SaaS_-_Terms_and_Conditions.docx

RFP # 2025-RFP-0045

Digital Signage Kiosk System

SOFTWARE AS A SERVICE (SAAS) - TERMS AND CONDITIONS

I. DEFINITIONS

a. Backup: Backup refers to the process of making copies of data or data files, on a regular basis, to use in the event the original data or data files are lost or destroyed.

· A backup is the duplication of system information in a manner that:

· Is not electronically connected to the primary system in its end state. (Replication, raid drives, and fail-over systems are not a backup).

· Is not on the same power supply of the primary system.

· Is located at least ten miles away from the primary system.

· Has been tested to ensure that a restoration can be done on a separate set of equipment from the primary equipment. A backup process is not considered to be in place unless a restoration has been tested.

· Keeps a history of at least one iteration in case the primary backup fails.

· Is maintained in a secure area.

· Regular Basis:

· Backup of servers will occur every day after regular business hours.

· Full Backup: Copying into an archive file of computer data so it may be used to restore the original after a data loss event. At a minimum, one full backup will be performed weekly, to include all the source files.

· Differential Backup: A backup of all changes made since the last full backup. At a minimum, Differential Backup will be performed daily.

· Incremental Backup: One in which successive copies of the data contain only the portion that has changed since the preceding backup copy was made. When a full recovery is needed, the restoration process would need the last full backup plus all the incremental backups until the point of restoration. At a minimum, Incremental Backup will be performed as needed.

b. CONTRACTOR: The contractor and its employees, subcontractors, agents and affiliates who are providing the services agreed to under this Agreement.

c. COUNTY Data: All data created or in any way originating with the COUNTY, and all data that is the output of computer processing or other electronic manipulation of any data that was created by or in any way originated with the COUNTY, whether such data or output is stored on the COUNTY’s hardware, the CONTRACTOR’s hardware, hardware owned by subcontractors of the CONTRACTOR, or exists in any system owned, maintained or otherwise controlled by the COUNTY, the CONTRACTOR, or subcontractors of the CONTRACTOR.

d. COUNTY and CONTRACTOR Identified Contact: The person or persons designated below in writing by the COUNTY/CONTRACTOR to receive Security Incident or breach notification.

Department of Technology Desk: (916) 874-7825 zakariar@saccounty.net

IT Division Chief Desk: (916) 875-5698 abrahamj@saccounty.net

Information Security Office (ISO) Glenn Herdrich Information Security Manager Desk: (916) 875-5247 ISO Group (916) 874-5171 herdrichg@saccounty.net

SOC Group: (916) 875-1600 soc@saccounty.net or 24/7 Emergency Notification Desk: 311

e. Data Breach: Access that results in the unauthorized use, unauthorized disclosure, or theft of COUNTY’s unencrypted Personal Data.

f. Electronic Systems: Includes all servers, routers, storage area networks, user data, configuration data, source code, databases, applications, PC’s with user data, PC’s with locally installed applications, or any other system component that is required to make a system operable for an end user.

g. Individually Identifiable Health Information: Information that is a subset of health information, including demographic information collected from an individual, and

· Is created or received by a health care provider, health plan, employer or health care clearinghouse; and

· Relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and

(a) That identifies the individual; or

(b) With respect to which there is a reasonable basis to believe, the information can be used to identify the individual.

h. Non-Public Data: Data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the COUNTY because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information.

i. Personal Data: Data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government-issued identification numbers, including but not limited to Social Security, driver’s license, passport; financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI) relating to a person.

j. Protected Health Information (PHI): Individually Identifiable Health Information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer.

k. Recovery Time Objective (RTO): The overall length of time an information system’s components can be in the recovery phase before negatively impacting the organization’s mission or mission/business functions. The targeted duration of time which COUNTY’s processes must be Restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity. For example, COUNTY typical business hours 9am to 5pm, Monday through Friday, will use the following timescales:

· 4 hours = 4 consecutive hours

· 24 hours = 1 consecutive calendar days

· 48 hours = 2 consecutive calendar days

· 10 days = 10 business days

· 30 days = 30 business days

· 60 days = 60 business days

· 90 days = 90 business days

· 1 year = 365 consecutive calendar days

· Annually = 365 consecutive calendar days

· 5 years = 1,825 consecutive calendar days

l. Restore: The ability to return to a fixed production state:

· Within 48 hours of when replacement equipment is available.

