Gartner_Attachment_B_-_Security_Rider_Final_4.2.2026.docx.pdf

Attachment B

|Security Rider v8 1

STATE OF WISCONSIN SECURITY RIDER

The terms and conditions of the State of Wisconsin Security Rider (hereinafter “Rider”) shall apply to all Products or Services provided under the Participating Addendum, 505ENT-O26-NASPOITRSRC-02, unless otherwise agreed to by the parties. This Rider shall apply to all environments (e.g., cloud-SaaS, IaaS, PaaS, AI, on-premises, and hybrid); all computing elements performed, provided, occupied, or utilized; and any access to State resources related to the delivery of Products or Services under the Master Contract.

In the event of a conflict between the terms of this Rider, the Master Contract or any other Service Level Agreements (SLA) or agreements between the State and Contractor, this Rider shall control.

1 Definitions

1.1 “Agency” or “State Agency” means an office, department, agency, institution of higher education, association, society, or other body in State of Wisconsin government created or authorized to be created by the State Constitution or any law, which is entitled to expend moneys appropriated by law, including the legislature and the courts, but not including an authority, as defined in Wis. Stat. § 16.70(2).

1.2 “Artificial Intelligence” or “AI” means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments.

(Source: NIST SP800-218A). Artificial Intelligence (AI) applies advanced analysis and logic-based techniques, including machine learning (ML), to interpret events, support and automate decisions, and take actions.

(Source: Gartner Glossary)

1.3 "Authorization" means the official decision by management, typically an Authorizing Official (AO), to permit an information system to operate after implementing appropriate security controls and accepting the associated risk to organizational operations and assets.

a) “Authorization to Operate” or “ATO” means a formal management decision by a State Agency to authorize an information system to operate and to explicitly accept the risk to Agency operations, assets, individuals, and the State that results from its use

b) “Authorization to Use” or “ATU” means a formal management decision by a State Agency to approve the use of an information system that has an existing Authorization. An ATU acknowledges that the

Agency has reviewed the associated security authorization package or attestation, accepted the system’s risk posture, and authorized its use to support the Agency’s mission and business purposes.

Docusign Envelope ID: 1BB0B196-9009-8083-82EF-FD82E9060B1A

|Security Rider v8 2

1.4 “Authorized User” means any appropriately provisioned individual with a requirement to access an information system.

1.5 “Baseline” or “Security Control Baselines” means the minimum set of security and privacy controls, as defined by the National Institute of Standards and Technology (NIST) in NIST Special Publication 800-53, Revision 5 and NIST Special Publication 800-53B, that are required for information systems categorized as

Moderate Impact under Federal Information Processing Standard (FIPS) 199. These controls provide protection where the loss of confidentiality, integrity, or availability could reasonably be expected to have a serious adverse effect on operations, assets, individuals, or the State.

For cloud-based systems, the baseline includes the FedRAMP Moderate Security Control Baseline, which incorporates the NIST Moderate controls plus additional FedRAMP-defined control enhancements, parameters, and continuous monitoring requirements necessary to safeguard Controlled Unclassified

Information (CUI) and other federal or State Data hosted in cloud environments.

1.6 “Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: a person other than an Authorized User accesses or potentially accesses

Personally Identifiable Information; or an Authorized User accesses Personally Identifiable Information for an unauthorized purpose. The determination of whether a Breach has occurred is within the sole discretion of the State.

1.7 “Confidential Data” means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization from the State. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There is a moderate risk when an Agency has discretion under the law to release data, particularly when the release must be made only according to Agency policy or procedure. Confidential Data includes, but is not limited to:

a) Personally Identifiable Information; and

b) Individually Identifiable Health Information; and

c) Federal Tax Information (FTI) under IRS Publication 1075 and bank or other financial account numbers; and

d) Criminal Justice Information under the Federal Bureau of Investigation’s Criminal Justice

Information Services Security Policy and the Law Enforcement Automated Data System (LEADS)

Policy, substance use disorder records under 42 C.F.R. Part 2, and crime victim information; and

e) Certain information not associated with individuals such as State building specifications, security and infrastructure records, and trade secrets; and

f) Information covered by the Children’s Online Privacy Act and Federal Educational Rights and

Privacy Act, and other information concerning minors, such as child critical incident records and other juvenile records.

|Security Rider v8 3

1.8 “Continuous Monitoring” or “CM” means maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.

