Sample_IT_Contract_Template.pdfSample_IT_Contract_Template.pdf

Contract # DPS0XXXXX

PH (10/2024) Page 1 of 14

Contractual Agreement Between the

Ohio Department of Public Safety/ Business Unit

And

VENDOR NAME

Address

City ST Zip Phone

This agreement, hereinafter referred to as “Agreement”, is made by and between the Ohio Department of Public Safety / BU, hereinafter referred to as “ODPS”, and VENDOR, hereinafter referred to as “the Independent Contractor”, and is subject to the following terms and conditions.

1. TERM: This Agreement is to be effective from receipt of a purchase order through June 30, 2027. If the term of this Agreement extends beyond a biennium, the Agreement will terminate on the last day of the current biennium. At that time, ODPS may renew this Agreement by addendum to the Independent Contractor no later than July 1, of the new biennium. The operating biennium expires June 30th of each odd-numbered calendar year.

RENEWAL: This Agreement may be renewed upon mutual agreement of both parties and may not exceed twenty-four (24) months, unless ODPS determines that additional renewal is necessary.

2. STATEMENT OF WORK:

A. The Independent Contractor shall undertake the work and activities described in the Scope of Work, labeled Exhibit 1, attached. Exhibits 1 and 2 are made a part of this Agreement and incorporated by reference, as if fully rewritten. The Independent Contractor shall perform the services under this Agreement in a professional, workman-like manner and to the satisfaction of the ODPS. The ODPS shall not hire, supervise, or pay any assistants to the Independent Contractor in its performance under this Agreement.

The ODPS shall not be required to provide any training to the Independent Contractor to enable it to complete work under this Agreement. The Independent Contractor shall furnish its own support staff, materials, tools, equipment, and other supplies necessary to complete the work under this Agreement, unless stated otherwise in ODPS Policy and / or Scope of Work.

Order of Priority: If there is an inconsistency between Exhibit 1 (Scope of Work) and any terms set forth in the body of the Agreement, the latter shall prevail.

B. The Independent Contractor declares that it is engaged as an independent business and shall furnish professional services performed according to applicable commercial standards. Neither the Independent Contractor nor its personnel shall, at any time or for any purpose under this Agreement, be considered as employees or agents of the ODPS or the State of Ohio. The Independent Contractor shall determine the hours required to perform the services to be provided under this Agreement, and retains discretion over its schedule when performing services on the premises of the ODPS, subject to the ODPS’s normal business hours and security requirements.

C. The Independent Contractor agrees to comply with all applicable federal, state, and local laws in performing the work under this Agreement. The Independent Contractor accepts full responsibility for the payment of all taxes, and the ODPS and the State of Ohio shall not be liable for any taxes under this Agreement.

D. The Independent Contractor shall perform the work under this Agreement and may subcontract without the ODPS’s approval for the purchase of articles, supplies, components, or special mechanical services that do not involve the type of work or services which are to be performed by the Independent Contractor under this Agreement, but which are required for the Agreement’s satisfactory completion. The Independent Contractor is responsible for the expense of any and all work subcontracted. Neither this Agreement nor any rights, duties, or obligations described in this Agreement shall be assigned by either party without the prior express written consent of the other party.

SAMPLE

PH (10/2024) Page 2 of 14

3. COMPENSATION:

A. The Independent Contractor will be compensated, not to exceed a total of total dollar amount ($0000.00) for fiscal year 2027 (FY27), for services performed according to this Agreement and the Scope of Work, attached. The State of Ohio is exempt from all state and local taxes and does not agree to pay any taxes.

The ODPS will make payment to the Independent Contractor within thirty (30) days of receipt of an acceptable invoice. O.R.C. Section 126.30 applies to this Agreement and requires payment of interest on overdue payments. The interest rate shall be at the rate per calendar month which equals one-twelfth of the rate per annum prescribed by O.R.C. Section 5703.47.

