exhibit_2-sample_agreement.pdf

2. The term of this Agreement is:

Agreement 24-3053 CDSS/TBD Page 1 of 4

EXHIBIT A

(Standard Agreement)

SCOPE OF WORK

A. BACKGROUND AND PURPOSE

This Agreement is entered into between the California Department of Social Services (CDSS) and [TBD] (Contractor).

CDSS, State Hearings Division (SHD) conducts administrative hearings in accordance with Government Code sections 11500 et seq., Welfare and Institutions Code section 10950 et seq., other applicable statutes, and pursuant to contracts and interagency agreements with other state entities. The proceedings are audio recorded by CDSS, by means capable of transcription. CDSS SHD requires transcription services as defined below.

B. CONTRACTOR RESPONSIBILITIES

The Contractor shall:

1. Provide CDSS with the transcript and attach the Transcriptionist’s Certificate that certifies the accuracy of the transcript.

2. Prepare transcripts in accordance with the following criteria pursuant to Division 24 of Title 16 of the California Code of Regulations, unless otherwise directed by the CDSS. Electronic copies, described below, shall be prepared so that if printed to paper, they shall satisfy the following specifications.

a. A minimum of 25 text lines per page.

b. Five (5) space indent, including Exhibit listings.

c. 1-1/2 inch margins (a minimum of 56 character spaces per line, time-stamping no fewer than 52).

d. Exhibits shall be maintained by CDSS and originals shall not be released to the

Reporter.

e. The Title Page shall contain the case caption, case number, type of proceeding or hearing, volume number, date, location/modality of proceeding, Transcriptionist’s name and Transcriptionist certification/license number.

f. The Appearance Page shall list the name of the Administrative Law Judge presiding, name(s) of party(ies) represented and name(s) of representative(s).

g. The Witness Index shall identify witness, type of examination (e.g., direct, cross, redirect, recross or rebuttal), and page number at which each witness testifies, or identify speakers and page number at which each speaker testifies.

h. The Exhibit Index shall identify documents with enumeration and description, state the page in the transcript it was introduced and the page on which it was admitted.

CDSS/TBD Page 2 of 4

i. The beginning time of proceeding shall be noted at the top of the first page of text, and concluding time shall be noted on the last page after the last line of text.

3. Ensure the accuracy of all transcripts prior to delivery to CDSS. Contractor shall have a quality assurance process in place that includes at minimum the running of spell check and editing transcripts for final review to eliminate “Critical Errors” that impact the credibility of the transcript, and to ensure that examinations, witness, and exhibit entries are thorough and accurate.

a. “Critical Errors” are defined as follows:

(1) Incorrect witness exams or exhibit entries;

(2) Incorrect text (including typographical errors);

(3) Missing text;

(4) Incorrect use of words, names or titles;

(5) Incorrect page numbering; and

(6) Incorrect witness/exhibit indexes, etc., that impact the accuracy and credibility of the transcript.

(7) This definition does not include differing styles of punctuation and capitalization that do not impact the credibility of the transcript. If a type of error is found that is not described above, CDSS shall determine whether the error is critical or non-critical.

4. Unless otherwise indicated, all transcripts shall be delivered to CDSS via encrypted email, secure FTP, or website for review. If CDSS has requested to review the transcript, CDSS shall return it to Contractor to make any necessary corrections, at Contractor’s expense.

5. Provide CDSS a corrected transcript within five (5) calendar days from CDSS’ notification of deficiency at no additional cost.

6. Receive and deliver orders for transcription via courier or United States Postal Service, electronically via encrypted email, using FTP, or a secure website.

7. Deliver transcripts to CDSS by the turnaround time requested in CDSS’ order (i.e.

Same Day, 1 Working Day, 2 Working Days, 3 Working Days, 4 Working Days, 11 to 15 Working Days) from date of request.

8. Produce transcripts in current software programs (e.g., Word, WordPerfect, e/index and ASCII) with latest virus control software, or as specified by CDSS.

9. Make digital/electronic signatures an acceptable form of certification for final electronic transcripts upon specific request from CDSS.

