SOLICITATION_0726.330.docx

Competitive Informal over $50,000 Request for Quote – IT Goods (Rev. 12/2024) Attachment 2

SERVICE LEVEL AGREEMENT

Competitive Informal over $50,000 Request for Quote – IT Goods (Rev. 12/2024) Attachment 2

SERVICE LEVEL AGREEMENT

Notice to Bidders Request for Quote RQS # 0726*330 Competitive Solicitation for Informal Over $50,000 Non-Cloud for Information Technology Goods

SOLICITATION INFORMATION

You are invited to review and respond to this Request for Quote (RFQ) for Information Technology Goods over $50,000. This RFQ solicitation incorporates, by reference, the following terms and conditions:

· Bidder Instructions – GSPD 451

· IT General Provisions for Non-Cloud Goods and Services only – DGS PD 403-ITGP (Non-Cloud)

· Security and Privacy General Provisions – Attachment 1

· Service Level Agreement – Attachment 2 for software purchases only Questions and Answers A. Questions regarding this RFQ must be received by the date and time specified in the Solicitation information above. Bidders are encouraged to submit written questions via e-mail to debra.rossaro@dot ca.gov.

B. Written questions must include the individual's name, firm name, complete address and must reference Request for Quote RQS #0726*330. Questions must be sent:

Email: debra.rossaro@dot ca.gov C. Written responses to all questions will be collectively compiled and posted, as an Addendum, to the Cal eProcure website (https://caleprocure.com/pages/index.aspx). It is the responsibility of the bidder to access the website for any changes or Addenda that may be posted. Refer to this RQS # for the schedule of events and dates/times. It is the responsibility of the bidder to check Cal eProcure for all addenda. Bidder can contact the Contract Analyst named above.

For IT solicitations exceeding $100,000, the provisions outlined below shall govern the Protest process and Contract Award.

1. Award of Contract A. Award of contract, if made, will be in accordance with the RFQ information on Evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ documents and an addenda thereto, except for such immaterial defects as may be waived by the State. Award, if made, will be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

B. The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its bid, the State may accept any item or group of items of any bid. The State reserves the right to modify or cancel in whole or in part it’s RFQ.

C. Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the paragraph titled “Protests” of this RFQ.

2. Protests A. Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or if they result in a protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final.

B. If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful bidder” will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final.

C. All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be mailed or delivered to:

Street and Mailing Address:

Deputy Director Procurement Division 707 Third Street, Second Floor South West Sacramento, CA 95605 Facsimile No.: (916) 375-4611 D. All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by DGS Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notification of Intent to Award. Certified or registered mail must be used unless delivered in person; in which case the protester should obtain a receipt of delivery.

SUBMIT BIDDER PACKAGES TO

Department of Transportation

Solicitation Contact Debra Rossaro

Address (Street, City, State, Zip) 1727 30TH Street, Sacramento, CA 95816

Submittal of an offer in response to this solicitation is the offeror’s acceptance to the terms and conditions in this solicitation and confirmation of compliance to the provisions set forth herein.

To be considered responsive, complete quote packages must be received by the Quote Submission Due Date and Time specified above. Late offers will not be considered. Bids emailed or mailed to another person other than the Solicitation Contact identified above will not be considered.

The State assumes no responsibility for Internet or technical difficulties experienced by the bidder that results in the bid package not being timely received by Caltrans. Any oral information given will not be binding upon Caltrans unless such information is issued in writing as an official addendum to this solicitation.

Prospective bidders are encouraged to consider programs and preferences that are available, such as those for the use of Microbusinesses (MB), Small Businesses (SB), Disabled Veteran Business Enterprises (DVBE), Disadvantaged Business Enterprises (DBE), and other businesses covered by State and Federal programs and preferences.

General Artificial Intelligence (GenAI)

1. “The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

1. Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or (iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

1. Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

1. Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

1. Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.”

DELIVERY INFORMATION

Quote Expiration Date 60 days from Quote Due Date

Ship To: 2901 W Broadway, Los Angeles, CA 90041

BIDDER INFORMATION

The awarded vendor shall strictly adhere to the delivery schedules specified in this solicitation and are subject to the delivery provisions detailed in the terms and conditions listed on the cover page of this solicitation.

By signing below, with inclusion of the date of signature, the bidder DECLARES UNDER PENALTY OF PERJURY under the laws of the State of California as follows:

1. Statement of Compliance. The below signed as complied with the non-discrimination program requirements of Government Code 12990 and Title 2, CA Administrative Code Section 8103, and such declaration is true and correct.

