Data Sharing Agreement v2026.4.27 Page 1 of 4

FLORIDA FISH AND WILDLIFE

CONSERVATION COMMISSION

1. Purpose.

This Memorandum of Understanding (“MOU”) is made and entered into by and between the Florida Fish and Wildlife Conservation Commission (“FWC”, “Agency”), a state agency of the State of Florida, and [Third‑Party Legal Name] (“Third-Party”). FWC and Recipient may be referred to individually as a “Party” and collectively as the “Parties.”

The purpose of this MOU is to establish the terms and conditions governing FWC’s disclosure of certain data to the Recipient for the purposes identified herein, and to ensure that the confidentiality, integrity, and availability of such data are preserved while the data is accessed, stored, processed, or otherwise handled by the Recipient.

2. Legal Authority.

Section 282.318, F.S. — State Cybersecurity Act: establishes cybersecurity standards and shared-data agreement requirements governing all executive branch state agencies.

Chapter 119, F.S. — Public Records Law: governs public access and exemptions applicable to Covered Data.

Section 501.171, F.S. — Florida Information Protection Act (FIPA): governs breach notification obligations for covered entities maintaining personal information.

Chapter 60GG-2, Fla. Admin. Code — Florida Cybersecurity Standards: establishes technical and operational safeguards aligned with the NIST Cybersecurity Framework.

NIST Special Publication 800-53 Rev. 5: provides the security and privacy controls framework governing technical safeguards required under § 282.318, F.S. and Chapter 60GG-2, Fla. Admin. Code.

FBI Criminal Justice Information Services (CJIS) Security Policy: establishes the mandatory security controls, technical safeguards, personnel requirements, and governance standards for the protection, transmission, processing, and storage of Criminal Justice Information (CJI), and serves as a binding safeguard framework required under § 282.318, F.S. and Chapter 60GG-2, Fla. Admin. Code.

3. Definitions.

For the purposes of the Data Sharing Agreement, the following terms are defined as set forth below:

a. Agreement – Means this Memorandum of Understanding, including all exhibits and amendments hereto.

b. Business Days – Monday through Friday, inclusive, except for holidays identified in section 110.117, Florida

Statutes (F.S.), or emergencies identified by the Agency’s Contract Manager.

c. Calendar Days – All days, including weekends and holidays.

d. CJI - means all data collected, created, received, accessed, transmitted, stored, or disseminated by criminal justice agencies that relates to individuals and criminal justice activities, including biometric, identity‑related, case, incident, investigative, and other law‑enforcement-sensitive information, as governed by the FBI CJIS Security Policy.

e. Cloud Computing – A service, solution, or option as defined in 60GG-4.001, Florida Administrative Code (F.A.C.).

f. Cloud Service Provider – Person, organization, or entity responsible for making a cloud computing service, solution, or option available to a consumer.

v2026.4.27 Page 2 of 4

g. Third-Party – The entity selected to provide goods or services to the Agency and its employees, officers, subcontractors for third-parties, agents, representatives, distributors, and resellers.

h. Data-in-Transit - Means any data being transmitted between systems or locations.

i. Data-at-Rest – Stationary electronic or digital Open Data and FWC Data stored in any digital form or medium.

j. Agency – The Florida Fish and Wildlife Conservation Commission, an agency of the State.

k. Breach – A confirmed event that compromises the confidentiality, integrity, or availability of information or data.

l. FWC Data – Any data that is in the possession or under the control of the State or the Third-Party that is confidential information exempt from public disclosure pursuant to Chapter 119, Florida Statutes, (F.S.) (Public Records); personal information enumerated in section 501.171(1)(g), F.S. (Consumer Protection); and/or any data that is restricted from public disclosure based on federal or state laws and regulations, including, but not limited to, those related to privacy, confidentiality, security, personal health, business or trade secret information, and exemptions from state public records laws. FWC Data also includes data that any state agency, the Agency of Legal Affairs, the Agency of Financial Services, or the Agency of Agriculture and Consumer Services is statutorily authorized to assess a fee for its distribution.

m. Open Data – Any and all data meeting the definition of “Open data” in section 282.0041, F.S. (Communications and Data Processing).

n. Artificial Intelligence – Refers to computer systems that mimic human intelligence, enabling tasks like learning, reasoning, and problem‑solving. It encompasses various technologies such as machine learning and natural language processing, with applications across industries to automate processes and make intelligent decisions.

o. Machine Learning – A subset of Artificial Intelligence (AI) that enables systems to learn from data and improve over time without being explicitly programmed.

p. Large Language Models – Advanced artificial intelligence (AI) systems, specifically deep learning models, designed to understand, generate, and manipulate human language.

q. State – The State of Florida.

4. Personnel Screening and Eligibility Requirements.

The Third-Party shall ensure that all individuals assigned to perform services under this MOU who will have access to information processing facilities, or who possess system, database, developer, network, or other administrative capabilities for systems, applications, or servers categorized as moderate‑impact or higher, undergo a comprehensive background investigation prior to being granted such access and should be reviewed annually.

In addition to any background screening, all such individuals shall successfully complete a federal criminal history check that identifies felony convictions involving, but not limited to, computer-related or information-technology related offenses; identity-theft-related crimes; financially-related crimes, including fraudulent practices, false pretenses, fraud, and credit-card-related offenses; forgery or counterfeiting; violations involving checks, drafts, or negotiable instruments; misuse of medical, personnel, or other sensitive records; and theft.

The Third-Party shall establish, maintain, and apply objective appointment and selection disqualification criteria for any personnel assigned to privileged or administrative IT functions under this MOU. Individuals who do not satisfy these criteria shall be prohibited from accessing FWC systems, data, third-party applications that contain FWC data or facilities of any impact level.

5. Scope of Data Sharing, Use, and Restrictions.

Sharing – FWC may provide the Recipient with access to, or the transfer of, the following categories of data:

[Describe Data Categories], including any additional data mutually agreed upon in writing by the Parties. All data disclosed or accessed under this MOU shall remain the exclusive property of FWC. The Recipient shall handle, store, transmit, and protect such data in full compliance with § 282.318, Florida Statutes, Chapter 60GG‑2, Florida Administrative Code, and, where applicable, the FBI CJIS Security Policy, including all associated technical, administrative, and physical safeguard requirements.

Use Restrictions – The Third-Party shall comply with the following requirements regarding all FWC data disclosed or made accessible under this MOU. The Third-Party shall agree to use such data solely for the purposes expressly authorized in this MOU. The Third-Party shall not disclose, sell, lease, assign, transmit, release, or otherwise transfer any data to any third‑party subsidiary, affiliate, or external entity without the prior written authorization of the Chief Information Officer (CIO) or the CIO’s designee.

v2026.4.27 Page 3 of 4

c. The Third-Party shall not attempt to re‑identify, re‑associate, or otherwise reverse any anonymization, pseudonymization, or de‑identification applied to the data described herein.

d. The Third-Party shall not use, process, or incorporate any data provided under this MOU for the purpose of training, fine‑tuning, validating, or otherwise improving any artificial intelligence (AI), machine learning (ML), or automated decision‑making system without the prior explicit written approval of the FWC Chief Information Officer (CIO) or designee. This prohibition includes but is not limited to: use of FWC Data in foundation models, use of FWC Data in large language models, or use of FWC Data in generative AI systems; ingestion of such FWC Data into AI or ML pipelines; and creation of derivative datasets intended for AI or ML development or enhancement.

6. Data Security Requirements.

a. The Third-Party shall implement and maintain administrative, technical, and physical safeguards that meet or exceed National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1, as detailed in Rule Chapter 60GG-2, F.A.C, National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, and if applicable, the FBI’s Criminal Justice Information Services (CJIS) Security Policy.

b. The Third-Party shall maintain an information security program aligned with the standards referenced in this MOU; ensure personnel with access to FWC Data have completed all required background screening, including screening applicable to regulated data such as CJI prior to accessing FWC Data; with the enforcement of least-privilege based access controls. The Third-Party shall also agree to encrypt all data-in-transit and data-at-rest using industry-accepted cryptographic standards (FIPS 140-2, FIPS 140-3) and apply timely security patches, updates, and configuration changes upon detection within a reasonable and communicated remediation period to all systems handling FWC Data.

c. The Third-Party shall comply with section 501.171, F.S. (Consumer Protection), 60GG-2 (State of Florida Cybersecurity Standards), and CJIS Security Policy (where applicable) to protect confidentiality, integrity, and availability of all FWC Data listed herein.

d. If a breach of FWC Data occurs, the Third-Party shall provide notice to the Agency as soon as possible but no later than two business days after the determination of the breach or reason to believe a breach occurred. Notice must be provided to the Agency’s Security Operations, Office of Information Technology, via email to ISM@MyFWC.com and via telephone at (850) 544-6322 and contain a summary of the breach or possible breach.

Third-Party will follow up as expeditiously as practicable, but no later than ten (10) Calendar Days after the cause of the breach has been identified with a detailed report on the reason for the breach, how it was identified, data impacted or released in the breach, and any relevant details or recommended steps the Agency should take as a result of the incident.

e. If the Third-Party is a Cloud Service Provider, the Third-Party shall engage a certified public accounting firm on an annual basis, at no cost to the Agency, to perform a Statement on Standards for Attestation Engagements SSAE 18 SOC 2 Type II audit in accordance with the professional standards established by the American Institute of Certified Public Accountants (AICPA) for all systems used to comply with data security obligations under this Contract. The Third-Party shall ensure the Agency’s Contract Manager’s receipt of the annual audit report in Adobe Acrobat PDF (.pdf) format, within ten (10) Business Days of the Third-Party’s receipt of the report from the auditor. The Agency’s expectation is that all audits conducted will find the Third-Party in full compliance with all data security standards. If an auditor notes any exceptions or deficiencies the Third-Party shall provide its audit response and identify any correctable items to the Agency as well as a remediation plan and timeline to address the deficiencies.

