IFB_25-0202780_Exhibit_A_-_SOW.pdf

STATE OF CALIFORNIA CONTRACTOR TBD

DEPARTMENT OF TECHNOLOGY PO 25-TBD / IFB No. 25-0202780

EXHIBIT A

STATEMENT OF WORK

1. Contract Description:

CONTRACTOR TBD (hereinafter referred to as “the Contractor”) agrees to provide the California Department of Technology (hereinafter referred to as the “State,” “CDT,” and/or the “Licensee”) with the SSAName3 and IDS Legacy Software Support Renewal, as listed on Page 1 of IFB No. 25-0202780 and on Exhibit C – Cost Worksheet of this Agreement.

2. Licensee Site/Location:

The “Licensee Site” shall mean CDT, as identified in this Agreement, which Licensee represents, is operated or controlled by the Licensee. The Licensee may change the Licensee Site to another location located within the United States without incurring additional charges provided that the licensed CPU Processor Group capacity for each software has not been exceeded.

a. The “Licensee Site” shall mean location(s) identified in the table below. The Software Products may be used on or at the State’s designated site(s) on computers upon which the Software Products are installed to the extent that the aggregate MIPS capacity of the mainframe computers upon which the Software Products are installed does not exceed the licensed number of MIPS provided herein. “MIPS,” million instructions per second, is the capacity of the computers on which the Software Products are installed. MIPS shall be calculated by referencing Gartner’s MIPS Rating and the published schedule of MIPS capacity of processors. In the event any particular processor is not accounted for on Gartner’s MIPS Ratings/schedule, the manufacturer’s published specification of MIPS capacity shall control. Additional State owned or operated domestic (United States) sites designated by the State may be incorporated as part of this Agreement, at no additional cost, provided the aggregate number of MIPS capacity of the computers on which the Software Products are installed does not exceed the maximum MIPS level as provided in Section 3, License Type below.

CDT, Office of Technology Services

Gold Camp Campus Vacaville Campus 3101 Gold Camp Drive 1020 Vaquero Circle

Rancho Cordova, CA 95670 Vacaville, CA 95688

b. The State shall be permitted to use the Software Products as listed in Exhibit C of this Agreement on multiple mainframe CPUs. The only condition to use would be that the aggregate number of MIPS capacity of the computers on which the Software Products are installed does not exceed the maximum MIPS level as provided in Section 3, License Type below.

c. The State shall be permitted to use the Software Products listed in Exhibit C of this

Agreement for CDT’s customers to provide Electronic Data Processing (EDP) services. Additionally, the license to use the Software Products is extended to those independent contractors and interns hired by the State to perform at Licensee’s locations or on-site services for the State.

Additionally, the license to use the Software Products is extended to those independent contractors and interns hired by the State to perform services on behalf of the State, who perform services for Licensee, which are equivalent to services otherwise performed by Licensee’s employees (and which shall in no event include a commercial service bureau, facilities manager, or other third party that provides data processing services), provided such independent contractors and interns are bound in writing to comply with the non-disclosure provisions hereof.

d. The Contractor may require the State upon Contractor’s written request, and not more than annually, to complete a Contractor form providing written certification to verify that the Software Products are used in accordance with this Agreement, including the location, model, serial number and the aggregate MIPS capacity of the computers on which the Software Products are installed. Similarly, the Contractor may require a statement from the State verifying that the Software Products are being used only to provide EDP services for CDT’s customers. If it is determined that the Software Products are being used in the manner that exceeds the licensed MIPS capacity, the State shall pay the licensee fee(s) (as well as Support Services fees and any applicable taxes) specified in this Agreement.

3. License Type: CPU/MIPS Based License. Licensed for up to 14,000 MIPS.

a. In accordance with provisions of this Agreement, the Contractor hereby grants the State, and the State accepts from the Contractor, a non-exclusive, non-cancelable (except as provided under the DGS PD 403-ITGP Non-Cloud (“General Provisions”)), non-transferable, non-assignable, perpetual license to use all versions, enhancements and modifications of the Software Products listed in Exhibit C, Cost Worksheet, and shall survive the expiration or termination of the Agreement. Software Support Services are included for the Software Products listed in Exhibit C, Cost Worksheet for term provided in the section below.

