RFP 760309 PCI-DSS FIM System.docx

REQUEST FOR PROPOSAL

PROJECT TITLE: PCI DSS Management System Ref # 760309

The University of Washington is soliciting proposals from potential vendors to provide the above referenced services. Vendors interested in providing the required services must submit proposals per the requirements detailed in this RFP.

This solicitation is open to those vendors that satisfy the minimum qualifications stated herein and that are available for work in Washington State.

Contents of this Solicitation

I. General Instructions

II. Requirements

III. Evaluation and Contract Award

VI. Attachments

Section I General Instructions

1.1 PURPOSE

This request for Proposal, (RFP) is issued by the University of Washington Merchant Services Department to procure a vendor for an eCommerce script management system in order to meet the PCI DSS requirements 6.4.3 and 11.6.1

1.2 RFP COORDINATOR

The RFP Coordinator is the sole point of contact in the University for this Procurement. All communication between the Contractor and the University upon release of this RFP shall be with the RFP Coordinator, in writing, as follows: : Benjamin Cory – bcory@uw.edu

1.3 Definition of Terms

“Supplier”, “Proposer”

“Request for Proposal ”

-A written solicitation document which identifies the UW’s need, and consultants are invited to submit proposals which outline their solution to the need, their qualifications and experience to provide the services, and their costs or fees.

1.4 tIMETABLE

RFP Released

11/14/24

RFP Due date for Questions

11/27/24 11:59 PM PST

Proposals Due

1/3/25 11:59 PM PST

1.5 Workday SUBMISSION

Vendors shall submit a information in PDF OR Word format, via the University’s Workday Strategic Sourcing website. Information must be submitted on or before the time specified in 1.4 Timetable. Any information received after that date and time may not be considered. All information shall remain valid for a minimum of 180 days following the RFP closing date. https://university-of-washington.public-portal.us.workdayspend.com/

1.6 INQUIRIES

All questions must be submitted in writing via the Workday message senter citing the particular RFP section and paragraph number, and utilizing the attached template/Attachment E. Depending upon the nature of the inquiry and the response, copies of the question and response may be distributed to all other potential vendors. The closing date for asking of questions is given in Paragraph 1.4. The University may exercise its option not to reply to Vendor inquiries; therefore, Vendors should be prepared to submit a proposal based on the information included in the RFP.

1.7 COMPLAINTS

A. Contractors may submit a complaint to the RFP Coordinator based on any of the following:

· The solicitation unnecessarily restricts competition;

· The solicitation evaluation or scoring process is unfair or flawed; or

· The solicitation requirements are inadequate or insufficient to prepare a response.

B. Contractors may submit complaints up to 5 business days prior to the proposal due date. Complaints must meet the following requirements:

· Must be in writing.

· Must be sent to the procurement coordinator, or designee.

· Should clearly articulate the basis for the complaint.

· Should include a proposed remedy.

The RFP coordinator or designee will respond to complaints in writing; the response to complaints including any changes to the solicitation will be posted as an amendment on WEBS, https://fortress.wa.gov/ga/webs/ and in ARIBA. The complaint may not be raised again during the protest period. The complaint process does not include an appeal process.

1.8 Interpretation of the RFP

Should any discrepancies be found in or omissions from the specifications, or doubt as to their meaning, the Contractor shall at once notify the Coordinator, in writing. The Coordinator will send written instructions or addenda as required to all interested parties. All addenda issued shall be incorporated into the contract. The Purchaser shall not be responsible for or bound by oral interpretations. Only questions answered by written addenda are binding. Questions received less than five (5) working days before the proposed due date for submission of proposals cannot be answered.

1.9 REVISIONS TO THE RFP

The University reserves the right to change the acquisition schedule or cancel the RFP at any time. The University reserves the right to make corrections or amendments due to errors identified in the RFP by the University or a Contractor. Any changes will be dated and attached to, and made a part of, the RFP. All changes must be coordinated in writing with, authorized by, and made by the RFP Coordinator.

All RFP corrections and amendments will be posted to https://fortress.wa.gov/ga/webs/ and also to the Ariba sourcing module. Contractors are responsible for checking the website for this information.

1.10 Signature

Each proposal must be signed by the Contractor with the usual signature and dated. The name and title shall be typed or printed below each signature.

A. Proposals submitted by a proprietorship must be signed by the Owner.

B. Proposals submitted by a partnership must be signed with the partnership name by one of the partners, followed by the signature and designation of the partner signing.

C. Proposals by a corporation must be signed with the legal name of the corporation, followed by the name of an authorized officer.

1.11 Cost of Proposals

Costs incurred in preparing and presenting the proposals or incurred in any other manner by the Contractor in responding to this solicitation are not reimbursable and may not be charged to the University.

1.12 Withdrawal or Modifications of Proposals

Any Contractor may withdraw their proposal upon written request at any time prior to the scheduled due date for submission of proposals.