B. The Independent Contractor will not submit more than one invoice for work performed within a 30-day period. In order to be considered a proper invoice, the Independent Contractor shall include on all invoices the proper vendor identification number, purchase order number, and total cost of services; attest that they are billing only one agency for the identified hours; and submit an original copy monthly to:

DPS Origin A77 Ohio Shared Services

P.O. Box 182880 Columbus, Ohio 43218-2880

Fiscal3@dps.ohio.gov

C. Unless expressly provided for elsewhere in this Agreement, the Independent Contractor shall be responsible for and assume all office and business expenses that are incurred as a result of the performance of this Agreement.

4. AVAILABILITY OF FUNDS: The obligations of the ODPS under this Agreement are subject to the determination by the Director of Budget and Management that sufficient funds have been appropriated by the General Assembly to the ODPS for the purposes of this Agreement and to the certification of the availability of such funds by the Director as required by O.R.C. Section 126.07. The ODPS may suspend or terminate this Agreement if the General Assembly fails to appropriate funds or if federal grant funds are not available for any part of the work under this Agreement.

5. AUDITOR RECOVERY FINDING - O.R.C. Section 9.24: The Independent Contractor affirmatively represents and warrants to the ODPS that the Independent Contractor is not subject to a finding for recovery under O.R.C.

Section 9.24, or that the Independent Contractor has taken the appropriate remedial steps required under O.R.C.

Section 9.24, or otherwise qualifies under that section. The Independent Contractor agrees that if this representation and warranty is false, the Agreement shall be void ab initio as between the parties to this Agreement, and any funds paid by the ODPS hereunder shall be immediately repaid to the ODPS, or an action for recovery may be immediately commenced by the ODPS for recovery of said funds.

6. DEBARMENT: The Independent Contractor warrants that it is not currently subject to a finding by the Ohio Department of Administrative Services debarring the Independent Contractor from consideration for contract awards, and that Independent Contractor does not currently appear on any federal or State of Ohio debarment list. In the event that, during the course of this Agreement, the Independent Contractor is debarred from consideration for the contract awards by the Ohio Department of Administrative Services, or otherwise appears on any federal or State of Ohio debarment list, then the ODPS may terminate this Agreement immediately.

7. WORKERS’ COMPENSATION AND OTHER BENEFITS: The Independent Contractor and its employees shall be covered by workers' compensation coverage purchased and maintained by the Independent Contractor. In addition, the Independent Contractor should ensure that any subcontractors maintain workers' compensation insurance at all times during the term of this Agreement. Any workers' compensation claims filed by the Independent Contractor, or its employees or subcontractors, as a result of work performed under this Agreement is not covered under ODPS's workers' compensation insurance. The Independent Contractor is not entitled to any State employment benefits, including, but not limited to the Public Employees Retirement System of Ohio (OPERS), for work performed under this Agreement. The Independent Contractor acknowledges and agrees any individual providing personal services under this Agreement is not a public employee for purposes of Chapter 145 of the Revised Code.

8. DRUG FREE WORKPLACE: The Independent Contractor certifies that to the best of his / her ability, all of his / her employees will not purchase, transfer, use, or possess illegal drugs or alcohol or abuse prescription drugs in any way while working on state property. Failure to comply may result in IMMEDIATE termination of this

PH (10/2024) Page 3 of 14

Agreement.

9. EQUAL OPPORTUNITY REQUIREMENTS:

A. The Independent Contractor, and any of its subcontractors, shall comply with the requirements under O.R.C. Section 125.111. The Independent Contractor, and any of its subcontractors, shall not discriminate against anyone because of race, color, religion, sex, age, disability, national origin, ancestry, or military status.

B. The Independent Contractor certifies that both the Independent Contractor and any of its subcontractors are in compliance with all applicable federal and state laws, as well as rules and regulations governing fair labor and employment practices.

C. The ODPS encourages both the Independent Contractor and any of its subcontractors to purchase goods and services from certified Minority Business Enterprise (MBE) and Encouraging Diversity Growth and Equity (EDGE) Independent Contractors.

10. CONFLICT OF INTEREST: The Independent Contractor shall not have any interest, direct or indirect, which is incompatible or in conflict with the carrying out of the terms of this Agreement.

11. CAMPAIGN CONTRIBUTIONS: The Independent Contractor hereby certifies that all applicable parties listed in Division (I) or (J) of O.R.C. Section 3517.13 are in full compliance with Divisions (I) and (J) of O.R.C. Section 3517.13.