· Return to service systems on equipment platforms other than the primary equipment platform.

· Restore all source code, applications, databases, drivers, or supporting systems to make a service fully functional to the end customer.

· Restore test and development systems associated with the production application.

· For critical systems, the ability to restore all components to restore services without the ability to connect to the internet.

m. Security Incident: A violation of an explicit or implied security policy; or the potentially unauthorized access to Personal Data or Non-Public Data the COUNTY believes could reasonably result in the unauthorized use, unauthorized disclosure, or theft of a COUNTY’s unencrypted Personal Data or Non-Public Data within the possession or control of the CONTRACTOR. A Security Incident may or may not turn into a Data Breach.

II. DATA OWNERSHIP

The COUNTY will own all rights, title and interest in its data that is related to the services provided by this Agreement. The CONTRACTOR shall not access COUNTY user accounts or COUNTY Data, except:

(1) In the course of data center operations;

(2) In response to service or technical issues;

(3) As required by the express terms of this Agreement or;

(4) At the COUNTY’s written approval.

III. DATA PROTECTION

Protection of personal privacy and data shall be an integral part of the business activities of the CONTRACTOR to ensure there is no inappropriate or unauthorized use of COUNTY information at any time. To this end, the CONTRACTOR shall safeguard the confidentiality, integrity and availability of COUNTY information and comply with the following conditions:

a. The CONTRACTOR shall adhere and maintain to the National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53 r4 moderate controls and 800-45 administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non-Public Data. Such security measures shall be in accordance with recognized industry practice, such as NIST and the Health Insurance Portability and Accountability Act (HIPAA) and not less stringent than the measures the CONTRACTOR applies to its own Personal Data and Non-Public Data of similar kind.

b. All data obtained by the CONTRACTOR in the performance of this Agreement shall become and remain the property of the COUNTY.

c. COUNTY/CONTRACTOR shall ensure appropriate identification and authentication controls, access controls, and audit logging controls are implemented on every network component.

d. The CONTRACTOR is responsible for encryption of all data, at rest and in transit, with encrypted web protocols specified by the NIST SP 800-53 r4 or most current version moderate controls, using Transport Layer Security (TLS) 1.2, or better, with Advanced Encryption Standard (AES) 256, or the then-current NIST standard, whichever is more secure, as the minimum standard encryption algorithm signed by a public signing authority. In the event the NIST standard increases during the term of this Agreement, CONTRACTOR shall satisfy such new NIST standard at no additional cost to the COUNTY.

e. At no time shall any data or processes—that either belong to or are intended for the use of the COUNTY or its officers, agents or employees—be copied, disclosed or retained by the CONTRACTOR or any party related to the CONTRACTOR for subsequent use in any transaction that does not include the COUNTY.

f. The CONTRACTOR shall not use any information collected in connection with the service provided under this Agreement for any purpose other than fulfilling the service.

IV. DATA LOCATION

The CONTRACTOR shall provide its services to the COUNTY solely from data centers in the United States (U.S.). Storage of COUNTY Data at rest shall be located solely in data centers in the U.S. The CONTRACTOR shall not allow its personnel or contractors to store COUNTY Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers and used for this Agreement. The CONTRACTOR shall permit its personnel and contractors to access COUNTY Data remotely only as required to provide technical support. The CONTRACTOR may provide technical user support on a 24/7 basis using a follow-the-sun model, unless otherwise prohibited in this Agreement.

V. SECURITY INCIDENT OR DATA BREACH NOTIFICATION

The CONTRACTOR discovering a Security Incident will report it in accordance with the COUNTY’s incident reporting procedures and ensure that the COUNTY is notified. Incident reporting contact information is listed in section I.d, “COUNTY and CONTRACTOR Identified Contact”, of this Agreement.

The COUNTY’s personnel will be notified of any Security Incident that may have an operational/security impact on COUNTY’s resources, or may become a breach.

