LAD24-2281_-_STATEMENT_OF_WORK.pdf

Department of Motor Vehicles RFQ # LAD24-2281 Section III

STATEMENT OF WORK

A. BACKGROUND

Postage machines and services required at Department of Motor Vehicles (DMV), at Driver Safety Offices as identified in attachments.

B. CONTRACT DESCRIPTION AND SCOPE

The purpose of this contract is to acquire a contractor to provide the DMV with the rental of postage systems; including all labor, tools, materials, equipment (including replacement meters), supervision, travel, shipping and handling costs, taxes, delivery, set up and removal of equipment, repairs, insurance and permit fees necessary to maintain the postage systems in good working condition for the term of this Agreement. The Contractor will provide these services at the following locations:

Driver Safety Offices as identified in Exhibit E, DMV Driver Safety Offices.

The Contractor shall commence work under this Agreement on the specified start date provided by the DMV Contract Manager following the execution of this Agreement by the State. The DMV Contract Manager shall provide the Contractor with written notification of the start date prior to the Contractor commencing work under this Agreement.

The services shall be provided during DMV business hours, Monday through Friday, 8:00 am - 5:00 pm, except State holidays, unless prior approval is obtained from the DMV Contract Manager.

The base term of this contract is 36 months.

It is understood that no funds sufficient for the purpose of this order have been appropriated until such time as the budget for each fiscal year covered by the agreement has been adopted by the Legislature and signed by the Governor.

C. CONTRACTOR’S RESPONSIBILITIES

1. The Contractor shall assume responsibility for completion of work identified in Exhibit A, Statement of Work and in accordance with Exhibit D, Information Security and Privacy Provisions (4/2022).

2. The Contractor Official responsible for overseeing completion of services, approval of Personnel Change Orders (PCO), and to whom all communications relative to those services be addressed is:

Name: To Be Determined

Telephone Number:

Email Address:

3. The Contractor shall comply with all applicable health and safety laws and regulations at the Contractor’s own expense. Upon notice by the DMV, the Contractor shall also comply with the DMV’s specific health and safety requirements and policies. The Contractor also agrees to include in any subcontract related to the performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice by the DMV, the DMV’s specific health and safety requirements and policies.

4. Contractor shall comply with the Department of Transportation Federal Motor Carrier Safety Administration Non-Discrimination Assurances located at:

https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/

5. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING

REQUIREMENTS:

A. If for this Contract the Contractor made a commitment to achieve small business participation, then the Department requires the Contractor upon completion of this Contract to report the actual percentage of small business participation that was achieved. (Govt. Code § 14841)

B. If for this Contract the Contractor made a commitment to achieve the disabled veteran business enterprise (DVBE) participation goal, then, pursuant to Mil. & Vets. Code § 999.5(d), upon completion of this Contract, the Department requires the Contractor to certify using the Prime Contractor’s Certification – DVBE Subcontracting Report (STD 817), all of the following:

(i) The total amount the prime Contractor received under the Contract;

(ii) the name, address, Contract number and certification ID number of the DVBE(s) that participated in the performance of this Contract;

(iii) the amount and percentage of work the prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor;

(iv) that all payments under the Contract have been made to the DVBE(s); and

(v) the actual percentage of DVBE participation that was achieved.

Upon request, the prime Contractor shall provide proof of payment for the work.

C. If for this Contract the Contractor made a commitment to achieve the DVBE participation goal, the Department will withhold $10,000 from the final payment, or the full final payment if less than $10,000, until the Contractor complies with the certification requirements above. The Contractor shall e-mail the STD 817 to dmvasdsbdvbeadvocate@dmv.ca.gov.

D. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 calendar days but not more than 30 calendar days from the date of written notice, the prime contractor refuses to comply with the certification requirements, the Department shall permanently deduct $10,000 https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/ mailto:dmvasdsbdvbeadvocate@dmv.ca.gov from the final payment, or the full payment if less than $10,000. (Mil. & Vets.

Code § 999.7).

E. A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code § 999.5(d); Govt. Code § 14841).

F. Contractor agrees to comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Mil.

& Vets. Code, including, but not limited to, the requirements of Section 999.5(d). (PCC Code § 10230).