1.9 “Contractor” means the person or entity who is required to provide Products or Services to the State pursuant to the Master Contract.

1.10 “Encrypt” or “Encryption” means encryption that complies with NIST’s Federal Information Processing

Standard 140-3 as demonstrated by a valid FIPS certificate number (or 140-2 until retirement per NIST transition guidance) and configured to use approved modes and algorithms, unless otherwise approved by the State CISO or designee in writing.

1.11 “Individually Identifiable Health Information” means information covered by the Health Insurance

Portability and Accountability Act (HIPAA), including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse;

and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Individually Identifiable Health

Information also includes patient health care records and other protected health information as defined by

Wis. Stat. §§ 146.81 and 146.816.

1.12 “Infrastructure as a Service (IaaS)” means the capability provided to the State to provision processing, storage, networks, and other fundamental computing resources where the State can deploy and run arbitrary software, which can include operating systems and applications. In IaaS environments, the State does not manage or control the underlying cloud infrastructure, but the State has control over operating systems, storage, and deployed applications. The State may also have limited control of select networking components (e.g., host firewalls).

1.13 “Large Language Model (LLM)” means a class of language models that use deep-learning algorithms and are trained on extremely large textual datasets that can be multiple terabytes in size. LLMs can be classed into two types: generative or discriminatory. Generative LLMs are models that output text, such as the answer to a question or even writing an essay on a specific topic. They are typically unsupervised or semi-supervised learning models that predict what the response is for a given task. Discriminatory LLMs are supervised learning models that usually focus on classifying text, such as determining whether a text was made by a human or AI. (Source: NIST AI 100-3: The Language of Trustworthy AI). A LLM is a specialized type of AI trained on vast amounts of text to understand existing content and generate original content. (Source:

Gartner Glossary)

1.14 “Master Contract” means the Participating Addendum between the Contractor and the State covering the

Products and Services to be performed.

1.15 “Personal Data” or “Personally Identifiable Information” means information that can be associated with a particular individual through one or more identifiers or other information or circumstances. Such information can include but is not limited to an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if the element is not publicly available information and is not encrypted, redacted, or altered in any manner that renders the element unreadable: (a) the individual’s Social Security number; (b) the individual’s driver’s license number or State

|Security Rider v8 4 identification number; (c) the individual’s date of birth; (d) the number of the individual’s financial account, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual’s financial account; (e) the individual’s DNA profile; or (f) the individual’s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation, and any other information protected by State or federal law.

1.16 “Platform as a Service (PaaS)” means the capability provided to the State to deploy onto the State’s cloud infrastructure or acquired applications developed by using programming languages and tools supported by the Contractor. In PaaS environments, the State does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

1.17 “Products” means any combination of software, hardware, facilities, and/or Services that deliver a value to a customer segment.

1.18 “Recovery Point Objective” or “RPO” means the point in time that data can be recovered and/or systems restored when Service is restored after an interruption. The Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup immediately preceding the interruption.

1.19 “Recovery Time Objective” or “RTO” means the period within which information technology services, systems, applications, and functions are to be recovered following an unplanned interruption.

1.20 “Risk Assessment" means an assessment that (1) documents and categorizes the systems and types of information the Contractor processes, stores, and transmits; (2) identifies threats and vulnerabilities to the system and determines the potential harm from a Breach and Security Incident; and (3) reviews supply chain risks associated with the Contractor’s systems.

1.21 “Security Incident” means an occurrence that actually or reasonable degree of certainty, jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. The determination of whether a Security Incident has occurred is within the sole discretion of the State.

1.22 “Service” or “Services” means an intangible product, including actions, recommendations, plans, research, customizations, modifications, documentation, and maintenance and support, including all related material necessary to fulfill that which the Contractor is obligated to accomplish or to provide under the Master

Contract.

1.23 “Service Level Agreement” or “SLA” means a written agreement between the State and the Contractor that is subject to the terms and conditions in this document that unless otherwise agreed to includes but is not limited to (1) the technical service level performance promises (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) security responsibilities and notice requirements, (5) how disputes are discovered and addressed, and (6) any remedies for performance failures.

|Security Rider v8 5

1.24 “Software as a Service” or “SaaS” means the capability provided to the State to use the Contractor’s applications on a cloud infrastructure. The applications are owned, delivered, and managed remotely by the

Contractor and accessible by the State through a thin-client interface or a program interface. The

Contractor delivers software based on one set of common code and data definitions that is consumed in a one-to-many model by the State at any time on a pay-for-use basis or as a subscription based on use metrics. The State does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage, or individual application capabilities, except for limited user-specific application configuration settings.

