PIP Tribal Agreement Sample.docx
DOCX document 109 KB Posted
- Attached to
- Positive Indian Parenting State and local contract opportunity
- Solicitation number
- 25-DCYF-CW-096
- Issued by
- Adams County, Asotin County, Benton County, Chelan County, Clallam County, Clark County, Columbia County, Cowlitz County, Douglas County, Ferry County, Franklin County, Garfield County, Grant County, Grays Harbor County, Island County, Jefferson County, King County, Kitsap County, Kittitas County, Klickitat County, Lewis County, Lincoln County, Mason County, Okanogan County, Pacific County, Pend Oreille County, Pierce County, San Juan County, Skagit County, Skamania County, Snohomish County, Spokane County, Stevens County, Thurston County, Wahkiakum County, Walla Walla County, Whatcom County, Whitman County, Yakima County, Asotin City, Clarkston City, Clarkston Heights-Vineland CDP, West Clarkston-Highland CDP, Benton City, Chelan City, Chelan Falls CDP, Clallam Bay CDP, Lewisville CDP, Rock Island City, Pacific Beach CDP, Whidbey Island Station CDP, Mercer Island City, Pacific City, Bainbridge Island City, Kingston CDP, Kitsap Lake CDP, Kittitas City, Klickitat CDP, Okanogan City, Anderson Island CDP, Fort Lewis CDP, Fox Island CDP, Herron Island CDP, Ketron Island CDP, North Fort Lewis CDP, Pacific City, Raft Island CDP, Stevenson City, Hat Island CDP, Lake Stevens City, Snohomish City, Spokane City, Spokane Valley City, Puget Island CDP, Garfield Town, Yakima City, Washington
About this file
The document is a sample Positive Indian Parenting (PIP) Tribal Agreement involving the Washington State Department of Children, Youth, and Families (DCYF) and Federally Recognized Tribes, Recognized American Indian Organizations (RAIOs), and Native Serving Organizations. The contract opportunity seeks to deliver Positive Indian Parenting services, targeting Native American communities in Washington State. While specific details about response dates, site visits, or contract term are not clearly visible in this sample document, the core purpose appears to be establishing a standardized framework for delivering parenting support services to Native American families.
The contract opportunity is specifically focused on Native-serving organizations, with a clear preference for Federally Recognized Tribes and Recognized American Indian Organizations as potential service providers. The document suggests a collaborative approach to addressing parenting needs within Native communities, likely involving culturally appropriate training, support, and intervention strategies. Funding appears to be coming from state resources, with DCYF acting as the primary contracting agency. The sample agreement indicates an intent to create a structured yet flexible mechanism for tribal organizations to provide essential family support services.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| Attach B Certs & Assurances.docx | DOCX document | |
| Attach C1 Admin Response.docx | DOCX document | |
| Attach B1 Small Business Self Cert.docx | DOCX document | |
| PIP Budget Template.xlsx | XLSX spreadsheet | |
| PIP Sample Contract.docx | DOCX document | |
| RFQQ 25-DCYF-CW-096 PIP.docx | DOCX document |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
INDIAN NATION
PROGRAM AGREEMENT
Positive Indian Parenting DCYF Agreement Number
| This Program Agreement is by and between the State of Washington Department of Children, Youth & Families (DCYF) and the Indian Nation identified below, and is issued in conjunction with a DCYF and Indian Nation Agreement on General Terms and Conditions, which is incorporated by reference. |
| Administration or Division Agreement Number |
1501- Indian Nation Agreement Number
DCYF ADMINISTRATION
Department of Children, Youth, and Families
DCYF DIVISION
Children, Youth and Families
DCYF INDEX NUMBER
DCYF CONTRACT CODE
2000NC-62
DCYF CONTACT NAME AND TITLE
Contract Manager
DCYF CONTACT ADDRESS
1115 Washington St SE
Olympia, WA 98504
DCYF CONTACT TELEPHONE
DCYF CONTACT FAX
Click here to enter text.
DCYF CONTACT E-MAIL
INDIAN NATION NAME
INDIAN NATION ADDRESS
NDIAN NATION CONTACT NAME
INDIAN NATION CONTACT TELEPHONE
INDIAN NATION CONTACT FAX
INDIAN NATION CONTACT E-MAIL
IS THE INDIAN NATION A SUBRECIPIENT FOR PURPOSES OF THIS PROGRAM AGREEMENT?
CFDA NUMBERS
PROGRAM AGREEMENT START DATE
PROGRAM AGREEMENT END DATE
MAXIMUM PROGRAM AGREEMENT AMOUNT
EXHIBITS. When the box below is marked with a check () or an X, the following Exhibits are attached and are incorporated into this Indian Nation Program Agreement by reference:
|_| Exhibits (specify): DCYF Indian Nation Data Security Requirements Exhibit A; Statement of Work Exhibit B; Program Requirements Exhibit C; Budget Exhibit D |_| No Exhibits.
