NAT26001-CVRP_ADMN_att10.pdf
PDF 348 KB Posted
- Solicitation number
- NAT26001-CVRP_ADMIN
- Issued by
- Kent County, Delaware
About this file
This is a Delaware Data Usage Terms and Conditions Agreement issued by the Delaware Department of Technology and Information (DTI) governing the handling of state data in contracts, applicable to the Delaware Clean Vehicle Rebate Program Administration. The agreement establishes mandatory data management requirements for all service providers and contractors working with Delaware state data, including both public and non-public information. The agreement applies to all contracts involving state data access and outlines obligations regarding data ownership, usage, security, and disposition throughout the contract term and following termination.
The agreement mandates that providers encrypt all non-public data in transit and, for engagements involving Personally Identifiable Information (PII) or sensitive data, encrypt data at rest using National Institute of Standards and Technology (NIST) FIPS 140-2 validated cryptography standards. Providers must not store, process, or transfer non-public state data outside the United States, including for backup and disaster recovery purposes. All state data must remain within the provider's possession until termination, after which providers must return data in CSV, XML, or mutually agreed formats or securely dispose of it within 90 days using NIST-approved methods with written certificates of destruction. Providers are liable for any data breaches resulting from their negligence, including costs for investigation, response, recovery, and credit monitoring services for affected individuals lasting at least three years. The agreement distinguishes between public data only engagements (requiring compliance with DU1-DU3) and non-public data engagements (requiring full compliance with DU1-DU7), with breach notification required within 60 days of determination unless federal law or law enforcement requires alternative timing.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| NAT26001-CVRP_ADMN_appC.pdf | ||
| NAT26001-CVRP_ADMN_appB.xlsx | XLSX spreadsheet | |
| NAT26001-CVRP_ADMN_appD.xlsx | XLSX spreadsheet | |
| NAT26001-CVRP_ADMN_rfp.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
STATE OF DELAWARE
DEPARTMENT OF TECHNOLOGY AND INFORMATION
801 Silver Lake Blvd., Dover, Delaware 19904
DELAWARE DATA USAGE TERMS AND CONDITIONS AGREEMENT
PUBLIC AND NON-PUBLIC DATA OWNED BY THE STATE OF DELAWARE
Contract/Agreement #/name __________________________________________________________, Appendix _________ between State of Delaware and __________________________________________________ dated ___________________
Form Date: 6/18/2018
Public Data
Non Public Data
DATA USAGE (DU) TERMS
DU1 √ √ Data Ownership The State of Delaware shall own all right, title and interest in its data that is related to the services provided by this contract. The PROVIDER shall not access State of Delaware user accounts, or State of Delaware data, except (i) in the course of data center operations, (ii) response to service or technical issues, (iii) as required by the express terms of this contract, or (iv) at State of Delaware’s written request. All information obtained or generated by the PROVIDER under this contract shall become and remain property of the State of Delaware.
DU2 √ √ Data Usage PROVIDER shall comply with the following conditions. At no time will any information, belonging to or intended for the State of Delaware, be copied, disclosed, or retained by PROVIDER or any party related to PROVIDER for subsequent use in any transaction. The PROVIDER will take reasonable steps to limit the use of, or disclosure of, and requests for, confidential State data to the minimum necessary to accomplish the intended purpose under this agreement. PROVIDER may not use any information collected in connection with the service issued from this proposal for any purpose other than fulfilling the service. Protection of Personally Identifiable Information (PII, as defined in the State’s Terms & Conditions Governing Cloud Services policy), privacy, and sensitive data shall be an integral part of the business activities of the PROVIDER to ensure that there is no inappropriate or unauthorized use of State of Delaware information at any time. The PROVIDER shall safeguard the confidentiality, integrity, and availability of State information.
Only duly authorized PROVIDER staff will have access to the State of Delaware data and may be required to obtain security clearance from the State. No party related to the PROVIDER may retain any data for subsequent use in any transaction that has not been expressly authorized by the State of Delaware.
Attachment 10
801 Silver Lake Blvd., Dover, Delaware 19904
DELAWARE DATA USAGE TERMS AND CONDITIONS AGREEMENT
PUBLIC AND NON-PUBLIC DATA OWNED BY THE STATE OF DELAWARE
Contract/Agreement #/name __________________________________________________________, Appendix _________ between State of Delaware and __________________________________________________ dated ___________________
Form Date: 6/18/2018
Public Data
Non
DATA USAGE (DU) TERMS
DU3 √ √ Termination and Suspension of Service
In the event of termination of the contract, the PROVIDER shall implement an orderly return (in CSV or XML or another mutually agreeable format), or shall guarantee secure disposal of State of Delaware data.
Suspension of services: During any period of suspension or contract negotiation or disputes, the PROVIDER shall not take any action to intentionally alter, erase, or otherwise render inaccessible any State of Delaware data.