4. Term: April 10, 2026 through April 9, 2029.

5. Installed on:

• IBM 3931-A01 504 (z16) SN E73AB | 3,440 MIPS | Vacaville Campus

• IBM 8561-T01 505 (z15) SN 48266 | 3,512 MIPS | Vacaville Campus

• IBM 8561-T01 503 (z15) SN EBDE4 | 2,178 MIPS | Gold Camp Campus

• IBM 3906-M01 505 (z14) SN 2A13A | 3,355 MIPS | Gold Camp Campus

12,485 MIPS Total

6. Notices:

All notices required by or relating to this Agreement shall be in writing and shall be sent to the parties of this Agreement at their address as set below unless changed from time to time, in which event each party shall notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail and directed to the following addresses:

The technical representative during the term of this Agreement will be:

State Agency Manufacturer CDT, Office of Technology Services Informatica LLC

Attn: Gerald Clift Attn: Support Phone: (916) 800-8520 Phone: (877) 463-2435 E-mail: Gerald.Clift@state.ca.gov Web: https://network.informatica.com/s/ mailto:Gerald.Clift@state.ca.gov https://network.informatica.com/s/

Contract inquiries should be addressed to:

State Agency Contractor

CDT, Acquisitions & IT Program Management Branch CONTRACTOR TBD Attn: Lindsey Eagle Attn: TBD Address: PO Box 1810

Rancho Cordova, CA 95741 Address: TBD

Phone: (279) 216-0611 Phone: TBD E-mail: Lindsey.Eagle@state.ca.gov E-mail: TBD

7. Acceptance of Software:

The State hereby acknowledges that on the Effective Date, the Software Products are accepted by the State for all purposes under this Agreement.

8. Licensee Software Support Services:

The Contractor shall ensure that Support is provided by the manufacturer, Informatica LLC, throughout the term of the Agreement.

a. Phone Support: (877) 463-2435

b. Website: https://network.informatica.com/s/

Notwithstanding any term or condition to the contrary in the General Provisions, Software License fees and fees paid for the first year of Software Support Services are non-cancelable, non-refundable and non-contingent. Funds for the Software Support Services have been appropriated subject to the Budget Contingency Clause, Exhibit B, item 2.

Subject to payment of the applicable annual Software Support Services fee (“Support Fees”), Informatica agrees to provide the following software support services (“Support Services”) for the Software, with such Support Services to commence upon delivery of the Software:

a. Error Correction. Upon receipt from Licensee of notice of a problem with the Software

(which problem can be reproduced at an Informatica support facility or via remote access to Licensee’s facility), Contractor shall use reasonable efforts to correct or circumvent the problem.

b. Updates. Contractor shall notify Licensee of all new support releases (collectively “Updates”) for the Software. Contractor shall make available to Licensee, at no additional charge, all currently supported Updates that are developed or published by Informatica and made generally commercially available to Informatica Support Services customers at no additional charge. Updates shall not include any option or future products which Informatica licenses separately.

c. Product Lifespan. A product release of the Software shall be supported for a period of eighteen (18) months from the date of general availability of a subsequent major product release. For example, release 8.x shall only be supported for a period of eighteen (18) months after the general availability of release 9.0.

d. Assistance. Contractor shall provide Licensee with access to technical support engineers for assistance in the proper installation and use of the Software, and to report and resolve Software problems. The hours for such assistance depends on the level of Support Services purchased by Licensee and are posted for Licensee’s reference on the Customer Support Services portal.

e. If Licensee cancels Support Services for the Software, Licensee may continue to use the Software pursuant to the license granted hereunder, but will not be entitled to receive Support Services for such Software. To reinstate Support Services, Licensee must pay to Informatica all accumulated Support Fees for the period during which Licensee did not mailto:Lindsey.Eagle@state.ca.gov https://network.informatica.com/s/ purchase Support Services and the Support Fees for the annual term in which Licensee re-enrolls the Software licenses under Support Services. Licensee must also upgrade the Software to a Software release supported by Informatica pursuant to Section (c) above.

f. If Licensee chooses to install Updates made available pursuant to this Agreement, Licensee must uninstall and cease use of all previous versions of the Software so that Licensee’s use of the Software corresponds to the number of licenses purchased for the Software.

