should Contractor fail to abide by the terms of this paragraph and not enter a separate statement of work, AGENCY reserves the right to obtain all of AGENCY’s data that AGENCY or its affiliates have created, stored, uploaded, and/or modified within thirty (30) days of notification and at no cost to AGENCY. Contractor shall provide technical assistance, data dictionaries/schemas, and export utilities necessary to complete migration in a usable, non-proprietary format.

6. Data Privacy

a. Contractor will implement and maintain a written information security and privacy program that contains appropriate administrative, technical, and physical security measures to safeguard RUI of AGENCY’s data that Contractor receives, stores, maintains, processes, or otherwise accesses in connection with the provision of services hereunder. The program shall incorporate data minimization, purpose limitation, privacy-by-design/default, data subject rights where applicable, and documented privacy impact assessments for systems processing RUI.

b. Contractor shall not disclose to any other person, firm, or corporation or entity (other than to AGENCY) or use for its own benefit, except as provided in the Contract, any data and/or confidential information it receives from AGENCY. Contractor shall return any and all data furnished by AGENCY and its affiliates within 30 days of AGENCY’s request in whatever form(s) it is maintained by Contractor.

On termination of the Contract, Contractor will not use any of such data or any material derived from the data for any purpose and will destroy such data or material except as otherwise expressly stated by this Attachment or the Contract. In the event Contractor discloses any of AGENCY’s proprietary and/or RUI, AGENCY may immediately terminate the Contract and pursue legal recourse. The restrictions and obligations contained herein shall continue in perpetuity from the date of the Contract unless AGENCY provides a written release. Contractor shall prohibit tracking technologies or analytics tools that profile AGENCY users or collect PII without AGENCY’s prior written authorization. AGENCY remains the sole owner and controller of all AGENCY data; Contractor acts solely as a processor/service provider.

c. Except to the extent the information is proven to be publicly known through no breach or misappropriation, and except to the extent a statute, rule, or regulation requires AGENCY to make information publicly available, all software, documentation, interfaces, and other components of the service provided by Contractor is confidential information of Contractor and may not be disclosed or used by AGENCY, except solely for its own internal business purposes. Nothing in this clause shall restrict AGENCY’s rights to access, export, audit, or retain information necessary to meet statutory, regulatory, or records-management obligations.

7. Information Security Incidents

a. Contractor shall maintain an incident response program that implements incident handling for Information Security Incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes. The incident response program must include defined severities, 24×7 points of contact, playbooks for ransomware and data exfiltration, and automated mechanisms supporting incident handling (e.g., EDR/SIEM alerting and case management). Contractor shall conduct at least annual incident response tabletop exercises that include AGENCY participation upon request.

b. Contractor is responsible for all Information Security Incidents that are processed by, or on behalf of, Contractor. Contractor shall immediately notify AGENCY (within twelve (12) hours) in writing whenever Contractor reasonably believes that there has been an Information Security Incident. After providing such notice, Contractor will investigate the Information Security Incident, immediately take all necessary steps to eliminate or contain any exposure of RUI, and keep AGENCY advised of status. Contractor shall provide: (i) an initial report within twenty-four (24) hours of notification; (ii) daily updates until containment; and (iii) a written root-cause analysis (RCA) and corrective action plan within ten (10) business days after containment. Contractor shall preserve all relevant logs, images, and evidence for no less than seven (7) years or longer if legally required and shall provide reasonable assistance and cooperation requested by AGENCY, including legally required notifications and credit monitoring where applicable, at Contractor’s sole cost.

c. Contractor agrees to adhere to all Information Security Incident reporting in accordance with K.S.A. 75-7244, including utilizing the Incident Reporting Form on the Kansas Office of Information Technology Services website, and any additional reporting requirements applicable to RUI (e.g., HIPAA breach notification, IRS Pub 1075 FTI safeguarding incident reporting, or CJIS incident reporting).

8. Destruction of Data

Unless otherwise specified in the Contract, Contractor agrees that upon termination of the Contract or upon request by AGENCY, Contractor shall erase, destroy, and render unrecoverable all AGENCY and AGENCY affiliate data and certify in writing that these actions have been completed within a timeframe communicated to Contractor by an authorized agent of AGENCY. At a minimum, media sanitization is to be performed according to NIST SP 800-88r1. Records of all sanitizations involving AGENCY data shall be maintained for five (5) years. In the case that any data must be retained for Federal Reporting purposes beyond the termination of the Contract, the Parties shall arrange for the proper transfer, storage, archiving, and schedule for deletion of such data. Certification of destruction shall be signed by an authorized security officer, specify the date, location, methods/tools used, media types, and a list of systems/sources included.

