STATE OF DELAWARE

DEPARTMENT OF TECHNOLOGY AND INFORMATION

801 Silver Lake Blvd., Dover, Delaware 19904

PUBLIC AND NON-PUBLIC DATA OWNED BY THE STATE OF DELAWARE

State of Delaware Terms and Conditions Governing Cloud Services and Data Usage Agreement Contract/Agreement # _______________________________________________________________, Appendix__________ between State of Delaware and ________________________________________________ dated ____________________

This document shall become part of the final contract.

Public

Data Non

Public Data

1 Data Ownership: The State of Delaware shall own all right, title and interest in its data that is related to the services provided by this contract. The PROVIDER shall not access State of Delaware user accounts, or State of Delaware data, except (i) in the course of data center operations, (ii) in response to service or technical issues,

(iii) as required by the express terms of this contract, or (iv) at State of Delaware’s written request. All information obtained or generated by the PROVIDER under this contract shall become and remain property of the State of Delaware.

2 Data Usage: The PROVIDER shall comply with the following conditions. At no time will any information, belonging to or intended for the State of Delaware, be copied, disclosed, or retained by PROVIDER or any party related to PROVIDER for subsequent use in any transaction. The PROVIDER will take reasonable steps to limit the use of, or disclosure of, and requests for, confidential State data to the minimum necessary to accomplish the intended purpose under this agreement. PROVIDER may not use any information collected in connection with the service issued from this proposal for any purpose other than fulfilling the service. Protection of Personally Identifiable Information (PII, as defined in the State’s Terms and Conditions Governing Cloud Services and Data Usage Policy), privacy, and sensitive data shall be an integral part of the business activities of the PROVIDER to ensure that there is no inappropriate or unauthorized use of State of Delaware information at any time. The PROVIDER shall safeguard the confidentiality, integrity, and availability of State information. No party related to the PROVIDER or contracted by the PROVIDER may retain any data for subsequent use in any transaction that has not been expressly authorized by the State of Delaware.

3 Termination and Suspension of Service: In the event of termination of the contract, PROVIDER shall implement an orderly return of State of Delaware data in CSV, XML, or another mutually agreeable format. The PROVIDER shall guarantee the subsequent secure disposal of State of Delaware data.

a) Suspension of services: During any period of suspension, contract negotiation, or disputes, the PROVIDER shall not take any action to intentionally erase any State of Delaware data.

b) Termination of any services or agreement in entirety: In the event of termination of any services or agreement in entirety, the PROVIDER shall not take any action to intentionally erase any State of Delaware data for a period of ninety (90) days after the effective date of the termination. All obligations for protection of State data remain in place and enforceable during this 90-day period. After such 90- day period has expired, the PROVIDER shall have no obligation to maintain or provide any State of Delaware data and shall thereafter, unless legally or contractually prohibited, dispose of all State of Delaware data in its systems or otherwise in its possession. Within this 90-day timeframe, the PROVIDER will continue to secure and back up State of Delaware data covered under the contract.

c) Post-Termination Assistance: The State of Delaware shall be entitled to any post-termination assistance generally made available with respect to the Services unless a unique data retrieval arrangement has been established as part of the Service Level Agreement.

d) Secure Data Disposal: When non-public data is provided by the State of Delaware, the PROVIDER shall destroy all requested data in all of its forms (e.g., disk, CD/DVD, backup tape, paper). Data shall be permanently deleted, and shall not be recoverable, in accordance with National Institute of Standards and Technology (NIST) approved methods after ninety (90) days of the contract termination. The PROVIDER shall provide written certificates of destruction to the State of Delaware.

PUBLIC AND NON-PUBLIC DATA OWNED BY THE STATE OF DELAWARE

State of Delaware Terms and Conditions Governing Cloud Services and Data Usage Agreement

Contract/Agreement # _______________________________________________________________, Appendix__________ between State of Delaware and ________________________________________________ dated ____________________

This document shall become part of the final contract.

Public

Data Non

4 Data Location: The PROVIDER shall not store, process, or transfer any non-public State of Delaware data outside of the United States, including for back-up and disaster recovery purposes. The PROVIDER will permit its personnel and subcontractors to access State of Delaware data remotely only as required to provide technical or call center support.

