RFQ_CSD25-3136_Section_III.pdf

California Department of Motor Vehicles CSD25-3136, Section III Exhibit A, Page 1 of 11

A. CONTRACT DESCRIPTION AND SCOPE

The Contractor will provide the Department of Motor Vehicles (DMV) the rental of postage systems; including all labor, tools, materials, equipment (including replacement meters), supervision, travel, shipping and handling costs, taxes, delivery, set up and removal of equipment, repairs, insurance and permit fees necessary to maintain the postage systems in good working condition for the term of this Agreement. The Contractor will provide these services at the following locations:

a. Customer Services Division as identified in Exhibit D, Contact Center Office Locations

The Contractor shall commence work under this Agreement on the specified start date provided by the DMV Contract Manager following the execution of this Agreement by the State. The DMV Contract Manager shall provide the Contractor with written notification of the start date prior to the Contractor commencing work under this Agreement.

The services shall be provided during DMV business hours, Monday through Friday, 8:00 am - 5:00 pm, except State holidays, unless prior approval is obtained from the DMV Contract Manager.

B. CONTRACT TERM

The contract shall be thirty-six (36) months.

The Contractor will provide services to the Contact Centers effective on November 1, 2025 through October 31, 2028.

It is understood that no funds sufficient for the purpose of this order have been appropriated until such time as the budget for each fiscal year covered by the agreement has been adopted by the Legislature and signed by the Governor.

C. CONTRACTOR’S RESPONSIBILITIES

1. The Contractor shall assume responsibility for completion of work identified in Exhibit A, Statement of Work and in accordance with Exhibit C, Information Security and Privacy Provisions.

2. The Contractor Official responsible for overseeing completion of services and to whom all communications relative to those services be addressed is:

Name: To Be Determined Telephone Number:

Email Address:

3. The Contractor shall comply with all applicable health and safety laws and regulations at the Contractor’s own expense. Upon notice by the DMV, the Contractor shall also comply with the DMV’s specific health and safety requirements and policies. The Contractor also agrees to include in any

Exhibit A, Page 2 of 11 subcontract related to the performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice by the DMV, the DMV’s specific health and safety requirements and policies.

4. Contractor shall comply with the Department of Transportation Federal Motor Carrier Safety Administration Non-Discrimination Assurances located at:

https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/

5. Small Business Participation and DVBE Participation Reporting Requirements:

A. If for this Contract the Contractor made a commitment to achieve small business participation, then the Department requires the Contractor upon completion of this Contract to report the actual percentage of small business participation that was achieved. (Govt. Code § 14841)

B. If for this Contract the Contractor made a commitment to achieve the disabled veteran business enterprise (DVBE) participation goal, then, pursuant to Mil. & Vets. Code § 999.5(d), upon completion of this Contract, the Department requires the Contractor to certify using the Prime Contractor’s Certification – DVBE Subcontracting Report (STD 817), all of the following:

1. The total amount the prime Contractor received under the Contract;

2. the name, address, Contract number and certification ID number of the

DVBE(s) that participated in the performance of this Contract;

3. the amount and percentage of work the prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor;

4. that all payments under the Contract have been made to the DVBE(s); and

5. the actual percentage of DVBE participation that was achieved. Upon request, the prime Contractor shall provide proof of payment for the work.

C. If for this Contract the Contractor made a commitment to achieve the DVBE participation goal, the Department will withhold $10,000 from the final payment, or the full final payment if less than $10,000, until the Contractor complies with the certification requirements above. The Contractor shall e-mail the STD 817 to dmvasdsbdvbeadvocate@dmv.ca.gov.

D. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 calendar days but not more than 30 calendar days from the date of written notice, the prime contractor refuses to comply with the certification requirements, the Department shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets.

Code § 999.7).

E. A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code § 999.5(d); Govt. Code § 14841).

https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/ mailto:dmvasdsbdvbeadvocate@dmv.ca.gov

Exhibit A, Page 3 of 11

F. Contractor agrees to comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Mil. & Vets. Code, including, but not limited to, the requirements of Section 999.5(d).