By their signatures below, the parties agree to the terms and conditions of this Indian Nation Program Agreement and all documents incorporated by reference. No other understandings or representations, oral or otherwise, regarding the subject matter of this Program Agreement shall be deemed to exist or bind the parties. The parties signing below certify that they are authorized, as representatives of their respective governments, to sign this Program Agreement.
INDIAN NATION SIGNATURE
Draft - Please Do Not Sign
PRINTED NAME AND TITLE
DATE SIGNED
DCYF SIGNATURE
Draft - Please Do Not Sign
PRINTED NAME AND TITLE
DATE SIGNED
Special Terms and Conditions
Department of Children, Youth & Families 2019NF Indian Nation Program Agreement (6-24-20) Page 3
1. Definitions Specific to Special Terms. The words and phrases listed below, as used in this Program Agreement, shall each have the following definitions. These definitions are in addition to those definitions in the Indian Nation and DCYF Agreement Regarding General Terms and Conditions referred to above.
a. “Compliance Agreement” means a written plan approved by DCYF which identifies deficiencies in performance, describes the steps the Indian Nation must take to correct the deficiencies, and sets forth timeframes within which such steps must be taken to return the Indian Nation to compliance with the terms of the Agreement.
Crisis Plan/Protective Action Plan: In the context of child safety, a crisis plan/protective action plan is a proactive and structured strategy developed to address and manage situations in which there is a present danger to the safety of the child. It is a crucial component of child welfare and protection, designed to ensure the well-being of a child when there are concerns about their immediate safety due to factors such as abuse, neglect, or other potential dangers. Crisis plans are typically developed and implemented by child protective services, social workers, or other relevant agencies and professionals.
Culturally Responsive: Culture includes the shared social behaviors and norms within a society. This can include shared knowledge, beliefs, laws, arts, customs, habits, priorities, expectations, and many other shared practices. Being Culturally Responsive would involve proactively engaging with people in ways that are appropriate within their cultural values, behaviors, and norms.
Culturally Specific: Proactive learning and engagement regarding the distinct cultural practices of others, referencing specific elements that could be recognized as particular to their cultural ways.
Cultural Adaptations: Modifications made to practices, customs, or expectations to better accommodate a specific culture's values and norms. This includes providing culturally competent training to staff to ensure a comprehensive understanding of local needs, employing linguistically and culturally specific communication and access strategies, and adjusting intervention methods to align with diverse family structures and belief systems.
Project Plan: The project plan that is developed by the providers that aims to guide contracted organizations and DCYF through the planning and execution of the program.
Reason to Know: When there is reason to know children are or may be Indian Children under 2.40.1 Reason to Know https://dcyf.wa.gov/dcyf-policies/2-40-1-reason-know Safety Plan: In the context of Washington's Department of Children, Youth, and Families (DCYF), a safety plan refers to a structured and documented strategy developed to ensure the safety of a child or youth involved with the child welfare system. These plans are typically created by DCYF in situations where there are concerns about a child's safety, often due to the presence of an active safety threat for the child/ren in the household. Safety plans are essential tools used by DCYF to ensure that children and youth are kept safe in situations of vulnerability or potential harm. They serve as a structured framework to coordinate efforts, resources, and interventions to protect and support the child's best interests.
Service Confirmation: Refers to the process by which the contracted provider acknowledges receipt of a referral from the Department of Children, Youth, and Families (DCYF) and confirms through written correspondence the acceptance or declination of services.
1. Purpose. The purpose of this Agreement is to provide Positive Indian Parenting services.
2. Contract Term. The period of performance of this Agreement is for one year ending 02/28/2027 with an option at the sole discretion of DCYF to amend for continuous funding.
3. Data Security Requirements – Exhibit A. The Indian Nation shall protect, segregate, and dispose of data from DCYF as described in Exhibit A.
4. Statement of Work – Exhibit B. The Indian Nation shall provide services and staff as described in the Statement of Work attached as Exhibit B.
5. Program Requirements – Exhibit C. The Indian Nation shall comply with all program and other requirements for providing services under this Agreement, as stated in the Program Requirements attached as Exhibit C.
6. Budget Exhibit – Exhibit D. The Budget for providing services under this Agreement is attached as Exhibit D. Funds may be transferred between budget line items of the Budget subject to the following conditions:
a. Transfer of funds up to 10% of the budget line item must be requested in writing by the Indian Nation and may be made without amending this Agreement;
b. Transfer of funds that exceeds 10% of the budget line item shall require a written amendment to this Agreement prior to the transfer of funds between budget line items.
7. Consideration
a. Maximum Amount. The maximum amount of total consideration payable to the Indian Nation for satisfactory performance of the work under this Agreement is the amount stated on page 1 of this Agreement under “Maximum Program Agreement Amount.”
b. Start-up Funding:
The Indian Nation shall utilize start-up funding the following activities:
Personnel costs related to recruitment and onboarding Recruitment, hiring, and onboarding materials Program advertisement and outreach Initial staff training System costs related to the program including technology for data collection and reporting Consulting and sub-contracting Strategic planning
c. Concrete goods
(1) The Indian Nation shall assist the family in obtaining concrete goods and support services, as follows:
When needed to directly support a family in maintaining child safety and family wellbeing to either prevent placement or achieve reunification;
The Indian Nation shall first seek community resources to provide concrete goods and support services that are available at no cost to the client or the Indian Nation before funds are expended for concrete goods and support services;
If community resources for concrete goods and support services are not available, purchases must be made using the most economical and reasonable approach and may include purchasing items that are gently used or second hand;
DCYF will reimburse the Indian Nation for actual costs of concrete goods and/or support services up to the cumulative total of $500.00 permitted per family.