CDSS/TBD Page 3 of 4

10. Return physical media sent to Contractor for transcription to CDSS unless specified otherwise by CDSS.

11. If the cost estimate for the requested transcription project is less than the minimum amount specified below for each transcription project, the invoice for each requested project shall reflect the minimum amount: $50 minimum per project

C. CDSS RESPONSIBILITIES

The CDSS shall:

1. Submit recordings of administrative hearings to the Contractor for transcription.

2. Provide notice to the Contractor, by written request with the turnaround time requested in CDSS’ order (i.e., Same Day, 1 Working Day, 2 Working Days, 3 Working Days, 4 Working Days, 11 to 15 Working Days).

3. Designate Program Coordinator to work with Contractor and serve as a single point of contact regarding services being provided.

4. Provide overall management of scheduling and coordinating transcription services.

5. Serve as the interface between the Contractor and CDSS Staff.

6. Help resolve and escalate issues.

7. Review, approve and submit invoices to CDSS Accounting Bureau for payment.

8. Indicate in its Order if a transcript shall require CDSS review and approval prior to finalization.

9. Review the transcript in a timely manner (within 24 hours or any other mutually agreeable timeframe) so as not to negatively impact the Transcribers production of a final transcript.

10. If a certified transcript is ordered, define the delivery timeframe and the format of transcript either electronic copy, CD-ROM or hardcopy certified transcripts (signed original or duplicate original) and one (1) copy.

CDSS/TBD Page 4 of 4

D. Project Representatives

The Project Representatives during the term of this Agreement shall be:

CDSS Contractor Name Name Title Title Address Address City, State Zip code City, State Zip code Phone: Phone:

Email: Email:

The Project Representative may be changed by providing written notice to the other party within five (5) business days of the change. Said change shall not require an amendment to this Agreement.

Agreement 24-3053 Page 1 of 3

CDSS/TBD

EXHIBIT B

(Standard Agreement)

Revised 12/29/23

BUDGET DETAIL AND PAYMENT PROVISIONS

A. Invoicing and Payment

1. The maximum amount payable under this Agreement shall not exceed $TBD Shown below are the amounts that cannot be exceeded for each of the fiscal year(s):

TBD $TBD

TBD $TBD

TBD $TBD

2. For services satisfactorily rendered, and upon receipt and approval of the invoice(s), CDSS agrees to pay the Contractor for said services in accordance with the rates specified in Exhibit B – Attachment TBD

3. Contractor shall not be reimbursed for any travel-related expenses. Any and all travel shall be at the expense of the Contractor.

4. Invoices shall include the Agreement Number TBD and Reporting Structure TBD and shall be submitted not more frequently than monthly in arrears to:

California Department of Social Services

TBD

TBD

744 P Street, M.S. TBD Sacramento, CA 95814

Attn: TBD Email: TBD

Any invoices submitted without the above referenced information may be returned to the Contractor for further re-processing.

B. State Budget Contingency Clause

1. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, CDSS shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

2. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, CDSS shall have the option to either cancel this Agreement with

Agreement 24-3053 Page 2 of 3

EXHIBIT B

(Standard Agreement)

Revised 12/29/23 no liability occurring to the State, or offer an agreement amendment to Contractor to reflect the reduced amount.

C. For Contract with Federal Funds

1. It is mutually understood between the parties that this Agreement may have been written before ascertaining the availability of Congressional appropriation of funds, for the mutual benefit of both parties, in order to avoid program and fiscal delays which would occur if the Agreement were executed after that determination was made.

2. This Agreement is valid and enforceable only if sufficient funds are made available to the State by the United States Government for the term of this Agreement for the purposes of this program. In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by the Congress or any statute enacted by the Congress which may affect the provisions, terms, or funding of this Agreement in any manner.

3. It is mutually agreed that if the Congress does not appropriate sufficient funds for the program, this Agreement shall be amended to reflect any reduction in funds.

4. CDSS has the option to invalidate the Agreement under the 30-day cancellation clause or to amend the Agreement to reflect any reduction of funds.

D. Prompt Payment Clause

Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927.

E. Review

CDSS reserves the right to review service levels and billing procedures as they impact charges against this Agreement.

F. Final Billing

Invoices for services must be received by CDSS within 90 days following each state fiscal year, or 90 days following the end of the contract term, whichever comes first.

The final invoice must include the statement “Final Billing.”

G. Nonresident Tax Withholdings

Payments to all nonresidents may be subject to withholding. Nonresident payees performing services in California or receiving rent, lease, or royalty payments from property (real or personal) located in California will have seven percent of their total

Agreement 24-3053 Page 3 of 3

EXHIBIT B

(Standard Agreement)

Revised 12/29/23 payments withheld for state income taxes. However, no withholding is required if total payments to the payee are $1,500 or less for the calendar year.