(PCC Code § 10230).

6. Contractor shall comply with Executive Order N-6-22, Economic Sanctions Against Russia. The Executive Order is available at the following website:

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine- Executive-Order.pdf.

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

7. The Contractor shall provide to the DMV Contract Manager a copy of the insurances listed below within 10 calendar days after contract award. The State requires that the Certificate Holder on the Certificate of Insurance include the DMV’s address as: Department of Motor Vehicles, 2415 1st Avenue, Sacramento, CA 95818, and the DMV Contract Number TCXX-XXX.

A. General Provisions Applying To All Insurance Policies

1. Coverage Term:

Coverage shall be in force for the entire term of this contract. If insurance expires during the term of this contract, a new certificate of Insurance shall be received by the DMV at least ten (10) business days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of this contract.

2. Policy Cancellation of Termination and Notice of Non-Renewal:

The Contractor shall provide to the DMV, within five (5) business days following receipt by the Contractor, a copy of any cancellation or non-renewal of insurance required under this contract. In the event the Contractor fails to keep the required insurance coverage in effect at all times, the DMV may, in addition to any other remedies it may have, terminate this contract upon the occurrence of such event.

3. Deductible

The Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive-Order.pdf https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive-Order.pdf

Exhibit A, Page 4 of 11

4. Primary Clause

Any required insurance specified under this contract shall be primary, and not excess or contributory to any other insurance carried by the DMV.

5. Insurance Carrier Required Rating

All insurance companies shall carry a rating acceptable to the Department of General Services (DGS), Office of Risk and Insurance Management (ORIM). Per DGS ORIM, an acceptable rating is “A” or better, and financial size category of “VII” or better to the latest edition of the A.M. Best Key Rating Guide. If the Contractor is self-insured for a portion or all of its insurance, a review of the Contractor’s financial information, including a letter of credit, may be required.

6. Endorsements

Any required endorsement shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

7. Inadequate Insurance

Inadequate insurance or lack of insurance does not negate the Contractor’s obligations under this contract.

B. Commercial General Liability

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is commercial general liability insurance presently in effect for the Contractor with limits of not less than $1,000,000.00 per occurrence for bodily injury and property damage liability combined. The policy shall include coverage for liabilities arising out of premises operations, independent contractors, products/completed operations, personal and advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

2. The insurance policy shall include the following additional insured endorsement that shall be supplied under form acceptable to DGS, ORIM:

The State of California, its officers, agents, and employees are included as additional insured, but only with respect to work performed for the State of California.

C. Automobile Liability

By signing this contract, the Contractor certifies that the Contractor and any of their employees or subcontractors using a vehicle in the performance of work under this contract possesses valid automobile liability coverage in accordance with California Vehicle Code Sections 16450 to 16457, inclusive.

The DMV reserves the right to request proof at any time.

Exhibit A, Page 5 of 11

D. Workers Compensation

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor, if the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California. The Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract.

Employer’s liability limits of not less than $1,000,000.00 are required. If the Contractor does not employ any person, in any manner, so as to not become subject to the Workers Compensation Laws of California, the Contractor shall complete and submit to the DMV Contract Administrator, a Workers Compensation Exemption Certification form.

2. In the event the Contractor becomes subject to the Workers Compensation Laws of California during the term of this contract as a result of hiring employees to perform required services under this contract, the Contractor shall provide the DMV within ten (10) calendar days of hiring employee, with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor. The Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract. Employer’s liability limits of not less than $1,000,000.00 are required.

3. The Contractor’s workers compensation insurance policy shall be endorsed with a waiver of subrogation in favor of the State of California in the event the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California.

D. DMV’S RESPONSIBILITIES

1. The DMV shall comply with all USPS regulations regarding the use of the postage systems and the printing of postage.

2. Provide access to the DMV staff, management, offices, and operation areas as required to complete the tasks defined under this contract.

