SI-147B 2025.pdf

Smithsonian Institution

Privacy and Security Clause

SI 147B – Privacy and Security Clause Page 1 of 4

September, 2024 (Rev.)

1. Smithsonian Data: (a) The Smithsonian Institution

(“Smithsonian”) retains sole ownership of, and unrestricted rights to, any and all physical or electronic information collected, processed, or stored by or on behalf of the

Smithsonian (“Smithsonian Data”), which is defined to include personal information, also referred to as personally identifiable information (PII), i.e., information about individuals, which may or may not be publicly available, that can be used to distinguish or indicate an individual’s identity, and any other information that is linked or linkable to an individual, such as medical, educational, financial or employment information, online identifiers such as IP address, device IDs, and cookie data, and any other information defined as “personal information,” “personal data” (or other analogous variations of such terms) under the applicable privacy, security and data protection laws (“PII”). (b) Contractor shall maintain, transmit, and retain in strictest confidence, and prevent the unauthorized duplication, use and disclosure of Smithsonian Data. (i)

Contractor shall only access, maintain, use, and disclose

Smithsonian Data to the extent necessary to carry out the requirements of this contract, and shall not use Smithsonian

Data for any other purposes, including testing or training purposes. (ii) Contractor shall only provide Smithsonian Data to its authorized employees, contractors, and subcontractors and those Smithsonian employees, contractors, and subcontractors who have a valid business need to know such information in order to perform duties consistent with this contract. (iii) Contractor shall ensure that all Smithsonian Data is protected from unauthorized access, disclosure, modification, theft, loss, and destruction and will provide assurance and evidence of such protections upon the Smithsonian’s request.

(iv) Contractor shall not disclose Smithsonian Data without the

Smithsonian’s advance written authorization. If Contractor receives a legal request (such as a subpoena), or becomes subject to a legal requirement or order to disclose Smithsonian

Data, Contractor shall (1) immediately notify the Contracting

Officer’s Technical Representative (“COTR”) of it and afford the Smithsonian the opportunity to contest such disclosure, (2) assert the confidential nature of the Smithsonian Data, and (3) cooperate with the Smithsonian’s reasonable requirements to protect the confidential and proprietary nature of Smithsonian

Data. (v) Contractor shall not transfer access to any

Smithsonian Data in the event of a Contractor merger, acquisition, or other transaction, including sale in bankruptcy, without the prior written approval of the Contracting Officer.

(c) Contractor shall provide the Smithsonian reasonable access to Contractor facilities, installations, technical capabilities, operations, documentation, records, databases, and personnel, and shall otherwise cooperate with the Smithsonian to the extent required to carry out an audit for compliance with the requirements in this contract. Contractor shall, as requested by the COTR, complete, or assist Smithsonian staff with the completion of, a privacy and/or security review which might include providing requested information and documentation about how Smithsonian Data is used, collected, maintained, stored, or shared. (d) Contractor shall make any Smithsonian

Data accessible to the COTR as soon as possible, but no later than ten calendar days of receiving a request from the COTR, and shall transfer all Smithsonian Data to the COTR no later than thirty calendar days from the date of such request from the

COTR. Contractor shall, when required to transfer Smithsonian

Data to the COTR under the terms of this contract, provide that

Smithsonian Data in one or more commonly used file or database formats as the COTR deems appropriate. (e) Unless otherwise specified in this contract, Contractor shall purge any

Smithsonian Data from its files and shall provide the COTR a

Certificate of Destruction (“COD”),confirming the purging of the Smithsonian Data within forty- five calendar days of receiving a request from the COTR or at the expiry of this contract. (f) Contractor shall only be permitted to use non-

Smithsonian provided information technology resources to access or maintain Smithsonian Data if Contractor provides, and the COTR approves, the following written certifications about the non-Smithsonian provided information technology resources: (i) Contractor shall maintain an accurate inventory of the information technology resources; (ii) Contractor shall keep all software installed on the information technology resources, especially software used to protect the security of the information technology resources, current and free of vulnerabilities; (iii) Contractor shall encrypt all Smithsonian