2. The National Labor Relations Board declaration set forth in Paragraph 48 of the General Provisions is true and correct.

3. If a claim is made for the Small Business or Disabled Veterans Business Enterprise preference, the information set forth within is true and correct.

The signatory below for this bid must be authorized to bind company contractually.

Printed Name and Title Official’s Signature

Date

BIDDER REQUIRED DOCUMENTS CHECKLIST

To be considered responsive, bidder must return the completed documents listed below.

Note: Bidder may be asked to submit a Payee Data Record (STD. 204) listing Taxpayer Identification Number. Bidder’s forms, license agreements, or other documents shall not be signed by state employees. Any documents provided by the bidder may be incorporated by reference.

QUOTE PRICING

Bidder’s quote is inclusive of all costs and no additional payments will be paid unless separate payment provisions are specified on the Purchasing Authority Purchase Order (STD. 65).

Any reference to brand names and model numbers in this solicitation is for reference purposes only. Bidder may propose equivalent items that comply with the specifications for items listed in this solicitation. Any substituted item is subject to the terms detailed in Bidder Instructions (DGS PD 451), Section 7: Brand Names.

|_| Contract award will be made on the basis of “all or none” to the bidder with the lowest quote.

|_| Contract award will be made on the basis of “individual items or combination of items” to the bidder with the lowest quoted items.

Pallet Requirements

VIDEO ROUTER NA 1 TB

LICENSE NOT INCLUDED

OPTIONAL AMENDMENT PRICING

Subject to the original terms and conditions of the executed Purchase Order and contingent upon approval by the State and the awarded Contractor, the State reserves the right to amend the Purchase Order for additional time and/or quantity, for more of the same item(s). If the Purchase Order is amended, the rates below would apply.

Any resulting Agreement amendment will not take effect until it is signed by a Caltrans Contract Officer and the Contractor has received a signed copy of the Purchasing Authority Purchase Order (STD. 65) amendment.

There is no commitment to issue an amendment for any part of the optional amendment items priced below.

Product Code Description/Specifications/ Pallet Requirements

(Quantity x Unit Price)

VIDEO ROUTER NA 1 TB

LICENSE NOT INCLUDED

California Department of Transportation

DIVISION OF PROCUREMENT AND CONTRACTS

1727 30TH STREET, MS 65

SACRAMENTO, CA 95816-7006

PHONE (916) 227-6000 TTY 711

https://dot.ca.gov/programs/procurement-and-contracts/

GAVIN NEWSOM, GOVERNOR

Competitive Informal over $50,000 Request for Quote – IT Goods (Rev. 10/2025)

The Agreement (and the services and work product produced under the Agreement) must be in compliance with this Exhibit (Security and Privacy General Provisions) to ensure the confidentiality, security, privacy, integrity, and availability of information assets, data, and systems.

Contractor agrees to protect all California Department of Transportation (Caltrans) information by implementing all controls and procedures necessary to comply with the provisions of this Exhibit and all State mandated data security and privacy requirements provided in the California State Administrative Manual (SAM), the State Contract Manual (SCM), all data security and privacy standards of the National Institute of Standards and Technology (NIST), all Federal Information Processing Standards (FIPS), all California State law (including, but not limited to, Government Code §11015.5 and §11019.9, the California Information Practices Act (IPA), the California Consumer Privacy Act (CCPA) and Civil Code §1978 et seq), and all promulgated or published State of California and Caltrans regulations and policies relating to data security and privacy. Contractor further agrees to implement the minimum administrative, physical, and technical safeguards described in this Agreement. Contractor also further agrees to respond to Caltrans surveys and inquiries regarding compliance with the terms and conditions of this agreement. Contractor shall protect Caltrans Data in accordance with this Exhibit for as long as the Contractor is in possession of, maintaining, or accessing Caltrans Data. Contractor shall ensure that all subcontractors and third parties with whom Contractor works comply with this Agreement and agree in writing to adhere to the provisions of this Agreement.

