STATE OF COLORADO FISCAL RULES
SIGNATURE PAGE
These Special Provisions apply to all contracts except where noted in italics.
1. CONTROLLER'S APPROVAL. CRS §24-30-202(1). This contract shall not be valid until it has been approved by the Colorado State Controller or designee.
2. FUND AVAILABILITY. CRS §24-30-202(5.5). Financial obligations of the State payable after the current fiscal year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available.
3. GOVERNMENTAL IMMUNITY. No term or condition of this contract shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, of the Colorado Governmental Immunity Act, CRS §24-10-101 et seq., or the Federal Tort Claims Act, 28 U.S.C. §§1346(b) and 2671 et seq., as applicable now or hereafter amended.
4. INDEPENDENT CONTRACTOR. Contractor shall perform its duties hereunder as an independent contractor and not as an employee. Neither Contractor nor any agent or employee of Contractor shall be deemed to be an agent or employee of the State. Contractor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Contractor or any of its agents or employees.
Unemployment insurance benefits will be available to Contractor and its employees and agents only if such coverage is made available by Contractor or a third party. Contractor shall pay when due all applicable employment taxes and income taxes and local head taxes incurred pursuant to this contract.
Contractor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Contractor shall (a) provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law, (b) provide proof thereof when requested by the State, and (c) be solely responsible for its acts and those of its employees and agents.
5. COMPLIANCE WITH LAW. Contractor shall strictly comply with all applicable federal and State laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices.
6. CHOICE OF LAW. Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this contract. Any provision included or incorporated herein by reference which conflicts with said laws, rules, and regulations shall be null and void. Any provision incorporated herein by reference which purports to negate this or any other Special Provision in whole or in part shall not be valid or enforceable or available in any action at law, whether by way of complaint, defense, or otherwise. Any provision rendered null and void by the operation of this provision shall not invalidate the remainder of this contract, to the extent capable of execution.
7. BINDING ARBITRATION PROHIBITED. The State of Colorado does not agree to binding arbitration by any extra-judicial body or person. Any provision to the contrary in this contact or incorporated herein by reference shall be null and void.
8. SOFTWARE PIRACY PROHIBITION. Governor's Executive Order D 002 00. State or other public funds payable under this contract shall not be used for the acquisition, operation, or maintenance of computer software in violation of federal copyright laws or applicable licensing restrictions. Contractor hereby certifies and warrants that, during the term of this contract and any extensions, Contractor has and shall maintain in place appropriate systems and controls to prevent such improper use of public funds. If the State determines that Contractor is in violation of this provision, the State may exercise any remedy available at law or in equity or under this contract, including, without limitation, immediate termination of this contract and any remedy consistent with federal copyright laws or applicable licensing restrictions.
9. EMPLOYEE FINANCIAL INTEREST/CONFLICT OF INTEREST. CRS §§24-18-201 and 24-50-507.
The signatories aver that to their knowledge, no employee of the State has any personal or beneficial interest whatsoever in the service or property described in this contract. Contractor has no interest and
SPECIAL PROVISIONS
Colorado
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 123
#15..
- 454 -
Issued by the Office of the State Controller Date Issued: 7/1/74 Rule 3-1 Date Revised: 1/1/09
STATE OF COLORADO FISCAL RULES
shall not acquire any interest, direct or indirect, that would conflict in any manner or degree with the SIGNATURE PAGE performance of Contractor’s services and Contractor shall not employ any person having such known interests.
10. VENDOR OFFSET. CRS §§24-30-202 (1) and 24-30-202.4. [Not Applicable to intergovernmental agreements] Subject to CRS §24-30-202.4 (3.5), the State Controller may withhold payment under the State’s vendor offset intercept system for debts owed to State agencies for: (a) unpaid child support debts or child support arrearages; (b) unpaid balances of tax, accrued interest, or other charges specified in CRS §39-21-101, et seq.; (c) unpaid loans due to the Student Loan Division of the Department of Higher Education; (d) amounts required to be paid to the Unemployment Compensation Fund; and (e) other unpaid debts owing to the State as a result of final agency determination or judicial action.
11. PUBLIC CONTRACTS FOR SERVICES. CRS §8-17.5-101. [Not Applicable to agreements relating to the offer, issuance, or sale of securities, investment advisory services or fund management services, sponsored projects, intergovernmental agreements, or information technology services or products and services] Contractor certifies, warrants, and agrees that it does not knowingly employ or contract with an illegal alien who will perform work under this contract and will confirm the employment eligibility of all employees who are newly hired for employment in the United States to perform work under this contract, through participation in the E-Verify Program or the Department program established pursuant to CRS §8-17.5-102(5)(c), Contractor shall not knowingly employ or contract with an illegal alien to perform work under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this contract. Contractor (a) shall not use E-Verify Program or Department program procedures to undertake pre-employment screening of job applicants while this contract is being performed, (b) shall notify the subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a subcontractor is employing or contracting with an illegal alien for work under this contract, (c) shall terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien within three days of receiving the notice, and (d) shall comply with reasonable requests made in the course of an investigation, undertaken pursuant to CRS §8-
17.5-102(5), by the Colorado Department of Labor and Employment. If Contractor participates in the Department program, Contractor shall deliver to the contracting State agency, Institution of Higher Education or political subdivision a written, notarized affirmation, affirming that Contractor has examined the legal work status of such employee, and shall comply with all of the other requirements of the Department program. If Contractor fails to comply with any requirement of this provision or CRS §8-17.5- 101 et seq., the contracting State agency, institution of higher education or political subdivision may terminate this contract for breach and, if so terminated, Contractor shall be liable for damages.
12. PUBLIC CONTRACTS WITH NATURAL PERSONS. CRS §24-76.5-101. Contractor, if a natural person eighteen (18) years of age or older, hereby swears and affirms under penalty of perjury that he or she (a) is a citizen or otherwise lawfully present in the United States pursuant to federal law, (b) shall comply with the provisions of CRS §24-76.5-101 et seq., and (c) has produced one form of identification required by CRS §24-76.5-103 prior to the effective date of this contract.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 124
#15..
- 455 -
1 Τηε παρτιεσ αγρεε τηατ τηε φολλοωινγ προϖισιονσ οφ τηισ Παρτιχιπατινγ Αδδενδυm σηαλλ αππλψ το ανψ αχτιον, πυρχηασε ορ πυρχηασε ορδερ ισσυεδ βψ τηε Στατε οφ Χοννεχτιχυτ ορ ανψ οφ ιτσ παρτιχιπατινγ εντιτιεσ.
1. Dεφινιτιονσ
Τηε φολλοωινγ δεφινιτιονσ αππλψ το τηισ Παρτιχιπατινγ Αδδενδυm:
α) Χλαιmσ: Αλλ αχτιονσ, συιτσ, χλαιmσ, δεmανδσ, ινϖεστιγατιονσ ανδ προχεεδινγσ οφ ανψ κινδ, οπεν, πενδινγ ορ τηρεατενεδ, ωηετηερ mατυρε, υνmατυρεδ, χοντινγεντ, κνοων ορ υνκνοων, ατ λαω ορ ιν εθυιτψ, ιν ανψ φορυm.
β) Χονφιδεντιαλ Ινφορmατιον: Ανψ ναmε, νυmβερ ορ οτηερ ινφορmατιον τηατ mαψ βε υσεδ, αλονε ορ ιν χονϕυνχτιον ωιτη ανψ οτηερ ινφορmατιον, το ιδεντιφψ α σπεχιφιχ ινδιϖιδυαλ ινχλυδινγ, βυτ νοτ λιmιτεδ το, συχη ινδιϖιδυαλ∋σ ναmε, δατε οφ βιρτη, mοτηερ∋σ mαιδεν ναmε, mοτορ ϖεηιχλε οπερατορ∋σ λιχενσε νυmβερ, Σοχιαλ Σεχυριτψ νυmβερ, εmπλοψεε ιδεντιφιχατιον νυmβερ, εmπλοψερ ορ ταξπαψερ ιδεντιφιχατιον νυmβερ, αλιεν ρεγιστρατιον νυmβερ, γοϖερνmεντ πασσπορτ νυmβερ, ηεαλτη ινσυρανχε ιδεντιφιχατιον νυmβερ, δεmανδ δεποσιτ αχχουντ νυmβερ, σαϖινγσ αχχουντ νυmβερ, χρεδιτ χαρδ νυmβερ, δεβιτ χαρδ νυmβερ ορ υνιθυε βιοmετριχ δατα συχη ασ φινγερπριντ, ϖοιχε πριντ, ρετινα ορ ιρισ ιmαγε, ορ οτηερ υνιθυε πηψσιχαλ ρεπρεσεντατιον. Wιτηουτ λιmιτινγ τηε φορεγοινγ, Χονφιδεντιαλ Ινφορmατιον σηαλλ αλσο ινχλυδε ανψ ινφορmατιον τηατ τηε Dεπαρτmεντ Iﾉ;ゲゲｷaｷWゲ ;ゲ さIﾗﾐaｷSWﾐデｷ;ﾉざ ﾗヴ さヴWゲデヴｷIデWSくざ CﾗﾐaｷSWﾐデｷ;ﾉ Iﾐaﾗヴﾏ;デｷﾗﾐ ゲｴ;ﾉﾉ ﾐﾗデ ｷﾐIﾉ┌SW ινφορmατιον τηατ mαψ βε λαωφυλλψ οβταινεδ φροm πυβλιχλψ αϖαιλαβλε σουρχεσ ορ φροm φεδεραλ, στατε, ορ λοχαλ γοϖερνmεντ ρεχορδσ ωηιχη αρε λαωφυλλψ mαδε αϖαιλαβλε το τηε γενεραλ πυβλιχ. χ) Χονφιδεντιαλ Ινφορmατιον Βρεαχη: Τηισ σηαλλ mεαν, γενεραλλψ, αν ινστανχε ωηερε αν υναυτηοριζεδ περσον ορ εντιτψ αχχεσσεσ Χονφιδεντιαλ Ινφορmατιον ιν ανψ mαννερ, ινχλυδινγ βυτ νοτ λιmιτεδ το τηε φολλοωινγ οχχυρρενχεσ: (1) ανψ Χονφιδεντιαλ Ινφορmατιον τηατ ισ νοτ ενχρψπτεδ ορ προτεχτεδ ισ mισπλαχεδ, λοστ, στολεν ορ ιν ανψ ωαψ χοmπροmισεδ; (2)ονε ορ mορε τηιρδ παρτιεσ ηαϖε ηαδ αχχεσσ το ορ τακεν χοντρολ ορ ποσσεσσιον οφ ανψ Χονφιδεντιαλ Ινφορmατιον τηατ ισ νοτ ενχρψπτεδ ορ προτεχτεδ ωιτηουτ πριορ ωριττεν αυτηοριζατιον φροm τηε Στατε; (3) τηε υναυτηοριζεδ αχθυισιτιον οφ ενχρψπτεδ ορ προτεχτεδ Χονφιδεντιαλ Ινφορmατιον τογετηερ ωιτη τηε χονφιδεντιαλ προχεσσ ορ κεψ τηατ ισ χαπαβλε οφ χοmπροmισινγ τηε ιντεγριτψ οφ τηε Χονφιδεντιαλ Ινφορmατιον; ορ (4) ιφ τηερε ισ α συβσταντιαλ ρισκ οφ ιδεντιτψ τηεφτ ορ φραυδ το τηε χλιεντ, τηε Χοντραχτορ, τηε Dεπαρτmεντ ορ Στατε.
δ) Χοντραχτ: Ιδεντιφψ Χοντραχτ ναmε ανδ νυmβερ ανδ τηισ παρτιχιπατινγ αδδενδυm ε) Χοντραχτορ: Α περσον ορ εντιτψ ωηο εξεχυτεσ τηε Χοντραχτ. φ) Χοντραχτορ Παρτιεσぎ A Cﾗﾐデヴ;Iデﾗヴげゲ ﾏWﾏHWヴゲが SｷヴWIデﾗヴゲが ﾗaaｷIWヴゲが ゲｴ;ヴWｴﾗﾉSWヴゲが ヮ;ヴデﾐWヴゲが mαναγερσ, πρινχιπαλ οφφιχερσ, ρεπρεσεντατιϖεσ, αγεντσ, σερϖαντσ, χονσυλταντσ, εmπλοψεεσ ορ ανψ ονε οφ τηεm ορ ανψ οτηερ περσον ορ εντιτψ ωιτη ωηοm τηε Χοντραχτορ ισ ιν πριϖιτψ οφ οραλ ορ ωριττεν χοντραχτ ανδ τηε Χοντραχτορ ιντενδσ φορ συχη οτηερ περσον ορ εντιτψ το Περφορm υνδερ τηε Χοντραχτ ιν ανψ χαπαχιτψ.
γ) DΑΣ: Dεπαρτmεντ οφ Αδmινιστρατιϖε Σερϖιχεσ.
Connecticut
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 125
#15..
- 456 -
2 η) Dεπαρτmεντ: Ανψ ανδ αλλ δεπαρτmεντσ, χοmmισσιονσ, βοαρδσ, βυρεαυσ, αγενχιεσ, ινστιτυτιονσ, πυβλιχ αυτηοριτιεσ, οφφιχεσ, χουνχιλσ, ασσοχιατιονσ, ινστρυmενταλιτιεσ, εντιτιεσ ορ πολιτιχαλ συβδιϖισιονσ οφ τηε Στατε τηατ ισσυε δυλψ αυτηοριζεδ πυρχηασε ορδερσ αγαινστ τηε Χοντραχτ. ι) Ρεχορδσ: Αλλ ωορκινγ παπερσ ανδ συχη οτηερ ινφορmατιον ανδ mατεριαλσ ασ mαψ ηαϖε βεεν αχχυmυλατεδ βψ τηε Χοντραχτορ ιν περφορmινγ τηε Χοντραχτ, ινχλυδινγ βυτ νοτ λιmιτεδ το, δοχυmεντσ, δατα, πλανσ, βοοκσ, χοmπυτατιονσ, δραωινγσ, σπεχιφιχατιονσ, νοτεσ, ρεπορτσ, ρεχορδσ, εστιmατεσ, συmmαριεσ, mεmορανδα ανδ χορρεσπονδενχε, κεπτ ορ στορεδ ιν ανψ φορm.