6. Contractor must comply with Executive Order N-6-22, Economic Sanctions Against Russia Sanctions

The Executive Order is available at the following website:

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine- Executive-Order.pdf.

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals.

“Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

7. Postage Metering Via Ethernet Connection

All postage metering equipment provided by the Contractor must be capable of having postage filled or refilled via Ethernet at no additional cost to the DMV.

8. Relocations

a. The Contractor shall be notified in writing within two (2) weeks of any changes to the DMV locations.

b. The Contractor shall move the equipment to the new location specified by the

DMV Contract Manager, at no additional cost to the DMV. If the Contractor does not move the equipment to a new location, the DMV personnel or moving services contractor will move the equipment with the toner separated in plastic zip lock bag to avoid spillage of ink, unless otherwise specified by the Contractor.

9. In the event equipment fails, the Contractor agrees to provide loaner equipment within sixteen (16) hours to avoid service interruption at no additional cost to the DMV.

10. Equipment Deletions https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive-Order.pdf https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive-Order.pdf

DMV equipment deletions throughout the term of this Agreement shall be accomplished by written notice by the DMV Contract Manager to the Contractor.

11. Rented or Loaned Equipment

a. In the case of rented or loaned equipment, the DMV shall be relieved of all risks of loss or damage during the entire time the equipment is in the possession of the DMV, except when the loss or damage is due to fault or negligence on the part of the DMV. Rented or loaned equipment shall be returned to the Contractor in the condition it was received, less normal wear and tear, provided there is no loss or damage due to fault or negligence on the part of the DMV.

b. The Contractor agrees to provide maintenance, repair, and replacement services for all rented or loaned equipment throughout the term of this Agreement to ensure that the equipment remains in good operating condition at all times.

Maintenance shall be performed by trained and qualified technicians. If rented or loaned equipment needs to be removed from the DMV premises for repair or replacement, the Contractor shall immediately provide the DMV with replacement equipment of comparable capability.

c. The DMV shall not use special attachments, printing plates, or other devices on rented or loaned equipment unless otherwise approved by the Contractor in writing. The DMV shall only use supplies that meet the published specifications of the Contractor. DMV deletion of rented or loaned equipment throughout the term of this Agreement shall be accomplished by written notice to the Contractor.

12. The Contractor shall, upon termination or expiration of this contract, provide DMV with an editable or modifiable version of the source and deployment code developed pursuant to this contract.

D. DMV’S RESPONSIBILITIES

1. The DMV shall comply with all USPS (United States Postal Service) regulations regarding the use of the postage systems and the printing of postage.

2. Provide access to the DMV staff, management, offices and operation areas as required to complete the tasks defined under this contract.

3. The DMV Contract Manager is responsible for overseeing the Contractor’s performance, and the Contractor’s completion of requested services), Invoices and Personnel Change Orders (PCOs) is: for the DMV Driver Safety Offices is:

Name: TBD or

Name: TBD

E. CONTRACTOR TASKS AND DELIVERABLES

1. Contract Transition

A. The first four (4) weeks and the last four (4) weeks of this Agreement term are hereby identified as “Contract Transition” for transitioning the performance of services and/or equipment under existing agreements to new agreements with different contractors (when applicable) in order to prevent service interruptions.

B. During the first four (4) weeks of this Agreement term, the Contractor agrees to transition the performance of services and/or equipment required under this Agreement from other contractors under existing agreements when applicable. Only the equipment transition shall occur if the Contractor is a different contractor under the existing agreement.

C. Within two (2) business days of the execution of the Agreement, the Contractor shall submit Exhibit F, Transition Schedule, to the DMV Contract Manager identifying all proposed transition dates for each location identified within the Transition Schedule.

D. During the last four (4) weeks of this Agreement term, the Contractor agrees to transition the performance of services required under this Agreement to other contractors under other agreements when applicable.

E. The Contractor shall continue to provide services at an office under this

Agreement until transition to another contractor under another agreement has been completed or the contract expires, whichever occurs first.

