STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICE
SOFTWARE LICENSING PROGRAM (SLP)
CONTRACT NO. SLP-22-70-00270
ALLIED NETWORK SOLUTIONS INC
APPROVED:
CITY OF MERCED
A California Charter Municipal
Corporation
BY: D. Scott MeBride
City Manager
ATTEST:
D. SCOTT MCBRIDE, CITY CLERK
BY:
Assistant/Deputy City Clerk
APPROVED AS TO FORM:
CRAIG J. CORNWELL, CITY ATTORNEY
rEgai, Cornwell 4-23-20240
City Attorney
ACCOUNT DATA:
M. VENUS RODRIGUEZ
BY:
Verified by Finance Officer
Procurement Division
CALIFORNIA DEPARTMENT OF
DGS GENERAL SERVICES 707 Third Street, 2nd Floor, MS #2-202 West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP) AGREEMENT
AMENDMENT NO. 3
softwarelicensingprogram
Contractor: Allied Network Solutions, Inc
Contract Number: SLP-22-70-00270
SLP Contract Term: 01/01/2022 through 12/31/2027
Contract Base: Red Hat, Inc. Offer Number RedHat-SLP-2022 This amendment is being issued to:
• Extend the term of this SLP agreement through 12/31/2027 • All other terms and conditions remain the same.
For State of CA: For Contractor:
Digitally signed by Kimberley
Kimberley Hettrick Hetrick Date: 2025.09.23 13:33:32 -07:00 For Stephanne Lim Signature
Manager President/CEO
Multiple Award Programs Section Printed Title
Procurement Division
Department of General Services Roger Schnorenberg
Printed Name
9/23/25
Date Allied Network Solutions, Inc.
Company Name
September 12, 2025
Date
rocurement Division | State of California | California Government Operations Agenc 07 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-440( Procurement Division
CALIFOR A DEPARTMENT OF
DGS 707 Third Street, 2nd Floor, MS #2-202
GENERAL SERVICES
West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP)
AMENDMENT NO. 2
software icensingprogram
Contractor Allied Network Solutions, Inc
Contract Number: SLP-22-70-00270
SLP Contract Term: 1/1/2022 through 12/31/2025
Contract Base: Red Hat Offer Number RedHat-SLP-2022
This amendment is being issued to:
1. Remove all incorporated references to the state's general and special provisions and replace with the following provisions:
Information Technology - General Provisions - Cloud Computing Services, DGS PD 402-ITGP (Cloud), effective 02/20/2025
• Information Technology - General Provisions - Non-Cloud Goods & Services, DGS PD 403-ITGP (Non-Cloud), effective 02/20/2025
2. Remove the provision "GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REPORTING" and replace with the following provision:
GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI)
State agencies must follow the required GenAl purchase procedures outlined in the State Contracting Manual (SCM) and the California Department of Technology GenAl policies.
ALL OTHER TERMS AND CONDITIONS REMAIN THE SAME.
For State of CA:
Digitally signed by Julie Matthews
For Julie MattheWS Date: 2025.06.18 17:06:03-07°00
Stephanne Lim Signature
Manager President/CEO
Multiple Award Programs Section Printed Title
Procurement Division
Department of General Services Roger Schnorenberg
6/18/2025 Printed Name
Date Allied Network Solutions, Inc.
Company Name
May 2, 2025
Date
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400 Procurement Division
CALIFORNIA DEPARTMENT OF
DGS 707 Third Street, 2nd Floor, MS #2-202
GENERAL SERVICES
West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP)
softwarelicensingprogram
Contractor: Allied Network Solutions, Inc.
Contract Number: SLP-22-70-00270
SLP Contract Term: 01/01/2022 through 12/31/2025
Contract Base: Red Hat Offer Number RedHat-SLP-2022
This contract is available for use by State of California departments and any city, county, special district
make its own determination whether the SLP is consistent with their procurement policies and regulations.
The SLP Contractor is required to provide all SLP contract terms and conditions with the list of products, services and prices.
Terms and conditions listed below are hereby incorporated by reference and made a part of this SLP Agreement as if attached herein and shall apply to the purchase of goods or services made under this Participating Agreement. Contractor non-compliance with the requirements of this contract may result in contract termination.
By signing below, Contractor agrees to the General Provisions dated November 19, 2021, SaaS Cloud Computing Services Special Provisions dated March 15, 2018 and all other provisions included herein.
General Provisions - Information Technology (GSPD-401IT) effective 11/19/2021 Cloud Computing Services Special Provisions (Software as a Service) effective 3/15/2018
3) General Provisions - Information Technology Cloud Computing Software as a Service (SaaS) effective 11/19/2021
4) Cloud Computing Special Provisions for Infrastructure as a Service (laas) & Platform as a Service (Paas) effective 05/11/16
For State of CA: For Contractor:
Original Signature on File Original Signature on File
Patrick Mullen Signature
Manager
Multiple Award Programs Section
Printed Title
Procurement Division
Department of General Services
Printed Name
Date
Company Name
Date
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
CONTRACTOR PROVIDES COPY OF SLP Quarterly Business Activity Reports THE CONTRACT AND SUPPLEMENTS are due in the SLP Unit within two weeks after the end of each quarter as shown
The SLP Contractors are required to below:
provide the entire contract that consists of
the following: Quarter 1 Jan 1 to Mar 31 Due Apr 15
Quarter 2 Apr 1 to Jun 30 Due Jul 15
• SLP Cover sheet with signatures from Quarter 3 Jul 1 to Sep 30 Due Oct 15 the DGS Procurement Division Deputy Quarter 4 Oct 1 to Dec 31 Due Jan 15 Director or designee and Contractor.
• Ordering instructions. Each contractor is required to remit to the • Std. 204 Payee Data Record DGS-PD an incentive fee equal to 1.25% • SLP Contract terms and conditions of the total of all local government agency (General provisions). orders (excluding sales tax and freight) • Software License Agreement pricing. placed against their SLP contracts) for the • Supplements, if applicable applicable quarter.
CONTRACTOR QUARTERLY REPORTS The check covering this fee shall be made payable to the Department of General
Contractors are required to submit a Services, Software Licensing Program, and detailed report quarterly to the DGS be attached to the supporting SLP Procurement Division, Software Quarterly Report.
Licensing Program. A separate report is
required for each contract, as differentiated Mail report and check to:
by alpha suffix (if applicable). Contractors
Department of General Services
with resellers are responsible for reporting
Procurement Division, SLP Unit
reseller ordering activity. Any report that Quarterly Report Processing does not follow the required format or that
PO Box 989052, MS 2-202
excludes information will be deemed
Attn: Software Licensing Program
incomplete and returned to the contractor. West Sacramento, CA 95798-9052 All SLP contractors, including certified SLP Quarterly Reports which include a Small Businesses and Disabled Veteran
check made payable to the DGS-SLP Unit
Business Enterprises, will be required to
pay DGS-PD a 1.25% incentive fee for all must be mailed via hard-copy, and cannot be accepted via facsimile or e-mail.
orders placed by local government
agencies via a SLP contract. This policy New contracts for contractors with however, does not affect orders placed by existing contracts, and extensions or State government offices. State agencies renewals of existing contracts, will be will continue to be billed the applicable approved ONLY if the contractor has administrative use fee by the DGS-PD. submitted to the SLP Unit all quarterly reports, due. Each quarterly report is
The SLP Quarterly Business Activity
required within two weeks of the end of
Report form separates sales to State and March, June, September, and December local government agencies. of each calendar year. A report is required even when there is no activity.