12. OHIO ETHICS CLAUSE: Independent Contractor agrees to abide by all provisions of the Ohio Ethic’s Law, including O.R.C. 102.02, O.R.C. 102.03, O.R.C. 102.04 and O.R.C. 2921.42.

Pursuant to O.R.C. 102.03(A)(1) no present or former public official or employee shall, during public employment or service or for twelve months thereafter, represent a client or act in a representative capacity for any person on any matter in which the public official or employee personally participated as a public official or employee through decision, approval, recommendation, the rendering of advice, investigation, or other substantial exercise of administrative discretion.

Per O.R.C. 102.04 (D): The Independent Contractor affirms by his / her signature that:

(a) He / She is not elected or appointed to an office of or employed by the General Assembly or any department, division, institution, instrumentality, board, commission, or bureau of the State, excluding the Courts, OR

(b) The Independent Contractor affirms by his / her signature that he / she is a public official appointed to a non-elective office or is a public employee, but, is exempt from the provisions of O.R.C. 102.04

(A) or (B) because,

1. The Independent Contractor is supplying the good and / or services which are subject of the agreement to an agency other than the one with which he / she serves; AND

2. The Independent Contractor has filed the required statements with the following agencies:

a. The appropriate ethics commission; AND

b. The public agency with which he / she serves; AND

c. The public agency to whom the goods and / or services will be provided.

13. OPEN TRADE: Pursuant to O.R.C. 9.76 (B), Vendor warrants that the vendor is not boycotting any jurisdiction with whom the State of Ohio can enjoy open trade, including Israel, and will not do so during the term of this Agreement.

PH (10/2024) Page 4 of 14

14. EXECUTIVE ORDERS 2019-12D AND 2022-02D: The Independent Contractor affirms that it read and understands Executive Order 2019-12D, and agrees to abide by its requirements in the performance of this Agreement. The Independent Contractor agrees not to perform any services required under this Agreement outside of the United States. The Independent Contractor further agrees not to send, take, access, test, maintain, back-up, store, or remotely make available State data outside of the United States unless a duly signed waiver has been obtained from the State.

The Independent Contractor further affirms that it read, understands, and agrees to abide by Executive Order 2022-02D, which prohibits Ohio state agencies from purchasing from or investing in Russian institutions and/or companies. The Independent Contractor thus agrees that it will: a) disclose its principal business location(s) to ODPS during the provision of goods and services under this Agreement; and b) disclose the principal business location(s) of all

Sub-contractors that are providing goods and services (whether directly or indirectly) under the Agreement.

The Independent Contractor agrees to complete the Contractor/Subcontractor Affirmation and Disclosure Form that is attached to this Agreement. If any of the locations disclosed on the Affirmation and Disclosure Form change during the performance of this Agreement, the Independent Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

A. Termination, Sanction, Damages:

If Independent Contractor or any of its subcontractors perform services under this Agreement outside of the United States, or if the Independent Contractor otherwise violates the requirements of Executive Orders 2019-12D or 2022-02D, the performance of such services shall be treated as a material breach of the Agreement. The State is not obligated to pay and shall not pay for such services.

If Independent Contractor or any of its subcontractors perform services under this Agreement outside of the United States, Independent Contractor shall immediately return to the State all funds paid for those services. The State may also recover from the Independent Contractor all costs associated with any corrective action the State may undertake, including but not limited to an audit or a risk analysis, as a result of the Independent Contractor performing services outside the United States.

The State may, at any time after the breach, terminate the Agreement, upon written notice to the Independent Contractor. The State may recover all accounting, administrative, legal and other expenses reasonably necessary for the preparation of the termination of the Agreement and costs associated with the acquisition of substitute services from a third party.

If the State determines that actual and direct damages are uncertain or difficult to ascertain, the State in its sole discretion may recover a payment of liquidated damages in the amount of one percent (1%) of the value of the Agreement.