2. Wηιστλεβλοωινγ. Τηισ Χοντραχτ mαψ βε συβϕεχτ το τηε προϖισιονσ οφ Σεχτιον 4−61δδ οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ. Ιν αχχορδανχε ωιτη τηισ στατυτε, ιφ αν οφφιχερ, εmπλοψεε ορ απποιντινγ αυτηοριτψ οφ τηε Χοντραχτορ τακεσ ορ τηρεατενσ το τακε ανψ περσοννελ αχτιον αγαινστ ανψ εmπλοψεε οφ τηε Χοντραχτορ ιν ρεταλιατιον φορ συχη εmπλοψεε∋σ δισχλοσυρε οφ ινφορmατιον το ανψ εmπλοψεε οφ τηε χοντραχτινγ στατε ορ θυασι−πυβλιχ αγενχψ ορ τηε Αυδιτορσ οφ Πυβλιχ Αχχουντσ ορ τηε Αττορνεψ Γενεραλ υνδερ τηε προϖισιονσ οφ συβσεχτιον (α) οφ συχη στατυτε, τηε Χοντραχτορ σηαλλ βε λιαβλε φορ α χιϖιλ πεναλτψ οφ νοτ mορε τηαν φιϖε τηουσανδ δολλαρσ φορ εαχη οφφενσε, υπ το α mαξιmυm οφ τωεντψ περ χεντ οφ τηε ϖαλυε οφ τηισ Χοντραχτ. Εαχη ϖιολατιον σηαλλ βε α σεπαρατε ανδ διστινχτ οφφενσε ανδ ιν τηε χασε οφ α χοντινυινγ ϖιολατιον, εαχη χαλενδαρ δαψ∋σ χοντινυανχε οφ τηε ϖιολατιον σηαλλ βε δεεmεδ το βε α σεπαρατε ανδ διστινχτ οφφενσε. Τηε Στατε mαψ ρεθυεστ τηατ τηε Αττορνεψ Γενεραλ βρινγ α χιϖιλ αχτιον ιν τηε Συπεριορ Χουρτ φορ τηε ϑυδιχιαλ Dιστριχτ οφ Ηαρτφορδ το σεεκ ιmποσιτιον ανδ ρεχοϖερψ οφ συχη χιϖιλ πεναλτψ. Ιν αχχορδανχε ωιτη συβσεχτιον (φ) οφ συχη στατυτε, εαχη λαργε στατε χοντραχτορ, ασ δεφινεδ ιν τηε στατυτε, σηαλλ ποστ α νοτιχε οφ τηε προϖισιονσ οφ τηε στατυτε ρελατινγ το λαργε στατε χοντραχτορσ ιν α χονσπιχυουσ πλαχε ωηιχη ισ ρεαδιλψ αϖαιλαβλε φορ ϖιεωινγ βψ τηε εmπλοψεεσ οφ τηε Χοντραχτορ.
3. Φορυm ανδ Χηοιχε οφ Λαω. Τηε παρτιεσ δεεm τηε Χοντραχτ το ηαϖε βεεν mαδε ιν τηε Χιτψ οφ Ηαρτφορδ, Στατε οφ Χοννεχτιχυτ. Βοτη παρτιεσ αγρεε τηατ ιτ ισ φαιρ ανδ ρεασοναβλε φορ τηε ϖαλιδιτψ ανδ χονστρυχτιον οφ τηε Χοντραχτ το βε, ανδ ιτ σηαλλ βε, γοϖερνεδ βψ τηε λαωσ ανδ χουρτ δεχισιονσ οφ τηε Στατε οφ Χοννεχτιχυτ, ωιτηουτ γιϖινγ εφφεχτ το ιτσ πρινχιπλεσ οφ χονφλιχτσ οφ λαωσ. Το τηε εξτεντ τηατ ανψ ιmmυνιτιεσ προϖιδεδ βψ Φεδεραλ λαω ορ τηε λαωσ οφ τηε Στατε οφ Χοννεχτιχυτ δο νοτ βαρ αν αχτιον αγαινστ τηε Στατε, ανδ το τηε εξτεντ τηατ τηεσε χουρτσ αρε χουρτσ οφ χοmπετεντ ϕυρισδιχτιον, φορ τηε πυρποσε οφ ϖενυε, τηε χοmπλαιντ σηαλλ βε mαδε ρετυρναβλε το τηε ϑυδιχιαλ Dιστριχτ οφ Ηαρτφορδ ονλψ ορ σηαλλ βε βρουγητ ιν τηε Υνιτεδ Στατεσ Dιστριχτ Χουρτ φορ τηε Dιστριχτ οφ Χοννεχτιχυτ ονλψ, ανδ σηαλλ νοτ βε τρανσφερρεδ το ανψ οτηερ χουρτ, προϖιδεδ, ηοωεϖερ, τηατ νοτηινγ ηερε χονστιτυτεσ α ωαιϖερ ορ χοmπροmισε οφ τηε σοϖερειγν ιmmυνιτψ οφ τηε Στατε οφ Χοννεχτιχυτ. Τηε Χοντραχτορ ωαιϖεσ ανψ οβϕεχτιον ωηιχη ιτ mαψ νοω ηαϖε ορ ωιλλ ηαϖε το τηε λαψινγ οφ ϖενυε οφ ανψ Χλαιmσ ιν ανψ φορυm ανδ φυρτηερ ιρρεϖοχαβλψ συβmιτσ το συχη ϕυρισδιχτιον ιν ανψ συιτ, αχτιον ορ προχεεδινγ.
4. Σοϖερειγν Ιmmυνιτψ. Τηε παρτιεσ αχκνοωλεδγε ανδ αγρεε τηατ νοτηινγ ιν τηε σολιχιτατιον ορ τηε Χοντραχτ σηαλλ βε χονστρυεδ ασ α mοδιφιχατιον, χοmπροmισε ορ ωαιϖερ βψ τηε Στατε οφ ανψ ριγητσ ορ δεφενσεσ οφ ανψ ιmmυνιτιεσ προϖιδεδ βψ Φεδεραλ λαω ορ τηε λαωσ οφ τηε Στατε οφ Χοννεχτιχυτ το τηε Στατε ορ ανψ οφ ιτσ οφφιχερσ ανδ εmπλοψεεσ, ωηιχη τηεψ mαψ ηαϖε ηαδ, νοω ηαϖε ορ ωιλλ ηαϖε ωιτη ρεσπεχτ το αλλ mαττερσ αρισινγ ουτ οφ τηε Χοντραχτ. Το τηε εξτεντ τηατ τηισ σεχτιον χονφλιχτσ ωιτη ανψ οτηερ σεχτιον, τηισ σεχτιον σηαλλ γοϖερν.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 126
#15..
- 457 -
3 5. Συmmαρψ οφ Στατε Ετηιχσ Λαωσ. Πυρσυαντ το τηε ρεθυιρεmεντσ οφ σεχτιον 1−101θθ οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ, τηε συmmαρψ οφ Στατε ετηιχσ λαωσ δεϖελοπεδ βψ τηε Στατε Ετηιχσ Χοmmισσιον πυρσυαντ το σεχτιον 1−81β οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ ισ ινχορπορατεδ βψ ρεφερενχε ιντο ανδ mαδε α παρτ οφ τηε Χοντραχτ ασ ιφ τηε συmmαρψ ηαδ βεεν φυλλψ σετ φορτη ιν τηε Χοντραχτ.
6. Χαmπαιγν Χοντριβυτιον Ρεστριχτιον. Φορ αλλ Στατε χοντραχτσ, δεφινεδ ιν Χονν. Γεν. Στατ. ♣9− 612(γ)(1) ασ ηαϖινγ α ϖαλυε ιν α χαλενδαρ ψεαρ οφ ∃50,000 ορ mορε, ορ α χοmβινατιον ορ σεριεσ οφ συχη αγρεεmεντσ ορ χοντραχτσ ηαϖινγ α ϖαλυε οφ ∃100,000 ορ mορε, τηε αυτηοριζεδ σιγνατορψ το τηισ Χοντραχτ W┝ヮヴWゲゲﾉ┞ ;Iﾆﾐﾗ┘ﾉWSｪWゲ ヴWIWｷヮデ ﾗa デｴW Sデ;デW EﾉWIデｷﾗﾐゲ EﾐaﾗヴIWﾏWﾐデ Cﾗﾏﾏｷゲゲｷﾗﾐげゲ ﾐﾗデｷIW ;S┗ｷゲｷﾐｪ ゲデ;デW χοντραχτορσ οφ στατε χαmπαιγν χοντριβυτιον ανδ σολιχιτατιον προηιβιτιονσ, ανδ ωιλλ ινφορm ιτσ πρινχιπαλσ οφ τηε χοντεντσ οφ τηε νοτιχε, ασ σετ φορτη ιν ∀Νοτιχε το Εξεχυτιϖε Βρανχη Στατε Χοντραχτορσ ανδ Προσπεχτιϖε Στατε Χοντραχτορσ οφ Χαmπαιγν Χοντριβυτιον ανδ Σολιχιデ;デｷﾗﾐ Lｷﾏｷデ;デｷﾗﾐゲがざ ;デデ;IｴWS デﾗ デｴｷゲ P;ヴデｷIｷヮ;デｷﾐｪ Αδδενδυm.
7. Εξεχυτιϖε Ορδερσ. Τηισ Χοντραχτ ισ συβϕεχτ το τηε προϖισιονσ οφ Εξεχυτιϖε Ορδερ Νο. Τηρεε οφ Γοϖερνορ Τηοmασ ϑ. Μεσκιλλ, προmυλγατεδ ϑυνε 16, 1971, χονχερνινγ λαβορ εmπλοψmεντ πραχτιχεσ, Εξεχυτιϖε Ορδερ Νο. Σεϖεντεεν οφ Γοϖερνορ Τηοmασ ϑ. Μεσκιλλ, προmυλγατεδ Φεβρυαρψ 15, 1973, χονχερνινγ τηε λιστινγ οφ εmπλοψmεντ οπενινγσ ανδ Εξεχυτιϖε Ορδερ Νο. Σιξτεεν οφ Γοϖερνορ ϑοην Γ.
Ροωλανδ προmυλγατεδ Αυγυστ 4, 1999, χονχερνινγ ϖιολενχε ιν τηε ωορκπλαχε, αλλ οφ ωηιχη αρε ινχορπορατεδ ιντο ανδ αρε mαδε α παρτ οφ τηε Χοντραχτ ασ ιφ τηεψ ηαδ βεεν φυλλψ σετ φορτη ιν ιτ. Τηε Χοντραχτ mαψ αλσο βε συβϕεχτ το τηε αππλιχαβλε παρτσ οφ Εξεχυτιϖε Ορδερ Νο. 14 οφ Γοϖερνορ Μ. ϑοδι Ρελλ, προmυλγατεδ Απριλ 17, 2006, χονχερνινγ προχυρεmεντ οφ χλεανινγ προδυχτσ ανδ σερϖιχεσ, Εξεχυτιϖε Ορδερ Νο. 19 οφ Γοϖερνορ Μ. ϑοδι Ρελλ, προmυλγατεδ ϑυνε 19, 2008 χονχερνινγ υσε οφ Σψστεm Dεϖελοπmεντ, ιν αχχορδανχε ωιτη τηειρ ρεσπεχτιϖε τερmσ ανδ χονδιτιονσ, ανδ το Εξεχυτιϖε Ορδερ Νο. 49 οφ Γοϖερνορ Dαννελ Π.
Μαλλοψ, προmυλγατεδ Μαψ 22, 2015, mανδατινγ δισχλοσυρε οφ χερταιν γιφτσ το πυβλιχ εmπλοψεεσ ανδ χοντριβυτιονσ το χερταιν χανδιδατεσ φορ οφφιχε. Ιφ Εξεχυτιϖε Ορδερσ 14, 19, ανδ 49 αρε αππλιχαβλε, τηεψ αρε δεεmεδ το βε ινχορπορατεδ ιντο ανδ αρε mαδε α παρτ οφ τηε Χοντραχτ ασ ιφ τηεψ ηαδ βεεν φυλλψ σετ φορτη ιν ιτ.
Aデ デｴW Cﾗﾐデヴ;Iデﾗヴげゲ ヴWケ┌Wゲデが デｴW DWヮ;ヴデﾏWﾐデ ゲｴ;ﾉﾉ ヮヴﾗ┗ｷSW ; Iﾗヮ┞ ﾗa デｴWゲW ﾗヴSWヴゲ デﾗ デｴW Cﾗﾐデヴ;Iデﾗヴく
8. Νονδισχριmινατιον.
(α) Φορ πυρποσεσ οφ τηισ Σεχτιον, τηε φολλοωινγ τερmσ αρε δεφινεδ ασ φολλοωσ:
ι. ∀Χοmmισσιον∀ mεανσ τηε Χοmmισσιον ον Ηυmαν Ριγητσ ανδ Οππορτυνιτιεσ; ιι. ゎCﾗﾐデヴ;Iデゎ ;ﾐS さIﾗﾐデヴ;Iデざ ｷﾐIﾉ┌SW ;ﾐ┞ W┝デWﾐゲｷﾗﾐ ﾗヴ ﾏﾗSｷaｷI;デｷﾗﾐ ﾗa デｴW Cﾗﾐデヴ;Iデ ﾗヴ χοντραχτ;
ιιι. ゎCﾗﾐデヴ;Iデﾗヴゎ ;ﾐS さIﾗﾐデヴ;Iデﾗヴざ ｷﾐIﾉ┌SW ;ﾐ┞ ゲ┌χχεσσορσ ορ ασσιγνσ οφ τηε Χοντραχτορ ορ χοντραχτορ;
ιϖ. ∀Γενδερ ιδεντιτψ ορ εξπρεσσιον∀ mεανσ α περσον∋σ γενδερ−ρελατεδ ιδεντιτψ, αππεαρανχε ορ βεηαϖιορ, ωηετηερ ορ νοτ τηατ γενδερ−ρελατεδ ιδεντιτψ, αππεαρανχε ορ βεηαϖιορ ισ διφφερεντ φροm τηατ τραδιτιοναλλψ ασσοχιατεδ ωιτη τηε περσον∋σ πηψσιολογψ ορ ασσιγνεδ σεξ ατ βιρτη, ωηιχη γενδερ−ρελατεδ ιδεντιτψ χαν βε σηοων βψ προϖιδινγ εϖιδενχε ινχλυδινγ, βυτ νοτ λιmιτεδ το, mεδιχαλ ηιστορψ, χαρε ορ τρεατmεντ οφ τηε γενδερ−ρελατεδ ιδεντιτψ, χονσιστεντ ανδ υνιφορm ασσερτιον οφ τηε γενδερ−ρελατεδ ιδεντιτψ ορ ανψ οτηερ εϖιδενχε τηατ τηε γενδερ−ρελατεδ ιδεντιτψ ισ σινχερελψ ηελδ, παρτ οφ α περσον∋σ χορε ιδεντιτψ ορ νοτ βεινγ ασσερτεδ φορ αν ιmπροπερ πυρποσε;
ϖ. さｪﾗﾗS a;ｷデｴゎ ﾏW;ﾐゲ デｴ;デ SWｪヴWW ﾗa SｷﾉｷｪWﾐIW ┘ｴｷIｴ ; ヴW;ゲﾗﾐ;HﾉW ヮWヴゲﾗﾐ ┘ﾗ┌ﾉS W┝WヴIｷゲW ｷﾐ τηε περφορmανχε οφ λεγαλ δυτιεσ ανδ οβλιγατιονσ;
ϖι. ∀γοοδ φαιτη εφφορτσ∀ σηαλλ ινχλυδε, βυτ νοτ βε λιmιτεδ το, τηοσε ρεασοναβλε ινιτιαλ εφφορτσ νεχεσσαρψ το χοmπλψ ωιτη στατυτορψ ορ ρεγυλατορψ ρεθυιρεmεντσ ανδ αδδιτιοναλ ορ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 127
#15..