A description of engagement and a copy of all receipts shall be submitted with billing.
DCYF is not able to pre-pay for any services A Concrete Goods Guide that provides additional direction on Acceptable Concrete Funds can be accessed at https://www.dcyf.wa.gov/sites/default/files/pdf/ConcreteGoodsGuide.pdf Cultural Supplies The Indian Nation shall purchase cultural supplies to support the delivery of Positive Indian Parenting as follows:
To support Positive Indian Parenting session delivery and cultural relevance To support the cultural connection and wellbeing of program participants Cultural Supplies may include but are not limited to:
Drum or rattle making supplies Sewing and beading materials Tools to craft cultural items Items to support cultural ceremony which may include shells, sage, cedar or blankets.
Items to support traditional methods of preparing or gathering food Materials to support indigenous language reclamation efforts including the purchase of books or other media Materials to support traditional methods of infant care and attachment Cultural Consultation:
The Indian Nation shall reimburse cultural experts with lived experience including tribal Elders, community members, and language teachers to support the delivery of Positive Indian Parenting as follows:
To support Positive Indian Parenting session delivery and cultural relevance To support the cultural connection and wellbeing of program participants
8. Billing and Payment The Indian Nation shall submit a monthly invoice for services performed under this Agreement on State of Washington Invoice Voucher forms (Form A-19), prepared in the manner prescribed by DCYF.
a. The invoice shall state the amount of each cost or expense incurred by the Indian Nation in the preceding calendar month that is based on the items listed in the Budget Exhibit attached as Exhibit D. Costs or expenses listed in the invoice must match the corresponding items listed in the Budget Exhibit for costs or expenses that will be incurred by the Indian Nation.
b. The cost or expense billed for each such item shall be charged against the total amount listed for that item in the Budget Exhibit. The cumulative dollar amount for each such item, for all invoices submitted by the Indian Nation, shall not exceed the total dollar amount stated for that item in the Budget Exhibit.
c. The voucher shall clearly indicate that it is “FOR SERVICES RENDERED IN PERFORMANCE UNDER DCYF AGREEMENT NO._________ FOR THE MONTH OF _________, 20__” The A-19 invoice vouchers shall be submitted to:
Tessa Velasco, Culturally Responsive Services Manager Department of Children, Youth and Families tessa.velasco@dcyf.wa.gov
The Indian Nation shall contact the above Program Manager at (360) 918-3518 The rates shall be as specified above in the section titled “Consideration” of this Contract.
d. The Indian Nation shall bill for each month of service on a separate Form A-19. The A-19 shall state the month services were provided.
e. Claims for payment submitted by the Indian Nation shall be paid by DCYF if received by DCYF no later than sixty (60) days from the date services were rendered.
f. DCYF will not be obligated to pay for services submitted more than three (3) months after the calendar month in which the services were performed.
g. DCYF shall make payment within thirty (30) days of receipt of a properly completed invoice for services.
h. DCYF may withhold payment to the Indian Nation if reports required under this Agreement are delinquent, i.e., not submitted within ten (10) working days of the due date, or incomplete.
i. DCYF may, at its sole discretion, withhold payment claimed by the Indian Nation for services rendered if the Indian Nation fails to satisfactorily comply with any term or condition of the Agreement.
9. Services Authorized as Needed DCYF shall request services from the Indian Nation on an as-needed basis. This Agreement does not obligate DCYF to authorize services from the Indian Nation.
10. Payment Only for Authorized Services DCYF shall pay the Indian Nation only for authorized services provided in accordance with this Agreement. If this Agreement is terminated for any reason, DCYF shall pay only for services authorized and provided through the date of termination.
11. Funding Stipulations.
a. Information for Federal Funding. The Indian Nation agrees that it will cooperate in supplying any information to DCYF that may be needed to determine DCYF or the client’s eligibility for federal funding.
b. Duplicate Billing. The Indian Nation agrees that it will not bill other funding sources for services rendered under this Agreement which would result in duplicate billing to different funding sources for the same service. Furthermore, the Indian Nation agrees that it will ensure that no subcontractor bills any other funding sources for services rendered under this Agreement, which would result in duplicate billing to different funding sources for the same service.
c. No Federal Match. The Indian Nation agrees that it will not use funds payable under this Agreement as match toward federal funds without the prior written permission of DCYF.
d. Supplanting. The Indian Nation agrees that it will use these funds to supplement, not supplant the amount of federal, state and local funds otherwise expended for services provided under this Agreement.