BUILDING GREEN • BUYING GREEN • WORKING GREEN 2
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
The report must include the agency name, If this certification has expired, the current purchase order number, purchase order expiration date for this company's date, state agency billing code, pre-tax certification should be verified at:
total order cost, agency contact name, CaleProcure (https://caleprocure.ca.gov/ address and phone number, and total pages/index.aspx) or by contacting the dollars for the quarter. Tax must NOT be Office of Small Business and DVBE included in the quarterly report, even if the Services at (916) 375-4940. Note that agency includes tax on the purchase order. some companies have been assigned a new certification number, so use the
A sample quarterly report indicating company name and/or certification number required format and information is attached when checking status on-line. for your reference (Attachment A).
AGENCY NON-COMPLIANCE
CONTRACTOR INVOICES
Agency non-compliance with the
Unless otherwise stipulated, the contractor requirements of this contract may result in must send their invoices to the department the loss of delegated purchasing authority address set forth in the purchase order. to use the SLP.
Invoices shall be submitted in triplicate and
shall include the following: PLEASE REQUEST A COPY OF ALL
CONTRACT TERMS AND CONDITIONS
• Contract number FROM THE CONTRACTOR, IF NOT
• Agency purchase order number PROVIDED INITIALLY.
• State Agency Bill Code
• Line item number AVAILABLE PRODUCTS AND/OR
• Unit price SERVICES
• Extended line item price This contract provides for the purchase • Invoice total
and warranty of software, software
maintenance, technical support, training,
State sales tax and/or use tax shall be
itemized separately and added to each installation, software as a service, infrastructure as a service, platform as a
invoice as applicable. The company name service, and implementation services. on the SLP contract, purchase order and
invoice must match or the State
Only products from the manufacturer listed
Controller's Office will not approve
below are available within the scope of this
payment. contract:
CONTRACTOR OWNERSHIP • Red Hat
INFORMATION
UNAVAILABLE PRODUCTS AND/OR
Allied Network Solutions, Inc. is a large SERVICES
business enterprise.
The following products and/or services are
They are also a certified disabled veteran not available under this contract:
business enterprise, and their OSDS
certification #24852 expires on 06/30/2022. • STANDALONE HARDWARE BUILDING GREEN BUYING GREEN WORKING GREEN 3
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
• CONSULTING Requirements
• STANDALONE TRAINING
• STANDALONE INSTALLATION • State departments must complete a SERVICES Statement of Work (SOW) for all
Implementation services.
Notice to State Agencies: Software
appliances/hardware products offered • Job titles/categories are limited to those under the Software Publisher's pricelist are identified in the SLP price list.
NOT available under the Software
• Hourly rates must not exceed those
Licensing Program (SLP) if the same type
of software appliance/hardware products identified in the SLP price list. are currently available under any
• Implementation services can only be
mandatory Statewide Contract. State
purchased when they are in support of
agencies who want to purchase a software
software purchased under the SLP.
appliance/hardware product type, other
than what is available through a
• Time and Material pricing must not
mandatory Statewide Contract must submit exceed the job Title hourly rate times an exemption request to the mandatory
the number of hours to complete the job.
Statewide Contract Administrator. For
more information and the required NOTE: Implementation Services under justification forms regarding the exemption this contract must be paid in arrears. process, please refer to the following
website: ACQUISITION OF IAAS AND/OR PAAS
https://www.dgs.ca.gov/PD/Services/Page-
Content/Procurement-Division-Services- If using this SLP for the purpose of List-Folder/Request-an-IT-Hardware-
acquiring Infrastructure as a Service (laas)
Contract-Exemption. This restriction does and/or Platform as a Service (PaaS), State not apply to local governmental agencies. agencies must first obtain approval to use INSTALLATION SERVICES this SLP by the California Department of Technology (CDT) in accordance with TL
• Installation Services can only be 17-06 (www.cdt.ca.gov/wp- purchased when they are in support of content/uploads/2017/08/TL-17-06.pdf). software purchased under this SLP State agencies must document CDT's contract. approval and maintain in the procurement
• Installation Services must not exceed file. Contact CDT for all questions related the total cost of the software. to the acquisition of laaS and PaaS and TL 17-06.
IMPLEMENTATION SERVICES
SOFTWARE MAINTENANCE,
Before procuring Implementation Services, SUBSCRIPTION AND SAAS RENEWALS state departments should conduct an
analysis and use their own due diligence to Software Maintenance, Subscription and determine if these services are the most SaaS renewals shall be fixed at the cost effective solution that meets their agencies prior applicable rates (or lower), business needs and security requirements. with a 0% uplift (no up-lift) and no BUILDING GREEN • BUYING GREEN WORKING GREEN 4
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
additional increases, fees or charges necessity of the services, securing added, for the duration of this SLP appropriate funding, complying with laws and policies, preparing the purchase order
FIRST-YEAR MAINTENANCE in a manner that safeguards the State's interests, obtaining required approvals, and
First-year Maintenance for software documenting compliance with Government products are inclusive of subscription. Code 19130.b (3) for outsourcing services.
ISSUE PURCHASE ORDER TO It is the responsibility of each agency to consult as applicable with their legal staff
Agency purchase orders must be mailed to and contracting offices for advice the following address, or e-mail: depending upon the scope or complexity of Allied Network Solutions, Inc. the purchase order.
5718 Lonetree Boulevard
If you do not have legal services available
Rocklin, CA 95765 to you within your agency, the DGS Office Attn: Roger Schnorenberg of Legal Services is available to provide services on a contractual basis.
Agencies with questions regarding
products and/or services may contact the ORDER REQUIREMENTS AND contractor as follows: MAXIMUM ORDER LIMIT
Phone: (916) 774-2670 Ext. 101 • Unless otherwise determined by an E-mail: [email protected] individual ordering agency purchasing SHIPPING INSTRUCTIONS authority, no SLP order may be
executed by a State agency that
F.O.B. (Free On Board) Destination exceeds that agency's purchasing authority threshold. State agencies with
DELIVERY approved purchasing authority, along
with their dollar thresholds can be
30 days after receipt of order, or as obtained at the List of State negotiated between agency and Contractor Departments with Approved Purchasing and included in the purchase order. Authority.
• Agencies must adhere to the detailed
AGENCY RESPONSIBILITY requirements in the State Contracting Manual (SCM) when using SLP
Agencies must contact contractors to contracts. The requirements for the obtain copies of the contracts and compare following bullets are in the SCM, Volume them for a best value purchasing decision. 3, (for IT): If soliciting offers from a certified DVBE, include the Disabled
Each agency is responsible for its own Veteran Business Enterprise contracting program and purchasing Declarations form (Std. 843) in the decisions, including use of the SLP Request for Offer. This declaration program and associated outcomes. must be completed and returned by the This responsibility includes, but is not DVBE prime contractor and/or any DVBE subcontractors. (See the SCM
necessarily limited to, ensuring the
Volume 3, Chapter 3)
BUILDING GREEN • BUYING GREEN • WORKING GREEN 5
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
• This is not a bid transaction, so the State departments shall use a small business preference, DVBE Contract/Delegation Purchase Order participation goals, protest language, (Std. 65) for purchases and services. intents to award, evaluation criteria,
advertising, etc., are not applicable. Local governments shall, in lieu of the • If less than 3 offers are received, State State's Purchase Order (Std. 65), use agencies must document their file with their own purchase order document. the reasons why the other suppliers
solicited did not respond with an offer. Electronic copies of the State Standard Forms can be found at the Office of
• Assess the offers received using best
value methodology, with cost as one of State Publishing web site:
the criteria. http://www.dgs.ca.gov/osp (select
Standard Forms). The site provides
• Issue a Purchase Order to the selected
information on the various forms and
contractor. use with the Adobe Acrobat Reader.