1.13 Public Disclosure

The University is subject to RCW 42.56 (Public Records Act). All Contractor Responses and any subsequent Contract will be “public records” as defined in RCW 42.56.010

The Contractor must clearly specify any specific information that it claims is confidential or proprietary. Marking of the entire Response or entire sections as proprietary will not be honored. The University may not accept Responses where pricing is marked as proprietary.

All Responses received will remain confidential until the Contract, if any, resulting from this RFP is signed by the University and the Apparent Successful Contractor; thereafter, the Responses will be deemed public records.

To the extent consistent with RCW 42.56, the University will maintain the confidentiality of all information marked confidential or proprietary. If a request is made to view the Contractor’s information, the University will notify the Contractor of the request and the date that such records will be released unless the Contractor obtains a court order enjoining that disclosure. The Contractor will have five (5) business days from receipt of notice to obtain the court order. If the Contractor fails to obtain the court order enjoining disclosure, the University will release the requested information on the date specified.

1.14 ACCEPTANCE PERIOD

Contractor’s proposal must provide 120 business days for acceptance by University from the due date for receipt of Proposals.

1.15 RESPONSIVENESS

All Proposals will be reviewed by the RFP Coordinator to determine compliance with administrative requirements and instructions specified in this RFP. The Contractor is specifically notified that failure to comply with any part of the RFP may result in rejection of the Proposal as non-responsive.

1.16 Selection of Proposals

In determining the “apparent successful Contractor”, in addition to cost, the Contractor’s compliance with the requirements of this solicitation, and the items listed below, shall be given consideration.

A. The ability, capacity, and skills of the Contractor to perform the contract or provide the service required.

B. The character, integrity, reputation, judgment, experience, and efficiency of the Contractor.

C. The quality of performance of previous contracts or service.

D. The previous and existing compliance by the Contractor with the laws relating to contract and services.

E. Such other information as may be secured having a bearing on the decision to award the contract.

1.17 No Obligation to Contract

This solicitation does not obligate the University of Washington to contract for the solicited services specified herein.

1.18 Contract in Best Interest

The University reserves the right to accept or reject proposals on each item separately or as a whole, to reject any or all proposals without penalty, to waive informalities or irregularities, and to contract in the best interests of the University.

1.19 PUBLICITY

Advertising, including use of the University marks and logos, press releases, or any other general public announcement by a Contractor, stating the availability of its products or services to University employees is strictly prohibited unless the Contractor has obtained prior written authorization from the UW Procurement Services Department.

1.20 NON-ENDORSEMENT

The successful Contractor agrees to make no reference to the University in any literature, promotional material, brochures, sales presentation or the like without express written consent of the University.

1.21 FUNDING

Any contract awarded as a result of this procurement is contingent upon the continued availability of state or federal agency funding.

1.22 Contract and Terms & Conditions

The Apparent Successful Vendor will be expected to enter into a contract which is substantially the same as the University of Washington’s General Terms and Conditions and appropriate riders (PCI, IT Security, etc.) which can be located here: https://finance.uw.edu/ps/suppliers/terms-conditions, and are also attached as Exhibit D. In no event is a Vendor to submit its own standard contract terms and conditions in response to this solicitation. All exceptions to the contract terms and conditions must be submitted as an attachment to the bidder’s proposal. The Agency will review requested exceptions and accept or reject the same at its sole discretion.

1.23 Data-Security

If, during the course of the performance, administration, or maintenance of this contract, or any extension or renewal thereof, CONTRACTOR acquires, uses, or otherwise obtains access to ‘University Data’ as those terms are defined in the UW Data Processing Agreement, incorporated herein, then the UW and CONTRACTOR agree that all of the terms and conditions of the UW’s Data Processing Agreement and/or IT Data Security Addendum(s) shall apply.

1.24 IN-STATE RECIPROCITY

The Department of Enterprise Services has established a schedule of states (Schedule) which grant a preference to their own in-state businesses for goods and services. Detailed information regarding the various States’ reciprocity policies is contained in the following URL. Bids submitted by Consultants with addresses in any of the states as described in the Schedules shall be evaluated in accordance with the instructions stated in the Schedule.

http://www.des.wa.gov/services/ContractingPurchasing/Pages/ReciprocalPreference.aspx

1.25 GRATUITIES

In accordance with RCW 42-52-150 and 160, Ethics in Public Service, no gifts, gratuities or any item of economic value may be accepted by University Employees. Contractors agree to offer no such items to any University employee.

1.26 Minority and Women Business Enterprise Participation

In accordance with chapter 39.19 RCW, the University of Washington encourages participation in all of its contracts by firms certified by the Office of Minority and Women’s Business Enterprises (OMWBE). Participation may be either on a direct basis in response to this solicitation or on a subcontractor basis. However, no preference will be included in the evaluation of proposals, no minimum level of MWBE participation shall be required as a condition for receiving an award and proposals will not be rejected or considered non-responsive on that basis. Any affirmative action requirements set forth in federal regulation or statutes included or referenced in the contract documents will apply.

