MMBI-RFQ_25-0197282.2_IPv4_Address_Spaces.pdf

P.O. Box 1810 Rancho Cordova, CA 95741-1810

PH: (916) 857-9051

DATE: January 30, 2026

REQUEST FOR QUOTATION (RFQ) #25-0197282.2

IPv4 Address Spaces Procurement

The California Department of Technology (CDT) is inviting responses to this Request for Quotation (RFQ) entitled: IPv4 Address Spaces Procurement.

Quotes are due by 5:00 PM (PT) on February 10, 2026, Your RFQ response shall be e-mailed to the Department Contact name below.

***ALL QUOTES MUST BE SIGNED AND DATED PRIOR TO SUBMISSION***

CDT reserves the right to amend the original order for changes (e.g. quantity or time) consistent with the terms of the resulting contract. Award, if made, will be to a single Contractor. CDT reserves the right to cancel this RFQ at any time. Pursuant to the Department of General Services’ (DGS) State Contracting Manual ,Volume 2.

This RFQ will be awarded to the lowest responsive, responsible Bidder.

State Terms and Conditions and Bidder’s instructions applicable to this RFQ are listed on the Department of General Services’ websites listed below:

• Bidders Instructions (GSPD-451), Effective 11/09/11 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

• Non-Cloud Goods & Services - General Provisions – Information Technology (IT), Effective

2/20/2025 (DGS PD 403-ITGP):

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document- Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf

For further information regarding this RFQ or its contents, please contact the CDT Departmental Contact listed below:

Tony Nguyen California Department of Technology Acquisitions & IT Program Management Branch P.O. Box 1810 Rancho Cordova, CA 95741 Anthony.Nguyen@state.ca.gov https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf

State of California RFQ #25-0197282.2 California Department of Technology

I. RFQ RESPONSE REQUIREMENTS

The following shall be submitted in response to the RFQ:

1. Completed Attachment 1 – Cost Worksheet. Please provide a price quote for the commodity/service or comparable commodity/service provided on this document. An emailed quote will be accepted provided it contains the following information:

a. SB/DVBE Certification Number;

b. Retailer’s Seller’s Permit Number;

c. FEIN Number;

d. Signature and Date;

e. Printed Name and Title;

f. Company Name;

g. Company Address; and

h. Contact Phone Number.

2. A completed and signed Payee Data Record (Std. 204) and Payee Data Record

Supplement (Std. 205). See item V on the following page(s) for links to the forms.

3. Completed GSPD-05-105, Bidder Declaration. See item VII on the following page(s).

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf

4. DVBE affiliation (DGS PD 843), if applicable.

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf

5. Both the RFQ 25-0197282.2 and the attached Agreement in its entirety (Exhibits A-F) will be a part of the final purchase order when executed.

6. Please complete, sign and return the Federal Debarment Certification Form https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_2.pdf

II. RESPONSIBLE BIDDER

This RFQ will be awarded to the lowest, responsive, responsible Bidder. CDT may require Bidder(s) to submit evidence of their qualifications at such times and under conditions, as it may deem necessary. If a Bidder has been determined to be non-responsible, the RFQ response shall be rejected.

The Bid may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind. CDT may reject any or all Bids and may waive any immaterial deviation in the Bid. CDT’s waiver of an immaterial defect shall in no way modify the Bid document or excuse the Bidder from full compliance with all the requirements if awarded the Agreement.

III. DELIVERY

For the purpose of this solicitation, only Bid responses quoting F.O.B. Destination will be accepted.

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_2.pdf

IV. SELLER’S PERMIT

You must provide your company's California retailer's seller's permit or certification of registration and, if applicable, the permit or certification of all participating affiliates, issued by California Department of Tax and Fee Administration pursuant to all requirements as set forth in Sections 6487, 7101 and sections 6452.1, 6487.3, 18510 of the Revenue and Taxation Code, and Section 10295.1 of the Public Contract Code.

V. PAYEE DATA RECORD (STD. 204) and PAYEE DATA RECORD SUPPLEMENT (STD.

205)

The Offeror is required to submit a completed Payee Data Record (Standard Form 204) in response to the RFO. Refer to the following website link for more details:

STD 204 Payee Data Record

To facilitate the collection of remittance address(es) and contact information in addition to that provided on the STD 204, the State Controller’s Office (SCO) Vendor Management Group (VMG) has developed and published the Payee Data Record Supplement form (STD 205 New 03/2021). The STD 205 must be used to provide the supplier’s remittance address information if different than the mailing address on the STD 204. This newly published form allows suppliers to provide up to five (5) additional remittance addresses and identify up to three (3) additional authorized representatives for the payee. Refer to the following website link for more details:

STD 205 Payee Data Record Supplement

VI. BIDDER DECLARATION FORM

When completing the declaration, Bidders must identify all subcontractors proposed for participation in the contract. Bidders awarded a contract are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution and it is incorporated by amendment to the contract.