- 458 -
4 συβστιτυτεδ εφφορτσ ωηεν ιτ ισ δετερmινεδ τηατ συχη ινιτιαλ εφφορτσ ωιλλ νοτ βε συφφιχιεντ το χοmπλψ ωιτη συχη ρεθυιρεmεντσ;
ϖιι. ∀mαριταλ στατυσ∀ mεανσ βεινγ σινγλε, mαρριεδ ασ ρεχογνιζεδ βψ τηε στατε οφ Χοννεχτιχυτ, ωιδοωεδ, σεπαρατεδ ορ διϖορχεδ;
ϖιιι. ∀mενταλ δισαβιλιτψ∀ mεανσ ονε ορ mορε mενταλ δισορδερσ, ασ δεφινεδ ιν τηε mοστ ρεχεντ εδιτιον οφ τηε Αmεριχαν Πσψχηιατριχ Ασσοχιατιον∋σ ∀Dιαγνοστιχ ανδ Στατιστιχαλ Μανυαλ οφ Μενταλ Dισορδερσ∀, ορ α ρεχορδ οφ ορ ρεγαρδινγ α περσον ασ ηαϖινγ ονε ορ mορε συχη δισορδερσ;
ιξ. ∀mινοριτψ βυσινεσσ εντερπρισε∀ mεανσ ανψ σmαλλ χοντραχτορ ορ συππλιερ οφ mατεριαλσ φιφτψ− ονε περχεντ ορ mορε οφ τηε χαπιταλ στοχκ, ιφ ανψ, ορ ασσετσ οφ ωηιχη ισ οωνεδ βψ α περσον ορ περσονσ: (1) ωηο αρε αχτιϖε ιν τηε δαιλψ αφφαιρσ οφ τηε εντερπρισε, (2) ωηο ηαϖε τηε ποωερ το διρεχτ τηε mαναγεmεντ ανδ πολιχιεσ οφ τηε εντερπρισε, ανδ (3) ωηο αρε mεmβερσ οφ α mινοριτψ, ασ συχη τερm ισ δεφινεδ ιν συβσεχτιον (α) οφ Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 32− 9ν; ανδ
ξ. ∀πυβλιχ ωορκσ χοντραχτ∀ mεανσ ανψ αγρεεmεντ βετωεεν ανψ ινδιϖιδυαλ, φιρm ορ χορπορατιον ανδ τηε Στατε ορ ανψ πολιτιχαλ συβδιϖισιον οφ τηε Στατε οτηερ τηαν α mυνιχιπαλιτψ φορ χονστρυχτιον, ρεηαβιλιτατιον, χονϖερσιον, εξτενσιον, δεmολιτιον ορ ρεπαιρ οφ α πυβλιχ βυιλδινγ, ηιγηωαψ ορ οτηερ χηανγεσ ορ ιmπροϖεmεντσ ιν ρεαλ προπερτψ, ορ ωηιχη ισ φινανχεδ ιν ωηολε ορ ιν παρτ βψ τηε Στατε, ινχλυδινγ, βυτ νοτ λιmιτεδ το, mατχηινγ εξπενδιτυρεσ, γραντσ, λοανσ, ινσυρανχε ορ γυαραντεεσ.
Fﾗヴ ヮ┌ヴヮﾗゲWゲ ﾗa デｴｷゲ SWIデｷﾗﾐが デｴW デWヴﾏゲ ゎCﾗﾐデヴ;Iデゎ ;ﾐS さIﾗﾐデヴ;Iデざ Sﾗ ﾐﾗデ ｷﾐIﾉ┌SW ; Iﾗﾐデヴ;Iデ ┘ｴWヴW W;Iｴ χοντραχτορ ισ (1) α πολιτιχαλ συβδιϖισιον οφ τηε στατε, ινχλυδινγ, βυτ νοτ λιmιτεδ το, α mυνιχιπαλιτψ, (2) α θυασι−πυβλιχ αγενχψ, ασ δεφινεδ ιν Χονν. Γεν. Στατ. Σεχτιον 1−120, (3) ανψ οτηερ στατε, ινχλυδινγ βυτ νοτ λιmιτεδ το ανψ φεδεραλλψ ρεχογνιζεδ Ινδιαν τριβαλ γοϖερνmεντσ, ασ δεφινεδ ιν Χονν. Γεν. Στατ. Σεχτιον 1− 267, (4) τηε φεδεραλ γοϖερνmεντ, (5) α φορειγν γοϖερνmεντ, ορ (6) αν αγενχψ οφ α συβδιϖισιον, αγενχψ, στατε ορ γοϖερνmεντ δεσχριβεδ ιν τηε ιmmεδιατελψ πρεχεδινγ ενυmερατεδ ιτεmσ (1), (2), (3), (4) ορ (5). (β) (1) Τηε Χοντραχτορ αγρεεσ ανδ ωαρραντσ τηατ ιν τηε περφορmανχε οφ τηε Χοντραχτ συχη Χοντραχτορ ωιλλ νοτ δισχριmινατε ορ περmιτ δισχριmινατιον αγαινστ ανψ περσον ορ γρουπ οφ περσονσ ον τηε γρουνδσ οφ ραχε, χολορ, ρελιγιουσ χρεεδ, αγε, mαριταλ στατυσ, νατιοναλ οριγιν, ανχεστρψ, σεξ, γενδερ ιδεντιτψ ορ εξπρεσσιον, ιντελλεχτυαλ δισαβιλιτψ, mενταλ δισαβιλιτψ ορ πηψσιχαλ δισαβιλιτψ, ινχλυδινγ, βυτ νοτ λιmιτεδ το, βλινδνεσσ, υνλεσσ ιτ ισ σηοων βψ συχη Χοντραχτορ τηατ συχη δισαβιλιτψ πρεϖεντσ περφορmανχε οφ τηε ωορκ ινϖολϖεδ, ιν ανψ mαννερ προηιβιτεδ βψ τηε λαωσ οφ τηε Υνιτεδ Στατεσ ορ οφ τηε Στατε οφ Χοννεχτιχυτ; ανδ τηε Χοντραχτορ φυρτηερ αγρεεσ το τακε αφφιρmατιϖε αχτιον το ινσυρε τηατ αππλιχαντσ ωιτη ϕοβ−ρελατεδ θυαλιφιχατιονσ αρε εmπλοψεδ ανδ τηατ εmπλοψεεσ αρε τρεατεδ ωηεν εmπλοψεδ ωιτηουτ ρεγαρδ το τηειρ ραχε, χολορ, ρελιγιουσ χρεεδ, αγε, mαριταλ στατυσ, νατιοναλ οριγιν, ανχεστρψ, σεξ, γενδερ ιδεντιτψ ορ εξπρεσσιον, ιντελλεχτυαλ δισαβιλιτψ, mενταλ δισαβιλιτψ ορ πηψσιχαλ δισαβιλιτψ, ινχλυδινγ, βυτ νοτ λιmιτεδ το, βλινδνεσσ, υνλεσσ ιτ ισ σηοων βψ τηε Χοντραχτορ τηατ συχη δισαβιλιτψ πρεϖεντσ περφορmανχε οφ τηε ωορκ ινϖολϖεδ; (2) τηε Χοντραχτορ αγρεεσ, ιν αλλ σολιχιτατιονσ ορ αδϖερτισεmεντσ φορ εmπλοψεεσ πλαχεδ βψ ορ ον βεηαλφ οφ τηε Χοντραχτορ, το στατε τηατ ιτ ισ αν ∀αφφιρmατιϖε αχτιον−εθυαλ οππορτυνιτψ εmπλοψερ∀ ιν αχχορδανχε ωιτη ρεγυλατιονσ αδοπτεδ βψ τηε Χοmmισσιον; (3) τηε Χοντραχτορ αγρεεσ το προϖιδε εαχη λαβορ υνιον ορ ρεπρεσεντατιϖε οφ ωορκερσ ωιτη ωηιχη τηε Χοντραχτορ ηασ α χολλεχτιϖε βαργαινινγ Αγρεεmεντ ορ οτηερ χοντραχτ ορ υνδερστανδινγ ανδ εαχη ϖενδορ ωιτη ωηιχη τηε Χοντραχτορ ηασ α χοντραχτ ορ υνδερστανδινγ, α νοτιχε το βε προϖιδεδ βψ τηε Χοmmισσιον, αδϖισινγ τηε λαβορ υνιον ορ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 128
#15..
- 459 -
5 ┘ﾗヴﾆWヴゲげ ヴWヮヴWゲWﾐデ;デｷ┗W ﾗa デｴW Cﾗﾐデヴ;Iデﾗヴろゲ IﾗﾏﾏｷデﾏWﾐデゲ ┌ﾐSWヴ デｴｷゲ ゲWIデｷﾗﾐ ;ﾐS デﾗ ヮﾗゲデ IﾗヮｷWゲ ﾗa デｴW νοτιχε ιν χονσπιχυουσ πλαχεσ αϖαιλαβλε το εmπλοψεεσ ανδ αππλιχαντσ φορ εmπλοψmεντ; (4) τηε Χοντραχτορ αγρεεσ το χοmπλψ ωιτη εαχη προϖισιον οφ τηισ Σεχτιον ανδ Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣♣ 46α−68ε ανδ 46α−68φ ανδ ωιτη εαχη ρεγυλατιον ορ ρελεϖαντ ορδερ ισσυεδ βψ σαιδ Χοmmισσιον πυρσυαντ το Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣♣ 46α−56, 46α−68ε ανδ 46α−68φ; ανδ (5) τηε Χοντραχτορ αγρεεσ το προϖιδε τηε Χοmmισσιον ον Ηυmαν Ριγητσ ανδ Οππορτυνιτιεσ ωιτη συχη ινφορmατιον ρεθυεστεδ βψ τηε Χοmmισσιον, ανδ περmιτ αχχεσσ το περτινεντ βοοκσ, ρεχορδσ ανδ αχχουντσ, χονχερνινγ τηε εmπλοψmεντ πραχτιχεσ ανδ προχεδυρεσ οφ τηε Χοντραχτορ ασ ρελατε το τηε προϖισιονσ οφ τηισ Σεχτιον ανδ Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 46α−56. Ιφ τηε χοντραχτ ισ α πυβλιχ ωορκσ χοντραχτ, τηε Χοντραχτορ αγρεεσ ανδ ωαρραντσ τηατ ηε ωιλλ mακε γοοδ φαιτη εφφορτσ το εmπλοψ mινοριτψ βυσινεσσ εντερπρισεσ ασ συβχοντραχτορσ ανδ συππλιερσ οφ mατεριαλσ ον συχη πυβλιχ ωορκσ προϕεχτσ.
(χ) Dετερmινατιον οφ τηε Χοντραχτορ∋σ γοοδ φαιτη εφφορτσ σηαλλ ινχλυδε, βυτ σηαλλ νοτ βε λιmιτεδ το, τηε φολλοωινγ φαχτορσ: Τηε Χοντραχτορ∋σ εmπλοψmεντ ανδ συβχοντραχτινγ πολιχιεσ, παττερνσ ανδ πραχτιχεσ; αφφιρmατιϖε αδϖερτισινγ, ρεχρυιτmεντ ανδ τραινινγ; τεχηνιχαλ ασσιστανχε αχτιϖιτιεσ ανδ συχη οτηερ ρεασοναβλε αχτιϖιτιεσ ορ εφφορτσ ασ τηε Χοmmισσιον mαψ πρεσχριβε τηατ αρε δεσιγνεδ το ενσυρε τηε παρτιχιπατιον οφ mινοριτψ βυσινεσσ εντερπρισεσ ιν πυβλιχ ωορκσ προϕεχτσ. (δ) Τηε Χοντραχτορ σηαλλ δεϖελοπ ανδ mαινταιν αδεθυατε δοχυmεντατιον, ιν α mαννερ πρεσχριβεδ βψ τηε Χοmmισσιον, οφ ιτσ γοοδ φαιτη εφφορτσ.
(ε) Τηε Χοντραχτορ σηαλλ ινχλυδε τηε προϖισιονσ οφ συβσεχτιον (β) οφ τηισ Σεχτιον ιν εϖερψ συβχοντραχτ ορ πυρχηασε ορδερ εντερεδ ιντο ιν ορδερ το φυλφιλλ ανψ οβλιγατιον οφ α χοντραχτ ωιτη τηε Στατε ανδ συχη προϖισιονσ σηαλλ βε βινδινγ ον α συβχοντραχτορ, ϖενδορ ορ mανυφαχτυρερ υνλεσσ εξεmπτεδ βψ ρεγυλατιονσ ορ ορδερσ οφ τηε Χοmmισσιον. Τηε Χοντραχτορ σηαλλ τακε συχη αχτιον ωιτη ρεσπεχτ το ανψ συχη συβχοντραχτ ορ πυρχηασε ορδερ ασ τηε Χοmmισσιον mαψ διρεχτ ασ α mεανσ οφ ενφορχινγ συχη προϖισιονσ ινχλυδινγ σανχτιονσ φορ νονχοmπλιανχε ιν αχχορδανχε ωιτη Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣46α−56; προϖιδεδ ιφ συχη Χοντραχτορ βεχοmεσ ινϖολϖεδ ιν, ορ ισ τηρεατενεδ ωιτη, λιτιγατιον ωιτη α συβχοντραχτορ ορ ϖενδορ ασ α ρεσυλτ οφ συχη διρεχτιον βψ τηε Χοmmισσιον, τηε Χοντραχτορ mαψ ρεθυεστ τηε Στατε οφ Χοννεχτιχυτ το εντερ ιντο ανψ συχη λιτιγατιον ορ νεγοτιατιον πριορ τηερετο το προτεχτ τηε ιντερεστσ οφ τηε Στατε ανδ τηε Στατε mαψ σο εντερ. (φ) Τηε Χοντραχτορ αγρεεσ το χοmπλψ ωιτη τηε ρεγυλατιονσ ρεφερρεδ το ιν τηισ Σεχτιον ασ τηεψ εξιστ ον τηε δατε οφ τηισ Χοντραχτ ανδ ασ τηεψ mαψ βε αδοπτεδ ορ αmενδεδ φροm τιmε το τιmε δυρινγ τηε τερm οφ τηισ Χοντραχτ ανδ ανψ αmενδmεντσ τηερετο.
(γ) (1) Τηε Χοντραχτορ αγρεεσ ανδ ωαρραντσ τηατ ιν τηε περφορmανχε οφ τηε Χοντραχτ συχη Χοντραχτορ ωιλλ νοτ δισχριmινατε ορ περmιτ δισχριmινατιον αγαινστ ανψ περσον ορ γρουπ οφ περσονσ ον τηε γρουνδσ οφ σεξυαλ οριεντατιον, ιν ανψ mαννερ προηιβιτεδ βψ τηε λαωσ οφ τηε Υνιτεδ Στατεσ ορ τηε Στατε οφ Χοννεχτιχυτ, ανδ τηατ εmπλοψεεσ αρε τρεατεδ ωηεν εmπλοψεδ ωιτηουτ ρεγαρδ το τηειρ σεξυαλ οριεντατιον; (2) τηε Χοντραχτορ αγρεεσ το προϖιδε εαχη λαβορ υνιον ορ ρεπρεσεντατιϖε οφ ωορκερσ ωιτη ωηιχη συχη Χοντραχτορ ηασ α χολλεχτιϖε βαργαινινγ Αγρεεmεντ ορ οτηερ χοντραχτ ορ υνδερστανδινγ ανδ εαχη ϖενδορ ωιτη ωηιχη συχη Χοντραχτορ ηασ α χοντραχτ ορ υνδερστανδινγ, α State of Utah Bid CH16012
3/22/2016 4:23 PM p. 129
#15..