3. The DMV Contract Manager responsible for overseeing the Contractor’s performance, and the Contractor’s completion of requested services for the DMV Contact Centers is:

PRIMARY

Name:

Telephone Number:

Email Address:

Exhibit A, Page 6 of 11 or

ALTERNATE

Name:

Telephone Number:

Email Address:

E. CONTRACTOR TASKS/DELIVERABLES

1. Contract Transition

a. The first two (2) weeks and the last two (2) weeks of this Agreement term are hereby identified as “Contract Transition” for transitioning the performance of services and/or equipment under existing agreements to new agreements with different contractors (when applicable) in order to prevent service interruptions.

1. During the first two (2) weeks of this Agreement term, the Contractor agrees to transition the performance of services and/or equipment required under this Agreement from other contractors under existing agreements when applicable. Only the equipment transition shall occur if the Contractor is a different contractor under the existing agreement.

A. Within two (2) business days of the execution of the Agreement, the

Contractor shall submit Exhibit E, Transition Schedule, to the DMV Contract Manager identifying all proposed transition dates for each location identified within the Transition Schedule.

B. The Contractor’s first invoice shall be pro-rated in accordance to the actual date the Contractor began performing services at an office following completion of transition.

1. The Contractor shall submit Exhibit E, Transition Schedule, to the DMV

Project Manager identifying all proposed transition dates for each location identified within the Transition Schedule.

2. During the last four (4) weeks of this Agreement term, the Contractor agrees to transition the performance of services required under this Agreement to other contractors under other agreements when applicable.

3. The Contractor shall continue to provide services at an office under this Agreement until transition to another contractor under another agreement has been completed or the contract expires, whichever occurs first.

4. The Contractor’s last invoice shall be pro-rated in accordance to the actual date the Contractor stopped performing services at an office following completion of transition.

2. Equipment Capability Requirement

a. All postage meter mailing machines shall include an integrated scale with no less than a ten (10) pound weighing capacity, and semi-automatic

Exhibit A, Page 7 of 11 feeders capable of processing a high volume of mail/bundles. All mailing systems shall have the capability to seal and apply postage at a rate of up to one hundred twenty (120) pieces of mail per minute.

b. In the event equipment fails, in order to avoid service interruption, the Contractor shall provide loaner equipment within sixteen (16) hours of phone call notification, at no additional cost to the DMV.

3. Postage Metering Via Ethernet Connection

All postage metering equipment provided by the Contractor must be capable of having postage filled or refilled via Ethernet at no additional cost to the DMV.

4. Network Requirements

a. Device must be proxy aware, all internet traffic needs to go through DMV’s proxy.

b. All traffic must be initiated internally (no inbound traffic from outside).

c. Device must be kept up to date on security patching.

d. Only authorized DMV personnel shall access device.

e. Must perform pre and post production vulnerability scans.

f. If applicable:

1. Configure DNS to DMV internal DNS servers.

2. Configure time server to DMV internal NTP servers.

3. Change default admin/root password.

4. Close unsecure ports (20, 21, 23, etc.).

5. Delivery, Installation, and Removal

a. The Contractor shall contact the DMV Project Manager for each location identified in Exhibit D for coordination of equipment installation and/or removal.

b. h. The Contractor shall provide all labor, materials, tools, equipment, and supervision; pay all travel expenses, shipping and handling fees, insurance, bonds, license fees, permit fees, and all other costs incidental to delivery, installation, or removal of the lease equipment.

c. i. The on-site set-up and start-up services shall be provided by the Contractor to ensure equipment is running properly and adjusted to factory specifications.

d. The Contractor shall adhere to all Federal, State and Local laws in disposing of debris.

6. Setup, Startup, and Training on Mailing Equipment System

a. The Contractor shall provide on-site setup, startup service, and training by factory trained technicians to ensure that the equipment is running properly and adjusted to factory specifications. The training session shall be provided to a minimum of two (2) DMV staff members at each location to cover the operation and maintenance of the system at no additional cost to the DMV.

