Information Security and Privacy Requirements Exhibit X

This is an Information Security and Privacy Requirements exhibit for a Request for Bids issued by the State of California, Department of General Services, for the annual renewal of software maintenance services for the Komprise data management and analytics platform (RFB-IS-26200913). The procurement seeks to renew the existing software maintenance agreement, with deliverables encompassing ongoing technical support, software updates, and platform maintenance services for a one-year renewal period aligned with the existing annual maintenance cycle. The proposal submission deadline is May 18, 2026, with contract award and commencement anticipated following standard evaluation and approval procedures. Bidders must meet all mandatory requirements outlined in the required forms appendix, demonstrate appropriate certifications and insurance coverage, and comply with California state procurement regulations and administrative standards.

The exhibit establishes comprehensive Information Security and Privacy Requirements mandating vendor compliance with California privacy laws and federal standards, including encryption protocols, audit logging capabilities, incident response procedures, and regular security assessments. Vendors must adhere to Business Associate Agreement (BAA) policies addressing inadvertent access procedures for protected health information and establish documented incident response protocols throughout the contract term. Komprise is identified as the incumbent vendor currently providing software maintenance services, with qualified alternative vendors eligible to submit competitive bids. Certified Business Enterprise (CBE) participation is required or encouraged, with preferences potentially available for small business participation, including minority-owned and women-owned business enterprises. Funding for this maintenance renewal is sourced from the Department of General Services' operating budget allocated for software licensing and support services, with successful bidders required to integrate with existing Komprise infrastructure already deployed within California state government systems.