12. Recovery of Fees for Noncompliance In the event the Indian Nation bills for services provided and is paid fees for services that DCYF later finds were either (a) not delivered or (b) not delivered in accordance with applicable standards or the requirements of this Agreement, DCYF shall have the right to recover the fees for those services from the Indian Nation, and the Indian Nation agrees that it will fully cooperate during the recovery process.
13. Prohibition of Use of Funds for Lobbying Activities The Indian Nation agrees that it will not use funds payable under this Agreement for lobbying activities of any nature. The Indian Nation certifies that no state or federal funds payable under this Agreement shall be paid to any person to influence, or attempt to influence, either directly or indirectly, an officer or employee of any state or federal agency, or an officer or member of any state or federal legislative body or committee, regarding the award, amendment, modification, extension, or renewal of a state or federal agreement or grant.
Any act by the Indian Nation in violation of this prohibition shall be grounds for termination of this Agreement, at the sole discretion of DCYF and shall subject the Indian Nation to such monetary and other penalties as may be provided by law.
14. Insurance Documentation
a. DCYF certifies it is self-insured under the State’s self-insurance liability program, as provided by RCW 4.92.130, and shall pay for losses for which it is found liable.
b. The Indian Nation shall, upon request by DCYF, submit evidence of coverage to the DCYF contact listed on page 1 of this Agreement either by a Certificate of Insurance or a letter certifying the Indian Nation is self-insured, as stated below in subsection c.
c. Letter of Certification of Self-Insurance shall include:
Legal name of Indian Nation Tax Identification # DCYF Agreement number(s) Level of self-insured retention The letter shall be signed by a duly authorized representative who can warrant and attest to the information contained in the letter.
15. Investigations of Contractor or Related Personnel DCYF may, without prior notice, suspend the Indian Nation’s performance of the Agreement if the Indian Nation, or any partner, officer or director of the Indian Nation, or a subcontractor, or any employee or volunteer of the Indian Nation or a subcontractor, is investigated by DCYF or a local, county, state or federal agency regarding any matter that, if ultimately established, could either:
a. Result in a conviction for violating a local, state or federal law, or
b. In the sole judgment of DCYF, adversely affect the delivery of services under this Agreement or the health, safety or welfare of DCYF clients.
c. DCYF may also take other lesser action, including, but not limited to, disallowing the subject of the investigation, whether an employee, volunteer, or other person associated with the Indian Nation or a subcontractor, from providing services, or from having contact with DCYF clients, until the investigation is concluded and a final determination made by the investigating agency.
16. Removal of Individuals from Performing Services
a. In the event that any of Indian Nation’s employees, subcontractors, or volunteers who provide services under this Agreement do not meet qualifications required by this Agreement or do not perform the services as required in this Agreement, DCYF may require that Indian Nation assure DCYF that such individual will not provide services to DCYF clients under this Agreement.
b. DCYF shall notify the Indian Nation of this decision verbally and in writing and the Indian Nation shall, within twenty-four (24) hours, disallow that person from providing direct services to DCYF clients. Failure to do so may result in a Compliance Agreement and possible suspension or termination of this Agreement.
17. Compliance Agreement In the event that DCYF identifies deficiencies in Indian Nation’s performance under this Agreement, DCYF may, at its option, establish a Compliance Agreement. When presented with a Compliance Agreement, Indian Nation agrees to undertake the actions specified in the plan within the timeframes given to correct the deficiencies. Indian Nation’s failure to do so shall be grounds for termination of this Agreement.
18. Resolution of Differences In the event of any differences between the parties on matters related to the interpretation and implementation of this Agreement, the parties shall first attempt to resolve the difference informally between themselves at the local or regional level, by contacting the DCYF contact on page 1 of this Agreement and following the identified regional conflict resolution process.
If the parties are unable to resolve their difference as stated above, then either party may submit a request for dispute resolution as provided in the Section titled “Disputes” in the Indian Nation and DCYF Agreement Regarding General Terms and Conditions referred to at the beginning of this Agreement.
A copy of the regional conflict resolution process is available from the DCYF contact person listed on page 1 of this Agreement.
19. Disputes
a. Either party who has a dispute concerning this Agreement may submit a written request for dispute resolution. The amount of any rate set by law, regulation, or DCYF policy is not disputable. A party’s written request for dispute resolution must include:
(1) A statement identifying the issue(s) in dispute; and
(2) The Indian Nation’s name, address and agreement number.
b. The request must be mailed to the following address within thirty (30) calendar days after the party could reasonably be expected to have knowledge of the issue, which is disputed.
c. A copy of the current DCYF’s dispute resolution process is available at any time by written request.
d. Requests for dispute resolution or for a copy of the current DCYF’s dispute resolution process should be sent to:
Department of Children, Youth & Families Attention: Contracts and Procurement Office P.O. Box 40983 Olympia, WA 98504-0983
e. This dispute resolution process is the sole administrative remedy available under this Agreement.
