FDLE-ITS-RFI-2643.pdf

FLORIDA DEPARTMENT

OF

LAW ENFORCEMENT

Request for Information

FDLE-RFI-2643

Computerized Criminal History and CJIS Data Collections

Systems

April 30, 2026

1. Introduction

The Florida Department of Law Enforcement (FDLE), Information Technology Services Division is requesting pre-procurement information on Computerized Criminal History (CCH) and Data Collections Systems via this Request for Information (RFI).

2. Purpose

Pursuant to Rule 60A-1.042, Florida Administrative Code (F.A.C.), an agency may request information by issuing a written Request for Information. Agencies may use an RFI in circumstances including, but not limited to, determining whether or not to competitively procure a commodity or contractual services, determining what solicitation process to use for a particular need, or researching general, special, and/or technical specifications for a solicitation. A Vendor’s response to an RFI is not an offer and the agency may not use the Vendor’s submission to justify a contract with that Vendor. There will be no award of a contract through the RFI process. Vendors submitting a response to an agency’s RFI are not prohibited from responding to any related subsequent solicitation.

3. Requested Information

Please respond to the following statements, using this document as the basis for your responses. Ensure that your responses are submitted according to the requirements listed in Section 10, Response Instructions and Format.

a. Does your company have a system or systems that can meet the needs of the CCH and/or Data Collections Systems as described in this document? If yes, please briefly describe the system(s) and why they would meet the needs of CCH and/or Data Collections Systems.

b. Describe how your system(s) scale and adapt to accommodate changes to legislation, increased capacity needs, and other necessary changes.

c. Describe whether your system(s) incorporate the requested elements described in Section 7, Scope of Work. You may highlight or clarify any items as needed to communicate the extent to which your system(s) fulfil those requested elements.

d. Describe whether your system(s) incorporate the requested elements described in Section 8, Non-Functional Requirements. You may highlight or clarify any items as needed to communicate the extent to which your system(s) fulfil those requested elements.

e. Describe whether your system(s) incorporate the requested elements described in Section 9, Security Requirements, as well as those listed in Appendix A. You may highlight or clarify any items as needed to communicate the extent to which your system(s) fulfil those requested elements.

f. Provide information on any features of your system(s) not covered by Sections 7-9 that you feel would be of value to FDLE in relation to Computerized Criminal History (CCH) and/or Data Collections.

4. Background

FDLE and the Criminal Justice Information Services (CJIS) division serve as the central repository for the state’s criminal history records. CJIS offers background screening services to criminal justice and non-criminal justice agencies, as well as private citizens, to identify individuals with criminal warrants, arrests, and convictions that may impact employment, licensing, firearm purchase eligibility, and various criminal justice functions. Additionally, CJIS compiles and provides crime statistics, such as the Uniform Crime Report (UCR) and the Hate Crime data from local law enforcement agencies, for policymakers and the public.

CJIS ensures data quality and plays a significant role in developing policies for the national sharing of criminal justice information with the FBI and other states. In doing so, CJIS supports efforts to prevent crime, solve cases, recover property, identify and apprehend criminals, and offers statistical and analytical crime data to policymakers, contributing to transparency for the public.

There is an express need for FDLE to modernize its current Computerized Criminal History and Criminal Justice Information Services (CJIS) Data Collections Systems.

Additional information about FDLE can be found on the agency’s website. https://www.fdle.state.fl.us/

Computerized Criminal History (CCH) Florida’s Computerized Criminal History (CCH) system is a fingerprint-based repository that collects electronic arrest and disposition data from law enforcement and criminal justice agencies across the state as mandated by Florida Statute §943.05 and Chapter 11C, Florida Administrative Code (F.A.C.). CCH contains records on more than 7.8 million subjects arrested by Florida law enforcement agencies. On average, FDLE receives approximately 500,000 arrest records from Florida law enforcement agencies annually. This repository is the 3rd largest criminal history system nationwide. CCH contains personal identity information (PII) such as name, date of birth, address, social security number; criminal history related data such as arrest, charges, and dispositions; and registration, correction, pardon, and deceased events. Criminal history record events are generated from fingerprint-based transactions from FDLE’s near real-time Multi-Biometric Identification System (MBIS). CCH can create, update, and in some unique cases, delete records while performing a maintenance or other function. CCH is a mission-critical system for FDLE and must have a 24x7x365 uptime due to the nature of its data. The CCH system largely stands alone from Data Collections.

