STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025).
Section 21.5 (Encryption). The plan must include a regular system back up schedule for making backups, storing backups offsite, an inventory of backup media, and the amount of time to restore should it be lost. At a minimum, full onsite data backup must be performed weekly. Full offsite storage of backup data must be performed monthly.
21.12.3 Notification & Recovery: In the event of disaster or catastrophic failure that results in loss of State Data or extended loss of access to State Data, unless otherwise specified in the Statement of Work or where Contractor has no responsibility to host and no access to State Data, Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the State CISO or designee of Contracting agency. Contractor shall provide such notification within 24 hours after Contractor reasonably believes there has been such a disaster or catastrophic failure. In the notification, Contactor shall inform the State of:
(a) The scale and quantity of the State Data loss;
(b) What Contractor has done or will do to recover State Data and mitigate the effect of the State Data loss; and
(c) Corrective action(s) Contractor has taken or will take to prevent future State Data loss.
If Contractor fails to respond immediately and remedy the failure, the State may exercise its options for assessing damages or other remedies under the Contract.
21.12.4 Contractor shall repair and restore continuity of the System, Services, or data, in accordance with the RPO and RTO, as needed to meet the performance requirements stated in the Service Level Agreement, if applicable. Failure to do so may result in the State exercising its options for assessing damages or other remedies under the Contract.
21.13 INSPECTION & AUDIT OF CONTRACTOR'S SYSTEMS:
21.13.1 Inspection & Audit: Upon advance written request, Contractor agrees that the State or its designated representative shall have access to Contractor's system, data, operational documentation, records, and databases, including online inspections, that relate to the System, Services, or data purchased by the State under the Contract. The online inspection shall allow the State, its authorized agents, or a mutually acceptable third-party, to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:
(a) Operating system/network vulnerability scans;
(b) Web application vulnerability scans;
(c) Database application vulnerability scans; and
(d) Any other scans to be performed by the State or its authorized representatives.
Upon written request, Contractor shall provide the results of any independent tests performed by Contractor including the results of any penetration testing. The State shall maintain the confidentiality of any information provided by Contractor pursuant to this Section.
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025)
.21.13.2 Remediation: Contractor shall remediate vulnerabilities and correct flaws identified through testing and assessments within the State's designated time periods, or a mutually agreed upon time period with Contractor. Contractor will notify the State once corrections and remediation have been completed. Contractor shall implement security, policies, procedures, and practices to protect State Data as required by the Contract.
21.13.3 Post-Breach/Disaster Audit: After any Data Breach or after any disaster or catastrophic failure that results in a loss of State Data, Contractor shall at its expense, have an independent, industry-recognized, State-approved third-party perform an information security audit. State approval of the auditor will not be unreasonably withheld. The audit results shall be shared with the State within 7 Days of Contractor's receipt of such results.
Within 30 Days of receiving the results of the audit, Contractor will provide the State with written evidence of planned remediation and promptly modify its security measures to meet its obligations under the Contract.
21.14 ACCESS TO REPORTS:
Unless otherwise provided in the Statement of Work:
(a) Contractor shall maintain a Software bill of materials that includes, at a minimum, the details and supply chain relationships of the components used in the Software or Services. Contractor shall provide a copy of the Software bill of materials to the State upon request.
(b) Contractor shall maintain a U.S. Cybersecurity & Infrastructure Security Agency Secure Software Development Attestation Form, or equivalent attestation, and provide a copy of the attestation to the State upon request. The attestation shall state, at a minimum, that:
i. The Software will be developed and built in secure environments that are secured by, at a minimum; separating and protecting each environment involved in developing and building the Software; regularly logging, monitoring, and auditing trust relationships used for authorization and access to any Software development and build environments, as well as among components within each environment; enforcing multi-factor authentication and conditional access across the environments relevant to developing and building the Software in a manner that minimizes security risk; taking consistent and reasonable steps to document, as well as minimize use or inclusion of Software products that create undue risk within the environments used to develop and build the Software; encrypting sensitive data, such as credentials, to the extent practicable and based on risk; implementing defensive cybersecurity practices, including continuous monitoring of operations and alerts and, as necessary, responding to suspected and confirmed cyber incidents;
Contractor will make good-faith efforts to maintain trusted source code supply chains by employing automated tools or comparable processes to address the
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025)
security of internal code and third-party components and manage related vulnerabilities.
ili. Contractor will maintain provenance for internal code and third-party components incorporated into the Software to the greatest extent feasible. iv. Contractor will employ automated tools or comparable processes that check for security vulnerabilities; Contractor operates these processes on an ongoing basis and prior to product, version, or update releases; Contractor has a policy or process to address discovered security vulnerabilities prior to product release; and Contractor operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed Software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.
(c) Contractor and the State recognize that security responsibilities are shared. Contractor is responsible for providing a secure infrastructure, as applicable. Specific shared responsibilities are identified within the Statement of Work or Service Level Agreement.
21.15 BACKGROUND CHECKS:
Unless otherwise provided in the Statement of Work, and as permitted or required by law, Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty.
Contractor shall promote and maintain an awareness of the importance of securing the State's Data among Contractor's employees and agents.
21.16 SYSTEM SECURITY CONTROLS:
21.16.1 Patch Management: Unless otherwise provided in the Statement of Work, all of Contractor's workstations, laptops, and other systems that process or store State Data must have operating system and application security patches applied, with system reboot if necessary. Contractor shall maintain a documented patch management process which determines installation timeframe based on risk assessment. At a minimum, emergency vulnerability and active exploit) patches must be applied immediately, while critica vulnerability and no exploit known) patches must be applied within 30 Days of release. Al other applicable patches must be installed within 90 Days of release.