The State, in its sole discretion, may provide written notice to Independent Contractor of a breach and permit the Independent Contractor to cure the breach. Such cure period shall be no longer than twenty-one

(21) calendar days. During the cure period, the State may buy substitute services from a third party and recover from the Independent Contractor any costs associated with acquiring those substitute services.

Notwithstanding the State permitting a period of time to cure the breach or the Independent Contractor’s cure of the breach, the State does not waive any of its rights and remedies provided the State in this Agreement, including but not limited to recovery of funds paid for services the Independent Contractor performed outside of the United States or in violation of Executive Orders 2019-12D and/or 2022-02D, costs associated with corrective action, or liquidated damages.

B. Assignment / Delegation:

The Independent Contractor will not assign any of its rights, nor delegate any of its duties and responsibilities under this Agreement, without prior written consent of the State. Any assignment or delegation not consented to may be deemed void by the State.

PH (10/2024) Page 5 of 14

15. WORK FOR MULTIPLE STATE AGENCIES: The Independent Contractor attests that they are not a party to a current agreement, nor shall they enter into any other contracts, agreements, or renewals, to perform substantially identical work for the State of Ohio such that the work product contemplated under this contract duplicates the work done or to be done under the other contracts, without the approval of ODPS and the other contracting entity.

16. RESPONSIBILITY FOR CLAIMS: The Independent Contractor agrees to indemnify and hold the ODPS harmless from any and all claims for personal injury or property damage resulting from the fault or negligence of the Independent Contractor and from claims for wages or overtime compensation due its employees in rendering services under this Agreement, including payment of all costs in defense of any claim made under the Fair Labor Standards Act or any other federal or state law. In no event shall either party be liable to the other party for indirect, consequential, incidental, special, or punitive damages, or lost profits.

17. OWNERSHIP:

A. Any and all written, electronic, or multimedia documents, presentations, reports, studies, deliverables, and / or software developed under this Agreement (hereinafter referred to under this Section as “Deliverables”) shall become the property of the ODPS. The ODPS, and any person, agency, or instrumentality providing financial assistance for the work performed under this Agreement shall have an unrestricted right to reproduce, distribute, modify, maintain, and use the Deliverables. The Independent Contractor shall not obtain copyright, patent, or other proprietary protection for the Deliverables without the written approval of the ODPS, except that the Independent Contractor shall reserve its rights in all methods, pre-existing work, software, and data used to prepare the Deliverables. The Independent Contractor shall not include in any Deliverables any copyrighted matter, unless the copyright owner and any person, agency, or instrumentality providing financial assistance for the work performed under this Agreement gives prior written approval to use such copyrighted matter in the manner provided under this Agreement. The Independent Contractor must identify in writing, prior to the start of work under this Agreement, any and all proprietary, copyrighted, and / or patented materials it intends to use.

B. The Independent Contractor agrees that all Deliverables may be made freely available to the general public to the extent required by law.

C. This Section shall survive the termination of this Agreement and may be enforced by the ODPS in any court of competent jurisdiction.

18. GOVERNING CLAUSE: This Agreement and any claims arising out of this Agreement shall be governed by the laws of the State of Ohio. If any provision under this Agreement is later determined to be invalid or unenforceable, the remainder of this Agreement shall not be affected by such determination.

19. SUSPENSION AND TERMINATION:

A. The Independent Contractor or the ODPS may suspend or terminate this Agreement, with or without cause, by providing thirty (30) days written notice to the other party.

B. Any violations or breach of the terms stated herein, by the Independent Contractor, shall provide the ODPS with the option of canceling this Agreement in its entirety, or withholding payment until such time as the violation or breach is remedied. Such option shall in no way limit or exclude any other remedies available to the ODPS.

C. If either party fails to perform any of the requirements of this Agreement, or is in violation of a specific provision of this Agreement, then the non-breaching party may suspend or terminate this Agreement if the breaching party fails to cure its non- performance or violation within ten (10) business days following delivery of written notice of the breach. In the case of late payment by ODPS, however, the Independent Contractor may not suspend or terminate this Agreement unless the payment is more than sixty (60) days past due, and O.R.C. Section 126.30 shall apply.

