FULLY_SIGNED_ACQ1043_Amendment_3.pdf

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 1 of 23

Version 7/23

RP ASSET RECOVERY, INC. CONTRACT (#ACQ1043)

AMENDMENT 3 AND RENEWAL

This Amendment 3 to and Renewal of contract #ACQ1043 (the “Amendment”) is between the State of Ohio, Department of Administrative Services (the “State”) and RP Asset Recovery, Inc. (the “Contractor”). This Amendment changes the terms of RP Asset Recovery, Inc., contract (#ACQ1043) (the “Contract”).

WHEREAS, the State and Contractor entered into the Contract on June 2, 2021; and

WHEREAS, the State and Contractor determined that an amendment is necessary to address certain revisions to the Contract.

NOW, THEREFORE, the Contract is amended as follows:

1. This Contract is renewed for an additional term effective December 15, 2024 and expiring on June 30, 2027.

2. In Attachment Three: Special Terms and Conditions, delete Contractor’s Revenue Share section in its entirety and replace it with the following:

Revenue Share. The Contractor must pay to the State a share of the sales transacted under this Contract as a fee to the State to cover the estimated costs the State will incur in administering this Contract and the Services offered under it (“Revenue Share”).

The Contractor must remit the Revenue Share in U.S. dollars within 30 days after the end of the quarterly reporting period. The Revenue Share that the Contractor must pay under this Contract equals .75% of the total quarterly sales reported. The Revenue Share must be included in the prices reflected in any order and reflected in the total amount charged to the State, and the Contractor may not add a surcharge to orders under this Contract to cover the cost of the Revenue Share.

The Contractor must remit any amount due as the result of a quarterly or closeout sales report at the time the quarterly or closeout sales report is submitted to the Department of Administrative Services, Office of State Purchasing. To ensure the payment is credited properly, the Contractor must identify the payment as a “State of Ohio Revenue Share” and include this Contract number, total report amount, and reporting period covered.

Contractor will pay the Revenue Share by check remittance, both normal and overnight, credit card payment via the State’s epayment portal, or ACH payment, if approved by the State, using the instructions below.

Check remittance: Follow the remittance instructions on the required Quarterly Sales Report and

Revenue Share Remittance Form at the following link, https://das.ohio.gov/revenueshareform.

Credit Card Payments: To pay by credit card, use the following link, https://epay.das.ohio.gov/Payment, select “Revenue Share” as the payment type and follow the on-screen prompts.

ACH Payments: If this payment method is approved by the State, the State will provide payment instructions to Contractor.

If the full amount of the Revenue Share is not paid within 30 days after the end of the applicable reporting period, the non-payment will constitute a contract debt to the State. The State may setoff any unpaid Revenue Share from any amount owed to the Contractor under this Contract and employ all other remedies available to it under Ohio law for the non-payment of the Revenue Share. Additionally, if the Contractor fails to pay the Revenue Share in a timely manner, the failure will be a breach of this Contract, and the State may terminate this Contract for cause as set forth herein and seek damages for the breach.

Quarterly Reporting. Contractor must report the quarterly dollar value (in U.S. currency rounded to the https://das.ohio.gov/revenueshareform https://epay.das.ohio.gov/Payment

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 2 of 23 nearest whole dollar) of the sales under this Contract each calendar quarter (i.e., January-March, April- June, July-September and October-December). The dollar value of the sales reported must equal the price paid by all State agencies and Cooperative Purchasing Members for purchases under this Contract during the reporting period.

Contractor must submit the quarterly sales report to the State via the State’s Ordering System, and when Contractor will be submitting a payment, Contractor must also complete and submit the Quarterly Sales Report and Revenue Share Remittance Form (available at https://das.ohio.gov/revenueshareform) with Contractor’s Revenue Share payment. If no sales occur, Contractor must show zero sales on the report.

The report must be submitted 30 days after the completion of the reporting period.

Contractor also must submit a closeout sales report within 120 days after the expiration of this Contract.

For purposes of this subsection, the Contract expires on the physical completion of the last, outstanding task or completion of an Order of the Contract. The closeout sales report must cover all sales not shown in the final quarterly sales report and reconcile all errors and credits. If Contractor reported all Contract sales and reconciled all errors and credits on the final quarterly sales report, then Contractor should show zero sales in the closeout sales report.