20. Emergency Management & Response
a. It may be possible, that during the performance of this Agreement, that DCYF or the State of Washington could issue or declare a State of Emergency. Such an emergency could include, but not be limited to:
(1) Pandemic;
(2) Public Health Emergency;
(3) Natural or manmade disaster; and / or
(4) Civil Unrest.
b. If such a declaration is made, by DCYF or the State of Washington, then DCYF may choose to temporarily modify the service delivery provisions of this agreement. Those modifications will be time limited and will be found here: https://www.dcyf.wa.gov/services/child-welfare-providers/contracted-services
EXHIBIT A
| 1. | Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions: |
| a. | “AES” means the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology (http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf). |
| b. | “Authorized Users(s)” means an individual or individuals with a business need to access DCYF Confidential Information, and who has been authorized to do so. |
| c. | “Cloud storage” means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iTunes, Dropbox, Box.com, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace. |
| d. | “Confidential Information” means information that may be exempt from disclosure to the public or other unauthorized persons under either chapter 42.56 RCW or other state or federal laws. Confidential Information includes, but is not limited to, Personal Information, agency source code or object code, and agency security data. “Confidential Information” also includes, but is not limited to, Category 3 and Category 4 Data as described in section 4 of this Exhibit (Exhibit A: Data Security Requirements), Personal Information, Materials, and Data. The definition of “Confidential Information” shall also include the definition described in section 1 (Definitions) of the General Terms and Conditions of this Contract. |
| e. | “Data” means DCYF’s records, files, forms, information and other documents in electronic or hard copy medium. “Data” includes, but is not limited to, Confidential Information. |
| f. | “Encrypt” means to encode Confidential Information into a format that can only be read by those possessing a “key”; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. |
| g. | “FedRAMP” means the Federal Risk and Authorization Management Program (see https://www.fedramp.gov/), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services. |
| h. | “Hardened Password” means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. |
| i. | “Mobile Device” means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. |
| j. | “Multi-factor Authentication” means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. “PIN” means a personal identification number, a series of numbers which act as a password for a device. Since PINs are typically only four to six characters, PINs are usually used in conjunction with another factor of authentication, such as a fingerprint. |
| k. | “Personal Information” shall have the same meaning as described in RCW 42.56.590(10) and includes, but is not limited to, information protected under chapter 13.50 RCW, Health Care Information as that phrase is defined in RCW 70.02.010, personally identifiable information, and other information that relates to a person’s name and the use or receipt of governmental services or other activities. |
| l. | “Portable Device” means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device. |
| m. | “Portable Media” means any machine-readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device. |
| n. | “Physically Secure” or “Physical Security” means that access is restricted through physical means to authorized individuals only. |
| o. | “Secure Area” means an area to which only authorized representatives of the entity possessing the Confidential Information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access to the Confidential Information is not available to unauthorized personnel. In otherwise Secure Areas, such as an office with restricted access, the Data must be secured in such a way as to prevent access by non-authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non-authorized staff cannot access it. |
| p. | “Staff” means the Contractor’s directors, officers, employees, and agents who provide goods or services pursuant to this Contract. “Staff” also means Subcontractors’ directors, officers, employees, and agents who provide goods or services on behalf of the Contractor. The term “Staff” also means the Subcontractors’ directors, officers, employees, and agents who provide goods or services on behalf of the Subcontractor and Contractor. |
| q. | “Trusted Network” means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DCYF Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data. |
| r. | “Unique User ID” means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. |
| 2. | Authority. |
| The security requirements described in this contract reflect the applicable requirements of Standard 141.10 (https://ocio.wa.gov/policies) | of the Office of the Chief Information Officer for the state of Washington, and of the DCYF Information Security Policy and Standards Manual. |
| 3. | Scope of Protection |
The requirements described in this Contract apply to Confidential Information and Data related to the subject matter of this Contract that is delivered, received, used, shared, acquired, created, developed, revised, modified, or amended by DCYF, the Indian Nation, or Subcontractors.
| 4. | Data Classification |
| a. | The Washington State Office of the Chief Information Officer (OCIO) has established policies that classify data into categories based on the data’s sensitivity. The categories described in Section 4 of OCIO policy No. 141.10 are adopted and incorporated by reference in this Agreement. Pursuant to Section 4 of OCIO policy No. 141.10 the categories are as follows: |
| (1) | Category 1 – Public Information |
Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls.
(2) Category 2 – Sensitive Information Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested.