At the State’s option prior to award, Bidders may be required to submit additional written clarifying information. Failure to submit the required written information as specified may be grounds for quote rejection.

VII. BID SUBMISSION

Completed Bids must be submitted by the date and time to the Departmental Contact listed on Page 1.

VIII. FEDERAL TAX ADMINISTRATION REQUIREMENTS

CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least 45 calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd204.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=X04VlEJkbwYcRPYArJ0KMYAikGvpvykcbdt4nS4M5iE%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd205.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AvffAGpU14ub1p8KTkMqXPWxSM6j0VzjwKzXomkTOD0%3D&reserved=0 safeguarding requirements. This procedure conforms to IRS Publication 1075. Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately, per the Non-Cloud Goods & Services - General Provisions

– Information Technology (403-ITGP), clause 16.3, Termination for Default.

In conformation with IRS Publication 1075, Contractor must comply with Exhibit D, Special Terms and Conditions to Safeguard Federal Tax Information.

IX. SECURITY AND DATA PROTECTION REQUIREMENTS

CDT must ensure agreements with state and non-state entities include provisions which protect and minimize risk to the state when engaging in the development, use, or maintenance of information systems, products, solutions, or services. In order to comply with the State Administrative Manual (SAM) Section 5305.8, Bidders must comply with Exhibit E, Security and Data Protection.

X. COMMERCIALLY USEFUL FUNCTION

CDT will uniformly apply Commercially Useful Function (CUF) Best Practices standards in collective consideration of CUF standards set forth by 49 CFR Part 26.55 (c)-(d), Government Code section 14837, California Code of Regulations section 1896.4(h), and Military and Veteran Code section 999(b) (5). A SB, DVBE, and MB is deemed to perform a CUF if the business meets the following CUF standards:

1. Performs a CUF when a SB/MB/DVBE is responsible for the execution of a distinct element of work of the Agreement and is carrying out its responsibilities by actually performing, managing, and supervising the work involved.

2. Performs work that is normal for its business services and functions.

3. Be responsible, with respect, to materials and supplies used on the Agreement, for negotiating price, determining quality and quantity, ordering the material, and installing and paying for the material itself.

4. A SB/MB/DVBE does not perform a CUF if its role is limited to that of an extra participant in a transaction, contract, or project through which funds are passed in order to obtain the appearance of SB/MB/DVBE participation.

5. A SB/MB/DVBE does not perform a CUF if it subcontracts a greater portion of the work than would be expected by normal industry practices.

XI. PLASTIC TRASH BAG CERTIFICATION VIOLATIONS

Public Resources Code §42290 et seq. prohibits the State from contracting with any supplier, manufacturer, or wholesaler, and any of its divisions, subsidiaries, or successors that have been determined to be noncompliant to the recycled content plastic trash bag certification requirements. This includes award of a State contract or subcontract or renewal, extension, or modification of an existing contract or subcontract. Prior to award the State shall ascertain if the intended awardee or proposed subcontractor is a business identified on the current CalRecycle noncompliant list(s). In the event of any doubt of the status or identity of the business in violation, the State will notify the Board of the proposed award and afford the Board the opportunity to advise the State. No award will be made when either the Bidder or a subcontractor has been identified either by published list or by advice from the Board, to be in violation of certification requirements.

XII. TIEBREAKER

In the event of a tie, contract award will be made as a result of a coin toss. Tied Bidders will be invited to attend the coin toss and State witnesses will also be present.

Note: In the event of a precise tie between suppliers claiming the incentive, the Bid of an SB and the Bid of a DVBE that is also a SB, the award shall go to the DVBE that is also an SB.

(Reference Chapter 3 and GC section 14838 (f) and 2 CCR section 1896.8(f)).