Incident Response: The parties agree to notify their designated counterparts, found in section I.d, by telephone or e-mail at the earliest opportunity in the event a Security Incident has been detected, so the other party may take steps to determine whether its system has been compromised and to take appropriate security precautions. This communication should include a description of the incident and status on containment and/or resolution efforts. The system owner will receive a formal written incident summary within ten (10) business days after the incident has been remediated.

a. Security Incident Reporting Requirements: The CONTRACTOR shall report a Security Incident to the appropriate COUNTY Identified Contact immediately as defined in section I.d.

b. Breach Reporting Requirements: If the CONTRACTOR has actual knowledge of a confirmed Data Breach that affects the security of any COUNTY content that is subject to applicable Data Breach notification law, the CONTRACTOR shall:

(1) Notify the appropriate COUNTY Identified Contact within 24 hours (as identified in section I.k) or sooner, unless shorter time is required by applicable law, and;

(2) Take the measures specified in this Agreement, or in the event not specifically specified in this Agreement take commercially reasonable measures, to address the Data Breach in a timely manner.

VI. BREACH RESPONSIBILITIES

This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the CONTRACTOR.

a. The CONTRACTOR shall immediately notify the appropriate COUNTY Identified Contact, section I.d, by telephone if it confirms that there is, or reasonably believes that there has been a Data Breach. The CONTRACTOR shall:

(1) Promptly investigate any alleged misuse of COUNTY Data or related security breach, and to cooperate reasonably with COUNTY personnel in connection with any alleged breaches involving its data.

(2) Promptly implement necessary remedial measures, if necessary, and

(3) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

b. If a Data Breach is a direct result of the CONTRACTOR’s obligation to encrypt Personal Data or otherwise prevent its release, the CONTRACTOR shall bear the costs associated with:

(1) The investigation and resolution of the Data Breach;

(2) Notifications to individuals, regulators or others required by state law;

(3) A credit monitoring service required by state (or federal) law;

(4) A website or a toll-free number and call center for affected individuals required by state law; and

(5) All corrective actions as reasonably determined by the COUNTY based on root cause.

VII. NOTIFICATION OF LEGAL REQUESTS

The CONTRACTOR shall contact the COUNTY upon receipt of any requests including but not limited to Public Records Act requests, discovery requests, litigation holds, and requests for expert testimonies related to the COUNTY’s data under this Agreement, or which in any way might reasonably require access to the COUNTY Data. The CONTRACTOR shall not respond to subpoenas, service of process and other legal requests related to the COUNTY without first notifying the COUNTY Identified Contacts in section I.d.

VIII. TERMINATION AND SUSPENSION OF SERVICE

a. In the event of a termination of this Agreement, the CONTRACTOR shall implement at no additional cost to the COUNTY an orderly return of COUNTY Data in a comma-separated values (CSV) file 60 business days, section I.k, after the effective date of termination.

b. During any period of service suspension, the CONTRACTOR shall not take any action to intentionally erase, sanitize, or delete any COUNTY Data.

c. In the event of termination of this Agreement, the CONTRACTOR shall not take any action to intentionally erase, sanitize, or delete any COUNTY Data for a period of 60 days (see section I.k) or a longer period if specified by the COUNTY.

d. After such period, the CONTRACTOR shall have no obligation to maintain or be provided any COUNTY Data and shall thereafter, unless legally prohibited, sanitize or delete, in accordance with NIST SP 800-88, all COUNTY Data in its systems or otherwise in its possession or under its control, as stated in this Agreement.

e. The COUNTY shall be entitled, at no additional cost to the COUNTY, to any post-termination assistance generally made available with respect to the services; unless a unique data retrieval arrangement has been established as part of this Agreement.

f. The CONTRACTOR shall securely dispose of all requested data in all of its forms, such as electronic/paper, when requested by the COUNTY at no additional cost to the COUNTY. Data shall be permanently deleted and shall not be recoverable, according to NIST approved methods. Certificates of destruction shall be provided to the COUNTY at no cost to the COUNTY.

