2. The term of this Agreement is:

Agreement IFB 26-3033 Page 1 of 4

CDSS/TBD

EXHIBIT A

(STANDARD AGREEMENT)

SCOPE OF WORK

A. Introduction and Background

The California Department of Social Services (CDSS), Disability Determination Service Division (DDSD) is committed to providing timely and accurate medical decisions for claimants who filed for disability benefits. Many claimants receive notification by mail and are often requested to send additional forms and documents to DDSD for case processing. This information is often time sensitive and critical in the case adjudication process. Therefore, it is imperative that mail is processed and delivered timely. The courier service would provide for timely mail delivery. This is an Agreement for daily courier service between the Roseville Branch office and the United States Postal Service (USPS).

B. Contractor Responsibilities

Contractor shall:

1. Provide to CDSS all labor, equipment, and materials necessary to provide daily courier service between the CDSS DDSD Roseville Branch office and the USPS, as described herein.

2. Provide courier services on a daily schedule (Monday through Friday excluding

State and Federal holidays listed in Exhibit A – Attachment 1) is as follows:

PICKUP

TIME FROM DELIVERY

TIME TO

8:00 a.m.

USPS

1860 Sierra Gardens Drive

Roseville, CA 95661 (1 P.O. Box)

9:00 a.m.

DDSD Roseville Branch Office

1640 E. Roseville Pkwy., Ste. 150 Roseville, CA 95661

4:00 p.m.

DDSD Roseville Branch Office 1640 E. Roseville Pkwy., Ste. 150 Roseville, CA 95661

5:00 p.m.

USPS

1860 Sierra Gardens

Drive Roseville, CA 95661

(1 P.O. Box)

3. Pick up mail from one (1) post office (P.O.) box on a daily basis. The mail from the DDSD P.O. box is not to be intermingled with different P.O. boxes. The mail volume shall slightly fluctuate daily.

Agreement IFB 26-3033 Page 2 of 4

The approximate volume of mail to be handled daily is:

Incoming: 150 - 200 pounds per day (approx. 1 - 3 tubs) Outgoing: 300 pounds per day (approx. 4 tubs and 3 trays)

4. Provide transportation (covered truck(s) or large van(s)) that shall be locked when unoccupied for all classes of mail, process all postal transactions, furnish all postal supplies, and sign for receipted mail at the Post Office as necessary.

All postal costs are at the expense of the State.

a. Driver is not to leave boxes/mail in unsecured area open to public viewing or access.

b. The vehicle must be locked when unoccupied.

5. Obtain CDSS approval prior to any vehicle substitutions if different than the vehicle(s) submitted for approval with awarded bid.

6. Provide a picture of the vehicle showing the license plate, a description of the cargo capacity that includes the maximum weight limit, length, height, and width of the storage area, and a copy of the current registration of the substituted vehicle(s) to be used in the performance of services, must be submitted to CDSS/DDSD for approval prior to commencement of use.

7. Provide dolly/hand truck to deliver and pick up mail as needed.

8. Ensure that each driver connected with the performance of this Agreement shall have a valid and appropriate California Driver’s License, and sign a confidentiality agreement (Exhibit E – Attachment 1).

9. Provide for own parking during the performance of this service.

10. Ensure that each driver connected with the performance of this Agreement shall receive a copy of and adhere to the requirements of the CDSS

Confidentiality and Information Security Requirements (Exhibit E, Attachment 1).

11. All services contained in this Agreement, shall be made available to CDSS locations including, but not limited to, those listed in Exhibit A. Locations may be added, deleted, or changed at CDSS’s discretion with 30 calendar days’ written notice and shall require formal amendment to the Agreement.

Agreement IFB 26-3033 Page 3 of 4

C. CDSS Responsibilities

CDSS shall:

1. Ensure each DDSD branch has outgoing mail ready for pickup at times listed on daily schedule.

2. Be responsible for all postal costs.

3. Provide the Contractor with local contact information.

4. All printing shall be sent to the California Department of General Services, Office of State Publishing (OSP). It is the responsibility of the CDSS Project Representative to obtain an exemption from OSP to competitively bid out any and all printing listed within this Agreement.

D. Subcontracting

Contractor may subcontract one or more portions of this Agreement if the subcontract is justified and is not for the purpose of circumventing state contracting requirements. Any subcontract(s) shall conform to State Contracting Manual (SCM) Volume 1, Section 3.06.

When the total of all of Contractor’s subcontracts exceeds $50,000 or 25% of the total value of the agreement, whichever is less, the following shall apply:

1. Contractor shall conduct a competitive bidding process that seeks at least three (3) bids from responsible bidders for all subcontracts, unless the contract is with an entity specifically exempted by SCM, Volume 1, Section 3.06A.