1.25 “State” means the State of Wisconsin.

1.26 “State Data” means all information that State officers, agents, employees, or end users upload, create, or modify pursuant to the Master Contract or this Rider, including Confidential Data, and any items or materials originated or prepared for the State under the Master Contract or this Rider. State Data also includes metadata that contains information from which State Data may be ascertainable.

1.27 “State IT Security Policies and Standards” means the policies and standards available at https://det.wi.gov/Pages/policies.aspx.

1.28 “System Security Plan” or “SSP” means a formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements. SSP should use FedRAMP or equivalent templates. SSP includes:

• system boundary; and

• system description; and

• roles and responsibilities; and

• Security categorization (FIPS 199 impact levels); and

• Implementation of each of the NIST 800-53r5 moderate baseline controls; and

• Inheritance from external providers (e.g., AWS, Azure, GCP); and

• Data flows (typically a diagram); and

• Interconnections; and

• Rules of behavior.

SSP is accompanied by a

a) “Security Assessment Report” or “SAR” means a document that details the findings of the independent security assessment conducted by a Third-Party Assessment Organization (3PAO) or equivalent.

b) “Plan of Action and Milestones” or “POA&M” means a document that details that tracks known weaknesses, vulnerabilities, or deficiencies found during the SAR, ongoing operations, or as part of continuous monitoring.

c) “Continuous Monitoring Strategy” or “ConMon” means a document that details process of maintaining ongoing awareness of security control effectiveness, vulnerabilities, and threats to support risk management decisions to ensure the system remains in compliance after Authorization.

1.29 “Subcontractor” means a third-party entity or individual that enters into an agreement with the Contractor for the purpose of providing Products or Services to the State pursuant to the Master Contract.

https://det.wi.gov/Pages/policies.aspx

|Security Rider v8 6

1.30 “Trade Secret” means information, including a formula, pattern, compilation, program, device, method, technique, or process to which all the following apply:

a) The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other people who can obtain economic value from its disclosure or use.

b) The information is the subject of efforts to maintain its secrecy that are reasonable under the circumstances.

2 Data Ownership

2.1 The State will own and retain all rights, title, and interest in the State Data related to the Products or

Services provided under the Master Contract, provided, however, that Contractor may use, reproduce, display and distribute excerpts and data from the deliverables, either alone or together with other material, in the ordinary course of Contractor’s business, so long as such excerpts and data do not identify State by name or contain any of the State’s confidential or proprietary information, and provided further that

Contractor retains all right, title and interest in and to its processes, benchmarking data and data collection tools, assessment models and pertinent methodologies such as Strategic Planning, Contractor’s copyrighted proprietary research and other pre-existing materials and data, such as Data Collection Templates and

Survey Tools for Applications and Infrastructure, and benchmark comparisons (“Preexisting Intellectual

Property”)..

2.2 The Contractor shall not collect, access, or use State Data, State user accounts, AI input or output containing or created by State Data, or State search history information, except as necessary to fulfill the terms of the Master Contract; respond to Service or technical issues; or upon written permission from the

State designee and shall remain the property of the State. These provisions also apply to all data or information stored or accessed by the Contractor that is the result of any processing of State Data.

2.3 The Contractor shall not acquire rights or licenses including, but not limited to, intellectual property rights or licenses, to State Data unless permitted under the terms of the Master Contract.

2.4 The Contractor shall enable and assist the State in transferring State Data at any time and disclose the necessary tools to complete the transfer. If costs are associated with the transfer, the amount will be negotiated and agreed upon by both parties before State Data is transferred.

3 Disclosing State Data to Third Parties

3.1 The Contractor shall not directly or indirectly disclose, provide, rent, sell, transfer, or otherwise provide access to State Data, State user accounts, AI input or output containing or created by State Data, or State search history information, except upon written permission from the State designee, by an order of a court of competent jurisdiction, or as provided within this Rider. If the Contractor engages in such prohibited actions, the State may invoke its cancellation rights under the Master Contract or SLA, and the procedures provided in Section 8 of this Rider.

3.2 The Contractor shall contact the State designee upon receipt of any electronic discovery, litigation holds, discovery searches, or expert testimonies related to State Data, or which in any way might reasonably

|Security Rider v8 7 require access to or disclosure of State Data. The Contractor shall not respond to subpoenas, service of process, or any other legal requests related to the State without first notifying and obtaining approval from the State designee, unless the Contractor is prohibited by law from providing such notice.