Data Collections The Florida Legislature charged FDLE with the responsibility of creating standard data reporting guidelines for various sets of criminal justice data. Criminal Justice Data Transparency (CJDT) and the Uniform Arrest Affidavit (UAA) are Florida-specific initiatives while the Florida Incident Based Reporting System (FIBRS) is both state and federal. The FDLE CJIS Portal (CJIS Portal) acts as a staging area to integrate and transform received data including but not limited to arrest, offense, prosecuting, detention information to CJDT, FIBRS, and UAA databases. Data Collections are hosted within the State’s Azure Government Cloud tenant.

Contributing law enforcement agencies submit their data via the CJIS Portal based on the FDLE Information Exchange Package Documentation (IEPDs). The purpose of the CJIS Portal is to collect and respond to the contributing agencies with success or error responses. Contributing agencies send a submission based on either the CJAdmin IEPD or FDLE IEPD. The contributor can submit a National Information Exchange Model (NIEM) Extensible Markup Language (XML) file based on the current schema or the prior two versions. The CJIS Portal sends the data to each respective Data Collections repository or system based on schema. All changes to Data Collections tables require a change to IEPD schema, which can be both costly and time-consuming.

Criminal Justice Data Transparency (CJDT) - The Florida Legislature created Florida Statutes §900.05 and §943.6871 that establish a framework for an expanded criminal justice data collection and sharing that became known as a Criminal Justice Data Transparency (CJDT) https://www.fdle.state.fl.us/ initiative. The goal of the CJDT initiative is to increase public visibility of criminal justice processes throughout the state and to provide policymakers with the information they need to make informed policy decisions. The data is collected from seven contributing agency groups: Clerks of Court, County Detention Facilities, Florida Department of Corrections, Justice Administrative Commission, Public Defender Offices, Regional Conflict Counsel, State Attorney Offices. As a part of this initiative, FDLE is collecting person-based data for each individual contact with the criminal justice system including but not limited to arrests, prosecutions, or incarcerations. The data available to the public does not include any PII. In addition to criminal justice data, there are administrative reports such as workload, staffing, and cost of the business.

Florida Incident Based Reporting System (FIBRS) – FDLE began Uniform Crime Report (UCR) Program data collection and dissemination in 1971. Today, UCR captures Use of Force (UoF) data as mandated in §943.6872, Hate crime data as mandated in §877.19, Human Trafficking Standards as mandated in §1004.343, and produces publications as mandated in §943.05. UCR also provides standardized reports on hate crimes, domestic violence, human trafficking, cargo theft, arrest, and other crime statistics for the State of Florida. Following the 2020 collection cycle, FDLE changed from Summary-Based reporting to Incident-Based Reporting as mandated by the FBI. The incident-based reporting standard is nationally known as National Incident-Based Reporting System (NIBRS). The Florida collection that supports NIBRS and Florida specific data is the Florida Incident-Based Reporting System (FIBRS). FIBRS provides a mechanism to consolidate the data collection processes for NIBRS, the National UoF data collection, and Florida specific data elements from various law enforcement agencies to study multi-jurisdictional patterns and trends. The data collected for FIBRS supports the annual UCR reports and Law Enforcement Officer Killed or Assaulted (LEOKA) reporting.

Uniform Arrest Affidavit (UAA) – Per Florida Statue §943.6871(10), the Florida Legislature established the Uniform Arrest Affidavit (UAA) initiative to address inconsistencies and inefficiencies in the collection and reporting of arrest affidavit data in Florida. By standardizing the data, the goal is to obtain complete, accurate, and timely collection of the data for ease of use and transfer across the agencies. The UAA, at a minimum, must include the identification of the arrestee (including juveniles), details of the arrest (including each charge), details of each vehicle and item seized at the time of arrest, and release information.

5. Statement of Need and Technical Information

FDLE’s primary objective is to seek information from experienced vendors to explore robust and scalable secure SaaS solution(s) to modernize the current CCH and Data Collections Systems. FDLE seeks solution(s) that enhance data analysis, reduce duplication of effort, improve the use of automated workflows for data validation and correction, and support the needs of our law enforcement partners, making reporting and data collections processes more seamless.

FDLE would like to explore the following:

• Service options which promote the delivery of high-quality CCH and Data collections solutions.

• A vendor-hosted SaaS solution that includes vendor-managed services for hosting, security, and infrastructure, as well as custom configuration/development, as defined in the Scope of Work.

6. Definitions

Organization / People: Focuses on the structure, roles, responsibilities, and skills required within the organization to effectively implement and support the future state system.

Time, Process, Cost: Encompasses the timeline for implementation, the processes involved in transitioning to the future state, financial savings that can be achieved.

Technology and Tools: Includes the core functions and features needed, the quality and management of data, the technology infrastructure, and the tools required to support the future state system.

Ongoing Operational Support: Refers to the resources, procedures, and mechanisms that will ensure the continuous and efficient operation and maintenance of the system after implementation.

