Sample IT Contract Provisions Exhibit (1019).pdf

Exhibit XXX Page 1 of 6

EXHIBIT C, INFORMATION TECHNOLOGY PROVISIONS

This Exhibit regarding Information Technology Provisions (the “Exhibit”) is an essential part of the agreement between the State and Contractor as described in the Contract to which this Exhibit is attached. Unless the context clearly requires a distinction between the Contract and this Exhibit, all references to “Contract” shall include this Exhibit.

1. PROTECTION OF SYSTEM DATA

A. In addition to the requirements of the main body of this Contract, if Contractor or any

Subcontractor is given access to State Information Technology resources or State Records by the State or its agents in connection with Contractor’s performance under the Contract, Contractor shall protect such Information Technology resources and State Records in accordance with this Exhibit. All provisions of this Exhibit that refer to Contractor shall apply equally to any Subcontractor performing work in connection with the Contract.

B. The terms of this Exhibit shall apply to the extent that Contractor’s obligations under this Contract include the provision of Information Technology goods or services to the State.

Information Technology is computer-based equipment and related services designed for the storage, manipulation, and retrieval of data, and includes, without limitation:

i. Any technology, equipment, or related services described in §24-37.5-102(2), C.R.S.;

ii. The creation, use, processing, disclosure, transmission, or disposal of State Records, including any data or code, in electronic form; and

iii. Other existing or emerging technology, equipment, or related services that may require knowledge and expertise in Information Technology.

C. Contractor shall, and shall cause its Subcontractors to meet all of the following:

i. Provide physical and logical protection for all hardware, software, applications, and data that meets or exceeds industry standards and the requirements of this Contract.

ii. Maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), annual security testing, and improvements or enhancements consistent with evolving industry standards.

iii. Comply with State and federal rules and regulations related to overall security, privacy, confidentiality, integrity, availability, and auditing.

iv. Provide that security is not compromised by unauthorized access to workspaces, computers, networks, software, databases, or other physical or electronic environments.

v. Promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the State’s Office of Information Security (“OIS”).

vi. Comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology (“OIT”), including change

Exhibit XXX Page 2 of 6 management, project lifecycle methodology and governance, technical standards, documentation, and other requirements posted at www.oit.state.co.us/about/policies.

D. Subject to Contractor’s reasonable access security requirements and upon reasonable prior notice, Contractor shall provide the State with scheduled access for the purpose of inspecting and monitoring access and use of State Records, maintaining State systems, and evaluating physical and logical security control effectiveness.

E. Contractor shall perform current background checks in a form reasonably acceptable to the State on all of its respective employees and agents performing services or having access to State Records provided under this Contract, including any Subcontractors or the employees of Subcontractors. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to State Records shall be deemed to be current.

i. Upon request, Contractor shall provide notice to a designated representative for the State indicating that background checks have been performed. Such notice will inform the State of any action taken in response to such background checks, including any decisions not to take action in response to negative information revealed by a background check.

ii. If Contractor will have access to Federal Tax Information under the Contract, Contractor shall agree to the State’s requirements regarding Safeguarding Requirements for Federal Tax Information and shall comply with the background check requirements defined in IRS Publication 1075 and §24-50- 1002, C.R.S.

2. DATA HANDLING

A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS.

B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request.

C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data.

i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system

Exhibit XXX Page 3 of 6 schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format.

ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor.

D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time.

Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

3. DELIVERY AND ACCEPTANCE

A. Contractor shall provide and maintain a quality assurance system acceptable to the State for any Work or Deliverables under this Contract and shall provide to the State only such Work or Deliverables that have been inspected and found to conform to the specifications identified in this Contract and any applicable solicitation, bid, offer, or proposal from which this Contract results.

B. Contractor’s delivery of any Work or Deliverables to the State shall constitute certification that such Work or Deliverable has been determined to conform to the applicable specifications, and Contractor shall make records of such quality assurance available to the State upon request during the term of the Contract or at any time within three years following expiration or termination of the Contract.

C. For any Work or Deliverables other than the purchase or license of commercially available goods or software, acceptance of the Work or Deliverable shall require affirmative written communication from the State to the Contractor that such Work or Deliverable has been accepted by the State. Such communication shall be provided within a reasonable time period from the delivery of the Work or Deliverable and shall not be unreasonably delayed or withheld. Acceptance by the State shall be final, except in cases of Contractor’s failure to conduct proper quality assurance, latent defects that could not reasonably have been detected upon delivery, or Contractor’s gross negligence or willful misconduct.

4. WARRANTY

A. Notwithstanding the acceptance of any Work or Deliverable, or the payment of any invoice for such Work or Deliverable, Contractor warrants that any Work or Deliverable provided by Contractor under this Contract shall be free from material defects and shall function in material accordance with the applicable specifications. Contractor warrants that any Work or Deliverable shall be, at the time of delivery, free from any harmful or

Exhibit XXX Page 4 of 6 malicious code, including without limitation viruses, malware, spyware, ransomware, or other similar function designed to interfere with or damage the normal operation of Information Technology resources. Contractor’s warranties under this section shall apply to any defects or material nonconformities discovered within 180 days following delivery of any Work or Deliverable.