1. DEFINITIONS

For purposes of this Exhibit, the following definitions shall apply:

1.1. Contractor shall generally refer to the “Contractor” as identified in this Agreement.

1.2. Data shall mean a representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

1.3. Caltrans Data shall refer to Data owned by Caltrans.

1.4. Confidential Information means any and all nonpublic information relating to the current and future operations and services of Caltrans, including but not limited to, planning, specifications, concepts, technical information, techniques, drawings, sketches, models, know-how, data, databases, electronic information, emails, processes, designs, photographs, apparatus, equipment, specifications, software programs, source code, software documentation, manuals, and formulae. The parties further agree that Confidential Information shall also include information received by Recipient prior to the execution of this Agreement and that would otherwise qualify as Confidential Information as provided herein. Confidential Information does not include information that (a) is lawfully within the public domain other than through disclosure or default by the Recipient; (b) was lawfully obtained from a third party who was legally in possession of the information, and who is authorized in writing by Caltrans to disclose it; (c) was independently developed by Recipient without the use of the Confidential Information, or any derivative works, and without the use of knowledge learned from accessing the Confidential Information; or (d) is subject to the requirements of the California Public Records Act (“CPRA”) or otherwise required to be disclosed by order of a court, administrative agency or other governmental body with competent jurisdiction provided that Recipient notifies Caltrans within three (3) business days of receipt of such an order so that Caltrans may, in its sole discretion, seek a protective order from a court of competent jurisdiction preventing or restricting disclosure.

1.5. Personal Information shall have the meaning established by California law (including without limitation the IPA) and administrative manuals (including without limitation the SAM and SCM).

1.6. Sensitive Information shall have the meaning established by California law (including without limitation the IPA) and administrative manuals (including without limitation the SAM and SCM).

1.7. Personnel shall refer to any Contractor employees, volunteers, sub-contractors and third parties commissioned, employed by, or otherwise engaged by Contractor to perform work under this Agreement.

1.8. Systems shall refer to workstations, laptops, servers, applications, network, and other information processing components.

1.9. Users shall refer to any Contractor personnel with access to Caltrans Data.

2. ADMINISTRATIVE SAFEGUARDS

2.1. DATA OWNERSHIP

Caltrans Data provided under this Agreement shall be the sole and exclusive property of Caltrans. Confidential, sensitive, and personal information should not be disclosed to any third- party and it requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without the written permission from an authorized representative of Caltrans.

Contractor agrees that it is responsible to protect the confidentiality of information in their custody as provided by this Agreement and to ensure such information is disclosed to only those parties to whom disclosure is permitted under this Agreement.

Contractor shall have a non-exclusive right to use and process the Caltrans Data for only the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of the Caltrans Data does not transfer ownership of information to the Contractor or any third party.

2.2. USE OF INFORMATION

Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement shall be used only for the purposes described in this Agreement, and Contractor agrees to implement its own policies and procedures to ensure that the confidentiality of said information is maintained in accordance with the provisions of this Agreement.

Contractor further agrees that information obtained under this Agreement shall not be reproduced, copied, published, sold, or released in original or any other form for any purpose other than the purposes set forth in this Agreement. Only the Caltrans Data that is required to perform purposes of this Agreement may be processed, stored, or transmitted by Contractor.

Contractor shall not use any Caltrans Data that identifies any natural person for any purpose that is not set forth in this Agreement, including for testing, training, or research.

2.3. STATEMENT OF CONFIDENTIALITY AND REQUIREMENTS

Caltrans Data may be exempt from disclosure under the provisions of federal and state laws.

Contractor understands and acknowledges that under California Penal Code §502, it is a public offense to knowingly and without permission alter, damage, delete, destroy, copy, or otherwise use any Caltrans Data. Such action can be prosecuted civilly or criminally, and it is punishable by fine and/or imprisonment.

Contractor shall ensure that all users sign a confidentiality statement, attesting to the fact that he/she is aware of the confidential nature of the Caltrans Data and that there are penalties for unauthorized disclosure of the Caltrans Data under applicable federal and state law. Copies of signed confidentiality statements must be made available to the Caltrans Information Security Office upon request.

2.4. INFORMATION SECURITY AND PRIVACY AWARENESS TRAINING

Contractor shall ensure that all persons that process or have contact with Caltrans Data will take information security and privacy awareness training prior to accessing and/or using such information, and annually thereafter. Information security and privacy awareness training must contain instructional components such as, but not limited to, information about the confidential nature of information, laws and regulations protecting the confidentiality of information, user responsibility for protecting the information, and the consequences and legal liability of unauthorized use, access, or disclosure of said information. Upon request, the Contractor must provide the Caltrans Chief Information Security Officer (CISO) or Privacy Officer with a copy of its information security and privacy awareness training components and certification of its annual information security and privacy awareness training completion.

2.5. EMPLOYEE ACCESS TO INFORMATION

Contractor agrees that the Caltrans Data shall be kept in the strictest confidence and made available to only authorized personnel on a “need-to-know” business basis, and only for the purposes authorized under this Agreement. The term “need-to-know” refers to those authorized persons who need specific information to perform their official duties in connection with the purposes described in the Agreement.