(3) Category 3 – Confidential Information Confidential information is information that is specifically protected from either release or disclosure by law. This includes, but is not limited to:
| (a) | Personal information as defined in RCW 42.56.590 and RCW 19.255.10; | |
| (b) | Information about public employees as defined in RCW 42.56.250; | |
| (c) | Lists of individuals for commercial purposes as defined in RCW 42.56.070(9); and | |
| (d) | Information about the infrastructure and security of computer and telecommunication | networks as defined in RCW 42.56.420. |
| (4) | Category 4 – Confidential Information Requiring Special Handling |
Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which:
| (a) | Especially strict handling requirements are dictated, such as by statutes, regulations, or | agreements; and |
| (b) | Serious consequences could arise from unauthorized disclosure, such as threats to health | and safety, or legal sanctions. |
| 5. | Compliance with Laws, Rules, Regulations, and Policies | |
| a. | Confidential Information and Data that is delivered, received, used, shared, acquired, created, developed, revised, modified, or amended in connection with this Contract the parties shall comply with the following: | |
| (1) | All federal and state laws and regulations, as currently enacted or revised, regarding the protection, security, and electronic interchange of Confidential Information and Data; and | |
| (2) | All federal and state laws and regulations, as currently enacted or revised, regarding the use, disclosure, modification or loss of Confidential Information and Data. | |
| 6. | Administrative Controls. | |
| a. | The Indian Nation must have the following controls in place: | |
| (1) | A documented security policy governing the secure use of its computer network, mobile devices, portable devices, as well as, any form of paper/hard copy documents. | |
| (2) | Security awareness training for all staff, presented and documented annually, as follows: | |
| (a) | Indian Nation staff responsibilities under the Contractor’s security policy; | |
| (b) | Contactor staff responsibilities as outlined under contract Exhibit A; and | |
| (c) | Must successfully complete the DCYF Information Security Awareness Training, which can be taken on this web page: https://www.dcyf.wa.gov/sites/default/files/pdf/Security-in-Contracts.pdf | |
| (3) | The Indian Nation may replace the DCYF Information Security Awareness training listed above with their own equivalent Information Awareness Training. | |
| 7. | Authorization, Authentication, and Access. | |
| a. | In order to ensure that access to the Data is limited to authorized staff, the Indian Nation must comply with the following: | |
| (1) | Have documented policies and procedures that: | |
| (a) | Govern access to systems; and | |
| (b) | Govern access to paper/hard copy documents and files. | |
| (2) | Only allow access to Confidential Information through administrative, physical, and technical controls. | |
| (3) | Ensure that user accounts are unique and that any given user account logon ID and password combination is known only to the one staff member to whom that account is assigned. For purposes of non-repudiation, it must always be possible to determine which staff member performed a given action on a system housing the Data based solely on the logon ID used to perform the action. | |
| (4) | Ensure that only authorized users are capable of accessing the Data; | |
| (5) | Ensure that an employee’s access to Data is removed: | |
| (a) | Within twenty-four (24) hours of an alleged compromise of the user credentials; | |
| (b) | Within 24 hours from when their employment, or the contract under which the Data is made available to them, is terminated; | |
| (c) | Within 24 hours from when the employee or contractor no longer need access to the Data to fulfill the requirements of the Contract; and | |
| (d) | Within 24 hours from when the staff member has been suspended from performing services under this Contract. | |
| (6) | Have a process in place the requires quarterly reviews verifications that ensure only authorized users have access to systems containing Confidential Information. | |
| (7) | The Indian Nation must require the following password and logon requirements for Authorized Users to access Data within the Trusted Network: | |
| (a) | To access Data the Authorized User must be required to enter a Hardened Password; | |
| (b) | The hardened password must not contain a user’s name, logon ID, or any form of an individual’s full name; | |
| (c) | The hardened password must not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words; and | |
| (d) | Hardened passwords are significantly different from the previous four (4) passwords. Hardened passwords that increment by simply adding a number are not considered significantly different. | |
| (8) | When accessing Confidential Information and Data from an external location (the Data will traverse the Internet or otherwise travel outside the Trusted network), mitigate risk and enforce hardened password and logon requirements for users by employing measures that include: | |
| (a) | Ensuring mitigations applied to the system don’t allow end-user modification; | |
| (b) | Not allowing the use of dial-up connections; | |
| (c) | Using industry standard protocols and solutions for remote access. Examples include secure VPN and Citrix; | |
| (d) | Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network; | |
| (e) | Ensuring that the remote access system prompts for re-authentication or performs automated session termination after no more than thirty (30) minutes of inactivity; and | |
| (f) | Ensuring the use of Multi-Factor Authentication (MFA) to connect from the external end point to the internal end point. | |
| (9) | Hardened passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.). If a lesser standard is authorized under this subsection, the PIN or password must: | |
| (a) | Be at least five (5) letters or numbers when used in conjunction with at least one other authentication factor; | |
| (b) | Not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable); and | |
| (c) | Not contain a “run” of three or more consecutive numbers (12398, 98743 would not be acceptable). | |
| (10) | If the Contract specifically allows for the storage of Confidential Information on a Portable Device, passwords used on the device must: | |
| (a) | Be a minimum of six (6) alphanumeric characters; | |
| (b) | Contain at least three unique character classes (upper case, lower case, letter, number); | |
| (c) | Not contain more than a three consecutive character run. Passcodes consisting of (12345, or abcd12 would not be acceptable); and | |
| (d) | Render the device unusable after a maximum of five (5) failed logon attempts. | |
| 8. | Protection of Data. | |
| a. | The Indian Nation agrees to store Data on one or more of the following medias and protect the Data as described: | |
| (1) | Hard disk drives |
Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards.