Exhibit A, Page 8 of 11

b. The equipment shall be delivered fully serviced and ready to operate.

Installation shall include, at no additional cost to DMV, delivery of two (2) ink cartridges and two (2) rolls or packs of meter strips.

c. The Contractor shall provide one (1) copy of the equipment operational manual to each location. All manuals and instructions shall be in the English language. If there are special tools required to operate the equipment, one

(1) set shall be provided to each location.

7. Equipment Parts Replacement

Equipment parts determined to be unserviceable by the Contractor shall be replaced by the Contractor with new or equivalent to new equipment parts at no additional cost to the DMV. Replacement equipment parts shall be approved by the DMV Contract Manager. Unserviceable equipment parts that are replaced by the Contractor shall become the property of the Contractor.

8. Equipment Deletions

DMV equipment deletions throughout the term of this Agreement shall be accomplished by written notice by the DMV Contract Manager to the Contractor.

9. Software

The Contractor shall provide, install, and maintain all software and hardware that is necessary to update changes, and update those changes to the postal zip code tables and postal rates at no additional cost to the DMV.

10. Relocations

a. The Contractor shall be notified in writing within two (2) weeks of any changes to the DMV locations.

b. The Contractor shall move the equipment to the new location specified by the DMV Contract Manager, at no additional cost to the DMV. If the Contractor does not move the equipment to a new location, the DMV personnel or moving services contractor will move the equipment with the toner separated in plastic zip lock bag to avoid spillage of ink, unless otherwise specified by the Contractor.

11. Rented or Loaned Equipment

a. In the case of rented or loaned equipment, the DMV shall be relieved of all risks of loss or damage during the entire time the equipment is in the possession of the DMV, except when the loss or damage is due to fault or negligence on the part of the DMV. Rented or loaned equipment shall be returned to the Contractor in the condition it was received, less normal wear and tear, provided there is no loss or damage due to fault or negligence on the part of the DMV.

b. The Contractor agrees to provide maintenance, repair, and replacement services for all rented or loaned equipment throughout the term of this Agreement to ensure that the equipment remains in good operating condition

Exhibit A, Page 9 of 11 at all times. Maintenance shall be performed by trained and qualified technicians. If rented or loaned equipment needs to be removed from the DMV premises for repair or replacement, the Contractor shall immediately provide the DMV with replacement equipment of comparable capability.

c. The DMV shall not use special attachments, printing plates, or other devices on rented or loaned equipment unless otherwise approved by the Contractor in writing. The DMV shall only use supplies that meet the published specifications of the Contractor. DMV deletion of rented or loaned equipment throughout the term of this Agreement shall be accomplished by written notice to the Contractor.

12. Service Calls

The Contractor shall respond to equipment maintenance and/or repair service calls placed by the DMV during regular DMV business hours (8:00 a.m. to 5:00 p.m.

Monday through Friday, excluding state holidays). The Contractor shall also respond to equipment repair service calls placed by the DMV outside of regular DMV business hours Monday through Sunday, including state holidays. When the DMV places a service call to the Contractor during regular DMV business hours, the Contractor shall begin performing services at the DMV within nine (9) DMV business hours following DMV’s service call. When the DMV places a service call to the Contractor outside of regular DMV business hours, the Contractor shall begin performing services at the DMV within two (2) hours following DMV’s service call.

13. Monthly Meeting

The Contractor shall attend a monthly meeting with the DMV Contract Manager on a mutually agreed upon day and time to evaluate services.

14. Loss/Damage

The DMV shall be relieved from all risks of loss or damage to all equipment/parts during periods of transportation by the Contractor or the Contractor’s agent.

15. Uniform Clothing

The Contractor shall require all employees, including supervisors, to wear distinctive uniform clothing while performing services under this Agreement. The Contractor shall ensure that every employee and supervisor is in uniform when on-site at a DMV office. Uniform clothing shall clearly identify the Contractor’s name in a manner that is easily identifiable via a permanently affixed badge or monogram.