2. Equipment Capability Requirement

A. The Bakersfield, Redding, Salida & Santa Rose DMV Driver Safety Offices, shall have a postage meter mailing machine with semi-automatic feeders and an integrated scale. The postage meter shall have the capability to seal and apply postage at a minimum rate of up to sixty-five (65) pieces of mail per minute, but no higher than a rate of up to eighty-five (85) pieces of mail per minute.

B. All locations, other than Bakersfield, Redding, Salida, Santa Rosa, listed in Exhibit E, DMV Driver Safety Offices, shall have postage meter mailing machines with an integrated scale and the capability to seal and apply postage at a minimum rate of up to one hundred twenty (120) pieces of mail per minute, but no higher than a rate of up to one hundred seventy-five (175) pieces of mail per minute.

3. Network Requirements

a. Device must be proxy aware, all internet traffic needs to go through DMV’s proxy.

b. All traffic must be initiated internally (no inbound traffic from outside).

c. Device must be kept up to date on security patching.

d. Must perform pre and postproduction vulnerability scans.

e. If applicable:

1. Configure DNS to DMV internal DNS servers.

2. Configure time server to DMV internal NTP servers.

3. Change default admin/root password.

4. Close unsecure ports (20, 21, 23, etc.).

4. Delivery, Installation, and Removal

a. The Contractor shall contact the DMV Contract Manager for coordination of equipment installation and/or removal.

b. The on-site setup and startup services shall be provided by the Contractor to ensure equipment is running properly and adjusted to factory specifications.

5. Setup, Startup, and Training on Mailing Equipment System

a. The Contractor shall provide on-site setup, startup service, and training by factory trained technicians to ensure that the equipment is running properly and adjusted to factory specifications. The training session shall be provided to a minimum of two (2) DMV staff members at each location to cover the operation and maintenance of the system at no additional cost to the DMV.

b. The equipment shall be delivered fully serviced and ready to operate. Installation shall include, at no additional cost to DMV, delivery of two (2) ink cartridges and two (2) rolls or packs of meter strips.

c. The Contractor shall provide one (1) copy of the equipment operational manual to each location. All manuals and instructions shall be in the English language. If there are special tools required to operate the equipment, one (1) set shall be provided to each location.

6. Equipment Parts Replacement

Equipment parts determined to be unserviceable by the Contractor shall be replaced by the Contractor with new or equivalent to new equipment parts at no additional cost to the DMV. Replacement equipment parts shall be approved by the DMV Contract Manager. Unserviceable equipment parts that are replaced by the Contractor shall become the property of the Contractor.

7. Software

The Contractor shall provide, install, and maintain all software and hardware that is necessary to update changes, and update those changes to the postal zip code tables and postal rates at no additional cost to the DMV.

8. Service Calls

The Contractor shall respond to equipment maintenance and/or repair service calls placed by the DMV during regular DMV business hours (8:00 a.m. to 5:00 p.m.

Monday through Friday, excluding state holidays). The Contractor shall also respond to equipment repair service calls placed by the DMV outside of regular DMV business hours Monday through Sunday, including state holidays. When the DMV places a service call to the Contractor during regular DMV business hours, the Contractor shall begin performing services at the DMV within nine (9) DMV business hours following DMV’s service call. When the DMV places a service call to the Contractor outside of regular DMV business hours, the Contractor shall begin performing services at the DMV within two (2) hours following DMV’s service call.

9. Loss/Damage

The DMV shall be relieved from all risks of loss or damage to all equipment/parts during periods of transportation by the Contractor or the Contractor’s agent.

F. PAYMENT TERMS AND INVOICING REQUIREMENTS

1. Contractor will be paid quarterly by invoice. The DMV may dispute an invoice that does not comply with this Contract’s requirements, including requirements for invoices, timesheets and status reports, and a dispute notice given on that basis shall satisfy the requirements of the California Prompt Payment Act.

2. Project costs related to items such as travel, per diem and travel time to the designated base of operation for the engagement are costs to be included within the contractor rates. DMV will not pay for such costs as a separate item.