The established annual procurement participation goals for this solicitation are MBE 6% and WBE 4%. For information on certified firms, Contractors may contact OMWBE at 360/753-9693or http://www.omwbe.wa.gov.”

1.27 U.S. Small Business Participation

Participation in contracts for goods and services is encouraged by firms which qualify under definitions by the U.S. Small Business Administration as small business (SB), or small disadvantaged business (SDB), or small women owned business (WOB).

The percentage listed below is voluntary. No preference will be included in the evaluation of bids/proposals. Participation in University contracts may be either direct as the Contractor in response to this solicitation, or as a subcontractor to a Contractor.

Voluntary U.S. Small Business goals for this solicitation are 15% SB/SDB/WOB

SECTION II

REQUIREMENTS

21 Background and Purpose To find a vendor to provide File Integrity Monitoring and Alerting service for UW eCommerce sites in order to meet PCI-DSS requirements (specifically requirements 6.4.3 and 11.6.1)

2.1 Period of Service

The anticipated start date of the contract and go-live for the solution/platform is prior to Q2 2025.

The University shall determine the initial terms of the agreement based on a comparison between pricing for a one (1) year and a two (2) year agreement with the firm and fixed pricing, commencing on the effective date of the Contract. Pricing information should include any additional charges or fees related to implementation, maintenance, or service plans. In addition, include a cost breakdown for user support or trouble requests and change order requests on customized or ad hoc projects and tasks. Finally, pricing information should highlight variations, discounts, or incentives in pricing.

At the University’s sole discretion, the Contract term may be extended by three (3) additional two-year (2 year) extension options not to exceed a total Contract term of nine (9) years. All extension options shall be mutually agreed upon by both parties by written amendment

2.2 Proposal Requirements and Instructions

· Provide a script management and monitoring solution for UW eCommerce sites

· The solution should provide logging and alerting or integrate with a SIEM system already in use at UW (Microsoft platforms (e.g., Sentinel and the Elastic stack.)

· Find a cost-effective solution that is sustainable

· Solution would need to work with the highly federated UW networks across multiple domains

· https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf - requirements reference document

· Must include ability to inventory all scripts used on eCommerce site along with notes on each

· Must confirm scripts are authorized when compared to inventory

· Must confirm no unauthorized changes are made to scripts – integrity management

· Must include a tamper detection mechanism for eCommerce scripts and HTTP headers as received by consumer browsers

· Logging and alerting of events must be native to vendor application or via integration with a SIEM in use at UW (Microsoft platforms (e.g., Sentinel) and the Elastic stack.)

· Experience with PCI-DSS requirements

· Experience with large, federated networks

· Experience with higher education in public sector

· Expected to be available via virtual meetings when needed, at minimum weekly meetings during implementation.

Background and History: Describe the company, organization, officers or partners, number of employees and operating policies which would affect this Contract. State the number of years the organization has been continuously engaged in business.

Financial Stability: Describe the financial status of the company. Attach a copy of the most recent annual financial statement or other similar document.

Technical Approach and Methodology: Describe Bidder’s technical approach and methodology for accomplishing the described Scope of Work. The proposed approach and methodology should include a detailed work plan and schedule. All information to be provided by participating Hospital(s) as part of this plan must be specified including content, format and frequency.

Project Team and Management Structure: Identify proposed project team and management structure for completing the Scope of Work. This should identify roles and responsibilities, including Bidder expectations of participating UW Medicine Hospital(s) staff resources. Provide resumes of key professional staff to be assigned to the project and their level of commitment to this engagement.

Proposed Fees: Provide a cost proposal to accomplish the Scope of Work or provide the requested product.

Firm Experience and Credentials: Provide evidence of Bidder’s experience in projects or providing products as described within this RFP.

References: List three (3) relevant references, including a description of the engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number and e-mail address

Contract Management Information: Provide primary Contract Manager Contact name, title, mailing address, telephone number and email address.

2.3 SCOPE OF WORK

The vendor will provide a script management and monitoring solution for UW eCommerce sites, including the installation, configuration, and integration with University logging and alert systems. Additionally, the vendor will provide aftercare support to ensure the successful execution of the solution toward PCI-DSS requirements 6.4.3 and 11.6.1 compliance..

In the absence of a vendor supplied alerting and logging solution, vendor will provide integration with existing UW SIEM systems

Vendor will also provide user training for the proposed system.

SECTION III EVALUATION AND CONTRACT AWARD

1.

2.

3.

3.1 Evaluation of Proposals

The University reserves the right to make Vendor selections based solely on the proposal submitted. Responsive proposals will be evaluated strictly in accordance with the requirements stated in this solicitation and any addenda issued. The evaluation of proposals shall be accomplished by an evaluation team to be designated by the UW, which will determine the ranking of the proposals. The RFP Coordinator may contact the Vendor for clarification of any portion of a Vendor’s proposal.