3.3 Upon the Contractor’s receipt of any other request for State Data, the Contractor shall promptly notify the

State designee and direct the request to the State. The Contractor shall cooperate with the State to provide the information requested to third parties.

3.4 Except as provided within this Rider, the Contractor shall not use, copy, or disclose State Data, State user accounts, AI input or output containing or created by State Data, or State search history information, or any other information the Contractor may collect from providing Products or Services under the Master

Contract, in any transaction that does not include the State, except as strictly necessary to fulfill the obligations of the Master Contract or as expressly permitted by the State designee in writing.

3.5 No later than 30 days of signing this Rider, the Contractor shall provide a list of all AI products, Services, or companies, third party or otherwise, that the Contractor will use or reasonably anticipates using to provide the Products or Services under the Master Contract. Annually, until the Master Contract ends or is cancelled, the Contractor shall provide an updated list in writing to the State designee. The State may prohibit the use or involvement of any AI product, Service, or company providing the Products or Services under the Master Contract to the State.

3.6 Except as provided in Section 3.5, these obligations shall survive and extend beyond the term of this Rider.

4 Data Protection

4.1 The Contractor shall not process, store, transmit, or otherwise use State data, nor provide Services for State business purposes, on any information system until such system has been formally authorized and secured in accordance with State requirements. Authorization shall be granted only after the following conditions are met:

a) Authorization to Operate (ATO): A formal decision by the State Authorizing Official to authorize the system to operate and to explicitly accept the risk associated with its use; or

b) Authorization to Use (ATU): A formal decision by the State Authorizing Official to approve the

State’s use of a system that already holds a valid Authorization (e.g., FedRAMP authorization, or another recognized authorization framework), based on review of the associated Authorization package and acceptance of the system’s risk posture; and authorized its use to support the

Agency’s mission and business purposes.

4.2 The Contractor shall provide the State with evidence in the form of external audit certifications of all required security documentation:

• Certificates of external audits where applicable e.g., ISO 27001 certificate

• Answers to an industry-standard SIG questionnaire

• Tables of contents for all relevant data security policies or standards

|Security Rider v8 8

The Contractor shall not permit State Data to reside in, or be processed by, any system until the State has formally reviewed and accepted the system’s Authorization package and security baseline compliance.

4.3 The Contractor shall implement and maintain appropriate physical, administrative, technical, and organizational security measures to safeguard against Security Incidents and Breaches. Where not defined in this Rider, such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own data of a similar kind and shall be periodically reviewed and updated, as needed.

4.4 The Contractor shall implement and maintain security and privacy controls meeting NIST SP 800-53 Rev.5

Moderate baseline or equivalent industry standards, with evidence in an SSP, SAR, POA&M, and Continuous

Monitoring Strategy. The Contractor shall perform authenticated vulnerability scanning of networks, hosts, containers, and applications at regular intervals (and after material changes), track findings in the POA&M, and meet the remediation timelines.

For cloud-based systems, the baseline includes the FedRAMP Moderate Security Control Baseline, which incorporates the NIST Moderate controls plus additional FedRAMP-defined control enhancements

4.4.1 The Contractor shall maintain a cybersecurity governance program aligned to NIST Cybersecurity

Framework v2.0 or equivalent industry standard, including the GOVERN function. The program will define risk appetite, roles, and decision rights; maintain a risk register; track POA&M.

4.4.2 The Contractor will (a) track and remediate CISA KEV items within mandated timelines; (b) perform automated asset discovery and vulnerability enumeration at regular intervals for all in-scope assets; (c) enforce controls to eliminate or harden internet exposed management interfaces.

4.4.3 If agreed to by both Parties, for any cloud service components, The Contractor will provide FedRAMP equivalent artifacts using FedRAMP templates (SSP, SAR, POA&M) and submit monthly continuous monitoring packages (including authenticated vulnerability scans, inventory, and POA&M updates) to the

State designee in writing.

4.5 Upon identification of a potential issue with using or maintaining State-provided infrastructure, the

Contractor shall identify and communicate the nature of the issue to the State designee in writing without delay, and, if feasible, outline potential remedies for the State’s consideration.

4.6 The Contractor acknowledges that it may create, receive from or on behalf of the State, or have access to, information and records that are subject to data protection laws or otherwise exempt from public disclosure under State or federal laws or regulations.