Agreement 24-3053 Page 1 of 5

EXHIBIT D

(Standard Agreement)

Rev: 7/3/24

SPECIAL TERMS AND CONDITIONS

A. Dispute Provisions

1. If Contractor disputes a decision of the State’s Project Representative regarding the performance of this Agreement or on other issues for which the Project Representative is authorized by this Agreement to make a binding decision, Contractor shall provide written dispute notice to the State’s Project Representative within 15 calendar days after the date of the action. The written dispute notice shall contain the following information:

a. the decision under dispute;

b. the reason(s) Contractor believes the decision of the State’s Project

Representative to have been in error (if applicable, reference pertinent contract provisions);

c. identification of all documents and substance of all oral communication which support Contractor’s position; and

d. the dollar amount in dispute, if applicable.

2. Upon receipt of the written dispute notice, the State program management will examine the matter and issue a written decision to Contractor within 15 calendar days. The decision of State program management shall contain the following information:

a. a description of the dispute;

b. a reference to pertinent contract provisions, if applicable;

c. a statement of the factual areas of agreement or disagreement; and

d. a statement of the representative’s decision with supporting rationale.

3. The decision of the State program management shall be final unless, within 30 calendar days from the date of receipt of the decision, Contractor files with the California Department of Social Services a notice of appeal addressed to:

California Department of Social Services 744 P Street, M.S. 9-6-747

Sacramento, CA 95814 Attention: Chief, Contracts and Procurement Services Branch

Pending resolution of any dispute, Contractor shall diligently continue all contract work and comply with all of the Project Representative’s orders and directions.

Agreement 24-3053 Page 2 of 5

EXHIBIT D

(Standard Agreement)

Rev: 7/3/24

B. Termination Without Cause

This Agreement may be terminated without cause by the State upon 30 days written notice to Contractor.

C. Debarment and Suspension

For federally funded agreements, Contractor certifies that to the best of their knowledge and belief that they and their principals or affiliates or any subcontractor utilized under this Agreement, are not debarred or suspended from federal financial assistance programs and activities, nor proposed for debarment, declared ineligible, or voluntarily excluded from participation in covered transactions by any federal department or agency. Contractor also certifies that it or any of its subcontractors are not listed with any active exclusions on the System for Award Management (http://www.sam.gov) (Executive Order 12549, 2 C.F.R. Parts 180, 376, 417 and 2336).

D. Certification Regarding Lobbying

The following provisions are applicable to Cooperative Agreements and Contracts exceeding $100,000 in federal funds:

1. For agreements with contractors who are State entities not under the authority of the Governor, or cities, private firms, or agencies which are receiving in excess of $100,000 in federal funds from CDSS to perform services. By signing this Agreement, Contractor certifies that to the best of their knowledge and belief, that:

a. No federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of a federal contract, the making of a federal grant, the making of a federal loan, the entering into of a cooperative agreement, and the extension, continuation, renewal, amendment, or modification of a federal contract, grant, loan, or cooperative agreement.

b. If any funds other than federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a member of Congress in connection with this federal grant or agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure of Lobbying Activities,” in accordance with its instructions.

http://www.sam.gov/

Agreement 24-3053 Page 3 of 5

EXHIBIT D

(Standard Agreement)

Rev: 7/3/24

c. Contractor shall require that the language of this certification be included in the award documents for all covered subawards exceeding $100,000 in federal funds at all appropriate tiers and that all subrecipients shall certify and disclose accordingly.

2. This certification is a prerequisite for making or entering into this transaction and is imposed by Section 1352, Title 31, U.S. Code. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Any person who fails to file the required certification shall be subject to a civil penalty of no less than $10,000 and not more than $100,000 for each such failure.

3. Nonprofit organizations and Institutes of Higher Education are also required to comply with the lobbying provisions contained in 2 C.F.R. section 200.450 and 45 C.F.R. section 75.450.

E. Unruh Civil Rights Act and the Fair Employment & Housing Act

By entering into this Agreement, Contractor certifies compliance with the Unruh Civil Rights Act (Section 51 of the Civil Code) and the Fair Employment and Housing Act (Section 12960 of the Government Code); and if Contractor has an internal policy against a sovereign nation or peoples recognized by the United States government, Contractor certifies that such policies are not used in violation of the Unruh Civil Rights Act or the Fair Employment and Housing Act.