Data stored or accessed on non-Smithsonian provided mobile devices and back-up devices (e.g., phone, laptop, tablet, or removable media) using a Federal Information Processing

Standards compliant encryption method; (iv) Contractor shall utilize anti-virus software on all non-SI information technology resources used under this contract; and (v) Contractor shall encrypt all transmissions of PII using Transport Layer Security

1.2 or higher with secure cyphers. Secure Sockets Layer shall not be used. (g) Unless more substantial requirements are provided for herein, Contractor is responsible for, at a minimum, applying industry best practice background screening, security and privacy training, and other appropriate personnel security safeguards to the services performed under this contract. (h) Contractor shall, if requested by the COTR, require its employees to sign a nondisclosure agreement, sign a conflict of interest agreement, and/or sign an acknowledgement of the requirements in this contract.

2. Privacy Breach or IT Security Incident: In the event of

(i) any action that threatens or is likely to threaten the confidentiality, integrity, or availability of Smithsonian IT resources (including computer hardware and software, data, communication links, mobile devices, digitized assets, automated processes, physical computing environments, and associated personnel, whether located inside or outside of the

Smithsonian); (ii) any activity that violates Smithsonian IT

Security policies provided by the COTR; (iii) any suspected or confirmed loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or situation where persons other than authorized users or for an other than authorized purpose have access or potential access to

Smithsonian Data or PII in a usable form, whether physical or electronic; or (iv) any suspected loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or situation where persons other than authorized users

SI 147B – Privacy and Security Clause Page 2 of 4 or for an other than authorized purpose have access or potential access to PII in a usable form, whether physical or electronic

(collectively, “Incident”), Contractor shall: (a) Immediately, but no later than 24 hours after discovery, report the Incident to the designated COTR and Smithsonian Office of the Chief

Information Officer (“OCIO”) Service Desk by calling 202-

633-4000 and, if the OCIO Service Desk does not answer the telephone, leaving a voicemail which includes the name of

Contractor, a brief summary of the Incident, and a return telephone number; (b) The Contractor shall cooperate with

Smithsonian investigations and response activities for breaches or incidents that include the Contractor’s IT resources or personnel; (c) Follow industry standard best practices to preserve evidentiary information to support forensics analysis, correct and mitigate any damages resulting from the Incident, provide a final report or summary of the incident to include lessons learned and corrective actions taken and planned; (d)

Contractor shall acquire applicable forensics services in the event the Contractor does not have adequate resources or capabilities to respond to the Incident; and (e) Indemnify and hold the Smithsonian harmless from any costs incurred by the

Smithsonian in connection with such Incident or corrective actions the Contractor must deploy to safeguard SI information.

3. Public-Facing Software: (a) Any application, system, software, or website used to fulfill the terms of this contract, which can be accessed by members of the public (Public-

Facing Software) shall comply with Smithsonian’s Privacy

Statement (located at Smithsonian Institution's Privacy

Statement | Smithsonian Institution (si.edu) and the

Smithsonian Kids Online Privacy (“SKOP”) Statement (located at http://www.si.edu/privacy/kids), and such Public- Facing

Software shall provide the public with privacy notices in locations that are acceptable in accordance with these policies.

(b) For kiosks and interactives developed by Contractor, the

Contractor shall take all reasonably necessary steps to ensure they will be maintained with antivirus software and routine patching. (c) If Contractor discovers that information was collected from someone under the age of 13 in violation of the

SKOP’s parental permission requirements, Contractor shall provide notice to the Smithsonian Privacy Office as soon as possible, but no later than 24 hours after discovery, and delete that information as soon as possible, but no later than 24 hours after discovery. (d) Any public-facing software that employs tracking technology (such as a cookie, pixel, web bug, or web beacon) or collects contact information shall provide all users with legally-compliant notice of its data collection and tracking practices, and any required consumer choices (including the opportunity to opt-in or opt-out, as required). as well as: (i) for those who opt-out or decline the “opt-in,” reasonable access to the public-facing software; and (ii) for those who “opt-in”, a subsequent and accessible opportunity to request that the tracking or communications cease (i.e., “opt-out”).