• For SLP transactions under $10,000,
Beyond the Reader capabilities, Adobe
only one offer is required if the State Acrobat advanced features may be agency can establish and document that utilized if you have Adobe Business the price is fair and reasonable. The fair Tools or Adobe Acrobat 4.0 installed on and reasonable method can only be your computer. Direct link to the used for non-customizable purchases. Standard Form 65:
(http://www.osp.dgs.ca.gov/pdf/std065.p
Local governments set their own order
limits, and are not bound by the order limits df)
on the cover page of this contract. 2. Purchase Orders
SPLITTING ORDERS All Ordering Agency purchase order
documents executed under this SLP
Splitting orders to avoid any monetary
must contain the applicable SLP
limitations is prohibited.
contract number as show on page 1.
Do not circumvent normal procurement
methods by splitting purchases into a 1. State Departments:
series of delegated purchase orders (SAM Std. 65 Purchase Documents - 3572). State departments not transacting
Splitting a project into small projects to in FI$Cal must use the Purchasing avoid either fiscal or procedural controls is Authority Purchase Order (Std. 65) for purchase execution. An
prohibited (SAM 4819.34).
electronic version of the Std. 65 is
MINIMUM ORDER LIMITATION available at the DGS-PD website at http://www.dgs.ca.gov/
There is no minimum dollar value limitation pd/Forms.aspx (select Standard on orders placed under this contract. STD Forms).
ORDERING PROCEDURES FI$Cal Purchase Documents -
State departments transacting in
1. Order Form FI$Cal will follow the FI$Cal
BUILDING GREEN • BUYING GREEN WORKING GREEN 6
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
procurement and contracting APPROVED BY DGS PROCUREMENT procedures. DIVISION SOFTWARE LICENSING
PROGRAM.
2. Local Governmental Departments:
Said documents are to be sent to the
Local governmental agencies may Department of General Services (DGS) use their own purchase document Procurement Division, Soffware Licensing for purchase execution. Program, 707 Third Street, 2nd Floor, West Sacramento, CA 95605-2811, Attention
The agency is required to complete and SLP Unit.
distribute the order form. For services,
the agency shall modify the information CONTRACT EXTENSIONS contained on the order to include the
service period (start and end date), and The initial term of this SLP contract is 3 the monthly cost (or other intermittent years and may be extended for an cost), and any other information additional 2-years, however an amendment pertinent to the services being provided. must be issued prior to contract end date.
The cost for each line item should be NOTE: Extensions are optional and are included in the order, not just system at the discretion of the state. totals.
SMALL BUSINESS MUST BE
The contractor must immediately reject CONSIDERED
orders that are not accurate.
Discrepancies are to be negotiated and Prior to placing orders under the SLP, state incorporated into the order prior to the departments shall, whenever practicable, products and services being delivered. first consider offers from small businesses that have established SLP contracts [GC
3. Service and Delivery after Contract Section 14846(b)]. NOTE: The Expiration Department of General Services auditors
will request substantiation of compliance
Purchase orders must be issued before with this requirement when department the SLP contract end term expires. files are reviewed.
Also, purchase order amendments SMALL BUSINESS/DVBE - TRACKING cannot be issued to add product and
software maintenance if the SLP State departments are able to claim contract end term has expired. subcontracting dollars towards their small business or DVBE goals whenever the
CONTRACT PRICES Contractor subcontracts a commercially
useful function to a certified small business
Contract prices for products and/or or DVBE. The Contractor will provide the services are maximums. The ordering ordering department with the name of the department is encouraged to negotiate small business or DVBE used and the lower prices. dollar amount the ordering department can apply towards its small business or DVBE
PRODUCT AND PRICING CHANGES goal.
AND/OR UPDATES ARE NOT
AUTHORIZED UNTIL REVIEWED AND
BUILDING GREEN BUYING GREEN WORKING GREEN 7
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
SMALL BUSINESS/DVBE - 3. The ordering department's purchase SUBCONTRACTING order must be addressed to the prime
Contractor, and the purchase order
1. The amount an ordering department must reference the information provided can claim towards achieving its small by the prime Contractor as outlined business or DVBE goals is the dollar above.
amount of the subcontract award made
by the Contractor to each small PRODUCTIVE USE REQUIREMENTS business or DVBE
2. The Contractor will provide an ordering The customer in-use requirement applies department with the following to all procurements of information information at the time the order is technology equipment and software, per quoted: the SCM, Volume 3, Chapter 2, Section
2.B6.2 and SCM, Volume FI$Cal, Chapter
a. The Contractor will state that, as the 2, Section 2.E3.2. prime Contractor, it shall be
responsible for the overall execution Each equipment or software component of the fulfillment of the order. must be in current operation for a paying customer and the paying customer must be
b. The Contractor will indicate to the external to the contractor's organization ordering department how the order (not owned by the contractor and not meets the small business or DVBE owning the contractor). goal, as follows:
To substantiate compliance with the
• List the name of each company Productive Use Requirements, the SLP that is certified by the Office of contractor must provide upon request the Small Business and DVBE name and address of a customer
Certification that it intends to installation and the name and telephone subcontract a commercially number of a contact person.
useful function to; and
Include the small business or The elapsed time such equipment or DVBE certification number of software must have been in operation is each company listed, and attach based upon the importance of the a copy of each certification; and equipment or software for system Indicate the dollar amount of operation and its cost. The following •
each subcontract with a small designates product categories and the business or DVBE that may be required period of time for equipment or claimed by the ordering software operation prior to approval of the department towards the small replacement item on SLP.
business or DVBE goal; and
Category 1 - Critical Software: Critical
• Indicate what commercially software is software that is required to useful function the small
control the overall operation of a computer
business or DVBE subcontractor
system or peripheral equipment. Included
will be providing towards in this category are operating systems, fulfillment of the order.
data base management systems, language
interpreters, assemblers and compilers,
BUILDING GREEN • BUYING GREEN WORKING GREEN 8
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
communications software, and other APPLICABLE CODES, POLICIES AND essential system software. GUIDELINES
Final Bid All California codes, policies and guidelines Cost Installation Submission are applicable. THE USE OF THE SLP More than DOES NOT REDUCE OR RELIEVE
$100,000 8 months 6 months STATE DEPARTMENTS OF THEIR
$10,000 up to RESPONSIBILITY TO MEET STATEWIDE
$100,000 4 months 3 months REQUIREMENTS REGARDING
Less than CONTRACTING OR THE
$10,000 1 month 1 month PROCUREMENT OF GOODS OR
SERVICES. Most procurement and
Category 2 - All Information Technology contract codes, policies, and guidelines are Equipment and Non-Critical Software: incorporated into The SLP contracts.
Information technology equipment is Notwithstanding this, there is no guarantee defined in State Administrative Manual that "every" possible requirement that (SAM) § 4819.2. pertains to all the different and unique state processes has been included.
Final Bid
Cost Installation Submission TERMINATION OF SLP CONTRACT More than
$100,000 6 months 4 months 1. The State or Contractor may terminate $10,000 up this SLP Contract at any time upon 30
to $100,000 4 months 3 months days prior notice.
Less than 2. Upon termination or other expiration of
$10,000 1 month 1 month this Contract, each party will assist the other party in orderly termination of the
STATE AND LOCAL GOVERNMENTS Contract and the transfer of all assets, CAN USE THE SLP tangible and intangible, as may
facilitate the orderly, nondisrupted
State and local government use of the SLP business continuation of each party. contracts is optional. A local government 3. This provision shall not relieve the is any city, county, special district or other Contractor of the obligation to perform local governmental body or corporation, under any purchase order or other including UC, K-12 schools and community similar ordering document executed colleges, prior to the termination becoming
effective.
that is empowered to expend public funds.
