STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS PROCUREMENT DIVISION
CLOUD COMPUTING SERVICES
DGS PD 402-ITGP Cloud (REV. 02/20/2025)
iv. Contractor will employ automated tools or comparable processes that check for security vulnerabilities; Contractor operates these processes on an ongoing basis and prior to product, version, or update releases; Contractor has a policy or process to address discovered security vulnerabilities prior to product release; and Contractor operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed Software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.
V. Contractor and the State recognize that security responsibilities are shared.
Contractor is responsible for providing a secure infrastructure, as applicable.
Specific shared responsibilities are identified within the Statement of Work or Service Level Agreement.
21.17 BACKGROUND CHECKS:
Unless otherwise provided in the Statement of Work, and as permitted or required by law, Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty.
Contractor shall promote and maintain an awareness of the importance of securing the State's Data among Contractor's employees and agents.
21.18 SYSTEM SECURITY CONTROLS:
21.18.1 Patch Management: Unless otherwise provided in the Statement of Work, all of Contractor's workstations, laptops, and other systems that process or store State Data must have operating system and application security patches applied, with system reboot if necessary. Contractor shall maintain a documented patch management process which determines installation timeframe based on risk assessment. At a minimum, emergency (vulnerability and active exploit) patches must be applied immediately, while critical (vulnerability and no exploit known) patches must be applied within 30 Days of release. All other applicable patches must be installed within 90 Days of release.
21.18.2 Endpoint Protection Standard: All Contractor workstations, laptops, and other systems used to process or store State Data must install and actively use a comprehensive endpoint protection solution that will at minimum comply with SIMM 5335-A.
Section 22: GENERATIVE ARTIFICIAL INTELLIGENCE
22.1 DEFINITIONS:
For purposes of this Section, the following terms shall be given the meaning shown below.
Capitalized terms used below and not defined in this Section shall have the meaning set forth in Section 1 (Definitions) or in the text of these General Provisions (ITGP Cloud).
22.1.1 Artificial Intelligence (AI): an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS PROCUREMENT DIVISION
CLOUD COMPUTING SERVICES
DGS PD 402-ITGP Cloud (REV. 02/20/2025)
receives how to generate outputs that can influence physical or virtual environments (Gov Code §§ 11549.64 & 11546.45.5).
22.1.2 GenAl Training Data: any content, information, or data that is used to train, tune, test, or validate a GenAl, including text, images, video, audio, code, or similar types of input.
22.1.3 Generated Data: any output, results, content, or other data that is produced by GenAl, including but not limited to text, images, video, audio, code, or similar types of output.
22.1.4 Generative Al (GenAl): an Al system that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system's GenAl Training Data (Gov Code §11549.64).
22.1.5 Hallucination: Generated Data that is nonsensical, false, or misleading, and is not based on real or existing data, but is instead produced by bias or the GenAl's extrapolation or creative interpretation of its Gen Al Training Data.
22.1.6 Materially Impacts: shall have the same meaning set forth in State Administrative Manual (SAM) 4986.2.
22.1.7 Prompt: any written, spoken, or rendered information provided as a query, command, or other form of input, to any GenAl in connection with this Contract. For avoidance of doubt, Prompt includes any input automatically detected or created by the GenAl, as well as any derivate works of a Prompt or collection of Prompts.
22.2 GENAI DISCLOSURE OBLIGATIONS:
22.2.1 Disclosure Obligations:
(a) Contractor must immediately notify the State in writing if it: (1) intends to provide GenAl as a Deliverable to the State; or (2) intends to utilize GenAl, including GenAl from third parties, to complete all or a portion of any Deliverable that materially impacts: (i) functionality of the System, (i) risk to the State, or (iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the same meaning set forth in State Administrative Manual (SAM) § 4986.2 Definitions for GenAl.
(b) Such notification shall be provided to the State designee identified in this Contract. (c) At the direction of the State, Contractor shall discontinue the provision to the State of any previously unreported GenAl that results in a material impact to the functionality of the System, risk to the State, or Contract performance, as determined by the State. (d) If the use of previously undisclosed GenAl is approved by the State, then Contractor will update the Deliverable description, and the Parties will amend the Contract accordingly, which may include incorporating the GenAl Special Provisions into the Contract, at no additional cost to the State.
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS PROCUREMENT DIVISION
CLOUD COMPUTING SERVICES
DGS PD 402-ITGP Cloud (REV. 02/20/2025)
22.2.2 Failure to Disclose or Discontinue GenAl Use: The State, at its sole discretion, may consider Contractor's failure to disclose or discontinue the provision or use of GenAl as described above, to constitute a material breach of Contract when such failure results in a material impact to functionality of the System, risk to the State, or Contract performance. The State is entitled to seek any and all remedies available to it under law as a result of such breach, including but not limited to termination of the contract, for default pursuant to Section
16.3. 22.3 CONTRACTOR'S OBLIGATIONS FOR RESPONSIBLE USE:
22.3.1 Contractor shall ensure that it has obtained all necessary consents, permissions, and licenses from data subjects and third parties to use the GenAl for this Contract. Subject to Section 11, Contractor represents and warrants, it has the appropriate U.S. Intellectual Property Rights associated with any GenAl used in the Deliverables provided under the Contract.
22.3.2 Contractor shall ensure that the GenAl included, or made available as part of the Deliverables is equitable, non-discriminatory, and reasonably well-designed to avoid harmful, offensive, dangerous, and unlawful impact. (Government Code11549.63. Contractor shall be liable for any Hallucination produced by the GenAl that has an adverse impact on Generated Data or a Deliverable.
22.3.3 Contractor shall comply with all applicable laws and regulations, including as set forth in Section 13.1 above and these General Provisions in relation to the provision or use of any GenAl in the Deliverables.
22.4 GENAI TRAINING DATA OWNERSHIP:
Except as otherwise agreed to by the Parties, Contractor shall retain all ownership and intellectual property rights in the GenAl Training Data it provides.
22.5 RIGHTS TO STATE GENERATED DATA:
In addition to Government Purpose Rights set forth in Section 9, the Parties agree that Generated Data created from a State provided Prompt is not a derivative work of the GenAl Training Data. Notwithstanding the preceding sentence, in the event a court of competent jurisdiction determines that Generated Data created from a State-provided Prompt constitutes a derivative work of the GenAl Training Data, Contractor agrees to grant the State an unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive right, and license to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Generated Data for any State Government Purpose Rights.
22.6 CONTRACTOR'S USE OF STATE DATA:
Contractor shall not incorporate any Non-Public State Data into GenAl Training Data and shall not otherwise utilize Non-Public State Data to train, tune, maintain, improve, or develop GenAl, except with the express written authorization from the State specifying the Non-Public State Data that may be used along with the acceptable scope of such usage.
STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICES
INFORMATION TECHNOLOGY GENERAL PROVISIONS PROCUREMENT DIVISION
CLOUD COMPUTING SERVICES
DGS PD 402-ITGP Cloud (REV. 02/20/2025)
.........