F. PAYMENT TERMS AND INVOICING REQUIREMENTS

1. The DMV will not be obligated to pay on an invoice until the status reports and timesheets required herein are received by the DMV Contract Manager. The DMV may dispute an invoice that does not comply with this Contract’s requirements, including requirements for invoices, timesheets and status reports, and a dispute

Exhibit A, Page 10 of 11 notice given on that basis shall satisfy the requirements of the California Prompt Payment Act.

2. Project costs related to items such as travel, per diem and travel time to the designated base of operation for the engagement are costs to be included within the contractor rates. DMV will not pay for such costs as a separate item.

3. Invoice(s) shall include all of the following:

a. Contractor’s name as indicated within this Agreement, address, telephone number, fax number, and email address.

b. Name, address, and telephone number of the DMV representative or office indicated within this Agreement to whom the invoice is being mailed or delivered.

c. Date the invoice was prepared.

d. Period of time covered by the invoice.

e. The Agreement number.

f. Office name and address where services were provided.

g. Brief description of the type of services for which the DMV is being billed.

h. Total number of days in the billing period that the Contractor was required to perform services.

i. Dates within the billing period that the Contractor failed to render required services.

j. Total amount invoiced (include calculations showing how the total amount invoiced was determined by including any pro-rata reduction amounts if applicable).

4. Invoices shall be emailed to: ACCT_INV@dmv.ca.gov

5. In addition to any other remedy available under this Agreement or applicable law, the DMV may dispute an invoice or invoices submitted by the Contractor and withhold amounts owed by the Contractor to the DMV under this Agreement, including but not limited to amounts owed for breach, amounts owed as liquidated damages, and amounts owed due to overpayments from amounts claimed by the Contractor on invoices submitted to the DMV and otherwise owed by the DMV to the Contractor under this Agreement.

G. AMENDMENTS

1. Should, during the course of this contract, it become necessary to modify the terms of this Statement of Work (Exhibit A), those modifications shall be through a written amendment to the contract.

2. A written contract amendment shall not be effective until fully executed by both parties. No oral understanding or agreement not incorporated through the proper contractual process shall be binding on either the Contractor or the DMV.

mailto:ACCT_INV@dmv.ca.gov

Exhibit A, Page 11 of 11

3. Contractor resources will not be expended, at a cost to the DMV, in excess of the authorized contract cost.

4. Any amendment to the contract not in the scope of the contract will require a fully approved Non-Competitively Bid justification.

H. TERMINATION

The DMV may suspend services at any time during the term of this Agreement upon three (3) calendar days’ written notice by the DMV Contract Manager to the Contractor. The DMV may choose to reinstate suspended services at any time during the term of this Agreement and shall provide ten (10) calendar days’ written notice to the Contractor. The DMV does not guarantee a minimum or maximum use of this Agreement.

Exhibit B, Page 1 of 2

COST DATA SHEET

PLACEHOLDER PAGE – INTENTIONALLY BLANK - VENDOR’S RFO ATTACHMENT 2, COST DATA SHEET WILL BE INSERTED INTO THIS

EXHIBIT UPON CONTRACT AWARD

CSD25-3136, Section II Exhibit C, Page 1 of 8

INFORMATION SECURITY AND PRIVACY PROVISIONS (04/2022)

In the performance of this Agreement, [Contractor] agrees to protect all Department of Motor Vehicles (DMV) information by implementing the necessary controls to comply with State mandated security and privacy requirements provided in California State Administrative Manual (SAM), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), Government Code §11015.5 and §11019.9, Vehicle Code, and California Information Practices Act (IPA) Civil Code §1798 et seq. The Contractor further agrees to implement the minimum administrative, physical, technical, and safeguards identified in this Agreement. The Contractor shall protect DMV information for the terms and length of this Agreement and while in possession of, maintaining, or accessing DMV information. The Contractor shall ensure any third parties adhere to these same provisions.