- 460 -
6 νοτιχε το βε προϖιδεδ βψ τηε Χοmmισσιον ον Ηυmαν Ριγητσ ανδ Οππορτυνιτιεσ αδϖισινγ τηε λαβορ υνιον ορ ωορκερσ∋ ρεπρεσεντατιϖε οφ τηε Χοντραχτορ∋σ χοmmιτmεντσ υνδερ τηισ σεχτιον, ανδ το ποστ χοπιεσ οφ τηε νοτιχε ιν χονσπιχυουσ πλαχεσ αϖαιλαβλε το εmπλοψεεσ ανδ αππλιχαντσ φορ εmπλοψmεντ; (3) τηε Χοντραχτορ αγρεεσ το χοmπλψ ωιτη εαχη προϖισιον οφ τηισ σεχτιον ανδ ωιτη εαχη ρεγυλατιον ορ ρελεϖαντ ορδερ ισσυεδ βψ σαιδ Χοmmισσιον πυρσυαντ το Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 46α−56; ανδ (4) τηε Χοντραχτορ αγρεεσ το προϖιδε τηε Χοmmισσιον ον Ηυmαν Ριγητσ ανδ Οππορτυνιτιεσ ωιτη συχη ινφορmατιον ρεθυεστεδ βψ τηε Χοmmισσιον, ανδ περmιτ αχχεσσ το περτινεντ βοοκσ, ρεχορδσ ανδ αχχουντσ, χονχερνινγ τηε εmπλοψmεντ πραχτιχεσ ανδ προχεδυρεσ οφ τηε Χοντραχτορ ωηιχη ρελατε το τηε προϖισιονσ οφ τηισ Σεχτιον ανδ Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 46α−56. (η) Τηε Χοντραχτορ σηαλλ ινχλυδε τηε προϖισιονσ οφ τηε φορεγοινγ παραγραπη ιν εϖερψ συβχοντραχτ ορ πυρχηασε ορδερ εντερεδ ιντο ιν ορδερ το φυλφιλλ ανψ οβλιγατιον οφ α χοντραχτ ωιτη τηε Στατε ανδ συχη προϖισιονσ σηαλλ βε βινδινγ ον α συβχοντραχτορ, ϖενδορ ορ mανυφαχτυρερ υνλεσσ εξεmπτεδ βψ ρεγυλατιονσ ορ ορδερσ οφ τηε Χοmmισσιον. Τηε Χοντραχτορ σηαλλ τακε συχη αχτιον ωιτη ρεσπεχτ το ανψ συχη συβχοντραχτ ορ πυρχηασε ορδερ ασ τηε Χοmmισσιον mαψ διρεχτ ασ α mεανσ οφ ενφορχινγ συχη προϖισιονσ ινχλυδινγ σανχτιονσ φορ νονχοmπλιανχε ιν αχχορδανχε ωιτη Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 46α−56; προϖιδεδ, ιφ συχη Χοντραχτορ βεχοmεσ ινϖολϖεδ ιν, ορ ισ τηρεατενεδ ωιτη, λιτιγατιον ωιτη α συβχοντραχτορ ορ ϖενδορ ασ α ρεσυλτ οφ συχη διρεχτιον βψ τηε Χοmmισσιον, τηε Χοντραχτορ mαψ ρεθυεστ τηε Στατε οφ Χοννεχτιχυτ το εντερ ιντο ανψ συχη λιτιγατιον ορ νεγοτιατιον πριορ τηερετο το προτεχτ τηε ιντερεστσ οφ τηε Στατε ανδ τηε Στατε mαψ σο εντερ.
9. Ινδεmνιφιχατιον.
(α)Τηε Χοντραχτορ σηαλλ ινδεmνιφψ, δεφενδ ανδ ηολδ ηαρmλεσσ τηε Στατε ανδ ιτσ οφφιχερσ, ρεπρεσεντατιϖεσ, αγεντσ, σερϖαντσ, εmπλοψεεσ, συχχεσσορσ ανδ ασσιγνσ φροm ανδ αγαινστ ανψ ανδ αλλ (1) Χλαιmσ αρισινγ, διρεχτλψ ορ ινδιρεχτλψ, ιν χοννεχτιον ωιτη τηε Χοντραχτ, ινχλυδινγ τηε αχτσ οφ χοmmισσιον ορ οmισσιον (χολλεχτιϖελψ, τηε ∀Αχτσ∀) οφ τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ; ανδ (2) λιαβιλιτιεσ, δαmαγεσ, λοσσεσ, χοστσ ανδ εξπενσεσ, ινχλυδινγ βυτ νοτ λιmιτεδ το, αττορνεψσ∋ ανδ οτηερ προφεσσιοναλσ∋ φεεσ, αρισινγ, διρεχτλψ ορ ινδιρεχτλψ, ιν χοννεχτιον ωιτη Χλαιmσ, Αχτσ ορ τηε Χοντραχτ. Τηε Χοντραχτορ σηαλλ υσε χουνσελ ρεασοναβλψ αχχεπταβλε το τηε Στατε ιν χαρρψινγ ουτ ιτσ οβλιγατιονσ υνδερ τηισ σεχτιον. Τηε Cﾗﾐデヴ;Iデﾗヴげゲ ﾗHﾉｷｪ;デｷﾗﾐゲ ┌ﾐSWヴ デｴｷゲ ゲWIデｷﾗﾐ デﾗ ｷﾐSWﾏﾐｷa┞, δεφενδ ανδ ηολδ ηαρmλεσσ αγαινστ Χλαιmσ ｷﾐIﾉ┌SWゲ Cﾉ;ｷﾏゲ IﾗﾐIWヴﾐｷﾐｪ IﾗﾐaｷSWﾐデｷ;ﾉｷデ┞ ﾗa ;ﾐ┞ ヮ;ヴデ ﾗa ﾗヴ ;ﾉﾉ ﾗa デｴW Cﾗﾐデヴ;Iデﾗヴげゲ HｷSが ヮヴﾗヮﾗゲ;ﾉ ﾗヴ ανψ Ρεχορδσ, ανψ ιντελλεχτυαλ προπερτψ ριγητσ, οτηερ προπριεταρψ ριγητσ οφ ανψ περσον ορ εντιτψ, χοπψριγητεδ ορ υνχοπψριγητεδ χοmποσιτιονσ, σεχρετ προχεσσεσ, πατεντεδ ορ υνπατεντεδ ινϖεντιονσ, αρτιχλεσ ορ αππλιανχεσ φυρνισηεδ ορ υσεδ ιν τηε περφορmανχε. (β)Τηε Χοντραχτορ σηαλλ νοτ βε ρεσπονσιβλε φορ ινδεmνιφψινγ ορ ηολδινγ τηε Στατε ηαρmλεσσ φροm ανψ λιαβιλιτψ αρισινγ δυε το τηε νεγλιγενχε οφ τηε Στατε ορ ανψ οτηερ περσον ορ εντιτψ αχτινγ υνδερ τηε διρεχτ χοντρολ ορ συπερϖισιον οφ τηε Στατε.
(χ) Τηε Χοντραχτορ σηαλλ ρειmβυρσε τηε Στατε φορ ανψ ανδ αλλ δαmαγεσ το τηε ρεαλ ορ περσοναλ προπερτψ οφ τηε Στατε χαυσεδ βψ τηε Αχτσ οφ τηε Χοντραχτορ ορ ανψ Χοντραχτορ Παρτιεσ. Τηε Στατε σηαλλ γιϖε τηε Χοντραχτορ ρεασοναβλε νοτιχε οφ ανψ συχη Χλαιmσ.
(δ)TｴW Cﾗﾐデヴ;Iデﾗヴげゲ S┌デｷWゲ ┌ﾐSWヴ デｴｷゲ ゲWIデｷﾗﾐ ゲｴ;ﾉﾉ ヴWﾏ;ｷﾐ a┌ﾉﾉ┞ ｷﾐ WaaWIデ ;ﾐS HｷﾐSｷﾐｪ ｷﾐ ;IIﾗヴS;ﾐIW ┘ｷデｴ τηε τερmσ ανδ χονδιτιονσ οφ τηε Χοντραχτ, ωιτηουτ βεινγ λεσσενεδ ορ χοmπροmισεδ ιν ανψ ωαψ, εϖεν ωηερε τηε Χοντραχτορ ισ αλλεγεδ ορ ισ φουνδ το ηαϖε mερελψ χοντριβυτεδ ιν παρτ το τηε Αχτσ γιϖινγ ρισε State of Utah Bid CH16012
3/22/2016 4:23 PM p. 130
#15..
- 461 -
7 το τηε Χλαιmσ ανδ/ορ ωηερε τηε Στατε ισ αλλεγεδ ορ ισ φουνδ το ηαϖε χοντριβυτεδ το τηε Αχτσ γιϖινγ ρισε το τηε Χλαιmσ.
(ε)Τηε Χοντραχτορ σηαλλ χαρρψ ανδ mαινταιν ατ αλλ τιmεσ δυρινγ τηε τερm οφ τηε Χοντραχτ, ανδ δυρινγ τηε τιmε τηατ ανψ προϖισιονσ συρϖιϖε τηε τερm οφ τηε Χοντραχτ, συφφιχιεντ γενεραλ λιαβιλιτψ ινσυρανχε το σατισφψ ιτσ οβλιγατιονσ υνδερ τηισ Χοντραχτ. Τηε Χοντραχτορ σηαλλ ναmε τηε Στατε ασ αν αδδιτιοναλ ινσυρεδ ον τηε πολιχψ ανδ σηαλλ προϖιδε α χοπψ οφ τηε πολιχψ το τηε Αγενχψ πριορ το τηε εφφεχτιϖε δατε οφ τηε Χοντραχτ. Τηε Χοντραχτορ σηαλλ νοτ βεγιν περφορmανχε υντιλ τηε δελιϖερψ οφ τηε πολιχψ το τηε Αγενχψ. Τηε Αγενχψ σηαλλ βε εντιτλεδ το ρεχοϖερ υνδερ τηε ινσυρανχε πολιχψ εϖεν ιφ α βοδψ οφ χοmπετεντ ϕυρισδιχτιον δετερmινεσ τηατ τηε Αγενχψ ορ τηε Στατε ισ χοντριβυτοριλψ νεγλιγεντ. (φ) Τηε ριγητσ προϖιδεδ ιν τηισ σεχτιον φορ τηε βενεφιτ οφ τηε Στατε σηαλλ ενχοmπασσ τηε ρεχοϖερψ οφ ;デデﾗヴﾐW┞ゲげ ;ﾐS ﾗデｴWヴ ヮヴﾗaWゲゲｷﾗﾐ;ﾉゲげ aWWゲ W┝ヮWﾐSWS ｷﾐ ヮ┌ヴゲ┌ｷﾐｪ ; Cﾉ;ｷﾏ ;ｪ;ｷﾐゲデ ; デｴｷヴS ヮ;ヴデ┞く (γ)Τηισ σεχτιον σηαλλ συρϖιϖε τηε Τερmινατιον οφ τηε Χοντραχτ ανδ σηαλλ νοτ βε λιmιτεδ βψ ρεασον οφ ανψ ινσυρανχε χοϖεραγε.
10. Τανγιβλε Περσοναλ Προπερτψ.
(a) Τηε Χοντραχτορ ον ιτσ βεηαλφ ανδ ον βεηαλφ οφ ιτσ Αφφιλιατεσ, ασ δεφινεδ βελοω, σηαλλ χοmπλψ ωιτη τηε προϖισιονσ οφ Χονν. Γεν. Στατ. ♣12−411β, ασ φολλοωσ:
(1) Φορ τηε τερm οφ τηε Χοντραχτ, τηε Χοντραχτορ ανδ ιτσ Αφφιλιατεσ σηαλλ χολλεχτ ανδ ρεmιτ το τηε Στατε οφ Χοννεχτιχυτ, Dεπαρτmεντ οφ Ρεϖενυε Σερϖιχεσ, ανψ Χοννεχτιχυτ υσε ταξ δυε υνδερ τηε προϖισιονσ οφ Χηαπτερ 219 οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ φορ ιτεmσ οφ τανγιβλε περσοναλ προπερτψ σολδ βψ τηε Χοντραχτορ ορ βψ ανψ οφ ιτσ Αφφιλιατεσ ιν τηε σαmε mαννερ ασ ιφ τηε Χοντραχτορ ανδ συχη Αφφιλιατεσ ωερε ενγαγεδ ιν τηε βυσινεσσ οφ σελλινγ τανγιβλε περσοναλ προπερτψ φορ υσε ιν Χοννεχτιχυτ ανδ ηαδ συφφιχιεντ νεξυσ υνδερ τηε προϖισιονσ οφ Χηαπτερ 219 το βε ρεθυιρεδ το χολλεχτ Χοννεχτιχυτ υσε ταξ; (2) A I┌ゲデﾗﾏWヴげゲ ヮ;┞ﾏWﾐデ ﾗa ; ┌ゲW デ;┝ デﾗ デｴW Cﾗﾐデヴ;Iデﾗヴ ﾗヴ ｷデゲ Aaaｷﾉｷ;デWゲ ヴWﾉｷW┗Wゲ デｴW I┌ゲデﾗﾏWヴ ﾗa ﾉｷ;Hｷﾉｷデ┞ φορ τηε υσε ταξ;
(3) Τηε Χοντραχτορ ανδ ιτσ Αφφιλιατεσ σηαλλ ρεmιτ αλλ υσε ταξεσ τηεψ χολλεχτ φροm χυστοmερσ ον ορ βεφορε τηε δυε δατε σπεχιφιεδ ιν τηε Χοντραχτ, ωηιχη mαψ νοτ βε λατερ τηαν τηε λαστ δαψ οφ τηε mοντη νεξτ συχχεεδινγ τηε ενδ οφ α χαλενδαρ θυαρτερ ορ οτηερ ταξ χολλεχτιον περιοδ δυρινγ ωηιχη τηε ταξ ωασ χολλεχτεδ;
(4) Τηε Χοντραχτορ ανδ ιτσ Αφφιλιατεσ αρε νοτ λιαβλε φορ υσε ταξ βιλλεδ βψ τηεm βυτ νοτ παιδ το τηεm βψ α χυστοmερ; ανδ
(5) Ανψ Χοντραχτορ ορ Αφφιλιατε ωηο φαιλσ το ρεmιτ υσε ταξεσ χολλεχτεδ ον βεηαλφ οφ ιτσ χυστοmερσ βψ τηε δυε δατε σπεχιφιεδ ιν τηε Χοντραχτ σηαλλ βε συβϕεχτ το τηε ιντερεστ ανδ πεναλτιεσ προϖιδεδ φορ περσονσ ρεθυιρεδ το χολλεχτ σαλεσ ταξ υνδερ χηαπτερ 219 οφ τηε γενεραλ στατυτεσ. (β) Fﾗヴ ヮ┌ヴヮﾗゲWゲ ﾗa デｴｷゲ ゲWIデｷﾗﾐ ﾗa デｴW Cﾗﾐデヴ;Iデが デｴW ┘ﾗヴS さAaaｷﾉｷ;デWざ ﾏW;ﾐゲ ;ﾐ┞ ヮWヴゲﾗﾐが ;ゲ SWaｷﾐWS ｷﾐ σεχτιον 12−1 οφ τηε γενεραλ στατυτεσ, τηατ χοντρολσ, ισ χοντρολλεδ βψ, ορ ισ υνδερ χοmmον χοντρολ ωιτη ανοτηερ περσον. Α περσον χοντρολσ ανοτηερ περσον ιφ τηε περσον οωνσ, διρεχτλψ ορ ινδιρεχτλψ, mορε デｴ;ﾐ デWﾐ ヮWヴ IWﾐデ ﾗa デｴW ┗ﾗデｷﾐｪ ゲWI┌ヴｷデｷWゲ ﾗa デｴW ﾗデｴWヴ ヮWヴゲﾗﾐく TｴW ┘ﾗヴS さ┗ﾗデｷﾐｪ ゲWI┌ヴｷデ┞ざ ﾏW;ﾐゲ ; σεχυριτψ τηατ χονφερσ υπον τηε ηολδερ τηε ριγητ το ϖοτε φορ τηε ελεχτιον οφ mεmβερσ οφ τηε βοαρδ οφ διρεχτορσ ορ σιmιλαρ γοϖερνινγ βοδψ οφ τηε βυσινεσσ, ορ τηατ ισ χονϖερτιβλε ιντο, ορ εντιτλεσ τηε ηολδερ デﾗ ヴWIWｷ┗Wが ┌ヮﾗﾐ ｷデゲ W┝WヴIｷゲWが ; ゲWI┌ヴｷデ┞ デｴ;デ IﾗﾐaWヴゲ ゲ┌Iｴ ; ヴｷｪｴデ デﾗ ┗ﾗデWく さVﾗデｷﾐｪ ゲWI┌ヴｷデ┞ざ ｷﾐIﾉ┌SWゲ ; γενεραλ παρτνερσηιπ ιντερεστ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 131
#15..