3.2 Interview / Presentation

At its sole discretion, the University may require Vendors to participate in an interview or provide a presentation to the evaluation committee. If so, the score from the interview and/or the presentation may be combined with the score of the proposal to identify the apparent successful Vendor. The University will contact the Vendor directly to schedule the interview/presentation.

3.3 Evaluation Criteria & Scoring

The following weighting and points will be assigned to the proposal for evaluation purposes:

Meets requirements put forth in PCI DSS 6.4.3 and 11.6.1 – 50 points Pricing – 20 points Implementation approach – 10 points Interoperability with existing UW systems and contracts – 20 points SUBTOTAL – 100 points

3.4 Notification to Proposers

Once the final evaluation phase has been completed, the solicitation Coordinator will issue a written announcement to all participants, citing the name(s) of the apparent successful vendors.

Section IV Attachments

1. Attachment A. Data Processing Agreement

4. Attachment D. University of Washington General Terms and Conditions

5. Attachment E. Question Template

6. Attachment F. IT Accessibility Rider

7. Attachment G. IT Security Terms

8. Attachment H PCI Rider image1.emf

C-to-P-DPA.docx

UNIVERSITY OF WASHINGTON

CONTROLLER TO PROCESSOR

DATA PROCESSING AGREEMENT

Introduction, Parties, AND Effective Date

This Data Processing Agreement (the “DPA”) is hereby incorporated into and amends the [insert name of Underlying Agreement] (the “Agreement”) between the University of Washington, an agency of the State of Washington, with its main campus located in Seattle, Washington (the “University”) and [insert entity name], a [insert name of jurisdiction within which entity was formed (ex. Delaware)] [insert type of entity type (ex. corporation)], with a principal place of business at [insert entity’s address] as of the Effective Date below. With respect to Data Processing performed under the Agreement and this DPA, the University is the Controller and the [insert non-UW entity] is the Processor. The parties agree as follows:

Definitions

1. “Controller” refers to the person or entity that determines the purpose and means for Data Processing.

2. “Data Breach” means any technical or physical incident or set of circumstances that leads to the unauthorized, accidental or unlawful access to, or destruction, loss, alteration, or disclosure of, University Personal Data undergoing Data Processing by the Processor.

3. “Data Processing” means any operation(s) performed on University Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, access, use, disclosure by transmission, dissemination, combination, restriction or destruction.

4. "Data Request” means a request to exercise rights available under any applicable law with respect to University Personal Data.

5. “Processor” refers to the person or entity that performs Data Processing on behalf of the Controller.

6. “Sub-processor” means any person or entity appointed by or on behalf of the Processor to carry out any portion of the Work.

7. “University Personal Data” or “UPD” means any records or information relating to an identified or identifiable natural person, such as name, identification number, location data, online identifiers, or factor(s) specific to physical, physiological, genetic, mental, economic, cultural, or social identity or characteristics, or is identified as personally identifiable data (or a similar term) by any applicable law, that:

a. Is created, received, or maintained by the University and transmitted to, accessed by, or otherwise made available to the Processor in connection with the Processor’s performance of the Work;

b. Is created or compiled by the Processor in performing the Work; or

c. Is appended to, aggregated with, or associated with any University Personal Data originating from the University that was transmitted to or accessed by the Processor in connection with the Processor’s performance of the Work.

Notwithstanding the foregoing, UPD does not include personal data relating to the Processor’s or Sub- processor’s personnel or personal data that is acquired from non-UW sources and is processed by the Processor not in association with the Work.

8. “Processor” as used in this DPA includes both the Processor identified above, and any third party and/or entity that owns or controls, is owned or controlled by, or is under common ownership or control with the Processor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting security, by contract, or otherwise.

9. “Work” refers to any and all activities carried out by the Processor or a Sub-processor in providing services, work product or deliverables under the Agreement, or in fulfilling any other obligations set forth in the Agreement.

standard of care

1. The Processor represents and warrants that any Data Processing shall be by personnel who (a) are obligated to maintain confidentiality under applicable law or job expectations, and (b) are sufficiently trained and experienced to use reasonable care commensurate with state-of-the-art professional practices to comply with the obligations in this DPA.

2. The Processor shall ensure that there are appropriate personnel-vetting processes, and appropriate policies and/or controls over activities as necessary to safeguard UPD per this DPA and applicable law.