While the state makes this contract STATEWIDE PROCUREMENT available, each local government agency REQUIREMENTS
should make its own
Departments must carefully review and
determination whether the SLP is adhere to the following Procurement consistent with their procurement policies Requirements, such as:
and regulations.
• SAM Section 4819.41 and 4832
certifications for information technology
BUILDING GREEN BUYING GREEN WORKING GREEN 9
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
procurements and compliance with PAYMENTS AND INVOICES
policies.
• Services may not be paid for in 1. Payment Terms
advance.
Payment will be made in accordance
• Departments are required to file with the
with the provisions of the California
Department of Fair Employment and
Prompt Payment Act, Government
Housing (DFEH) a Contract Award Code Section 927 et. seq. Unless Report Std. 16 for each order over
expressly exempted by statute, the
$5,000 within 10 days of award,
Act requires State agencies to pay
including supplements that exceed
properly submitted, undisputed
$5,000.
invoices not more than 45 days after
• Pursuant to Unemployment Insurance
(i) the date of acceptance of goods or
Code Section 1088.8, state and local performance of services; or (i) receipt government agencies must report to the of an undisputed invoice, whichever is Employment Development Department later.
(EDD) all payments for services that
equal $600 or more to independent sole 2. Advance Payments proprietor contractors. See the
contractor's Std. Form 204, Payee Data Advance payment is allowed for Record, in the SLP contract to services only under limited, narrowly determine sole proprietorship. All defined circumstances, e.g. between inquiries regarding this subject should specific departments and certain be forwarded to EDD: Technical types of non-profit organizations, or questions: 916/651-6945 or Information when paying another government and forms: 916/657-0529. agency (Government Code (GC) § • Annual small business and disabled 11256 - 11263 and 11019). veteran reports.
It is NOT acceptable to pay in
ETHNICITY/RACE/GENDER REPORTING advance, except software REQUIREMENT maintenance and license fees, which
are considered a subscription and
Effective July 1, 2002, in accordance with may be paid in advance if a provision Public Contract Code 10116, state addressing payment in advance is departments are to capture information on included in the purchase order. ethnicity, race, and gender of business
owners (not subcontractors) for all Software warranty upgrades and awarded contracts, including CAL-Card extensions may also be paid for in transactions. Each department is required advance, one time. to independently report this information to
the Governor and the Legislature on an 3. Payee Data Record (Std. 204) annual basis.
State Agencies not transacting in
Departments are responsible for FI$Cal, must obtain a copy of the developing their own guidelines and forms Payee Data Record (Std. 204) in for collecting and reporting this information, order to process payments. State Ordering Agencies forward a copy of
Contractor participation is voluntary.
BUILDING GREEN • BUYING GREEN WORKING GREEN 10
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270
the Std. 204 to their accounting ublished as Part Vil of the May 26, 198 office(s). Without the Std. 204, ederal Register (pages 19160-19211 payment may be unnecessarily
delayed. . State Agencies should AMERICANS WITH DISABILITY ACT contact the Contractor for copies of (ADA)
the Payee Data Record
(See attachment B)
4. DGS Administrative and Incentive
Fees DGS PROCUREMENT DIVISION
CONTACT AND PHONE NUMBER
Orders from State Agencies:
Department of General Services
The Department of General Services Procurement Division, SLP Unit (DGS) will bill each State agency 707 Third Street, 2nd Floor directly an administrative fee for use West Sacramento, CA 95605-2811 of SLP contracts. The administrative
Phone no.: 916/375-4365
fee should NOT be included in the
Faxination no.: 916/376-6371
order total, nor remitted betore an
invoice is received from DGS.
5. Credit Card
Allied Network Solutions, Inc. accepts
the State of California credit card
(CAL-Card).
A Purchasing Authority Purchase
Order (Std. 65) is required even when
the ordering department chooses to
pay the contractor via the CAL-Card.
Also, the DGS administrative fee is
applicable for all SLP orders to
suppliers not California certified as a
small business.
FEDERAL DEBARMENT
When federal funds are being expended,
the department is required to obtain (retain
in file) a signed "Federal Debarment"
certification from the contractor before the
purchase order is issued. This
certification is required by the regulations
implementing Executive Order 12549,
Debarment and Suspension, 29 CFR Part
98, Section 98.510, Participants;
responsibilities. The regulations were
BUILDING GREEN • BUYING GREEN WORKING GREEN 11
ATTACHMENT A
SLP QUARTERLY BUSINESS ACTIVITY REPORT
Company Name: Reporting Calendar Year:
Software Publisher: • Q1 (January to March)
Reporting Quarter:
Contract Number: • Q2 (April to June)
For Questions Regarding this Report: • Q3 (July to September) E-mail: • Q4 (October to December)
Check Here if No New Orders for This Quarter |
STATE GOVERNMENT AGENCY PURCHASES
Total Dollars Phone
State Agency Purchase Purchase Agency
Per Purchase Agency Contact Agency Address Number
Name Order Number Order Date Billing Code
Order
Total State Agency Dollars Reported for Quarter: $
LOCAL GOVERNMENT AGENCY PURCHASES
Local Government Agency Purchase Order Purchase Total Dollars Per Agency Phone Agency Address Number
Name Number Order Date Purchase Order
Total Local Government Agency Dollars for Quarter: $
1.25% Remitted to DGS (does not apply to CA certified Small Businesses): $ Total of State and Local Government Agency Dollars Reported for this Quarter: $ Updated 7/2019
ATTACHMENT A
SLP QUARTERLY BUSINESS ACTIVITY REPORT
Instructions for completing the SLP Quarterly Business Activity Report.
1. Complete the top of the form with the appropriate information for your company.
2. Agency Name - Identify the State agency or Local Government agency that issued the order.
3. Purchase Order Number - Identify the purchase order number (and amendment number if applicable) on the order form. This is not your invoice number. This is the number the State agency or Local Government agency assigns to the order.
4. Purchase Order Date - Identify the date the purchase order was issued, as shown on the order. This is not the date you received, accepted, or invoiced the order.
5. Agency Billing Code - Identify the State agency billing code. This is a five-digit number identified on the upper right hand corner of the Std. 65 purchase order form.
You must identify this number on all purchases made by State of California agencies.
Billing codes are not applicable to Local Government agencies.
6. Total Dollars Per PO - Identify the total dollars of the order excluding tax and freight.
Tax must NOT be included in the quarterly report, even if the agency includes tax on the purchase order. The total dollars per order should indicate the entire purchase order amount (less tax and freight) regardless of when you invoice order, perform services, deliver product, or receive payment.
7. Agency Contact - Identify the ordering agency's contact person on the purchase order.
8. Agency Address - Identify the ordering agency's address on the purchase order.
9. Phone Number - Identify the phone number for the ordering agency's contact person.
10. Total State Sales & Total Local Sales - Separately identify the total State dollars and/or Local Government agency dollars (pre-tax) for all orders placed in quarter.
11. 1.25% Remitted to DGS - Identify 1.25% of the total Local Government agency dollars reported for the quarter.
12. Grand Total - Identify the total of all State and Local Government agency dollars reported for the quarter.
Notes:
• A report is required for each SLP contract each quarter even when there are no new orders for the quarter.
• Quarterly reports are due two weeks after the end of the quarter.
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400
ATTACHMENT B
ADA NOTICE
Procurement Division (State Department of General Services)
AMERICANS WITH DISABILITIES ACT (ADA) COMPLIANCE
POLICY OF NONDISCRIMINATION ON THE BASIS OF DISABILITY
To meet and carry out compliance with the nondiscrimination requirements of the Americans With Disabilities Act (ADA), it is the policy of the Procurement Division (within the State Department of General Services) to make every effort to ensure that its programs, activities, and services are available to all persons, including persons with disabilities.