D. If this Agreement is suspended or terminated, the Independent Contractor shall cease work on the suspended or terminated activities, suspend or terminate all subcontractors relating to the suspended or terminated activities, take all necessary or appropriate steps to limit disbursement and minimize cost, and, if requested by the ODPS, furnish a report describing the status of all work under this Agreement, including results and conclusions accomplished, and such other matters as the ODPS may require. The requirements in this paragraph shall occur in accordance with the following:

PH (10/2024) Page 6 of 14

1. If the Agreement is suspended or terminated by the ODPS, the requirements in Paragraph

19. D. of this Agreement shall commence upon the date the Independent Contractor receives notice of suspension or termination.

2. If the Agreement is suspended or terminated by the Independent Contractor, the requirements in Paragraph 19. D. of this Agreement shall commence upon the date the Independent Contractor sends notice of suspension or termination.

E. If this Agreement is suspended or terminated, the Independent Contractor, upon submission of a proper invoice, shall be entitled to compensation which shall be calculated by the ODPS according to Paragraph 3 of this Agreement for the work performed prior to the date on which the Independent Contractor either receives notice of termination or suspension or sends notice of suspension or termination, whichever is applicable, less any funds previously paid by, or on behalf of, the ODPS.

Regardless of which party terminates the Agreement, any payments made by the ODPS in which services have not been rendered by the Independent Contractor shall be prorated and returned to the ODPS. Such payment(s) must be sent to the ODPS within thirty (30) days of the date on which the Independent Contractor either receives notice of termination or suspension or sends notice of suspension or termination, whichever is applicable. The ODPS shall not be liable for any further claims.

20. ACKNOWLEDGEMENT AND NON-DISCLOSURE AGREEMENT: Independent Contractor agrees to have each individual to perform work under this Agreement sign the Contractor Acknowledgement and Non- Disclosure Agreement, before that individual begins such work.

21. ENFORCEMENT OF RIGHTS: The failure of ODPS to act with respect to a breach of this Agreement by

Independent Contractor or others does not constitute a waiver and shall not limit ODPS’ rights with respect to such breach or any subsequent breaches.

22. BACKGROUND CHECK: A routine background check, at ODPS expense, may be performed on the

Independent Contractor for assignment to this Agreement. The Independent Contractor may be required to complete a “Background Information Form” furnished by the ODPS. Failure to pass the background check will result in immediate dismissal.

23. ANTITRUST ASSIGNMENT: The Independent Contractor assigns to the ODPS all State and Federal antitrust claims and causes of action that relate to all goods and services provided for in this Agreement. Additionally, the State of Ohio will not pay excess charges resulting from antitrust violations by the Independent Contractor’s suppliers and subcontractors.

24. RECORD KEEPING: During the performance of this Agreement and for a period of three (3) years after its completion, the Independent Contractor shall maintain auditable records of all charges pertaining to this Agreement and shall make such records available to the ODPS, upon request and at such times as are commercially reasonable.

25. FORCE MAJEURE: If the State or Independent Contractor is unable to perform any part of its obligations under this Agreement by reason of force majeure, the party will be excused from its obligations, to the extent that its performance is prevented by force majeure, for the duration of the event. The party must remedy with all reasonable dispatch the cause preventing it from carrying out its obligations under this Agreement. The term “force majeure” means without limitation: acts of God, such as epidemics, lightning, earthquakes, fires, storms, hurricanes, tornadoes, floods, washouts, droughts, any other severe weather, or explosions; restraint of government and people; war; strikes; and other like events or any other cause that could be not reasonably foreseen in the exercise of ordinary care, and that is beyond the reasonable control of the party.

26. CONFIDENTIALITY: Independent Contractor understands and acknowledges that ODPS is a government agency of the State of Ohio and as such is subject to Ohio Public Records law. Independent Contractor understands and agrees that in the event that any provision included in Independent Contractor’s offer or quote, or any other provisions applicable or incorporated into this Agreement conflict with the Ohio Public Records law, Ohio Public Records law will govern and this agreement will have no effect.