Contractor shall maintain records of all authorized users and the authorization level of access granted to the information access and/or used under this Agreement with the purpose described in this Agreement.

2.6. CYBER RISK ASSESSMENT

A Cyber Risk Assessment (CRA) must be conducted every two years on all systems which input, process, store or transmit Caltrans Data, or sooner if there is a significant change to the system or environment. The risk assessment must meet requirements provided by SAM 5305.7; and if Contractor cannot meet this requirement, Caltrans may require a CRA be conducted by Caltrans or a third party at Contractor’s expense. Risk assessment results must be provided to the Caltrans CISO upon request. If the risk assessment reveals risks or vulnerabilities, Caltrans will request in writing that the risks and vulnerabilities be corrected within a reasonable period of time set by Caltrans; and, if such risks and vulnerabilities are not corrected within the period of time set by Caltrans, Caltrans may immediately terminate the Agreement at no cost.

2.7. INCIDENT REPORTING

Contractor shall immediately notify the Caltrans CISO or their Designee of any actual or suspected security event involving Caltrans Data that is accessed or obtained under this Agreement. Contractor shall cooperate fully with Caltrans to comply with the incident reporting requirements to which Caltrans is subject, including without limitation the requirements described in Civil Code section 1798.29 and SAM section 5340.4, as amended.

Contractor shall thoroughly investigate all unauthorized or suspected unauthorized access, use, and/or disclosure of Caltrans Data subject to this Agreement. Caltrans reserves the right to participate in the investigation of any information security incident involving its data; Caltrans may conduct its own independent investigation, possibly including Caltrans authorized vendors in such investigation; and the Contractor shall cooperate fully in such investigations.

In addition, Contractor shall provide a preliminary report within three (3) working days of discovery of any breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as any pertinent preliminary information. In addition, the Contractor shall then provide a full written report of the investigation to the Caltrans CISO and Privacy Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including information on the measures that were taken to halt and/or contain the improper use or disclosure of the data, the measures to identify the source, method or process used to obtain improper use or disclosure of the data, and the measures to identify the parties who were involved in the improper use or disclosure of the data.

Caltrans reserves the right to take corrective action at any time.

2.8. BREACH OR DISCLOSURE OF CALTRANS DATA

Disclosure of any Caltrans Data to any person or entity that is not specifically authorized in this Agreement is strictly prohibited. Personnel assigned to work with Caltrans confidential information shall not publish, disclose, reveal, share, or divulge to any person or entity any of the confidential information provided under this Agreement, except as authorized by the provisions of this Agreement or required by law.

Contractor shall immediately notify the Caltrans contract manager in writing of any actual or attempted violations of security of Caltrans Data, including lost or stolen computing devices, files, or portable electronic storage media containing Caltrans Data.

Contractor shall advise the Caltrans CISO in writing of vulnerabilities that may present a threat to the security of Caltrans Data and of specific means of protecting that Caltrans Data.

Contractor shall notify Caltrans immediately by telephone call and email upon the discovery of breach of security of personal information, sensitive information, or confidential information (PSCI) when such data is, or is reasonably believed to be, acquired by an unauthorized person, or within two hours by email of the discovery of any suspected security incident, intrusion or unauthorized use or disclosure of State data in violation of this Agreement, this provision, the law, or potential loss of confidential data affecting this Agreement. In the event of a breach caused by the Contractor, upon the written request of Caltrans, and after Caltrans approves the content of the notifications (as described below), the Contractor shall be responsible for sending out any and all notifications to individuals whose personal information is breached as defined in the Civil Code section 1798.29 and SAM section 5340.4. Contractor shall bear all costs and expenses associated with sending out any such notices and will strictly comply with the requirements of Civil Code section 1798.29. In the event Contractor fails to send out the requisite notices, Caltrans in its sole discretion may notify all affected individuals, and Contractor shall bear all costs and expenses arising from any notifications sent out by Caltrans.

The Caltrans CISO and Legal Office shall review the content of any and all notifications and written approval must be obtained before notification can be made under this Agreement.

