Exhibit E - IT Provisions.pdf

Exhibit E 1

Exhibit E - Information Technology Provisions

This exhibit regarding Information Technology Provisions (“IT Exhibit”) is an essential part of the agreement between the State and Contractor as described in the Contract to which this IT Exhibit is attached. Unless the context clearly requires a distinction between the Contract and this IT

Exhibit, all references to “Contract” shall include this IT Exhibit. If there is language in the main body of this Contract or any other Exhibit referencing “Force Majeure,” or anything substantially similar to Force Majeure, this IT Exhibit shall not be subject to the “Force Majeure” language. The provisions of this IT Exhibit are of vital importance to the State and the security of the State.

1. Protection of System Data

A. In addition to the requirements of the main body of this Contract, if Contractor or any

Subcontractor accesses the State’s Information Technology (defined below) or State

Records by the State or its agents in connection with Contractor’s performance under the

Contract, Contractor shall protect such Information Technology resources and State

Records in accordance with this IT Exhibit. All provisions of this IT Exhibit that refer to

Contractor shall apply equally to any Subcontractor performing work in connection with the Contract.

B. The terms of this IT Exhibit shall apply to the extent that Contractor’s obligations under this Contract include the provision of Information Technology goods or services to the

State. “Information Technology” means:

i. Any technology and equipment described in §24-37.5-102(2), C.R.S., and any related

Work or Deliverable(s);

ii. The creation, use, processing, disclosure, transmission, or disposal of State Records, including any data or code, in electronic form; and

iii. Other existing or emerging technology, equipment, or related services that may require knowledge and expertise in Information Technology.

C. Contractor shall, and shall require its Subcontractors to meet all of the following:

i. Comply with all rules, policies, procedures, and standards issued by the Governor’s

Office of Information Technology (“OIT”), including change management, project lifecycle methodology and governance, technical standards, accessibility, documentation, and other requirements posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies.

https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

Exhibit E 2

ii. Comply with State and federal laws, rules, and regulations related to security, privacy, confidentiality, integrity, availability, auditing, and Incident Reporting.

iii. Provide that security is not compromised by unauthorized access, including but not limited to: workspaces, computers, networks, software, databases, or other physical or electronic environments.

iv. Promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the State’s

Information Security Office (“ISO”).

D. Subject to Contractor’s reasonable access security requirements and upon reasonable prior notice, Contractor shall provide the State with scheduled access for the purpose of inspecting and monitoring access and use of State Records, maintaining or accessing the

State’s Information Technology, and evaluating physical and logical security control effectiveness.

E. Contractor shall perform current background checks in a form reasonably acceptable to the State on all of its employees and agents, including any Subcontractors and employees of Subcontractors, performing services or having access to State Records, or maintaining or accessing the State’s Information Technology, provided under this Contracts. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to State Records shall be considered current.

i. Upon request, Contractor shall provide written notice to a designated representative for the State indicating that background checks have been performed. Such written notice shall inform the State of any action taken in response to such background checks, including any decisions not to take action in response to information revealed by a background check.

ii. If Contractor will have access to Federal Tax Information (“FTI”) under the

Contract, Contractor shall agree to the State’s requirements regarding Safeguarding

Requirements for Federal Tax Information and shall comply with the prohibitions on offshore access and the background check requirements defined in IRS Publication

1075 and §24-50-1002, C.R.S.

2. Data Handling

Exhibit E 3

A. Contractor may not maintain or forward State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery, without the prior written consent of the State. Contractor shall not maintain or store State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of ISO.

B. Contractor agrees to not disclose State Records except only to its employees, or

Subcontractors, who have a need to know the information for the purpose of satisfying the requirements of the Contract. Contractor shall not disclose State Records to any third parties, or allow any third parties to access State Record, without the prior written authorization of the State.

C. Contractor shall not access or process Federal Tax Information or Criminal Justice

Information, or systems that connect to such data, from outside the United States, including accessing or processing by Contractor’s employees, agents, or Subcontractors.

D. Within 60 days following the expiration or termination of this Contract, and upon request by the State, Contractor shall make available to the State a complete download file of all

State Records.

i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema as well as transformation definitions, or delimited text files with documents, and detailed schema definitions along with attachments in their native format.

ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided to

Contractor by the State or its agents, and the copies thereof, to the State or destroy all such State Records and certify to the State that Contractor has done so.

If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided to Contractor by the State or its agents, Contractor shall provide written notice to the State and guarantee the confidentiality of all State Records provided to Contractor by the State or its agents and shall not access or actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor.

Exhibit E 4

E. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State, the federal government, or the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this IT Exhibit in accordance with the terms of this Contract.

3. Delivery and Acceptance

A. Contractor shall provide and maintain a quality assurance system acceptable to the State for any Work or Deliverables under this Contract and shall provide to the State only such

Work or Deliverables that have been inspected and found to conform to the specifications identified in this Contract and any applicable solicitation, bid, offer, or proposal from which this Contract results.

B. Contractor’s delivery of any Work or Deliverables to the State shall constitute

Contractor’s certification that such Work or Deliverable conforms to the applicable specifications, and Contractor shall make records of such quality assurance available to the State upon request during the term of the Contract or at any time within three years following expiration or termination of the Contract.

