Schedule Z Forms for Access to State Inventory System.pdf

Mi ch i ga n .gov/Mi P rocu re me n t

SCHEDULE Z – FORMS FOR ACCESS TO STATE INVENTORY

SYSTEM

(Forms begin on the next page)

BACKGROUND CHECK REQUEST

Michigan Department of Technology, Management and Budget

DTMB-0021 Revised 8/9/2018 The following information is requested in order to perform a Law Enforcement Information Network (LEIN) (name based) background check. This information will be kept CONFIDENTIAL.

Please complete the following information – type or print clearly.

SECTION 1. APPLICANT INFORMATION FOR BACKGROUND CHECK

1. Full Legal Name (First Middle Last)

2. Other Names (Maiden Name, etc.)

3. Date of Birth (MM/DD/YYYY)

4. Gender

5. Ethnicity American Indian/Alaska Native Asian

Black Hispanic/Latino

Native Hawaiian/Pacific Islander White

Other Two or More Races

6. Have you ever been convicted of a felony?

No Yes

I have verified that all information is true and accurate.

I have read the above information and authorize a background check be completed.

Furthermore, I authorize the release of the results of the background check to Human Resources.

Applicant Signature Printed Name Date

SECTION 2. EMPLOYMENT INFORMATION

1. This request is for a

State Employee Contractor Company Name of Contractor

2. DTMB Office / Division of Prospective Employee/Contractor

3. Work Area Contact Name

4. Work Area Contact Phone Number

5. Authorized Requester Name

6. Authorized Requester Office / Division

7. Authorized Requester Email

8. Authorized Requester Phone Number

SECTION 3. AUTHORIZATION

Authorized Requester Signature Printed Name Date

DISTRIBUTION: • Applicant Personnel File

CONTRACTOR SECURITY AGREEMENT

Michigan Department of Technology, Management and Budget

DTMB-0928 Revised 7/19/2019

SECTION 1. CONTRACTOR INFORMATION

1. Contractor Name

SECTION 2. SECURITY AGREEMENT

As a user of services provided by the Department of Technology, Management & Budget, I accept and agree to:

1. Comply with the State of Michigan Computer Crime Law and to use State of Michigan's systems to perform my job function to the exclusion of all other uses. (Public Act 53 of 1979)1

2. Not copy or infringe upon the rights granted to the owner of a product with a Copyright or Patent.

3. Comply with the Michigan Civil Service Commission Rules governing Conflict of Interest. (Rule

2-8)2

4. Keep confidential all computers and network system access codes issued to me.

5. Report to the appropriate supervisor or the Office of Cybersecurity and Infrastructure Protection

(CIP) immediately any suspected threat to or violation of State of Michigan system security.

6. Report to the appropriate supervisor or the Office of Infrastructure Protection (OIP), the loss or theft of any key or facility access card which was supplied to me, which allows access to any State of Michigan facility.

7. Not loan or transfer to anyone else the facility access card, which was supplied to me, for access to any State of Michigan facility.

8. Comply with State of Michigan Information Technology Information Security Policy 1340.00 and the Acceptable Use of Information Technology Standard 1340.00.130.02.3

9. Comply with federal laws regarding confidentiality to protect an individual’s rights and privacy.

10. Not leave my workstation unattended without either being logged off or invoking a hotkey password supported screen saver.

11. Comply with HIPAA Confidentiality requirements. To ensure that privacy rights of enrollees are respected, you are required to only use any protected health information you access for the purpose of ensuring proper plan operation and administration. You also are prohibited from disclosing any protected health information to any outside party without written authorization of the Privacy Official of the Employee Benefits Division of the Michigan Department of Civil Service or the Privacy Official's designee.

SECTION 3. AGREEMENT SIGNATURE

Contractor Signature Printed Name Date

AUTHORITY: 1 Public Act 53 of 1979 (http://legislature.mi.gov/doc.aspx?mcl-act-53-of-1979) References 2 Michigan Civil Service Commission Rules (http://www.michigan.gov/documents/mdcs/Michigan_Civil_Service_

Commission_Rules_347183_7.pdf), 2-8 Ethical Standards and Conduct 3 IT Policies, Standards and Procedures (https://stateofmichigan.sharepoint.com/teams/insidemi/Pages/

For%20Your%20Job/In%20the%20Office/IT_PSP.aspx), 1340.00 Information Technology Security Policy and

1340.00.130.02 Acceptable Use of Information Technology Standard.

DISTRIBUTION: • Authorized Requestor

• Copy to Employee http://legislature.mi.gov/doc.aspx?mcl-act-53-of-1979 http://www.michigan.gov/documents/mdcs/Michigan_Civil_Service_Commission_Rules_347183_7.pdf https://stateofmichigan.sharepoint.com/teams/insidemi/Pages/For%20Your%20Job/In%20the%20Office/IT_PSP.aspx

FOREIGN DEVICE NETWORK CONNECTION REQUEST

Michigan Department of Technology, Management and Budget

DTMB-0155 Revised 2/1/2018 Connection Action Requested

Creation Removal (If checked, complete only Sections 1 and 7)