Caltrans shall not be held liable for any breach of Contractor systems that results in the release of any information provided by Caltrans and/or Contractor’s breach of this Agreement. Contractor agrees to indemnify and hold harmless Caltrans, its officers, and representatives from and against any liability, losses, costs, damages, or expenses (including but not limited to attorney fees) resulting from any claims arising from the performance of this Agreement, including but not limited to any and all liability, damages, costs, expenses, or attorney fees resulting from a breach of security of the system as defined in the California IPA unless such damages are determined to be the direct result of the gross negligence or willful misconduct of Caltrans, its officers, employees, or representatives. If consumer protective services, such as credit monitoring, are deemed appropriate by Caltrans due to the data breach, all costs associated with such services shall be paid by Contractor.

3. DEPARTMENT POLICIES

Contractor must review the standards, manuals, and other references set forth in this Exhibit, and ensure that their operations comply with the standards, manuals, and other references, as amended from time to time. For general guidance on Caltrans Information Security policies, refer to SIMM 5300-B Foundational Framework.

By virtue of signing this contract, Contractor agrees to and agrees to adhere to Caltrans terms, covenants and conditions set forth in this Security Exhibit and to be responsible for its breaches of these terms, covenants, and conditions.

3.1. ACCESS CONTROL

Contractor shall ensure information in all forms, such as, but not limited to CDs, DVDs, USB flash drives, or other removable media must be stored in areas that are physically secure and free from access by unauthorized persons as described in this Agreement.

Contractor shall ensure that computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement cannot be viewed by unauthorized persons as described in the Agreement.

Contractor shall adhere to all access management protocols including the use of industry-standard multi-factor authentication solutions.

3.2. SUPERVISION OF DATA

Caltrans Data in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk, or office. “Unattended” means that information is not being observed by an employee authorized to access the information. Caltrans Data in paper form shall not be left unattended at any time in transportation vehicles (including planes) and shall not be checked as baggage on commercial airplanes.

Contractor shall maintain confidentiality of all Caltrans Data by limiting data sharing to those individuals contracted to provide services on behalf of the State, and limit use of Caltrans Data assets to State purposes only.

3.3. ESCORTING VISITORS

Visitors to areas where Caltrans Data is contained shall be escorted and Caltrans Data shall be kept out of sight while visitors are in the area.

3.4. REMOVAL OF DATA

Caltrans Data must not be removed from the premises of the Contractor without express written permission by Caltrans.

Contractor shall not transfer Caltrans Data to any computing system, mobile device, or desktop computer without first establishing the specifications for information integrity and security as established for the original data file(s) including State Administrative Manual (SAM) section 5335.1.

4. TECHNICAL SAFEGUARDS

4.1. DATA RETENTION AND DESTRUCTION

Caltrans Data may be retained only to the extent that it is necessary to perform the required business purposes of this Agreement.

All data received by the Contractor under this Agreement and any data created, copied, attributed to data received shall be destroyed when no longer needed for the purposes of this Agreement for which they were obtained, or within 30 calendar days of termination of this Agreement. Data must be destroyed in accordance with the requirements specified by NIST Special Publication (SP) 800-88, Guidelines for Media Sanitization, and other promulgated or published State of California and Caltrans regulations and policies, as amended or superseded.

4.2. ENCRYPTION

Confidential, sensitive, or personal information shall be encrypted in accordance with Federal Information Processing Standards 140-2 (or most current version), Security Requirements for Cryptographic Modules, and other promulgated or published State of California and Caltrans regulations and policies, as amended or superseded.

The data encryption used by Contractor shall use government-certified Advanced Encryption Standard (AES) cipher algorithms with a 256-bit or better encryption key with cryptographic technology that has been tested and approved against exacting standards, meeting FIPS 140-2 level 2 Security Requirements for Cryptographic Modules or better.

Contractor shall encrypt all Caltrans Data stored on portable computing devices and portable electronic storage media to protect Caltrans Data stored on every sector of a hard drive, including temp files, cached data, hibernation files, and unused disk space.

Contractor shall encrypt all Caltrans Data at rest if there is a reasonable likelihood that data storage media may be lost, stolen, or copied, such as when transferring to offsite backup storage.

Contractor shall encrypt, as described above, all Caltrans Data transmitted from one computing device or storage medium to another when traversing an open, public, or other unprotected network (such as the Internet).

4.3. DATA AT REST AND IN TRANSIT

All Caltrans Data at rest and in transit must be encrypted in accordance with the security and privacy provisions specified within this Agreement.

4.4. ENDPOINT PROTECTION

All workstations, laptops and other systems that input, process, store, or transmit Caltrans Data must install and actively use endpoint protection with automatic updates scheduled at least daily. Contractor shall install and maintain current anti-virus software and endpoint protection, security patches, and upgrades on all computing devices used during the agreement.