Security and Governance: Includes policies, practices, and controls to protect data integrity, privacy, and compliance with regulations, ensuring the system is secure and trustworthy.

Vision and Strategy: Defines the overarching goals, aspirations, and strategic direction guiding the development and deployment of the future state system.

7. Scope of Work

FDLE is seeking a vendor(s) that can provide and maintain essential software products for system operation for the duration of the contract.

7.1. Solution Capabilities - Shared

a. Security & Governance

• Provide Multi-Factor Authentication (MFA) – Single Sign on (SSO).

• The solution should provide the ability to assign user groups and roles to a user.

• The solution should provide the ability to allow FDLE administrator(s) to grant or restrict user access.

b. Vision & Strategy

• Utilize AI Ad-HOC reporting.

o AI hosted within a dedicated environment that ensures all Department data remains segregated and is not exposed to or utilized by any public or multi-tenant AI services.

o Department data will not be used for training or improving any external or generalized AI models.

c. Technology and Tools

• Provide error queue integration for data correction.

• Provide 24/7/365 access to the system for all users and contributors, with exceptions made for mutually agreed upon maintenance windows.

7.2. Solution Capabilities - CCH

a. Organization/People

• Provide enhanced productivity metrics for management.

b. Time, Process, Cost

• Have data correction and cleansing capability prior to system migration.

• Have the ability to see batch submission status and errors for internal and external users.

• Provide FDLE with the capability to make workflow changes to correspondence without vendor involvement.

• Provide the capability to make form changes in UI (1500 users agency and internal).

c. Ongoing Operational Support

• Provide workflow capabilities (ability to work on defects and enhancements simultaneously).

• Have the log tracking capability and notifications of system errors in a dashboard with active vendor monitoring.

• Have proactive system monitoring and messaging.

d. Technology and Tools

• Have data reporting capabilities.

• Have consistent data management for new and legacy records.

• Have a unified reporting platform.

• Be hosted in a GovCloud (FDLE’s preference) or another cloud provider that can comply with the FBI CJIS Security Policy.

e. Vision & Strategy

• Should not be reliant on other FDLE applications or infrastructure, except as data sources

(ex: MBIS)

• Have customer-facing direct integration (web form that can marry multiple types of information (ex. fingerprint, payment info) and eliminate the need for customers to complete manual intake forms.

7.3. Solution Capabilities - Data Collections

a. Organization/People

• Minimize impact on the end user and optimize the end user experience.

• Should provide enhanced training options/processes.

b. Time, Process, Cost

• Provide improved cost efficiency (a SaaS solution should remove the need for FDLE to purchase and manage additional/separate hardware, software, and licensing).

c. Security & Governance

• Remain in NIEM & Uniform Standards in all Data Collections.

• Establish a data retention policy.

d. Technology and Tools

• Simplify the IEPD creation process and create a robust method for technical documentation.

• Build funding timelines/cycles for the IEPD process as a dependency.

e. Ongoing Operational Support

• Provide a mechanism for system performance reporting.

8. Non-Functional Requirements (Applies to both CCH and Data Projects)

8.1. Contractor Responsibilities

a. Staffing

• Provide a dedicated team of experts to manage the deployment and support the solution.

• Assign and maintain staff qualified and experienced in operating and maintaining the system.

• Ensure availability of staff during FDLE business hours (M-F 8:00 am-6:00 pm Eastern Time).

• Maintain an adequate administrative organizational structure to support staff.

• Ensure staff have necessary education and experience.

• Allow FDLE to approve and replace contractor and subcontractor staff if necessary.

• Provide project management services.

• Operate and maintain the system for 24/7/365 availability.

• Identify opportunities for improving business processes and workflows.

• Provide feedback and recommend resolutions for testing issues and defects.

b. Other Responsibilities

• Respond to and resolve documented incidents or problems, including assignment and escalation to third-party Contractors.

• Provide maintenance and support services for the system.

• Provide 24/7/365 monitoring of system availability.

9. Security Requirements

The Florida Department of Law Enforcement’s information technology resources, data, and information are valuable assets. The confidentiality, integrity, and availability of those resources must be protected. Contractors providing products and/or services to FDLE must ensure that data and information resources are reliable and available only to those who are authorized to use them.

Describe how the solution incorporates data security best practices and standards.

Applicable requirements are:

☒ Federal Law and Policy

☒ FBI CJIS Security Policy – Security Controls to protect criminal justice information.

☒ State Law and Rules ☒ Chapter 119, FS - Public Records ☒ Section 282.318, FS - Security of data and information technology ☒ Section 501.171, FS - Security of confidential personal information ☒ Rule 60GG-2, FAC - Information Technology Security ☒ Rule 60GG-4, FAC - Cloud Computing

See Appendix A, Florida Department of Law Enforcement (FDLE) INFORMATION SYSTEMS SECURITY ADDENDUM, for more details regarding these requirements.