PH (10/2024) Page 7 of 14

27. CHANGE OR MODIFICATION: This Agreement constitutes the entire agreement between the parties on the subject matter of this Agreement. This Agreement supersedes all prior agreements, understandings, or representations, whether oral or written, concerning the subject matter of this Agreement. Any changes or modifications of this Agreement shall be made and agreed to in writing and signed by the ODPS Director. The provisions outlined in these Terms and Conditions shall take priority over any inconsistent or conflicting provisions included in the Independent Contractor’s offer or quote, or any other provisions applicable to or incorporated into this Agreement.

28. CONTRACTORS PAID WITH FEDERAL FUNDS BY NON-FEDERAL ENTITY: If the Contractor will be paid

(whether in whole or in part) by ODPS with federal funds, the Contractor hereby affirms that it read, fully understands, and agrees to comply with all of the provisions set forth in the attached “Addendum for Contractors Paid with Federal Funds,” which is hereby incorporated by reference. In addition, such Contractor agrees to complete and return the 44 C.F.R. Part 18 - “Certification Regarding Lobbying” that is included in the Addendum.

29. DATA SECURITY AND PRIVACY: Contractor agrees to comply, and assume responsibility for compliance by its officers, employees, subcontractors, and agents, with the requirements set forth in the “Data Security and Privacy Terms,” which are labeled as Exhibit #2 and both attached to and incorporated into the Agreement by reference.

Contractor must obtain at its own expense an independent, third-party audit of its security controls as well as all operations pertaining to the services covered by this Contract. Such audit must meet the requirements of Section III.C (“Independent Third-Party Audit”) of the Data Security and Privacy Terms and must be conducted at least biennially for the duration of the contract. In addition, the results of the audit must be sent to the following email address within thirty (30) days of the Contractor’s receipt of the results: Compliance@das.ohio.gov.

If contracted services involve credit card processing, PCI Service Level One certification from a PCI Counsel certified independent assessor must be provided.

IN WITNESS THEREOF the parties have executed this Agreement as of the day and year first written below.

Independent Contractor’s Signature Benjamin B. Suver, Director VENDOR Ohio Department of Public Safety

Printed Name

Date: Date:

mailto:Compliance@das.ohio.gov

PH (10/2024) Page 8 of 14

STANDARD AFFIRMATION AND DISCLOSURE FORM

EXECUTIVE ORDERS 2019-12D AND 2022-02D

State of Ohio's Response to Russia's Unjust War on the Country of Ukraine

AFFIRMATION AND DISCLOSURE FORM

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

The Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate "Not Applicable" in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

PH (10/2024) Page 9 of 14

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Contractor also affirms, understands and agrees that Contractor and its subcontractors are under a duty to disclose to the State any change or shift in location of services performed by Contractor or its subcontractors before, during and after execution of any contract with the State. Contractor agrees it shall so notify the State immediately of any such change or shift in location of its services.

The State has the right to immediately terminate the contract, unless a duly signed waiver from the State has been attained by the Contractor to perform the services outside the United States.

On behalf of the Contractor, I acknowledge that I am duly authorized to execute this Affirmation and Disclosure Form and have read and understand that this form is a part of any Contract that Contractor may enter into with the State and is incorporated therein.

Independent Contractor’s Signature

Printed Name

Date:

PH (10/2024) Page 10 of 14

Exhibit 1

Scope of Work

PH (10/2024) Page 11 of 14

Exhibit 2

Data Security and Privacy Terms

The below Data Security and Privacy Terms (the Terms) set forth the standards and responsibilities of the Contractor to maintain the confidentiality, integrity, and availability of data when providing services to the State of Ohio (State).

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

I. Definitions

1. Contract means the contract entered into between the Contractor and the State to which these Terms are attached and/or incorporated.

2. Contract Data means State Data to which the Contractor has access, transmits, processes, possesses, creates or stores in providing services to the State. Contract Data may include Confidential Data.

3. Contractor means the person or entity with whom the State has entered into the Contract and, for purposes of these Terms, includes employees, subcontractors, agents or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

4. Confidential Data means any type of data that is required to be protected by law or regulation, is intended for confidential use, or may not be copied or removed from the State’s operational control without authorized permission. Confidential Data includes Personal Information as defined in Ohio Revised Code 1347.01 that is required to be protected as confidential by law or regulation. Confidential Data also includes data that, if compromised, may result in loss of life, serious injury, or other harm to an individual or group, or disruption to critical agency operations.