F. Computer Software Copyrights

Contractor certifies that it has appropriate systems and controls in place to ensure that state funds will not be used in the performance of this Agreement for the acquisition, operation, or maintenance of computer software in violation of copyright laws.

G. OMB Audit

Pursuant to Office of Management and Budget (OMB) audit requirement regulations (2 C.F.R. § 200.501), non-federal entities that expend $750,000 or more in a year in federal awards from all sources combined shall have a single or program-specific audit conducted for that year in accordance with the provisions of 2 C.F.R. section

200.514 (previously OMB Circular A-133). All OMB audit reports shall meet the report submission requirements established in 2 C.F.R. section 200.512 and a copy shall be forwarded to CDSS.

Agreement 24-3053 Page 4 of 5

EXHIBIT D

(Standard Agreement)

Rev: 7/3/24

H. Subcontractors

The following provision is applicable to agreements in which the Contractor subcontracts out a portion of the work performed under this Agreement:

Contractor may enter into subcontracts for the services to be performed at Contractor’s expense, provided such subcontracts are consistent with this Agreement. Nothing contained in this Agreement or otherwise shall create any contractual relationship between CDSS and any subcontractors, and no subcontractor shall relieve Contractor of its responsibilities and obligations hereunder. Contractor agrees to be fully responsible to CDSS for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by Contractor. Contractor’s obligation to pay its subcontractors is an independent obligation from the obligation of CDSS to make payments to Contractor. As a result, CDSS shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor. Contractor shall maintain a copy of each subcontract entered into in support of this Agreement and shall, upon request by CDSS, make copies available for approval, inspection, or audit. Contractor shall ensure that all subcontracts for services include provision(s) requiring compliance with applicable terms and conditions specified in this Agreement and shall, as applicable, advise all subcontractors of their obligations to comply with the terms of the Agreement between CDSS and Contractor.

I. Indirect Costs/Administrative Overhead

Where allowed and identified in this Agreement, Contractor may claim indirect costs.

Indirect costs are expenses incurred for administrative services such as, but not limited to, accounting; personnel and payroll administration; accounts payable services; general and specialized insurance coverage; compliance and regulatory monitoring; independent audit services; and legal services. Indirect costs are applied to personnel, operating expenses, supplies, equipment, and travel expenses. Contractor shall ensure that all administrative fees are reasonable considering the services being provided. Contractor may only pay overhead charges on the first $25,000 of each subcontract. Any subcontractor receiving $25,000 or more must be clearly identified in the budget display and excluded when the total indirect costs are calculated. Line-item budget shifts which increase the indirect costs shall not be allowed.

J. Accessibility Requirements

Contractor shall comply with California Government Code sections 7405 and 11135 which requires, among other things, that Contractor shall comply with the accessibility requirements of Section 508 of the Federal Rehabilitation Act of 1973, Agreement 24-3053 Page 5 of 5

EXHIBIT D

(Standard Agreement)

Rev: 7/3/24 as amended (29 U.S.C. Sec. 794d), and regulations implementing that act as set forth in Part 1194 of Title 36 of the Federal Code of Regulations. All Contractor deliverables shall meet the requirements of the Web Content Accessibility Guidelines 2.0, or a subsequent version, published by the Web Accessibility Initiative of the World Wide Web Consortium at minimum Level AA success criteria.

Contractor shall respond to and resolve any complaint regarding accessibility of its products or services that is brought to its attention.

K. Russia – Ukraine Conflict Economic Sanctions

Contractor shall ensure compliance with economic sanctions imposed by the U.S.

government in response to Russia's actions in Ukraine, as well as any sanctions imposed under state law (collectively, economic sanctions). Economic sanctions include, but are not limited to, refraining from new investments in, and financial transactions with, Russian institutions or companies that are headquartered or have their principal place of business in Russia (Russian entities), and not transferring technology to Russia or Russian entities. Contractor(s) are further notified that they will be subject to additional reporting requirements pursuant to Executive Order (N-6-22) issued on March 4, 2022, and any other subsequently issued orders.

L. Generative Artificial Intelligence (GenAI) Technology Use & Reporting

During the term of the contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAI technology, including GenAI from third parties or subcontractors.