2. Contractor, by signing this Agreement, certifies that any subcontractor(s) utilized to fulfill the Scope of Work in this Agreement shall be selected by Contractor pursuant to a competitive bidding process that seeks at least three (3) bids from responsible bidders for all subcontracts, unless the subcontract is with an entity specifically exempted by SCM, Volume 1, Section 3.06A. Failure to comply with this requirement may result in suspension of payments under this Agreement or be grounds for termination of this Agreement.

E. Project Representatives

The Project Representatives during the term of this Agreement shall be:

CDSS/DDSD Contractor

Agreement IFB 26-3033 Page 4 of 4

TBD TBD

The Project Representative may be changed by providing written notice to the other party within five (5) business days of the change. Said change shall not require an amendment to this Agreement.

Agreement IFB 26-3033

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

Exhibit A - Attachment 1

OBSERVED STATE HOLIDAYS

HOLIDAY

NEW YEAR'S DAY

MARTIN LUTHER KING DAY

PRESIDENT'S DAY CESAR

FARMWORKER'S DAY

MEMORIAL DAY

INDEPENDENCE DAY

LABOR DAY

VETERAN'S DAY

THANKSGIVING DAY

DAY AFTER THANKSGIVING

CHRISTMAS DAY

DA TE OBSERVED

JANUARY 1

3Ro MONDAY IN JANUARY

3Ro MONDAY IN FEBRUARY

MARCH 31

LAST MONDAY IN MAY

JULY 4

18T MONDAY IN SEPTEMBER

NOVEMBER 11

4TH THURSDAY IN NOVEMBER

4TH FRIDAY IN NOVEMBER

DECEMBER 25

NOTE: When a State holiday falls on a Sunday, it is observed the following Monday.

Agreement IFB 26-3033 Page 1 of 2

EXHIBIT B

(Standard Agreement)

Revised 3/21/25

BUDGET DETAIL AND PAYMENT PROVISIONS

A. Invoicing and Payment

1. The maximum amount payable under this Agreement shall not exceed $TBD.

2. For services satisfactorily rendered, and upon receipt and approval of the invoice(s), CDSS agrees to pay the Contractor for said services in accordance with the rates specified below:

$___________ per month

3. Invoices shall include the Agreement Number TBD and Reporting Structure TBD and shall be submitted not more frequently than monthly in arrears to:

California Department of Social Services Disability Determination Service Division

Administrative Services Bureau 744 P Street, M.S. TBD Sacramento, CA 95814

Attn: TBD Email: TBD

Any invoices submitted without the above referenced information may be returned to the Contractor for further re-processing.

B. State Budget Contingency Clause

1. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, CDSS shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

2. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, CDSS shall have the option to either cancel this Agreement with no liability occurring to the State, or offer an agreement amendment to Contractor to reflect the reduced amount.

C. For Contract with Federal Funds

1. It is mutually understood between the parties that this Agreement may have been written before ascertaining the availability of Congressional appropriation of funds, for the mutual benefit of both parties, in order to avoid program and fiscal

Agreement IFB 26-3033 Page 2 of 2

EXHIBIT B

(Standard Agreement)

Revised 3/21/25 delays which would occur if the Agreement were executed after that determination was made.

2. This Agreement is valid and enforceable only if sufficient funds are made available to the State by the United States Government for the term of this Agreement for the purposes of this program. In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by the Congress or any statute enacted by the Congress which may affect the provisions, terms, or funding of this Agreement in any manner.

3. It is mutually agreed that if the Congress does not appropriate sufficient funds for the program, this Agreement shall be amended to reflect any reduction in funds.

4. CDSS has the option to invalidate the Agreement under the 30-day cancellation clause or to amend the Agreement to reflect any reduction of funds.

D. Prompt Payment Clause

Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927.

E. Review

CDSS reserves the right to review service levels and billing procedures as they impact charges against this Agreement.

F. Final Billing

Invoices for services must be received by CDSS within 90 days following each state fiscal year, or 90 days following the end of the contract term, whichever comes first.

The final invoice must include the statement “Final Billing.”

G. Nonresident Tax Withholdings

Payments to all nonresidents may be subject to withholding. Nonresident payees performing services in California or receiving rent, lease, or royalty payments from property (real or personal) located in California will have seven percent of their total payments withheld for state income taxes. However, no withholding is required if total payments to the payee are $1,500 or less for the calendar year.

EXHIBIT D

(Standard Agreement)

Rev: 4/4/25

SPECIAL TERMS AND CONDITIONS

A. Dispute Provisions

1. If Contractor disputes a decision of the State’s Project Representative regarding the performance of this Agreement or on other issues for which the Project Representative is authorized by this Agreement to make a binding decision, Contractor shall provide written dispute notice to the State’s Project Representative within 15 calendar days after the date of the action. The written dispute notice shall contain the following information:

a. the decision under dispute;

b. the reason(s) Contractor believes the decision of the State’s Project

Representative to have been in error (if applicable, reference pertinent contract provisions);

c. identification of all documents and substance of all oral communication which support Contractor’s position; and

d. the dollar amount in dispute, if applicable.