XIII. GC 12990 AND NON-DISCRIMINATION (IT AND NON-IT GOODS ONLY)

Any employer who wishes to contract with the State for goods is subject to the provisions of GC 12990 relating to discrimination in employment. Contractors that do not meet the provisions of GC 12990 are not eligible to contract with the State for IT goods. Ineligible contractors are found in the California Regulatory Notice Register. To access the California Regulatory Notice Register: https://oal.ca.gov/publications/notice_register/ https://oal.ca.gov/publications/notice_register/

ATTACHMENT 1 - COST WORKSHEET

IPv4 Address Spaces Procurement

California Department of Technology Requested Quote:

Bidders must submit a cost quote for each item(s) in the following list and clearly state unit price and extended (cost) price.

ITEM QTY DESCRIPTION UNIT

PRICE

EXTENDED

PRICE

1 2 /23 Addresses $ $

Subtotal (line 1):

Tax (if applicable):

N/A- Electronic Download

Grand Total:

SB/DVBE Certification

Number:

Retailer’s Seller’s Permit Number:

FEIN Number:

Signature and Date:

Printed Name and Title:

Company Name:

Company Address:

Contact Phone Number:

STATE OF CALIFORNIA CONTRACTOR TBD

DEPARTMENT OF TECHNOLOGY PO 25-TBD / RFQ No. 25-0197282.2

EXHIBIT A

STATEMENT OF WORK

1. Contract Description:

CONTRACTOR TBD (hereinafter referred to as “the Contractor”) agrees to provide the California Department of Technology (hereinafter referred to as the “State,” “CDT,” and/or the “Licensee”) Middle-Mile Broadband Initiative (MMBI) with two /23 IPv4 address space blocks, to be transferred to CDT’s ARIN ORG ID.

2. Licensee Site/Location:

The “Licensee Site” shall mean CDT, as identified in this Agreement, which Licensee represents, is operated or controlled by the Licensee. The Licensee may change the Licensee Site to another location located within the United States without incurring additional charges.

CDT, Office of Technology Services Gold Camp Campus Vacaville Campus

3101 Gold Camp Drive 1020 Vaquero Circle Rancho Cordova, CA 95670 Vacaville, CA 95688

3. License Type: Network Resource Allocation/License, subject to the ARIN Registration

Services Agreement and applicable ARIN Number Resource Policy.

4. Term: One-Time purchase. CDT will own the IP address space indefinitely.

5. Notices:

All notices required by or relating to this Agreement shall be in writing and shall be sent to the parties of this Agreement at their address as set below unless changed from time to time, in which event each party shall notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail and directed to the following addresses:

The technical representative during the term of this Agreement will be:

State Agency Contractor California Department of Technology

Middle-Mile Broadband Initiative

TBD

Attn: Jason Moore Attn: Support Phone: (916) 208-2277 Phone: TBD E-mail: Jason.moore@state.ca.gov Web: TBD

Contract inquiries should be addressed to:

State Agency Contractor California Department of Technology

Middle-Mile Broadband Initiative

TBD

Attn: Tony Nguyen Attn: TBD Address: PO Box 1810

Rancho Cordova, CA 95741 Address: TBD

Phone: (916) 857-9051 Phone: TBD E-mail: Anthony.nguyen@state.ca.gov E-mail: TBD mailto:Jason.moore@state.ca.gov mailto:support@crowdstrike.com mailto:allan@hftechservices.com

6. Contractor Responsibilities:

a. Contractor’s responsibilities are limited to registry and allocation functions performed pursuant to the ARIN Registration Services Agreement.

b. Contractor shall arrange for transfer of two /23 ARIN IPv4 address space blocks to CDT’s

ARIN ORG ID.

c. Contractor warrants that the address space is not, at the time of transfer, on any common

IPv4 abuse or routing blacklist. If the address space is found to be blacklisted within 30 days of transfer owing to no act of CDT, Contractor shall replace the address space with non-blacklisted space at no cost to CDT.

d. Contractor warrants that the address space to be transferred to CDT is properly delegated by ARIN to the transferer and that no address space hijacking issues exist. If the address space is found to be hijacked and/or not properly delegated by ARIN to the transferer within 30 days of transfer, Contractor shall replace the address space with non-hijacked space at no cost to CDT.

e. Contractor warrants that the transfer complies with all applicable ARIN policies such as

8.3 (“Transfers Between Specified Recipients in the ARIN Region”)

7. Support:

The Contractor shall ensure that Support is provided by the manufacturer, Insert Manufacturer, through the term of the Agreement.

a. Phone Support: (xxx) xxx-xxxx

b. Website:

c. E-mail:

8. Amendments:

Consistent with the terms and conditions of the original solicitation, and upon mutual consent, the CDT and the Contractor may execute amendments to this Agreement for quantity, money and/or time. No additional products or services can be added to this Agreement. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, and agreed upon by both parties and approved, as required. No verbal understanding or agreement not incorporated into the Agreement is binding on any of the parties.