3. Invoice(s) shall include all of the following:

a. Contractor’s name as indicated within this Agreement, address, telephone number, fax number, and email address.

b. Name, address, and telephone number of the DMV representative or office indicated within this Agreement to whom the invoice is being mailed or delivered.

c. Date the invoice was prepared.

d. Period of time covered by the invoice.

e. The Agreement number.

f. Office name and address where services were provided.

g. Brief description of the type of services for which the DMV is being billed.

h. Total number of days in the billing period that the Contractor was required to perform services.

i. Dates within the billing period that the Contractor failed to render required services.

Total amount invoiced (include calculations showing how the total amount invoiced was determined by including any pro-rata reduction amounts if applicable).

4. Invoices shall be emailed to: ACCT_INV@dmv.ca.gov

5. In addition to any other remedy available under this Agreement or applicable law, the DMV may dispute an invoice or invoices submitted by the Contractor and withhold amounts owed by the Contractor to the DMV under this Agreement, including but not limited to amounts owed for breach, amounts owed as liquidated damages, and amounts owed due to overpayments from amounts claimed by the Contractor on invoices submitted to the DMV and otherwise owed by the DMV to the Contractor under this Agreement.

G. PERSONNEL REPLACEMENT

The replacement or addition of the DMV Contract Manager or Contractor Official may be completed with Exhibit C, Personnel Change Order. The additional or mailto:ACCT_INV@dmv.ca.gov replacement staff will not begin work on a contract deliverable until the Contractor Official, DMV Contract Manager, DMV IT Acquisitions Analyst, and DMV IT Acquisitions Manager have approved the PCO. An amendment to the contract is not required for replacement of the DMV Contract Manager or Contractor Official.

H. AMENDMENTS

1. A contract amendment shall not be effective unless in writing and until fully executed by both parties. No oral understanding or agreement not incorporated through the proper contractual process shall be binding on either the Contractor or the DMV. All amendments will follow the rules and regulations set forth by the State Contracting Manual Volume 2.

2. Contractor resources will not be expended, at a cost to the DMV, in excess of the authorized contract cost without written authorization from the DMV, in the form of a written contract amendment. Additionally, a contract amendment is required in the event that additional work is required that both parties agree was unanticipated, is necessary to successfully complete the project, and is within the project scope. All contract amendments will be processed utilizing the guidelines of the current rules from the State Contracting Manual Volume 2 and a contractor cannot begin work until they have received a fully executed copy of the written amendment from the DMV Information Technology Acquisitions Unit. Any amendment to a contract that increases the dollar amount of the contract, and/or adds additional tasks not in the scope of the contract, will be required to follow the Non-Competitive Bid (NCB) process as described in the State Contracting Manual – Volume 2.

Exhibit C – Personnel Change Order Authorization

CHANGE ORDER NO._______________

Contractor Name: __________________________ Contract Number: ________________

Start Date: ___________________ or upon approval by the DMV IT Acquisitions Manager, whichever occurs later.

Description of Change:

Staff Name: __________________________________________ Phone Number: ___________________________________________ Email Address: ____________________________________________

SOW Staff Classification: Hourly Rate:

Exhibit H Attached: Yes

Reason for Change:

Approval:

Changes identified above are in accordance with the terms and condition of the contract.

By signing below, the Contractor Official has confirmed that the proposed staff meets the Contractor’s Classification requirements and Staff Mandatory Qualifications listed in Exhibit A, Statement of Work.

The DMV Contract Manager or Contract Administrator’s signature below indicates that he/she has confirmed that the proposed staff meets the Staff Mandatory Qualifications listed in Exhibit A, Statement of Work.

Contractor Official Print Name, Sign, and Date

DMV Contract Manager and/or Contract Administrator

By signing below, the DMV IT Acquisitions Manager and DMV IT Acquisitions Analyst have confirmed that the proposed staff meets the Contractor’s Classification requirements.

DMV IT Acquisitions Manager

DMV IT Acquisitions Analyst/Date

Notes: (1) Only replacement of staff shall be allowed under this contract. No additional staff shall be added to this contract; (2) the DMV Contract Manager or Contract Administrator will submit Personnel Change

Order forms to the IT Acquisitions Analyst to obtain DMV IT Acquisitions Manager approval.