Contractor shall ensure that it shall apply anti-malware controls to the services to help avoid malicious software gaining unauthorized access to state data, including malicious software originating from public networks. Such controls shall always equal or exceed the controls consistent with the industry standards for such data, but in no event less than the controls that contractor applies to its own internal corporate electronic data of like character.

4.5. VULNERABILITY MANAGEMENT

Systems which input, process, store, or transmit Caltrans Data must be scanned for vulnerabilities at least on a monthly basis, and at any time when new vulnerabilities that potentially affect the system are identified and reported. Vulnerabilities by severity must be remediated within the following timeframe:

1. Critical (3 business days or less)

2. High (21 days)

3. Medium (60 days)

4. Low (90 days) The CISO must be notified within 24 hours if critical vulnerabilities cannot be remediated within the required timeframe.

Note: vulnerability severity ratings referenced above must follow the NIST scoring system (https://nvd.nist.gov/vuln-metrics/cvss).

4.6. INTRUSION DETECTION

All systems which store, process, or transmit Caltrans Data that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

4.7. WARNING BANNERS

All systems which input, process, store, or transmit Caltrans Data must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.

4.8. IDENTIFICATION

All users accessing Caltrans Data must be issued unique user identification.

4.9. MULTI FACTOR AUTHENTICATION

Multi factor authentication must be enabled for all users.

4.10. PASSWORD CONTROLS

Passwords must be changed at least every 120 days.

Passwords must be a minimum of 15 characters and must be composed of a minimum one character each from the following four groups:

1. Upper case letters (A-Z)

2. Lower case letters (a-z)

3. Arabic numerals (0-9)

4. Non-alphanumeric characters (punctuation symbols)

4.11. USER ACCOUNTS

User accounts must be immediately disabled or deleted upon personnel termination or a change in assigned duties which no longer require access to Caltrans Data.

4.12. SESSION LOCK

Systems must not be left unattended and logged on. Systems must be configured to prevent access by initiating a session lock after no more than 10 minutes of inactivity. Session locks must be retained until the user reestablishes access using established identification and authentication procedures.

4.13. CHANGE CONTROL

Contractor shall notify Caltrans 30 days prior of any changes to systems, hardware, software, applications, file structure, data, or record layout which input, process, store, or transmit Caltrans Data. Caltrans shall notify the Contractor of any changes to Caltrans systems, hardware, software, applications, file structure, data, or record layout which input, process, store, or transmit information in the performance of this Agreement at the discretion of Caltrans.

4.14. AUDITING

Contractor shall maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Said logs must be made available to Caltrans upon request. Contractor shall allow audits or inspections by individuals authorized by Caltrans at the Contractor premises during regular business hours, with seven (7) business days prior notice for purposes of determining compliance with the terms of this Agreement.

4.15. PROTECTION OF PROPRIETARY SOFTWARE AND OTHER PROPRIETARY DATA:

Contractor shall agree in writing that all material that is marked or identified in writing as proprietary and furnished hereunder by Caltrans to Contractor are provided for the Contractors exclusive use for the purposes of this contract only. All such proprietary data shall remain the property of the State. Contractor agrees to take all reasonable steps to ensure that such proprietary data are not disclosed to others, without prior written consent of the State, subject to California public records act, or other lawful process (e.g., in response to a subpoena), and to review such steps (at commercially reasonable intervals) to ensure the proprietary data is not disclosed.

Contractor will ensure, prior to disposing of any media, that any licensed materials contained thereon have been erased or otherwise destroyed.

Contractor agrees that it will take appropriate action by instruction, agreement or otherwise with its employees or other persons permitted access to proprietary materials to satisfy its obligations in this contract with respect to use, copying, modification, protection and security of proprietary materials and data, subject to the California Public Records Act and other applicable law.

4.16. CLOUD SERVICES

The applicable Department of General Services Procurement Division, INFORMATION TECHNOLOGY - GENERAL PROVISIONS CLOUD - COMPUTING SERVICES, DGS PD 402-ITGP (Cloud) (hereafter referred to as, the “Cloud Computing Services”) are incorporated by reference.

Compliance with SAM section 4983 and SIMM 5315-B Cloud Security Standard must be followed by the Contractor.

4.17. REMOTE ACCESS

Any remote access to Caltrans Data or systems shall be transmitted and executed only over an encrypted method that is approved in writing by Caltrans. All remote access shall be limited to minimum necessary and least privilege principles. Remote Access shall meet security standards as defined in SAM 5360.1 and SIMM 5360-A.