4. Cardholder Data and PCI Sensitive Authentication

Data: (a) Any Contractor that collects, processes, stores, transmits, or affects the security of cardholder data or Payment

Card Industry (“PCI”) sensitive authentication data, either directly or through a third party, in order to carry out the requirements of this contract shall provide the COTR, before this contract begins and annually thereafter, for the Contractor and for any third party vendor that processes, stores, transmits, or affects the security of cardholder data or PCI sensitive authentication data, a current, complete, comprehensive, and signed PCI Data Security Standard (“DSS”) Attestation of

Compliance (“AOC”), a template for which may be accessible in the online document library of the PCI Security Standards

Council (“SSC”); (b) any Contractor that works as a PCI Third-party Service Provider (“TPSP”), in order to carry out the requirements of this contract, shall provide the COTR: (i) the duly authorized contact responsible for the Contractor’s maintenance of PCI DSS compliance; (ii) the PCI DSS

Requirement Management Form provided by the COTR, which asks whether Contractor or a third party shall be responsible for ensuring that certain key DSS requirements are met; (iii) before this contract begins and for each bespoke and custom software developed for the Smithsonian i.e., application, system, software, or website, the validation for the use of the PCI

SSC’s Software Security Framework standards (the Secure

Software Standard or the Secure SLC standard); (iv) for each

Payment Application hosted by the Smithsonian, the listing from the SSC website’s Validated Payment Software List of

Validated Payment Applications or the Report on Validation

(“ROV”) from a PCI Secure Software Assessor; (v) for each payment device, the listing from the SSC website’s Approved

Personal Identification Number Transaction Security (“PTS”)

Devices list; (vi) for each system used to process Point of Sale card-present transactions, the listing from the SSC website’s

Point-to-Point Encryption Solutions list; and (vii) if requested, any additional evidence needed to determine the PCI compliance of activities related to this contract; (c) Contractor shall provide the documents and listings identified in Paragraph

4(b) before it shall be permitted to use the relevant technology and shall provide updated documents and listings to the COTR for review and approval before a system change results in one or more of the required documents or listings becoming inaccurate.

5. IT Systems and Cloud Services: (a) Contractor is responsible for applying industry best practices to secure their systems and services provided to or used for the Smithsonian.

(b) For any Cloud Service (i.e., computing service provided on-demand via a shared pool of configurable resources instead of via separate dedicated computing resources or information technology system) or IT system Contractor develops, operates, or maintains on behalf of the Smithsonian, or which Contractor uses to collect or store information on the Smithsonian’s behalf, Contractor shall provide the requested documentation, security control evidence/artifacts, and other information needed to complete Security Assessment and Authorization activities. (c)

For Systems that have been Federal Risk and Authorization

Management Program (“FedRAMP”) certified or have received other independent third party assessments (e.g., SOC2, HITRUST, etc.), Contractor shall provide FedRAMP documentation or relevant third party assessment report(s) to the Smithsonian for review and shall cooperate with https://www.si.edu/Privacy https://www.si.edu/Privacy http://www.si.edu/privacy/kids

SI 147B – Privacy and Security Clause Page 3 of 4

Smithsonian requests for clarification or further evidence. (d)

For Systems which are not FedRAMP certified, Contractor shall complete all requested Smithsonian Assessment and

Authorization documentation and shall fully cooperate with the

Smithsonian’s security assessment process, including providing requested security control evidence/artifacts and access to interview appropriate Contractor personnel about security controls. (e) For websites or web servers hosted outside of the

Smithsonian’s data center, the Contractor must allow OCIO to perform vulnerability scanning and penetration testing. Website owners should consult with information technology security staff to determine specific needs for their environment. (f) The