A. DEFINITIONS – For purposes of this Exhibit, the following definitions shall apply:

1. Contractor shall generally refer to any entity, private or public organization hired or working in conjunction with or for DMV to provide deliverables.

2. Data shall mean a representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

3. DMV Information shall refer to DMV provided data.

4. Confidential Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

5. Personal Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

6. Sensitive Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

7. Personnel shall refer to any Contractor employees, volunteers, contractors, sub-contractors commissioned, employed by, or otherwise engaged in the performance of work associated with the Contractor.

8. Systems shall refer to workstations, laptops, servers, network, and other information processing components managed and hosted by Contractor which process, store, or transmit DMV information.

9. Users shall refer to any Contractor personnel with access to DMV information.

Exhibit C, Page 2 of 8

B. ADMINISTRATIVE SAFEGUARDS

1. DATA OWNERSHIP

DMV information provided under this Agreement remains DMV exclusive property. Confidential, sensitive, and personal information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without written permission from the DMV.

The Contractor recognizes its responsibility to protect the confidentiality of information in their custody as provided by law and ensure such information is disclosed only to those individuals, and of such purpose as authorized by the respective laws.

The Contractor shall have a non-exclusive right to use and process the disclosed information for the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of this data does not transfer ownership of information to the Contractor.

2. USE OF INFORMATION

The Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement shall be used solely for the purposes described in this Agreement and agrees to implement policies and procedures to ensure the confidentiality of said information.

The Contractor further agrees that information obtained under this Agreement shall not be reproduced, published, sold, or released in original or any other form for any purpose other than identified in this Agreement. Only the minimum necessary amount of DMV information required to perform necessary business functions may be processed, stored, or transmitted.

The Contractor shall not use any DMV information that identifies real individuals for any purpose not described in this Agreement including for testing, training, or research.

3. BACKGROUND CHECKS

Contractor Personnel who may access DMV information, must undergo a thorough background check, with evaluation of the results to assure that there is no indication that the worker may present a risk to the security or integrity of confidential data or a risk for theft or misuse of confidential data. The Contractor shall retain background check documentation for a period of three (3) years following contract termination.

Exhibit C, Page 3 of 8

4. STATEMENT OF CONFIDENTIALITY AND REQUIREMENTS

Information maintained by DMV is confidential under this Agreement and exempt from disclosure under the provisions of California Public Records Act (Government Code §6250-6265), the California Elections Code §2194), and other applicable state or federal laws.

The Contractor further understands and acknowledges that under California Penal Code §502, it is a public offense to knowingly and without permission alter, damage, delete, destroy, copy, or otherwise use any DMV data. Such action can be prosecuted civilly or criminally and is punishable by fine and/or imprisonment.

The Contractor shall ensure that all users sign a confidentiality statement each year, attesting to the fact that he/she is aware of the confidential nature of the data and penalties for unauthorized disclosure under applicable state and federal law. Copies of signed confidentiality statements must be made available to the DMV CISO upon request.

5. INFORMATION SECURITY AND PRIVACY AWARENESS TRAINING

The Contractor shall ensure that all users must receive information security and privacy awareness training prior to accessing such information, and annually thereafter. Information security and privacy awareness training must contain instructional components such as, but not limited to, information about the confidential nature of information, laws and regulations protecting the confidentiality of information, user responsibility for protecting the information, and the consequences and legal liability of unauthorized use, access, or disclosure of said information. Upon request, the Contractor must provide the DMV Chief Information Security Officer (CISO) or Privacy Officer with a copy of its information security and privacy awareness training components and certification of its annual information security and privacy awareness training completion.

6. EMPLOYEE ACCESS TO INFORMATION

The Contractor agrees that information shall be kept in the strictest confidence and only made available to authorized personnel on a “need-to-know” business basis, and only for the purposes authorized under this Agreement. The term “need-to-know” refers to those authorized persons who need information to perform their official duties in connection with the purpose described in the Agreement.