5 Encryption: The PROVIDER shall encrypt all non-public data in transit regardless of the transit mechanism. For engagements where the PROVIDER stores sensitive personally identifiable or otherwise confidential information, this data shall be encrypted at rest. The PROVIDER’s encryption shall be consistent with validated cryptography standards as specified in National Institute of Standards and Technology FIPS140-2, Security Requirements. The key location and other key management details will be discussed and negotiated by both parties. When the PROVIDER cannot offer encryption at rest, they must maintain, for the duration of the contract, cyber security liability insurance coverage for any loss resulting from a data breach in accordance with the Terms and Conditions Governing Cloud Services and Data Usage Policy.

6 Breach Notification and Recovery: The PROVIDER must notify the State of Delaware at eSecurity@delaware.gov immediately or within 24 hours of any determination of the breach of security as defined in 6 Del. C. §12B-101(2) resulting in the destruction, loss, unauthorized disclosure, or alteration of State of Delaware data. The PROVIDER shall send a preliminary written report detailing the nature, extent, and root cause of any such data breach no later than two (2) business days following notice of such a breach. The PROVIDER will continue to send any and all reports subsequent to the preliminary written report. The PROVIDER shall meet and confer with representatives of DTI regarding required remedial action in relation to any such data breach without unreasonable delay. If data is not encrypted (see CS3, below), Delaware Code (6 Del. C. §12B-100 et seq.) requires public breach notification of any incident resulting in the loss or unauthorized disclosure of Delawareans’ Personally Identifiable Information (PII, as defined in Delaware’s Terms and Conditions Governing Cloud Services and Data Usage Policy) by PROVIDER or its subcontractors. The PROVIDER will assist and be responsible for all costs to provide notification to persons whose information was breached without unreasonable delay but not later than sixty (60) days after determination of the breach, except 1) when a shorter time is required under federal law; 2) when law enforcement requests a delay; or 3) reasonable diligence did not identify certain residents, in which case notice will be delivered as soon as practicable. All such communication shall be coordinated with the State of Delaware. Should the PROVIDER or its contractors be liable for the breach, the PROVIDER shall bear all costs associated with investigation, response, and recovery from the breach. This includes, but is not limited to, credit monitoring services with a term of at least three (3) years, mailing costs, website, and toll-free telephone call center services. The State will retain all determining authority for breach accountability and responsibility.

The State of Delaware shall not agree to any limitation on liability that relieves the PROVIDER or its subcontractors from its own negligence, or to the extent that it creates an obligation on the part of the State to hold a PROVIDER harmless. The PROVIDER shall not issue a media notice without the approval of the State.

http://delcode.delaware.gov/title29/c100/index.shtml

Contract/Agreement # _______________________________________________________________, Appendix__________ between State of Delaware and ________________________________________________ dated ____________________

This document shall become part of the final contract.

Non

Background Checks: The PROVIDER must warrant that they will only assign employees and subcontractors who have passed a federally compliant (IRS Pub 1075 2.C.3) criminal background check. The background checks must demonstrate that staff, including subcontractors, utilized to fulfill the obligations of the contract, have no convictions, pending criminal charges, or civil suits related to any crimes of dishonesty. This includes but is not limited to criminal fraud, or any conviction for any felony or misdemeanor offense for which incarceration for a minimum of one (1) year is an authorized penalty. The PROVIDER shall promote and maintain an awareness of the importance of securing the State's information among the PROVIDER’s employees and agents. Failure to obtain and maintain all required criminal history may be deemed a material breach of the contract and grounds for immediate termination and denial of further work with the State of Delaware.

8 Security Logs and Reports: The PROVIDER shall allow the State of Delaware access to system security logs that affect this engagement, its data, and or processes. This includes the ability for the State of Delaware to request a report of the records that a specific user accessed over a specified period of time.

9 Sub-contractor Flow down: The PROVIDER shall be responsible for ensuring its subcontractors’ compliance with the security requirements stated herein.