10. Response Instructions and Format

Please submit one electronic copy, via email, to the Procurement Officer noted in Section 16 below, no later than the time and date noted in Section 12., Timeline. Responses must reference the RFI No.: FDLE- RFI-2643 in the subject line of the response submission.

The Vendor shall organize their response submittal contents as follows:

Tab 1 Introduction

Tab 2 Requested Information and Responses

Tab 3 Sample Pricing Information for budgetary purposes only

Tab 4 Additional Information e.g., added value items

In response to this RFI, and addressing the items identified in the Scope of Work, please provide the following information:

TAB 1 – Introduction

Please provide an introduction via cover letter, including primary point of contact information (i.e.

name, title, business address, telephone and fax numbers, and business e-mail address) and a clear indication of the section(s) to which the RFI response is directed, i.e.: Section 7: SCOPE OF

WORK

TAB 2 – Requested Information and Responses (Please reprint each request with your response)

The FDLE’s intent is to identify potential vendors that can fulfill the solution capabilities and security requirements provided in Sections 7-9. Vendors should address all solution capabilities and security requirements identified in this RFI. Include any licensing and software agreement terms and conditions. All vendor RFI responses should be clear, concise, and generally no more than 50 pages in length.

TAB 3 – Sample Pricing Information

PLEASE DO NOT PROVIDE A SPECIFIC PRICE QUOTE. To preserve your ability to bid on a future procurement related to this RFI it is important to provide general pricing information only (i.e., competitive ranges and variables impacting price; not a specific price quote.)

TAB 4 – Additional Information

Provide additional information Vendor believes will be helpful in evaluating whether and how to contract with an exceptional service provider.

11. PROCESS

Responses to this RFI will be reviewed by the FDLE for informational purposes only. A Vendor’s response to this RFI is not an offer and FDLE will not use the Vendor’s submission to justify a contract with that Vendor without otherwise complying with Chapter 287, F.S., and Chapter 60A-1, F.A.C.

The Information Technology Services Division is requesting information, and will review the responses received from this RFI, for purposes including, but not limited to, determining whether or not to competitively procure a solution, determining what solicitation process to use for a particular need, or researching general, special, and/or technical specifications for a solicitation.

FDLE may hold information exchange meetings with selected vendors to discuss their proposed solutions. These meetings may include demonstrations of the product(s) described in the responses.

12. DISCLAIMER

The FDLE will review all vendor RFI responses for informational purposes only. A vendor’s RFI response is not an invitation to negotiate or offer to contract, and the FDLE will not use a vendor’s RFI response as the sole justification for any subsequent negotiation or contractual relationship with a vendor outside strict compliance with Chapter 287, Florida Statutes, and Chapter 60A-1, Florida Administrative Code.

Responses to this RFI will not be returned to the vendor, and all vendor RFI responses are subject to Florida’s public records law.

13. TIMELINE/SCHEDULE OF EVENTS

The dates and times listed below identify when actions are required by the FDLE or the Vendor, as applicable. FDLE reserves the right to modify or cancel any listed dates or times as necessary and will provide notice of any changes to all responsive Vendors via addendum on the Vendor Information Portal.

All times listed are in Eastern Time (ET), Tallahassee, Florida.

DATE TIME ACTION

April 30, 2026 9:00 AM ET RFI Disseminated to Vendors

May 13, 2026 5:00 PM ET Vendor Questions Due

May 27, 2026 5:00 PM ET FDLE Posts Reponses to Questions (anticipated)

June 10, 2026 12:00 PM ET Vendor RFI Responses Due

TBD TBD Information Exchange Meetings (optional)

14. CONTACT WITH THE STATE

Please direct any questions or issues regarding this RFI to the Procurement Officer identified herein.

The FDLE will post any amendments to the RFI on the Vendor Information Portal (VIP) at MyFloridaMarket Place Vendor Information Portal Each Respondent is responsible for monitoring the VIP for new or changing information.

15. VENDOR COSTS AND EXPENSES

Vendors are responsible for all costs associated with the preparation, submission, and any potential meeting to discuss this RFI. The State of Florida, particularly the Department of Law Enforcement, will not be responsible for any vendor-related costs associated with responding to this request.

16. FLORIDA PUBLIC RECORDS AND CONFIDENTIAL, PROPRIETARY, OR TRADE SECRET INFORMATION

The FDLE strictly adheres to its legal obligations under Chapter 119, Florida Statutes, and Article I, Section 24 of the Florida Constitution. If a vendor considers any part of its MMR response to be confidential, proprietary, or trade secret, and therefore exempt from public disclosure, then that vendor must also submit a separate, redacted electronic copy of its RFI response to the FDLE via e-mail attachment to the Procurement Officer listed in Section 16. The redacted copy must briefly describe both the factual and legal grounds for the vendor’s claimed exemption from public records disclosure under Florida law, including specific statutory references, and be marked “Redacted Copy” on its cover sheet.