4.7 The Contractor shall not use or disclose State Data except as permitted to provide the Products and Services under the Master Contract and pursuant to this Rider, as required by law, or as otherwise authorized by the

State designee in writing.

4.8 The Contractor shall implement commercially reasonable non-disclosure agreements and shall limit knowledge of State Data to those personnel necessary to provide the Products or Services under the Master

Contract.

|Security Rider v8 9

4.9 The Contractor shall encrypt all Confidential Data at rest and in transit with controlled access and is FIPS validated (140-2 or -3)or equivalent industry standards. Any stipulation of encryption responsibilities will identify the specific roles and responsibilities of the State and the Contractor.

4.10 The Contractor shall utilize data redundancy techniques to prevent data loss. The Contractor shall perform offsite replication or backups in a secure, environmentally controlled facility.

4.11 The Contractor shall not allow Confidential Data on mobile devices, portable computing devices, or portable storage components, except as strictly necessary to provide the Products or Services under the Master

Contract or SLA, or as expressly permitted by the State designee in writing.

4.12 Where the State allows the Contractor to access Confidential Data on mobile devices, portable computing devices, or portable storage components, the Contractor shall implement security measures that address physical security and appropriate encryption, as well as a restriction on viewing Confidential Data in public or common areas.

4.13 The Contractor must maintain an accurate inventory of all devices that are allowed to access State Data and the individuals to whom they are assigned or who have access to such devices.

4.14 The Contractor must maintain and keep up-to-date antivirus and firewall software, firewall session tracking, and system password protection on any systems or devices (including mobile devices, portable computing devices, and portable storage components) that access State Data.

4.15 The Contractor must maintain and update system software patches on the systems and devices (including mobile devices, portable computing devices, and portable storage components) that access State Data.

4.16 The Contractor must maintain strong password security and multifactor authentication when accessing

State Data. This will include ensuring accounts have cryptographically strong passwords and storing passwords in a hashed or encrypted format.

4.17 If applicable, the Contractor shall integrate with the State’s identify management process by either (a) extending the State’s trust boundary into the Contractor’s domain using an identity management system with role-based user authentication and Authorization and synchronizing with the State’s active directory using federation or single sign-on technology; or (b) using a password sign-on for application-level security which aligns with industry standards for password strength.

4.18 The Contractor will apply industry standard frameworks (e.g., NIST security frameworks) for Application

Program Interfaces (APIs), authentication, and Authorization tasks.

4.19 The Contractor is strictly prohibited from using State Data to train AI or LLMs except if permitted by the

State designee in writing and if for the exclusive purpose of providing Products or Services to the State.

4.20 Where the use of AI is allowed by the State, the Contractor shall have safeguards in place to prevent State

Data from being exposed to public or external information systems. This restriction extends to

Subcontractors.

4.21 No later than 30 days after signing this Rider, the Contractor shall provide the documents outlined below to the State designee in writing. Each of these shall be updated and provided to the State designee (1)

|Security Rider v8 10 annually in writing, (2) when major changes, upgrades, or updates occur to the Products or Services provided under the Master Contract, and (3) following a Security Incident or Breach. The State and

Contractor shall work to understand each other’s roles and responsibilities with regards to intrusion protection.

• Certificates of external audits where applicable e.g., ISO 27001 certificate

• Answers to an industry-standard SIG questionnaire

• Tables of contents for all relevant data security policies or standards

5 Contractor Access to State Network Systems and Data

5.1 The Contractor shall maintain a robust boundary security capability that incorporates generally recognized system hardening techniques.

5.2 The Contractor shall determine which of their ports are required to support access to systems that hold

State Data and shall limit their access to only these ports, disabling all others.

5.3 The Contractor’s system network architecture shall separate internal systems from external information systems.

5.4 The Contractor shall use a demilitarized zone for handling public traffic, host-to-host management, Internet protocol specification for source and destination, packet filtering, and activity logging.

5.5 The Contractor shall maintain appropriate access control and Authorization policies, plans, and procedures.

The Contractor must use multifactor authentication to access State network systems or Contractor network systems that store, transmit, or otherwise contain State Data.

5.6 The Contractor shall have security policies, plans, and procedures for the handling, storage, backup, access, and, if appropriate, destruction of State Data. These must be commensurate with the moderate security baselines defined in NIST Special Publication (SP) 800-53 or equivalent industry standards, unless provided otherwise in this Rider or agreed to by the State designee in writing.