The Contractor shall maintain records of all authorized users and the authorization level of access granted to the information obtained under this Agreement with the purpose described in this Agreement.

Exhibit C, Page 4 of 8

7. RISK ASSESSMENT

A risk assessment must be conducted annually on all Contractor systems which process, store or transmit DMV information. Risk assessments must be documented at least every three (3) years or upon significant change to the system or environment. Risk assessment results must be provided to the CISO within 30 days of completion.

8. INCIDENT REPORTING

The Contractor shall immediately notify the DMV CISO/Designee of any actual or suspected security event involving DMV information accessed or obtained under this Agreement. The Contractor shall cooperate fully with DMV to comply with the incident reporting requirements within Civil Code section 1798.29 and SAM section 5340.4.

The Contractor shall thoroughly investigate all unauthorized or suspected unauthorized access, use, and/or disclosure of information obtained under this Agreement. DMV reserves the right to participate in the investigation of any information security incident involving its data and may conduct its own independent investigation, and the Contractor shall cooperate fully in such investigation.

The Contractor shall provide a preliminary report within three (3) working days of discovery of breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as any pertinent preliminary information. The Contractor shall then provide a full written report of the investigation to the DMV CISO and Privacy Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure.

DMV reserves the right to take corrective action at any time.

9. BREACH OR DISCLOSURE OF DMV INFORMATION

Disclosure of any DMV information to any person or entity not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with DMV’s confidential information shall not reveal, share, or divulge to any person or entity any of the confidential information provided under this Agreement, except as authorized or required by law.

DMV shall not be held liable for any breach of Contractor systems that results in the release of any information provided by DMV. Contractor agrees to indemnify and hold harmless DMV, its officers, and representatives from and against any liability, losses, costs, damages, or expenses (including but not limited to attorney fees) resulting from any claims arising from the performance of this Agreement, including but not limited to any and all liability, damages, costs, expenses, or attorney fees resulting from a breach of security of the system

Exhibit C, Page 5 of 8 as defined in the California IPA unless such damages are determined to be the result of the negligence of DMV, its officers, employees, or representatives.

If the Contractor experiences a loss or breach of data, the Contractor shall immediately report the loss or breach to DMV. If DMV determines that notice to the individuals whose data has been lost or breached is appropriate, the Contractor shall bear any, and all costs associated with the notice, or any mitigation selected by the data owner. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data.

C. PHYSICAL SAFEGUARDS

1. ACCESS CONTROL

The Contractor shall ensure information in all forms, such as, but not limited to CDs, DVDs, USB flash drives, or other removable media must be stored in areas physically secure and free from access by unauthorized persons as described in this Agreement.

The Contractor shall ensure computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement must not be viewed by the public or other unauthorized persons as described in the Agreement.

2. SUPERVISION OF DATA

DMV information in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information. DMV information in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

3. ESCORTING VISITORS

Visitors to areas where DMV information is contained shall be escorted and DMV information shall be kept out of sight while visitors are in the area.

4. REMOVAL OF DATA

DMV information must not be removed from the premises of the Contractor except with express written permission.

Exhibit C, Page 6 of 8

D. TECHNICAL SAFEGUARDS

1. DATA RETENTION AND DESTRUCTION

DMV information must be retained for the minimum necessary to perform the required business function.

All data received by the Contractor under this Agreement and any data created, copied, attributed to data received shall be destroyed when no longer needed for the business function for which they were obtained, or within 10 calendar days of termination of this Agreement. Data must be destroyed in accordance with the requirements specified NIST Special Publication (SP) 800-88, Guidelines for Media Sanitization.

2. ENCRYPTION

Confidential, sensitive, or personal information must be encrypted in accordance with Federal Information Processing Standards 140-3, Security Requirements for Cryptographic Modules.

