Exhibit F - CDHS IT Provisions Exhibit.docx

Exhibit F, Information Technology Provisions This Exhibit regarding Information Technology Provisions (the “IT Exhibit”) is an essential part of the agreement between the State and Contractor as described in the Contract to which this Exhibit is attached. Unless the context clearly requires a distinction between the Contract and this Exhibit, all references to “Contract” shall include this Exhibit. If there is language in the main body of this Contract or any other Exhibit referencing to “Force Majeure,” or anything substantially similar to Force Majeure, this IT Exhibit shall not be subject to the “Force Majeure” language. The provisions of this IT Exhibit are of vital importance to the State and the security of the State.

1. Protection of System Data A. In addition to the requirements of the main body of this Contract, if Contractor or any Subcontractor accesses the State Information Technology (defined herein) or State Records by the State or its agents in connection with Contractor’s performance under the Contract, Contractor shall protect such Information Technology resources and State Records in accordance with this IT Exhibit. All provisions of this IT Exhibit that refer to Contractor shall apply equally to any Subcontractor performing work in connection with the Contract.

B. The terms of this IT Exhibit shall apply to the extent that Contractor’s obligations under this Contract include the provision of Information Technology goods or services to the State. ”Information Technology” means:

i. Any technology, and equipment described in §24-37.5-102(2), C.R.S., and any related Work and Deliverable(s);

ii. The creation, use, processing, disclosure, transmission, or disposal of State Records, including any data or code, in electronic form; and

iii. Other existing or emerging technology, equipment, or related services that may require knowledge and expertise in Information Technology.

C. Contractor shall, and shall require its Subcontractors to meet all of the following:

i. Comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology (“OIT”), including change management, project lifecycle methodology and governance, technical standards, accessibility, documentation, and other requirements posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies.

ii. Comply with State and federal laws, rules, and regulations related to security, privacy, confidentiality, integrity, availability, auditing, and Incident Reporting.

iii. Provide that security is not compromised by unauthorized access, including but not limited to: workspaces, computers, networks, software, databases, or other physical or electronic environments.

iv. Promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the State’s Information Security Office (“ISO”).

D. Subject to Contractor’s reasonable access security requirements and upon reasonable prior notice, Contractor shall provide the State with scheduled access for the purpose of inspecting and monitoring access and use of State Records, maintaining State systems or accessing the State’s Information Technology, and evaluating physical and logical security control effectiveness.

E. Contractor shall perform current background checks in a form reasonably acceptable to the State on all of its employees and agents, including any Subcontractor and employees of Subcontractors, performing services or having access to State Records, or maintaining or accessing the State’s Information Technology, provided under this Contract. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to State Records shall be considered current.

i. Upon request, Contractor shall provide written notice to a designated representative for the State indicating that background checks have been performed. Such written notice shall inform the State of any action taken in response to such background checks, including any decisions not to take action in response to information revealed by a background check.

ii. If Contractor will have access to Federal Tax Information (“FTI”) under the Contract, Contractor shall agree to the State’s requirements regarding Safeguarding Requirements for Federal Tax Information and shall comply with the prohibitions on offshore access and the background check requirements defined in IRS Publication 1075 and §24-50-1002, C.R.S.

2. Data Handling A. Contractor may not maintain or forward State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery, without the prior written consent of the State. Contractor shall not maintain or store State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of ISO.

B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of ISO. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request.

C. Contractor agrees to not disclose State Records except only to its employees, or Subcontractors, who have a need to know the information for the purpose of satisfying the requirements of the Contract. Contractor shall not disclose State Records to any third parties, or allow any third parties to access State Record, without the prior written authorization of the State.

D. Contractor shall not access or process Federal Tax Information or Criminal Justice Information, or systems that connect to such data, from outside the United States, including accessing or processing by Contractor’s employees, agents, or Subcontractors.

E. Within 60 days following the expiration or termination of this Contract,Contractor shall make available to the State a complete download file of all State Records and data.

i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in their native format.

ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor or its agents, and the copies thereof, to the State or destroy all such State Records and certify to the State that Contractor has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor or its agents, Contractor shall provide written notice to the State and guarantee the confidentiality of all State Records provided by the State to Contractor by the State or its agents, and shall not access or actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor.

F. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State, the federal government, or the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this IT Exhibit in accordance with the terms of this Contract.

3. Delivery and Acceptance A. Contractor shall provide and maintain a quality assurance system acceptable to the State for any Work or Deliverables under this Contract and shall provide to the State only such Work or Deliverables that have been inspected and found to conform to the specifications identified in this Contract and any applicable solicitation, bid, offer, or proposal from which this Contract results.

B. Contractor’s delivery of any Work or Deliverables to the State shall constitute Contractor’s certification that such Work or Deliverable conforms to the applicable specifications, and Contractor shall make records of such quality assurance available to the State upon request during the term of the Contract or at any time within three years following expiration or termination of the Contract.

C. For any Work or Deliverables other than the purchase or license of commercially available goods or software, acceptance of the Work or Deliverable shall require affirmative written communication from the State to the Contractor that such Work or Deliverable has been accepted by the State. The State will provide communication of such acceptance or rejection within a reasonable time period from the delivery of the Work or Deliverable. Acceptance by the State shall be final, except in cases of Contractor’s failure to conduct proper quality assurance, latent defects that could not reasonably have been detected upon delivery, or Contractor’s gross negligence or willful misconduct.

4. Warranty A. Notwithstanding the acceptance of any Work or Deliverable, or the payment of any invoice for such Work or Deliverable, Contractor warrants that any Work or Deliverable provided by Contractor under this Contract shall be free from material defects and shall function in material accordance with the applicable specifications. Contractor warrants that any Work or Deliverable shall be, at the time of delivery, free from any harmful or malicious code, including without limitation viruses, malware, spyware, ransomware, or other similar function designed to interfere with or damage the normal operation of Information Technology resources. Contractor’s warranties under this section shall apply to any defects or material nonconformities discovered within 180 days following delivery of any Work or Deliverable.

B. Upon notice during the warranty term of any defect or material nonconformity, Contractor shall submit to the State in writing within 10 business days of the notice one or more recommendations for corrective action with sufficient documentation for the State to ascertain the feasibility, risks, and impacts of each recommendation. The State’s remedy for such defect or material non-conformity shall be either:

i. Contractor shall re-perform, repair, or replace such Work or Deliverable in accordance with any recommendation chosen by the State. Contractor shall deliver, at no additional cost to the State, all documentation required under the Contract as applicable to the corrected Work or Deliverable; or

ii. Contractor shall refund to the State all amounts paid for such Work or Deliverable, as well as pay to the State any additional amounts reasonably necessary for the State to procure alternative goods or services of substantially equivalent capability, function, and performance.

C. Any Work or Deliverable delivered to the State as a remedy under this section shall be subject to the same quality assurance, acceptance, and warranty requirements as the original Work or Deliverable. The duration of the warranty for any replacement or corrected Work or Deliverable shall run from the date that the State accepts, in writing, the corrected or replacement Work or Deliverable.

5. Compliance A. In addition to the compliance obligations imposed by the main body of the Contract, Contractor shall comply with:

i. All ISO policies and procedures that ISO has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501-5. These policies and procedures are posted att https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

ii. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to Contractor’s performance under the Contract. Such obligations may arise from:

a. Health Information Portability and Accountability Act (HIPAA)

b. IRS Publication 1075

c. Payment Card Industry Data Security Standard (PCI-DSS)

d. Federal Bureau of Investigation’s (FBI) Criminal Justice Information Service Security Addendum

e. Centers for Medicare & Medicaid Services (CMS) Minimum Acceptable Risk Standards for Exchanges

f. Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with The Social Security Administration B. Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor’s performance under the Contract.