Contractor shall immediately complete the GenAI Reporting and Factsheet, STD 1000 to notify the State of any new or previously unreported GenAI technology. At the direction of the State, Contractor shall discontinue the use of any new or previously undisclosed GenAI technology that materially impacts functionality, risk or contract performance, until use of such GenAI technology has been approved by the State.

Failure to disclose GenAI use to the State and submit the GenAI Reporting and Factsheet, STD 1000 may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAI and/or failure to submit the GenAI Reporting and Factsheet, STD 1000 as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief it may be entitled to as a result of such non-disclosure.

The State reserves the right to amend the contract, without additional cost, to incorporate GenAI Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.

Agreement 24-3053 Page 1 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

ADDITIONAL PROVISIONS

A. Agreement Term and Amendment

The anticipated term of the resulting Agreement is January 1, 2025, or date of approval by the CDSS, whichever is later, through a period not to exceed 36 months. The state may, at its discretion, amend to add funds to complete the identified tasks at the originally agreed upon service rates. However, the date of Agreement approval by the State shall be the governing factor as to the date of commencement. Should performance commence before the Agreement is approved, such services may be considered voluntary. The State may exercise any options to extend and/or amend the Agreement as permitted by the Solicitation.

B. Confidentiality Requirements

Contractor and its employees and agents shall comply with CDSS Confidentiality and Information Security Requirements as described in Exhibit E – Attachment 1.

C. Insurance Requirements

1. Contractor, at their own expense, shall maintain the following insurance coverage:

a. Commercial General Liability – Contractor shall maintain general liability on an occurrence form with limits not less than $1,000,000 per occurrence for bodily injury and property damage liability combined with a $2,000,000 annual policy aggregate. The policy shall include coverage for liabilities arising out of premises, operations, independent contractors, products, completed operations, personal & advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

The policy shall include California Department of Social Services, State of California, its officers, agents, employees, and guests, as additional insureds, but only with respect to work performed under the Agreement.

This endorsement shall be supplied under form acceptable to the Office of Risk and Insurance Management. In the case of Contractor’s utilization of subcontractors to complete the contracted scope of work, Contractor shall include all subcontractors as insureds under Contractor’s insurance or supply evidence of insurance to the State equal to policies, coverages, and limits required of Contractor.

Agreement 24-3053 Page 2 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

b. Workers’ Compensation and Employers Liability – Contractor shall maintain statutory workers’ compensation and employer’s liability coverage for all its employees who will be engaged in the performance of the Agreement.

Employer’s liability limits of $1,000,000 are required.

The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the State. The waiver of subrogation endorsement is to be provided with the certificate of insurance.

2. Certificates evidencing Contractor's insurance coverage shall be filed with CDSS prior to execution of this Agreement.

D. General Provisions Applying to All Insurance Polices

1. Coverage Term – Coverage shall be in force for the complete term of the Agreement. If insurance expires during the term of the Agreement, a new certificate shall be received by the State at least ten (10) days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of the Agreement.

2. Policy Cancellation / Termination & Notice of Non-Renewal – Contractor shall provide to the State within five (5) business days a copy of any notice of Cancellation/Termination or Non-renewal received by Contractor for any required insurance policies. In the event Contractor fails to keep the insurance coverage required by this Agreement in effect at all times, the State may, in addition to any other remedies it may have, terminate this Agreement upon the occurrence of such event, subject to the provisions of this Agreement.

3. Deductible – Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause – Any required insurance contained in this Agreement shall be primary, and not excess or contributory, to any other insurance carried by the State.

5. Insurance Carrier Required Rating – All insurance companies shall carry a rating acceptable to the Office of Risk and Insurance Management. If the Contractor is self-insured for a portion or all of its insurance, review of financial information including a letter of credit may be required.

6. Endorsements – Any required endorsements requested by the State shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

Agreement 24-3053 Page 3 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

7. Inadequate Insurance – Inadequate or lack of insurance does not negate the Contractor’s obligations under this Agreement.

E. Certifications and Licenses

Contractor and its employees shall maintain applicable valid and current certifications and/or licenses as required throughout the term of the Agreement.

Contractor shall furnish, upon CDSS request, certifications and/or licenses of staff utilized to perform services.

F. Substitution of Subcontractor

Contractor may not substitute any subcontractor without advance written consent of

CDSS.