3. DATA AT REST AND IN TRANSIT

All Contractor systems that process, store, or transmit DMV confidential, sensitive, or personal information at rest and in transit must be encrypted in accordance with the security and privacy provisions specified within this Agreement.

4. ENDPOINT PROTECTION

All Contractor systems that process, store, or transmit DMV information must install and actively use endpoint protection with automatic updates scheduled at least daily.

5. VULNERABILITY MANAGEMENT

All Contractor systems which store, process, or transmit DMV information must be scanned for vulnerabilities monthly, and when new vulnerabilities potentially affecting the system are identified and reported. Vulnerabilities by severity must be remediated within the following timeframe.

• Critical (3 business days or less)

• High (21 days)

• Medium (60 days)

• Low (90 days)

The CISO must be notified within 24 hours if critical vulnerabilities cannot be remediated within the required timeframe.

Exhibit C, Page 7 of 8

6. INTRUSION DETECTION

All Contractor systems which store, process, or transmit DMV information that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

7. WARNING BANNERS

All Contractor systems which store, process, or transmit DMV information must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.

8. IDENTIFICATION and AUTHENTICATION All users accessing DMV information from Contractor systems must be assigned uniquely identified accounts.

9. PASSWORD CONTROLS

Contractor system user account passwords must be a minimum 15 characters and must be composed of a minimum one character each from the following four groups:

a. Upper case letters (A-Z)

b. Lower case letters (a-z)

c. Arabic numerals (0-9)

d. Non-alphanumeric characters (punctuation symbols)

Passwords must be changed at least every 180 days.

10. USER ACCOUNT MANAGEMENT

Contractor system user accounts must be immediately disabled or deleted upon personnel termination or a change in assigned duties which no longer require access to DMV information.

11. MULTI FACTOR AUTHENTICATION

Multi factor authentication must be enabled for all Contractor system users accessing DMV information.

12. SESSION LOCK

Contractor systems must not be left unattended and logged on. Systems must be configured to prevent access by initiating a session lock after no more than 10 minutes of inactivity. Session locks must be retained until the user reestablishes access using established identification and authentication procedures.

Exhibit C, Page 8 of 8

13. CHANGE CONTROL

The Contractor shall notify the DMV 30 days prior of any changes to systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit DMV information. The DMV shall notify the Contractor of any changes to DMV systems, hardware, software, applications, file structure, data, or record layout which process, store, or transmit information in the performance of this Agreement at the discretion of the DMV.

14. AUDITING

The Contractor shall maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Said logs must be made available to the DMV upon request.

To determine compliance with Agreement terms, the Contractor shall permit DMV authorized individuals to perform audit or inspections during regular business hours of hosted Contractor systems located on Contractor premises.

Contractor shall permit audits or inspections with seven (7) days prior notice.

Exhibit D, Page 1 of 1

DMV Contact Center Office Locations

RU #

Location

Contact Name

Phone

Transition Date

DMV Contact Center Yolanda Thornburg

Yolanda.thornburg@dmv.ca.gov

(916) 964-8939

TBD 8251 Demetre Ave. MS l130

Sacramento, CA 95828

Harumi Cox

Harumi.cox@dmv.ca.gov

(951) 564-5648

TBD 6465 Sycamore Canyon Blvd., 2ndFloor

Riverside, CA 92507 mailto:Yolanda.thornburg@dmv.ca.gov mailto:Harumi.cox@dmv.ca.gov

Exhibit E, Page 1 of 1

Transition Schedule

RU #

Location

Contact Name

Phone Transition

Date

Yolanda Thornburg

Yolanda.thornburg@dmv.ca.gov

(916) 964-8939

TBD 8251 Demetre Ave. MS l130

Sacramento, CA 95828

Harumi Cox

Harumi.cox@dmv.ca.gov

(951) 564-5648

TBD 6465 Sycamore Canyon Blvd., 2ndFloor

Riverside, CA 92507 mailto:Yolanda.thornburg@dmv.ca.gov mailto:Harumi.cox@dmv.ca.gov