Exhibit D - INFORMATION SECURITY AND PRIVACY PROVISIONS (04/2022)

In the performance of this Agreement, [Contractor] agrees to protect all Department of Motor Vehicles (DMV) information by implementing the necessary controls to comply with State mandated security and privacy requirements provided in California State Administrative Manual (SAM), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), Government Code §11015.5 and §11019.9, Vehicle Code, and California Information Practices Act (IPA) Civil Code §1798 et seq. The Contractor further agrees to implement the minimum administrative, physical, technical, and safeguards identified in this Agreement. The Contractor shall protect DMV information for the terms and length of this Agreement and while in possession of, maintaining, or accessing DMV information. The Contractor shall ensure any third parties adhere to these same provisions.

A. DEFINITIONS – For purposes of this Exhibit, the following definitions shall apply:

1. Contractor shall generally refer to any entity, private or public organization hired or working in conjunction with or for DMV to provide deliverables.

2. Data shall mean a representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

3. DMV Information shall refer to DMV provided data.

4. Confidential Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

5. Personal Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

6. Sensitive Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

7. Personnel shall refer to any Contractor employees, volunteers, contractors, sub-contractors commissioned, employed by, or otherwise engaged in the performance of work associated with the Contractor.

8. Systems shall refer to workstations, laptops, servers, network, and other information processing components managed and hosted by Contractor which process, store, or transmit DMV information.

9. Users shall refer to any Contractor personnel with access to DMV information.

B. ADMINISTRATIVE SAFEGUARDS

1. DATA OWNERSHIP

DMV information provided under this Agreement remains DMV exclusive property. Confidential, sensitive, and personal information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without written permission from the DMV.

The Contractor recognizes its responsibility to protect the confidentiality of information in their custody as provided by law and ensure such information is disclosed only to those individuals, and of such purpose as authorized by the respective laws.

The Contractor shall have a non-exclusive right to use and process the disclosed information for the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of this data does not transfer ownership of information to the Contractor.

2. USE OF INFORMATION

The Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement shall be used solely for the purposes described in this Agreement and agrees to implement policies and procedures to ensure the confidentiality of said information.

The Contractor further agrees that information obtained under this Agreement shall not be reproduced, published, sold, or released in original or any other form for any purpose other than identified in this Agreement. Only the minimum necessary amount of DMV information required to perform necessary business functions may be processed, stored, or transmitted.

The Contractor shall not use any DMV information that identifies real individuals for any purpose not described in this Agreement including for testing, training, or research.

3. BACKGROUND CHECKS

Contractor Personnel who may access DMV information, must undergo a thorough background check, with evaluation of the results to assure that there is no indication that the worker may present a risk to the security or integrity of confidential data or a risk for theft or misuse of confidential data. The Contractor shall retain background check documentation for a period of three (3) years following contract termination.

4. STATEMENT OF CONFIDENTIALITY AND REQUIREMENTS

Information maintained by DMV is confidential under this Agreement and exempt from disclosure under the provisions of California Public Records Act (Government Code §6250-6265), the California Elections Code §2194), and other applicable state or federal laws.

The Contractor further understands and acknowledges that under California Penal Code §502, it is a public offense to knowingly and without permission alter, damage, delete, destroy, copy, or otherwise use any DMV data. Such action can be prosecuted civilly or criminally and is punishable by fine and/or imprisonment.

The Contractor shall ensure that all users sign a confidentiality statement each year, attesting to the fact that he/she is aware of the confidential nature of the data and penalties for unauthorized disclosure under applicable state and federal law. Copies of signed confidentiality statements must be made available to the DMV CISO upon request.

5. INFORMATION SECURITY AND PRIVACY AWARENESS TRAINING

The Contractor shall ensure that all users must receive information security and privacy awareness training prior to accessing such information, and annually thereafter. Information security and privacy awareness training must contain instructional components such as, but not limited to, information about the confidential nature of information, laws and regulations protecting the confidentiality of information, user responsibility for protecting the information, and the consequences and legal liability of unauthorized use, access, or disclosure of said information. Upon request, the Contractor must provide the DMV Chief Information Security Officer (CISO) or Privacy Officer with a copy of its information security and privacy awareness training components and certification of its annual information security and privacy awareness training completion.