For persons with a disability needing a reasonable accommodation to participate in the Procurement process, or for persons having questions regarding reasonable accommodations for the Procurement process, please contact the Procurement Division at (916) 375-4400 (main office); the Procurement Division TTY/TDD (telephone device for the deaf) or California Relay Service numbers which are listed below. You may also contact directly the Procurement Division contact person who is handling this procurement.
IMPORTANT: TO ENSURE THAT WE CAN MEET YOUR NEED, IT IS BEST THAT WE RECEIVE YOUR REQUEST AT LEAST 10 WORKING DAYS
BEFORE THE SCHEDULED EVENT (i.e., MEETING, CONFERENCE,
WORKSHOP, etc.) OR DEADLINE DUE-DATE FOR PROCUREMENT
DOCUMENTS.
The Procurement Division TTY telephone numbers are:
Sacramento Office: (916) 376-1891
Fullerton Office: (714) 773-2093
The California Relay Service Telephone Numbers are:
Voice: 1-800-735-2922 or 1-888-877-5379
TTY: 1-800-735-2929 or 1-888-877-5378
Speech-to-Speech: 1-800-854-7784
Updated 2/06/2018 14
Procurement Division
CALIFORNIA DEPARTMENT OF
DGS 707 Third Street, 2nd Floor, MS #2-202
GENERAL SERVICES
West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP)
AMENDMENT NO. 1
softwarelicensingprogram
Contractor: Allied Network Solutions, Inc.
Contract Number: SLP-22-70-00270
SLP Contract Term: 1/1/2022 through 12/31/2025
Contract Base: Red Hat Offer Number RedHat-SLP-2022
This amendment is being issued to:
Add the provision "GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REPORTING"
GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REPORTING
1. State Agencies
State agencies are required to obtain a GenAl Reporting and Factsheet (STD 1000) from the Contractor prior to award.
If GenAl is disclosed by the Contractor, state agencies must follow the required GenAl purchase procedures outlined in State Contracting Manual (SCM) Volume 2, Chapter 23, Generative Artificial Intelligence (GenAl). State agencies must retain the STD 1000 and confirmation the purchase may proceed in their procurement file.
2. Contractor
Upon request by an ordering agency, Contractor must complete a GenAl Reporting and Fact Sheet (STD 1000) to identify if their solution or service includes, or makes available, any GenAl including, GenAl from third parties or subcontractors.
During the term of the contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAl technology, including GenAl from third parties or subcontractors. Contractor shall immediately complete the GenAl Reporting and Factsheet (STD 1000) to notify the State of any new or previously unreported GenAl technology.
At the direction of the State, Contractor shall discontinue the use of any new or previously undisclosed GenAl technology that materially impacts functionality, risk or contract performance, until use of such GenAl technology has been approved by the State.
Failure to disclose GenAl use to the State and submit the GenAl Reporting and Factsheet (STD 1000) may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAl and/or failure to submit the GenAl Reporting and Factsheet (STD 1000) as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief to which it may be entitled to as a result of such non-disclosure.
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2n°Floor | West Sacramento, CA 95605 | t 916.375-4400
SOFTWARE LICENSING PROGRAM (SLP)
ALLIED NETWORK SOLUTIONS, INC.
SLP-22-70-00270 AMENDMENT NO. 1
The State reserves the right to amend the contract, without additional cost, to incorporate GenAl Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.
If Contractor identifies GenAl in their solution, a copy of the STD 1000 must be submitted to the State Contract Administrator.
ALL OTHER TERMS AND CONDITIONS REMAIN THE SAME.
For State of CA: For Contractor:
Original Signature on File Original Signature on File
Stephanne Lim Signature
Manager
Multiple Award Programs Section
Procurement Division Printed Title
Department of General Services
Printed Name
10/22/2024
Date
Company Name
Date
BUILDING GREEN • BUYING GREEN • WORKING GReEN 2
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
THESE SPECIAL PROVISIONS ARE ONLY TO BE USED FOR SOFTWARE AS A SERVICE (SaaS), AS DEFINED BELOW. THESE SPECIAL PROVISIONS ARE TO BE ATTACHED TO THE GENERAL PROVISIONS -
INFORMATION TECHNOLOGY AND SHOULD BE ACCOMPANIED BY, A STATEMENT OF WORK (SOW) AND SERVICE LEVEL AGREEMENT (SLA). SECURITY REQUIREMENTS DESIGNATED IN THIS DOCUMENT ARE
ASSUMING A NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) LOW CLASSIFICATION, UNLESS OTHERWISE SET FORTH IN THE SOW. A HIGHER CLASSIFICATION MAY REQUIRE DIFFERENT SECURITY REQUIREMENTS. STATE AGENCIES MUST FIRST:
A. CLASSIFY THEIR DATA PURSUANT TO THE CALIFORNIA STATE ADMINISTRATIVE MANUAL (SAM) 5305.5;
3. CONSIDER THE FACTORS TO BE TAKEN INTO ACCOUNT WHEN SELECTING A PARTICULAR TECHNOLOGICAL APPROACH, IN ACCORDANCE WITH SAM 4981.1, 4983 AND 4983.1 AND THEN:
C. MODIFY THESE SPECIAL PROVISIONS THROUGH THE SOW AND/OR SLA TO MEET THE NEEDS OF EACH ACQUISITION.
1. Definitions
"Cloud Software as a Service (SaaS)" - The capability provided to the consumer is to use applications made available by the provider running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.
, "Cloud Platform as a Service (PaaS)" - The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations c) "Cloud Infrastructure as a Service (laaS)" - The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems; storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).
d) "Data" - means any information, formulae, algorithms, or other content that the State, the State's employees, agents and end users upload, create or modify using the SaaS pursuant to this Contract. Data also includes user identification information and metadata which may contain Data or from which the State's Data may be ascertainable.
e) "Data Breach" - means any access, destruction, loss, theft, use, modification or disclosure of Data by an unauthorized party or that is in violation of Contract terms and/or applicable state or federal law. f) "Encryption" - Conversion of plaintext to ciphertext through the use of a Federal Information Processing Standards (FIPS) validated cryptographic algorithm. [FIPS 140-2] g) "Recovery Point Objective (RPO)" - means the point in time to which Data can be recovered and/or systems restored when service is restored after an interruption. The Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup of Data immediately preceding the interruption. The RPO is detailed in the SLA.
DGS Procurement Division Page 1 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
h) "Recovery Time Objective (RTO)" - means the period of time within which information technology services, systems, applications and functions must be recovered following an unplanned interruption. The RTO is detailed in the SLA.
Terms
2. SaaS AVAILABILITY: Unless otherwise stated in the Statement of Work, The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon maintenance downtime).
b) If SaaS monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to recover damages, apply credits or use other contractual remedies as set forth in the Statement of Work.
c) If SaaS monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), for three (3) or more months in a rolling twelve-month period, the State may terminate the contract for material breach in accordance with the Termination for Default provision in the General Provisions - Information Technology.
d) Contractor shall provide advance written notice to the State in the manner set forth in the Statement of Work of any major upgrades or changes that will affect the SaaS availability.
3. DATA AVAILABILITY: Unless otherwise stated in the Statement of Work, a) The Data shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon maintenance downtime).
b) If Data monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to recover damages, apply credits or use other contractual remedies as set forth in the Statement of Work if the State is unable to access the Data as a result of:
1) Acts or omission of Contractor;
2) Acts or omissions of third parties working on behalf of Contractor; 3) Network compromise, network intrusion, hacks, introduction of viruses, disabling devices, malware and other forms of attack that can disrupt access to Contractor's server, to the extent such attack would have been prevented by Contractor taking reasonable industry standard precautions; 4) Power outages or other telecommunications or Internet failures, to the extent such outages were within Contractor's direct or express control.
c) If Data monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), for three (3) or more months in a rolling twelve-month period, the State may terminate the contract for material breach in accordance with the Termination for Default provision in the General Provisions - Information Technology.