- 462 -
8 (χ) Τηε Χοντραχτορ ρεπρεσεντσ ανδ ωαρραντσ τηατ εαχη οφ ιτσ Αφφιλιατεσ ηασ ϖεστεδ ιν τηε Χοντραχτορ πλεναρψ αυτηοριτψ το σο βινδ τηε Αφφιλιατεσ ιν ανψ αγρεεmεντ ωιτη τηε Στατε οφ Χοννεχτιχυτ. Τηε Χοντραχτορ ον ιτσ οων βεηαλφ ανδ ον βεηαλφ οφ ιτσ Αφφιλιατεσ σηαλλ αλσο προϖιδε, νο λατερ τηαν 30 δαψσ ;aデWヴ ヴWIWｷ┗ｷﾐｪ ; ヴWケ┌Wゲデ H┞ デｴW Sデ;デWげゲ Iﾗﾐデヴ;Iデｷﾐｪ ;┌デｴﾗヴｷデ┞が ゲ┌Iｴ ｷﾐaﾗヴﾏ;デｷﾗﾐ ;ゲ デｴW Sデ;デW ﾏ;┞ ヴWケ┌ｷヴW デﾗ Wﾐゲ┌ヴWが ｷﾐ デｴW Sデ;デWげゲ ゲﾗﾉW SWデWヴﾏｷﾐ;デｷﾗﾐが Iﾗﾏヮﾉｷ;ﾐIW ┘ｷデｴ デｴW ヮヴﾗ┗ｷゲｷﾗﾐゲ ﾗa Cｴ;ヮデWヴ ヲヱΓ οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ, ινχλυδινγ, βυτ νοτ λιmιτεδ το, ♣12−411β.
11. Αυδιτ ανδ Ινσπεχτιον οφ Πλαντσ, Πλαχεσ οφ Βυσινεσσ ανδ Ρεχορδσ. (α) Τηε Στατε ανδ ιτσ αγεντσ, ινχλυδινγ, βυτ νοτ λιmιτεδ το, τηε Χοννεχτιχυτ Αυδιτορσ οφ Πυβλιχ AIIﾗ┌ﾐデゲが AデデﾗヴﾐW┞ GWﾐWヴ;ﾉ ;ﾐS Sデ;デWげゲ AデデﾗヴﾐW┞ ;ﾐS デｴWｷρ ρεσπεχτιϖε αγεντσ, mαψ, ατ ヴW;ゲﾗﾐ;HﾉW ｴﾗ┌ヴゲが ｷﾐゲヮWIデ ;ﾐS W┝;ﾏｷﾐW ;ﾉﾉ ﾗa デｴW ヮ;ヴデゲ ﾗa デｴW Cﾗﾐデヴ;Iデﾗヴげゲ ;ﾐS Cﾗﾐデヴ;Iデﾗヴ P;ヴデｷWゲげ ヮﾉ;ﾐデゲ ;ﾐS ヮﾉ;IWゲ ﾗa H┌ゲｷﾐWゲゲ ┘ｴｷIｴが ｷﾐ ;ﾐ┞ ┘;┞が ;ヴW ヴWﾉ;デWS デﾗが ﾗヴ ｷﾐ┗ﾗﾉ┗WS ｷﾐが デｴW περφορmανχε οφ τηισ Χοντραχτ.
(β) Τηε Χοντραχτορ σηαλλ mαινταιν, ανδ σηαλλ ρεθυιρε εαχη οφ τηε Χοντραχτορ Παρτιεσ το mαινταιν, αχχυρατε ανδ χοmπλετε Ρεχορδσ. TｴW Cﾗﾐデヴ;Iデﾗヴ ゲｴ;ﾉﾉ ﾏ;ﾆW ;ﾉﾉ ﾗa ｷデゲ ;ﾐS デｴW Cﾗﾐデヴ;Iデﾗヴ P;ヴデｷWゲげ Ρεχορδσ αϖαιλαβλε ατ αλλ ρεασοναβλε ηουρσ φορ αυδιτ ανδ ινσπεχτιον βψ τηε Στατε ανδ ιτσ αγεντσ. (χ) Τηε Στατε σηαλλ mακε αλλ ρεθυεστσ φορ ανψ αυδιτ ορ ινσπεχτιον ιν ωριτινγ ανδ σηαλλ προϖιδε τηε Χοντραχτορ ωιτη ατ λεαστ τωεντψ−aﾗ┌ヴ ふヲヴぶ ｴﾗ┌ヴゲげ ﾐﾗデｷIW πριορ το τηε ρεθυεστεδ αυδιτ ανδ ινσπεχτιον δατε. Ιφ τηε Στατε συσπεχτσ φραυδ ορ οτηερ αβυσε, ορ ιν τηε εϖεντ οφ αν εmεργενχψ, τηε Στατε ισ νοτ οβλιγατεδ το προϖιδε ανψ πριορ νοτιχε.
(δ) Aﾉﾉ ;┌Sｷデゲ ;ﾐS ｷﾐゲヮWIデｷﾗﾐゲ ゲｴ;ﾉﾉ HW ;デ デｴW Sデ;デWげゲ W┝ヮWﾐゲWく (ε) Τηε Χοντραχτορ σηαλλ κεεπ ανδ πρεσερϖε ορ χαυσε το βε κεπτ ανδ πρεσερϖεδ αλλ οφ ιτσ ανδ Cﾗﾐデヴ;Iデﾗヴ P;ヴデｷWゲげ RWIﾗヴSゲ ┌ﾐデｷﾉ デｴヴWW ふンぶ ┞W;ヴゲ ;aデWヴ デｴW ﾉ;デデWヴ ﾗa ふｷぶ aｷﾐ;ﾉ ヮ;┞ﾏWﾐデ ┌ﾐSWヴ デｴｷゲ Χοντραχτ, ορ (ιι) τηε εξπιρατιον ορ εαρλιερ τερmινατιον οφ τηισ Χοντραχτ, ασ τηε σαmε mαψ βε mοδιφιεδ φορ ανψ ρεασον. Τηε Στατε mαψ ρεθυεστ αν αυδιτ ορ ινσπεχτιον ατ ανψ τιmε δυρινγ τηισ περιοδ. Ιφ ανψ Χλαιm ορ αυδιτ ισ σταρτεδ βεφορε τηε εξπιρατιον οφ τηισ περιοδ, τηε Χοντραχτορ σηαλλ ρεταιν ορ χαυσε το βε ρεταινεδ αλλ Ρεχορδσ υντιλ αλλ Χλαιmσ ορ αυδιτ φινδινγσ ηαϖε βεεν ρεσολϖεδ. (φ) Τηε Χοντραχτορ σηαλλ χοοπερατε φυλλψ ωιτη τηε Στατε ανδ ιτσ αγεντσ ιν χοννεχτιον ωιτη αν αυδιτ ορ ινσπεχτιον. Φολλοωινγ ανψ αυδιτ ορ ινσπεχτιον, τηε Στατε mαψ χονδυχτ ανδ τηε Χοντραχτορ σηαλλ χοοπερατε ωιτη αν εξιτ χονφερενχε.
(γ) Τηε Χοντραχτορ σηαλλ ινχορπορατε τηισ εντιρε Σεχτιον ϖερβατιm ιντο ανψ χοντραχτ ορ οτηερ αγρεεmεντ τηατ ιτ εντερσ ιντο ωιτη ανψ Χοντραχτορ Παρτψ.
12. Προτεχτιον οφ Χονφιδεντιαλ Ινφορmατιον.
(α) Χοντραχτορ ανδ Χοντραχτορ Παρτιεσ, ατ τηειρ οων εξπενσε, ηαϖε α δυτψ το ανδ σηαλλ προτεχτ φροm α Χονφιδεντιαλ Ινφορmατιον Βρεαχη ανψ ανδ αλλ Χονφιδεντιαλ Ινφορmατιον ωηιχη τηεψ χοmε το ποσσεσσ ορ χοντρολ, ωηερεϖερ ανδ ηοωεϖερ στορεδ ορ mαινταινεδ, ιν α χοmmερχιαλλψ ρεασοναβλε mαννερ ιν αχχορδανχε ωιτη χυρρεντ ινδυστρψ στανδαρδσ.
(β) Εαχη Χοντραχτορ ορ Χοντραχτορ Παρτψ σηαλλ δεϖελοπ, ιmπλεmεντ ανδ mαινταιν α χοmπρεηενσιϖε δατα − σεχυριτψ προγραm φορ τηε προτεχτιον οφ Χονφιδεντιαλ Ινφορmατιον. Τηε σαφεγυαρδσ χονταινεδ ιν συχη προγραm σηαλλ βε χονσιστεντ ωιτη ανδ χοmπλψ ωιτη τηε σαφεγυαρδσ φορ προτεχτιον οφ Χονφιδεντιαλ Ινφορmατιον, ανδ ινφορmατιον οφ α σιmιλαρ χηαραχτερ, ασ σετ φορτη ιν αλλ αππλιχαβλε φεδεραλ ανδ στατε λαω State of Utah Bid CH16012
3/22/2016 4:23 PM p. 132
#15..
- 463 -
9 ανδ ωριττεν πολιχψ οφ τηε Dεπαρτmεντ ορ Στατε χονχερνινγ τηε χονφιδεντιαλιτψ οφ Χονφιδεντιαλ Ινφορmατιον. Συχη δατα−σεχυριτψ προγραm σηαλλ ινχλυδε, βυτ νοτ βε λιmιτεδ το, τηε φολλοωινγ:
(1)Α σεχυριτψ πολιχψ φορ εmπλοψεεσ ρελατεδ το τηε στοραγε, αχχεσσ ανδ τρανσπορτατιον οφ δατα χονταινινγ Χονφιδεντιαλ Ινφορmατιον;
(2)Ρεασοναβλε ρεστριχτιονσ ον αχχεσσ το ρεχορδσ χονταινινγ Χονφιδεντιαλ Ινφορmατιον, ινχλυδινγ αχχεσσ το ανψ λοχκεδ στοραγε ωηερε συχη ρεχορδσ αρε κεπτ; (3)Α προχεσσ φορ ρεϖιεωινγ πολιχιεσ ανδ σεχυριτψ mεασυρεσ ατ λεαστ αννυαλλψ; (4)Χρεατινγ σεχυρε αχχεσσ χοντρολσ το Χονφιδεντιαλ Ινφορmατιον, ινχλυδινγ βυτ νοτ λιmιτεδ το πασσωορδσ; ανδ
(5)Ενχρψπτινγ οφ Χονφιδεντιαλ Ινφορmατιον τηατ ισ στορεδ ον λαπτοπσ, πορταβλε δεϖιχεσ ορ βεινγ τρανσmιττεδ ελεχτρονιχαλλψ.
(χ) Τηε Χοντραχτορ ανδ Χοντραχτορ Παρτιεσ σηαλλ νοτιφψ τηε Dεπαρτmεντ ανδ τηε Χοννεχτιχυτ Οφφιχε οφ τηε Αττορνεψ Γενεραλ ασ σοον ασ πραχτιχαλ, βυτ νο λατερ τηαν τωεντψ−φουρ (24) ηουρσ, αφτερ τηεψ βεχοmε αωαρε οφ ορ συσπεχτ τηατ ανψ Χονφιδεντιαλ Ινφορmατιον ωηιχη Χοντραχτορ ορ Χοντραχτορ Παρτιεσ ηαϖε χοmε το ποσσεσσ ορ χοντρολ ηασ βεεν συβϕεχτ το α Χονφιδεντιαλ Ινφορmατιον Βρεαχη. Ιφ α Χονφιδεντιαλ Ινφορmατιον Βρεαχη ηασ οχχυρρεδ, τηε Χοντραχτορ σηαλλ, ωιτηιν τηρεε (3) βυσινεσσ δαψσ αφτερ τηε νοτιφιχατιον, πρεσεντ α χρεδιτ mονιτορινγ ανδ προτεχτιον πλαν το τηε Χοmmισσιονερ οφ Αδmινιστρατιϖε Σερϖιχεσ, τηε Dεπαρτmεντ ανδ τηε Χοννεχτιχυτ Οφφιχε οφ τηε Αττορνεψ Γενεραλ, φορ ρεϖιεω ανδ αππροϖαλ. Συχη χρεδιτ mονιτορινγ ορ προτεχτιον πλαν σηαλλ βε mαδε αϖαιλαβλε βψ τηε Χοντραχτορ ατ ιτσ οων χοστ ανδ εξπενσε το αλλ ινδιϖιδυαλσ αφφεχτεδ βψ τηε Χονφιδεντιαλ Ινφορmατιον Βρεαχη. Συχη χρεδιτ mονιτορινγ ορ προτεχτιον πλαν σηαλλ ινχλυδε, βυτ ισ νοτ λιmιτεδ το ρειmβυρσεmεντ φορ τηε χοστ οφ πλαχινγ ανδ λιφτινγ ονε (1) σεχυριτψ φρεεζε περ χρεδιτ φιλε πυρσυαντ το Χοννεχτιχυτ Γενεραλ Στατυτεσ ♣ 36α−701α. Συχη χρεδιτ mονιτορινγ ορ προτεχτιον πλανσ σηαλλ βε αππροϖεδ βψ τηε Στατε ιν αχχορδανχε ωιτη τηισ Σεχτιον ανδ σηαλλ χοϖερ α λενγτη οφ τιmε χοmmενσυρατε ωιτη τηε χιρχυmστανχεσ οφ τηε CﾗﾐaｷSWﾐデｷ;ﾉ Iﾐaﾗヴﾏ;デｷﾗﾐ BヴW;Iｴく TｴW Cﾗﾐデヴ;Iデﾗヴゲげ Iﾗゲデゲ ;ﾐS W┝ヮWﾐゲWゲ aﾗヴ デｴW IヴWSｷデ ﾏﾗﾐｷデﾗヴｷﾐｪ ;ﾐS προτεχτιον πλαν σηαλλ νοτ βε ρεχοϖεραβλε φροm τηε Dεπαρτmεντ, ανψ Στατε οφ Χοννεχτιχυτ εντιτψ ορ ανψ αφφεχτεδ ινδιϖιδυαλσ.
(δ) Τηε Χοντραχτορ σηαλλ ινχορπορατε τηε ρεθυιρεmεντσ οφ τηισ Σεχτιον ιν αλλ συβχοντραχτσ ρεθυιρινγ εαχη Χοντραχτορ Παρτψ το σαφεγυαρδ Χονφιδεντιαλ Ινφορmατιον ιν τηε σαmε mαννερ ασ προϖιδεδ φορ ιν τηισ Σεχτιον.