5.7 The Contractor shall employ appropriate intrusion and attack prevention and detection capabilities. Those capabilities must track unauthorized access and attempts to access State Data, as well as attacks on the

Contractor’s infrastructure associated with State Data.

5.8 The Contractor shall maintain event profiles to reduce false positives and rapidly detect active access.

5.9 The Contractor shall design and execute reports, at regular intervals, to identify anomalies in system logs.

5.10 The Contractor shall ensure logs are written to central log aggregation with 12-month online retention minimum for security logs, and with integrity controls and immutability for all servers.

5.11 The Contractor must use encryption to protect the confidentiality and integrity of transmitted information.

6 Data Centers and Location of Data

|Security Rider v8 11

6.1 Consistent with Wis. Stat. § 16.705(1r), the Contractor shall provide its Services under the Master Contract solely from within the United States.

6.2 The Contractor shall use data centers located in the United States and shall access data only from the

United States. The Contractor shall ensure the transmission and storage of State Data at rest is at data centers located in the United States. The Contractor shall not allow its personnel to provide Services, store, or access State Data on desktops, mobile devices, or portable computing devices from Contractor’s data centers while its personnel are located outside of the United States.

6.3 The Contractor shall perform physical security functions including, but not limited to, 24/7 controlled access, identification badge controls, and alarm responses, at any data centers housing State Data that are under the Contractor’s control.

7 Security Incidents and Breaches

7.1 The Contractor shall notify the State no later than 72 hours of confirming a compromise that impacts confidentiality, integrity, or availability of State Data. Initial notice may include, to the extent reasonably available at the time, the following data elements:

• Identify the current level of impact on Agency functions or Services (Functional Impact).

• Identify the type of information lost, compromised, or corrupted (Information Impact).

• A preliminary assessment summary to be provided when recovered from the incident

(Recoverability).

• Identify when the activity was first detected.

• An estimate of potential impact, if known.

• Summary of technical details, when confirmed and appropriate.

• Identify point of contact information for additional follow-up.

Important: Please refrain from adding sensitive personally identifiable information (PII) to incident submissions

7.2 Upon request, The Contractor shall provide updates until containment.

7.3 The Contractor shall notify the State designee of any confirmed or suspected to a reasonable degree of certainty Security Incidents or Breaches within 72 hours, for the State to take any actions it deems necessary.

7.4 The Contractor must notify the State designee of any of the Contractor’s disclosures of the Security Incident or Breach to law enforcement, news media, or any other third parties.

7.5 The Contractor must notify or assist the State designee in notifying regulatory or other governmental organizations and any affected individuals or entities the State deems appropriate or as required by federal or state law including, but not limited to, Wis. Stat § 134.98.

7.6 The Contractor shall preserve sufficient evidence to ensure accurate Security Incident or Breach records, facilitate any investigations internally, and determine the extent of the Security Incident or Breach.

|Security Rider v8 12

7.7 The Contractor shall cooperate fully with the State and, without delay, by providing a Security Incident or

Breach summary report to the State designee. At a minimum, the report will include the following:

• The data elements involved, the extent of the State Data involved, and the identities of any affected individuals or entities.

• The persons or entities known or reasonably believed to have improperly used or disclosed

State Data and/or were responsible for the Security Incident or Breach.

• Where the Contractor believes the State Data was improperly transmitted, sent, or utilized.

• The probable causes of the Security Incident or Breach.

7.8 A proposed risk remediation and prevention plan for future Security Incidents or Breaches.

• The corrective actions the Contractor has taken or plans to take, including temporary workarounds and permanent fixes.

• Whether the Contractor believes any federal or State laws requiring notifications to individuals were triggered including, but not limited to, Wis. Stat § 134.98.

7.9 The Contractor must provide periodic follow-up reports to the State designee in writing until the

Contractor’s investigation of the Security Incident or Breach is complete. In the final follow-up report, the

Contractor shall identify the root cause of the Security Incident or Breach.

7.10 The State may conduct an independent investigation of the Security Incident or Breach with which the

Contractor shall cooperate by providing written incident summaries and responding to reasonable security questionnaires. An independent investigation may be conducted by a State Agency or a third party acting on behalf of the State. The State may require the Contractor to cover the cost of that investigation.