g. The CDT designates 1020 Vaquero Circle, Vacaville, California 95688, and 3101 Gold Camp Drive, Rancho Cordova, California 95741, as the sites for delivery of support services during the term of the Agreement. The designated sites will receive, directly from the software manufacturer, all product shipments, technical information, telephone support, improvements, fixes, modifications, changes or new releases to the version of the Software Products during the term of the Agreement. Licensee may change the Licensee Site to another location located within the United States without incurring additional charges provided the licensed CPU Processor Group or MIPS level capacity for each Program Product has not been exceeded.

h. Notwithstanding any term or condition to the contrary, all software deliveries are via electronic download. The Licensee shall take all requisite steps to ensure that the Licensee is able to accept electronic delivery of the Contractors software and related support services. Unless requested otherwise as set forth below, the Software, Documentation and all Updates furnished under Support Services shall be shipped via electronic delivery. Licensee acknowledges that such electronic transfer shall satisfy Informatica’s Software delivery requirements under the Agreement, and Informatica shall have no obligation to deliver the Software on tangible media to Licensee.

Thereafter, annual Support renewal will be available subject to payment of Licensor's then prevailing annual Support fee; however, the total Support charges shall not exceed the prior year's support charges by more than 5 percent (5%).

9. Superseding Technologies:

During the term of this Agreement, the State shall be entitled, without additional charge, to any new release, enhancement, updates, modifications, or supersets of any of the Contractor’s Software Products licensed in Exhibit C that the Contractor makes generally available without additional charge to its other Customers licensed for the same products.

10. Software Product CPU Identification Authorization Codes:

The State hereby acknowledges that at each new license period, or if required as a result of hardware or software changes, the State must apply a new Product Authorization Code. The Product Authorization Code enables the Software Products to operate for its designated term. If applicable, the Contractor will provide the State with the valid annual authorization code for the Software Products licensed herein upon payment of the annual license fees. If the State notifies the Contractor prior to the expiration of this Agreement that it will be exercising its option to renew the contract, and the new Agreement has not been approved and/or payment of the license fees set forth in the new Agreement has not been received, then the Contractor agrees to issue to the State a thirty (30) calendar day temporary Product Authorization Code during contract approval and/or execution of payment. After the Product Authorization Code is provided, except as otherwise allowed in the General Provisions, refunds are not available. The Product Authorization Code is not a harmful code, as defined in Section 4.4 of the General Provisions.

Within 24 hours of receipt of notification from the State that a change in a designated CPU has occurred, the Contractor will use reasonable efforts to issue a temporary encryption identification authorization code for use on a newly designated CPU.

11. Additional MIPS:

The State may acquire additional MIPS for the Software Products listed in Exhibit C during the term of this Agreement by paying the fees and by executing an amendment to this Agreement.

12. Price/Cost Changes:

Prices/costs established in Exhibit C of this Agreement are not subject to change during the term of this Agreement.

13. Documentation:

The Contractor agrees to provide the State, if not previously provided, one (1) copy of all manuals and all other associated printed materials and updated versions thereof, which are necessary or useful to the State in its use of the Software Products provided hereunder.

Such materials will be provided only for Software Products that the Contractor provides updated versions to other customers at no cost. The State acknowledges that such documentation is proprietary to the Contractor.

Licensee shall have the right to print copies of the softbound version of the documentation provided with the Software (“Documentation”) in the form generally available and post the PDF format of the Documentation on Licensee’s own intranet solely for Licensee’s internal use. Licensee shall not have the right to make copies of the hardbound version of the Documentation.

14. Rights in Work Product (Continued from General Provisions Section 9.1.1)

The following is added to Section 9.1.1 of the General Provisions: Copyright notices and other proprietary rights notices in the Software Products shall not be deleted or modified.

The State is not authorized to use any of the Contractor’s trade names, trademarks or logos.

The State shall not reverse engineer, disassemble or decompile the Software Products or otherwise attempt to recreate the source code, which is the Contractor’s trade secret.