9. Vulnerability Scans & Security Audit

a. Contractor shall conduct Vulnerability Scans on networks, systems, databases, or applications that create, maintain, process, transmit, or store AGENCY RUI on a regular basis (no less than every thirty (30) days). Contractor shall perform quarterly Vulnerability Scans using enterprise tooling and shall provide AGENCY with the results of those scans upon request. High-risk external attack surface discovery (e.g., internet-facing assets) shall be assessed at least monthly.

b. If a Vulnerability Scan identifies vulnerabilities in Contractor’s networks, systems, databases, or applications, Contractor is expected to remediate them or, in rare cases where remediation is not possible, implement approved and documented compensating controls to reduce risk. Contractor shall meet the following timelines unless otherwise approved by AGENCY in writing: Critical within thirty (30) days; High within thirty (30) days; Medium within ninety (90) days; Low within one hundred eighty (180) days. In cases where a vulnerability introduces heightened risk to data exposure, AGENCY may disconnect, disable, and/or block the device from accessing AGENCY systems until remediation or risk mitigation takes place. Contractor shall track remediation to closure and provide status reports to AGENCY upon request.

c. Contractor shall ensure performance of a security audit at least once annually. Such audit shall include, at minimum, an independent third-party penetration test (aligned to NIST SP 800-115 and OWASP) of relevant in-scope systems, verification of configuration baselines, access reviews, and assessment of logging/monitoring effectiveness. Executive summaries and remediation plans shall be provided to AGENCY within ten (10) business days of report availability, and remediation of critical/high findings shall follow timelines in 9.b.

10. Generative AI

Contractor shall comply with the State of Kansas Generative Artificial Intelligence (AI) Policy (Memorandum No. P8200.00).

a. Contractor shall ensure that responses generated from generative AI outputs are reviewed by knowledgeable human operators for accuracy, appropriateness, privacy, and security before being acted upon or disseminated. Contractor shall implement technical and administrative controls to prevent prompt-injection, data exfiltration, model poisoning, insecure tool-use, and training-data contamination.

b. Contractor shall ensure RUI or any other confidential AGENCY data shall not be utilized in generative AI queries or for building or training proprietary or third-party generative AI programs unless explicitly approved in writing by AGENCY with consultation from the AGENCY Chief Information Security Officer. If approved, Contractor shall implement strict input/output filtering, data redaction, access controls with MFA, and logging of all prompts/completions involving AGENCY data.

c. At execution of the Contract, Contractor shall disclose Contractor’s utilization of generative AI or integrations with generative AI platforms, including the identities and locations of any third-party AI service providers or subprocessors. Contractor shall immediately notify AGENCY of any updates to Contractor’s systems that would change Contractor’s use of generative AI. If Contractor is utilizing generative AI to build software explicitly for the State of Kansas, Contractor must demonstrate positive control over all data input into the system, annotate all usage of code generated by generative AI, and ensure license compliance and provenance tracking for generated artifacts.

11. AGENCY Audit

In addition to any documents outlined in this Appendix, upon AGENCY’s reasonable written request with no less than thirty (30) days’ notice during the term of the Contract, the Contractor agrees to cooperate and assist AGENCY with information security audits regarding the Contractor’s compliance with the terms and conditions regarding information security hereunder. This cooperation shall include, but not be limited to:

a. Providing evidence of certification, policies, training and awareness program, and compliance related to information security;

including annual attestation signed by an authorized officer and the Contractor CISO (or equivalent) that the controls in this Attachment are implemented and effective.

b. Making available to AGENCY the Contractor’s Service and Organization Controls (SOC) 2 (Type II preferred) covering the relevant system(s) and period(s); redactions permitted for third-party confidentiality but not to obscure security deficiencies relevant to AGENCY.

c. Making available to AGENCY the Contractor’s NIST SP 800-53 (control mappings, implementation statements, and assessment results) or equivalent security control documentation sufficient to demonstrate conformity with the required baseline.

d. Making available to AGENCY an executive summary of the Contractor’s most recent information security tests (including penetration tests and independent audits), remedial actions taken, current open findings with severity/risk ratings, and target remediation dates.

e. Providing evidence of a comprehensive continuous monitoring program encompassing all systems with access to AGENCY data, including vulnerability management metrics, patch cadence, configuration drift reports, and security incident metrics.

f. Permitting AGENCY to review the Contractor’s information security program, including results of vulnerability scanning, configuration standards, IR/BC/DR plans and test results, key-management procedures, and change records relevant to AGENCY systems.

Contractor shall facilitate reasonable interviews with responsible personnel and provide secure on-site or virtual access for audit document review.