IX. BACKGROUND CHECKS

The CONTRACTOR shall conduct criminal background checks – and must satisfy Federal Tax Information background check policy, if applicable - and not utilize any staff, including subcontractors, to fulfill the obligations of this Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to one year is an authorized penalty. CONTRACTOR shall provide documentation of the above background checks upon request of the COUNTY at no cost to the COUNTY.

The CONTRACTOR shall ensure that all individuals maintaining COUNTY Data have attended initial basic and annual refresher Information Security and Privacy Awareness and Training. Additionally, ensure that persons with significant security responsibilities for the data, receive annual role based training covering their specific areas of responsibility. This training should ensure that staff members know how to report suspicious or prohibited activities. CONTRACTOR shall provide documentation of the above training upon request of the COUNTY at no cost to the COUNTY.

X. ACCESS TO SECURITY LOGS AND REPORTS

The CONTRACTOR shall provide security logs to the COUNTY in a JavaScript Object Notation (JSON) format. Reports shall include, but not limited to:

· User identification

· Type and origin of event

· Date and time

· Success or failure indication

· Identity or name of affected data; System component or resource

· All actions taken by any individual with elevated privileges

· Invalid logical access attempts

· Use of and changes to identification and authentication mechanisms

· Creation and deletion of system level objects Security logs will be retained for at least five (5) (see section I.k) years or such longer period as specified by the COUNTY or as required by law.

XI. CONTRACT AUDIT

The CONTRACTOR shall allow the COUNTY to audit conformance to the Agreement terms. The COUNTY may perform this audit or contract with a third party at its discretion and at the COUNTY’s expense.

XII. DATA CENTER AUDIT

The CONTRACTOR shall perform an independent audit of its data center(s) at least annually at its expense, and provide a redacted version of the audit report upon request at no cost to COUNTY. The CONTRACTOR may remove its proprietary information from the redacted version. A Service Organization Control (SOC) 2 audit report or equivalent approved by the COUNTY sets the minimum level of a third-party audit.

XIII. CHANGE CONTROL AND ADVANCE NOTICE

Significant changes, any upgrade or modification that affects the security of the system, the system architecture, documentation, or configurations, of either parties, will be reviewed, approved, and documented in accordance with CONTRACTOR/COUNTY configuration or change control process. Each party shall notify the other if a system change significantly changes the approved security posture of the system or introduces new significant risk/residual risk to either system. Whenever significant changes are made at one or both parties, (e.g., through additional staff, service, etc.), these changes should be recorded as an addendum to the original Agreement.

The CONTRACTOR shall give ninety (90) business days’ advance notice, or such other agreed upon days, to the COUNTY of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its security posture and characteristics. It usually includes a new version number.

XIV. INFORMATION SECURITY

The CONTRACTOR shall disclose upon COUNTY request its non-proprietary security processes and technical limitations to the COUNTY such that adequate protection and flexibility can be attained between the COUNTY and the CONTRACTOR. For example: virus checking and port sniffing — the COUNTY and the CONTRACTOR shall understand each other’s roles and responsibilities.

XV. NON-DISCLOSURE AND SEPARATION OF DUTIES

The CONTRACTOR shall enforce separation of job duties where only the staff that require access to the COUNTY data have access to the COUNTY data, require commercially reasonable non-disclosure agreements, and limit staff knowledge of COUNTY Data to that which is absolutely necessary to perform job duties.

XVI. IMPORT AND EXPORT OF DATA

The COUNTY shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the CONTRACTOR. This includes the ability for the COUNTY to import or export data to/from other contractors.

XVII. RESPONSIBILITIES AND UPTIME GUARANTEE

The CONTRACTOR shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the CONTRACTOR. The system shall be available 24/7/365 (with agreed-upon maintenance downtime during non-peak hours only).

XVIII. SUBCONTRACTOR DISCLOSURE

The CONTRACTOR shall identify all of its strategic business partners related to services provided under this Agreement, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the CONTRACTOR, and who shall be involved in any application development and/or operations.

XIX. RIGHT TO REMOVE INDIVIDUALS

Both parties shall allocate the appropriate human resources to ensure the continual function of this Agreement, irrespective of changes in personnel. Each party agrees to provide the other with notification of any changes in point of contact information.