3. Prior to the disclosure of UPD to, or the commencement of Data Processing by any Sub-processor, the Processor shall cause each Sub-processor to execute an agreement with the Processor that includes terms and conditions which establish at least the same level of protection for UPD as those set out in this DPA and applicable law. If a Sub-processor fails to fulfill its data protection obligations under this DPA or applicable law, the Processor shall remain fully liable to the University for the performance of that Sub-processor’s obligations.

purpose And LIMITS OF DATA PROCESSING

1. The Description of Data Processing Exhibit to this DPA sets forth certain information relating to the Data Processing by the Processor for the purpose of carrying out the Work. The Processor may only engage in Data Processing for the limited purpose described in the Description of Data Processing Exhibit (the “Purpose”). The Processor shall limit its Data Processing to include only the minimum UPD needed to fulfill the Purpose. The Processor’s Data Processing will not involve any secondary uses of UPD beyond the Purpose. Without limiting the generality of the foregoing, the Processor shall not use any UPD to market or sell goods or services to persons named or otherwise identified in UPD.

2. When the University reasonably deems necessary to meet its own requirements and/or applicable laws, the University may make reasonable changes to the Data Processing by amending the Description of Data Processing Exhibit or providing the Processor with an additional exhibit in the same form as the Description of Data Processing Exhibit. Any material change to the Description of Data Processing Exhibit that increases the cost of the Work shall be subject to the mutual agreement of the parties.

3. The University shall have sole control over determinations related to (a) the lawfulness of the Data Processing, and (b) the necessity of any privacy notice to and/or solicitation of consent from individuals whose personal data will undergo Data Processing in relation to the Work.

Non-Disclosure AND DATA REQUESTS

1. UPD shall not be disclosed by the Processor (or any Sub-processor) to a third party, unless the University grants permission in writing to the Processor to disclose, or unless such disclosure is required by applicable law.

2. If the Processor receives any subpoena, discovery request, court order, or other legal request or order that calls for disclosure of any UPD, then the Processor shall promptly notify the University unless specifically prohibited by law from doing so. The Processor’s notification shall give the University sufficient time to object to the disclosure, obtain a protective order, or otherwise protect UPD by limiting disclosure. The Processor shall provide the University with prompt and full assistance in the University’s efforts to protect UPD. Any disclosure pursuant to this section shall be limited to the minimum disclosure required by law.

3. The Processor shall assist the University by implementing technical and organizational measures, to the extent practicable, in order for the University to meet its obligations (as understood by the University) to respond to Data Requests relating to UPD held by the Processor. The Processor shall promptly notify the University if the Processor receives a Data Request, assist the University in the University’s response, and respond to the Data Request directly only on the documented instructions of the University or as required by applicable laws to which the Processor is subject, in which case the Processor shall, to the extent permitted by applicable laws, inform the University of the Processor’s legal obligations before any response to the Data Request.

Compliance and Data Transfers

1. The Processor shall conduct all Work and Data Processing in full compliance with any and all applicable statutes, regulations, rules, standards and orders of any official body with jurisdiction over the Processor or the University. Applicable statutes, regulations, rules, or orders may include, but are not necessarily limited to:

a. The Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. §1232g; 34 CFR Part 99;

b. The Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 300gg and 29 U.S.C § 1181 et seq. and 42 USC 1320d et seq.; and/or the Washington Health Care Information Act, Ch. 70.02 RCW; and

c. European Union General Protection Data Regulation (“GDPR”), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. The University’s obligations and rights with respect to GDPR are set forth in the Agreement and this DPA. The Agreement, this DPA, and any directions contained in notices from the University to the Processor pursuant to § J.4 together constitute the University’s documented instructions to the Processor for the purposes of GDPR. The subject matter of the Data Processing with respect to GDPR is the Work, as defined above, in the Agreement, and/or in the Description of Data Processing Exhibit to this DPA (including any change(s) pursuant to § D.1). Compliance with GDPR includes, without limitation, the following:

i. The Processor shall provide the University with assistance and information required by GDPR, to the extent applicable, as it relates to Data Processing. As contemplated by GDPR, the Processor’s provision of assistance may relate to data protection impact assessments, prior consultations, demonstration of compliance with Article 28 of GDPR, and audits. The Processor will also immediately notify the University if, in its opinion, a University instruction infringes GDPR.

ii. The Sub-processors that are identified and described by the Processor in the Description of Data Processing Exhibit of this DPA are the only Sub-processors permitted to perform Data Processing. Prior to engaging a new Sub-processor for Data Processing, the Processor shall: (1) notify the University in writing of the intended addition or replacement of the Sub-processor; and (2) give the University the opportunity to object to such change.

2. For Data Processing that involves transfers of UPD from the European Economic Area, Switzerland, or the United Kingdom to a country that does not ensure an adequate level of data protection (including, but not limited to, the United States) within the meaning of the applicable laws of the foregoing territories, the Standard Contractual Clauses (accessible at https://privacy.uw.edu/design/agreements/dpa/ shall govern such transfers.