C. Contractor shall allow the State access and shall provide the State with information required to assess Contractor’s compliance at the Contractor’s sole cost and expense. Such access and information shall include, at the State’s sole discretion:

i. An annual fiscal year SOC2 Type II audit including, at a minimum, the Trust Principles of Security, Confidentiality, and Availability, or an alternative audit recommended by ISO, including the performance of security audit and penetration tests, as requested by ISO.

D. To the extent Contractor controls or maintains information systems used in connection with State Records, Contractor will provide ISO with the results of all security assessment activities when conducted on such information systems, including any code-level vulnerability scans, application level risk assessments, and other security assessment activities as required by this Contract or reasonably requested by ISO. Contractor will make reasonable efforts to remediate any vulnerabilities or will request a security exception from the State. The State will work with Contractor and ISO to prepare any requests for exceptions from the security requirements described in this Contract and its Exhibits, including mitigating controls and other factors, and ISO will consider such requests in accordance with their policies and procedures referenced herein. The State shall have sole discretion for determining a security exception or requiring remediation of the vulnerability by Contractor. Contractor’s obligations under this Contract are not altered by requesting a security exception under this section, unless and to the extent the request is approved by the State.

6. Transition of Services

7. Upon request by the State and prior to expiration or termination of this Contract or of any Services provided in this Contract, Contractor shall provide reasonable and necessary assistance to accomplish a complete transition of the Services designated by the State. Contractor shall perform all services related to such transition at no additional cost.License or Use Audit Rights A. To the extent that Contractor, through this Contract or otherwise as relates to the subject matter of this Contract, has granted to the State any license or otherwise limited permission to use any Contractor Property, the terms of this section shall apply.

B. Contractor shall have the right, at any time during and throughout the Contract Term, but not more than once per Fiscal Year, to request via written notice in accordance with the notice provisions of the Contract that the State audit its use of and certify to its compliance with any applicable license or use restrictions and limitations contained in this Contract (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Contractor (“Audit Certification”) within 120 days following the State’s receipt of the Audit Request.

C. If upon receipt of the State’s Audit Certification, the Parties reasonably determine that: (i) the State’s use of licenses, use of software, use of programs, or any other use during the audit period exceeded the use restrictions and limitations contained in this Contract (“Overuse”) and (ii) the State would have been or is then required to purchase additional maintenance and/or services (“Maintenance”), Contractor shall provide written notice to the State in accordance with the notice provisions of the Contract identifying any Overuse or required Maintenance and request that the State bring its use into compliance with such use restrictions and limitations.

8. SOC 1 Type II Annual Report If Contractor performs Work for any of the State’s IT systems that impact the State’s Comprehensive Annual Financial Report as determined by the Colorado Office of the State Controller, Contractor, on an annual basis, shall deliver to the State, at Contractor’s sole cost and expense, Contractor’s System and Organization Controls 1 Type II Report (“SOC 1 Type II Report”) prepared by a qualified independent audit firm with respect to the Statement on Standards for Attestation Engagements, Reporting on Controls at a Service Organization (SSAE) as promulgated by the Auditing Standards Board of the American Institute of Certified Public Accountants, as amended, from time to time.

9. Performance Outside the State of Colorado or the United States, §24-102-206, C.R.S.

A. Performance Outside the State of Colorado To the extent not previously disclosed in accordance with §24-102-206, C.R.S., Contractor shall provide written notice to the State, in accordance with §15 and in form designated by the State, within 20 days following the earlier to occur of Contractor’s decision to perform Services outside of the State of Colorado, or its execution of an agreement with a Subcontractor to perform Services outside the State of Colorado. Such notice shall specify the type of Services to be performed outside the State of Colorado and the reason why it is necessary or advantageous to perform such Services at such location or locations, and such notice shall be a public record. Knowing failure by Contractor to provide notice to the State under this section shall constitute a Breach of this Contract. This section shall not apply if the Contract Funds include any federal funds.