Termination of any services or agreement in entirety: In the event of termination of any services or agreement in entirety, the PROVIDER shall not take any action to intentionally alter, erase, or otherwise render inaccessible any State of Delaware data for a period of 90 days after the effective date of the termination. Within this 90-day timeframe, vendor will continue to secure and back up State of Delaware data covered under the contract. After such 90-day period, the PROVIDER shall have no obligation to maintain or provide any State of Delaware data. Thereafter, unless legally prohibited, the PROVIDER shall dispose securely of all State of Delaware data in its systems or otherwise in its possession or control, as specified herein.
Post-Termination Assistance: The State of Delaware shall be entitled to any post-termination assistance generally made available with respect to the Services unless a unique data retrieval arrangement has been established as part of the Service Level Agreement.
DU4 √ Data Disposition At the end of this engagement, PROVIDER will account for and return all State data in all of its forms, disk, CD / DVD, tape, paper, for example. At no time shall any data or processes that either belong to or are intended for the use of State of Delaware or its officers, agents, or employees, be copied, disclosed, or retained by the PROVIDER.
When required by the State of Delaware, the PROVIDER shall destroy all requested data in all of its forms (e.g., disk, CD/DVD, backup tape, paper). Data shall be permanently deleted, and shall not be recoverable, in accordance with National Institute of Standards and Technology (NIST) approved methods. The PROVIDER shall provide written certificates of destruction to the State of Delaware.
https://webfiles.dti.delaware.gov/pdfs/pp/DataDestructionCertificationForm.pdf
Contract/Agreement #/name __________________________________________________________, Appendix _________ between State of Delaware and __________________________________________________ dated ___________________
Non
DU5 √ Data Location The PROVIDER shall not store, process, or transfer any non-public State of Delaware data outside of the United States, including for back-up and disaster recovery purposes. The PROVIDER will permit its personnel and subcontractors to access State of Delaware data remotely only as required to provide technical or call center support.
DU6 √ Breach Notification and Recovery
The PROVIDER must notify the State of Delaware immediately of any incident resulting in the destruction, loss, unauthorized disclosure, or alteration of State of Delaware data. If data is not encrypted (see DU7, below), Delaware Code (6 Del. C.
§12B-100 et seq.) requires public breach notification of any incident resulting in the loss or unauthorized disclosure of Delawareans’ Personally Identifiable Information (PII, as defined in Delaware’s Terms and Conditions Governing Cloud Services policy) by PROVIDER or its subcontractors. The PROVIDER will provide notification to persons whose information was breached without unreasonable delay but not later than 60 days after determination of the breach, except 1) when a shorter time is required under federal law; 2) when law enforcement requests a delay; 3) reasonable diligence did not identify certain residents, in which case notice will be delivered as soon as practicable. All such communication shall be coordinated with the State of Delaware. Should the PROVIDER or its contractors be liable for the breach, the PROVIDER shall bear all costs associated with investigation, response, and recovery from the breach. This includes, but is not limited to, credit monitoring services with a term of at least three (3) years, mailing costs, website, and toll-free telephone call center services. The State of Delaware shall not agree to any limitation on liability that relieves the PROVIDER or its subcontractors from its own negligence, or to the extent that it creates an obligation on the part of the State to hold a PROVIDER harmless.
Contract/Agreement #/name __________________________________________________________, Appendix _________ between State of Delaware and __________________________________________________ dated ___________________
Non
DU7 √ Data Encryption The PROVIDER shall encrypt all non-public data in transit, regardless of transit mechanism. For engagements where the PROVIDER stores Personally Identifiable Information (PII) or other sensitive, confidential information, it shall encrypt this non-public data at rest. The PROVIDER’s encryption shall meet validated cryptography standards as specified by the National Institute of Standards and Technology in FIPS140-2 and subsequent security requirements guidelines. The PROVIDER and State of Delaware will negotiate mutually acceptable key location and key management details. Should the PROVIDER not be able to provide encryption at rest, it must maintain cyber security liability insurance coverage for the duration of the contract.
Coverage must meet the State of Delaware’s standard in accordance with the Terms and Conditions Governing Cloud Services policy.
The terms of this Agreement shall be incorporated into the aforementioned contract. Any conflict between this Agreement and the aforementioned contract shall be resolved by giving priority to this Agreement. By signing this Agreement, the PROVIDER agrees to abide by the following applicable Terms and Conditions
[check one]:
FOR OFFICIAL USE ONLY DU 1 - DU 3 (Public Data Only) OR DU 1 - DU 7 (Non-public Data)
PROVIDER Name/Address (print):
PROVIDER Authorizing Official Name (print):
PROVIDER Authorizing Official Signature: Date: ________________
File details come from the government source that posted it. Updated .