6. EMPLOYEE ACCESS TO INFORMATION

The Contractor agrees that information shall be kept in the strictest confidence and only made available to authorized personnel on a “need-to-know” business basis, and only for the purposes authorized under this Agreement. The term “need-to-know” refers to those authorized persons who need information to perform their official duties in connection with the purpose described in the Agreement.

The Contractor shall maintain records of all authorized users and the authorization level of access granted to the information obtained under this Agreement with the purpose described in this Agreement.

7. RISK ASSESSMENT

A risk assessment must be conducted annually on all Contractor systems which process, store or transmit DMV information. Risk assessments must be documented at least every three (3) years or upon significant change to the system or environment. Risk assessment results must be provided to the CISO within 30 days of completion.

8. INCIDENT REPORTING

The Contractor shall immediately notify the DMV CISO/Designee of any actual or suspected security event involving DMV information accessed or obtained under this Agreement. The Contractor shall cooperate fully with DMV to comply with the incident reporting requirements within Civil Code section 1798.29 and SAM section 5340.4.

The Contractor shall thoroughly investigate all unauthorized or suspected unauthorized access, use, and/or disclosure of information obtained under this Agreement. DMV reserves the right to participate in the investigation of any information security incident involving its data and may conduct its own independent investigation, and the Contractor shall cooperate fully in such investigation.

The Contractor shall provide a preliminary report within three (3) working days of discovery of breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as any pertinent preliminary information. The Contractor shall then provide a full written report of the investigation to the DMV CISO and Privacy Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure.

DMV reserves the right to take corrective action at any time.

9. BREACH OR DISCLOSURE OF DMV INFORMATION

Disclosure of any DMV information to any person or entity not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with DMV’s confidential information shall not reveal, share, or divulge to any person or entity any of the confidential information provided under this Agreement, except as authorized or required by law.

DMV shall not be held liable for any breach of Contractor systems that results in the release of any information provided by DMV. Contractor agrees to indemnify and hold harmless DMV, its officers, and representatives from and against any liability, losses, costs, damages, or expenses (including but not limited to attorney fees) resulting from any claims arising from the performance of this Agreement, including but not limited to any and all liability, damages, costs, expenses, or attorney fees resulting from a breach of security of the system as defined in the California IPA unless such damages are determined to be the result of the negligence of DMV, its officers, employees, or representatives.

If the Contractor experiences a loss or breach of data, the Contractor shall immediately report the loss or breach to DMV. If DMV determines that notice to the individuals whose data has been lost or breached is appropriate, the Contractor shall bear any, and all costs associated with the notice, or any mitigation selected by the data owner. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data.

C. PHYSICAL SAFEGUARDS

1. ACCESS CONTROL

The Contractor shall ensure information in all forms, such as, but not limited to CDs, DVDs, USB flash drives, or other removable media must be stored in areas physically secure and free from access by unauthorized persons as described in this Agreement.

The Contractor shall ensure computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement must not be viewed by the public or other unauthorized persons as described in the Agreement.

2. SUPERVISION OF DATA

DMV information in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information. DMV information in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

3. ESCORTING VISITORS

Visitors to areas where DMV information is contained shall be escorted and DMV information shall be kept out of sight while visitors are in the area.

4. REMOVAL OF DATA

DMV information must not be removed from the premises of the Contractor except with express written permission.

D. TECHNICAL SAFEGUARDS

1. DATA RETENTION AND DESTRUCTION

DMV information must be retained for the minimum necessary to perform the required business function.

All data received by the Contractor under this Agreement and any data created, copied, attributed to data received shall be destroyed when no longer needed for the business function for which they were obtained, or within 10 calendar days of termination of this Agreement. Data must be destroyed in accordance with the requirements specified NIST Special Publication (SP) 800-88, Guidelines for Media Sanitization.

2. ENCRYPTION

Confidential, sensitive, or personal information must be encrypted in accordance with Federal Information Processing Standards 140-3, Security Requirements for Cryptographic Modules.

3. DATA AT REST AND IN TRANSIT

All Contractor systems that process, store, or transmit DMV confidential, sensitive, or personal information at rest and in transit must be encrypted in accordance with the security and privacy provisions specified within this Agreement.