B. Performance Outside of the United States Contractor shall request written approval from the State, acting through the Office of Information Technology, for Contractor to perform, or subcontract to perform, Services outside the United States. The State may approve or deny such request within the State’s sole discretion, whether or not services outside the United States are prohibited or restricted by the Statement of Work or by any Exhibit attached to this Contract. Following written approval from the State, Contractor shall comply with the notice provisions for performance outside the State of Colorado. Any notice provided to the State by Contractor regarding performance outside the United States shall be deemed ineffective if the State has not granted prior written approval for such performance.

10. Limitation of Contractor’s Liability to State The liability of Contractor, its Subcontractors, and their respective personnel to the State for any claims, liabilities, or damages relating to this Contract shall be limited to damages, including but not limited to direct losses, consequential, special, indirect, incidental, punitive or exemplary loss, loss of State Records or unauthorized disclosure of State Confidential Information, not to exceed three (3) times the Contract Maximum Amount payable by the State under this Contract or $1,000,000.00, whichever is greater. Direct damages include data losses and Incident notice and Incident remediation costs.

No limitation on Contractor's liability to the State under this Section shall limit or affect:

A. Contractor’s indemnification obligations to the State under this Contract;

B. Any claims, losses, or damages related to breach of Contractor’s security obligations under this Contract, including those for which coverage is available under any insurance required under this Contract;

C. Claims or damages arising out of bodily injury, including death, or damage to tangible property of the State; or D. Claims or damages resulting from the recklessness, bad faith, or intentional misconduct of Contractor or its Subcontractors.

E. Any provision in the contract limiting contractor’s liability shall not apply to any HIPAA Business Associate’s liability under this agreement, which shall not be limited.

Contractor is not responsible for claims based on the sole actions of State employees acting without authority or unintended uses of the program.

11. Other A. This definition of “Incident” shall control and take precedence over the definition of “Incident” set forth in the main body of the Contract: “Incident” means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, which are included as part of the Work, as described in §§24-37.5-401, et seq., C.R.S., or the discovery or reasonable suspicion that there is or may be an imminent threat or vulnerability that jeopardizes the Information Technology that may result in exploitation or exposure, or any defect or vulnerability with the potential to impact the ongoing resilience, security, and/or integrity of systems accessing State Records or the State’s Information Technology. Incidents include, without limitation, any events impacting the State’s Information Technology or State Records regardless of where such information is located, such as: unauthorized access or modification, denial of service, malware, spyware, worms, trojans, rootkits, man-in-the-middle, SQL injection, cross site scripting, ransomware, dns tunneling, password attack, email events, including business email compromise, phishing (spear or otherwise), whaling, brute force attacks, insider threats, web attacks, session hijacking, or URL interpretation.

B. In addition to the Incident Notice and Remediation terms in the body of the Contract (see subsection therein under Confidential Information-State Records), in the event that the Contractor becomes aware of any Incident, Contractor shall also provide regular, as reasonably requested, no less than weekly, videoconference, telephone, or email updates during a collaborative investigation process.

C. The subsection within Reporting – Notification of the main body of the contract regarding Performance Outside the State of Colorado or the United States is hereby supplemented to include also the following:

Performance Outside of the United States Contractor shall request written approval from the State, prior to the Effective Date, acting through the Office of Information Technology, for Contractor to perform, or subcontract to perform, Services outside the United States, including accessing State Records or the State’ Information Technology. The State may approve or deny such request within the State’s sole discretion, whether or not services outside the United States are prohibited or restricted by any Exhibit attached to this Contract. Following written approval from the State, Contractor shall comply with the notice provisions for performance outside the United States, as set forth in §24-102-206, C.R.S. Any notice provided to the State by Contractor regarding performance outside the United States shall be deemed ineffective if the State has not granted prior written approval for such performance.

Notwithstanding anything to the contrary in this Contract, Contractor shall not access or process Federal Tax Information (“FTI”) or Criminal Justice Information (“CJI”), or the State’s Information Technology that connects to such information, from outside the United States, including accessing or processing by Contractor’s employees, agents, or Subcontractors.

Page of

(V: 10/25) image1.png