5. Security Incident means a confirmed, successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system involving Contract Data, either by Contractor personnel and/or within the Contractor’s administratively controlled environment(s).

6. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including Contract Data and Confidential Data.

II. Requirements

A. Information Security Program

The Contractor must maintain a reasonable information security program consisting of policies, procedures, tools, and personnel designed to maintain the confidentiality, integrity, and availability of data and of services provided to the State. The Contractor’s information security program must reasonably align to the current version of one or more of the following industry-recognized cybersecurity frameworks, as applicable to the work under the Contract:

1. National Institute of Standards (NIST) Special Publication 800-53 (NIST 800-53);

2. NIST 800-171

3. NIST Cybersecurity Framework (NIST CSF);

4. International Organization for Standardization 27001 (ISO27001);

5. Center for Information Security (CIS) Critical Security Controls;

6. Health Information Trust Alliance (HiTRUST);

7. Cybersecurity Maturity Model Certification (CMMC);

8. Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM); and/or

9. Payment Card Industry Data Security Standard (PCI-DSS).

PH (10/2024) Page 12 of 14

B. Background Investigations of Contractor Personnel

Prior to any individual doing any of the following, the Contractor must validate and confirm the identity of the individual by initiating and receiving a Federal Bureau of Investigation (FBI) national fingerprint-based background check:

1. Working onsite at a State-owned, leased, or managed location;

2. Remotely accessing an internal State information system; or

3. Accessing Confidential Data, and at the Contractor’s expense.

If an FBI national fingerprint-based background check cannot be initiated (i.e., an FBI Background Check Reason Code1 is not available), then the Contractor must initiate and receive an Ohio Bureau of Criminal Investigation fingerprint-based background check or the individual’s state of residence equivalent, where permitted by law. For the duration of the Contract, the Contractor must ensure all of the following for each individual performing work under the Contract:

1. The individual is eligible to perform work in the United States;

2. The individual is physically located in the United States while performing work on the Contract unless a waiver of this requirement is received from the State pursuant to the Contract;

3. The individual is not currently charged with, in a diversion program for, or convicted of any of the following:

a. felony;

b. crime of violence; or

c. offense involving fraud, theft, or dishonesty;

4. The individual is not designated as a Specially Designated National by the Office of Foreign Asset Control (OFAC); and

5. The individual is not suspected of working for a foreign government or criminal organization.

The State reserves the right to conduct investigations of any individual working onsite at a State owned, leased, or managed location or remotely accessing a State information system or Confidential Data. Such investigation may include fingerprinting; criminal, tax, and driving record checks; drug testing; licensing and credential checks;

and/or employment history verification. Access to any of the aforementioned locations, information systems, or data may be denied at any time if, in its sole discretion, the State determines it would be in its best interests.

If any individual who intends to perform work does not initially meet or if at any point during the performance of work, does not meet, the requirements detailed in this section, the Contractor must either not permit those individuals to begin to perform the work under the Contract or must terminate the individual’s performance of the work under the Contract immediately, as applicable.

C. Security Incidents

The Contractor is responsible for Security Incidents that occur during the performance of the work under the Contract, including the detection of, response to, and recovery from Security Incidents to minimize the impact to the State.

The Contractor must report to the State in writing within 48 hours of the Contractor becoming aware of a Security Incident and must reasonably cooperate with the State to mitigate the impact to the State of the Security Incident.

The Contractor must work with the State at the beginning of each engagement to establish Security Incident reporting procedures. If no procedure is established, the Contractor must report Security Incidents to the State via email at CSC@ohio.gov and/or by calling 877-644-6860.

Within five business days after an initial Security Incident report to the State, the Contractor must begin providing follow-up reports of the Security Incident to the State containing pertinent information about the scope, data elements, indicators of compromise, threat actors, and remediation efforts, as available.