The redacted copy must be provided to the FDLE simultaneously with the vendor’s RFI response and must exclude only those portions claimed as confidential, proprietary, or trade secret. The vendor is solely responsible for all legal costs or expenses incurred in defending its determination that its RFI redactions Any Reply content submitted to the Department which is asserted to be exempted by law from disclosure as a public record shall be clearly marked “exempt,” “confidential,” or “trade secret” (as applicable), with the statutory basis for such claim of exemption specifically identified in writing on each and every such page. Failure to segregate and to clearly identify any such content shall constitute a waiver of any claimed exemption as applied to the portion of the Reply or other document in which the content is set forth.

An entire page or paragraph in which such information appears should not be marked “exempt”, “confidential” or “trade secret” unless the entire page or paragraph consists of such confidential information. Only the confidential portions(s) should be identified and marked. Respondents are to indicate where confidential information begins and ends.

Any claim of exemption from public disclosure is waived upon submission, unless addressed as set forth above. The Department will attempt to afford protection from disclosure of any trade secret as defined in Section 812.081(1)(f), F.S., or Section 688.002(4), F.S., where identified as such in the Reply, to the extent permitted under Section 815.045, F.S., and Chapter 119, F.S. Each Respondent acknowledges that the protection afforded by Section 815.045, F.S., is incomplete, and hereby agrees that no remedy for damages may arise from any disclosure by the Department.

It will be the responsibility of the Respondent to defend the confidentiality of its trade secrets through the judicial process.

https://vendor.myfloridamarketplace.com/ https://vendor.myfloridamarketplace.com/

The Department takes its public records responsibilities under Chapter 119, F.S., and Article I, Section 24 of the Florida Constitution very seriously. If a Respondent considers any portion of the documents, data, or record submitted in response to this solicitation to be exempted by law from disclosure as a public record, the Respondent must also provide the Department with a separate Redacted Copy of its Reply, at the time of Reply submission in accordance with Section 10 of this RFI.

This Redacted Copy should contain the Department’s solicitation name, number, and the name of the Respondent on the cover and should be clearly titled “Redacted Copy.” The Redacted Copy must be provided to the Department at the same time the Respondent submits its Reply and must only exclude or obliterate those exact portions which are exempted by law from public disclosure.

If a Respondent fails to submit a Redacted Copy with its Reply as described herein, THE DEPARTMENT is authorized to produce the entire document(s), data or records submitted by the Respondent in answer to a public records request.

The State of Florida does not consider Price to be confidential.

17. PROCUREMENT OFFICER

The Procurement Officer is the sole point of contact for this RFI. Direct all contact with the Department to the Procurement Officer in writing by email.

Angela Githens General Services/ Business Unit 2331 Phillips Road Tallahassee, Florida 32308

Telephone No.: (850) 410-7300 Fax No.: (850) 410-7333 E-mail: FDLEOGSCONTRACTS@fdle.state.fl.us

This contact person is the only authorized individual to respond to RFI comments and questions.

***PLACE THE RFI NUMBER IN THE SUBJECT LINE OF ALL EMAILS TO THE PROCUREMENT OFFICER*** If a Respondent claims that any portion of an email is trade secret under Section 812.081, F.S., or otherwise confidential under Florida or Federal Law, the Respondent is to place the word “Confidential” in the subject line. (See also Section 10 of this RFI for more information on confidential information.)

mailto:FDLEOGSCONTRACTS@fdle.state.fl.us

APPENDIX A

Florida Department of Law Enforcement (FDLE)

INFORMATION SYSTEMS SECURITY ADDENDUM

The Florida Department of Law Enforcement’s information technology resources, data, and information are valuable assets. The confidentiality, integrity, and availability of those resources must be protected.

Contractors providing products and/or services to FDLE must ensure that data and information resources are reliable and available to those who are authorized to use them.

The purposes of this FDLE Information Security Addendum are to:

● Maintain a security program consistent with all applicable federal and state laws, regulations, agency policies, and standards relevant to the procurement and associated the Statement of Work.

● Document a framework of information security best practices for Contractors in order to safeguard the confidentiality, integrity, and availability of FDLE’s data and information technology resources.

● Define minimum standards to be used by Contractors to provide appropriate levels of information security.

● Define minimum management, operational and technical security controls to be used by

Contractors to secure information and information technology resources.