15. Title and Confidentiality of Software Products:

Title to the Software Products remains with the Licensor. To the maximum extent permitted by applicable law, the Licensee and its employees shall keep the Software Products confidential, and the Licensee will not disclose or otherwise distribute any Software Product to anyone other than Licensee’s authorized employees, and contractors engaged by the Licensee who have agreed to comply with the confidentiality and use restrictions of the contract (“Consultants”). Unless Licensor consents in writing, the Licensee will not give access to the Software Products to anyone other than its employees and the Consultants hired by the Licensee. The Licensee will not decompile, disassemble, or otherwise reverse engineer any Software Product. Contractor owns all rights to all derivatives of the Software Products developed prior to this Agreement, including but not limited to bug fixes, patches, updates, etc. The State fully retains its “Government Purpose Rights” set forth in Section 9.2 of the General Provisions. Any reference to a “sale” of Contractor intellectual property is deemed to be a grant of a license and not an actual transfer of ownership. Contractor reserves all intellectual property rights not specifically granted hereunder. All Contractor software, code, product development and marketing plans, and non- public financial and human resources data, material and information are confidential and may not be disseminated to any third party.

16. Disaster Recovery:

Licensee hereby certifies to Contractor that it has a bona fide disaster recovery plan with respect to the computer software programs used in its operations. Licensee may make one

(1) copy of the Software Products for archival purposes and use such archival copy on an alternative CPU, or at an installation site other than the Licensee Site identified in Section 5 of this Agreement. Such alternative CPU or installation site is to be owned or controlled by the licensee. The use of such archival copy shall be limited:

a. For the purpose of conducting limited testing of the disaster recovery plan’s procedures and effectiveness (which testing shall not exceed 10 days in any three (3) month period) and,

b. During any period subsequent to the occurrence of an actual disaster during which the Licensee cannot operate the Software on the then-current authorized CPU(s), site identified in Section 5, Installed On.

17. Amendments:

Consistent with the terms and conditions of the original solicitation, and upon mutual consent, the CDT and the Contractor may execute amendments to this Agreement for quantity, time and/or money. No additional products or services can be added to this Agreement. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, and agreed upon by both parties and approved, as required. No verbal understanding or agreement not incorporated into the Agreement is binding on any of the parties.

18. Export Compliance:

Licensee shall observe all relevant import and export laws and regulations including, but not limited to, the regulations of the Office of Export Administration of the U.S. Department of Commerce.

19. Warranty:

Notwithstanding anything contrary in Section 8, “Warranties & Representations,” of the General Provisions, any Software Products or services warranties provided by Informatica pursuant to the Agreement shall be for a period of 90 days from the initial delivery of the Software Products.

Notwithstanding the content of Section 8 of the General Provisions, Informatica warrants only against Informatica’s specifications for the Software Products in accordance with the Software Products’ then current technical documentation and not in accordance with the other provisions listed in Section 8 of the General Provisions. Licensee’s sole remedy in the event of Informatica’s breach of the foregoing warranties shall be the repair or replacement of the defect causing the non-conformance or, if such repair or replacement is not commercially feasible, Licensee shall be entitled to receive, upon return of the Software Products and termination of the services, a pro-rated refund solely of the support fees paid and unused for the Software Products. Other warranties including warranty of merchantability and fitness for particular purpose are expressly disclaimed. The parties agree that nothing contained herein shall prevent either party from seeking injunctive or other appropriate relief in a court of appropriate jurisdiction in the event of emergency circumstances. The preceding sentence shall not relive Contractor of any obligation(s) delineated in Section 4.3 of the General Provisions, under any circumstances.

20. Cancellation Provisions:

CDT may exercise its option to terminate the resulting Agreement at any time with thirty (30) calendar days’ prior written notice.

21. Federal Tax Administration Requirements

CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least forty-five (45) calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075.

Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately, per the Non-Cloud Goods & Services - General Provisions – Information Technology (403-ITGP), clause 16.3, Termination for Default. In conformation with IRS Publication 1075, Contractor must comply with Exhibit D - Special Terms and Conditions to Safeguard Federal Tax Information.

22. Security and Data Protection Requirements:

CDT must ensure agreements with state and non-state entities include provisions which protect and minimize risk to the state when engaging in the development, use, or maintenance of information systems, products, solutions, or services. The Contractor must comply with the State Administrative Manual (SAM) Section 5305.8.