4. SaaS and DATA SECURITY:
a) In addition to the Compliance with Statutes and Regulations provision set forth in the General Provisions - Information Technology, Contractor shall certify to the State:
1) The sufficiency of its security standards, tools, technologies and procedures in providing Saas under this Contract;
2) Compliance with the following:
i. The California Information Practices Act (Civil Code Sections 1798 et seq.); ii. Current NIST special publications 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. Third party audit results and Contractor's plan to correct any negative findings shall be made available to the State upon request; DGS Procurement Division Page 2 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
ili. Undergo an annual Statement on Standards for Attestation Engagements (SSAE) No. 16 Service Organization Control (SOC) 2 Type Il audit. Third party audit results and Contractor's plan to correct any negative findings and implementation progress reports shall be made available to the State upon request; and
iv. Privacy provisions of the Federal Privacy Act of 1974; 3) Compliance with industry standards and guidelines applicable to the SaaS services being provided.
Relevant security provisions may include, but are not limited to: Health Insurance Portability and Accountability Act of 1996, IRS 1075, Health Information Technology for Economic and Clinical (HITECH) Act, Criminal Justice Information Services (CJIS) Security Policy, Social Security Administration (SSA) Electronic Information Exchange Security Requirements, and the Payment Card Industry (PCI) Data Security Standard (DSS) as well as their associated Cloud Computing Guidelines.
b) Contractor shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the State's access to its Data.
c) Contractor shall allow the State reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Contract and the State's Data, at no cost to the State. d) Contractor assumes responsibility for the security and confidentiality of the Data under its control. e) No Data shall be copied, modified, destroyed or deleted by Contractor other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the State.
f) Remote access to Data from outside the continental United States, including remote access to Data by authorized SaaS support staff in identified support centers, is prohibited unless approved in advance in writing by:
1) the Agency Information Security Officer, with written notice to the State Chief Information Security Officer, or
in the absence of an Agency Information Security Officer, the State Chief Information Security Officer.
5. ENCRYPTION: Confidential, sensitive or personal information shall be encrypted in accordance with California State Administrative Manual 5350.1 and California Statewide Information Management Manual 5305-A.
6. DATA LOCATION: Unless otherwise stated in the Statement of Work and approved in advance in writing by:
1) the Agency Information Security Officer, with written notice to the State Chief Information Security Officer, or
2) in the absence of an Agency Information Security Officer, the State Chief Information Security Officer,
the physical location of Contractor's data center where the Data is stored shall be within the continental United States.
7. RIGHTS TO DATA: The parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the State, and Contractor has a limited, non-exclusive license tr access and use the Data as provided to Contractor solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of Data by Contractor or third parties is prohibited. For the purposes of this requirement.
DGS Procurement Division Page 3 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
the phrase "unauthorized use" means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.
8. TRANSITION PERIOD:
a) Unless otherwise stated in the SOW, for ninety (90) days prior to the expiration date of this Contract, or upon notice of termination of this Contract, Contractor shall assist the State in extracting and/or transitioning all Data in the format determined by the State ("Transition Period"). b) The Transition Period may be modified in the SOW or as agreed upon in writing by the parties in a contract amendment.
c) During the Transition Period, SaaS and Data access shall continue to be made available to the State without alteration.
d) Contractor agrees to compensate the State for damages or losses the State incurs as a result of Contractor's failure to comply with this section in accordance with the Limitation of Liability provision set forth in the General Provisions - Information Technology. e) Unless otherwise stated in the SOW, the Contractor shall permanently destroy or render inaccessible any portion of the Data in Contractor's and/or subcontractor's possession or control following the expiration of all obligations in this section. Within thirty (30) days, Contractor shall issue a written statement to the State confirming the destruction or inaccessibility of the State's Data. f) The State at its option, may purchase additional transition services as agreed upon in the SOW.
9. DATA BREACH: Unless otherwise stated in the Statement of Work, a) Upon discovery or reasonable belief of any Data Breach, Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the Chief Information Security Officer or designee of the contracting agency. Contractor shall provide such notification within forty-eight (48) hours after Contractor reasonably believes there has been such a Data Breach. Contractor's notification shall identify:
1) The nature of the Data Breach;
2) The Data accessed, used or disclosed
The person(s) who accessed, used, disclosed and/or received Data (if known); 4) What Contractor has done or will do to quarantine and mitigate the Data Breach; and What corrective action Contractor has taken or will take to prevent future Data Breaches. b) Goons permed by daily upda uni tre Date teachy fred by te reso regardine stairs and satisfaction.
c) Contractor shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with the SLA. Failure to do so may result in the State exercising its options for assessing damages or other remedies under this Contract.
d) Notwithstanding anything to the contrary in the General Provisions - Information Technology, in performing services under this Contract, and to the extent authorized by the State in the Statement of Work, Contractor may be permitted by the State to use systems, or may be granted access to the State systems, which store, transmit or process State owned, licensed or maintained computerized Data consisting of personal information, as defined by Civil Code Section 1798.29 (g). If the Contractor causes or knowingly experiences a breach of the security of such Data, Contractor shall immediately report any breach of security of such system to the State following discovery or notification of the breach in the security of such Data. The State's Chief Information Security Officer, or designee, shall determine whether notification to the individuals whose Data has been lost or breached is appropriate. If personal information of any resident of California was, or is reasonably believed to have been acquired by an unauthorized person as a result of a DGS Procurement Division Page 4 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
security breach of such system and Data that is not due to the fault of the State or any person or entity under the control of the State, Contractor shall bear any and all costs associated with the State's notification obligations and other obligations set forth in Civil Code Section 1798.29 (d) as well as the cost of credit monitoring, subject to the dollar limitation, if any, agreed to by the State and Contractor in the applicable Statement of Work. These costs may include, but are not limited to staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach of the security of such personal information.
e) Contractor shall conduct an investigation of the Data Breach and shall share the report of the investigation with the State. The State and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the State, its agents and law enforcement.
10. DISASTER RECOVERY/BUSINESS CONTINUITY: Unless otherwise stated in the Statement of Work, In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the Chief Information Security Officer or designee of the contracting agency.
Contractor shall provide such notification within twenty-four (24) hours after Contractor reasonably believes there has been such a disaster or catastrophic failure. In the notification, Contactor shall inform the State of:
1) The scale and quantity of the Data loss;
2) What Contractor has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and
3) What corrective action Contractor has taken or will take to prevent future Data loss. 4) If Contractor fails to respond immediately and remedy the failure, the State may exercise its options for assessing damages or other remedies under this Contract. b) Contractor shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA. Failure to do so may result in the State exercising its options for assessing damages or other remedies under this Contract.
c) Contractor shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the State. The State and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the State, its agents and law enforcement.
11. EXAMINATION AND AUDIT: In addition to the Examination and Audit provision set forth in the General Provisions - Information Technology, unless otherwise stated in the Statement of Work:
a) Upon advance written request, Contractor agrees that the State or its designated representative shall have access to Contractor's SaaS, operational documentation, records and databases, including online inspections, that relate to the SaaS purchased by the State. b) The online inspection shall allow the State, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:
1) Operating system/network vulnerability scans,
2) Web application vulnerability scans,
3) Database application vulnerability scans, and
4) Any other scans to be performed by the State or representatives on behalf of the State. c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, Contractor will at its expense have an independent, industry-recognized, State-approved third party perform an information security audit. The audit results shall be shared with the State within seven (7) days of Contractor's receipt of such results. Upon Contractor receiving the results of the audit, Contractor will DGS Procurement Division Page 5 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Software as a Service)
provide the State with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.
12. DISCOVERY: Contractor shall promptly notify the State upon receipt of any requests which in any way might reasonably require access to the Data of the State or the State's use of the Saas. Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the Chief Information Security Officer or designee of the contracting agency, unless prohibited by law from providing such notification.
Contractor shall provide such notification within forty-eight 48) hours after Contractor receives the request.
Contractor shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests irected at Contractor reaardina this Contract without first notifying the State unless prohibited by law trom providin uch notification. Contractor agrees to provide its intended responses to the State with adeauate time for the State t review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. Contractor shall not respond to legal requests directed at the State unless authorized in writing to do so by the State.
DGS Procurement Division Page 6 rev. 03/15/18
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service) THESE SPECIAL PROVISIONS ARE ONLY TO BE USED FOR INFRASTRUCTURE AS A SERVICE (laaS) AND PLATFORM AS A SERVICE (PaaS), AS DEFINED BELOW. THESE SPECIAL PROVISIONS ARE TO
BE ATTACHED TO THE GENERAL PROVISIONS - INFORMATION TECHNOLOGY AND ACCOMPANIED BY, AT MINIMUM, A STATEMENT OF WORK (SOW) AND SERVICE LEVEL AGREEMENT (SLA). STATE AGENCIES MUST FIRST:
A: CLASSIFY THEIR DATA PURSUANT TO THE CALIFORNIA STATE ADMINISTRATIVE MANUAL (SAM) 5305.5;
B: CONSIDER THE FACTORS TO BE TAKEN INTO ACCOUNT WHEN SELECTING A PARTICULAR TECHNOLOGICAL APPROACH, IN ACCORDANCE WITH SAM 4981.1, 4983 AND 4983.1 AND THEN;
C: MODIFY THESE SPECIAL PROVISIONS THROUGH THE SOW AND/OR SLA TO MEET THE NEEDS OF EACH ACQUISITION.
1. DEFINITIONS:
A. "Authorized Persons" means the Service Provider's employees, Contractors, subcontractors or other agents who need to access the State's Data to enable the Service Provider to perform the services required.
B. "Data Breach" means the unauthorized access that results in the use, disclosure, destruction, modification, loss or theft of the State's unencrypted Personal Data or Non- Public Data.
C. "Individually Identifiable Health Information" means Information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.
D. "Infrastructure-as-a-Service" (laaS) means the capability provided to the consumer is to provision processing, storage, networks and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed application; and possibly limited control of select networking components (e.g., host firewalls).
E. "Non-Public Data" means data submitted to the Service Provider's laas or Paas Service, other than Personal Data, that is not subject to distribution to the public as public information.
It is deemed to be sensitive and confidential by the State because it contains information that is exempt by statute, regulation or policy from access by the general public as public information.
Page | 1 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service) F. "Personal Data" means data submitted to the Service Provider's laaS or PaaS Service that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government-issued identification numbers (e.g., Social Security, driver's license, passport); financial account information, including account number, credit or debit card numbers; or protected health information (PHI) relating to a person.
G. "Platform-as-a-Service" (PaaS) means the capability provided to the consumer to deploy onto the cloud infrastructure consumer- created or -acquired applications created using programming languages and tools supported by the provider. This capability does not necessarily preclude the use of compatible programming languages, libraries, services and tools from other sources. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems or storage, but has control over the deployed applications and possibly application hosting environment configurations.
H. "Protected Health Information" (PHI) means Individually Identifiable Health Information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA) as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer.
I. "Security Incident" means the potentially unauthorized access to Personal Data or Non- Public Data the Service Provider believes could reasonably result in the use, disclosure or theft of the State's unencrypted Personal Data or Non-Public Data within the possession or control of the Service Provider. A Security Incident may or may not turn into a Data Breach.
J. "Service Level Agreement" (SLA) means a written agreement between both the State and the Service Provider that is subject to the terms and conditions in this document that unless otherwise agreed to includes (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) security responsibilities and notice requirements, how disputes are discovered and addressed, and (6) any remedies for performance failures.
K. "Service Provider" means the Contractor, subcontractors, agents, resellers, third parties and affiliates who are providing the services agreed to under the Contract.
L. "State Data" means all data created or in any way originating with the State, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the State, whether such data or outputis stored on the State's hardware, the Service Provider's hardware or exists in any system owned, maintained or otherwise controlled by the State or by the Service Provider.
Page | 2 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service) "State Identified Contact" means the person or persons designated in writing by the State to receive Security Incident or Data Breach notification.
N. "Statement of Work" (SOW) means a written statement in a Contract that describes the State's service needs and expectations.
2. DATA OWNERSHIP:
The State will own all right, title and interest in State Data that is related to the services provided by this Contract. The Service Provider shall not access State user accounts or State Data, except (1) In the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of this Contract, (4) at the State's written request or (5) as required by law.
3. DATA PROTECTION:
Protection of personal privacy and data shall be an integral part of the business activities of the Service Provider to ensure there is no inappropriate or unauthorized use of State information at any time. To this end, the Service Provider shall safeguard the confidentiality, integrity and availability of State information within its control and comply with the following conditions:
A. In addition to the Compliance with Statues and Regulations provisions set forth in the General Provisions - Information Technology, the Service Provider shall comply as required with:
i. The California Information Practices Act (Civil Code Sections 1798 et seq). ii. NIST Special Publication 800-53 Revision 4 or its successor. ili. Privacy provisions of the Federal Privacy Act of 1974.
B. All State Data obtained by the Service Provider within its control in the performance of this Contract shall become and remain the property of the State.
C. Unless otherwise set forth in the SOW and/or SLA, Personal Data and Non-Public Data shall be encrypted at rest, in use, and in transit with controlled access. The SOW and/or SLA will specify which party is responsible for encryption and access control of the State Data for the service model under Contract. If the SOW and/or SLA and the Contract are silent, then the State is responsible for encryption and access control.
D. Unless otherwise set forth in the SOW and/or SLA, it is the State's responsibility to identify data it deems as Non-Public Data to the Service Provider. The level of protection and encryption for all Non-Public Data shall be identified and made a part of this Contract.
Page | 3 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service) E. At no time shall any Personal Data and Non-Public Data or processes — which either belong to or are intended for the use of State or its officers, agents or employees - be copied, disclosed or retained by the Service Provider or any party related to the Service Provider for subsequent use in any transaction without the express written consent of the State except as permitted in Section 2 above.
F. (For PaaS Only) Encryption of Data at Rest: The Service Provider shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data and Non-Public Data, unless the Service Provider presents a justifiable position approved by the State that Personal Data and Non-Public Data must be stored on a Service Provider portable device in order to accomplish work as defined in the SOW and/or SLA.
4. DATA LOCATION:
The Service Provider shall provide its services to the State and its end users solely from data centers in the continental United States. Storage of State Data at rest shall be located solely in data centers in the continental United States. The Service Provider shall not allow its personnel or contractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Service Provider shall permit its personnel and contractors to access State Data remotely only as required to provide technical user support or other customer support. The Service Provider may provide technical user support or other customer support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in this Contract.
5. SECURITY INCIDENT OR DATA BREACH NOTIFICATION:
The Service Provider shall inform the State of any Security Incident or Data Breach related to State Data within the possession or control of the Service Provider and related to the service provided under this Contract.
A. Security Incident Reporting Requirements: Unless otherwise set forth in the SOW and/or SLA, the Service Provider shall promptly report a Security Incident related to its service under the Contract to the appropriate State Identified Contact as defined in the SOW and/or B. Breach Reporting Requirements: If the Service Provider has actual knowledge of a confirmed Data Breach that affects the security of any State Data that is subject to applicable Data Breach notification law, the Service Provider shall (1) promptly notify the appropriate State Identified Contact within 24 hours or sooner, unless otherwise required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner.
Page | 4 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service) C. (For PaaS Only) Incident Response: The Service Provider may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing Security Incidents with the State should be handled on an urgent as- needed basis, as part of Service Provider communication and mitigation processes as mutually agreed, defined by law or contained in the Contract.
6. DATA BREACH RESPONSIBILITIES:
This section only applies when a Data Breach occurs with respect to Personal Data and/or Non- Public Data within the possession or control of a Service Provider and related to service provided under this Contract.
A. The Service Provider, unless otherwise set forth in in the SOW and/or SLA, shall promptly notify the appropriate State Identified Contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is or reasonably believes that there has been a Data Breach. The Service Provider shall (1) cooperate with the State as reasonably requested by the State to investigate and resolve the Data Breach; (2) promptly implement necessary remedial measures, if necessary; and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.
B. Service Provider will provide daily updates, or more frequently if required by the State, regarding findings and actions performed by Service Provider to the State Identified Contact until the Data Breach has been effectively resolved to the State's satisfaction.
C. Service Provider shall quarantine the Data Breach, ensure secure access to Data, and repair laaS and/or PaaS as needed in accordance with the SOW and/or SLA. Failure to do so may result in the State exercising its options for assessing damages or other remedies under this Contract.
D. Unless otherwise set forth in the SOW and/or SLA, if a Data Breach is a direct result of the Service Provider's breach of its Contract obligation to encrypt Personal Data and/or Non- Public Data or otherwise prevent its release, the Service Provider shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State (or Federal) law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by the Service Provider based on root cause; all [(1) through (5)] subject to this Contract's Limitation of Liability provision as set forth in the General Provisions - Information Technology.
Page | 5 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service)
7. NOTIFICATION OF LEGAL REQUESTS:
Unless otherwise required by law, the Service Provider shall contact the State upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the State's Data under this Contract, or which in any way might reasonably require access to State's Data. The Service Provider shall not respond to subpoenas, service of process and other legal requests related to the State without first notifying the State, unless prohibited by law from providing such notice. Unless otherwise required by law, Service Provider agrees to provide its intended responses to the State with adequate time for the State to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. Service Provider shall not respond to legal requests directed at the State unless authorized in writing to do so by the State.
8. DATA PRESERVATION AND RETRIEVAL:
A. For ninety (90) days prior to the expiration date of this Contract, or upon notice of termination of this Contract, Service Provider shall assist the State in extracting and/or transitioning all State Data in the format determined by the State ("Transition Period").
B. The Transition Period may be modified in the SOW and/or SLA or as agreed upon in writing by the parties in a Contract amendment.
C. During the Transition Period, laaS and/or PaaS and State Data access shall continue to be made available to the State without alteration.
D. Service Provider agrees to compensate the State for damages or losses the State incurs as a result of Service Provider's failure to comply with this section in accordance with the "Limitation of Liability" provision set forth in the General Provisions - Information Technology.
E. The State at its option, may purchase additional transition services as agreed upon in the SOW and/or SLA.
F. During any period of suspension, the Service Provider shall not take any action to intentionally erase any State Data.
G. The Service Provider will impose no additional fees for access and retrieval of State Data by the State during the Transition Period
H. After termination of the Contract and the prescribed retention period, the Service Provider shall securely dispose of all State Data in all forms. State Data shall be permanently deleted and shall not be recoverable, according to NIST-approved methods. Certificates of destruction shall be provided to the State.
Page | 6 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service)
9. BACKGROUND CHECKS:
As permitted or required by law, the Service Provider shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Service Provider shall promote and maintain an awareness of the importance of securing the State's information among the Service Provider's employees and agents.
10. ACCESS TO SECURITY LOGS AND REPORTS:
A. (For laas Only) Upon request, the Service Provider shall provide reports to the State directly related to the infrastructure the Service Provider controls upon which the State account resides. Unless otherwise agreed to in the SLA, the Service Provider shall provide the State a history of all Application Program Interface (API) calls for the State account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Service Provider. The report will be sufficient to enable the State to perform security analysis, resource change tracking and compliance auditing.
B. (For PaaS Only) Upon request, the Service Provider shall provide reports to the State in a format as specified in the SOW and/or SLA and agreed to by both the Service Provider and the State. Reports will include latency statistics, user access, user access IP address, user access history and security logs for all State files related to this Contract.
C. The Service Provider and the State recognize that security responsibilities are shared. The Service Provider is responsible for providing a secure infrastructure. The State is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SOW and/or SLA.
11. CONTRACT AUDIT:
The Service Provider shall allow the State to audit conformance to the Contract terms. The State may perform this audit or Contract with a third party at its discretion and at the State's expense.
12. DATA CENTER AUDIT:
The Service Provider shall undergo an annual Statement on Standards for Attestation Engagements (SSAE) No. 16 Service Organization Control (SOC) 2 Type II audit of its data centers, or its successor at its own expense. The Service Provider shall provide a redacted version of the audit report and Contractor's plan to correct any negative findings upon request.
The Service Provider may remove its proprietary information from the redacted version.
Page | 7 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service)
13. CHANGE CONTROL AND ADVANCE NOTICE:
The Service Provider shall give advance notice (as agreed to by the parties and included in the SOW and/or SLA) to the State of any upgrades (e.g., major upgrades, minor upgrades, system changes) that is expected to materially and negatively impact service availability and performance, as well as any planned downtime for such upgrades. A major upgrade is a replacement of hardware, software or firmware ware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number. Service Provider may change the features and functionality of the services, without degrading them, to make improvements, address security requirements and comply with changes in law.
14. SECURITY PROCESSES:
The Service Provider shall disclose its non-proprietary security processes and technical limitations to the State such that adequate protection and flexibility can be attained between the State and the Service Provider. The State and the Service Provider shall understand each other's roles and responsibilities, which shall be set forth in the SOW and/or SLA.
15. IMPORT AND EXPORT OF DATA:
The State shall have the ability to import or export data in whole or in part at its discretion without interference from the Service Provider. This includes the ability for the State to import or export data to or from other Service Providers.
16. RESPONSIBILITIES AND UPTIME GUARANTEE:
The Service Provider shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environment are the responsibility of the Service Provider. The system shall be available 24/7/365 (with agreed- upon maintenance downtime), and shall provide service to customers as defined in the SOW and/or SLA.
17. RIGHT TO REMOVE INDIVIDUALS:
The State shall have the right at any time to require the Service Provider remove from interaction with State any Service Provider representative who the State believes is detrimental to its working relationship with the Service Provider. The State shall provide the Service Provider with notice of its determination, and the reasons it requests the removal. The Service Provider shall not assign the person to any aspect of the Contract or future work orders without the State's consent.
Page | 8 5/11/2016
STATE MODEL
CLOUD COMPUTING SERVICES SPECIAL PROVISIONS
(Infrastructure as a Service and Platform as a Service)
18. BUSINESS CONTINUITY AND DISASTER RECOVERY:
The Service Provider shall provide a business continuity and disaster recovery plan and shall ensure that it achieves the State's Recovery Time Objective (RTO), as agreed to by the parties and set forth in the SOW and/or SLA.
19. WEB SERVICES:
(For PaaS Only)The Service Provider shall use Web services exclusively to interface with State Data in near real time when possible, or as mutually agreed in the SOW and/or SLA.
Page | 9 5/11/2016