Contractor shall maintain all Smithsonian Data inside the

United States. (g) For Contractor custom developed (non-

COTS) systems and websites to be hosted at the Smithsonian, Contractor shall complete all requested Smithsonian

Assessment and Authorization documentation for the components/aspects of the system provided by Contractor, and shall fully cooperate with the Smithsonian’s security assessment process, including providing requested security control evidence/artifacts and access to interview appropriate

Contractor personnel about security controls. (h) For Contractor developed applications or Contractor built interactive systems

(e.g., public-facing exhibit technology incorporated through digital signage, custom interactives, content players, media players, audio streaming devices, lighting or control automation systems), Contractor shall not circumvent the security of the system (e.g., the use of backdoor or maintenance hook provisions are prohibited) and will ensure that the system can be protected from malware and vulnerabilities while it is in use at the Smithsonian. (i) Contractor shall not implement into live production or use for the Smithsonian or any system containing

Smithsonian Data until security and privacy authorization has been granted in writing by the Smithsonian OCIO via the

COTR. Contractor will resolve security deficiencies in order to successfully meet the applicable requirements of this section. (j)

Contractor consents to and will cooperate with ongoing monitoring for security, privacy, cyber supply chain risk management, and contractual requirement compliance by the

Smithsonian, including providing periodic updated evidence/artifacts, third party assessment reports, and questionnaire responses as requested. Contractor will resolve findings from monitoring, assessments, and Smithsonian web vulnerability scans in a timely manner. The Smithsonian may use third party risk intelligence tools to monitor risk and control compliance by the Contractor. Contractor will address issues as necessary to maintain an acceptable risk rating in these tools.

(k) Contractor will provide at least one point of contact to receive and respond to requests related to these requirements.

6. Credentials and Network Access: (a) Contractor and

Contractor’s employees who have access to Smithsonian network/systems shall, when requested by the COTR, complete

Smithsonian-provided privacy and security training course(s), sign a nondisclosure agreement, sign a conflict of interest agreement, sign an acknowledgement of the requirements in this contract, provide fingerprints, pass a Smithsonian background check, and/or provide notice of the results of that background check to the COTR. The content and timing of the course(s), agreement, or background check shall be substantially similar to one that would be required of a

Smithsonian employee with access to similar Smithsonian networks/systems. (b) Contractor shall notify the COTR at least two weeks before any of Contractor’s employee requiring a

Smithsonian credential, network account or other access, or other Smithsonian-furnished equipment stops supporting the work of this contract. In the event that Contractor is not provided two weeks’ notice by its employee, Contractor will notify the COTR as soon as Contractor becomes aware of the employee’s departure from the contracted work. (c) Contractor shall, when any employee requiring a Smithsonian credential, network account or other access, or other Smithsonian furnished equipment stop supporting the work of this contract, provide such employee’s Smithsonian credential and any

Smithsonian furnished equipment to the COTR within three business days.

7. California Consumer Privacy Act: (a) The California

Consumer Privacy Act as amended by the California Privacy

Rights Act, including any regulations and amendments implemented thereto (“CCPA”) shall apply to any information collected from California residents on behalf of the

Smithsonian. (b) For purposes of the CCPA, Contractor shall be considered a service provider and the Smithsonian is a business.

(c) Contractor shall not collect, maintain, store, use, disclose, or share PII for a commercial purpose other than providing the services or performing its obligations to the Smithsonian. (d)

Without limiting the foregoing, Contractor: (i) will not sell or share PII (as “sell,” “sale,” or “share” is defined by the CCPA);

(ii) will not retain, use, or disclose Personal Information outside of the direct business relationship between Contractor and the Smithsonian; and (iii) certifies that it understands the restrictions in this section and will comply with them. (e)

Contractor agrees: (i) that the personal information disclosed is only for limited and specified purposes; (ii) to comply with applicable CCPA obligations; (iii) to grant the Smithsonian the right to take reasonable and appropriate steps to help ensure that Contractor uses the PII transferred in a manner consistent with the Smithsonian’s CCPA obligations; (iv) to notify the