These information security requirements apply equally to all levels of Contractor staff assigned to deliver products and/or services specified in this Agreement.

1.00 Definitions

1.01 Administration of criminal justice - the detection, apprehension, detention, pretrial release, post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. It also includes criminal identification activities; the collection, storage, and dissemination of criminal history record information; and criminal justice employment.

1.02 Agency Coordinator (AC) - a member of FDLE, who manages the agreement between the Contractor and agency.

1.03 Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.

1.04 Contractor Security Officer (CSO) – an individual designated by the Contractor to administer the Contractor’s security program as it pertains to this contract.

1.05 Information Security Manager (ISM) – a member of FDLE, designated by the agency head, to administer FDLE’s information security program.

2.00 Responsibilities of FDLE

2.01 FDLE shall appoint an AC.

2.02 The AC has the following responsibilities:

a. Understand the communications and records capabilities and needs of the Contractor which is accessing federal and state records through or because of its relationship with

FDLE;

b. Participate in related meetings and provide input and comments for system improvement;

c. Receive information and disseminate it to appropriate Contractor employees;

d. Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor;

e. Maintain up-to-date records of employees of the Contractor who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued, and date initially trained, tested, certified or recertified (if applicable);

f. Train or ensure the training of Contractor personnel. If Contractor personnel access the Florida Crime Information Center (FCIC) System, schedule the operators for testing or a certification exam. Schedule new operators for the certification exam within six (6) months of employment. Schedule certified operators for recertification testing within thirty (30) days prior to the expiration of certification. Schedule operators for any other mandated class;

g. The AC shall not permit an untrained/untested or non-certified employee of the Contractor to access FDLE information systems;

h. Where appropriate, ensure compliance by the Contractor with Criminal Justice Information System (CJIS) security requirements; and

i. Ensure that Contractor staff undergo background investigations prior to accessing FDLE information systems.

3.00 Responsibilities of the Contractor

3.01 The Contractor shall maintain a security program which meets the requirements of this Security Addendum.

3.02 The Contractor shall assign a Contractor Security Officer (CSO) accountable for the management of this security program. This person shall coordinate with the AC and ISM to establish the Contractor’s security program.

3.03 The Contractor shall ensure that the designated signature authority for the Contractor assigned to FDLE read this Security Addendum and sign the Certification form attached to this addendum. Signed Certification forms shall be delivered to FDLE’s Contract Manager.

3.04 The Contractor shall establish and maintain a security violation response and reporting procedure to discover, investigate, document, and report on all security violations. Violations which endanger the security or integrity of FDLE information systems or records located therein must be communicated to the AC immediately.

3.05 The Contractor’s facilities shall be subject to unannounced security inspections performed by FDLE. These facilities are also subject to periodic audits.

3.06 The security plan is subject to annual review by the AC and the Contractor. During this review, efforts shall be made to update the program in response to security violations, changes in policies and standards, and/or changes in federal and state law and technology.

3.07 The Contractor and its employees shall comply with all federal and state laws, rules, procedures and policies formally adopted by FDLE, Florida’s Digital Services and Federal Bureau of Investigations.

3.08 FDLE policies shall be published on FDLE’s internal website and shall be accessible to Contractor employees assigned to work at FDLE.

3.09 The Contractor shall propose service level agreements for availability, performance and response.

3.10 The Contractor shall propose a risk mitigation strategy including an exit strategy related to FDLE data stored in a cloud environment.

3.11 Contractor is expressly prohibited from using or subcontracting facilities, services or personnel outside of the United States in performing the work defined in this Agreement.

3.12 Unless otherwise agreed in writing, the CONTRACTOR and its subcontractors shall not perform any of the Services from outside of the United States, and the CONTRACTOR shall not allow any State of Florida Data to be sent by any medium, transmitted or accessed outside of the United States.

4.00 Site Security

4.01 The Contractor shall dedicate and maintain control of the facilities, or areas of facilities, that support FDLE, when applicable.

4.02 All personal computers and/or terminals physically or logically connected to the computer system accessing FDLE information systems must be segregated and screened against unauthorized use or observation.

5.00 System Integrity

5.01 Only employees of the Contractor and such other persons as may be granted authorization by the AC shall be permitted access to the system.

5.02 The Contractor shall maintain appropriate and reasonable quality assurance procedures.

5.03 Access to the system shall be available only for official purposes consistent with the appended Agreement. Any dissemination of FDLE data to authorized employees of the Contractor is to be for their official purposes.

5.04 Information contained in or about the system shall not be provided to another entity without prior written authorization by the AC.

5.05 All criminal history record information requests must be authorized by the appended Agreement. A current up-to-date log concerning access and dissemination of criminal history record information shall be maintained at all times by the Contractor.