The Contractor must preserve sufficient evidence about the Security Incident to:

1 FBI Reason Fingerprint Codes available at: Publications for BCI and Background Checks - Ohio Attorney General Dave Yost

SAMPLE

mailto:CSC@ohio.gov https://www.ohioattorneygeneral.gov/Files/Publications-Files/Background-Check-Publications/ https://www.ohioattorneygeneral.gov/Files/Publications-Files/Background-Check-Publications/

PH (10/2024) Page 13 of 14

1. Ensure the Security Incident records are accurate,

2. Facilitate an investigation into the Security Incident, and

3. Determine the extent of the Security Incident.

The Contractor is responsible for all associated costs of the Security Incident, including notification to impacted individuals and applicable credit monitoring for those impacted individuals.

The Contractor must comply with all applicable laws that require the notification of individuals, or with other reasonable direction of the State for notification when Confidential Data is involved.

The State reserves the right to conduct an independent investigation of the Security Incident, and the Contractor must reasonably cooperate with the investigation. The independent investigation may be conducted by a State agency or a third-party acting on behalf of the State.

D. Privacy

The Contractor must publish a privacy policy that includes the Contractor’s procedure for responding to requests to access, correct, or delete Confidential Data.

E. Generative Artificial Intelligence

The Contractor must disclose the use of generative artificial intelligence (AI) to the State when producing work that will be owned by the State or the integration of generative AI in products, services, or solutions used by the State. The Contractor will reasonably cooperate in the State’s review of the generative AI solution by responding to associated requests. The Contractor must not utilize Confidential Data in training generative AI models except as specifically approved by the State.

F. Data Return or Destruction

Upon completion of the work under the Contract or upon termination or expiration of the Contract, the Contractor must promptly destroy or return to the State, in a format designated by the State, all Contract Data received from or through the State. Notwithstanding the foregoing, the Contractor may keep a copy of the Contract Data to comply with contractual, legal, or record keeping obligations, and any such retained Contract Data is subject to the requirements of this Contract for so long as the Contractor has the Contract Data in its possession.

III. Requirements for Contractor or Cloud Hosted Solutions

A. Data Hosting

All Contract Data must be hosted within the contiguous United States at a minimum of two data center facilities at two different and distant geographic locations, in high-availability configurations. The Contractor must ensure appropriate physical and environmental controls are implemented to maintain the confidentiality, integrity, and availability of Contract Data.

B. Data Security C.

All Contract Data in Contractor’s possession must be encrypted at rest and during transit using industry standard validated encryption methods that meet or exceed the requirements set forth by NIST Federal Information Processing Standards (FIPS) 140-2.

The Contractor may not sell, rent, lease, or disclose any Contract Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

Prior to promoting or releasing source code into production, the Contractor must utilize industry best practices to scan source code for vulnerabilities and remediate vulnerabilities using a risk-informed approach at no cost to the State.

PH (10/2024) Page 14 of 14

C. Independent Third-Party Audit

The Contractor must obtain, at its expense, an independent third-party audit of its security controls in place for the hosted solution, product, or service. This audit must be conducted at least biennially for the duration of the Contract, renewed as required, and be one of the following audit types:

1. Federal Risk and Authorization Management Program (FedRAMP);

2. GovRAMP;

3. Service Organization Control (SOC 2) Type II;

4. ISO 27007;

5. HiTRUST;

6. CSA STAR Level 2 or Level 3; or

7. CMMC Level 2 or Level 3.

The Contractor, at its sole expense, must address material issues and weaknesses identified in each audit as they pertain to the services provided under this Contract.

The results of the audits must be provided to the State at Compliance@das.ohio.gov within 30 days of the Contractor’s receipt of its audit results. The results of the audit provided to the State are considered Confidential Information under the Contract.

When required by law, rule, or regulation, or if the Contractor fails to obtain the required audit or obtains an adverse opinion on an independent third-party audit, the State may perform an information security audit of the hosted solution at its own expense. The State will provide a 30-day written notice prior to beginning the audit and the audit will take place during the Contractor’s normal business hours. Before beginning the audit, the State and Contractor will reasonably agree on the scope, duration, and other parameters of the audit. The State reserves the right to utilize a third-party contractor to perform the audit subject to reasonable approval by the Contractor.

SAMPLE

mailto:Compliance@das.ohio.gov