21.16.2 Endpoint Protection Standard: All Contractor workstations, laptops, and other systems used to process or store State Data must install and actively use a comprehensive endpoint protection solution that will, at a minimum, comply with SIMM 5335-A.
Section 22: GENERATIVE ARTIFICIAL INTELLIGENCE
22.1 DEFINITIONS:
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025)
For purposes of this Section, the following terms shall be given the meaning shown below.
Capitalized terms used below and not defined in this Section shall have the meaning set forth in Section 1 (Definitions) or in the text of these General Provisions (ITGP Non-Cloud).
22.1.1 Artificial Intelligence (Al): an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments (Gov Code §§ 11549.64 & 11546.45.5).
22.1.2 GenAl Training Data: any content, information, or data that is used to train, tune, test, or validate a GenAl, including text, images, video, audio, code, or similar types of input.
22.1.3 Generated Data: any output, results, content, or other data that is produced by GenAl, including but not limited to text, images, video, audio, code, or similar types of output.
22.1.4 Generative Al (GenAI): an Al system that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system's GenA! Training Data (Gov Code §11549.64).
22.1.5 Hallucination: Generated Data that is nonsensical, false, or misleading, and is not based on real or existing data, but is instead produced by bias or the GenAl's extrapolation or creative interpretation of its Gen Al Training Data.
22.1.6 Materially Impacts: shall have the same meaning set forth in State Administrative Manual (SAM) 4986.2.
22.1.7 Prompt: any written, spoken, or rendered information provided as a query, command, or other form of input, to any GenAl in connection with this Contract. For avoidance of doubt, Prompt includes any input automatically detected or created by the GenAl, as well as any derivate works of a Prompt or collection of Prompts.
22.2 GENAI DISCLOSURE OBLIGATIONS:
22.2.1 Disclosure Obligations:
Contractor must immediately notify the State in writing if it: (1) intends to provide GenAl as a Deliverable to the State; or (2) intends to utilize GenAl, including GenAl from third parties, to complete all or a portion of any Deliverable that materially impacts: (i) functionality of the System, (ii) risk to the State, or iiii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the same meaning set forth in State Administrative Manual (SAM) § 4986.2 Definitions for GenAl.
(b) Such notification shall be provided to the State designee identified in this Contract.
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025)
(c) At the direction of the State, Contractor shall discontinue the provision to the State of any previously unreported GenAl that results in a material impact to the functionality of the System, risk to the State, or Contract performance, as determined by the State. (d) If the use of previously undisclosed GenAl is approved by the State, then Contractor will update the Deliverable description, and the Parties will amend the Contract accordingly, which may include incorporating the GenAl Special Provisions into the Contract, at no additional cost to the State.
22.2.2 Failure to Disclose or Discontinue GenAl Use: The State, at its sole discretion, may consider Contractor's failure to disclose or discontinue the provision or use of GenAl as described above, to constitute a material breach of Contract when such failure results in a material impact to functionality of the System, risk to the State, or Contract performance. The State is entitled to seek any and all remedies available to it under law as a result of such breach, including but not limited to termination of the contract, for default pursuant to Section
16.3. 22.3 CONTRACTOR'S OBLIGATIONS FOR RESPONSIBLE USE:
22.3.1 Contractor shall ensure that it has obtained all necessary consents, permissions, and licenses from data subjects and third parties to use the GenAl for this Contract. Subject to Section 11, Contractor represents and warrants, it has the appropriate U.S. Intellectual Property Rights associated with any GenAl used in the Deliverables provided under the Contract.
22.3.2 Contractor shall ensure that the GenAl included, or made available as part of the Deliverables is equitable, non-discriminatory, and reasonably well-designed to avoid harmful, offensive, dangerous, and unlawful impact. (Government Code11549.63. Contractor shall be liable for any Hallucination produced by the GenAl that has an adverse impact on Generated Data or a Deliverable.
22.3.3 Contractor shall comply with all applicable laws and regulations, including as set forth in Section 13.1 above and these General Provisions in relation to the provision or use of any GenAl in the Deliverables.
22.4 GENAI TRAINING DATA OWNERSHIP:
Except as otherwise agreed to by the Parties, Contractor shall retain all ownership and intellectual property rights in the GenAl Training Data it provides.
22.5 RIGHTS TO STATE GENERATED DATA:
In addition to Government Purpose Rights set forth in Section 9, the Parties agree that Generated Data created from a State provided Prompt is not a derivative work of the GenAl Training Data. Notwithstanding the preceding sentence, in the event a court of competent jurisdiction determines that Generated Data created from a State-provided Prompt constitutes a derivative work of the GenAl Training Data, Contractor agrees to grant the State an unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive right, and license to
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD PROCUREMENT DIVISION
GOODS & SERVICES
DGS PD 403-ITGP Non-Cloud (REV. 02/20/2025)
use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Generated Data for any State Government Purpose Rights.
22.6 CONTRACTOR'S USE OF STATE DATA:
Contractor shall not incorporate any Non-Public State Data into GenAl Training Data and shall not otherwise utilize Non-Public State Data to train, tune, maintain, improve, or develop GenAl, except with the express written authorization from the State specifying the Non-Public State Data that may be used along with the acceptable scope of such usage.