4.18. OUT OF COUNTRY STORAGE AND REMOTE ACCESS

Caltrans Data cannot be stored or accessed by Caltrans employees, agents, representatives, or contractors located outside the United States of America (U.S.) “Outside the U.S.” means outside the geographical boundaries of the United States, the United States territories, embassies, or military installations. Furthermore, Caltrans Data may not be received, processed, stored, transmitted, or disposed of by information technology (IT) systems located outside the U.S. All contractor data centers utilized as part of this contract must be located within the U.S., and all Caltrans Data must be located within the U.S. For reference, see California State Administrative Manual (SAM) Section 4983.1 (#15) -Out of country requirements.

Contractors may receive specific provisional access under the terms of this contract provided they submit the following data and abide by the following provisions: they submit the data to, and they received written approval by, the Contract Manager, Deputy Director of Administration or the District Deputy Director of Administration and State CISO:

REQUIRED CONTRACTOR INFORMATION

1. First and Last Names of all contractors working outside the U.S.

2. Start and end date of the outside of U.S. access.

3. Terms and conditions for the outside of U.S. data breach responsibilities of the Contractor.

4. Terms covering Contractor handling of Caltrans Data

5. Name(s) of all Caltrans system(s), network zones and applications the Contractor will have access to from outside the U.S.

6. All capabilities the Contractor will have to Caltrans applications (user account provisioning, data modification, etc.)

7. Third-party Cyber Risk Assessment conducted by a vendor selected by Caltrans at Contractor's expense.

DATA TYPE, CLASSIFICATION AND USE

1. Classification of data the Contractor be able to access on from outside the U.S.

2. If the Contractor will have access to confidential, sensitive, or personal data from outside of the U.S. the following additional information is required:

a. Will the Contractor have access to production data or synthetic (obfuscated) data?

b. If the Contractor will have access to Caltrans Data from outside the U.S. list the specific types of data the contractor will be able to access (SSNs, Credit Cards, Names and Addresses, etc.)

c. Will the Contractor be able to modify Caltrans Data from outside the U.S.?

d. Name(s) of Caltrans Program Manager(s) responsible for ensuring proper handling of Caltrans Data by the Contractor.

e. Why the service cannot be offered from within the U.S.?

4.19. HARDWARE AND SOFTWARE REQUIREMENTS

Contractor must use State issued equipment to access the Caltrans network and systems or use remote connectivity solutions provided by Caltrans IT.

4.20. MATERIAL RETURN/DESTRUCTION

Contractor shall warrant that all materials provided by Caltrans will be returned promptly after use and that all copies or derivations of the materials will be physically and/or electronically destroyed. Contractor shall meet the standards as set forth in NIST 800-88 for destruction of data. All personal, sensitive, and confidential information shall be wiped from systems when the data is no longer necessary. The wipe method shall conform to Department of Defense standards for data destruction. Contractor will include with all returned materials, a letter attesting to the complete return of materials, and documentation evidencing the destruction of copies and derivations. Failure to so comply will subject the Contractor to liability, both criminal and civil, including all damages to the State and third parties. Contractor authorizes the State to inspect and verify the above. Any data that Contractor is legally required to maintain after contract termination is to be disclosed to Caltrans prior to contract initiation and again at contract termination.

4.21. COMPLIANCE WITH LAWS, REGULATIONS AND POLICIES

Contractor will comply with all federal and state laws, regulations and policies that are enacted, promulgated, or published and that govern the subject matter of this Agreement.

4.22. CONTACT INFORMATION

Direct security and privacy communications to the below referenced Caltrans staff. Caltrans reserves the right to make changes to the contact information below by giving written notice to the Contractor. Said changes shall not require an amendment to this Exhibit or the Agreement to which it is incorporated.

Caltrans Contract Manager

Security Officer (CISO)

CA Department of Transportation 1120 N Street Sacramento, CA 95814 Email: russ.watts@dot.ca.gov Telephone: (916) 217-8682 Russ Watts CA Department of Transportation 1120 N Street Sacramento, CA 95814 Email: russ.watts@dot.ca.gov Telephone: (916) 217-8682

References:

Department of General Services Procurement Division, INFORMATION TECHNOLOGY - GENERAL PROVISIONS CLOUD - COMPUTING SERVICES, DGS PD 402-ITGP (Cloud) SAM sections 4800 through 5900 et. seq.