(ε) Nﾗデｴｷﾐｪ ｷﾐ デｴｷゲ SWIデｷﾗﾐ ゲｴ;ﾉﾉ ゲ┌ヮWヴゲWSW ｷﾐ ;ﾐ┞ ﾏ;ﾐﾐWヴ Cﾗﾐデヴ;Iデﾗヴげゲ ﾗヴ Cﾗﾐデヴ;Iデﾗヴ P;ヴデ┞げゲ ﾗHﾉｷｪ;デｷﾗﾐゲ πυρσυαντ το ΗΙΠΑΑ ορ τηε προϖισιονσ οφ τηισ Χοντραχτ χονχερνινγ τηε οβλιγατιονσ οφ τηε Χοντραχτορ ασ α Βυσινεσσ Ασσοχιατε οφ τηε Dεπαρτmεντ.
13. Φινανχιαλ Αυδιτ φορ Στατε Γραντσ. Φορ πυρποσεσ οφ τηισ παραγραπη, τηε ωορδ ∀χοντραχτορ∀ σηαλλ βε δεεmεδ το mεαν ∀νονστατε εντιτψ,∀ ασ τηατ τερm ισ δεφινεδ ιν Σεχτιον 4−230 οφ τηε Χοννεχτιχυτ Γενεραλ Στατυτεσ. Τηε χοντραχτορ σηαλλ προϖιδε φορ αν αννυαλ φινανχιαλ αυδιτ αχχεπταβλε το τηε Dεπαρτmεντ φορ ανψ εξπενδιτυρε οφ στατε−αωαρδεδ φυνδσ mαδε βψ τηε χοντραχτορ. Συχη αυδιτ σηαλλ ινχλυδε mαναγεmεντ λεττερσ ανδ αυδιτ ρεχοmmενδατιονσ. Τηε Στατε Αυδιτορσ οφ Πυβλιχ Αχχουντσ σηαλλ ηαϖε αχχεσσ το αλλ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 133
#15..
- 464 -
10 ρεχορδσ ανδ αχχουντσ φορ τηε φισχαλ ψεαρ(σ) ιν ωηιχη τηε αωαρδ ωασ mαδε. Τηε χοντραχτορ ωιλλ χοmπλψ ωιτη φεδεραλ ανδ στατε σινγλε αυδιτ στανδαρδσ ασ αππλιχαβλε.
14. Στατε Χοmπτρολλερ Σπεχιφιχατιονσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−31, τηισ Χοντραχτ ισ δεεmεδ το ηαϖε ινχορπορατεδ ωιτηιν ιτ, ανδ τηε Χοντραχτορ σηαλλ δελιϖερ τηε Γοοδσ ανδ Σερϖιχεσ ιν χοmπλιανχε ωιτη, αλλ σπεχιφιχατιονσ εσταβλισηεδ βψ τηε Στατε Χοmπτρολλερ το ενσυρε τηατ αλλ πολιχιεσ, προχεδυρεσ, προχεσσεσ ανδ χοντρολ σψστεmσ, ινχλυδινγ ηαρδωαρε, σοφτωαρε ανδ προτοχολσ, ωηιχη αρε εσταβλισηεδ ορ προϖιδεδ βψ τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ, αρε χοmπατιβλε ωιτη ανδ συππορτ τηε Στατε∋σ χορε φινανχιαλ σψστεmσ, ινχλυδινγ βυτ νοτ λιmιτεδ το, αχχουντινγ, παψρολλ, τιmε ανδ αττενδανχε, ανδ ρετιρεmεντ σψστεmσ.
15. ΧΙΟ Συβχοντραχτ Αππροϖαλ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−32, τηε Χοντραχτορ σηαλλ νοτ αωαρδ α συβχοντραχτ φορ ωορκ υνδερ τηισ Χοντραχτ ωιτηουτ ηαϖινγ φιρστ οβταινεδ τηε ωριττεν αππροϖαλ οφ τηε Χηιεφ Ινφορmατιον Οφφιχερ οφ τηε Dεπαρτmεντ οφ Ινφορmατιον Τεχηνολογψ ορ τηειρ δεσιγνεε οφ τηε σελεχτιον οφ τηε συβχοντραχτορ ανδ οφ τηε προϖισιονσ οφ τηε συβχοντραχτ. Τηε Χοντραχτορ σηαλλ δελιϖερ α χοπψ οφ εαχη εξεχυτεδ συβχοντραχτ ορ αmενδmεντ το τηε συβχοντραχτ το τηε Χηιεφ Ινφορmατιον Οφφιχερ, ωηο σηαλλ mαινταιν τηε συβχοντραχτ ορ αmενδmεντ ασ α πυβλιχ ρεχορδ, ασ δεφινεδ ιν Χονν. Γεν. Στατ. ♣ 1− 200.
16. Ριγητσ το ανδ Ιντεγριτψ οφ Πυβλιχ Ρεχορδσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−34, (α) νειτηερ τηε Χοντραχτορ νορ Χοντραχτορ Παρτιεσ σηαλλ ηαϖε ανψ Τιτλε ιν ορ το (1) ανψ πυβλιχ ρεχορδσ ωηιχη τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ ποσσεσσ, mοδιφψ ορ χρεατε πυρσυαντ το α χοντραχτ, συβχοντραχτ ορ αmενδmεντ το α χοντραχτ ορ συβχοντραχτ, ορ (2) ανψ mοδιφιχατιονσ βψ συχη χοντραχτορ, συβχοντραχτορ, εmπλοψεε ορ αγεντ το συχη πυβλιχ ρεχορδσ; (β) νειτηερ τηε Χοντραχτορ νορ Χοντραχτορ Παρτιεσ σηαλλ ιmπαιρ τηε ιντεγριτψ οφ ανψ πυβλιχ ρεχορδσ ωηιχη τηεψ ποσσεσσ ορ χρεατε; ανδ (χ) πυβλιχ ρεχορδσ ωηιχη τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ ποσσεσσ, mοδιφψ ορ χρεατε πυρσυαντ το τηισ Χοντραχτ ορ οτηερ χοντραχτ, συβχοντραχτ ορ αmενδmεντ το α χοντραχτ ορ συβχοντραχτ σηαλλ ατ αλλ τιmεσ ανδ φορ αλλ πυρποσεσ ρεmαιν τηε ヮヴﾗヮWヴデ┞ ﾗa デｴW Sデ;デWく Fﾗヴ ヮ┌ヴヮﾗゲWゲ ﾗa デｴｷゲ ゲWIデｷﾗﾐが さヮ┌HﾉｷI ヴWIﾗヴSゲざ ゲｴ;ﾉﾉ ｴ;┗W デｴW ﾏW;ﾐｷﾐｪ ゲWデ aﾗヴデｴ ｷﾐ Χονν. Γεν. Στατ. ♣ 4−33, ασ ιτ mαψ βε mοδιφιεδ φροm τιmε το τιmε.
17. Πυβλιχ Ρεχορδσ ανδ ΦΟΙΑ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−35, ανψ πυβλιχ ρεχορδ ωηιχη α στατε αγενχψ προϖιδεσ το τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ σηαλλ ρεmαιν α πυβλιχ ρεχορδ φορ τηε πυρποσεσ οφ συβσεχτιον (α) οφ σεχτιον 1−210 ανδ ασ το συχη πυβλιχ ρεχορδσ, τηε Στατε, τηε Χοντραχτορ ανδ Χοντραχτορ Παρτιεσ σηαλλ ηαϖε α ϕοιντ ανδ σεϖεραλ οβλιγατιον το χοmπλψ ωιτη τηε οβλιγατιονσ οφ τηε στατε αγενχψ υνδερ τηε Φρεεδοm οφ Ινφορmατιον Αχτ, ασ δεφινεδ ιν σεχτιον 1−200, προϖιδεδ τηατ τηε δετερmινατιον οφ ωηετηερ ορ νοτ το δισχλοσε α παρτιχυλαρ ρεχορδ ορ τψπε οφ ρεχορδ σηαλλ βε mαδε βψ συχη στατε αγενχψ.
18. Dισχλοσυρε οφ Πυβλιχ Ρεχορδσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−36, νειτηερ τηε Χοντραχτορ νορ Χοντραχτορ Παρτιεσ σηαλλ δισχλοσε το τηε πυβλιχ ανψ πυβλιχ ρεχορδσ (α) ωηιχη τηεψ ποσσεσσ, mοδιφψ ορ χρεατε πυρσυαντ το τηισ Χοντραχτ ορ ανψ χοντραχτ, συβχοντραχτ ορ αmενδmεντ το α χοντραχτ ορ συβχοντραχτ ανδ (β) ωηιχη α στατε αγενχψ (1) ισ προηιβιτεδ φροm δισχλοσινγ πυρσυαντ το στατε ορ φεδεραλ λαω ιν αλλ χασεσ, (2) mαψ δισχλοσε πυρσυαντ το στατε ορ φεδεραλ λαω ονλψ το χερταιν εντιτιεσ ορ ινδιϖιδυαλσ ορ υνδερ χερταιν χονδιτιονσ ορ (3) mαψ ωιτηηολδ φροm δισχλοσυρε πυρσυαντ το στατε ορ φεδεραλ λαω. Τηισ προϖισιον σηαλλ νοτ βε χονστρυεδ το προηιβιτ τηε Χοντραχτορ φροm δισχλοσινγ συχη πυβλιχ ρεχορδσ το ανψ Χοντραχτορ Παρτιεσ τﾗ I;ヴヴ┞ ﾗ┌デ デｴW ヮ┌ヴヮﾗゲWゲ ﾗa ｷデゲ ゲ┌HIﾗﾐデヴ;Iデく Fﾗヴ ヮ┌ヴヮﾗゲWゲ ﾗa デｴｷゲ ゲWIデｷﾗﾐが さヮ┌HﾉｷI ヴWIﾗヴSゲざ ゲｴ;ﾉﾉ ｴ;┗W デｴW ﾏW;ﾐｷﾐｪ ゲWデ aﾗヴデｴ ｷﾐ Cﾗﾐﾐく GWﾐく Sデ;デく よ ヱ−200, ασ ιτ mαψ βε mοδιφιεδ φροm τιmε το τιmε.
19. Προφιτινγ φροm Πυβλιχ Ρεχορδσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−37, νειτηερ τηε Χοντραχτορ νορ Χοντραχτορ Παρτιεσ σηαλλ σελλ, mαρκετ ορ οτηερωισε προφιτ φροm τηε δισχλοσυρε ορ υσε οφ ανψ πυβλιχ ρεχορδσ ωηιχη αρε ιν τηειρ ποσσεσσιον πυρσυαντ το τηισ Χοντραχτ ορ ανψ χοντραχτ, συβχοντραχτ ορ αmενδmεντ το α χοντραχτ ορ συβχοντραχτ, εξχεπτ ασ αυτηοριζεδ ιν τηισ Χοντραχτ. Φορ πυρποσεσ οφ τηισ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 134
#15..
- 465 -
11 ゲWIデｷﾗﾐが さヮ┌HﾉｷI ヴWIﾗヴSゲざ ゲｴ;ﾉﾉ ｴ;┗W デｴW ﾏW;ﾐｷﾐｪ ゲWデ aﾗヴデｴ ｷﾐ Cﾗﾐﾐく GWﾐく Sデ;デく よ ヱ−200, ασ ιτ mαψ βε mοδιφιεδ φροm τιmε το τιmε.
20. Cﾗﾐデヴ;Iデﾗヴげゲ OHﾉｷｪ;デｷﾗﾐ デﾗ Nﾗデｷa┞ DΑΣ χοmmισσιονερ Χονχερνινγ Πυβλιχ Ρεχορδσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−38, ιφ τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ λεαρν οφ ανψ ϖιολατιον οφ τηε προϖισιονσ οφ Χονν. Γεν. Στατ. ♣♣ 4δ−36 ορ 4δ−37 τηεψ σηαλλ, νο λατερ τηαν σεϖεν χαλενδαρ δαψσ αφτερ λεαρνινγ οφ συχη ϖιολατιον, νοτιφψ τηε χοmmισσιονερ οφ συχη ϖιολατιον.
21. Γενεραλ Ασσεmβλψ Αχχεσσ το Ρεχορδσ. Ιν αχχορδανχε ωιτη Χονν. Γεν. Στατ. ♣ 4δ−40, τηε ϑοιντ Χοmmιττεε ον Λεγισλατιϖε Μαναγεmεντ ανδ εαχη νονπαρτισαν οφφιχε οφ τηε Γενεραλ Ασσεmβλψ σηαλλ χοντινυε το ηαϖε αχχεσσ το στατε αγενχψ ρεχορδσ τηατ ισ νοτ λεσσ τηαν τηε αχχεσσ τηατ σαιδ χοmmιττεε ανδ συχη οφφιχεσ ηαϖε ον ϑυλψ 1, 1997.
22. Χοντινυιτψ οφ Σψστεmσ. Τηισ Σεχτιον ισ ιντενδεδ το χοmπλψ ωιτη Χονν. Γεν. Στατ. ♣4δ−44. (α) Τηε Χοντραχτορ αχκνοωλεδγεσ τηατ τηε Σψστεmσ ανδ ασσοχιατεδ σερϖιχεσ αρε ιmπορταντ το τηε φυνχτιον οφ Στατε γοϖερνmεντ ανδ τηατ τηεψ mυστ χοντινυε ωιτηουτ ιντερρυπτιον. Πυρσυαντ το Χονν.