23. Purpose Clarification:

The purpose of this Statement of Work is to renew the SSAName3 and IDS Legacy software support. This Agreement is not a contract for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, support, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes. The Contractor is not engaging in the development, use, or support of information systems, products, solutions, or services.

24. Other Requirements:

a. In the event of any conflict among the Exhibits, such conflict shall be resolved in accordance with the Order of Precedence set forth in Section 3 of the General Provisions.

Information Technology – General Provisions, Non-Cloud Goods and Services Effective 02/20/2025 (DGS PD 403-ITGP Non-Cloud):

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document- Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised- 02202025.pdf

b. Third party software provided with the Informatica Software may not be used independently of Informatica Software. Licensee may only make copies of the software as per Section 6.5 herein. Informatica assumes no responsibility or liability for any data or information that the Licensee may process with the Software. Licensee is the sole data controller and is responsible for the security of any information processed by the software. The preceding two sentences shall not be interpreted so as to negate or dilute any section of the General Provisions or any warranty provided herein. The parties agree that notwithstanding any term or condition herein to the contrary, Contractor shall maintain insurance coverage consistent with current coverage as evidenced in Contractor’s current certificates of insurance. State will approve settlements that are in accordance with Section 2.2.1, 11.3, of the General Provisions. General Provisions Section 12.1 shall at all times be interpreted in accordance with prevailing and applicable California Law. All Informatica Software, code, product development and marketing plans, business methods and non-public financial and human resources data, materials and information are deemed covered by Section 4.1 of the General Provisions.

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf

25. Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act (33 U.S.C. 1251-1388).

The Contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).

26. Generic Audit Clause

With a minimum of ninety (90) days advance written notice, Contractor may conduct an audit to verify State’s compliance with the software and license usage set forth in this Agreement.

Such audits shall be limited to once per 12-month period, and shall be conducted remotely, unless Contractor can reasonably demonstrate that onsite access to State facilities is necessary to verify State’s usage of software or licenses, in which case, express written consent to access such facilities shall be required and shall not be unreasonably withheld by the State.

All audits conducted pursuant to this section shall occur during the State's normal business hours and in a manner that minimizes disruption to the State's business and shall be commercially reasonable in nature and time. Contractor may use an independent third-party auditor to assist with such audits, provided that Contractor has a written confidentiality agreement in place with such an auditor, a copy of which shall be provided to the State upon request. The State agrees to cooperate in good faith with Contractor and any independent third-party auditor to respond to an audit conducted pursuant to this section.

For licenses in use by CDT but owned by other agencies, an agreement will be made on the scope of use and licenses to ensure clarity in the specific licenses to be audited.

Contractor shall provide the State with a copy of the results of any audit conducted under this section (“Audit Results”). The State shall have the opportunity to review the Audit Results, and within sixty (60) calendar days of receipt, notify the Contractor of any disputes. In the event of a dispute, the Parties shall work in good faith to resolve the dispute. In the event there are no disputes, and an overage has been identified, within thirty (30) calendar days of receiving the Audit Results, the State shall order overage fees to be agreed upon, a sufficient number of such software and licenses, including any applicable support, to cover its past or current use in excess of the usage identified in this Agreement.

EXHIBIT B

BUDGET DETAIL AND PAYMENT PROVISIONS

1. Payment and Invoicing:

a. Payment will be made annually in advance upon receipt of a correct invoice. The invoice shall include booking confirmation of the CDT Purchase Order;

including but not limited to, the product name, code (if applicable), and term date; and shall reference the Agency Order Number.

b. Payment Schedule:

FY 25/26 - $XXX,XXX.00 (Term: 4/10/2026 – 4/9/2027) FY 26/27 - $XXX,XXX.00 (Term: 4/10/2027 – 4/9/2028) FY 27/28 - $XXX,XXX.00 (Term: 4/10/2028 – 4/9/2029)

c. Submit your invoice using only one of the following options:

1) Send via U.S. mail in TRIPLICATE to:

California Department of Technology Administration Division – Accounting Office P. O. Box 1810 Rancho Cordova, CA 95741

OR

2) Submit electronically at: APInvoices@state.ca.gov

d. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.