SAFEGUARDING DATA

1. Taking into consideration the state of the art, costs of implementation and the nature, scope, context and purposes of the Data Processing, the likelihood and potential severity of risks to the rights and freedoms of natural persons, and the risk of Data Breach, the Processor represents and warrants that it shall implement technical, physical, and administrative security measures appropriate to such risks, which may include, but are not necessarily limited to:

a. The de-identification, anonymization, pseudonymization, and encryption of UPD;

b. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, facilities, and services;

c. The ability to restore the availability of and access to UPD in a timely manner in the event of a physical or technical incident; and

d. A process for regularly testing, assessing, and evaluating the effectiveness of technical, physical, and administrative measures for ensuring the security of the Data Processing.

2. The Processor’s measures for protecting UPD shall (a) meet or exceed industry best practices for safeguarding personal data, and (b) be based on the concepts of privacy by design and by default.

DATA BREACH responsE

1. The Processor shall have sufficient capabilities for detecting, identifying, and responding to a Data Breach.

2. If the Processor has reason to believe that a Data Breach has occurred, then, without undue delay, the Processor shall notify the University of said Data Breach. Such notification to the University shall include sufficient information to enable the University to meet its obligations under applicable law.

3. In the event of a Data Breach, the Processor shall cooperate with the University and immediately:

a. Investigate and identify the nature of the Data Breach;

b. Preserve relevant evidence;

c. Contain, remediate, and mitigate the Data Breach; and

d. Notify the University of any additional or newly-emerged information beyond the initial Data Breach notification to the University described in § H.2.

4. In the event of a Data Breach caused in whole or part by the Processor:

a. The University may instruct the Processor, at the Processor’s expense, to provide:

i. Notice when required by applicable law, or when a Data Breach could result in harm to individuals and/or risk to the University; and/or

ii. Services such as credit monitoring or identity theft protection to individuals when the absence of such services could result in harm to individuals and/or individuals would have a reasonable expectation that such services be provided.

b. Alternatively, the University may elect to provide the aforementioned notice and services itself.

5. Notwithstanding the foregoing, unless the Processor is required by law to provide the aforementioned notice and/or services in a particular manner, the University shall control the time, place, content, and manner of such notice and services.

DISPOSITION OF UPD UPON Termination OR FULFILLMENT OF PURPOSE

4. The duration of Data Processing by the Processor shall be no longer than the expiration or termination of the Agreement or fulfillment of the Purpose with respect to UPD, whichever is earlier.

5. Upon expiration or termination of the Agreement, or fulfillment of the Purpose with respect to UPD, whichever is earlier, the Processor shall transfer to the University any and all UPD, unless otherwise instructed by the University in writing.

gENERAL TERMS

1. SURVIVAL AND ORDER OF PRECEDENCE. This DPA shall survive the expiration or earlier termination of the Agreement. In the event the provisions of this DPA conflict with any provision of the Agreement, or the Processor’s warranties, support agreement, or service level agreement, the provisions of this DPA shall prevail.

2. SEVERABILITY. If any provision of this DPA is found to be unenforceable, the remainder of the Agreement and this DPA shall remain in effect.

3. HEADINGS FOR CONVENIENCE ONLY. Any and all subject headings are not substantive and are for convenience only.

4. NOTICES. Any notices or communications required or permitted to be given by this DPA must be (a) given in writing, and (b) personally delivered; mailed by prepaid, certified mail, or overnight courier; or transmitted by electronic mail (including PDF) with receipt acknowledged, to the party to whom such notice or communication is directed, or to the mailing address or regularly monitored electronic email address of such party.

IN WITNESS WHEREOF, this DPA has been executed as of the date of the last party to sign below (“Effective Date”). If signed in counterparts, then each shall be considered an original thereof.

University:

Signature

Processor:

Name and Title

Date

DESCRIPTION OF DATA PROCESSING EXHIBIT

This Description of Data Processing Exhibit to the Data Processing Agreement (the “DPA”) sets forth certain information relating to the Data Processing, current as of the date of the last signature below (including in a countersigned version of this Description of Data Processing Exhibit), that the Parties anticipate will be carried out in connection with the Work as defined in the DPA. This version of this Description of Data Processing Exhibit may be superseded by subsequent versions issued in accordance with Section § D.2 of the DPA.

1. NATURE AND PURPOSE

[Describe the nature (such as the operations to be undertaken by the Processor, volume of personal data, etc.) and the purpose (such as the University’s mission and the University department or unit’s specific objectives that will be fulfilled through the Processor’s Data Processing)]

2. CATEGORIES OF DATA SUBJECTS

[List the categories of individuals about whom personal data relates (such as currently enrolled undergraduate students, prospective academic personnel, alumni who have donated to the University between 2008-2018, etc.)]

3. TYPES OF PERSONAL DATA

[List the personal data points that will undergo Data Processing including any special categories of personal data. NOTE: special categories of personal data include information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.]

4. PROCESSOR CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

5. UNIVERSITY DEPT/UNIT CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

6. SUB-PROCESSORS

[The Processor must list all Sub-processors that will perform any GDPR-governed Data Processing (such as cloud storage providers, hosting providers, etc.), with an explanation of each Sub-processor’s Data Processing activities. If GDPR does not apply or the Processor does not use any Sub-processors for GDPR-governed Data Processing, insert “Not Applicable”.]