Γεν. Στατ. ♣4δ−44, ιφ τηε ωορκ υνδερ τηε Χοντραχτ, ανψ συβχοντραχτ, ορ αmενδmεντ το ειτηερ, ισ τρανσφερρεδ βαχκ το τηε Στατε ορ το ανοτηερ χοντραχτορ ατ ανψ τιmε φορ ανψ ρεασον, τηεν τηε Χοντραχτορ σηαλλ χοοπερατε φυλλψ ωιτη τηε Στατε, ανδ δο ανδ περφορm αλλ αχτσ ανδ τηινγσ τηατ DΑΣ δεεmσ το βε νεχεσσαρψ ορ αππροπριατε, το ενσυρε χοντινυιτψ οφ στατε αγενχψ ινφορmατιον σψστεm ανδ τελεχοmmυνιχατιον σψστεm φαχιλιτιεσ, εθυιπmεντ ανδ σερϖιχεσ σο τηατ τηερε ισ νο δισρυπτιον ορ ιντερρυπτιον ιν περφορmανχε ασ ρεθυιρεδ ορ περmιττεδ ιν τηε Χοντραχτ. Τηε Χοντραχτορ σηαλλ νοτ εντερ ιντο ανψ συβχοντραχτ φορ ανψ παρτ οφ τηε περφορmανχε υνδερ τηε Χοντραχτ ωιτηουτ αππροϖαλ οφ συχη συβχοντραχτ βψ DΑΣ, ασ ρεθυιρεδ βψ Χονν. Γεν. Στατ. ♣4δ−32, ανδ ωιτηουτ συχη συβχοντραχτ ινχλυδινγ α προϖισιον τηατ οβλιγατεσ τηε συβχοντραχτορ το χοmπλψ φυλλψ ωιτη Χονν. Γεν. Στατ. ♣4δ−44 ασ ιφ τηε συβχοντραχτορ ωερε ιν φαχτ τηε Χοντραχτορ. Τηε Χοντραχτορ σηαλλ mακε α φυλλ ανδ χοmπλετε δισχλοσυρε οφ ανδ δελιϖερψ το DΑΣ ﾗヴ ｷデゲ ヴWヮヴWゲWﾐデ;デｷ┗Wゲ ﾗa ;ﾉﾉ RWIﾗヴSゲ ;ﾐS さP┌HﾉｷI RWIﾗヴSゲがざ ;ゲ デｴ;デ τερm ισ δεφινεδ ιν Χονν. Γεν. Στατ. ♣4δ−33, ασ ιτ mαψ βε αmενδεδ, ιν ωηατεϖερ φορm τηεψ εξιστ ορ αρε στορεδ ανδ mαινταινεδ ανδ ωηερεϖερ λοχατεδ, διρεχτλψ ορ ινδιρεχτλψ χονχερνινγ τηε Χοντραχτ. (β) Τηε παρτιεσ σηαλλ φολλοω τηε φολλοωινγ αππλιχαβλε ανδ ρεσπεχτιϖε προχεδυρεσ ιν ορδερ το ενσυρε τηε ορδερλψ τρανσφερ το τηε Στατε οφ:
(1) συχη φαχιλιτιεσ ανδ εθυιπmεντ: _________________;
(2) αλλ σοφτωαρε χρεατεδ ορ mοδιφιεδ πυρσυαντ το τηε Χοντραχτ, συβχοντραχτ ορ αmενδmεντ:____________________________; ανδ
(3) αλλ πυβλιχ ρεχορδσ, ασ δεφινεδ ιν Χονν. Γεν. Στατ. ♣4δ−33, ωηιχη τηε Χοντραχτορ ορ Χοντραχτορ Παρτιεσ ποσσεσσ ορ χρεατε πυρσυαντ το τηε Χοντραχτ, συβχοντραχτ ορ αmενδmεντ:
__________________.
Ιφ τηε Χοντραχτορ εmπλοψσ φορmερ Στατε εmπλοψεεσ, τηε Χοντραχτορ σηαλλ φαχιλιτατε τηε εξερχισινγ οφ ανψ ρεεmπλοψmεντ ριγητσ τηατ συχη Στατε εmπλοψεεσ mαψ ηαϖε ωιτη τηε Στατε, ινχλυδινγ, βυτ νοτ λιmιτεδ το, αφφορδινγ τηεm αλλ ρεασοναβλε οππορτυνιτιεσ δυρινγ τηε ωορκδαψ το ιντερϖιεω φορ Στατε ϕοβσ. Τηε Χοντραχτορ σηαλλ ινχλυδε λανγυαγε σιmιλαρ το τηισ σεχτιον ιν αλλ οφ ιτσ χοντραχτσ ωιτη ιτσ συβχοντραχτορσ ανδ αππλιχαβλε Χοντραχτορ Παρτιεσ σο τηατ τηεψ αρε σιmιλαρλψ οβλιγατεδ.
23. Λεαδ Στατε Τερmσ τηατ σηαλλ νοτ αππλψ το Χοννεχτιχυτ. Τηε παρτιεσ ηερεβψ αγρεε τηατ ανψ προϖισιον ιν τηε Στανδαρδ Τερmσ ανδ Χονδιτιονσ οφ τηε _______________________, σηαλλ νοτ αππλψ το Χοννεχτιχυτ ορ ανψ οφ τηε παρτιχιπατινγ εντιτιεσ φροm Χοννεχτιχυτ ιφ τηε προϖισιον ϖιολατεσ σοϖερειγν ιmmυνιτψ ορ χονφλιχτσ ωιτη τηισ Παρτιχιπατινγ Αδδενδυm. Φυρτηερ τηε παρτιεσ αγρεε τηατ ιν ανψ ινστανχε ωηερε α προϖισιον ρεθυιρεσ τηε Στατε το ινδεmνιφψ τηε Χοντραχτορ ορ τηατ τηε παρτιεσ αρε βουνδ βψ βινδινγ αρβιτρατιον τηατ χονστιτυτεσ α ϖιολατιον οφ σοϖερειγν ιmmυνιτψ, ανδ τηερεφορε ισ νοτ αππλιχαβλε.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 135
#15..
- 466 -
12 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 136
#15..
- 467 -
Illinois
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 137
#15..
- 468 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 138
#15..
- 469 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 139
#15..
- 470 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 140
#15..
- 471 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 141
#15..
- 472 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 142
#15..
- 473 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 143
#15..
- 474 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 144
#15..
- 475 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 145
#15..
- 476 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 146
#15..
- 477 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 147
#15..
- 478 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 148
#15..
- 479 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 149
#15..
- 480 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 150
#15..
- 481 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 151
#15..
- 482 -
COMMONWEALTH TERMS AND CONDITIONS
This Commonwealth Terms and Conditions form is
jointly issued by the Executive Office for
Administration and Finance (ANF), the Office of the
Comptroller (CTR) and the Operational Services
Division (OSD) for use by all Commonwealth of
Massachusetts (“State”) Departments and Contractors. Any changes or electronic alterations by either the Department or the Contractor to the official version of this form, as jointly published by ANF, CTR and OSD, shall be void. Upon execution of these Commonwealth Terms and Conditions by the Contractor and filing as prescribed by the Office of the Comptroller, these Commonwealth Terms and Conditions will be incorporated by reference into any Contract for Commodities and Services executed by the Contractor and any State Department, in the absence of a superseding law or regulation requiring a different Contract form. Performance shall include services rendered, obligations due, costs incurred, commodities and deliverables provided and accepted by the Department, programs provided or other commitments authorized under a Contract. A deliverable shall include any tangible product to be delivered as an element of performance under a Contract. The Commonwealth is entitled to ownership and possession of all deliverables purchased or developed with State funds. Contract shall mean the Standard Contract Form issued jointly by ANF, CTR and OSD.
1. Contract Effective Start Date. Notwithstanding verbal or other representations by the parties, or an earlier start date indicated in a Contract, the effective start date of performance under a Contract shall be the date a Contract has been executed by an authorized signatory of the Contractor, the Department, a later date specified in the Contract or the date of any approvals required by law or regulation, whichever is later.
2. Payments And Compensation. The Contractor shall only be compensated for performance delivered and accepted by the Department in accordance with the specific terms and conditions of a Contract. All Contract payments are subject to appropriation pursuant to M.G.L. C. 29, §26, or the availability of sufficient non-appropriated funds for the purposes of a Contract, and shall be subject to intercept pursuant to M.G.L. C. 7A, §3 and 815 CMR 9.00.
Overpayments shall be reimbursed by the Contractor or may be offset by the Department from future payments in accordance with state finance law.
Acceptance by the Contractor of any payment or partial payment, without any written objection by the Contractor, shall in each instance operate as a release and discharge of the State from all claims, liabilities or other obligations relating to the performance of a Contract.
3. Contractor Payment Mechanism. All Contractors will be paid using the Payment Voucher System unless a different payment mechanism is required.
The Contractor shall timely submit invoices (Payment Vouchers - Form PV) and supporting documentation as prescribed in a Contract. The Department shall review and return rejected invoices within fifteen (15) days of receipt with a written explanation for rejection. Payments shall be made in accordance with the bill paying policy issued by the Office of the Comptroller and 815 CMR 4.00, provided that payment periods listed in a Contract of less than forty-five (45) days from the date of receipt of an invoice shall be effective only to enable a Department to take advantage of early payment incentives and shall not subject any payment made within the forty-five (45) day period to a penalty. The Contractor Payroll System, shall be used only for "Individual Contractors" who have been determined to be "Contract Employees" as a result of the Department's completion of an Internal Revenue Service SS-8 form in accordance with the Omnibus Budget Reconciliation Act (OBRA) 1990, and shall automatically process all state and federal mandated payroll, tax and retirement deductions.
4. Contract Termination Or Suspension. A Contract shall terminate on the date specified in a Contract, unless this date is properly amended in accordance with all applicable laws and regulations prior to this date, or unless terminated or suspended under this Section upon prior written notice to the Contractor. The Department may terminate a Contract without cause and without penalty, or may terminate or suspend a Contract if the Contractor breaches any material term or condition or fails to perform or fulfill any material obligation required by a Contract, or in the event of an elimination of an appropriation or availability of sufficient funds for the purposes of a Contract, or in the event of an unforeseen public emergency mandating immediate Department action. Upon immediate notification to the other party, neither the Department nor the Contractor shall be deemed to be in breach for failure or delay in performance due to Acts of God or other causes factually beyond their control and without their fault or negligence. Subcontractor failure to perform or price increases due to market fluctuations or product availability will not be deemed factually beyond the Contractor's control.
5. Written Notice. Any notice shall be deemed delivered and received when submitted in writing in person or when delivered by any other appropriate method evidencing actual receipt by the Department or the Contractor. Any written notice of termination or suspension delivered to the Contractor shall state the effective date and period of the notice, the reasons for the termination or suspension, if applicable, any alleged breach or failure to perform, a reasonable period to cure any alleged breach or failure to perform, if applicable, and any instructions or restrictions concerning allowable activities, costs or expenditures by the Contractor during the notice period.
6. Confidentiality. The Contractor shall comply with M.G.L. C. 66A if the Contractor becomes a "holder" of "personal data". The Contractor shall also protect the physical security and restrict any access to personal or other Department data in the Contractor's possession, or used by the Contractor in the performance of a Contract, which shall include, but is not limited to the Department's public records, documents, files, software, equipment or systems.
7. Record-keeping And Retention, Inspection Of Records. The Contractor shall maintain records, books, files and other data as specified in a Contract and in such detail as shall properly substantiate claims for payment under a Contract, for a minimum retention period of seven (7) years beginning on the first day after the final payment under a Contract, or such longer period as is necessary for the resolution of any litigation, claim, negotiation, audit or other inquiry involving a Contract. The Department shall have access, as well as any parties identified under Executive Order 195, during the Contractor’s regular business hours and upon reasonable prior notice, to such records, including onsite reviews and reproduction of such records at a reasonable expense.
8. Assignment. The Contractor may not assign or delegate, in whole or in part, or otherwise transfer any liability, responsibility, obligation, duty or interest under a Contract, with the exception that the Contractor shall be authorized to assign present and prospective claims for money due to the Contractor pursuant to a Contract in accordance with M.G.L. C. 106, §9-318.
The Contractor must provide sufficient notice of assignment and supporting documentation to enable the Department to verify and implement the assignment. Payments to third party assignees will be processed as if such payments were being made directly to the Contractor and these payments will be subject to intercept, offset, counter claims or any other Department rights which are available to the Department or the State against the Contractor.
9. Subcontracting By Contractor. Any subcontract entered into by the Contractor for the purposes of fulfilling the obligations under a Contract must be in writing, authorized in advance by the Department and shall be consistent with and subject to the provisions of these Commonwealth Terms and Conditions and a Contract. Subcontracts will not relieve or discharge the Contractor from any duty, obligation, responsibility or liability arising under a Contract. The Department is entitled to copies of all subcontracts and shall not be bound by any provisions contained in a subcontract to which it is not a party.
10. Affirmative Action, Non-Discrimination In Hiring And Employment.
The Contractor shall comply with all federal and state laws, rules and regulations promoting fair employment practices or prohibiting employment discrimination and unfair labor practices and shall not discriminate in the hiring of any applicant for employment nor shall any qualified employee be demoted, discharged or otherwise subject to discrimination in the tenure, position, promotional opportunities, wages, benefits or terms and conditions of their employment because of race, color, national origin, ancestry, age, sex, religion, disability, handicap, sexual orientation or for exercising any rights afforded by law. The Contractor commits to purchasing supplies and services from certified minority or women-owned businesses, small businesses or businesses owned by socially or economically disadvantaged persons or persons with disabilities.
11. Indemnification. Unless otherwise exempted by law, the Contractor shall indemnify and hold harmless the State, including the Department, its agents, officers and employees against any and all claims, liabilities and costs for any personal injury or property damages, patent or copyright infringement or other damages that the State may sustain which arise out of or in connection with the Contractor's performance of a Contract, including but not limited to the negligence, reckless or intentional conduct of the Contractor, its agents, officers, employees or subcontractors. The Contractor shall at no time be considered an agent or representative of the Department or the State. After prompt notification of a claim by the State, the Contractor shall have an opportunity to participate in the defense of such claim and any negotiated Massachusets
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 152
#15..
- 483 -
COMMONWEALTH TERMS AND CONDITIONS
settlement agreement or judgment. The State shall not
be liable for any costs incurred by the Contractor arising under this paragraph. Any indemnification of the
Contractor shall be subject to appropriation and
applicable law.
12. Waivers. Forbearance or indulgence in any form or manner by a party shall not be construed as a waiver, nor in any way limit the legal or equitable remedies available to that party. No waiver by either party of any default or breach shall constitute a waiver of any subsequent default or breach.
13. Risk Of Loss. The Contractor shall bear the risk of loss for any Contractor materials used for a Contract and for all deliverables, Department personal or other data which is in the possession of the Contractor or used by the Contractor in the performance of a Contract until possession, ownership and full legal title to the deliverables are transferred to and accepted by the Department.
14. Forum, Choice of Law And Mediation. Any actions arising out of a Contract shall be governed by the laws of Massachusetts, and shall be brought and maintained in a State or federal court in Massachusetts which shall have exclusive jurisdiction thereof. The Department, with the approval of the Attorney General's Office, and the Contractor may agree to voluntary mediation through the Massachusetts Office of Dispute Resolution (MODR) of any Contract dispute and will share the costs of such mediation. No legal or equitable rights of the parties shall be limited by this Section.
15. Contract Boilerplate Interpretation, Severability, Conflicts With Law, Integration. Any amendment or attachment to any Contract which contains conflicting language or has the affect of a deleting, replacing or modifying any printed language of these Commonwealth Terms and Conditions, as officially published by ANF, CTR and OSD, shall be interpreted as superseded by the official printed language. If any provision of a Contract is found to be superseded by state or federal law or regulation, in whole or in part, then both parties shall be relieved of all obligations under that provision only to the extent necessary to comply with the superseding law, provided however, that the remaining provisions of the Contract, or portions thereof, shall be enforced to the fullest extent permitted by law. All amendments must be executed by the parties in accordance with Section 1. of these Commonwealth Terms and Conditions and filed with the original record copy of a Contract as prescribed by CTR. The printed language of the Standard Contract Form, as officially published by ANF, CTR and OSD, which incorporates by reference these Commonwealth Terms and Conditions, shall supersede any conflicting verbal or written agreements relating to the performance of a Contract, or attached thereto, including contract forms, purchase orders or invoices of the Contractor. The order of priority of documents to interpret a Contract shall be as follows: the printed language of the Commonwealth Terms and Conditions, the Standard Contract Form, the Department's Request for Response (RFR) solicitation document and the Contractor’s Response to the RFR solicitation, excluding any language stricken by a Department as unacceptable and including any negotiated terms and conditions allowable pursuant to law or regulation.
IN WITNESS WHEREOF, The Contractor certify under the pains and penalties of perjury that it shall comply with these Commonwealth Terms and Conditions for any applicable Contract executed with the Commonwealth as certified by their authorized signatory below:
CONTRACTOR AUTHORIZED SIGNATORY:_________________________________________________________________________ (signature)
Print Name:
Title:
Date:
(Check One): ____ Organization ____ Individual
Full Legal Organization or Individual Name:
Doing Business As: Name (If Different):
Tax Identification Number:
Address:
Telephone: FAX:
INSTRUCTIONS FOR FILING THE COMMONWEALTH TERMS AND CONDITIONS A “Request for Verification of Taxation Reporting Information” form (Massachusetts Substitute W-9 Format), that contains the Contractor's correct TIN, name and legal address information, must be on file with the Office of the Comptroller. If the Contractor has not previously filed this form with the Comptroller, or if the information contained on a previously filed form has changed, please fill out a W-9 form and return it attached to the executed COMMONWEALTH TERMS AND CONDITIONS.