4. ENDPOINT PROTECTION

All Contractor systems that process, store, or transmit DMV information must install and actively use endpoint protection with automatic updates scheduled at least daily.

5. VULNERABILITY MANAGEMENT

All Contractor systems which store, process, or transmit DMV information must be scanned for vulnerabilities monthly, and when new vulnerabilities potentially affecting the system are identified and reported. Vulnerabilities by severity must be remediated within the following timeframe.

• Critical (3 business days or less)

• High (21 days)

• Medium (60 days)

• Low (90 days)

The CISO must be notified within 24 hours if critical vulnerabilities cannot be remediated within the required timeframe.

6. INTRUSION DETECTION

All Contractor systems which store, process, or transmit DMV information that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

7. WARNING BANNERS

All Contractor systems which store, process, or transmit DMV information must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.

8. IDENTIFICATION and AUTHENTICATION All users accessing DMV information from Contractor systems must be assigned uniquely identified accounts.

9. PASSWORD CONTROLS

Contractor system user account passwords must be a minimum 15 characters and must be composed of a minimum one character each from the following four groups:

a. Upper case letters (A-Z)

b. Lower case letters (a-z)

c. Arabic numerals (0-9)

d. Non-alphanumeric characters (punctuation symbols)

Passwords must be changed at least every 180 days.

10. USER ACCOUNT MANAGEMENT

Contractor system user accounts must be immediately disabled or deleted upon personnel termination or a change in assigned duties which no longer require access to DMV information.

11. MULTI FACTOR AUTHENTICATION

Multi factor authentication must be enabled for all Contractor system users accessing DMV information.

12. SESSION LOCK

Contractor systems must not be left unattended and logged on. Systems must be configured to prevent access by initiating a session lock after no more than 10 minutes of inactivity. Session locks must be retained until the user reestablishes access using established identification and authentication procedures.

13. CHANGE CONTROL

The Contractor shall notify the DMV 30 days prior of any changes to systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit DMV information. The DMV shall notify the Contractor of any changes to DMV systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit information in the performance of this Agreement at the discretion of the DMV.

14. AUDITING

The Contractor shall maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Said logs must be made available to the DMV upon request.

To determine compliance with Agreement terms, the Contractor shall permit DMV authorized individuals to perform audit or inspections during regular business hours of hosted Contractor systems located on Contractor premises. Contractor shall permit audits or inspections with seven (7) days prior notice.

Exhibit E - DMV DRIVER SAFETY OFFICES

RU# Address Zip Manufacturer Make/Model

Contact Phone #

Bakersfield 5800 District Blvd., Ste 100-B Bakersfield, CA 93313

93313 TBD Johnny Facio (916) 657-6469

City of Commerce 5801 E. Slauson Avenue, Ste 250 City of Commerce, CA 90040

90040 TBD Johnny Facio (916) 657-6469

Covina 1365 N. Grand Avenue, Ste 101 Covina, CA 91724

91724 TBD Johnny Facio (916) 657-6469

El Segundo 390 N. Pacific Coast Hwy, Ste 2075 El Segundo, CA 90245

90245 TBD Johnny Facio (916) 657-6469

Fresno 247 E. Nees Avenue, 3rd floor Fresno, CA 93720

93720 TBD Johnny Facio (916) 657-6469

Oakland 7677 Oakport Street, Ste 220 Oakland, CA 94621

94621 TBD Johnny Facio (916) 657-6469

Orange 790 The City Drive, Ste 410 Orange, CA 92868

92868 TBD Johnny Facio (916) 657-6469

Oxnard 2051 North Solar Drive, Ste 100 Oxnard, CA 93036

93036 TBD Johnny Facio (916) 657-6469

Redding 2650 Churn Creek Road, Ste 200 Redding, CA 96002

96002 TBD

Johnny Facio (916) 657-6469

Sacramento 4700 Broadway, 2nd Floor Sacramento, CA 95820

95820 TBD Johnny Facio (916) 657-6469

Riverside Contact Center 6465 Sycamore Canyon Blvd, 2nd floor San Bernardino, CA 92507