2. Budget Contingency Clause:

a. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this contract and Contractor shall not be obligated to perform any provisions of this contract.

b. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Contract with no liability occurring to the State or offer a contract amendment to the Contractor to reflect the reduced amount.

mailto:APInvoices@state.ca.gov

EXHIBIT C

COST WORKSHEET

SSANAME3 AND IDS LEGACY SOFTWARE SUPPORT RENEWAL

Term: April 10, 2026 through April 9, 2029

(Placeholder for Vendor’s Quote)

EXHIBIT D

SPECIAL TERMS AND CONDITIONS TO SAFEGUARD FEDERAL TAX INFORMATION

Federal statute, regulations and guidelines require that all contracts for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes include the provisions contained in this Exhibit.

Contractor agrees to comply with 26 United States Code (U.S.C) §6103(n), as revised in the future, 26 Code of Federal Regulations (C.F.R) §301.6103(n)-1(a)(2) and (d), as revised in the future, and Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021, or as revised in the future), Section 2.C.8., 2.C.9, and Exhibit 7) and all applicable conditions and restrictions as may be prescribed by the IRS by regulation, published rules or procedures, or written communication to the Contractor.

Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021, or as revised in the future) https://www.irs.gov/pub/irs-pdf/p1075.pdf

EXHIBIT 7 SAFEGUARDING CONTRACT LANGUAGE

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and 202 obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1. (3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075.

The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

IRS Publication 1075 (Rev. 11/2021 or as revised in the future) Section 2.C.8, Control over Processing through 2.C.9, Service Level Agreements (SLA)

2.C.8 Controls Over Processing

The agency must establish adequate controls to prevent disclosing FTI to other state agencies, tax or non-tax, or to political subdivisions, such as cities or counties, for any purpose, including tax administration, absent explicit written IRS authority granted under IRC § 6103(p)(2)(B).

Processing of FTI in an electronic media format including removable media, microfilms, photo impressions or the conversion to other formats (including tape reformatting or duplication, reproduction or conversion to digital images or hard copy printout) will be performed as indicated in the environments listed in 2.C.8.1 and 2.C.8.2.

2.C.8.1 Agency-owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews.

2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities https://www.irs.gov/pub/irs-pdf/p1075.pdf

Recipients of FTI are permitted to use a shared facility but only in a manner that does not allow access to FTI by employees, agents, representatives, or contractors of other agencies using the shared facility.

For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes contractors and subcontractors.

Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply; for example, human services agencies administering benefit eligibility programs may not allow contractors or sub-contractors, including consolidated data center contractors, access to any FTI.

The agency must include, as appropriate, the requirements specified in Exhibit 7, Safeguarding Contract Language.

The agency, as well as its contractor, sub-contractor and shared sites that receive, process, store, access, protect and/or transmit FTI, are subject to Safeguard reviews.

These requirements also apply to releasing electronic media to a private contractor, sub-contractor or other agency office, even if the purpose is merely to erase the old media for reuse.

2.C.9 Service Level Agreements (SLA) Agencies using support functions, including, but not limited to, consolidated data centers, shared print facilities, and disaster recovery sites, must implement appropriate controls to ensure the protection of FTI. This includes a service level agreement (SLA) between the agency authorized to receive FTI and support functions. The SLA must cover the following:

• The agency with authority to receive FTI is responsible for ensuring the protection of all

FTI received. The state support function shares responsibility for safeguarding FTI.

• The Exhibit 7 language must be included in the SLA between the recipient agency and support functions and in all contracts involving contractors or sub-contractors hired by the state support function.

• The SLA provides written notification to the state support function’s management that they are bound by the provisions of Publication 1075, relative to protecting all FTI within their possession or control.

• The SLA shall detail the IRS’s right to inspect state support function facilities and operations receiving, processing, storing, accessing, protecting and/or transmitting FTI under this agreement to assess compliance with requirements defined in IRS Publication 1075. The SLA shall specify that IRS’s right of inspection includes the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI.

• The SLA shall detail the state support function’s responsibilities to address corrective action recommendations to resolve findings of noncompliance identified by IRS inspections.