2. Upon receipt of the written dispute notice, the State program management will examine the matter and issue a written decision to Contractor within 15 calendar days. The decision of State program management shall contain the following information:

a. a description of the dispute;

b. a reference to pertinent contract provisions, if applicable;

c. a statement of the factual areas of agreement or disagreement; and

d. a statement of the representative’s decision with supporting rationale.

3. The decision of the State program management shall be final unless, within 30 calendar days from the date of receipt of the decision, Contractor files with the California Department of Social Services a notice of appeal addressed to:

California Department of Social Services 744 P Street, M.S. 9-6-747

Sacramento, CA 95814 Attention: Chief, Contracts and Procurement Services Branch

Pending resolution of any dispute, Contractor shall diligently continue all contract work and comply with all of the Project Representative’s orders and directions.

EXHIBIT D

(Standard Agreement)

Rev: 4/4/25

B. Termination Without Cause

This Agreement may be terminated without cause by the State upon 30 days written notice to Contractor.

C. Debarment and Suspension

For federally funded agreements, Contractor certifies that to the best of their knowledge and belief that they and their principals or affiliates or any subcontractor utilized under this Agreement, are not debarred or suspended from federal financial assistance programs and activities, nor proposed for debarment, declared ineligible, or voluntarily excluded from participation in covered transactions by any federal department or agency. Contractor also certifies that it or any of its subcontractors are not listed with any active exclusions on the System for Award Management (http://www.sam.gov) (Executive Order 12549, 2 C.F.R. Parts 180, 376, 417 and 2336).

D. Certification Regarding Lobbying

The following provisions are applicable to Cooperative Agreements and Contracts exceeding $100,000 in federal funds:

1. For agreements with contractors who are State entities not under the authority of the Governor, or cities, private firms, or agencies which are receiving in excess of $100,000 in federal funds from CDSS to perform services. By signing this Agreement, Contractor certifies that to the best of their knowledge and belief, that:

a. No federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of a federal contract, the making of a federal grant, the making of a federal loan, the entering into of a cooperative agreement, and the extension, continuation, renewal, amendment, or modification of a federal contract, grant, loan, or cooperative agreement.

b. If any funds other than federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a member of Congress in connection with this federal grant or agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure of Lobbying Activities,” in accordance with its instructions.

http://www.sam.gov/

EXHIBIT D

(Standard Agreement)

Rev: 4/4/25

c. Contractor shall require that the language of this certification be included in the award documents for all covered subawards exceeding $100,000 in federal funds at all appropriate tiers and that all subrecipients shall certify and disclose accordingly.

2. This certification is a prerequisite for making or entering into this transaction and is imposed by Section 1352, Title 31, U.S. Code. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Any person who fails to file the required certification shall be subject to a civil penalty of no less than $10,000 and not more than $100,000 for each such failure.

3. Nonprofit organizations and Institutes of Higher Education are also required to comply with the lobbying provisions contained in 2 C.F.R. section 200.450 and 45 C.F.R. section 75.450.

E. Unruh Civil Rights Act and the Fair Employment & Housing Act

By entering into this Agreement, Contractor certifies compliance with the Unruh Civil Rights Act (Section 51 of the Civil Code) and the Fair Employment and Housing Act (Section 12960 of the Government Code); and if Contractor has an internal policy against a sovereign nation or peoples recognized by the United States government, Contractor certifies that such policies are not used in violation of the Unruh Civil Rights Act or the Fair Employment and Housing Act.

F. Computer Software Copyrights

Contractor certifies that it has appropriate systems and controls in place to ensure that state funds will not be used in the performance of this Agreement for the acquisition, operation, or maintenance of computer software in violation of copyright laws.

G. OMB Audit

Pursuant to Office of Management and Budget (OMB) audit requirement regulations (2 C.F.R. § 200.501), non-federal entities that expend $1,000,000 or more in a year in federal awards from all sources combined shall have a single or program-specific audit conducted for that year in accordance with the provisions of 2 C.F.R. section

200.514 (previously OMB Circular A-133). All OMB audit reports shall meet the report submission requirements established in 2 C.F.R. section 200.512 and a copy shall be forwarded to CDSS.