University:

Processor:

Controller to Processor Data Processing Agreement

Version September 2021 image1.gif image2.emf

Confidentiality Statement RFP.docx Attachment B

To be completed and returned with proposal

CONFIDENTIALITY STATEMENT

The provider of services shall keep all work and services carried out hereunder for the University of Washington entirely confidential and not use, publish or make known any information to any persons other than the personnel of the parties of the agreement. The confidentiality of such information will survive the conclusion of the provider’s work and the termination of the agreement.

AGREED TO:

Signature: ____________________________________________________

Printed Name: ________________________________________________

Date: ________________

RFQQ 11-0025 Attachment B image1.jpeg image3.emf

OMWBE RFP.doc

ATTACHMENT C

Complete and return with proposal

Minority and Women's Business Enterprise (MWBE) Response Form

This solicitation includes voluntary goals for MWBE participation. If the Vendor has been certified by the State of Washington Office of Minority and Women's Business Enterprises (OMWBE), please complete Part 1 below. If the Vendor is proposing to subcontract or joint venture with certified Minority Business Enterprises (MBE's) or Women's Business Enterprises (WBE's) please complete Part 2. If the Vendor proposes no MWBE participation in the bid, so indicate in Part 3.

1.

MWBE VENDOR:

Vendor is certified by the OMWBE as: (check as applicable)

MBE

FORMCHECKBOX

Both Minority and Woman Owned FORMCHECKBOX

WBE

FORMCHECKBOX

Combination 50% Minority / 50% Woman Owned FORMCHECKBOX

2.

MWBE SUBCONTRACT PARTICIPATION:

The voluntary goals for MWBE participation in this contract are established in the accompanying solicitation. Vendor proposes to include certified MWBE's in the contract as described below:

Certified MWBE Subcontract Participation

Name(s) of Participating MWBE: ______________________________________

Description of Participation: __________________________________________

Amount of Participation: $______________ Contract% Participation: ______%

3.

NO MWBE PARTICIPATION PROPOSED:

No certified MWBE participation is proposed by this vendor.

Signed: Vendor or authorized representative

Title:

Contact OMWBE at (360) 753-9693 or the University's MWBE Representative at (206) 543-5753 for details on certification.

For more description on State certification, see next page

Federal Small Business Certification Response

Please indicate (check) the appropriate selection:

_ Small Business _ Small Disadvantaged Business _ Small Woman Owned

Please include the four digit Standard Industrial Classification (SIC) code, if known: _________

For more description on Federal certification, see next page

State of Washington Office of Minority and Women Owned Business Certification and Federal Qualification

GENERAL STATEMENT: In accordance with the legislative findings and policies set forth in Chapter 39.19 RCW the State of Washington encourages participation in all of its contracts by MWBE firms certified by the Office of Minority and Women’s Business Enterprises (OMWBE). Participation may be either on a direct basis in response to this solicitation/invitation or as a subcontractor to a Vendor/Proposer. However, unless required by federal statutes, regulations, grants or contract terms referenced in the contract documents, no preference will be included in the evaluation of bids/proposals. No minimum level of MWBE participation shall be required as a condition for receiving an award and bids/proposals will not be rejected or considered non-responsive on that basis. Any affirmative action requirements set forth in federal regulations or statutes included or referenced in the contract documents will apply.

RECORD KEEPING: The Contractor shall maintain, for at least three years after completion of this contract, relevant records and information necessary to document the level of utilization of MWBEs and other businesses as subcontractors and suppliers in this contract as well as any efforts the contractor makes to increase the participation of MWBEs as listed below. The contractor shall also maintain, for at least three years after completion of this contract, a record of all quotes, bids, estimates, or proposals submitted to the Contractor by all businesses seeking to participate as subcontractors or suppliers in this contract. The State shall have the right to inspect and copy such records. If this contract involves federal funds, Contractor shall comply with all record keeping requirements set forth in any federal rules, regulations or statutes included or referenced in the contract documents.

AFFIRMATIVE EFFORTS TO INCREASE PARTICIPATION BY MWBE’s: Vendors/Proposers/Contractors are encouraged to:

1. Advertise opportunities for subcontractors or suppliers in a manner reasonably designed to provide MWBEs capable of performing the work with timely notice of such opportunities, and include a provision encouraging participation by MWBE bids/proposals directly from MWBEs.

2. Provide MWBEs that express interest with adequate and timely information about plans, specifications, and requirements of the Contract.

3. Break down total requirements into smaller tasks or quantities, where economically feasible, in order to permit maximum participation by MWBEs and other small businesses.

4. Establish delivery schedules, where the requirements of this contract permit, that encourage participation by MWBEs and other small businesses.