If Contractor fails to submit any sales report in a timely manner or falsifies any sales report, the State may terminate this Contract for cause.

3. In Attachment Four: Standard Terms and Conditions, II. Regulatory Contract Requirements, add the following:

Q. Independent Contractor Acknowledgement:

https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf.

4. In Attachment Four: Standard Terms and Conditions, II. Regulatory Contract Requirements, delete H.

Drug Free Workplace in its entirety and replace it with the following:

DRUG FREE WORKPLACE. The Contractor agrees to comply with all applicable state and federal laws regarding drug-free workplace and shall make a good faith effort to ensure that all Contractor employees, while working on State property or performing work on behalf of the State, will not purchase, transfer, use, be under the influence of, or possess illegal drugs, non-medical cannabis (recreational marijuana), or alcohol, or abuse prescription drugs or medical marijuana in any way.

5. In Attachment Four: Standard Terms and Conditions, II. Regulatory Contract Requirements, delete J.

Prohibition of the Expenditure of Public Funds for Offshore Services in its entirety and replace it with the following:

PROHIBITION OF THE EXPENDITURE OF PUBLIC FUNDS FOR OFFSHORE SERVICES No State Cabinet, Agency, Board or Commission will enter into any contract to purchase services provided outside the United States or that allows State data to be sent, taken, accessed, tested, maintained, backed-up, stored, or made available remotely outside (located) of the United States, unless a duly signed waiver from the State has been attained. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid for services the Contractor performs outside of the United States for which it did not receive a waiver. The State does not waive any other rights and remedies provided the State in the Contract.

Further, no State agency, board, commission, State educational institution, or pension fund will make any purchase from or investment in any Russian institution or company. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid to Contractor for purchases or investments in a Russian institution or company in violation of this paragraph. The provisions of this paragraph will expire when the applicable Executive Order is no longer effective.

The Contractor must complete the Contractor/Subcontractor Affirmation and Disclosure Form affirming the Contractor understands and will meet the requirements of the above prohibition. During the performance of this Contract, if the Contractor changes the location(s) disclosed on the Affirmation and Disclosure Form, https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/04-Affirmation%20and%20Disclosure%20Form_3-4-22.pdf

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 3 of 23

Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

6. In Attachment Four: Standard Terms and Conditions, VI. Performance and Compliance, A. Audits, delete the $2,500 amount and replace it with $25,000.

7. In Attachment Four: Standard Terms and Conditions, Section VI. Performance and Compliance, delete K. eProcurement in its entirety and replace it with the following:

OHIOBUYS. This Contract may become part of OhioBuys, an electronic procurement system which provides electronic contract and catalog hosting and management services. Ordering Agencies access this system to place orders for the procurement of goods and services using State of Ohio contracts. When the Contract becomes part of OhioBuys, the Contractor agrees to establish, maintain and support its contract and catalog in OhioBuys.

8. In Attachment Four: Standard Terms and Conditions, VII. Data and Information Control, add the following new section:

E. DATA SECURITY AND PRIVACY TERMS. These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms applies to all work and services across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with the State IT Security Policies and Standards and these Terms and must accept the security and privacy requirements outlined in these Terms in their entirety, as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management in accordance with State IT Security Policies and Standards.

These Terms apply to the following:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the Contract.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State

Data directly or indirectly.

E. Any Contractor personnel that have access to State Data.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contractor for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

2. Personally Identifiable Information means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics, E. The definitions of “personal information” in Revised Code chapters 1347.01, 1347.04 through

1347.99, and

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 4 of 23

F. The various other definitions of “personal information” throughout the Ohio Revised Code.

3. Security Event has the meaning set forth in Section 7 of these Terms.

4. Security Incident has the meaning set forth in Section 7 of these Terms.

5. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Sensitive Data.

6. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act

(45 CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare:

42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards;

G. Social Security Administration (SSA) Data which is data received by the State from the Social

Security Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

7. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with the applicable security baseline of the current published version of the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (“NIST 800-53”) commensurate with the type of State Data involved in the Contract as communicated by the State. If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. In either scenario, the Contractor must implement information security policies, standards, and capabilities as set forth in the Contract, adhere to State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards. All work performed by the Contractor, all deliverables provided by the Contractor, and all environments utilized to perform the Contractor’s work must comply with State IT Security Policies and Standards. The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 5 of 23

A. Support State IT security policies, standards and procedures development and maintenance activities. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of State Data

Contractor shall maintain an Information Security Program (“ISP”) made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations and be handled in accordance with the requirements of these Terms at all Contractor locations.

If the Contractor will be handling Sensitive Data, the State may require additional documentation such as the Contractor’s information security policies and procedures, contingency plans, or incident response plans, a Privacy Impact Assessment (PIA), FIPS-199 compliance documentation, a NIST-compliant System Security Plan (SSP), and Plans of Action and Milestones (POA&M) documentation.

3. Security Standards and Warranties

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 6 of 23

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq.

(“FISMA 2014”) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

Contractor’s information security program protects State Data by aligning with NIST 800-53 to implement an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against the unauthorized access to, disclosure of, or use of State Data.

D. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroy or return to the State, in a format designated by the State, all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

G. Maintain appropriate and effective business continuity and disaster recovery plans to ensure resiliency of State Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered State Data and Confidential Information under this Contract.

Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, and must promptly remediate any and all vulnerabilities and provide the State with patches to address the vulnerabilities at no cost to the State. Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), Contractor warrants that its software and/or service are free from any and all defects in materials, workmanship, and design. Contractor warrants that the software is free from any and all viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of State Data is permitted as set forth in the Contract. Additionally, disclosure of State Data is also permitted when required by applicable law, regulation, court order or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Sensitive Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State within 24 hours of receipt of the order or request in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also cooperate in the State’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the State.

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 7 of 23

If, in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Contractor may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. The Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

B. The State may, at any time in its sole discretion, elect to perform a Security and Data Protection Audit. This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will provide its request in writing and will work with the Contractor to schedule time to conduct the audit.

C. At no cost to the State, the Contractor must immediately remedy any issues, material weaknesses, or other items identified in each audit as they pertain to the services provided under this Contract.

6. Background Investigations of Contractor Personnel

The State of Ohio may conduct background investigations on Contractor personnel that may have access to State Data or as otherwise deemed necessary by the State. Any person who (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform certain services under the Contract. Contractor personnel who will have access to FTI or CJI must complete required background investigations that are favorably determined prior to being permitted to access the information. In addition, existing Contractors whose personnel already have access to FTI or CJI that have not completed the required background investigations within the last five years must complete the required background investigations that are favorably adjudicated prior to being permitted continued access to the information. If any Contractor personnel with existing access to the information have an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the information.

7. Security Incidents

A. Definitions. A security incident threatens the confidentiality, integrity, or availability of State information resources. A “Security Incident” means there is a successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 8 of 23 in an information system. A “Security Event” is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds.

Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of, but are not limited to, the following:

i. unsuccessful log-on attempts,

ii. unsuccessful denial of service attacks,

iii. unsuccessful phishing attacks, and

iv. unsuccessful network attacks such as pings, probes of firewalls, and port scans.

B. Security Incident Response and Reporting

The Contractor is responsible for Security Incident response, including containment, eradication, and recovery, to minimize the impact to the State. In addition to the requirements in the Contract, the Contractor must perform the following in response to a Security Incident involving State Data.

The Contractor is not required to report Security Events which do not adversely impact or potentially impact State Data or information systems unless a pattern of attacks significantly increases the risk of impact. Contractor must report in writing to the State within 24 hours of the Contractor becoming aware of any Security Incident and/or use or disclosure of State Data not authorized by the Contract, including any reasonable belief that unauthorized access to or acquisition of the State Data has occurred, and fully cooperate with the State to mitigate the consequences of the Security Incident. Within five business days of the initial Security Incident report to the State, the Contractor must document and begin providing follow-up reports for all Security Incidents to the State. The Contractor must provide updates to the follow-up reports until the investigation is complete. At a minimum, the Security Incident reports will include:

i. Data elements involved, the extent of the State Data involved in the Security Incident, and the identification of affected individuals, if applicable.