The COUNTY shall have the right at any time to require that the CONTRACTOR remove from interaction with COUNTY any CONTRACTOR representative who the COUNTY believes is detrimental to its working relationship with the CONTRACTOR. The COUNTY shall provide the CONTRACTOR with notice of its determination, and the reasons it requests the removal. If the COUNTY signifies that a potential security violation exists with respect to the request, the CONTRACTOR shall immediately remove such individual. The CONTRACTOR shall not assign the person to any aspect of this Agreement or future work orders without the COUNTY’s consent.

XX. BUSINESS CONTINUITY AND DISASTER RECOVERY

The CONTRACTOR shall provide a business continuity and disaster recovery plan upon request at no cost to the COUNTY and ensure that the COUNTY’s Recovery Time Objective (RTO) of 48 hours (see section I.k) are met.

The parties agree to provide notification to the COUNTY and CONTRACTOR identified contacts in section I.d. by telephone or e-mail at least every four (4) hours in the event of a disaster or other contingency which disrupts the normal operation of one or both of the connected systems. This communication shall include the cause of the outage and reasonable forecasts pertinent to the restoration of services. The system owner will receive formal after action written event summary within ten (10), see section I.k, business days after restoration of services.

XXI. COMPLIANCE WITH ACCESSIBILITY STANDARDS

The CONTRACTOR shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973.

XXII. ENCRYPTION OF DATA

The CONTRACTOR shall ensure hard drive encryption consistent with validated cryptography standards as referenced and specified by the NIST SP 800-53 r4 or most current version moderate controls, using Transport Layer Security (TLS) 1.2, or better, with Advanced Encryption Standard AES 256, or the then-current NIST standard, as the minimum standard encryption algorithm signed by a public signing authority. In the event the NIST standard increases during the term of this Agreement, CONTRACTOR shall satisfy such new NIST standard, at no additional cost to the COUNTY.

XXIV. CURRENT VERSIONS

a. CONTRACTOR will certify its product is compatible and runs without defect with versions of supporting systems that are within two major versions and four minor versions (service packages) of the most recent release by the component manufacturer. These supporting systems include, but are not limited to: client and server operating systems, databases, web servers, Java clients, programming languages, third party application components (such as grids, calendars and widgets), reporting tools, etc.

b. Should the CONTRACTOR fail to keep its products current within two major versions and four minor versions of the most recent release by the component manufacturer, the CONTRACTOR will forego maintenance payments by the COUNTY until such time as the CONTRACTOR’s product is compatible.

c. Should the CONTRACTOR lapse in updating its product to be compatible with newer supporting platforms, the CONTRACTOR will reimburse the COUNTY for any necessary costs incurred to keep the supporting systems under maintenance by the component manufacturer after their end-of-life date (e.g., Microsoft Extend Life Support for operating systems).

d. At no time shall the CONTRACTOR allow its system, or components of its system to lapse to a point that security patches are no longer available.

XXV. BACKUPS

All Electronic Systems and their components will be backed up on a Regular Basis and before any work is done on production systems.

The CONTRACTOR shall create a Backup copy of the COUNTY Data at least daily and shall ensure that each such copy is sufficient to enable the COUNTY to restore the services to the state they were in at the time the Backup was taken. In addition, the CONTRACTOR shall retain and securely store each such copy for a minimum period of 90 days, section I.k.

Within the period of 48 hours (section I.k) following receipt of a written request from the COUNTY, the CONTRACTOR shall use all reasonable endeavors to Restore the COUNTY Data stored in any Backup copy created and stored by the CONTRACTOR. The COUNTY acknowledges that this process will overwrite the COUNTY’s data stored on the platform prior to the restoration.

XXVIII. CERTIFICATION

· The CONTRACTOR shall maintain a Federal Risk and Management Program (FEDRAMP) certification.

· If the CONTRACTOR is utilizing any type of credit card or payment card a current certification that the systems meet the most recent version of Payment Card Industry Security Standards (PCI DSS) must also be maintained.

· CONTRACTOR shall send to the COUNTY’s Chief Information Security Officer (CISO) a copy of the current certification prior to any payments under this Agreement, and annually at:

Sacramento County Chief Information Security Officer 799 G Street Sacramento, CA 95814