• The agency will conduct an internal inspection of the state support function every 18 months, as described in Section 2.D.3, Internal Inspections. Multiple agencies sharing a state support function such as a consolidated data center may partner together to conduct a single, comprehensive internal inspection. However, care must be taken to ensure agency representatives do not gain unauthorized access to other agencies’ FTI during the internal inspection.

• The employees from the state support function with access to or use of FTI, including system administrators and programmers, must:

1. Meet the background check requirements defined in Background Investigation

Minimum Requirements and

2. Receive disclosure awareness training and sign a confidentiality statement, prior to initial access to or use of FTI, as well as annually thereafter. These provisions also extend to any contractors or sub-contractors hired by the state support function that have authorized access to or use of FTI.

• The specific data breach incident reporting procedures for all state support function employees, contractors and sub-contractors must be covered. The required disclosure awareness training must include a review of these procedures.

• Responsibilities must be identified for coordination of the 45-day notification of the use of contractors or sub-contractors with access to FTI.

• Require a formal sanction process for individuals covered by the SLA for failing to comply with established FTI security policies and procedures. Notification of designated agency personnel is required within 72 hours when the formal sanction is a proposed disciplinary or adverse action involving an unauthorized access or disclosure of FTI and must include the date the unauthorized access or disclosure of FTI occurred.

Generally, consolidated data centers are operated either by a separate state agency (e.g., Department of Information Services) or by a private contractor or sub-contractor. If an agency is considering transitioning to either a state-owned or private vendor consolidated data center, the Office of Safeguards strongly suggests the agency submit a request for discussions with Safeguards as early as possible in the decision making or implementation planning process. The purpose of these discussions is to ensure the agency remains compliant with safeguarding requirements during the transition to the consolidated data center.

Disclosure awareness training videos produced by the IRS can be found at:

https://www.irs.gov/privacy-disclosure/irs-disclosure-awareness-videos

REFERENCES

26 U.S.C. §6103(n) Confidentiality and disclosure of returns and return information

(n) Certain other Persons Pursuant to regulations prescribed by the Secretary, returns and return information may be disclosed to any person, including any person described in section 7513(a), to the extent necessary in connection with the processing, storage, transmission, and reproduction of such returns and return information, the programming, maintenance, repair, testing, and procurement of equipment, and the providing of other services, for purposes of tax administration.

26 C.F.R. §301.6103(n)-1 Disclosure of returns and return information in connection with written contracts or agreements for the acquisition of property or services for tax administration purposes.

(a) General rule.

(1) Pursuant to the provisions of section 6103(n) of the Internal Revenue Code and subject to the conditions of this section, officers and employees of the Treasury Department, a State tax agency, the Social Security Administration, or the Department of Justice, are authorized to disclose returns and return information (as defined in section 6103(b)) to any person (including, in the case of the Treasury Department, any person described in section 7513(a)), or to an officer or employee of the person, for purposes of tax administration https://www.irs.gov/privacy-disclosure/irs-disclosure-awareness-videos https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-934396624-1069627217&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-536286780-1069627218&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-934396624-1069627217&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-536286780-1069627218&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-451060365-1069627220&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-451060365-1069627220&term_occur=999&term_src= https://www.law.cornell.edu/topn/irc https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=ce15809edeb1ba34ad35438ab4f8283a&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4213e3004a09e65224a9cea553071bb1&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4213e3004a09e65224a9cea553071bb1&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1

(as defined in section 6103(b)(4)), to the extent necessary in connection with a written contract or agreement for the acquisition of -

(i) Equipment or other property; or

(ii) Services relating to the processing, storage, transmission, or reproduction of returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services.

(2) Any person, or officer or employee of the person, who receives returns or return information under paragraph (a)(1) of this section, may -

(i) Further disclose the returns or return information to another officer or employee of the person whose duties or responsibilities require the returns or return information for a purpose described in this paragraph (a); or

(ii) Further disclose the returns or return information, when authorized in writing by the Internal Revenue Service (IRS), to the extent necessary to carry out the purposes described in this paragraph (a). Disclosures may include disclosures to an agent or subcontractor of the person, or officer or employee of the agent or subcontractor.

(3) An agent or subcontractor, or officer or employee of the agent or…