SECTION 1. EMPLOYEE INFORMATION

1. Last Name

2. First Name

3. M.I.

4. Email Address

5. Work Telephone

6. Sponsoring Agency / Office / Division / Section / Unit

7. Work Location Street Address

8. City

9. State

10. Zip Code

11. SOM TCP/IP Network Address this Device will Connect to

SECTION 2. EMPLOYER

1. Employment Type (check one)

State Employee Contractor (Must have signed DTMB-0928 on file)

2. Assigned Agency

3. Company Name

4. Company Telephone

SECTION 3. EQUIPMENT DESCRIPTION

1. Equipment type (check one)

Laptop

PC

Smartphone

2. Equipment Manufacturer

3. Serial Number

4. Device model or description

SECTION 4. CURRENT SECURITY LEVELS

1. Anti-virus Software Package and Update Process

2. Operating System / Patch Level & Update Process

3. Personal Firewall Type

4. Security Level Review Date

5. Reviewer Name

6. Reviewer Telephone

7. Encryption Software

SECTION 5. LIABILITY ACCEPTANCE

Liability Accepting Agent Signature Printed Name Date

1. State Contract Number

2. Contract Liability Section Number

SECTION 6. AGENCY APPROVAL

1. Usage Begin Date

2. Usage End Date

Authorized Agency Approver Signature Printed Name Date

Continued on back

SECTION 7. DTMB SECURITY REVIEW

Authorized DTMB Service Requestor Signature Printed Name Date

1. Remedy Case Number

2. Static IP Address Assigned

Note: Include a copy of this completed form or all of this information in the Remedy Ticket Remedy routing to follow this order:

• MCS for approval • I&O Design/Delivery for IP address • Field Services for auditing The State of Michigan will not assume any responsibility or liability for a foreign device

MICHIGAN CYBER SECURITY VENDOR SECURID QUESTIONS

FOR COMPLETING THE DTMB-0051 REMOTE ACCESS SERVICE REQUEST

Michigan Department of Technology, Management and Budget Revised 11/27/2018

SECTION 1. GENERAL INFORMATION

1. Vendor/Contractor Name

2. Vendor Company Name

3. Sponsoring Agency

4. Preparation Date

SECTION 2. INFORMATION NEEDED

1. Will the vendor employee be working as “staff augmentation”?

Yes No

2. How many hours per week does the vendor employee work in support of state of Michigan (SOM)?

3. Is there a current contract between the vendor and SOM?

Yes No If yes, Vendor Company Name:

If yes, contract Begin Date:

Contract End Date:

4. Will the vendor employee be using a SOM computer?

Yes No If no, who does the computer belong to?

5. How many hours per week does the vendor employee work in a SOM owned or leased building?

6. Has the vendor employee completed a SOM background check within the last year?

Yes No If yes, date of background check?

If yes, were the results acceptable?

7. What was the starting date for the vendor employee?

8. What is the vendor employee’s SOM email address?

9. Please provide the Remedy CRQ number for each SOMSAVPN request.

10. Does the vendor employee currently belong to an existing VPN group?

Yes No If yes, please provide the name of the group

11. Has the vendor employee completed the following applicable security forms? (all forms may not be necessary) Yes No

a. DTMB-0021 DTMB Background Check Request (http://inside.michigan.gov/dtmb/wr/Forms/Background Check Request.dot)

b. DTMB-0049 Non-Disclosure Agreement (http://inside.michigan.gov/dtmb/wr/Forms/Non-Disclosure%20Agreement.docx)

c. DTMB-0927 Physical Security Access Request (http://inside.michigan.gov/dtmb/wr/Forms/Physical%20Security%20Access%20Request.docx) (may not be necessary)

d. DTMB-0155 Foreign Device Network Connection Request (http://inside.michigan.gov/dtmb/wr/Forms/Foreign Device Network Connection Request.dot) (not required if vendor employee is using a SOM computing device)

e. DTMB-0928 Contractor Security Agreement (http://inside.michigan.gov/dtmb/wr/Forms/Contractor Security Agreement.dot http://inside.michigan.gov/dtmb/wr/Forms/Background%20Check%20Request.dot http://inside.michigan.gov/dtmb/wr/Forms/Non-Disclosure%20Agreement.docx http://inside.michigan.gov/dtmb/wr/Forms/Physical%20Security%20Access%20Request.docx http://inside.michigan.gov/dtmb/wr/Forms/Foreign%20Device%20Network%20Connection%20Request.dot http://inside.michigan.gov/dtmb/wr/Forms/Contractor%20Security%20Agreement.dot

NON-DISCLOSURE AGREEMENT

Michigan Department of Technology, Management and Budget

This Non-disclosure Agreement (Agreement) is between:

Michigan Department of Technology, Management and Budget (DTMB) 525 West Allegan Street, Lansing, Michigan 48913 and Entity Name (short form)

Address (Street, City, State, Zip)

During the Exchange Period set forth below, the parties intend to exchange confidential or proprietary information in furtherance of the Business Purpose described below:

Business Purpose: State why the parties intend to exchange information, e.g., to learn from one another; to develop policy; to make improvements to a shared software application, etc.

