EXHIBIT I - Information Technology Provisions.pdf

Exhibit I Page 1 of 5

EXHIBIT I

INFORMATION TECHNOLOGY PROVISIONS

This Exhibit regarding Information Technology Provisions (the “Exhibit”) is an essential part of the agreement between the State and Contractor as described in the Contract to which this Exhibit is attached. Unless the context clearly requires a distinction between the Contract and this Exhibit, all references to “Contract” shall include this Exhibit.

1. PROTECTION OF SYSTEM DATA

A. In addition to the requirements of the main body of this Contract, if Contractor or any Subcontractor is given access to State Records by the State or its agents in connection with Contractor’s performance under the Contract, Contractor shall protect all State Records in accordance with this Exhibit. All provisions of this Exhibit that refer to Contractor shall apply equally to any Subcontractor performing work in connection with the Contract.

B. For the avoidance of doubt, the terms of this Exhibit shall apply to the extent that any of the following statements is true in regard to Contractor access, use, or disclosure of State Records:

i. Contractor provides physical or logical storage of State Records;

ii. Contractor creates, uses, processes, discloses, transmits, or disposes of State Records;

iii. Contractor is otherwise given physical or logical access to State Records in order to perform Contractor’s obligations under this Contract.

C. Contractor shall, and shall cause its Subcontractors, to do all of the following:

i. Provide physical and logical protection for all hardware, software, applications, and data that meets or exceeds industry standards and the requirements of this Contract.

ii. Maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), annual security testing, and improvements or enhancements consistent with evolving industry standards.

iii. Comply with State and federal rules and regulations related to overall security, privacy, confidentiality, integrity, availability, and auditing.

iv. Provide that security is not compromised by unauthorized access to workspaces, computers, networks, software, databases, or other physical or electronic environments.

v. Promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the State’s Office of Information Security (“OIS”).

vi. Comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology (“OIT”), including project

Exhibit I Page 2 of 5 lifecycle methodology and governance, technical standards, documentation, and other requirements posted at www.oit.state.co.us/about/policies.

D. Subject to Contractor’s reasonable access security requirements and upon reasonable prior notice, Contractor shall provide the State with scheduled access for the purpose of inspecting and monitoring access and use of State Records, maintaining State systems, and evaluating physical and logical security control effectiveness.

E. Contractor shall perform current background checks in a form reasonably acceptable to the State on all of its respective employees and agents performing services or having access to State Records provided under this Contract, including any Subcontractors or the employees of Subcontractors. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to State Records shall be deemed to be current.

i. Contractor will provide notice to the Security and Compliance Representative for the State indicating that background checks have been performed. Such notice will inform the State of any action taken in response to such background checks, including any decisions not to take action in response to negative information revealed by a background check.

ii. If Contractor will have access to Federal Tax Information under the Contract, Contractor shall agree to the State’s requirements regarding Safeguarding Requirements for Federal Tax Information and shall comply with the background check requirements defined in IRS Publication 1075 and §24-50- 1002, C.R.S.

2. DATA HANDLING

A. The State, in its sole discretion, may securely deliver State Records directly to the facility where such data is used to perform the Work. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS.

B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request.

C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete and secure download file of all data that is encrypted and appropriately authenticated. This download file shall be made available to the State within 10 Business Days of the State’s request, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, Exhibit I Page 3 of 5 to the State or destroy all such State Records and certify to the State that it has done so.

If legislation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore.

D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time.

Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

3. COMPLIANCE

A. In addition to the compliance obligations imposed by the main body of the Contract, Contractor shall comply with:

i. All Colorado Office of Information Security (OIS) policies and procedures which OIS has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501-5 and posted at http://oit.state.co.us/ois

ii. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to Contractor’s performance under the Contract. Such obligations may arise from:

a. Health Information Portability and Accountability Act (HIPAA)

b. IRS Publication 1075

c. Payment Card Industry Data Security Standard (PCI-DSS)

d. FBI Criminal Justice Information Service Security Addendum

e. CMS Minimum Acceptable Risk Standards for Exchanges

f. Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with The Social Security Administration

B. Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor’s performance under the Contract.