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed State Data, or to have been responsible for the Security Incident.

iii. A description of where the State Data is believed to have been improperly transmitted, sent, or utilized, if applicable.

iv. A description of the probable causes of the Security Incident and, in the final report, the root cause.

v. A description of the proposed plan for preventing similar future Security Incidents, including a recommended risk remediation plan.

vi. A description of the corrective actions taken, including repair (elimination of a defect or incident and/or restoration of system functionality requirements according to the Contract) and resolution (a temporary workaround to enable system function).

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 9 of 23

vii. Whether the Contractor believes any federal or state laws requiring notifications to individuals are triggered.

The Contractor must comply with all applicable laws that require the notification of individuals, or with other reasonable direction of the State for notification, in the event of a Security Incident involving personally identifiable information, or any other event requiring such notification. The State may, in its sole discretion, choose to provide notice to any or all parties affected by a Security Incident, but the Contractor shall reimburse the State for the cost of providing such notification.

Contractor further agrees to provide, or to reimburse the State for its costs in providing, any credit monitoring or similar services that are necessary as a result of Contractor’s Security Incident.

Under Ohio law, State Data is State property and any illegal activity involving State property is subject to a criminal investigation. The Contractor shall preserve sufficient evidence to ensure accurate Security Incident records, facilitate an investigation, and determine the extent of the Security Incident.

The Contractor shall work with the customer State agency to establish a Security Incident reporting communications procedure including Contractor and customer State agency contacts, communication methods and tools. If there is no procedure established, the Contractor must report Security Incidents to the primary contact listed in the Contract or that contact’s successor and Contractor must report the Security Incident to the State via email at Enterprise.SIRT@das.ohio.gov or call 614.728.7448.

The State reserves the right to conduct an independent investigation of the Security Incident, and the Contractor shall cooperate with the investigation. The independent investigation may be conducted by a State agency or a third party acting on behalf of the State.

8. Contractor Access

When the Contractor accesses State network systems and data, including remotely, the Contractor must maintain a robust security capability that incorporates generally recognized system hardening techniques.

The Contractor must use appropriate measures to ensure that State Data is secure before transferring control of any systems or media on which State Data is stored. The method of securing the State Data must be in alignment with the required data classification. The Contractor may permit State Data to be loaded onto portable computing devices or portable storage components or media only if adequate security measures are in place to ensure the integrity and security of State Data. The transfer of any such system or media must be reasonably necessary for the performance of the Contractor’s obligations under the Contract. The Contractor shall use multifactor authentication to limit access to systems that contain Sensitive Data.

State Data must be encrypted when stored on any portable computing or storage device or media or when transmitted across any data network. Contractors must also maintain an accurate inventory of all such devices and the individuals to whom they are assigned. The Contractor must have reporting requirements for lost or stolen portable computing devices authorized for use with State Data and must report any loss or theft of such devices to the State in writing as defined in Section 7.

9. HIPAA Compliance

When the Contractor is handling State Data that includes health or medical data, the Contractor must comply with the data handling and privacy requirements of HIPAA and its associated regulations.

Additionally, some or all of the State Data may be client identifying information covered by 42 C.F.R. Part

2. Contractor may only disclose such client identifying information back to the State and is bound in all respects by the regulations of 42 C.F.R. Part 2.

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 10 of 23

10. Federal Tax Information

When the Contractor is handling State Data that includes Federal Tax Information (FTI), the Contractor must comply with the IRS Publication 1075 safeguards below.

All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements defined in Internal Revenue Service (IRS) Publication 1075. The language in this Section may not be modified by Contractor and any proposed language changes listed in Contractor’s responses in this section will not be considered. For purposes of this section, “agency” means the applicable State entity.

A. Performance

In the performance of the Contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

i. All work will be performed under the supervision of the contractor.

ii. The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

iii. FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

iv. FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

v. The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

vi. Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

vii. All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

viii. No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

ix. Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 11 of 23

x. To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

xi. In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

xii. For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

xiii. The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

xiv. Audit and accountability policies and procedures must be developed, documented, disseminated, and updated as necessary to facilitate implementing audit and accountability security controls of contractor systems receiving, processing, storing or transmitting FTI.

a. To support the audit of activities, all agencies must ensure that audit information is archived for seven years.

b. The information system must protect audit information and audit tools from unauthorized access, modification, and deletion.

xv. IRS Publication 1075 compliance is mandatory. The aforementioned compliance items are a small selection of key elements contained within the requirements defined in IRS publication 1075. The contractor shall comply with all requirements of IRS Publication 1075 in its performance under the contract. The parties may agree via amendment to the contract to impose additional and more stringent requirements as deemed necessary to protect FTI.