Project Name:

Project Description:

Exchange Period From:

Exchange Period To:

Agreement Begin Date:

Agreement End Date:

CONFIDENTIAL INFORMATION

For the purposes of this Agreement, Confidential or Proprietary Information (Confidential Information) includes: all technical information shared by any party with the other party in connection with the Business Purpose, including development plans, technical plans, costs, finances, technical configurations, data, access, or security codes and related procedures;

security-related information; infrastructure-related information; trade secrets; information designated as confidential in writing or identified as confidential at the time of disclosure if such disclosure is verbal or visual and confirmed in writing to the recipient party within 15 days of disclosure; and any copies of the prior categories or excerpts included in other materials created by the recipient party. Confidential Information also includes all information protected by state or federal law including “Personal Information” as defined in the Michigan Identity Theft Protection Act, MCL 445.63(r). “Trade Secrets” as defined under section 2 of the Uniform Trade Secrets Act, MCL 445.1902, or “Financial or Proprietary Information” as defined in the Management and Budget Act, MCL 18.1261(13)(b).

Confidential Information does not include contracts entered into between the parties, or any pricing information included within contracts. Although Confidential Information may include “Personal Health Information” as defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and its related rules and regulations, this Agreement is not intended to, and does not, replace a Business Associate Agreement that may be otherwise required pursuant to HIPAA and its related rules and regulations.

DUTIES

Each party must: (a) use the same degree of care it uses to protect its own Confidential Information, exclusive of corporate document marking conventions, but in any event not less than reasonable care, to protect the disclosing party’s Confidential Information during the Exchange Period from unauthorized use, dissemination, or publication; (b) use the disclosing party’s Confidential Information only in connection with the Business Purpose;

and (c) limit access to the disclosing party’s Confidential Information to those employees performing work in connection with the Business Purpose. Each party must advise its employees and agents who receive or have access to any of the other party’s Confidential Information of its confidential nature.

EXCLUSIONS

Confidential Information does not include information that: (a) was or becomes generally available to the public other than as a result of disclosure in violation of this Agreement; (b) becomes available to the recipient party from a source other than the disclosing party, provided that the recipient party has no reason to believe that the source is itself bound by a confidentiality or non-disclosure agreement with the disclosing party or is otherwise prohibited from disclosing the Confidential Information by a legal, contractual, or fiduciary obligation; (c) was developed by the recipient party without the use of the disclosing party’s Confidential Information; (d) is subject to disclosure by the recipient party under the Freedom of Information Act (FOIA), MCL 15.231 et seq.; (e) or is required to be disclosed by other law, regulation, or court order, so long as the recipient party provides the disclosing party with written notice of the required disclosure promptly upon receipt of notice of the disclosure.

RETURN OF CONFIDENTIAL INFORMATION

Except as otherwise provided by law, including retention and disposal schedules of governmental agencies, at the written request of the disclosing party, the recipient party must return all copies of the disclosing party’s Confidential Information or certify in writing that all copies thereof have been destroyed. Either party may return the other party’s Confidential Information, or any part thereof, at any time.

SURVIVAL

The provisions of this Agreement that impose continuing obligations with respect to confidentiality will survive the expiration or termination of this Agreement, to the extent that either party retains Confidential Information of the other after the expiration of the Agreement.

EQUITABLE RELIEF

Each party to this Agreement acknowledges and agrees that (a) a breach or threatened breach by such party of any of its obligations under this Agreement may give rise to irreparable harm to the other party for which monetary damages would not be an adequate remedy and (b) in the event of a breach or a threatened breach by such party of any such obligations, the other party hereto is entitled to equitable relief, including a temporary restraining order, an injunction, specific performance and any other relief that may be available from a court of competent jurisdiction, without any requirement to post a bond or other security, and without any requirement to prove actual damages or that monetary damages will not afford an adequate remedy.

NO THIRD-PARTY BENEFICIARIES

DTMB’s Confidential Information may include information that belongs to a third party that is assisting DTMB with the Business Purpose. Nothing in this Agreement, however, is intended to confer any rights or remedies upon any person or entity not a party to this Agreement.

NO WARRANTIES OR FURTHER RIGHTS

Neither party makes any representations or warranties, express or implied, with respect to any of its Confidential Information. Nothing contained in this Agreement shall be construed as granting or conferring to either party any rights by license or otherwise in or to the other party’s Confidential Information, except for the use of such Confidential Information as expressly provided in this Agreement. Neither party may use the other party’s Confidential Information for any purpose except in relation to the Business Purpose.

MISCELLANEOUS

Neither party may act or has the authority to act as an agent of the other party for any purpose. This Agreement is governed by and construed in accordance with the laws of the State of Michigan. Neither party may assign its rights or obligations under this Agreement without the prior written consent of the other party. Any modification of this Agreement must be in writing and signed by both parties.

COUNTERPARTS AND ELECTRONIC DOCUMENTS

This Agreement may be executed and delivered in counterparts, including by a facsimile or an electronic transmission thereof, each of which shall be deemed an original.

APPROVALS

For Department of Technology, Management and Budget:

Signature Printed Name Title Date

For Entity Name:

Signature Printed Name Title Date