9. Cancellation Provisions:

CDT may exercise its option to terminate the resulting Agreement at any time with thirty (30) calendar days’ prior written notice.

10. Federal Tax Administration Requirements

CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least forty-five (45) calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075.

Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately, per the Non-Cloud Goods & Services - General Provisions – Information Technology (403-ITGP), clause 16.3, Termination for Default. In conformation with IRS Publication 1075, Contractor must comply with Exhibit D - Special Terms and Conditions to Safeguard Federal Tax Information.

11. Security and Data Protection Requirements:

CDT must ensure agreements with state and non-state entities include provisions which protect and minimize risk to the state when engaging in the development, use, or maintenance of information systems, products, solutions, or services. In order to comply with the State Administrative Manual (SAM) Section 5305.8, the Contractor must comply with Exhibit E, Security and Data Protection.

EXHIBIT B

BUDGET DETAIL AND PAYMENT PROVISIONS

1. Payment and Invoicing:

a. Payment will be made in advance upon receipt of a correct invoice. The invoice shall include booking confirmation of the CDT Purchase Order; including but not limited to, the product name, code (if applicable), and term date; and shall reference the Agency Order Number.

b. Submit your invoice using only one of the following options:

1) Send via U.S. mail in TRIPLICATE to:

Administration Division – Accounting Office P. O. Box 1810 Rancho Cordova, CA 95741

OR

2) Submit electronically at: APInvoices@state.ca.gov

c. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.

2. Budget Contingency Clause:

a. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this contract and Contractor shall not be obligated to perform any provisions of this contract.

b. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Contract with no liability occurring to the State, or offer a contract amendment to the Contractor to reflect the reduced amount.

mailto:APInvoices@state.ca.gov

EXHIBIT B-1

COST WORKSHEET

IPv4 Address Spaces Procurement

(Placeholder for Vendor’s Quote)

EXHIBIT C

IT GENERAL PROVISONS NON-CLOUD GOODS & SERVICES

These provisions are hereby incorporated by reference. The provisions are revised and effective 2/20/2025.

https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT- General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf

EXHIBIT D

SPECIAL TERMS AND CONDITIONS TO SAFEGUARD FEDERAL TAX INFORMATION

Federal statute, regulations and guidelines require that all contracts for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes include the provisions contained in this Exhibit.

Contractor agrees to comply with 26 United States Code (U.S.C) §6103(n), as revised in the future, 26 Code of Federal Regulations (C.F.R) §301.6103(n)-1(a)(2) and (d), as revised in the future, and Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021, or as revised in the future), Section 2.C.8., 2.C.9, and Exhibit 7) and all applicable conditions and restrictions as may be prescribed by the IRS by regulation, published rules or procedures, or written communication to the Contractor.

Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021, or as revised in the future) https://www.irs.gov/pub/irs-pdf/p1075.pdf

EXHIBIT 7 SAFEGUARDING CONTRACT LANGUAGE

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and 202 obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1. (3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075.

The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

IRS Publication 1075 (Rev. 11/2021 or as revised in the future) Section 2.C.8, Control over Processing through 2.C.9, Service Level Agreements (SLA)

2.C.8 Controls Over Processing

The agency must establish adequate controls to prevent disclosing FTI to other state agencies, tax or non-tax, or to political subdivisions, such as cities or counties, for any purpose, including tax administration, absent explicit written IRS authority granted under IRC § 6103(p)(2)(B).

Processing of FTI in an electronic media format including removable media, microfilms, photo impressions or the conversion to other formats (including tape reformatting or duplication, reproduction or conversion to digital images or hard copy printout) will be performed as indicated in the environments listed in 2.C.8.1 and 2.C.8.2.

2.C.8.1 Agency-owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews.

2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities https://www.irs.gov/pub/irs-pdf/p1075.pdf

Recipients of FTI are permitted to use a shared facility but only in a manner that does not allow access to FTI by employees, agents, representatives, or contractors of other agencies using the shared facility.

For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes contractors and subcontractors.

Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply; for example, human services agencies administering benefit eligibility programs may not allow contractors or sub-contractors, including consolidated data center contractors, access to any FTI.

The agency must include, as appropriate, the requirements specified in Exhibit 7, Safeguarding Contract Language.