C. Contractor shall allow the State reasonable access and shall provide the State with information reasonably required to assess Contractor’s compliance. Such access and information may include:

i. The performance of security audit and penetration tests, as requested by OIS or its designee at any time under this Contract;

ii. An annual SOC2 Type II audit including, at a minimum, the Trust Principles of Security, Confidentiality, and Availability, or an alternative audit recommended by OIS.

4. INTELLECTUAL PROPERTY ESCROW

Exhibit I Page 4 of 5

A. Upon request from the State and within the State’s sole discretion, Contractor shall deposit the software, documentation, and/or all other related material(s) that are part of the Work with a reputable, State-approved software escrow agent (“Escrow Agent”).

a. For the purposes of this section, software is the source code accompanied by a running object code version submitted on a virus-free magnetic or optical media, compiled and ready to be read by a computer; documentation is all materials sufficient for a trained computer programmer of general proficiency to maintain and support the software without further assistance from Contractor; and all other related material(s) is anything else related to the software or documentation necessary or required for the proper use of the same (such software, documentation and all other related material(s) hereinafter referred to collectively as the “Escrowed Software”).

b. Contractor shall also have a continuing obligation to deposit any maintenance modifications, updates, upgrades, new releases, or documentation related to the Escrowed Software for the term of the Contract.

B. Contractor shall enter into an “Escrow Agreement” with the Escrow Agent, which will instruct the Escrow Agent to independently verify the operation of Escrowed Software and cause delivery of the Escrowed Software in Contractor’s possession to the State if any one of the following events occurs:

a. Contractor agrees in writing to the delivery.

b. Contractor ceases to do business and the State has not approved a successor to assume Contractor’s obligations to the State.

c. Contractor has failed to support the Escrowed Software or has otherwise breached this Contract and has exhausted all cure periods to avoid termination for such breach.

d. Contractor files for liquidation under the U.S. Bankruptcy Code, or files for reorganization under the U.S. Bankruptcy Code and does not remain debtor in possession.

C. Contractor shall grant the appropriate license rights in the Escrow Agreement to the Escrow Agent to allow the Escrow Agent to exercise its rights under this Contract. If the Escrow Agent delivers the Escrowed Software to the State, the State shall have the same license and rights to use the Escrowed Software as the State had under this Contract, including, but not limited to, the right to utilize the source code and create updates and derivative works consistent with the purpose of this Contract.

D. All costs and fees associated with the Escrow Agreement between Contractor and the Escrow Agent for the Escrowed Software shall be the sole responsibility of Contractor.

Upon request by the State, Contractor shall provide the State with a copy of the Escrow Agreement.

5. TRANSITION OF SERVICES

Upon expiration or earlier termination of this Contract or any Services provided in this Contract, Contractor shall accomplish a complete transition of the Services from Contractor to the State or any replacement provider designated solely by the State without any interruption of or adverse impact on the Services or any other services provided by third parties in this Contract. Contractor shall cooperate fully with the State or such replacement provider and promptly take all steps required to assist in effecting a

Exhibit I Page 5 of 5 complete transition of the Services designated by the State. All services related to such transition shall be performed at no additional cost beyond what would be paid for the Services in this Contract.

6. LICENSE OR USE AUDIT RIGHTS

A. Contractor shall have the right, at any time during and throughout the Contract Term, but not more than once per Fiscal Year, to request via written notice in accordance with the notice provisions of the Contract that the State audit its use of and certify as to its compliance with any applicable license or use restrictions and limitations contained in this Contract (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Contractor (“Audit Certification”) within 120 days following the State’s receipt of the Audit Request.

B. If upon receipt of the State’s Audit Certification, the Parties reasonably determine that:

(i) the State’s use of licenses, use of software, use of programs, or any other use during the audit period exceeded the use restrictions and limitations contained in this Contract (“Overuse”) and (ii) the State would have been or is then required to purchase additional maintenance and/or services (“Maintenance”), Contractor shall provide written notice to the State in accordance with the notice provisions of the Contract identifying any Overuse or required Maintenance and request that the State bring its use into compliance with such use restrictions and limitations.

C. Notwithstanding anything to the contrary in this Contract, or incorporated as a part of Contractor’s or any Subcontractor’s website, click-through or online agreements, third-party agreements, or any other documents or agreements between the Parties, the State shall not be liable for the costs associated with any Overuse or Maintenance, regardless of whether the State may have been notified in advance of such costs.