G. Disabled Veteran Business Enterprise Subcontractors

1. If for this Agreement Contractor made a commitment to achieve Disabled Veteran Business Enterprise (DVBE) participation, then Contractor shall within 60 days of receiving final payment under this Agreement (or within such other time period as may be specified elsewhere in this Agreement) certify in a report to the awarding department: (1) the total amount the prime contractor received under the contract; (2) the name and address of the DVBE(s) that participated in the performance of the contract; (3) the amount each DVBE received from the prime contractor; (4) that all payments under the contract have been made to the DVBE(s); and (5) the actual percentage of DVBE participation that was achieved.

A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Military & Veterans Code (M&VC) §999.5(d).)

2. Contractor understands and agrees that should award of this Agreement be based in part on their commitment to use the DVBE subcontractor(s) identified in their bid or offer, per M&VC 999.5(e), a DVBE subcontractor may only be replaced by another DVBE subcontractor and shall be approved by the Department of General Services (DGS). Changes to the scope of work that impact the DVBE subcontractor(s) identified in the bid or offer and approved DVBE substitutions will be documented by contract amendment.

3. Failure of Contractor to seek substitution and adhere to the DVBE participation level identified in the bid or offer may be cause for contract termination, recovery of damages under the rights and remedies due to the State, and penalties as outlined in M&VC §999.9; Public Contract Code (PCC) §10115.10, or PCC §4110 (applies to public works only).

Agreement 24-3053 Page 4 of 4

EXHIBIT E

(Standard Agreement)

Rev: 3/20/24

H. DVBE Subcontractor Invoices

To ensure that DVBE participation is applied correctly, all DVBE subcontractor invoices submitted to the Contractor shall include the Agreement number.

2022 01 Exhibit E Attachment 1 - Contracted Services

The California Department of Social Services Confidentiality and Information Security Requirements

Contracted Services - v 2022 01 This Confidentiality and Information Security Requirements Exhibit (hereinafter referred to as “this Exhibit”) sets forth the information security and privacy requirements Contractor/Entity (hereinafter referred to as “Contractor”) is obligated to follow with respect to all confidential and sensitive information (as defined herein) disclosed to or collected by Contractor, pursuant to Contractor’s Agreement (the “Agreement”) with the California Department of Social Services (hereinafter “CDSS”) in which this Exhibit is incorporated. The CDSS and Contractor desire to protect the privacy and provide for the security of CDSS Confidential, Sensitive, and/or Personal (CSP) Information (hereinafter referred to as “CDSS CSP”) in compliance with state and federal statutes, rules, and regulations.

I. Order of Precedence.

With respect to information security and privacy requirements for all CDSS CSP, unless specifically exempted, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the Agreement between Contractor and CDSS.

II. Effect on lower tier transactions.

The terms of this Exhibit shall apply to all lower tier transactions (e.g. agreements, sub-agreements, contracts, subcontracts, and sub-awards, etc.). Contractor shall incorporate the contents of this Exhibit into each lower tier transaction.

III. Confidentiality of Information.

A. DEFINITIONS.

The following definitions apply to this Exhibit and relate to CDSS Confidential, Sensitive and/or Personal Information.

1. “Confidential Information” is information maintained by the CDSS that is exempt from disclosure under the provisions of the California Public Records Act (Government Codes Sections 7920.000 et seq.) or has restrictions on disclosure in accordance with other applicable state or federal laws.

2. “Sensitive Information” is information maintained by the CDSS, which is not confidential by definition, but requires special precautions to protect it from unauthorized access and/or modification (i.e., financial or operational information). Sensitive information is information in which the disclosure would jeopardize the integrity of the CDSS (i.e., CDSS' fiscal resources and operations).

3. “Personal Information” is information, in any medium (paper, electronic, or oral) that identifies or describes an individual (i.e., name, social security number, driver’s license, home/mailing address, telephone number, financial matters with security codes, medical insurance policy number, Protected Health Information

Agreement 24-3053

CDSS/TBD

Exhibit E - Attachment 1

[PHI], etc.) and must be protected from inappropriate access, use or disclosure and must be made accessible to information subjects upon request. It can also be information in the possession of the Department in which the disclosure is limited by law or contractual Agreement (i.e., proprietary information, etc.).

4. “Breach” is

a. the unauthorized acquisition, access, use, or disclosure of

CDSS CSP in a manner which compromises the security, confidentiality or integrity of the information; or

b. the same as the definition of "breach of the security of the system" set forth in California Civil Code section 1798.29(f).