10 Contract Audit: The PROVIDER shall allow the State of Delaware to audit conformance including contract terms, system security, and data centers, as appropriate. The State of Delaware may perform this audit or contract with a third party at its discretion at the State’s expense. Such reviews shall be conducted with at least thirty (30) days advance written notice and shall not unreasonably interfere with the PROVIDER’s.

business. In lieu of performing its own audit, the State may request the results of a third party audit from the PROVIDER or an attestation of compliance.

11 Cyber Liability Insurance: An awarded vendor unable to meet the Terms and Conditions Governing Cloud Services and Data Usage Policy requirement of encrypting PII at rest shall, prior to execution of a contract, present a valid certificate of cyber liability insurance at the levels indicated below. Further, the awarded vendor shall ensure the insurance remains valid for the entire term of the contract, inclusive of any term extension(s). Levels of cyber liability insurance required are based on the number of PII records anticipated to be housed within the solution at any given point in the term of the contract. Should the actual number of PII records exceed the anticipated number, it is the vendor’s responsibility to ensure that sufficient coverage is obtained (see table below). In the event that vendor fails to obtain sufficient coverage, vendor shall be liable to cover damages up to the required coverage amount.

Contract/Agreement # _______________________________________________________________, Appendix__________ between State of Delaware and ________________________________________________ dated ____________________

This document shall become part of the final contract.

The terms of this Agreement shall be incorporated into the aforementioned contract. Any conflict between this Agreement and the aforementioned contract shall be resolved by giving priority to this Agreement. By signing this Agreement, the PROVIDER agrees to abide by the following applicable Terms and Conditions [check one]:

FOR OFFICIAL USE:

1-3 (Public Data)

1-11 (Non-Public Data)

Provider Name/Address (print):

Provider Authorizing Official Name (print):

Provider Authorizing Official Signature:

Date:

Accessibility Report

Filename:

HSS-26-060 - AppD-Templates PSA, BAA & DTI T&Cs.pdf

Report created by:

Organization:

[Enter personal and organization information through the Preferences > Identity dialog.]

Summary

The checker found no problems in this document.

Needs manual check: 2

Passed manually: 0

Failed manually: 0

Skipped: 1

Passed: 29

Failed: 0

Detailed Report

Document

Rule Name Status Description

Accessibility permission flag Passed Accessibility permission flag must be set

Image-only PDF Passed Document is not image-only PDF

Tagged PDF Passed Document is tagged PDF

Logical Reading Order Needs manual check Document structure provides a logical reading order

Primary language Passed Text language is specified

Title Passed Document title is showing in title bar

Bookmarks Passed Bookmarks are present in large documents

Color contrast Needs manual check Document has appropriate color contrast

Page Content

Rule Name Status Description

Tagged content Passed All page content is tagged

Tagged annotations Passed All annotations are tagged

Tab order Passed Tab order is consistent with structure order

Character encoding Passed Reliable character encoding is provided

Tagged multimedia Passed All multimedia objects are tagged

Screen flicker Passed Page will not cause screen flicker

Scripts Passed No inaccessible scripts

Timed responses Passed Page does not require timed responses

Navigation links Passed Navigation links are not repetitive

Forms

Rule Name Status Description

Tagged form fields Passed All form fields are tagged

Field descriptions Passed All form fields have description

Alternate Text

Rule Name Status Description

Figures alternate text Passed Figures require alternate text

Nested alternate text Passed Alternate text that will never be read

Associated with content Passed Alternate text must be associated with some content

Hides annotation Passed Alternate text should not hide annotation

Other elements alternate text Passed Other elements that require alternate text

Tables

Rule Name Status Description

Rows Passed TR must be a child of Table, THead, TBody, or TFoot

TH and TD Passed TH and TD must be children of TR

Headers Passed Tables should have headers

Regularity Passed Tables must contain the same number of columns in each row and rows in each column

Summary Skipped Tables must have a summary

Lists

Rule Name Status Description

List items Passed LI must be a child of L

Lbl and LBody Passed Lbl and LBody must be children of LI

Headings

Rule Name Status Description

Appropriate nesting Passed Appropriate nesting

Back to Top