| (2) | Network server disks |
| (a) | Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. |
| (b) | Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. |
| (3) | Optical discs (CDs or DVDs) in local workstation optical disc drives |
| (a) | Data provided by DCYF on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area, when not in use for the contracted purpose, such discs must be Stored in a Secure Area. |
| (b) | Workstations that are capable of accessing Data from optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. |
| (4) | Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers |
| (a) | Data provided by DCYF on optical discs that will be attached to network servers will not be transported out of a Secure Area. |
| (b) | Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. |
| (c) | Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. |
| (5) | Paper documents |
| (a) | All paper documents must be protected by storing the records in a Secure Area, with access controlled through the use of a key, card key, combination lock, or comparable mechanism, and which is only accessible to authorized personnel. |
| (b) | When being transported outside of a Secure Area, paper documents must be under the physical control of the Indian Nation staff with authorization to access the Data. |
| (c) | Paper documents will not be secured or stored in a motor vehicle any time a staff member is away from the motor vehicle. NOTE: The use of a lock box, other lockable storage container or a non-lockable storage container stored in a vehicle does not override this requirement. |
| (d) | Paper documents will be retained in a Secure Area, per the State of Washington records retention requirements. |
| (6) | Data storage on portable devices or media |
| (a) | Except where otherwise described herein, Data shall not be stored by the Indian Nation on portable devices or media unless specifically authorized within the terms and conditions of the Contract. If so authorized, the Data shall be given the following protections: |
| i. | The Data must be Encrypted; |
| ii. | Portable devices must be equipped with a Unique User ID and Hardened Password or stronger authentication method such as token or biometrics; |
| iii. | Portable devices must be manually locked whenever they are left unattended. The devices must be set to automatically lock after a period of no more than fifteen (15) minutes of inactivity; |
| iv. | Administrative and physical security controls must be applied to Portable Devices and Portable Media by: |
| (A) | Keeping them in a Secure Area when not in use; |
| (B) | Using check-in/check-out procedures when they are shared; and |
| (C) | Taking quarterly inventories. |
| (b) | When being transported outside of a Secure Area, Portable Devices and Portable Media with Data must be under the physical control of Indian Nation staff with authorization to access the Data, even if the Data is encrypted. |
| (c) | Portable Devices and Portable Media will not be secured or stored within motor vehicles at any time the staff member is away from the motor vehicle. |
| (7) | Data stored for backup purposes |
| (a) | DCYF Confidential Information may be stored on Portable Media as part of the Indian Nation’s existing, documented backup process for business continuity or disaster recovery purposes. |
| i. | Such storage is authorized until such time as that media would be reused during the course of normal backup operations. |
| ii. | If backup media is retired while DCYF Confidential Information still exists upon it, refer to Section 13 Data Disposition. |
| (b) | Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of the Indian Nation’s existing, documented backup process for business continuity or disaster recovery purposes. |
| i. | If so, such media will be protected as otherwise described in this exhibit. |
| ii. | If this media is retired while DCYF Confidential Information still exists upon it, refer to Section 13 Data Disposition. |
| (8) | Cloud storage |
| (a) | Data requires protections equal to or greater than those specified elsewhere within this Exhibit. |
| (b) | Cloud storage of Data is problematic as neither DCYF nor the Indian Nation has control of the environment in which the Data is stored. For this reason: |
| i. | Data must not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: |
| (A) | The Indian Nation has written procedures in place governing use of the Cloud storage and by signing this contract, the Indian Nation attests that all such procedures will be uniformly followed; |
| (B) | The Data must be Encrypted while within the Indian Nation network; |
| (C) | The Data must remain Encrypted during transmission to the Cloud; |
| (D) | The Data must remain Encrypted at all times while residing within the Cloud storage solution; |
| (E) | The Indian Nation must possess a decryption key for the Data, and the decryption key will be possessed only by the Indian Nation and/or DCYF; |
| (F) | The Data must not be downloaded to a non-authorized system. the only authorized systems are located on the DCYF network or Trusted networks; |
| (G) | The Data must not be decrypted until downloaded onto a computer or portable devise within the control of an Authorized User and within either the DCYF network or Trusted network; and |
| (H) | Access to the cloud storage requires Multi Factor Authentication. |
| ii. | Data must not be stored on an Enterprise Cloud storage solution unless either: |
| (A) | The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to all of the requirements within this exhibit; or |