Smithsonian if it makes a determination that it can no longer meet its obligations; and (v) to grant the Smithsonian the right

(upon notice) to take reasonable and appropriate steps to stop and remediate unauthorized use of PII. (f) Upon request by the

Smithsonian, Contractor will assist the Smithsonian in the

Smithsonian’s fulfillment of any individual’s request to access, delete, or correct PII. (g) Contractor will promptly notify the

Smithsonian following Contractor’s receipt of any request or complaint relating to any PII (unless applicable law prohibits such notification). Contractor will not respond to any such request or complaint, other than to redirect to the Smithsonian, unless expressly authorized to respond by the Smithsonian.

8. Required Insurance Coverage: Contractor shall maintain at all times during the performance of this contract and for three years following its expiration or termination the following insurance coverage:

SI 147B – Privacy and Security Clause Page 4 of 4

8.1. If Contractor will be providing hardware, pre-

packaged software, portal access, website development or data storage, as a part of this contract, IT Professional

Liability Insurance and Cyber Liability Insurance with limits of no less than $2,000,000 per occurrence and

$2,000,000 in the annual aggregate, including coverage for the following:

8.1.a Security and privacy liability, including privacy breach response costs, regulatory fines and penalties; and coverage for unauthorized access, unauthorized disclosure, denial of service attacks, computer viruses, Trojan horses, worms, transmission of any other type of malicious or damaging code, ransomware and failure of security;

8.1.b Hostile action or threat of hostile action;

8.1.c Dishonest, fraudulent, malicious, or criminal use of a computer system;

8.1.d Failure to prevent access to a computer system or computer system resources by an unauthorized person or an authorized person in an unauthorized manner;

8.1.e Breach of privacy and/or the failure to protect any disclosure of personally identifiable information;

8.1.f Cyber extortion coverage, which must include the ability to reasonably meet a hacker’s ransom demand, to pay for extortion-related expenses and to bring damaged computer hardware or databases back to their original working condition; and

8.1.g Failure to address any known vulnerabilities.

8.2. If Contractor will be providing colocation services, cloud services, or managed dedicated servers as a part of this contract, Professional Liability Insurance with a limit of no less than $1,000,000 per occurrence. Coverage must encompass all of the duties and obligations that are the subject of the contract.

8.3. If Contractor will be allowing a third party to use, store, process or access PII or sPII as a part of this contract, Cyber Liability Insurance with a limit of no less than

$2,000,000 per occurrence and must include coverage for the acts or omissions of the third party.

8.4. SI may increase the required minimum policy limit

amounts based on the level of risk exposure to SI upon written notice to Contractor. Contractor will provide SI a certificate(s) of insurance showing compliance with SI’s increased minimum policy requirements within thirty (30) days of such written notice.

As this is a professional liability policy, the requirement for additional insureds is waived and the following language should be included in the contract: Contractor agrees that upon the event that Contractor and Smithsonian are named as co-defendants in any claim, damages or losses related to any matter arising from work performed by Contractor under this contract, that Contractor’s insurance shall take all appropriate action on behalf of the Smithsonian. Contractor shall immediately advise Smithsonian of any claims presented or suits filed as relates to this contract. Contractor agrees and acknowledges that U.S. Federal Law requires that the U.S.

Department of Justice, as the legal representative for

Smithsonian, must defend or settle any such claims, damages, or losses unless the United States agrees otherwise.

9. European Economic Area. This contract does not include the collection or processing of Personal Information relating to individuals located in the European Economic Area.

10. Terms: The bolded headings at the start of each section of this Smithsonian Institution Privacy and Security Clause are included only to assist the reader in navigating this Smithsonian

Institution Privacy and Security Clause. The Parties intend the bolded headings to have no legal effect, and agree that the bolded headings are not intended to limit or modify any other language in this Smithsonian Institution Privacy and Security

Clause.