7.11 In the event of a Breach of Confidential Data the State, the Contractor shall provide a written incident summary (facts, impact to State data/services, root cause when known, remediation) and, upon request no more than annually, an industry‑standard SIG questionnaire response, ISO 27001 certificate, and security whitepaper.

7.12 Upon request from the State, the Contractor shall provide one or more of the following corrective action steps to limit the exposure of State Data and respond to the Security Incident or Breach:

a) Credit monitoring.

b) Toll free number for impacted customers.

c) Liability of the Contractor for a certain amount (up to the level of their cyber insurance policy).

d) Participation of all Contractor employees in incident breach drills.

e) All other deliverables the State deems necessary to remediate the Security Incident or Breach.

|Security Rider v8 13

8 Cancellation and Suspension of Service

8.1 During any period of Service suspension, the Contractor shall not intentionally erase or otherwise dispose of

State Data regardless of its format.

8.2 Upon cancellation of the Master Contract, the Contractor shall implement an orderly return of State Data in a mutually agreeable format and at a mutually agreeable time, or the Contractor shall allow the State to extract the State Data itself. Only after the State Data is returned and the State designee confirms receipt of the State Data in writing may the Contractor securely dispose of it.

8.3 The Contractor shall ensure no State Data is deleted in violation of the Wisconsin Public Records Law and the record retention requirements from the Master Contract.

8.4 Upon cancellation of the Master Contract, unless legally prohibited, the Contractor shall securely dispose of all State Data regardless of its format unless stipulated otherwise by the State designee in writing. State

Data shall be permanently destroyed and shall not be recoverable, in accordance with NIST 800-88 Revision

1. Certificates of destruction shall be provided to the State designee upon completion.

8.5 The State shall be entitled to any assistance post cancellation of the Master Contract that the Contractor would generally make available with respect to the provided Products and Services.

9 Security Audits

9.1 Upon the agreement of both Parties the State may perform a security audit to review the Contractor’s conformance to this Rider. A State Agency may perform this audit, or the State may contract with a third party as its authorized representative, at the State’s discretion and expense. The State or its authorized representatives will have access to anything necessary to review the Contractor’s compliance with this

Rider or pertaining to any facts related to any claim against the Contractor that may be chargeable to the

State or its property. The Contractor shall cooperate with the State and its authorized representative in performance of a security audit.

9.2 As part of the security audit, the State or its authorized representative may conduct vulnerability scans and full penetration testing. Penetration testing may be conducted internally or externally on the hardware, software, or firmware components of a system, and may test both physical and technical controls.

9.3 As part of the security audit, the State or its authorized representative may require that the Contractor provide information regarding the security and access of State Data, but not limited to, latency statistics, user access, user access IP address, user access history, and security logs. The Contractor will also provide the following information and services to the State or its authorized representative, upon its request:

a) A review on the Contractor’s hardware and software assets. This may include, but is not limited to, information regarding deviations from the hardware baseline, an inventory of information types by hardware device, a software inventory compared against State purchased licenses, and the software versions and scans of the software against patches distributed and applied.

b) A review of the Contractor’s boundary defenses. This may include, but is not limited to, working with the State to support the denial of communications to and from known malicious IP

|Security Rider v8 14 addresses, ensuring that the system network architecture separates internal systems from external information systems and that multifactor authentication is used when required under this Rider, cooperating with the State’s monitoring and management of devices remotely logging into the internal network, and ensuring sufficient configuration of firewall session tracking mechanisms.

c) An audit log review. This may include, but is not limited to, validating the audit log settings for hardware and software, ensuring that all systems and environments have adequate space to store logs, creating and implementing profiles of common events to reduce false positives and rapidly identify active access, configuring operating systems to log access control events, creating periodic reports of anomalies in system logs, and ensuring audit logs are written to write-only devices for all servers or a dedicated server managed at an alternative storage site.

d) A review of application software security. This may include, but is not limited to, performing a configuration review of operating system, application, and database settings; and training for software development personnel in secure code development.

e) A review of system administrator access. This may include, but is not limited to, providing an inventory of all administrative passwords (application, database, and operating system level), configuring accounts to require regular password changes, ensuring user and service level accounts have cryptographically strong passwords and that they are stored in a hashed or encrypted format, and reviewing administrative privileged functions.

f) A review of account management and access privileges. This may include providing an inventory of user IDs and passwords; updating the processes for establishing and revoking system access;

disabling unnecessary, unauthorized, or dormant accounts; creating a daily report on locked out accounts and disabled accounts; ensuring users are automatically logged off after three (3) unsuccessful log-in attempts after 120 minutes and after a period of inactivity; monitoring access attempts to deactivated accounts; profiling typical account usage; and properly maintaining security profiles.