5.06 The Contractor shall ensure that its inquiries of FDLE information systems and any subsequent dissemination conform to applicable laws, rules, and policies, as set forth in, without limitation:

1) Chapter 817, F.S. Fraudulent Practices

2) Chapter 119, F.S. Public Records

3) Chapter 943, F.S. Law Enforcement Act

4) and this Security Addendum;

5.07 The Contractor shall protect against any unauthorized persons gaining access to the equipment, any of the data, or the operational documentation for the criminal justice information system. In no event shall copies of messages or criminal history record information be disseminated other than as envisioned and governed by the appended Agreement.

6.00 Personnel Security

6.01 A background investigation shall be conducted on all Contractor employees and the Contractor's Contractors which provide system maintenance support.

6.02 The background investigation shall be conducted by FDLE. This investigation includes an employment check, reference check, credit check, drug screen, and submission of a completed applicant fingerprint card. State and national record checks by fingerprint identification shall be conducted for all personnel who manage, operate, develop, access and maintain criminal justice information systems and facilities. Record checks must be completed prior to employment.

6.03 When identification of the applicant with a criminal history has been established by fingerprint comparison, FDLE shall review the matter. A Contractor employee found to have a criminal record consisting of any felony convictions or of misdemeanor offenses which demonstrate a pattern of disregard for lawful behavior is disqualified. Applicants shall also be disqualified on the basis of confirmations that arrest warrants are outstanding for such applicants.

6.04 If an adverse employment determination is made, access shall be denied and the Contractor’s Security Officer shall be notified in writing of the access denial. This applicant shall not be permitted to work on the contract with the FDLE. The Contractor shall be notified of the adverse decision. The Contractor may request FDLE to review an adverse employment decision.

6.05 FDLE’s Security Officer shall maintain a list of personnel who successfully completed the background investigation.

6.06 FDLE shall ensure that each Contractor employee receives a copy of the Security Addendum and executes an acknowledgment of such receipt and the contents of the Security Addendum.

The signed acknowledgments shall remain in the possession of FDLE and available for audit purposes.

6.07 FDLE shall ensure that each Contractor employee authorized to access CJIS network terminals or information provided there from is specially trained in the state and federal laws and rules governing the security and integrity of criminal justice information.

6.08 Visitors to sensitive areas of Contractor facilities must be escorted at all times by a Contractor employee with clearance. Names of all visitors shall be recorded in a visitor log, to include date and time of visit, name of visitor, purpose of visit, name of person visiting, and date and time of departure. The visitor logs shall be maintained for five years following the termination of the contract.

7.00 System Security

7.01 Transmission, processing, and storage of criminal justice information shall be conducted on dedicated systems. Increased reliance should be placed on technical measures to support the ability to identify and account for all activities on a system and to preserve system integrity.

7.02 The system shall include the following technical security measures:

a. unique identification and authentication for all interactive sessions;

b. if warranted by the nature of the contract, advanced authentication techniques in the form of digital signatures and certificates, biometric or encryption for remote communications;

c. security audit capability for interactive sessions and transaction based logging for message-based sessions; this audit shall be enabled at the system and application level;

d. access control mechanisms to enable access to be restricted by object (e.g., data set, volumes, files, records) to include the ability to read, write, or delete the objects;

e. ORI identification and access control restrictions for message based access;

f. system and data integrity controls;

g. access controls on communications devices;

h. confidentiality controls (e.g., partitioned drives, encryption, and object reuse).

7.03 Data encryption shall be required throughout the network passing through a shared public carrier network.

7.04 The Contractor shall provide for the secure storage and disposal of all hard copy and media associated with the system to prevent access by unauthorized personnel.

7.05 The Contractor shall establish a procedure for sanitizing all fixed storage media (e.g., disks, drives) at the completion of the contract and/or before it is returned for maintenance, disposal or reuse. Sanitization procedures include overwriting the media and/or degaussing the media. If media cannot be successfully sanitized it must be returned to the FDLE or destroyed.

8.00 Cloud Requirements

8.01 The Contractor shall provide Architecture Design Documents including data egress charge models.

8.02 All FDLE data must be stored in the continental United States. Any remote access to the data must come from the United States. Exceptions require approval from the agency CIO.

8.03 FDLE shall maintain data ownership at all times.

8.04 The Contractor shall notify the FDLE Information Technology Customer Support Helpdesk of any and all system outages.

8.05 The Contractor shall provide to FDLE a Service Organization Control Type 2 or 3 Report (SOC 2 or SOC 3) consistent with the American Institute of Certified Public Accountants (AICPA) requirements. Additionally, Contractor shall deliver a SOC 2 or SOC 3 report within thirty (30) days after each anniversary of the execution of this Contract. SOC 2 is preferred but SOC 3 is acceptable.