SIMM 5300-B Information Security Foundational Framework SIMM 5315-B Cloud Security Standard SIMM 140 Cloud Security Guide Caltrans Policies, Procedures and Practices (available through Caltrans Contract Manager) Websites:

https://www.dgs.ca.gov https://cdt.ca.gov/policy/simm https://www.nist.gov/ Competitive Informal over $50,000 Request for Quote – IT Goods (Rev. 02/2025) Attachment 1

SECURITY AND PRIVACY GENERAL PROVISIONS

1. Definitions

0. “Documentation” means all specifications, user manuals, and any related documentation (including, without limitation, any written proposals, program manuals and marketing materials submitted by Licensor to Caltrans) for the operation and use of the Licensed Program(s) supplied to Caltrans by Licensor.

0. “Licensed Program” means any software program, programming aid, routine, subroutine, translation, Update, Upgrade, compiler and diagnostic routine offered by or through Licensor.

0. “Preventive Maintenance” means the maintenance performed, or required to be performed, by Licensor as set forth in the applicable documentation to keep the Licensed Program(s) in operating condition in accordance with the documentation. Preventive Maintenance shall include, without limitation: (A) debugging, coding, calibration, testing, integration, and any necessary adjustments, and (B) maintenance and engineering services necessary to install changes, modifications, and improvements made to any Licensed Program by Licensor at any time during the maintenance term specified under Section 2; and (C) automatic update services for any and all documentation furnished with any Licensed Program subject to maintenance under this Agreement.

0. “Project Manager” is the person in overall charge of the planning and execution of a particular project.

0. “Remedial Maintenance” means maintenance performed, or required to be performed, by Licensor upon the written or oral request of Caltrans to place the applicable Licensed Program back into operating condition in accordance with the documentation, after it has become inoperative or subject to malfunction.

0. “Response Time” means the time Licensor takes to respond to a service request.

0. “Update” means a release for the Licensed Programs containing error corrections and/or minor enhancements, in object code form, which is made commercially available by Licensor and generally indicated by a change in the revision number in the tenths or hundredths digit to the right of the decimal point (e.g., a change from version x.xx to x.xy or x.yx) and any corrections and updates to the associated documentation (as defined above)

0. “Upgrade” includes without limitation, enhancements, new releases, new versions of and other changes to any Licensed Program, including but not limited to Upgrades made after the Effective Date. Upgrades may be indicated by a change in the revision number in the whole numbers to the left of the decimal point (e.g., a change from version 1.xx to 2.xx) or by a new, renamed or successor product if the Licensor includes most of the functionalities of a Licensed Program into the new, renamed or successor product (regardless of whether other functionalities are added to or included in the new, renamed or successor product).

1. License: Licensor hereby grants to Caltrans a perpetual, irrevocable, paid-up, royalty-free, non-exclusive, worldwide license to install, execute and otherwise use any Licensed Program. Caltrans may utilize the Licensed Programs and Updates and Upgrades on any central processing unit of any size at all sites where Caltrans processes data, regardless of whether such central processing unit is owned, leased, or otherwise rented by Caltrans. In the event any software is used as a part of Licensed Program and it is owned by a third party (each, a “Third Party Program”), Licensor shall obtain for Caltrans a perpetual, irrevocable, paid-up, royalty-free, non-exclusive, worldwide license to the Third Party Program, and such license shall be a direct license grant from the third party to Caltrans and such license shall conform with the terms and conditions of this Agreement.

1. Maintenance Services: During the Term, Licensor agrees will provide Caltrans with the Preventive Maintenance services and Remedial Maintenance services in accordance with the Response Times set forth in Section 6 of this Exhibit G. Preventive Maintenance services and Remedial Maintenance services are in this Agreement are, collectively, called the Services. Licensor shall ensure that the Licensed Program functions, operates and performs in accordance with the provisions of this Agreement, the documentation, and the materials that are publicly distributed by Licensor regarding the Licensed Program with 99.9% uptime (excluding scheduled Contractor services from 8:00 a.m. through 5:00 a.m., local Pacific Time). Licensor shall only be obligated to support the then-current version of each Licensed Program at the time of acceptance of such Licensed Program by Caltrans, any subsequent Updates and Upgrade for such Licensed Program, and all prior versions of such Licensed Program, for a period of 12 months after the release of such Licensed Program or the applicable Update or Upgrade (whichever is later). In addition to the Services described in Sections 1.3 and 1.4 above, the Services shall also include, without limitation:

2. Telephone and Email Consultation: Licensor’s technical support staff shall provide Caltrans with “hotline” toll-free telephone and email consultation during the hours of 8:00 a.m. through 5:00 p.m., local Pacific Time, Monday through Friday.