5. “Information Security Incident” is

a. unauthorized access or disclosure, modification or destruction of, or interference with, CDSS CSP that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of any state or federal law or in a manner not permitted under the Agreement between Contractor and CDSS, including this Exhibit.

B. CDSS CSP which may become available to Contractor as a result of the implementation of the Agreement shall be protected by Contractor from unauthorized access, use, and disclosure as described in this Exhibit.

C. Contractor is notified that unauthorized disclosure of CDSS CSP may be subject to civil and/or criminal penalties under state and federal law, including but not limited to:

• California Welfare and Institutions Code section 10850

• Information Practices Act - California Civil Code section 1798 et seq.

• Public Records Act - California Government Code section 7920.000 et seq.

• California Penal Code Section 502, 11140-11144, 13301-13303

• Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) - 45 CFR Parts 160 and 164

• Safeguarding Information for the Financial Assistance Programs - 45 CFR Part 205.50

• Unemployment Insurance Code section 14013

D. EXCLUSIONS.

Agreement 24-3053

CDSS/TBD

“Confidential Information”, “Sensitive Information”, and “Personal Information” (CDSS CSP) does not include information that

1. is or becomes generally known or available to the public other than because of a breach by Contractor of these confidentiality provisions;

2. already known to Contractor before receipt from CDSS without an obligation of confidentiality owed to CDSS;

3. provided to Contractor from a third party except where Contractor knows, or reasonably should know, that the disclosure constitutes a breach of confidentiality or a wrongful or tortious act; or

4. independently developed by Contractor without reference to the

CDSS CSP.

IV. Contractor Responsibilities.

A. Training.

Contractor shall instruct all employees, agents, and subcontractors with access to the CDSS CSP regarding:

1. The confidential nature of the information;

2. The civil and criminal sanctions against unauthorized access, use, or disclosure found in the California Civil Code Section 1798.55, Penal Code Section 502 and other state and federal laws;

3. CDSS procedures for reporting actual or suspected information security incidents in Paragraph V - Information Security Incidents and/or Breaches; and

4. That unauthorized access, use, or disclosure of CDSS CSP is grounds for immediate termination of this Agreement with CDSS, and Contractor and may be subject to penalties, both civil and criminal.

B. Use Restrictions.

Contractor shall take the appropriate steps to ensure that their employees, agents, and subcontractors will not intentionally seek out, read, use, or disclose the CDSS CSP other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

C. Disclosure of CDSS CSP.

Contractor shall not disclose any individually identifiable CDSS CSP to any person other than for the purposes described in the Agreement and to meet its obligations under the Agreement.

D. Subpoena.

Agreement 24-3053

CDSS/TBD

If Contractor receives a subpoena or other validly issued administrative or judicial notice requesting the disclosure of CDSS CSP, Contractor will immediately notify the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer. In no event should notification to CDSS occur more than three (3) business days after receipt by Contractor’s responsible unit for handling subpoenas and court orders.

E. Confidentiality Safeguards.

Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the CDSS CSP that it creates, receives, maintains, uses, or transmits pursuant to the Agreement. Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities.

F. Nothing in this Agreement shall restrict Contractor’s use of:

1. Information obtained by Contractor from public records or other sources generally available to the public, including but not limited to, academic publications and data extracts.

2. Contractor’s pre-existing data, reports or similar information.

3. Non-confidential information received by Contractor from a third party or non-confidential information created or developed by Contractor, with the exception of information specifically identifying or intending to identify an applicant for, or recipient of, public social services.

V. Information Security Incidents and/or Breaches of CDSS CSP A. CDSS CSP Information Security Incidents and/or Breaches Response

Responsibility.

The Contractor shall be responsible for facilitating the Information Security Incident and/or Breach response process as described in California Civil Code 1798.82(f), and State Administrative Manual (SAM) Section 5340, Information Security Incident Management, including, but not limited to, taking:

1. Prompt corrective action to mitigate the risks or damages involved with the Information Security Incident and/or Breach and to protect the operating environment; and

2. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.

B. Discovery and Notification of Information Security Incidents and/or Breaches of CDSS CSP.

Contractor shall notify the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer of an Information Security Incident and/or Breach as expeditiously as practicable and without unreasonable

Agreement 24-3053

CDSS/TBD

delay, taking into account the time necessary to allow Contractor to determine the scope of the Information Security Incident and/or Breach, but no later than three (3) calendar days after the discovery of an Information Security Incident and/or Breach. Notification is to be made by telephone call and email.