EXHIBIT D

(Standard Agreement)

Rev: 4/4/25

H. Subcontractors

Contractor may enter into subcontracts for the services to be performed consistent with this Agreement. Nothing contained in this Agreement or otherwise shall create any contractual relationship between CDSS and any subcontractors, and no subcontractor shall relieve Contractor of its responsibilities and obligations hereunder. Contractor agrees to be fully responsible to CDSS for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by Contractor. Contractor’s obligation to pay its subcontractors is an independent obligation from the obligation of CDSS to make payments to Contractor. As a result, CDSS shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor. Contractor shall maintain a copy of each subcontract entered into in support of this Agreement and shall, upon request by CDSS, make copies available for approval, inspection, or audit. Contractor shall ensure that all subcontracts for services include provision(s) requiring compliance with applicable terms and conditions specified in this Agreement and shall, as applicable, advise all subcontractors of their obligations to comply with the terms of the Agreement between CDSS and Contractor. Contractor may not add or substitute any subcontractor without advance written consent of CDSS.

I. Accessibility Requirements

Contractor shall comply with California Government Code sections 7405 and 11135 which requires, among other things, that Contractor shall comply with the accessibility requirements of Section 508 of the Federal Rehabilitation Act of 1973, as amended (29 U.S.C. Sec. 794d), and regulations implementing that act as set forth in Part 1194 of Title 36 of the Federal Code of Regulations. All Contractor deliverables shall meet the requirements of the Web Content Accessibility Guidelines 2.0, or a subsequent version, published by the Web Accessibility Initiative of the World Wide Web Consortium at minimum Level AA success criteria.

Contractor shall respond to and resolve any complaint regarding accessibility of its products or services that is brought to its attention.

J. Russia – Ukraine Conflict Economic Sanctions

Contractor shall ensure compliance with economic sanctions imposed by the U.S.

government in response to Russia's actions in Ukraine, as well as any sanctions imposed under state law (collectively, economic sanctions). Economic sanctions include, but are not limited to, refraining from new investments in, and financial transactions with, Russian institutions or companies that are headquartered or have their principal place of business in Russia (Russian entities), and not transferring technology to Russia or Russian entities. Contractor(s) are further notified that they will be subject to additional reporting requirements pursuant to Executive Order (N-6-22) issued on March 4, 2022, and any other subsequently issued orders.

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

ADDITIONAL PROVISIONS

A. Agreement Term and Amendment

The date of Agreement approval by the State shall be the governing factor as to the date of commencement. Should performance commence before the Agreement is approved, such services may be considered voluntary. The State may exercise any options to extend and/or amend the Agreement as permitted by the Solicitation.

B. Confidentiality Requirements

Contractor and its employees and agents shall comply with CDSS Confidentiality and Information Security Requirements as described in Exhibit E – Attachment 1.

C. Insurance Requirements

1. Contractor, at their own expense, shall maintain the following insurance coverage:

a. Commercial General Liability – Contractor shall maintain general liability on an occurrence form with limits not less than $1,000,000 per occurrence for bodily injury and property damage liability combined with a $2,000,000 annual policy aggregate. The policy shall include coverage for liabilities arising out of premises, operations, independent contractors, products, completed operations, personal & advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

The policy shall include California Department of Social Services, State of California, its officers, agents, employees, and guests, as additional insureds, but only with respect to work performed under the Agreement.

This endorsement shall be supplied under form acceptable to the Office of Risk and Insurance Management. In the case of Contractor’s utilization of subcontractors to complete the contracted scope of work, Contractor shall include all subcontractors as insureds under Contractor’s insurance or supply evidence of insurance to the State equal to policies, coverages, and limits required of Contractor.

b. Automobile Liability – Contractor shall maintain motor vehicle liability with limits not less than $1,000,000 combined single limit per accident. Such insurance shall cover liability arising out of a motor vehicle including owned, hired, and non-owned motor vehicles.

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

The policy shall be endorsed to include the State of California, its officers, agents, employees, and guests as additional insured, but only with respect to work performed under the Agreement. The additional insured endorsement is to be provided with the certificate of insurance.

c. Workers’ Compensation and Employers Liability – Contractor shall maintain statutory workers’ compensation and employer’s liability coverage for all its employees who will be engaged in the performance of the Agreement.

Employer’s liability limits of $1,000,000 are required.

The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the State. The waiver of subrogation endorsement is to be provided with the certificate of insurance.

2. Certificates evidencing Contractor's insurance coverage shall be filed with CDSS prior to execution of this Agreement.

D. General Provisions Applying to All Insurance Polices

1. Coverage Term – Coverage shall be in force for the complete term of the Agreement. If insurance expires during the term of the Agreement, a new certificate shall be received by the State at least ten (10) days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of the Agreement.

2. Policy Cancellation / Termination & Notice of Non-Renewal – Contractor shall provide to the State within five (5) business days a copy of any notice of Cancellation/Termination or Non-renewal received by Contractor for any required insurance policies. In the event Contractor fails to keep the insurance coverage required by this Agreement in effect at all times, the State may, in addition to any other remedies it may have, terminate this Agreement upon the occurrence of such event, subject to the provisions of this Agreement.

3. Deductible – Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause – Any required insurance contained in this Agreement shall be primary, and not excess or contributory, to any other insurance carried by the State.