B. IRS 1075 Criminal/Civil Sanctions

i. Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

ii. Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

iii. Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 12 of 23 inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

iv. Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a.

Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C.

552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

v. Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI.

A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

C. Inspection

The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

11. Criminal Justice Information

When the Contractor is handling State Data that includes criminal justice information (CJI), the Contractor must comply with the requirements in this section.

Contractor acknowledges that this Contract is subject to the requirements, conditions and restrictions set forth in: (i) the National Crime Information Center (NCIC) Operating Manual (available at http://www.cjis.gov, call the help desk); (ii) the Criminal Justice Information Services (CJIS) Security Policy (available at http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center/view); and (iii) Title 28, Code of Federal Regulations, Part 20 (available at http://www.gpo.gov/fdsys/pkg/CFR-2010-title28-vol1/pdf/CFR-2010-title28-vol1-part20.pdf) as the manual, policy, and regulations may be revised, amended or replaced. Further, Contractor shall require all employees, independent contractors and/or any other consultant performing work for Contractor under this Contract to complete and submit to the State the Certification page of the Federal Bureau of Investigation, CJIS Security Addendum and Certification set forth in Appendix H attached hereto.

https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.cjis.gov%2F&data=05%7C02%7CJessica.B.Tom%40das.ohio.gov%7C1731c8814ea84a92661908dc0bb0ee43%7C50f8fcc494d84f0784eb36ed57c7c8a2%7C0%7C0%7C638398101736657588%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2BEamW%2BnVQuo%2F%2Bc0%2B29g2%2FB36HUjGOUfJkkv6PJON100%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fbi.gov%2Fabout-us%2Fcjis%2Fcjis-security-policy-resource-center%2Fview&data=05%7C02%7CJessica.B.Tom%40das.ohio.gov%7C1731c8814ea84a92661908dc0bb0ee43%7C50f8fcc494d84f0784eb36ed57c7c8a2%7C0%7C0%7C638398101736657588%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=106zJ3nL0TxvN1EO79LmsOV4MJRviQWI%2BHQ7dGWN7NA%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gpo.gov%2Ffdsys%2Fpkg%2FCFR-2010-title28-vol1%2Fpdf%2FCFR-2010-title28-vol1-part20.pdf&data=05%7C02%7CJessica.B.Tom%40das.ohio.gov%7C1731c8814ea84a92661908dc0bb0ee43%7C50f8fcc494d84f0784eb36ed57c7c8a2%7C0%7C0%7C638398101736657588%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=LDyvzBWsYZl24WcUb13X%2FmqRsTeXQa96wYFuY2Bw0SE%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gpo.gov%2Ffdsys%2Fpkg%2FCFR-2010-title28-vol1%2Fpdf%2FCFR-2010-title28-vol1-part20.pdf&data=05%7C02%7CJessica.B.Tom%40das.ohio.gov%7C1731c8814ea84a92661908dc0bb0ee43%7C50f8fcc494d84f0784eb36ed57c7c8a2%7C0%7C0%7C638398101736657588%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=LDyvzBWsYZl24WcUb13X%2FmqRsTeXQa96wYFuY2Bw0SE%3D&reserved=0

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 13 of 23

APPENDIX H

CJIS Security Addendum

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 14 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 15 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 16 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 17 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 18 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 19 of 23

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 20 of 23

9. Delete Attachment Nine: Affirmation and Disclosure Form, in its entirety and replace it with the following:

AFFIRMATION AND DISCLOSURE FORM

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate “Not Applicable” in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

RP Asset Recovery, Inc. ACQ1043 – Amendment 3 Page 21 of 23

Rev. 3/22 Page 1 of 2

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Contractor affirms, understands, and agrees that Contractor and its subcontractors are…