B. Upon notice during the warranty term of any defect or material nonconformity, Contractor shall submit to the State in writing within 10 business days of the notice one or more recommendations for corrective action with sufficient documentation for the State to ascertain the feasibility, risks, and impacts of each recommendation. The State’s remedy for such defect or material non-conformity shall be:

i. Contractor shall re-perform, repair, or replace such Work or Deliverable in accordance with any recommendation chosen by the State. Contractor shall deliver, at no additional cost to the State, all documentation required under the Contract as applicable to the corrected Work or Deliverable; or

ii. Contractor shall refund to the State all amounts paid for such Work or Deliverable, as well as pay to the State any additional amounts reasonably necessary for the State to procure alternative goods or services of substantially equivalent capability, function, and performance.

C. Any Work or Deliverable delivered to the State as a remedy under this section shall be subject to the same quality assurance, acceptance, and warranty requirements as the original Work or Deliverable. The duration of the warranty for any replacement or corrected Work or Deliverable shall run from the date of the corrected or replacement Work or Deliverable.

5. COMPLIANCE

A. In addition to the compliance obligations imposed by the main body of the Contract, Contractor shall comply with:

i. All Colorado Office of Information Security (OIS) policies and procedures which

OIS has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501- 5 and posted at http://oit.state.co.us/ois

ii. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any specifically incorporated industry standards or guidelines, as applicable based on the classification of the data relevant to Contractor’s performance under the Contract. Such obligations may arise from:

a. Health Information Portability and Accountability Act (HIPAA)

b. IRS Publication 1075

c. Payment Card Industry Data Security Standard (PCI-DSS)

d. FBI Criminal Justice Information Service Security Addendum

e. CMS Minimum Acceptable Risk Standards for Exchanges

f. Electronic Information Exchange Security Requirements and Procedures

For State and Local Agencies Exchanging Electronic Information With

Exhibit XXX Page 5 of 6

The Social Security Administration

iii. Contractor shall comply with and adhere to Section 508 of the U.S. Rehabilitation

Act of 1973, as amended, and §§24-85-101, et seq., C.R.S. Contractor shall comply with all State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the Web Content Accessibility Guidelines (WCAG), incorporated in the State of Colorado technology standards and available at https://www.w3.org/TR/WCAG21/.

B. Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor’s performance under the Contract.

C. Contractor shall allow the State reasonable access and shall provide the State with information reasonably required to assess Contractor’s compliance. Such access and information shall include:

i. An annual SOC2 Type II audit including, at a minimum, the Trust Principles of

Security, Confidentiality, and Availability, or an alternative audit recommended by OIS; or

ii. The performance of security audit and penetration tests, as requested by OIS.

D. To the extent Contractor controls or maintains information systems used in connection with State Records, Contractor will provide OIS with the results of all security assessment activities when conducted on such information systems, including any code-level vulnerability scans, application level risk assessments, and other security assessment activities as required by this Contract or reasonably requested by OIS. Contractor will make reasonable efforts to remediate any vulnerabilities or will request a security exception from the State. The State will work with Contractor and OIS to prepare any requests for exceptions from the security requirements described in this Contract and its Exhibits, including mitigating controls and other factors, and OIS will consider such requests in accordance with their policies and procedures referenced herein.

6. TRANSITION OF SERVICES

Upon request by the State prior to expiration or earlier termination of this Contract or any Services provided in this Contract, Contractor shall provide reasonable and necessary assistance to accomplish a complete transition of the Services from Contractor to the State or any replacement provider designated solely by the State without any interruption of or adverse impact on the Services. Contractor shall cooperate fully with the State or any successor provider and shall promptly take all steps required to assist in effecting a complete transition of the Services designated by the State. All services related to such transition shall be performed at no additional cost beyond what would be paid for the Services in this Contract.

7. LICENSE OR USE AUDIT RIGHTS

A. To the extent that Contractor, through this Contract or otherwise as related to the subject matter of this Contract, has granted to the State any license or otherwise limited permission to use any Contractor Property, the terms of this section shall apply.

B. Contractor shall have the right, at any time during and throughout the Contract Term, but

Exhibit XXX Page 6 of 6 not more than once per Fiscal Year, to request via written notice in accordance with the notice provisions of the Contract that the State audit its use of and certify as to its compliance with any applicable license or use restrictions and limitations contained in this Contract (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Contractor (“Audit Certification”) within 120 days following the State’s receipt of the Audit Request.

C. If upon receipt of the State’s Audit Certification, the Parties reasonably determine that:

(i) the State’s use of licenses, use of software, use of programs, or any other use during the audit period exceeded the use restrictions and limitations contained in this Contract (“Overuse”) and (ii) the State would have been or is then required to purchase additional maintenance and/or services (“Maintenance”), Contractor shall provide written notice to the State in accordance with the notice provisions of the Contract identifying any Overuse or required Maintenance and request that the State bring its use into compliance with such use restrictions and limitations.