C. For any Work or Deliverables other than the purchase or license of commercially available goods or software, acceptance of the Work or Deliverable shall require affirmative written communication from the State to the Contractor that such Work or

Deliverable has been accepted by the State. The state will provide communication of such acceptance or rejection within a reasonable time period after the delivery of the

Work or Deliverable. Acceptance by the State shall be final, except in cases of

Contractor’s failure to conduct proper quality assurance, latent defects that could not reasonably have been detected upon delivery, or Contractor’s gross negligence or willful misconduct.

4. Warranty

Notwithstanding the acceptance of any Work or Deliverable, or the payment of any invoice for such Work or Deliverable, Contractor warrants that any Work or Deliverable provided by

Contractor under this Contract shall be free from material defects and shall function in material accordance with the applicable specifications. Contractor warrants that any

Work or Deliverable shall be, at the time of delivery, free from any harmful or malicious code, including without limitation viruses, malware, spyware, ransomware, or other

Exhibit E 5 similar function designed to interfere with or damage the normal operation of

Information Technology resources. Contractor’s warranties under this section shall apply to any defects or material nonconformities discovered within 180 days following delivery of any Work or Deliverable.

Upon notice during the warranty term of any defect or material nonconformity, Contractor shall submit to the State in writing within 10 Business Days of the notice one or more recommendations for corrective action with sufficient documentation for the State to ascertain the feasibility, risks, and impacts of each recommendation. The State’s remedy for such defect or material non-conformity shall be either:

Contractor shall re-perform, repair, or replace such Work or Deliverable in accordance with any recommendation chosen by the State. Contractor shall deliver, at no additional cost to the State, all documentation required under the Contract as applicable to the corrected Work or Deliverable; or

Contractor shall refund to the State all amounts paid for such Work or Deliverable, as well as pay to the State any additional amounts reasonably necessary for the State to procure alternative goods or services of substantially equivalent capability, function, and performance.

Any Work or Deliverable delivered to the State as a remedy under this section shall be subject to the same quality assurance, acceptance, and warranty requirements as the original

Work or Deliverable. The duration of the warranty for any replacement or corrected

Work or Deliverable shall run from the date that the State accepts, in writing, the corrected or replacement Work or Deliverable.

5. Compliance

In addition to the compliance obligations imposed by the main body of the Contract, Contractor shall comply with:

A. All ISO policies and procedures that ISO has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501-5. These policies and procedures are posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

B. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on

Exhibit E 6 the classification of the data relevant to Contractor’s performance under the Contract.

Such obligations may arise from:

i. Health Information Portability and Accountability Act

ii. IRS Publication 1075

iii. Payment Card Industry Data Security Standard

iv. Federal Bureau of Investigation’s Criminal Justice Information Service Security

Addendum

v. Centers for Medicare & Medicaid Services Minimum Acceptable Risk Standards for

Exchanges

vi. Electronic Information Exchange Security Requirements and Procedures For State and Local Agencies Exchanging Electronic Information With The Social Security

Administration

C. Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor’s performance under the

Contract.

D. Contractor shall allow the State access and shall provide the State with information required to assess Contractor’s compliance, at the Contractor’s sole cost and expense.

Such access and information shall include, at the State’s sole discretion:

i. An annual fiscal year SOC2 Type II audit including, at a minimum, the Trust

Principles of Security, Confidentiality, and Availability, or an alternative audit recommended by ISO, including the performance of security audit and penetration tests, as requested by ISO.

E. To the extent Contractor controls or maintains information systems used in connection with State Records, Contractor shall provide ISO with the results of all security assessment activities when conducted on such information systems, including any code-level vulnerability scans, application level risk assessments, and other security assessment activities as required by the Contract or reasonably requested by ISO.

Contractor shall make reasonable efforts to remediate any vulnerabilities or shall request a security exception from the State. The State will work with Contractor and ISO to

Exhibit E 7 prepare any requests for exceptions from the security requirements described in this

Contract and its Exhibits, including mitigating controls and other factors, and ISO will consider such requests in accordance with their policies and procedures referenced herein. The State shall have sole discretion for determining a security exception or requiring remediation of the vulnerability by Contractor. Contractor’s obligations under this Contract are not altered by requesting a security exception under this section, unless and to the extent the request is approved by the State.

6. Transition of Services

Upon request by the State and prior to expiration or termination of this Contract or of any

Services provided in this Contract, Contractor shall provide reasonable and necessary assistance to accomplish a complete transition of the Services designated by the State.

Contractor shall perform all services related to such transition at no additional cost.

7. License or use audit rights

A. To the extent that Contractor, through this Contract or otherwise as relates to the subject matter of this Contract, has granted to the State any license or otherwise limited permission to use any Contractor Property, the terms of this section shall apply.

B. Contractor shall have the right, at any time during and throughout the Contract Term, but not more than once per Fiscal Year, to request via written notice in accordance with the notice provisions of the Contract that the State audit its use of and certify to its compliance with any applicable license or use restrictions and limitations contained in this Contract (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to

Contractor (“Audit Certification”) within 120 days following the State’s receipt of the

Audit Request.

C. If upon receipt of the State’s Audit Certification, the Parties reasonably determine that:

(i) the State’s use of licenses, use of software, use of programs, or any other use during the audit period exceeded the use restrictions and limitations contained in this Contract

(“Overuse”); and (ii) the State would have been or is then required to purchase additional maintenance and/or services (“Maintenance”), Contractor shall provide written notice to the State in accordance with the notice provisions of the Contract

Exhibit E 8 identifying any Overuse or required Maintenance and request that the State bring its use into compliance with such use restrictions and limitations.