The agency, as well as its contractor, sub-contractor and shared sites that receive, process, store, access, protect and/or transmit FTI, are subject to Safeguard reviews.

These requirements also apply to releasing electronic media to a private contractor, sub-contractor or other agency office, even if the purpose is merely to erase the old media for reuse.

2.C.9 Service Level Agreements (SLA) Agencies using support functions, including, but not limited to, consolidated data centers, shared print facilities, and disaster recovery sites, must implement appropriate controls to ensure the protection of FTI. This includes a service level agreement (SLA) between the agency authorized to receive FTI and support functions. The SLA must cover the following:

• The agency with authority to receive FTI is responsible for ensuring the protection of all

FTI received. The state support function shares responsibility for safeguarding FTI.

• The Exhibit 7 language must be included in the SLA between the recipient agency and support functions and in all contracts involving contractors or sub-contractors hired by the state support function.

• The SLA provides written notification to the state support function’s management that they are bound by the provisions of Publication 1075, relative to protecting all FTI within their possession or control.

• The SLA shall detail the IRS’s right to inspect state support function facilities and operations receiving, processing, storing, accessing, protecting and/or transmitting FTI under this agreement to assess compliance with requirements defined in IRS Publication 1075. The SLA shall specify that IRS’s right of inspection includes the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI.

• The SLA shall detail the state support function’s responsibilities to address corrective action recommendations to resolve findings of noncompliance identified by IRS inspections.

• The agency will conduct an internal inspection of the state support function every 18 months, as described in Section 2.D.3, Internal Inspections. Multiple agencies sharing a state support function such as a consolidated data center may partner together to conduct a single, comprehensive internal inspection. However, care must be taken to ensure agency representatives do not gain unauthorized access to other agencies’ FTI during the internal inspection.

• The employees from the state support function with access to or use of FTI, including system administrators and programmers, must:

1. Meet the background check requirements defined in Background Investigation

Minimum Requirements and

2. Receive disclosure awareness training and sign a confidentiality statement, prior to initial access to or use of FTI, as well as annually thereafter. These provisions also extend to any contractors or sub-contractors hired by the state support function that have authorized access to or use of FTI.

• The specific data breach incident reporting procedures for all state support function employees, contractors and sub-contractors must be covered. The required disclosure awareness training must include a review of these procedures.

• Responsibilities must be identified for coordination of the 45-day notification of the use of contractors or sub-contractors with access to FTI.

• Require a formal sanction process for individuals covered by the SLA for failing to comply with established FTI security policies and procedures. Notification of designated agency personnel is required within 72 hours when the formal sanction is a proposed disciplinary or adverse action involving an unauthorized access or disclosure of FTI and must include the date the unauthorized access or disclosure of FTI occurred.

Generally, consolidated data centers are operated either by a separate state agency (e.g., Department of Information Services) or by a private contractor or sub-contractor. If an agency is considering transitioning to either a state-owned or private vendor consolidated data center, the Office of Safeguards strongly suggests the agency submit a request for discussions with Safeguards as early as possible in the decision making or implementation planning process. The purpose of these discussions is to ensure the agency remains compliant with safeguarding requirements during the transition to the consolidated data center.

Disclosure awareness training videos produced by the IRS can be found at:

https://www.irs.gov/privacy-disclosure/irs-disclosure-awareness-videos

REFERENCES

26 U.S.C. §6103(n) Confidentiality and disclosure of returns and return information

(n) Certain other Persons Pursuant to regulations prescribed by the Secretary, returns and return information may be disclosed to any person, including any person described in section 7513(a), to the extent necessary in connection with the processing, storage, transmission, and reproduction of such returns and return information, the programming, maintenance, repair, testing, and procurement of equipment, and the providing of other services, for purposes of tax administration.

26 C.F.R. §301.6103(n)-1 Disclosure of returns and return information in connection with written contracts or agreements for the acquisition of property or services for tax administration purposes.

(a) General rule.