8.06 The Contractor shall provide exit strategy for cloud computing services and applications including data acquisition, migration strategy, high-level timeline and cost.

8.07 The Contractor shall provide a Disaster Recovery plan which complies with Chapter 60GG-2 F.A.C. Cybersecurity Standards prior to the contract execution. If the Disaster Recovery Plan is modified during the contract term, the Contractor shall provide the modified version.

9.00 Security Violations

9.01 Consistent with Section 3.05, the Contractor agrees to inform the AC and ISM of system violations. The Contractor further agrees to immediately remove any employee from assignments covered by this contract for security violations pending investigation. Any violation of system discipline or operational policies related to system discipline is grounds for termination, which shall be immediately reported to the AC in writing.

9.02 The ISM shall be responsible for reporting security violations to Florida’s Digital Services along actions taken by FDLE and Contractor.

9.03 Security violations can justify termination of the appended agreement.

9.04 Upon notification, FDLE reserves the right to:

a. Investigate or decline to investigate any report of unauthorized use;

b. Suspend or terminate access and services, including the actual telecommunications link to FDLE information systems.

9.05 FDLE shall provide the Contractor with timely written notice of the suspension. Access and services shall be reinstated only after satisfactory assurances have been provided to FDLE by the Contractor. Upon termination, the Contractor's records containing criminal history record information must be deleted or returned to FDLE.

9.06 FDLE reserves the right to audit the Contractor's operations and procedures at scheduled or unscheduled times. FDLE is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.

9.07 Notwithstanding any provision of this Contract to the contrary, the CONTRACTOR shall notify the Department as soon as possible and in all events within one (1) business day in the event it discovers any Data is breached, any unauthorized access of State of Florida Data occurs (even by persons or companies with authorized access for other purposes), any unauthorized transmission of Data or any credible allegation or suspicion of a material violation of the above.

This notification is required whether the event affects one employee/retiree or the entire population. The notification shall be clear and conspicuous and include a description of the following: (a) the incident in general terms, (b) the type of personal information that was subject to the unauthorized access and acquisition, (c) the number of individuals who were, or potentially have been affected by the breach, and (d) the actions taken by the CONTRACTOR to protect the Data information from further unauthorized Access. However, the description of those actions in the written notice may be general so as not to further increase the risk or severity of the breach.

9.08 Upon becoming aware of an alleged security breach or security incident, the CONTRACTOR Security Officer shall set up a conference call with the Department’s Contract Manager. The conference call invitation shall contain a brief description of the nature of the event. When possible, a thirty (30) minute notice shall be given to allow Department personnel to be available for the call. If the designated time is not practical for the Department, an alternate time for the call shall be scheduled. All available information shall be shared on the call. The CONTRACTOR shall answer all questions based on the information known at that time and shall answer additional questions as additional information becomes known. The CONTRACTOR shall provide the Department with final documentation of the incident including all actions that took place. If the CONTRACTOR becomes aware of a security breach or security incident outside of normal business hours, the CONTRACTOR shall notify the Department’s Contract Manager in all events, within one (1) business day.

10.00 Miscellaneous Provisions

10.01 The parties are also subject to applicable federal and state laws and regulations.

10.02 The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they provide a minimum basis for the security of the system, and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.

10.03 This Security Addendum may only be modified by amendments signed by authorized representatives of FDLE and the Contractor.

10.04 Contractors must adhere to the selected Information Security Requirements.

☒ Federal Law and Policy ☒ FBI CJIS Security Policy – Security Controls to protect criminal justice information ☐ Federal Risk and Authorization Management Program (FedRAMP) –

Implements the Federal Information Security Management Act (FISMA) for cloud services.

☒ State Law and Rules (as applicable)

☒ Chapter 119, FS - Public Records ☒ Section 282.318, FS - Security of data and information technology ☒ Section 287.057, FS – Procurement of Personal Property and Services

☒ Section 501.171, FS - Security of confidential personal information ☒ Rule 60GG-2, FAC - Information Technology Security ☒ Rule 60GG-4, FAC - Cloud Computing

☐ FDLE Policy ☐ Policy 2.5 - Information Security ☐ Policy 2.6 - Acceptable Use of Info Technology

This section is to be completed before a procurement is executed.

☐ Assessments ☐ FedRAMP Control Implementation Summary and System Security Plan ☐ Cloud Security Alliance – Consensus Assessments Initiative Questionnaire

(CAIQ) Lite ☐ FDLE CJIS Technical Compliance Audit, if it contains CJI data

10.05 Security-related notices and correspondence shall be forwarded to:

FDLE

Information Technology Services Attention: Information Security Officer 2331 Phillips Road Tallahassee, FL 32308