| (B) | The Cloud storage solution used is FedRAMP certified; or |
| (C) | Indian Nation can attest that: |
1. They have reviewed the data security policy of the cloud service provider; and
2. The cloud service provider meets requirements of Exhibit A in full or with limited exceptions.
| 9. | Method of Transfer |
| a. | All Data transfers to or from the Indian Nation shall be made by using an approved solution that meets agency and state IT security standards. |
| (1) | Approved options include: |
| (a) | SFT service provided Washington Technology Solutions (WaTech); or |
| (b) | The DCYF instance of Box.com. |
| b. | Any information containing sensitive data elements must be encrypted and password protected using a tool such as WinZip, 7zip, or something similar. |
| c. | An account is required to access either of the above solutions, you will need to make a request by contacting the contract contact listed on the cover page of this Agreement. |
| d. | Any other solution must be approved by the DCYF Information Security Office. To obtain approval, contact the contract contact listed on the cover page of this Agreement. Request must include the name of the solution, as well as, any information to help in the approval process. |
| e. | The Indian Nation must use a secure solution for electronic mail submissions which contain Confidential information, and Personal Information, as defined in the General Terms and Conditions. |
| f. | Information regarding receiving encrypted email from DCYF can be obtained at DCYF’s website, located at: https://www.dcyf.wa.gov/services/child-welfare-providers/encrypted-email. |
| 10. | System Protection. |
| a. | To prevent compromise of systems that contain DCYF Data or systems that Data passes through, the Indian Nation must: |
| (1) | Ensure all security patches or hotfixes applied within three (3) months of being made available; |
| (2) | Have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes; |
| (3) | Ensure systems containing Data shall have an Anti-Malware application installed, if available; and |
| (4) | Ensure that Anti-Malware software is kept up to date. The product, its anti-virus engine, and any malware database the system uses, will be no more than one update behind current. |
| 11. | Data Segregation. |
| a. | Data must be segregated or otherwise distinguishable from non-DCYF data. This is to ensure that when no longer needed by the Indian Nation, all Data can be identified for return or destruction. It also aids in determining whether Data has or may have been compromised in the event of a security breach. |
| b. | The Indian Nation must use one or more of the following methods to segregate Data: |
| (1) | Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non-DCYF Data; and/or |
| (2) | Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to Data; and/or |
| (3) | Data will be stored in a database which will contain no non-DCYF data; and/or |
| (4) | Data will be stored within a database and will be distinguishable from non-DCYF data by the value of a specific field or fields within database records; and |
| (5) | When stored as physical paper documents, Data will be physically segregated from non-DCYF data in a drawer, folder, or other container. |
| c. | When it is not feasible or practical to segregate Data from non-DCYF data, then both the Data and the non-DCYF data with which it is commingled must be protected as described in this exhibit. |
| 12. | Confidentiality Protection |
| a. | To safeguard confidentiality, and ensure that access to all Data is limited to authorized staff, the Indian Nation must: |
| (1) | Ensure that the Indian Nation’s Staff, Subcontractors, and the Subcontractors’ Staff use Data solely for the purposes of accomplishing the services set forth in this Agreement. |
| (2) | Ensure that no Data is released, disclosed, published, modified, transferred, sold, or otherwise made known to unauthorized persons without the prior written consent of the individual named or as otherwise authorized by law. |
| (3) | Not use, publish, transfer, sell or otherwise disclose any Confidential Information of a minor except as provided by law or with the prior written consent of the minor’s parent, legal representative or guardian. If a child is a dependent of Washington State, then prior written consent must be obtained from DCYF. |
| (4) | Require that the Indian Nation’s Staff and Subcontractors’ Staff having access to Data sign a Statement of Confidentiality and Non-Disclosure Agreement (DCYF Form 03-374B), that can be found at this webpage: https://www.dcyf.wa.gov/forms. Data shall not be released to the Indian Nation’s Staff person(s) or Subcontractors’ Staff person(s) until the following conditions have been met: |
| (a) | DCYF approves the Indian Nation’s Staff person(s) or Subcontractors’ Staff person(s), to work on this Contract; and |
| (b) | If requested by DCYF, The Indian Nation must provide the original Statement of Confidentiality and Non-Disclosure Agreement, signed by the Staff person(s) and Subcontractors’ Staff person(s). |
| 13. | Data Disposition. |
| a. | The Indian Nation must ensure that all Data, including paper and electronic records, are retained pursuant to the Washington State retention standards. |
| b. | When the contracted work has been completed or when the Data is no longer needed, Data shall be retained pursuant to the retention standards required by chapter 40.14 RCW, or returned to DCYF. |
| c. | Once the retention standard has passed, The Indian Nation may destroy data as outlined below: |
| (1) | The following acceptable methods of destruction must be used: |
| Data stored on: | |
| Will be destroyed by: |
Server or workstation hard disks, or
Removable media (e.g. floppies, USB flash drives, portable hard disks) excluding optical discs
Using a “wipe” utility which will overwrite the Data at least three (3) times using either random or single character data, or
Degaussing sufficiently to ensure that the Data cannot be reconstructed, or
Physically destroying the disk
| Paper documents with Category 3 Confidential Information |
| Recycling through a contracted firm, provided the contract with the recycler assures that the confidentiality of Data will be protected. |
| Paper documents containing Category 4 Confidential Information requiring special handling (e.g. protected health information) |
| On-site shredding, pulping, or incineration |
| Optical discs (e.g. CDs or DVDs) |
| Incineration, shredding, or completely defacing the readable surface with a coarse abrasive |
| Magnetic tape |
| Degaussing, incinerating or crosscut shredding |
| 14. | Data shared with Subcontractors. |
| a. | If the Subcontractor cannot protect the Data described in this Agreement, then the contract with the subcontractor must be submitted to the DCYF Contact specified for this contract for review and approval. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .