PO SOW (PMT-57) - Fleet Management ONLY.pdf

PURCHASE ORDER SCOPE OF WORK

Fleet Management Application

PMT-57 1 v.24.1

1. Description of Service The Provider must provide the services described within this Scope of Work (Scope).

The Provider shall deliver to the Department of Children and Families (“Department”) licensing and ongoing support for an automated, cloud-hosted, web-based solution(s). The Fleet Management Application (Application) must have the ability support up to at least 3,500 vehicles, while the Department anticipates current needs for approximately 1,200 vehicles. The Application will include, at a minimum, the functionality outlined in this Scope of Work. The Provider shall also demonstrate the ability to scale services in response to the Department’s evolving and fluctuating needs.

2. Governance Based on §287.057(19), Florida Statutes (F.S.), if applicable, Provider(s) under this contract will be prohibited from participating in any other engagement that the Provider provides related content as this would create a conflict of interest. The Provider shall comply with all applicable state and federal requirements, including, without limitation:

3. Term

3.1 The anticipated term of the resulting Contract is January 1, 2026, through December 31, 2029.

The term of the resulting Contract is subject to change based on the actual execution date of the resulting Contract.

3.2 In accordance with §287.058(1)(g), F.S., the Contract resulting from this procurement may be renewed for a period that may not exceed three years or the term of the resulting original Contract period, whichever is longer. Renewal of the Contract shall be in writing and subject to the same terms and conditions set forth in the original Contract. A renewal may not include any compensation for costs associated with the renewal. Renewals are contingent upon satisfactory performance as determined by the Department, are subject to the availability of funds, and optional to the Department.

3.3 Funding under this Contract is subject to the availability of funds. The Department reserves the right to expand the Scope performed by the Provider, should additional needs and funding become available. Additional services may be included in, or added to, any purchase order(s), upon mutual written agreement, and through issuance of a change order.

4. Composition of the Contract

4.1 This Contract is composed of the documents listed in this section. In the event of any conflict between the documents, the documents shall be interpreted in the following order of precedence:

4.1.1 Purchase Order Scope of Work (PMT-57), and other attached documents: All other attachments and exhibits to the contract referenced in the solicitation shall also be part of the resulting contract, if any

4.1.2 The Department’s Purchase Order Terms and Conditions, located at:

https://www.myflfamilies.com/general-information/contracted-client-services/library.

4.1.3 Department of Children and Families Standard Contract Definitions, located at:

https://www.myflfamilies.com/general-information/contracted-client-services/library.

4.1.4 PUR 1000 Form, located at:

https://www.dms.myflorida.com/business_operations/state_purchasing/state_agency_resources/state_ purchasing_pur_forms.

4.1.5 Provider Response: The Provider’s Response and any additional submittals, if incorporated into or attached to the contract.

https://www.myflfamilies.com/general-information/contracted-client-services/library https://www.myflfamilies.com/general-information/contracted-client-services/library https://www.dms.myflorida.com/business_operations/state_purchasing/state_agency_resources/state_purchasing_pur_forms https://www.dms.myflorida.com/business_operations/state_purchasing/state_agency_resources/state_purchasing_pur_forms

PMT-57 2 v.24.1

4.2 Notwithstanding the order of precedence indicated, for purchases based on a state term contract or an enterprise alternative contract source procured for state agency use by the Department of Management Services (DMS), the terms of the underlying state term contract or Department of Management Services enterprise alternative contract source agreement shall prevail over conflicting terms in other documents in the order of precedence, unless by the terms of that underlying state term contract or alternative contract source agreement the “Customer” is explicitly authorized to vary the terms to the State’s detriment.

5. Elements of Services The Provider is responsible for the performance of all tasks and deliverables contained in this Scope.

5.1.1 Service Delivery Location

The Department’s preferred method of service delivery is for the Provider to perform work remotely from within the contiguous United States. The Department reserves the right to request work to be performed in person (at the Department’s Headquarters office in Tallahassee, Florida), if performing work in person is more time-efficient and cost-effective than performing work remotely. The Provider is responsible for any incremental costs associated with having staff travel or work remotely.

5.2 Equipment

The Provider must provide all equipment required for the services within this Scope.

6. SERVICE SPECIFICATIONS

6.1 The Provider shall provide a secure, user friendly, online, cloud-hosted Application capable of tracking, logging, calculating, and reporting mileage for Department staff such as the Child Protective Investigators (CPIs), Adult Protective Investigators (APIs), and Field Support Staff (FSS), when using state issued fleet vehicles. The Department is anticipating two separate modules, a Mileage Reimbursement module and a Fleet Management module.

6.1.1 The Provider shall deliver licensing for the Application.

6.1.1.1 The Provider shall offer a tiered structure of license costs that would be applicable should the Department require additional or a reduced number of licenses in the future.

6.1.2 The Application must integrate with the Department’s enterprise Identity Access Management (IAM) System, Okta. All solution/system user access will utilize the Department’s enterprise IAM System, Okta.

6.1.3 The Application must integrate with the Department’s Enterprise Data Warehouse (EDW), which is hosted in Azure Synapse, for data repository and internal data analysis.

6.1.4 Provider shall integrate through the Department’s Data Replication tool Qlik Replicate for real-time data replication needs, when appropriate.

6.1.5 Provider shall integrate application through the Department’s Enterprise Integration/API platform Mulesoft for all web services and APIs, where appropriate.

6.1.6 The Fleet Management Application must be customized to generate data reports that will adhere to the following requirements:

6.1.6.1 Agency Operating Procedure CFOP 40-1 (chapter 5-6) policy and guidelines in computing travel mileage (Attachment A), as outlined in the Department of Financial Services (DFS) Reference Guide for State Expenditures, Attorney General Opinion 82-34.

https://www.myflfamilies.com/sites/default/files/2022-12/cfop_40-1_official_travel_of_dcf_employees_and_non-employees_0.pdf https://www.myfloridacfo.com/docs-sf/accounting-and-auditing-libraries/manuals/agencies/reference-guide-for-state-expenditures.pdf?sfvrsn=b4cc3337_6 https://www.myfloridacfo.com/docs-sf/accounting-and-auditing-libraries/manuals/agencies/reference-guide-for-state-expenditures.pdf?sfvrsn=b4cc3337_6

PMT-57 3 v.24.1

6.1.7 The Application installed on drivers’ mobile phones must support geo-tracking functionality and provide location data suitable for reporting and analytics. The Department requires that tracking be conducted via mobile devices only and does not permit the use of vehicle plug-in devices.

Accordingly, the Provider must deliver an app-based solution that includes this capability.

6.2 The Provider shall deliver a training to the Department Users showing how the Application and its different functions operate. Acceptable methods of training are a readily available video or an online training.

6.3 Users

The Department anticipate the following types of Users and vehicles; however, these numbers are estimates and are subject to change as necessary:

6.3.1 12-15 Admin Users

6.3.2 The Department Currently operates approximately 1,200 vehicles. To accommodate potential changes in fleet size, the Provider must offer tiered pricing that reflects both increases and decreases in the number of vehicles. The anticipated vehicle breakdown is as follows:

6.3.2.1 900-1,000 Department Owned Fleet Vehicles

6.3.2.2 Approximately 1,500 Leased Fleet Vehicles (Approximately 900 currently, with 565 coming in the future)

6.3.2.3 Approximately 1,000 personal vehicles utilizing mileage reimbursement.

6.4 The Provider shall provide 24-hour help desk support to end-users of the Application.

6.5 Fleet Management Application Functions

The Application and any required hardware must provide at minimum the following functions:

6.5.1 Distinguish between Owned Fleet Vehicles and Leased Vehicles, as well as the following:

6.5.1.1 Vehicles in Service

6.5.1.2 Vehicles out for maintenance, and

6.5.1.3 Vehicles not being used.

6.5.2 Mileage Tracker

Tool used that records the number of miles driven for the purposes of determining the reimbursement amounts.

6.5.3 Fuel Tracker

System or device used to monitor and record a vehicle’s fuel consumption for fleet vehicles.

6.5.4 Maintenance Status – Scheduling and Reporting

The Application must include timeframe and mileage maintenance recommendations and count downs for fleet vehicles.

6.5.4.1 Types of Maintenance include but are not limited to the following:

6.5.4.1.1 Oil Change

6.5.4.1.2 Tire Rotation

6.5.4.1.3 Air Filter (Replace)

6.5.4.1.4 Coolant (Flush/Replace)

6.5.4.1.5 Spark Plug (Replace)

6.5.4.1.6 Transmission Fluid (Replace)

PMT-57 4 v.24.1

6.5.4.1.7 Drive Belts (Replace)

6.5.4.1.8 Tires (Repair/Replace)

6.5.4.2 Maintenance Management

6.5.4.2.1 Maintenance to Perform (future)

6.5.4.2.2 Actions needing to be completed (current)

6.5.4.2.3 Delinquent Maintenance (history)

6.5.4.2.4 Unplanned Maintenance (e.g. Nail in tire, Light bulbs, Windshield wipers, etc.)

6.5.4.3 Detailed Vehicle Inspections

6.5.5 Cost Tracking for fleet vehicles

6.5.5.1 Fuel Costs

6.5.5.2 Maintenance Costs

6.5.5.3 Other Costs

6.5.6 Mileage Reimbursement for personal vehicles. Reference section 6.1.2.

6.5.7 Vehicle Telematics for fleet vehicles

6.5.7.1 Engine Performance

6.5.7.2 Fuel Efficiency

6.5.7.3 Driver Behavior/Performance, such as

6.5.7.3.1 Braking and Acceleration

6.5.7.3.2 Vehicle Speed

6.5.7.4 GPS Location

6.5.7.5 Idling Time

6.5.7.6 Vehicle Faults

6.5.7.7 Mileage

6.5.8 Vehicle Pool Portal

6.5.8.1 The Department’s Vehicle Pool is shared pool of vehicles that various

Department Users can utilize as needed.

6.5.8.2 The Vehicle Pool Portal will include a snapshot of which Department User has a particular vehicle(s) at a specific time and whether is the usage is considered long-term, or the Department user is temporarily using the vehicle from the Vehicle Pool.

6.5.8.3 The Vehicle Pool Portal shall include the ability to make vehicle reservations.

6.5.9 Manual input for DMS requirements (exports).

6.5.9.1 The system shall have export capability into (but not limited to) CSV, Word, PDF, Excel or some other file format that would allow for importing into DMS’ enterprise fleet management system. Currently the Department can manually input data into the DMS' enterprise fleet management system. The Provider shall assist the Department in determining improvement options to this process, such as the ability to import or batch upload data.

6.5.10 Some travelers have multiple vehicles that must be tracked separately.

6.5.11 Data Dashboard

6.5.11.1 The Application’s dashboard shall include features to allow the Department to stay ahead of maintenance, streamline workflows, and manage assets/inventory from a centralized data hub.

6.5.11.2 This Dashboard shall be a visual interface that displays key metrics and performance indicators (KPIs) related to the Department’s fleet of vehicles, providing real-time insights into aspects like vehicle location, fuel

PMT-57 5 v.24.1 consumption, driver behavior, maintenance status, and overall operational efficiency.

6.5.12 Ability to run reports for data visibility.

6.6 STAFFING REQUIREMENTS

6.6.1 The Provider shall have adequately trained and physically able staff readily available to perform services 24-hours per day, seven (7) days per week, 365 days a year. Staffing levels shall be sufficient to deliver the services.

6.6.1.1 The Provider shall have direct oversight and responsibility for the performance of all its staff. The Provider shall monitor the performance of all its staff, ensuring they follow the staffing requirements to support this agreement.

6.6.1.2 The Provider’s staff shall liaise with, and maintain a good working relationship with, Department staff, and others working with the Department.

6.6.1.3 The Provider shall deliver a list of all current staff providing services in any resulting contract(s). This list shall include the staff member’s title, certifications (if applicable), and if the staff member is Full-Time, Part-Time, or Temporary, within 10 business days of any resulting Contract(s) execution.

6.7 HOSTING, OPERATIONS, AND MAINTENANCE

The Provider shall:

6.7.1 Provide Application access in hosted environment, adhering to the availability standard described in this section, excluding scheduled downtime (maintenance).

6.7.1.1 The Application will be available 24-hours per day, 7-days per week, 365-days per year, except for scheduled downtime, 98% of the time.

6.7.1.2 The Department’s Contract Manager, or designee, shall be notified by email 12-hours prior to any scheduled downtime.

6.7.1.3 The Provider’s scheduled downtime must occur after 10:00 PM, ET and before 6:00 AM, ET, unless a different time is approved by the Department in writing.

6.7.1.4 Any instances of unscheduled downtime shall be reported to the Department within 12-hours of occurrence.

6.7.1.5 Maintenance must be performed in order to correct faults (updates), improve design (upgrades), and implement enhancements.

6.7.2 Provide any necessary hardware/devices required for installation in fleet vehicles for tracking.

6.7.3 Be responsible for ongoing maintenance to ensure the Application and any related hardware, software and integrations, receive updates, upgrades, and enhancements to continue satisfying the Department’s requirements.

6.7.4 Ensure Application interfaces with other State of Florida databases and/or systems are maintained throughout the life of the Contract.

6.7.5 Fulfill the Department’s request(s) to provide additional operations and maintenance services needed to support any service(s) selected.

7. Deliverables, Minimum Performance Measures, and Financial Consequences

7.1 The Provider must complete or submit the following deliverables in the time and manner specified herein.

PMT-57 6 v.24.1

7.2 Pursuant to §287.058, F.S., the Contract must contain financial consequences that will apply if the Provider fails to perform in accordance with the Contract terms.

7.3 The deliverables must meet the following minimum service level, and failure of the Provider to complete or submit a deliverable in the time and manner specified will result in a reduction in payment for that deliverable.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

PMT-57 7 v.24.1

DELIVERABLES, MINIMUM PERFORMANCE MEASURES, AND FINANCIAL CONSEQUENCES

No. Deliverable Description Minimum Performance

Measure Financial Consequence

Application(s) Go-Live The Provider shall ensure timely launch of the Application, according to the Department’s requirements and timelines. The Provider shall obtain Department acceptance that the Application functions as required.

Due Date: TBD – Based upon agreed upon timeline submitted by the Provider.

Provider shall:

• Complete all activities for the associated Application(s), and adhere to all provisions, described in herein.

Payment shall be reduced by $100 a day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

Application Licensing The Provider shall provide licensing/hosting for the cloud-based Application, according to the Department’s requirements and timelines. The Provider shall obtain Department acceptance that the Application functions are acceptable as designed.

• Complete all activities for the associated Application(s), or adhere to all provisions, described herein.

Payment shall be reduced by $100 a day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

Monthly Summary Report The Provider shall provide a Monthly Summary Report for the previous month’s Application services, in a Department approved format, via email, to the Department’s Project Manager, or designee.

Due Date: No later than the 10th calendar day of each month following

Provider shall:

• Provide report for the associated Application(s), as defined in 8.4.1 by this Deliverable’s due date.

The Department shall assess financial consequences in the amount of $250 a day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

PMT-57 8 v.24.1 the month that services were provided.

Application Down-time Report The Provider shall provide a Monthly Application Down-Time Report, for each Region, to the Department’s Project Manager, or designee. This report shall include approved scheduled downtime.

Due Date: No later than the 10th calendar day of each month following

• Provide report for the associated Application(s), as defined in 8.4.2 by this Deliverable’s due date.

day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

Help Desk Support Report The Provider shall provide a Help Desk Support Report, for each Region, to the Department’s Project Manager, or designee.

Due Date: No later than the 10th

• Provide report for the associated Application(s), as defined in 8.4.3 by this Deliverable’s due date.

• Provide help desk support 24-hours per day, seven (7) days per week, 365 days per year.

day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

6 Downtime Standards

Provider shall adhere to the requirements of Section 6.7.1 for the associated Application(s).

This will be verified utilizing the Monthly Application Down-Time Report.

The Department shall assess a financial consequence of $500 for:

• Each percentage deviated from Section 6.7.1.1 (98%).

• Each failure to notify the Department in accordance with Section 6.7.1.2.

• Each failure to adhere to the hours for scheduled downtime in accordance with Section 6.7.1.3.

• Each failure to adhere to Section 6.7.1.4

PMT-57 9 v.24.1

7 End-User Training Due Date: No later than the 10th the conclusion of the quarter.

Provider shall adhere to the requirements of Section 8.4.4 for the associated Application(s).

and timely submit the Quarterly End-User Training Report.

The Department shall assess financial consequences in the amount of $250 per day, for each day this Deliverable remains incomplete or does not meet the Minimum Performance Measures.

PMT-57 10 v.24.1

8. Reports

8.1 The Provider shall adhere to reporting requirements included in this section. The Department reserves the right to direct the Provider to amend or update its reports and/or report formats in accordance with the best interests of the Department and at no cost to the Department. The Department will notify the Provider of such modification, in writing.

8.2 The Department reserves the right to modify reporting formats and submission timetables resulting from changing priorities or management direction.

8.3 Executive Compensation Reporting. Annually on or before May 1 Provider shall complete and return the Executive Compensation Annual Report (Form PCMT-08), located at:

https://www.myflfamilies.com/general-information/contracted-client-services/library.

8.4 The Provider shall submit the following:

8.4.1 Monthly Summary Report: The Provider shall deliver a Monthly Summary Report, for each User (i.e. CPI, API, FSS) by Region, to the Department’s Contract Manager, or designee, by the 10th calendar day of each month following the month when services were provided. The following information shall be included in the report:

8.4.1.1 The Name of the User and Region (Central, Headquarters, Northeast, Northwest, Southern, Southeast, Suncoast);

8.4.1.2 Date and time the request for service(s) was received;

8.4.1.3 Type of service(s) requested; and

8.4.1.4 Date and time the service(s) was provided.

8.4.2 Down-Time Report: The Provider shall provide a Monthly Application Down-Time Report, for each Region, to the Department’s Project Manager, or designee, by the 10th calendar day of each month following the month when services were provided. The following information shall be included in the report:

8.4.2.1 The Region (Central, Headquarters, Northeast, Northwest, Southern, Southeast, Suncoast);

8.4.2.2 Date and time the Application was unavailable (scheduled or unscheduled); and

8.4.2.3 Date and time the Application became available (functioning).

8.4.3 Help Desk Support Report: The Provider shall provide a Monthly Help Desk Support Report, for each Region, to the Department’s Project Manager, or designee, by the 10th calendar day of each month following the month where services were provided. The following information shall be included in the report for each service type provided:

8.4.3.1 The Region Name (Central, Headquarters, Northeast, Northwest, Southern, Southeast, Suncoast);

8.4.3.2 Date and time the Help Desk was initiated; and

8.4.3.3 Length of time taken to resolve each Help Desk inquiry.

8.4.4 Quarterly End-User Training Report: The Provider shall deliver a Quarterly End-User Training Report, which includes at a minimum the following:

https://www.myflfamilies.com/general-information/contracted-client-services/library

PMT-57 11 v.24.1

8.4.4.1 Number of Users trained

8.4.4.2 Names of Users trained

9. Invoicing and Payments

9.1 General Information

9.1.1 A Purchase Order (PO) will be issued to the Provider.

9.1.2 The method of payment for this purchase is fixed rate.

9.1.3 The Provider will not receive payment in advance for goods or services described in this Scope.

9.2 Invoicing

9.2.1 The Provider must submit an invoice upon completion of each deliverable that provides a detailed accounting of the deliverables performed during the invoice period for which payment is being requested. Invoices must be sufficient for a proper pre-audit and post-audit thereof.

9.2.2 The invoice shall be submitted along with the documentation supporting completion of each deliverable, milestone, recurring maintenance and operations monthly cost. Each invoice must include the following information:

9.2.2.1 PO number,

9.2.2.2 Provider name and address,

9.2.2.3 Provider federal identification number,

9.2.2.4 Date(s) and services provided,

9.2.2.5 Identification of any deliverable(s) due during the invoicing period,

9.2.2.6 Invoice amount,

9.2.2.7 PO balance after payment of invoice, and

9.2.2.8 Signature of Provider’s authorized representative and date signed.

9.2.3 The Department may require any other information from the Provider that the Department deems necessary to verify the completion of services.

9.3 Payments

9.3.1 The Provider will receive payment for deliverables described in this Scope after deliverables submitted to the Department are deemed to meet the Department’s satisfaction.

9.3.2 Payments to the Provider through this PO will be made through MyFloridaMarketPlace (MFMP), thus it is required that the Provider is registered with MFMP.

9.3.3 MFMP registration instructions are located at:

https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_ve ndors/requirements_for_vendor_registration

9.3.4 The PO and this document contain all terms and conditions agreed upon by the parties, which terms and conditions shall govern all transactions between the Department and Provider related to this Contract. This Contract may only be modified or amended upon mutual written agreement of the Department and Provider. Any modification to this PO will be addressed through a change order within

MFMP.

9.3.5 Effective July 1, 2024, the MFMP transaction fees imposed for the use of MFMP are equal to seven-tenths of one percent (0.7%) of the payment issued. More information is located at:

https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_ve https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/requirements_for_vendor_registration https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/requirements_for_vendor_registration https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/transaction_fee_and_reporting

PMT-57 12 v.24.1 ndors/transaction_fee_and_reporting.

10. Provider Travel Reimbursement The Provider will not be reimbursed for any travel expenses under this Contract.

11. Definitions

11.1 The Department’s “Standard Contract Definitions” are located at:

https://www.myflfamilies.com/sites/default/files/2022-11/GlossaryofContractTerms.pdf .

11.2 Terms and definitions specific to this Scope are listed below:

SCOPE OF WORK SPECIFIC TERMS

TERM DEFINITION

Department The Florida Department of Children and Families.

DFS Florida Department of Financial Services

End user/user Any person at the Department utilizing / interacting with the Application.

Provider The vendor(s) selected to provide the services written in this Scope.

Scope Scope of Work.

https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/transaction_fee_and_reporting https://www.myflfamilies.com/sites/default/files/2022-11/GlossaryofContractTerms.pdf

APPLICATION AND DATA SECURITY AND CONFIDENTIALITY

PMT-57 13 v.24.1

This attachment is for the purpose of ensuring adequate information security protection is in place at all times during this contract between the Department of Children and Families hereinafter referred to as “the Department” and service providers, Providers, and information trading partners, all referenced hereinafter together referred to as “Providers” in this attachment.

In this document, the term “State Data” means any electronic information including, but not limited to, records, files, computer programs, and databases, that are owned by the State of Florida.

1. Hosting Data or Applications – This section applies to all contracts whereby a Provider is hosting data, or hosting an application that processes data, on behalf of the Department.

Provider will comply with the following:

a. Provider, its employees, subcontractors, and agents will comply with all security and administrative requirements of the Department in performance of this contract. Provider will provide immediate notice to the Department’s Information Security Manager (ISM), or their designee, in the event it becomes aware of any security breach and any unauthorized transmission of State Data as described below or of any allegation or suspected violation of security requirements of the Department.

b. Provider will produce, upon entering a contract, a current security audit (no more than 12 months old) performed by a third party that is certified to perform such audits that demonstrate the use of sound security measures and practices by the Provider hosting the data or application that is processing data, as defined by a nationally recognized security framework. Provider will produce the status of any corrective action plans underway to address deficiencies found in the security audit. Provider must provide an annual update on any open corrective action plans associated with the most recent audit’s noted deficiencies. The Department has the right to require Provider to produce a new or updated audit every three (3) years during the contract term, at Provider’s expense.

c. Provider will provide a copy of its American Institute of Certified Public Accountants (AICPA) “Standards for Attestation Engagements no. 18” (SSAE 18) Service Organization Controls (SOC) Report, SOC 2, Type 2, to the Department within one month of issued purchase order. For each additional year of the contract, at the request of the Department, Provider will obtain a current American Institute of Certified Public Accountants (AICPA) “Standards for Attestation Engagements no. 18” (SSAE 18).

d. Data Loss Prevention: Provider will perform periodic backups of all data (files, programs, databases, electronic records, etc.) hosted by Provider on behalf of the Department sufficient to ensure no data loss occurs, and that data will be restored from backup, when necessary, at the Provider’s sole expense. In the event of loss of any State Data or records, where such loss is due to the negligence of Provider or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the contract.

e. Breach: A confirmed event that compromises the confidentiality, integrity or availability of information or data. In the event of a breach of any State Data where such breach is due to the negligence of Provider or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the contract. Provider may be subject to administrative sanctions for failure to comply with section 501.171, Florida Statutes, for any breach of data, due to a failure to maintain adequate security, and responsible for any costs to the Department for the breach caused by Provider.

PMT-57 14 v.24.1

f. Data Protection: No State Data or information will be stored in, processed in, or shipped to offshore locations or outside of the United States of America, regardless of method, except as required by law. Access to State Data will only be available to approved and authorized staff, including offshore Provider personnel, that have a legitimate business need. Requests for offshore access will be submitted in accordance with the Department established processes and will only be allowed with express written approval from the Deputy Secretary of Operations. Third parties may be granted time-limited terminal service access to IT resources as necessary for fulfillment of related responsibilities with prior written approval by the ISM. Third parties will not be granted remote access via VPN, private line, or firewall holes, without an approved exemption. Requests for exceptions to this provision must be submitted to the ISM for approval. When remote access needs to be changed, the ISM will be promptly notified. Provider will abide by all Department and State of Florida data encryption standards regarding the transmission of confidential or confidential and exempt information. Documented encryption standards will be provided upon request. Offshore data access must be provided via a trusted method such as SSL, TLS, SSH, VPN, IPSec or a comparable protocol approved by the ISM. Confidential information must be encrypted using an approved encryption technology when transmitted outside of the network or over a medium not entirely owned or managed by the Department.

g. Notice Requirement: Provider will notify the Department upon detection of anomalous or malicious traffic within the scope of contracted services. To the extent applicable, failure to notify the Department of events or incidents that result in breach will subject Provider to legal sanctions, financial consequences per the contract and/or any costs to the Department of such breach of security.

h. Data Retention: Provider must retain data as follows:

i. Copies: At contract termination or expiration, submit copies of all finished or unfinished documents, data, studies, correspondence, reports and other products prepared by or for Provider under the contract; submit copies of all State Data to the Department in a format to be designated by the Department in accordance with section 119.0701, Florida Statutes; shred or erase parts of any retained duplicates containing personal information of all copies to make any personal information unreadable.

ii. Originals: At contract termination or expiration--retain its original records, and maintain, in confidence to the extent required by law, Provider’s original records in un-redacted form, until the records retention schedule expires and to reasonably protect such documents and data during any pending investigation or audit.

iii. Both Copies and Originals: Upon expiration of all retention schedules and audits or investigations and upon notice to the Department, destroy all State Data from Provider’s systems including, but not limited to, electronic data and documents containing personal information or other data that is confidential and exempt under Florida public records law.

2. Application Provisioning – This section applies to all contracts whereby a Provider is making available a software application to be used by the Department for collecting, processing, reporting, and storing data. Provider’s software application used for the

PMT-57 15 v.24.1

Department’s automation and processing must support, and not inhibit, each of the following Department security requirements:

a. Users must never share account passwords or allow other users to use their account credentials. Users are responsible for all activities occurring from the use of their account credentials.

i. Provider employees are responsible for safeguarding their passwords and other authentication methods by not sharing account passwords, email encryption passwords, personal identification numbers, smart cards, identification badges, or other devices used for identification and authentication purposes.

ii. Passwords will not be passed or stored in plain text. Passwords must be encrypted or secured by other means when stored or in transit.

b. Provider employees will be accountable for their account activity.

i. Audit records will allow actions of users to be uniquely traced for accountability purposes.

ii. User accounts must be authenticated at a minimum by a complex password.

Provider accounts will require passwords of at least 10 characters to include an upper and lowercase letter, a number, and a special character.

iii. Provider employees must log-off or lock their workstations prior to leaving the work area.

iv. Workstations must be secured with a password-protected screensaver with the automatic activation feature set at no more than 10 minutes.

c. Provider employees must not disable, alter, or circumvent Department security measures.

d. Computer monitors must be protected to prevent unauthorized viewing.

e. Consultation involving confidential information must be held in areas with restricted access.

f. Confidential information must be printed using appropriate administrative, technical, and physical safeguards to prevent unauthorized viewing.

g. Access to data and information systems must be controlled to ensure only authorized individuals are allowed access to information and that access is granted upon a “need-to-know” basis only.

h. User accounts will be deleted or disabled, as appropriate, within 30 days of employment termination, non-use of account for 60 consecutive days, or under direction of a manager or Personnel and Human Resource Management’s notification of a security violation.

i. Confidential information will not be disclosed without proper authority. It is the responsibility of each member of the workforce to maintain the confidentiality of information and data. Any employee who discloses confidential information will ensure sufficient authorization has been received, the information has been reviewed and prepared for disclosure as required, and no revocation of the requesting document has been received.

PMT-57 16 v.24.1

j. All employees are responsible for protecting Department data, resources, and assets in their possession.

k. All employees are responsible for immediately notifying their local information security coordinator of any violation of Department security policies, or suspected/potential breach of security.

l. All employees will be knowledgeable of the classifications of data and information and the proper handling of data and information.

3. Data Interchange – This section applies to contracts whereby the Department will be sending data transmissions to, or receiving data transmissions from, a Provider for the purpose of independent processing. Examples include sending laboratory orders to a laboratory, receiving laboratory results, sending billing information to a clearing house, receiving billing results or notification of payment, sending vital statistics to the Social Security Administration, sending physician licensing information to Florida’s Agency for Health Care Administration, receiving continuing education credit information for medical profession licensees, etc. Data interchange contracts must have a data sharing agreement in place. Provider will comply with the following:

a. Follow all Department and State of Florida data encryption standards regarding the transmission of confidential or confidential and exempt information between the Department and the Provider. Documented encryption standards will be provided upon request. All transmission of confidential or confidential and exempt data must utilize a protected protocol such as SSL, TLS, SSH, VPN, IPSec or a comparable protocol approved by the ISM.

b. Use of any connection to the Department’s network will be for retrieving information delivered by the Department, or sending data to the Department, and not for any other access to resources on the Department’s network.

c. Protect and maintain the confidentiality of all data, files, and records, deemed to be confidential or confidential and exempt, retrieved from the Department pursuant to this agreement. The user will immediately notify the Department’s ISM of any loss or breach of information originating from the Department and retrieved by Provider.

4. All IT Services – This section applies to all contracts whereby a Provider is providing IT services to the Department.

a. Provider will protect and maintain the confidentiality of all data, files, and records, deemed to be confidential or confidential and exempt, acquired from the Department pursuant to this agreement. Except as required by law or legal process and after notice to the Department, Provider will not divulge to third parties any confidential information obtained by Provider or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing contract work, including, but not limited to, security design or architecture, business operations information, or commercial proprietary information in the possession of the state or the Department.