5. Insurance Carrier Required Rating – All insurance companies shall carry a rating acceptable to the Office of Risk and Insurance Management. If the Contractor is self-insured for a portion or all of its insurance, review of financial information including a letter of credit may be required.

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

6. Endorsements – Any required endorsements requested by the State shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

7. Inadequate Insurance – Inadequate or lack of insurance does not negate the Contractor’s obligations under this Agreement.

E. Certifications and Licenses

Contractor and its employees shall maintain applicable valid and current certifications and/or licenses as required throughout the term of the Agreement.

Contractor shall furnish, upon CDSS request, certifications and/or licenses of staff utilized to perform services.

F. Substitution of Subcontractor

Contractor may not substitute any subcontractor without advance written consent of

CDSS.

G. Disabled Veteran Business Enterprise Subcontractors

1. If for this Agreement Contractor made a commitment to achieve Disabled Veteran Business Enterprise (DVBE) participation, then Contractor shall within 60 days of receiving final payment under this Agreement (or within such other time period as may be specified elsewhere in this Agreement) certify in a report to the awarding department: (1) the total amount the prime contractor received under the contract; (2) the name and address of the DVBE(s) that participated in the performance of the contract; (3) the amount each DVBE received from the prime contractor; (4) that all payments under the contract have been made to the DVBE(s); and (5) the actual percentage of DVBE participation that was achieved.

A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Military & Veterans Code (M&VC) §999.5(d).)

2. Contractor understands and agrees that should award of this Agreement be based in part on their commitment to use the DVBE subcontractor(s) identified in their bid or offer, per M&VC 999.5(e), a DVBE subcontractor may only be replaced by another DVBE subcontractor and shall be approved by the Department of General Services (DGS). Changes to the scope of work that impact the DVBE subcontractor(s) identified in the bid or offer and approved DVBE substitutions will be documented by contract amendment.

3. Failure of Contractor to seek substitution and adhere to the DVBE participation level identified in the bid or offer may be cause for contract termination, recovery of damages under the rights and remedies due to the State, and penalties as

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24 outlined in M&VC §999.9; Public Contract Code (PCC) §10115.10, or PCC §4110 (applies to public works only).

H. DVBE Subcontractor Invoices

To ensure that DVBE participation is applied correctly, all DVBE subcontractor invoices submitted to the Contractor shall include the Agreement number.

The California Department of Social Services Confidentiality and Information Security Requirements

Standard Agreement - v 2026 01

This Confidentiality and Information Security Requirements Exhibit (hereinafter referred to as “this Exhibit”) sets forth the information security and privacy requirements Contractor/Entity (hereinafter referred to as “Contractor”) is obligated to follow with respect to all confidential and sensitive information (as defined herein) disclosed to or collected by Contractor, pursuant to Contractor’s Agreement (the “Agreement”) with the California Department of Social Services (hereinafter “CDSS”) in which this Exhibit is incorporated. The CDSS and Contractor desire to protect the privacy and provide for the security of CDSS Confidential, Sensitive, and/or Personal (CSP) Information (hereinafter referred to as “CDSS CSP”) in compliance with state and federal statutes, rules and regulations.

If it is determined at the sole discretion of CDSS that if no CDSS CSP is processed, stored, transmitted, received, accessed, or exchanged, this Exhibit remains a required and enforceable part of the Agreement; however, only the following sections of this Exhibit apply, and all other provisions remain non-operative:

Sections I-III; IV (A-E, N, O(1)(a), O(2)(g)-(h), P-Q); and V-XI.

I. Order of Precedence.

With respect to information security and privacy requirements for all CDSS CSP, unless specifically exempted, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the Agreement between Contractor and CDSS.

II. Effect on Lower Tier Transactions.

The terms of this Exhibit shall apply to all lower tier transactions (e.g. agreements, sub-agreements, contracts, subcontracts, and sub-awards, etc.). Contractor shall incorporate the contents of this Exhibit into each lower tier transaction.

III. Confidentiality of Information.

A. DEFINITIONS.

The following definitions apply to this Exhibit and relate to CDSS Confidential, Sensitive, and/or Personal Information.

1. “Confidential Information” is information maintained by the CDSS that is exempt from disclosure under the provisions of the California Public Records Act (Government Codes Sections 7920.000 et seq.) or has restrictions on disclosure in accordance with other applicable state or federal laws.

2. “Sensitive Information” is information maintained by the CDSS, which is not confidential by definition, but requires special precautions to protect it from unauthorized access and/or modification (i.e., financial, or operational information). Sensitive information is information in which the

Agreement IFB 26-3033

CDSS/TBD

Exhibit E - Attachment 1 disclosure would jeopardize the integrity of the CDSS (i.e., CDSS' fiscal resources and operations).