92507 TBD Johnny Facio (916) 657-6469

San Diego 1455 Frazee Road, Ste 400 San Diego, CA 92108

92108 TBD Johnny Facio (916) 657-6469

San Francisco *See bottom of page

94117 TBD Johnny Facio (916) 657-6469

1377 Fell Street, 2nd Floor San Francisco, CA 94117 395 Oyster Point Blvd. Suite 321, 3rd floor South San Francisco, CA 94080

San Jose 90 Great Oaks Blvd., Ste 104 San Jose, CA 95119

95119 TBD Johnny Facio (916) 657-6469

Salida 5330 Pirrone Road, Ste 204 Salida, CA 95368

95368 TBD Johnny Facio (916) 657-6469

Van Nuys 6150 Van Nuys Blvd., Ste 205 Van Nuys, CA 91401

91401 TBD Johnny Facio (916) 657-6469

Santa Rosa 2570 Corby Avenue, Santa Rosa, CA 95407

95407 TBD Johnny Facio (916) 657-6469

Exhibit F- TRANSITION SCHEDULE Reporting

Unit # Address Contact Phone

Number Transition Date

275 Bakersfield 5800 District Blvd., Ste 100-B Bakersfield, CA 93313

Kira Hudson (661) 452-9285

(661) 833-2107

TBD

301 City of Commerce 5801 E. Slauson Avenue, Ste 250 City of Commerce, CA 90040

Mohindra Chhatarpal

(323) 529-9708

(310) 627-2920

TBD

274 Covina 1365 N. Grand Avenue, Ste 101 Covina, CA 91724

Verleeta French

(949) 440-4421

(626) 547-3351

TBD

292 El Segundo 390 N. Pacific Coast Hwy, Ste 2075 El Segundo, CA 90245

Azita Foroughian

(310) 855-4545

(310) 620-9444

TBD

286 Fresno 247 E. Nees Avenue, 3rd floor Fresno, CA 93720

Kira Hudson (661) 452-9285

(559) 254-6897

TBD

289 Oakland 7677 Oakport Street, Ste 220 Oakland, CA 94621

Tameika Stone

(510) 721-3547

(510) 588-0810

TBD

296 Orange 790 The City Drive, Ste 410 Orange, CA 92868

Gladys Hampton

(714) 705-1587

(714) 276-1247

TBD

305 Oxnard 2051 North Solar Drive, Ste 100 Oxnard, CA 93036

Rodger Nolasco

(805) 424-5639

(805) 329-1812

TBD

276 Redding 2650 Churn Creek Road, Ste 200 Redding, CA 96002

William (Sean) Campbell

(530) 323-5876

(530) 240-2863

TBD

285 Sacramento 4700 Broadway, 2nd Floor Sacramento, CA 95820

Edward Mariut

(916) 404-7629

(916) 274-7698

TBD

299 Riverside Contact Center 6465 Sycamore Canyon Blvd, 2nd floor San Bernardino, CA 92507

Michelle Zuno (909) 718-4933

(909) 780-3673

298 San Diego 1455 Frazee Road, Ste 400 San Diego, CA 92108

Wendy Walton

(619) 815-1281

(619) 603-8090

TBD

290 San Francisco 395 Oyster Point Blvd. Suite 321, 3rd Floor South San Francisco, CA 94080

Okechukwu Mbama

(415) 301-5174

(415) 376-4914

TBD

291 San Jose 90 Great Oaks Blvd., Ste 104 San Jose, CA 95119

Leland Lee (408) 538-4229

(408) 538-6659

TBD

277 Salida 5330 Pirrone Road, Ste 204 Salida, CA 95368

Jeneane Oman- Escoto

(209) 399-4450

(209) 494-4990

TBD

293 Van Nuys 6150 Van Nuys Blvd., Ste 205 Van Nuys, CA 91401

Christopher Pitchford

(805) 360-4932

(818) 273-5217

TBD

279 Santa Rosa 2570 Corby Avenue, Santa Rosa, CA 95407

Alaina Mitchell

(833) 543-7703

(415) 376-4914

Exhibit D - INFORMATION SECURITY AND PRIVACY PROVISIONS (04/2022)