Disclosure Restrictions.

The Third-Party shall not divulge to any third party any FWC Data obtained by the Third-Party in the course of performing its contracted work unless required by law or legal process, and only after notice to the Agency. The Third- Party will not be required to keep confidential any information that is publicly available through no fault of the Third- Party, material that the Third-Party developed independently without relying on the State’s FWC Data, or information that is otherwise obtainable under State law as a public record.

Data Access and Storage.

f. No Data-at-Rest will be stored outside of the continental United States of America regardless of method or medium, except as required by law or approved in writing by the Chief Information Officer (CIO) or the CIO’s designee, pursuant to 60GG-4.002, F.A.C.

v2026.4.27 Page 4 of 4

g. No Data-in-transit will be transmitted outside of the continental United States of America regardless of method or medium, except as required by law or approved in writing by the Chief Information Officer (CIO) or the CIO’s designee, pursuant to 60GG-4.002, F.A.C.

h. Access to FWC Data will only be available to personnel with a legitimate business need who are approved and authorized by the Agency.

i. Remote access to data other than Open Data from outside of the continental United States is prohibited unless approved in writing by the CIO or the CIO’s designee, pursuant to 60GG-4.002, F.A.C.

j. Requests for remote access shall be submitted to the Agency’s Information Security Manager, Contract Manager and Chief Information Officer. With approval from the Agency in writing, third parties may be granted time-limited remote access to IT resources as necessary for the fulfillment of related responsibilities. Remote connections are subject to detailed monitoring via two-way log reviews and the use of other tools. When remote access is no longer needed, the Third-Party shall notify the Agency’s Information Security Manager, Contract Manager and Chief Information Officer, and access shall be promptly removed when no longer appropriate.

k. If required by the Agency, the Agency will escort any remote support access and maintain visibility of the Third- Party actions during remote support sessions.

Data Encryption and Protection.

The Third-Party shall encrypt all data transmissions (e.g., “data-in-transit”) and data storage (e.g., “data-at-rest”) containing FWC Data using industry-accepted methods and best practices, pursuant to 60GG-2.003, F.A.C.

Artificial Intelligence and Machine Learning.

The third-party must disclose the inclusion of any Artificial Intelligence and/or Large Language Models utilized within their services. Under no circumstances shall the Third-Party use any Agency provided FWC Data, in whole or in part, to train, develop, refine, or enhance any models, systems, algorithms, or datasets, whether proprietary, open‑source, or third‑party. The Third-Party shall implement and maintain controls ensuring that provided FWC Data is completely segregated from all model‑training processes and environments. The third-party shall ensure that Agency Data is used solely for the performance of services under this Agreement.

Breach and Liability.

The Third-Party agrees to protect, indemnify, defend, and hold harmless the Agency from and against any and all costs, claims, demands, damages, losses, and liabilities arising from or in any way related to the Third-Party’s breach of this Data Sharing Agreement or the negligent acts or omissions of the Third-Party related to this agreement.

Separate Security Requirements.

Any Criminal Justice Information Services-specific (CJIS) security requirements are attached in a separate attachment, if applicable.

Ownership of FWC Data.

FWC Data shall be made available to the Agency upon its request, in the form and format reasonably requested by the Agency. Title to all FWC Data will remain property of the Agency and/or become property of the Agency upon receipt and acceptance. The Third-Party shall not possess or assert any lien or other right against or to any FWC Data in any circumstances.

Right to Audit.

The FWC reserves the right, upon reasonable notice, to audit Third-Party systems, applications, networks, hosting environments, facilities, and data centers; inspect any records, logs, documents, or information relevant to compliance;

request security documentation required under applicable regulatory and contractual obligations; interview Third- Party or sub Third-Party personnel; validate sub Third-Party adherence to all flow-down requirements; and otherwise verify the Third-Party’s compliance with this agreement. The Third-Party shall also fully and promptly cooperate with all such audit activities without delay or obstruction.

Cooperation with the State and Third Parties.

The Third-Party agrees to cooperate with the following entities: the State, the State’s other Third-Partys, the State’s agents including properly authorized governmental entities, the State’s authorized third parties such as technology staff under contract with the State, and other properly authorized individuals who directly or indirectly access FWC Data on behalf of any of the entities listed in this section. The Third-Party agrees to impose these same requirements on all sub Third-Partys providing services under this Contract.