C. Investigation of Information Security Incidents and/or Breaches.

Contractor shall promptly investigate Information Security Incidents and/or Breaches of CDSS CSP. CDSS shall have the right to participate in the investigation of such Information Security Incidents and/or Breaches. CDSS shall also have the right to conduct its own independent investigation, and Contractor shall cooperate fully in such investigations. Contractor is not required to disclose their un-redacted confidential, proprietary, or privileged information. Contractor will keep CDSS fully informed of the results of any such investigation.

D. Updates on Investigation.

Contractor shall provide regular (at least once a week) email updates on the progress of the Information Security Incident and/or Breach investigation of CDSS CSP to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer until the updates are no longer needed, as mutually agreed upon between Contractor and the CDSS Information Security and Privacy Officer. Contractor is not required to disclose their un-redacted confidential, proprietary, or privileged information.

E. Written Report.

Contractor shall provide a written report of the investigation to the CDSS Program Contract Manager and the CDSS Information Security and Privacy Officer within thirty (30) business days of the discovery of the Information Security Incident and/or Breach of CDSS CSP. Contractor is not required to disclose their un-redacted confidential, proprietary, or privileged information. The report shall include, but not be limited to, if known, the following:

1. Contractor point of contact information;

2. A description of what happened, including the date of the

Information Security Incident and/or Breach of CDSS CSP and the date of the discovery of the Information Security Incident and/or Breach, if known;

3. A description of the types of CDSS CSP that were involved and the extent of the information involved in the Information Security Incident and/or Breach;

4. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed CDSS CSP;

5. A description of where the CDSS CSP is believed to have been improperly transmitted, sent, or utilized;

Agreement 24-3053

CDSS/TBD

6. A description of the probable causes of the improper use or disclosure;

7. Whether Civil Code sections 1798.29 or 1798.82 or any other federal or state laws requiring individual notifications of breaches are triggered; and

8. A full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the Information Security Incident and/or Breach of CDSS CSP.

F. Cost of Investigation and Remediation.

Per SAM Section 5305.8, Contractor shall be responsible for all direct and reasonable costs incurred by CDSS due to Information Security Incidents and/or Breaches of CDSS CSP resulting from Contractor’s failure to perform or from negligent acts of its personnel, and resulting in the unauthorized disclosure, release, access, review, or destruction; or loss, theft or misuse of an information asset. These costs include, but are not limited to, notice and credit monitoring for twelve (12) months for impacted individuals, CDSS staff time, material costs, postage, media announcements, and other identifiable costs associated with the Information Security Incident, Breach and/or loss of data.

VI. Contact Information.

To direct communications to the above referenced CDSS staff, Contractor shall initiate contact as indicated herein. CDSS reserves the right to make changes to the contact information below by giving written notice to Contractor. Said changes shall not require an amendment to this Exhibit or the Agreement to which it is incorporated.

CDSS Program Contract Manager

See the Scope or Statement of Work exhibit for Program Project Representative information.

CDSS Information Security & Privacy Officer

California Department of Social Services Information Security & Privacy Officer

744 P Street, MS 9-9-70 Sacramento, CA 95814 Email: iso@dss.ca.gov

Telephone: (916) 651-5558

Agreement 24-3053

CDSS/TBD

Exhibit E - Attachment 1 mailto:iso@dss.ca.gov

VIII. Audits and Inspections.

CDSS may inspect and/or monitor the Contractor’s system(s) or environment(s) if either contains, or is reasonably believed to contain, CDSS CSP in order to ensure compliance with physical or logical safeguards required in this Exhibit.

Contractor shall promptly remedy any violation of any provision of this Exhibit and shall certify the same to the CDSS Program Manager and the CDSS Information Security and Privacy Officer in writing. The fact that CDSS inspects, or fails to inspect, or has the right to inspect, does not relieve Contractor of its responsibility to comply with this Exhibit.

IX. Termination.

An Information Security Incident and/or Breach of CDSS CSP by Contractor, its employees, agents, or subcontractors, as determined by CDSS, may constitute a material breach of the Agreement between Contractor and CDSS and grounds for immediate termination of the Agreement.

Agreement 24-3053

CDSS/TBD