(1) Pursuant to the provisions of section 6103(n) of the Internal Revenue Code and subject to the conditions of this section, officers and employees of the Treasury Department, a State tax agency, the Social Security Administration, or the Department of Justice, are authorized to disclose returns and return information (as defined in section 6103(b)) to any person (including, in the case of the Treasury Department, any person described in section 7513(a)), or to an officer or employee of the person, for purposes of tax administration (as defined in section 6103(b)(4)), to the extent necessary in connection with a written contract or agreement for the acquisition of -https://www.irs.gov/privacy-disclosure/irs-disclosure-awareness-videos https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-934396624-1069627217&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-536286780-1069627218&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-934396624-1069627217&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-536286780-1069627218&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-451060365-1069627220&term_occur=999&term_src= https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=26-USC-451060365-1069627220&term_occur=999&term_src= https://www.law.cornell.edu/topn/irc https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=ce15809edeb1ba34ad35438ab4f8283a&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4213e3004a09e65224a9cea553071bb1&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4213e3004a09e65224a9cea553071bb1&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1

(i) Equipment or other property; or

(ii) Services relating to the processing, storage, transmission, or reproduction of returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services.

(2) Any person, or officer or employee of the person, who receives returns or return information under paragraph (a)(1) of this section, may -

(i) Further disclose the returns or return information to another officer or employee of the person whose duties or responsibilities require the returns or return information for a purpose described in this paragraph (a); or

(ii) Further disclose the returns or return information, when authorized in writing by the Internal Revenue Service (IRS), to the extent necessary to carry out the purposes described in this paragraph (a). Disclosures may include disclosures to an agent or subcontractor of the person, or officer or employee of the agent or subcontractor.

(3) An agent or subcontractor, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a)(2)(ii) of this section, may further disclose the returns or return information to another officer or employee of the agent or subcontractor whose duties or responsibilities require the returns or return information for a purpose described in this paragraph (a).

(4) Any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under this paragraph (a), may, subject to the provisions of § 301.6103(p)(2)(B)-1 (concerning disclosures by a Federal, State, or local agency, or its agents or contractors), further disclose the returns or return information for a purpose authorized, and subject to all applicable conditions imposed, by section 6103.

(b) Limitations.

(1) Disclosure of returns or return information in connection with a written contract or agreement for the acquisition of property or services described in paragraph (a) of this section will be treated as necessary only if the performance of the contract or agreement cannot otherwise be reasonably, properly, or economically carried out without the disclosure.

(2) Disclosure of returns or return information in connection with a written contract or agreement for the acquisition of property or services described in paragraph (a) of this section shall be made only to the extent necessary to reasonably, properly, or economically perform the contract. For example, disclosure of returns or return information to employees of a contractor for purposes of programming, maintaining, repairing, or testing computer equipment used by the IRS or a State tax agency shall be made only if the services cannot be reasonably, properly, or economically performed without the disclosure. If it is determined that disclosure of returns or return information is necessary, and if the services can be reasonably, properly, or economically performed by disclosure of only parts or portions of a return or if deletion of taxpayer identity information (as defined in section 6103(b)(6)) reflected on a return would not seriously impair the ability of the employees to perform the services, then only the parts or portions of the return, or only the return with taxpayer identity information deleted, may be disclosed.

(c) Penalties. Any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a) of this section, is subject to the civil and criminal penalty provisions of sections 7431, 7213, and 7213A for the unauthorized inspection or disclosure of the returns or return information.

https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/cfr/text/26/301.6103(n)-1#a_1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/cfr/text/26/301.6103(n)-1#a_2_ii https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/cfr/text/26/301.6103#p_2_B https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=ce15809edeb1ba34ad35438ab4f8283a&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/cfr/text/26/301.6103(n)-1#a https://www.law.cornell.edu/cfr/text/26/301.6103(n)-1#a https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=a0e44df58c65974d9271616067a414dc&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7336a9bece1f6a04e99414e7b0c782e7&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=ce15809edeb1ba34ad35438ab4f8283a&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4213e3004a09e65224a9cea553071bb1&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=1b081dcbc3a49a9a1753e65dfe8cc1ac&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=1b081dcbc3a49a9a1753e65dfe8cc1ac&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=410ee21553e0d34d7bb982c847a9800b&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1 https://www.law.cornell.edu/cfr/text/26/301.6103(n)-1#a https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=7e65015a97e711402f305555bb8569ac&term_occur=999&term_src=Title:26:Chapter:I:Subchapter:F:Part:301:Subpart:0:Subjgrp:54:301.6103(n)-1

(d) Notification requirements. Any person, or agent or subcontractor of the person, who receives returns or return information under paragraph (a) of this section shall provide written notice to his, her, or its officers and employees receiving the returns or return information that -

(1) Returns or return information disclosed to the officer or employee may be used only for a purpose and to the extent authorized by paragraph (a) of this section and that the officer or employee is subject to the civil and criminal penalty provisions of sections 7431, 7213, and 7213A…