3. “Personal Information” is information, in any medium (paper, electronic, or oral) that identifies or describes an individual (i.e., name, social security number, driver’s license, home/mailing address, telephone number, financial matters with security codes, medical insurance policy number, Protected Health Information [PHI], etc.) and must be protected from inappropriate access, use or disclosure and must be made accessible to information subjects upon request. It can also be information in the possession of the Department in which the disclosure is limited by law or contractual Agreement (i.e., proprietary information, etc.).

4. “Breach” is

a. the unauthorized acquisition, access, use, or disclosure of CDSS

CSP in a manner which compromises the security, confidentiality or integrity of the information; or

b. the same as the definition of "breach of the security of the system" set forth in California Civil Code section 1798.29(f).

5. “Information Security Incident” is unauthorized access or disclosure, modification, or destruction of, or interference with, CDSS CSP that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of any state or federal law or in a manner not permitted under the Agreement between Contractor and CDSS, including this Exhibit.

6. “State Data” is all information and data owned by the State and submitted to, processed by, or stored by the Contractor and includes, but is not limited to, all data/information that originated with the State, all data/information provided by the State, and data/information generated, manipulated, produced, reported by or otherwise emanating from or by applications run by the State. State Data encompasses CDSS CSP.

7. “CDSS Credentials” is the unique username (user ID) and password issued to CDSS employees, agents, and subcontractors for access to CDSS domain accounts, used to authenticate a user or device prior to granting access to CDSS information assets and resources.

B. CDSS CSP which may become available to Contractor as a result of the implementation of the Agreement shall be protected by Contractor from unauthorized access, use, and disclosure as described in this Exhibit.

C. Contractor is notified that unauthorized disclosure of CDSS CSP may be subject to civil and/or criminal penalties under state and federal law, including but not limited to:

Agreement IFB 26-3033

CDSS/TBD

• California Welfare and Institutions Code section 10850

• Information Practices Act - California Civil Code section 1798 et seq.

• Public Records Act - California Government Code section 7920.000 et seq.

• California Penal Code Section 502, 11140-11144, 13301-13303

• Health Insurance Portability and Accountability Act of 1996

(“HIPAA”) - 45 CFR Parts 160 and 164

• Safeguarding Information for the Financial Assistance Programs - 45

CFR Part 205.50

• Unemployment Insurance Code section 14013

D. EXCLUSIONS.

“Confidential Information,” “Sensitive Information,” and “Personal Information” (CDSS CSP) does not include information that

1. is or becomes generally known or available to the public other than because of a breach by Contractor of these confidentiality provisions;

2. already known to Contractor before receipt from CDSS without an obligation of confidentiality owed to CDSS;

3. provided to Contractor from a third party except where Contractor knows, or reasonably should know, that the disclosure constitutes a breach of confidentiality or a wrongful or tortious act; or

4. independently developed by Contractor without reference to the CDSS

CSP.

IV. Contractor Responsibilities.

A. Training.

Contractor shall instruct all employees, agents, and subcontractors with access to the State Data regarding:

1. The confidential nature of the information;

2. The civil and criminal sanctions against unauthorized access, use, or disclosure found in the California Civil Code Section 1798.55, Penal Code Section 502 and other state and federal laws;

3. CDSS procedures for reporting actual or suspected information security incidents in Paragraph V - Information Security Incidents and/or Breaches; and

4. That unauthorized access, use, or disclosure of CDSS CSP is grounds for immediate termination of this Agreement with CDSS and Contractor and may be subject to penalties, both civil and criminal.

B. Disclosure of Attendee CSP.

For contracts for training services, unless authorized in writing by the attendees or required by law, the collection and/or disclosure of confidential

Agreement IFB 26-3033

CDSS/TBD

information related to the attendees in trainings and conferences by Contractor shall be limited to that which is required to:

1. Verify attendance and/or participation;

2. Analyze the effectiveness of training and conference;

3. Provide attendees with continuing education units (e.g., Board of

Behavioral Sciences requirements available at http://www.bbs.ca.gov/licensees/ce_licensees.shtml); and/or

4. Analyze the effectiveness of training and conference as described in the “Child and Family Services Plan 2015-2019” available at http://www.cdss.ca.gov/inforesources/Child-Welfare-Program- Improvement/Child-and-Family-Services-Plan

C. Use Restrictions.

Contractor shall take the appropriate steps to ensure that their employees, agents, and subcontractors will not intentionally seek out, read, use, or disclose the State Data other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

D. Disclosure of State Data.

Contractor shall not disclose any individually identifiable State Data to any person other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

E. Subpoena.

If Contractor receives a subpoena or other validly issued administrative or judicial notice requesting the disclosure of State Data, Contractor will immediately notify the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer. In no event should notification to CDSS occur more than three (3) business days after receipt by Contractor’s responsible unit for handling subpoenas and court orders.

F. Information Security Officer.

Contractor shall designate an Information Security Officer to oversee its compliance with this Exhibit and to communicate with CDSS on matters concerning this Exhibit.

G. Requests for CDSS CSP by Third Parties.

Contractor shall promptly transmit to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer all requests for disclosure of any CDSS CSP requested by third parties to the Agreement between Contractor and CDSS (except from an Individual for an accounting of disclosures of the individual’s personal information pursuant to applicable state or federal law), unless prohibited from doing so by applicable state or federal law.

H. Documentation of Disclosures for Requests for Accounting.

Contractor shall maintain an accurate accounting of all requests for disclosure of CDSS CSP Information and the information necessary to respond to a request for an accounting of disclosures of personal information as required by Civil Code section 1798.25, or any applicable state or federal law.

I. Return or Destruction of CDSS CSP on Expiration or Termination.

Upon expiration or termination of the Agreement between Contractor and CDSS, or upon a date mutually agreed upon by the Parties following expiration or termination, Contractor shall return or destroy the CDSS CSP.

If return or destruction is not feasible, Contractor shall provide a written explanation to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer, using the contact information in this Agreement. CDSS, in its sole discretion, will make a determination of the acceptability of the explanation and, if retention is permitted, shall inform Contractor in writing of any additional terms and conditions applicable to the retention of the CDSS CSP.

J. Retention Required by Law.

If required by state or federal law, Contractor may retain, after expiration or termination, CDSS CSP for the time specified as necessary to comply with the law.

K. Obligations Continue Until Return or Destruction.

Contractor’s obligations regarding the confidentiality of CDSS CSP set forth in this Agreement, including but not limited to obligations related to responding to Public Records Act requests and subpoenas shall continue until Contractor returns or destroys the CDSS CSP or returns the CDSS CSP to CDSS; provided however, that on expiration or termination of the Agreement between Contractor and CDSS, Contractor shall not further use or disclose the CDSS CSP except as required by state or federal law.

L. Notification of Election to Destroy CDSS CSP.

If Contractor elects to destroy the CDSS CSP, Contractor shall certify in writing, to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer, using the contact information, that the CDSS CSP has been destroyed.

M. Background Check.

Before a member of Contractor's workforce may access State Data, a thorough background check must be completed to ensure the worker does not present a risk to CDSS information technology systems and/or State Data.

Contractors with CDSS Credentials Prior to accessing any CDSS CSP and being granted CDSS credentials, Contractors will need to pass all of CDSS’ fingerprinting/background checks and onboarding procedures.

All Other Contractors Contractor shall perform at, Contractor’s expense, thorough background checks of any member of their workforce that may access or be exposed to CDSS CSP and evaluate the results to ensure that there is no indication that the worker may present a risk to CDSS information technology systems and/or CDSS data. Contractor shall be liable for damages due to security incidents as a result of insufficient background check of its workforce.

Contractor shall retain each workforce member’s background check documentation for a period of three (3) years following Agreement termination.

1. Please see the following table for clarification on contractor background checks:

Contractors Needing CDSS Credentials

Contractors Not Needing CDSS Credentials

Prior to accessing any CDSS CSP and being granted CDSS credentials, Contractors will need to pass CDSS’ fingerprinting/ background checks and onboarding procedures.

It is the responsibility of the contractor to perform thorough background checks of any member of their workforce that will have access to CDSS CSP.

Contractor must conduct a thorough background check of that worker.

[Contractor shall perform thorough background checks of any member of their workforce that may access or be exposed to CDSS CSP and evaluate the results to ensure that there is no indication that the worker may present a risk to CDSS information technology systems and/or CDSS data. Contractor shall be liable for damages due to security incidents as a result of insufficient background check of its workforce. Contractor shall retain each workforce member’s background check documentation

Agreement IFB 26-3033

CDSS/TBD

for a period of three (3) years following Agreement termination.

N. Nothing in this Agreement shall restrict Contractor’s use of:

1. Information obtained by Contractor from public records or other sources generally available to the public, including but not limited to, academic publications and data extracts.

2. Contractor’s pre-existing data, reports or similar information.

3. Non-confidential information received by Contractor from a third party or non-confidential information created or developed by Contractor, with the exception of information specifically identifying or intending to identify an applicant for, or recipient of, public social services.

O. Confidentiality Safeguards.

Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the State Data that it creates, receives, maintains, uses, or transmits pursuant to the Agreement. Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, including at a minimum the following safeguards:

1. General Security Controls

a. Confidentiality Acknowledgement.

By executing this Agreement and signing Paragraph XI, CDSS Confidentiality and Security Compliance Statement, Contractor acknowledges that the information resources maintained by CDSS and provided to Contractor may be confidential, sensitive, and/or personal and requires special precautions to protect it from wrongful access, use, disclosure, modification, and destruction.

b. Workstation/Laptop Encryption.

All Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP must be encrypted using a FIPS 140-3, until deprecated, certified algorithm which is 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by the CDSS Information Security Office.

c. Data Encryption.

Any CDSS CSP shall be encrypted at rest when stored on network file shares or document repositories.

Agreement IFB 26-3033

CDSS/TBD

d. Server Security.

Servers containing unencrypted CDSS CSP must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.

e. Minimum Necessary.

Only the minimum necessary amount of the CDSS CSP required to perform necessary business functions may be copied, downloaded, or exported.

f. Removable Media Devices.

All electronic files that contain the CDSS CSP must be encrypted when stored on any removable media or portable device (i.e. USB thumb drives, floppies, CD/DVD, smart phone, backup tapes etc.). Encryption must be a FIPS 140-3, until deprecated, certified algorithm which is 128 bit or higher, such as AES.

g. Antivirus Software.

All Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP must install and actively use comprehensive anti-virus software solution with automatic updates scheduled at least daily.

h. Patch Management.

To correct known security vulnerabilities, Contractor shall install security patches and updates in a timely manner on all Contractor-owned or managed workstations, laptops, tablets, smart phones, and similar devices that process and/or store CDSS CSP as appropriate based on Contractor’s risk assessment of such patches and updates, the technical requirements of Contractor’s systems, and the vendor’s written recommendations. If patches and updates cannot be applied in a timely manner due to hardware or software constraints, mitigating controls will be implemented based upon the results of a risk assessment.

i. User IDs and Password Controls.

All users must be issued a unique username for accessing CDSS CSP. Contractor’s password policy must be based on information security best practices for password length, complexity, and reuse.

j. Data Destruction.

Upon termination of the Agreement, all CDSS CSP must be sanitized in accordance with NIST Special Publication 800-88, Guidelines for Media Sanitization.

k. Multi-Factor Authentication (MFA) Contractor shall comply with the Multi-Factor Authentication (MFA) requirements set forth in the Statewide Information Management Manual (SIMM) Section 5360-C. MFA shall be enforced for any publicly accessible information asset that stores, processes, transmits or visually presents CDSS CSP.

Contractor shall also ensure that all employees, subcontractors and associated third parties engaged in the performance of this Agreement comply with these same MFA requirements.

2. System Security Controls

a. System Timeout.

The system providing access to the CDSS CSP must provide an automatic timeout, requiring re-authentication of the user session after no more than thirty (30) minutes of inactivity for applications, and fifteen (15) minutes of inactivity for desktops and laptops.

b. Warning Banners.

All systems (servers, desktops, laptops, etc.) containing CDSS CSP must display a warning banner at login stating that data is confidential, systems are logged, and system use is for business purposes only. User must be directed to log off the system if they do not agree with these requirements.

c. System Logging.

The system must maintain an automated audit trail which can identify the user or system process which initiates a request for CDSS CSP, or which alters CDSS CSP. The audit trail must be date and time stamped, must log both successful and failed accesses, must be read only, and must be restricted to authorized users. If CDSS CSP is stored in a database, database logging functionality must be enabled. Audit trail data must be archived for at least one (1) year after occurrence.

d. Access Controls.

The system must use role-based access controls for all user authentications, enforcing the principle of least privilege.

Agreement IFB 26-3033

CDSS/TBD

e. Transmission Encryption.

All data transmissions of CDSS CSP by Contractor outside the secure internal network must be encrypted using a FIPS 140-3, until deprecated, certified algorithm, such as Advanced Encryption Standard (AES), with a 128 bit key or higher.

Encryption can be end-to-end at the network level, or the data files containing CDSS CSP can be encrypted. This requirement pertains to any type of CDSS CSP in motion such as website access, file transfer, and/or email.

f. Intrusion Detection.

All systems involved in accessing, holding, transporting, and protecting CDSS CSP that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

g. Data Location.

The physical location of Contractor’s data center where State Data is stored shall only be within the continental United States, unless otherwise specified in the Statement of Work and approved in advance in writing by the State CISO.

Any exceptions to the Data Location is at the sole discretion of the State

h. Data Access.

Contractor shall not allow its personnel or subcontractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its data centers located in the continental United States.

Remote access to State Data from outside the continental United States, including remote access to State Data by authorized Services support staff in identified support centers, is prohibited unless approved in advance in writing by the State CISO. Responsibility to obtain CISO approval lies with the State.

i. Software as a Service.

If the Contractor is providing any web/cloud hosting services, the Contractor shall agree to the most current revision of the State Model Cloud Computing Special Provisions for Software as a Service (SaaS), hereby incorporated by reference.

3. Audit Controls

a. System Security Review.

All systems processing and/or storing CDSS CSP must have at least an annual system risk assessment/security review

Agreement IFB 26-3033

CDSS/TBD

Exhibit E - Attachment 1 https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews shall include vulnerability scanning and/or penetration testing tools.