9.4 The Contractor will bear the cost and responsibility for resolving any issues that exist in the Products or

Services provided to the State pursuant to the Master Contract, except if an issue exists in the resources furnished by the State (e.g., code, systems, computer hardware and software). The State may elect to work with the Contractor under mutually agreeable terms for resolution of any found issues, or the State may elect to address the issues independently of the Contractor.

9.5 Any issues found during the security audit must be resolved to the State’s satisfaction. Unless the

Contractor receives the State’s approval, the Contractor will not proceed with Contract work until the State tests and approves the Contractor’s resolution.

9.6 Results of the security audit shall be sent to the Contractor and the State, if performed by a third party, within seven (7) business days of completion. The results shall include a complete copy of any certifications, scans, and tests conducted.

10 Data Center Audits

|Security Rider v8 15

10.1 Upon both Parties agreement to conduct, annually, and upon request by the State in response to a Breach of Confidential Data, the Contractor shall perform and bear the cost of an independent audit of its data centers. FedRAMP ATO and Service Organization Control (SOC) 2 audit report, or an equivalent approved by the State CISO or designee in writing, shall set the minimum requirements of the audit. The Contractor shall provide the unredacted audit report to the State designee in electronic format within seven (7) business days of completion. The report shall include a complete copy of any certifications, scans, and tests conducted. The Contractor may only remove its Trade Secret from the un-redacted audit report before providing it to the State.

11 Support Responsibilities and Uptime Guarantee

11.1 The Contractor shall be responsible for the acquisition and operation of all hardware, software, and network support related to the Products or Services provided under the Master Contract. The Contractor shall also be responsible for the technical and professional activities required for establishing, managing, and maintaining the environments. All systems shall be available and accessible to customers and the State, except when agreed to by the State designee and Contractor in writing for maintenance downtime.

12 Subcontractor Disclosure

12.1 The Contractor shall maintain and provide to the State, a current roster of all Subcontractors and personnel with access to State systems, data, or facilities and involved in providing Products or Services pursuant to the Master Contract or the Rider. The roster shall include the Subcontractor's name, personnel’s name, role, access level, and Authorization status. The Contractor shall provide the roster before the start of work and as a monthly update. The Contractor shall also ensure that only rostered Subcontractors and personnel are granted access.

12.2 The Subcontractors providing Products of Services to the State pursuant to the Master Contract shall be subject to the terms of this Rider. The State shall assess and manage granting access to these

Subcontractors. These Subcontractors shall not be permitted to access State Data unless needed to provide

Products or Services under the Master Contract.

12.3 The Contractor shall be responsible for the actions of the Subcontractors when related to providing

Products or Services pursuant to the Master Contract.

13 Annual Review

13.1 The Contractor must meet with the State designee at least annually to review the requirements of this

Rider and any of the Contractor’s related documents, plans, policies and/or updates. These reviews will include, but are not limited to:

a) Reviewing the Contractor’s list of AI Services, Products, and companies annually provided to the

State per Section 3.5 of this Rider.

b) Certificates of external audits where applicable e.g., ISO 27001 certificate

c) Answers to an industry-standard SIG questionnaire

|Security Rider v8 16

d) Tables of contents for all relevant data security policies or standards

e) Ensuring the Contractor remains in compliance with the State’s Acceptable Technology Use, Access and Security Policy or Contractor’s ISO 27001 certified policy for personnel with access to the

State’s IT resources.

13.2 The Contractor must perform an annual disaster recovery test and correct any issues detected during the test within the time per Contractor policies. Upon the State’s request, the Contractor shall provide the test’s result confirmation, test type, scope, date of test.

14 Notification process

14.1 All notifications or other communications required under this Rider shall be provided to the contact listed below:

State designee:

To be determined by Agency at time of purchase order.

Contractor designee:

Will McGuire, Contract Manager will.mcguire@gartner.com

571-683-4482

Docusign Envelope ID: 1BB0B196-9009-8083-82EF-FD82E9060B1A https://detcc.wi.gov/Shared%20Documents/AUP%20-%20Effective%20Date%203.10.2025.pdf https://detcc.wi.gov/Shared%20Documents/AUP%20-%20Effective%20Date%203.10.2025.pdf