5. Reduce bonding requirements where practicable.

6. Utilize the services of available minority community organizations, minority contractors groups, local minority assistance offices and organizations that provide assistance in the recruitment and placement of MWBEs and other small businesses.

7. The actions described in this section should supplement efforts to provide information to all qualified firms, and nothing in this section is intended to prevent or discourage the Vendors/Proposers/Contractors from inviting proposals for participation from non-MWBE firms as well as MWBE firms.

NON-DISCRIMINATION: Contractors, Vendors and Proposers shall not create barriers to open and fair opportunities for all businesses including MWBEs to participate in all State contracts and to obtain or compete for contracts and subcontracts as sources of supplies, equipment, construction and services. In considering offers from and doing business with subcontractors and suppliers, the Contractor shall not discriminate on the basis of race, color, creed, religion, sex, age, nationality, marital status, or the presence of any mental or physical disability in an otherwise qualified disabled person.

FEDERAL Small, Small Disadvantaged or Small Woman Owned Business Certification accordance with Public Law 95-507, Federal Contracts that contain Federal Acquisition Regulations (FAR) clause 52.219-8 (Utilization of Small Business Concerns and Small Disadvantaged Business Concerns) impose requirements regarding subcontracting with small businesses and small business subcontracting plans. Refer to FAR 19.001 for guideline definitions. With regards to certification, the Small Business Administration (SBA) classifies small businesses on an industry-by-industry basis, utilizing a Standard Industrial Classification (SIC) code as described in the Code of Federal Regulations (CFR) Title 13, Part 121.The offeror certifies that the information is true and understands that whoever, for the purpose of securing a contract or subcontract is accountable under Public Law 99-661 and the CFR Title 13, Part 124 & 125. If a firm misrepresents the status of any concern or person as a small business owned and controlled by a minority or woman owned business, they shall (1) be punished by imposition of a fine, imprisonment, or both; (2) be subject to administrative remedies including suspension and disbarment; and (3) be ineligible for participation in programs conducted under the authority of the Small Business Act. If you need assistance in determining whether your business is considered to be small, contact the Seattle branch of the U.S. Small Business Administration at (206) 553-7310, or the University’s Representative at (206) 543-5753.

OMWBE

image4.emf

UW General Terms and Conditions - 9.26.19(rev)cc.pdf

UW General Terms & Conditions rev: 9-26-19_cc 1

UNIVERSITY OF WASHINGTON GENERAL TERMS AND CONDITIONS

1. DEFINITIONS – As used throughout this Contract, the following terms shall have the meaning set forth below:

a. “Contract” means purchase order and/or the entire written agreement between the UW and the Contractor, including any exhibits, Riders, and other materials incorporated by reference.

b. "The Contractor" means that firm, provider, organization, individual or other entity providing goods and/or performing service(s) under this Contract.

c. “Contractor Group” means, collectively, the Contractor and all Subcontractors.

d. “Debarment” means an action taken by a federal official to exclude a person or business entity from participating in transaction involving certain federal funds.

e. “Improper Influence” means any influence that induces or intends to induce a UW employee or officer to give special consideration or award a Contract on any basis other than the merits of the matter.

f. “Materials” means all information in any format and includes, but is not limited to, data, reports, documents, pamphlets, advertisements, books, magazines, surveys, studies, computer programs, films, tapes, and sound reproductions.

g. “Ownership” includes the right to copyright, patent, and register, and the ability to transfer, these rights.

h. “RCW” means the Revised Code of Washington. All reference in this Contract to RCW chapters or sections shall include any successor, or replacement statute.

i. “Regulation” means any federal, state, local, or UW regulation, law, rule, or ordinance.

j. “Rider” means additional terms and conditions, other than General Terms and Conditions that address a specific

UW requirement based on the scope and nature of Work.

k. “Subcontract” means any separate agreement or contract between the Contractor and an individual or entity

(“Subcontractor”) to perform all or portion of the duties and obligations that the Contractor is obligated to perform pursuant to this Contract.

l. "Subcontractor" means one not in the employment of the Contractor, and/or entity that owns or controls, is owned or controlled by, or is under common ownership or control of the Contractor, who is performing all or part of those services under this Contract under a separate contract with the Contractor, and/or any person or entity appointed by or on behalf of the Contractor to carry out any portion of the Work. The terms "Subcontractor" and "Subcontractors" means Subcontractor(s) in any tier. Control for the context of this paragraph, shall mean the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting security, by contract, or otherwise.

m. "UW" means the University of Washington, any division, section, office, unit, or other entity of the University of Washington, or any of the officers or other officials lawfully representing the University of Washington.

n. “Work” refers to all services, work, and activities involved in providing the materials, work product deliverables, or other obligations that are the subject of the Contract.

2. ACCESSIBILITY - Contractor represents that it is committed to promoting and improving accessibility of all its products as specified in the University of Washington IT Accessibility Guidelines (https://uw.edu/accessibility/guidelines), and will remain committed throughout the term of this Contract.