If the Contractor is responding to a Request for Response (RFR), the COMMONWEALTH TERMS AND CONDITIONS must be submitted with the Response to RFR or as specified in the RFR. Otherwise, Departments or Contractors must timely submit the completed and properly executed COMMONWEALTH TERMS AND CONDITIONS (and the W-9 form if applicable) to the: Payee and Payments Unit, Office of the Comptroller, 9th Floor, One Ashburton Place, Boston, MA 02108 in order to record the filing of this form on the MMARS Vendor File. Contractors are required to execute and file this form only once.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 153
#15..
- 484 -
COMMONWEALTH OF MASSACHUSETTS ~ STANDARD CONTRACT FORM
(Updated 3/21/2014) Page 1 of 5
This form is jointly issued and published by the Executive Office for Administration and Finance (ANF), the Office of the Comptroller (CTR) and the Operational Services Division (OSD) as the default contract for all Commonwealth Departments when another form is not prescribed by regulation or policy. Any changes to the official printed language of this form shall be void. Additional non-conflicting terms may be added by Attachment. Contractors may not require any additional agreements, engagement letters, contract forms or other additional terms as part of this Contract without prior Department approval. Click on hyperlinks for definitions, instructions and legal requirements that are incorporated by reference into this Contract. An electronic copy of this form is available at www.mass.gov/osc under Guidance For Vendors - Forms or www.mass.gov/osd under OSD Forms.
CONTRACTOR LEGAL NAME:
(and d/b/a):
COMMONWEALTH DEPARTMENT NAME:
MMARS Department Code:
Legal Address: (W-9, W-4,T&C): Business Mailing Address:
Contract Manager: Billing Address (if different):
E-Mail: Contract Manager:
Phone: Fax: E-Mail:
Contractor Vendor Code: Phone: Fax:
Vendor Code Address ID (e.g. “AD001”): AD .
(Note: The Address Id Must be set up for EFT payments.) MMARS Doc ID(s):
RFR/Procurement or Other ID Number:
___ NEW CONTRACT
PROCUREMENT OR EXCEPTION TYPE: (Check one option only)
__ Statewide Contract (OSD or an OSD-designated Department) __ Collective Purchase (Attach OSD approval, scope, budget) __ Department Procurement (includes State or Federal grants 815 CMR 2.00) (Attach RFR and Response or other procurement supporting documentation) __ Emergency Contract (Attach justification for emergency, scope, budget) __ Contract Employee (Attach Employment Status Form, scope, budget) __ Legislative/Legal or Other: (Attach authorizing language/justification, scope and budget)
___ CONTRACT AMENDMENT
Enter Current Contract End Date Prior to Amendment: , 20 .
Enter Amendment Amount: $ . (or “no change”)
AMENDMENT TYPE: (Check one option only. Attach details of Amendment changes.) __ Amendment to Scope or Budget (Attach updated scope and budget) __ Interim Contract (Attach justification for Interim Contract and updated scope/budget) __ Contract Employee (Attach any updates to scope or budget) __ Legislative/Legal or Other: (Attach authorizing language/justification and updated scope and budget)
The following COMMONWEALTH TERMS AND CONDITIONS (T&C) has been executed, filed with CTR and is incorporated by reference into this Contract. __ Commonwealth Terms and Conditions __ Commonwealth Terms and Conditions For Human and Social Services COMPENSATION: (Check ONE option): The Department certifies that payments for authorized performance accepted in accordance with the terms of this Contract will be supported in the state accounting system by sufficient appropriations or other non-appropriated funds, subject to intercept for Commonwealth owed debts under 815 CMR 9.00. __ Rate Contract (No Maximum Obligation. Attach details of all rates, units, calculations, conditions or terms and any changes if rates or terms are being amended.) __ Maximum Obligation Contract Enter Total Maximum Obligation for total duration of this Contract (or new Total if Contract is being amended). $ .
PROMPT PAYMENT DISCOUNTS (PPD): Commonwealth payments are issued through EFT 45 days from invoice receipt. Contractors requesting accelerated payments must identify a PPD as follows: Payment issued within 10 days __% PPD; Payment issued within 15 days __ % PPD; Payment issued within 20 days __ % PPD; Payment issued within 30 days __% PPD. If PPD percentages are left blank, identify reason: __agree to standard 45 day cycle __ statutory/legal or Ready Payments (G.L. c. 29, § 23A); __ only initial payment (subsequent payments scheduled to support standard EFT 45 day payment cycle. See Prompt Pay Discounts Policy.) BRIEF DESCRIPTION OF CONTRACT PERFORMANCE or REASON FOR AMENDMENT: (Enter the Contract title, purpose, fiscal year(s) and a detailed description of the scope of performance or what is being amended for a Contract Amendment. Attach all supporting documentation and justifications.) ANTICIPATED START DATE: (Complete ONE option only) The Department and Contractor certify for this Contract, or Contract Amendment, that Contract obligations:
__ 1. may be incurred as of the Effective Date (latest signature date below) and no obligations have been incurred prior to the Effective Date. __ 2. may be incurred as of , 20 , a date LATER than the Effective Date below and no obligations have been incurred prior to the Effective Date. __3. were incurred as of , 20 , a date PRIOR to the Effective Date below, and the parties agree that payments for any obligations incurred prior to the Effective Date are authorized to be made either as settlement payments or as authorized reimbursement payments, and that the details and circumstances of all obligations under this Contract are attached and incorporated into this Contract. Acceptance of payments forever releases the Commonwealth from further claims related to these obligations.
CONTRACT END DATE: Contract performance shall terminate as of , 20 , with no new obligations being incurred after this date unless the Contract is properly amended, provided that the terms of this Contract and performance expectations and obligations shall survive its termination for the purpose of resolving any claim or dispute, for completing any negotiated terms and warranties, to allow any close out or transition performance, reporting, invoicing or final payments, or during any lapse between amendments.
CERTIFICATIONS: Notwithstanding verbal or other representations by the parties, the “Effective Date” of this Contract or Amendment shall be the latest date that this Contract or Amendment has been executed by an authorized signatory of the Contractor, the Department, or a later Contract or Amendment Start Date specified above, subject to any required approvals. The Contractor makes all certifications required under the attached Contractor Certifications (incorporated by reference if not attached hereto) under the pains and penalties of perjury, agrees to provide any required documentation upon request to support compliance, and agrees that all terms governing performance of this Contract and doing business in Massachusetts are attached or incorporated by reference herein according to the following hierarchy of document precedence, the applicable Commonwealth Terms and Conditions, this Standard Contract Form including the Instructions and Contractor Certifications, the Request for Response (RFR) or other solicitation, the Contractor’s Response, and additional negotiated terms, provided that additional negotiated terms will take precedence over the relevant terms in the RFR and the Contractor’s Response only if made using the process outlined in 801 CMR 21.07, incorporated herein, provided that any amended RFR or Response terms result in best value, lower costs, or a more cost effective Contract.
AUTHORIZING SIGNATURE FOR THE CONTRACTOR:
X: . Date: .
(Signature and Date Must Be Handwritten At Time of Signature) Print Name: .
Print Title: .
AUTHORIZING SIGNATURE FOR THE COMMONWEALTH:
X: . Date: .
(Signature and Date Must Be Handwritten At Time of Signature) Print Name: .
Print Title: .
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 154
#15..
- 485 -
COMMONWEALTH OF MASSACHUSETTS ~ STANDARD CONTRACT FORM
(Updated 3/21/2014) Page 2 of 5
INSTRUCTIONS AND CONTRACTOR CERTIFICATIONS
The following instructions and terms are incorporated by reference and apply to this Standard Contract Form. Text that appears underlined indicates a "hyperlink" to an Internet or bookmarked site and are unofficial versions of these documents and Departments and Contractors should consult with their legal counsel to ensure compliance with all legal requirements. Using the Web Toolbar will make navigation between the form and the hyperlinks easier. Please note that not all applicable laws have been cited.
CONTRACTOR LEGAL NAME (AND D/B/A): Enter the Full Legal Name of the Contractor's business as it appears on the Contractor's W-9 or W-4 Form (Contract Employees only) and the applicable Commonwealth Terms and Conditions If Contractor also has a “doing business as” (d/b/a) name, BOTH the legal name and the “d/b/a” name must appear in this section.
Contractor Legal Address: Enter the Legal Address of the Contractor as it appears on the Contractor's W-9 or W-4 Form (Contract Employees only) and the applicable Commonwealth Terms and Conditions, which must match the legal address on the 1099I table in MMARS (or the Legal Address in HR/CMS for Contract Employee).
Contractor Contract Manager: Enter the authorized Contract Manager who will be responsible for managing the Contract. The Contract Manager should be an Authorized Signatory or, at a minimum, a person designated by the Contractor to represent the Contractor, receive legal notices and negotiate ongoing Contract issues. The Contract Manager is considered “Key Personnel” and may not be changed without the prior written approval of the Department. If the Contract is posted on COMMBUYS, the name of the Contract Manager must be included in the Contract on COMMBUYS.
Contractor E-Mail Address/Phone/Fax: Enter the electronic mail (e-mail) address, phone and fax number of the Contractor Contract Manager. This information must be kept current by the Contractor to ensure that the Department can contact the Contractor and provide any required legal notices. Notice received by the Contract Manager (with confirmation of actual receipt) through the listed address, fax number(s) or electronic mail address will meet any written legal notice requirements.
Contractor Vendor Code: The Department must enter the MMARS Vendor Code assigned by the Commonwealth. If a Vendor Code has not yet been assigned, leave this space blank and the Department will complete this section when a Vendor Code has been assigned. The Department is responsible under the Vendor File and W-9s Policy for verifying with authorized signatories of the Contractor, as part of contract execution, that the legal name, address and Federal Tax Identification Number (TIN) in the Contract documents match the state accounting system.
Vendor Code Address ID: (e.g., “AD001”) The Department must enter the MMARS Vendor Code Address Id identifying the payment remittance address for Contract payments, which MUST be set up for EFT payments PRIOR to the first payment under the Contract in accordance with the Bill Paying and Vendor File and W-9 policies.
COMMONWEALTH DEPARTMENT NAME: Enter the full Department name with the authority to obligate funds encumbered for the Contract.
Commonwealth MMARS Alpha Department Code: Enter the three (3) letter MMARS Code assigned to this Commonwealth Department in the state accounting system.
Department Business Mailing Address: Enter the address where all formal correspondence to the Department must be sent. Unless otherwise specified in the Contract, legal notice sent or received by the Department’s Contract Manager (with confirmation of actual receipt) through the listed address, fax number(s) or electronic mail address for the Contract Manager will meet any requirements for legal notice.
Department Billing Address: Enter the Billing Address or email address if invoices must be sent to a different location. Billing or confirmation of delivery of performance issues should be resolved through the listed Contract Managers.
Department Contract Manager: Identify the authorized Contract Manager who will be responsible for managing the Contract, who should be an authorized signatory or an employee designated by the Department to represent the Department to receive legal notices and negotiate ongoing Contract issues.
Department E-Mail Address/Phone/Fax: Enter the electronic mail (e-mail) address, phone and fax number of the Department Contract Manager. Unless otherwise specified in the Contract, legal notice sent or received by the Contract Manager (with confirmation of actual receipt) through the listed address, fax number(s) or electronic mail address will meet any requirements for written notice under the Contract.
MMARS Document ID(s): Enter the MMARS 20 character encumbrance transaction number associated with this Contract which must remain the same for the life of the Contract. If multiple numbers exist for this Contract, identify all Doc Ids.
RFR/Procurement or Other ID Number or Name: Enter the Request for Response (RFR) or other Procurement Reference number, Contract ID Number or other reference/tracking number for this Contract or Amendment and will be entered into the Board Award Field in the MMARS encumbrance transaction for this Contract.
NEW CONTRACTS (left side of Form):
Complete this section ONLY if this Contract is brand new. (Complete the CONTRACT AMENDMENT section for any material changes to an existing or an expired Contract, and for exercising options to renew or annual contracts under a multi-year procurement or grant program.)
PROCUREMENT OR EXCEPTION TYPE: Check the appropriate type of procurement or exception for this Contract. Only one option can be selected. See State Finance Law and General Requirements, Acquisition Policy and Fixed Assets, the Commodities and Services Policy and the Procurement Information Center (Department Contract Guidance) for details.
Statewide Contract (OSD or an OSD-designated Department). Check this option for a Statewide Contract under OSD, or by an OSD-designated Department.
Collective Purchase approved by OSD. Check this option for Contracts approved by OSD for collective purchases through federal, state, local government or other entities.
Department Contract Procurement. Check this option for a Department procurement including state grants and federal sub-grants under 815 CMR 2.00 and State Grants and Federal Subgrants Policy, Departmental Master Agreements (MA). If multi-Department user Contract, identify multi-Department use is allowable in Brief Description.
Emergency Contract. Check this option when the Department has determined that an unforeseen crisis or incident has arisen which requires or mandates immediate purchases to avoid substantial harm to the functioning of government or the provision of necessary or mandated services or whenever the health, welfare or safety of clients or other persons or serious damage to property is threatened.
Contract Employee. Check this option when the Department requires the performance of an Individual Contractor, and when the planned Contract performance with an Individual has been classified using the Employment Status Form (prior to the Contractor's selection) as work of a Contract Employee and not that of an Independent Contractor.
Legislative/Legal or Other. Check this option when legislation, an existing legal obligation, prohibition or other circumstance exempts or prohibits a Contract from being competitively procured, or identify any other procurement exception not already listed.
Legislative “earmarks” exempt the Contract solely from procurement requirements, and all other Contract and state finance laws and policies apply. Supporting documentation must be attached to explain and justify the exemption.
CONTRACT AMENDMENT (Right Side of Form)
Complete this section for any Contract being renewed, amended or to continue a lapsed Contract. All Contracts with available options to renew must be amended referencing the original procurement and Contract doc ids, since all continuing contracts must be maintained in the same Contract file (even if the underlying appropriation changes each fiscal year.) “See Amendments, Suspensions, and Termination Policy.) Enter Current Contract End Date: Enter the termination date of the Current Contract being amended, even if this date has already passed. (Note: Current Start Date is not requested since this date does not change and is already recorded in MMARS.) Enter Amendment Amount: Enter the amount of the Amendment increase or decrease to a Maximum Obligation Contract. Enter “no change” for Rate Contracts or if no change.
AMENDMENT TYPE: Identify the type of Amendment being done. Documentation supporting the updates to performance and budget must be attached. Amendment to Scope or Budget. Check this option when renewing a Contract or executing any Amendment (“material change” in Contract terms) even if the Contract has lapsed. The parties may negotiate a change in any element of Contract performance or cost identified in the RFR or the Contractor’s response which results in lower costs, or a more costeffective or better value performance than was presented in the original selected response, provided the negotiation results in a better value within the scope of the RFR than what was proposed by the Contractor in the original selected response. Any “material” change in the Contract terms must be memorialized in a formal Amendment even if a corresponding MMARS transaction is not needed to support the change. Additional negotiated terms will take precedence over the relevant terms in the RFR and the Contractor’s Response only if made using the process outlined in 801 CMR 21.07, incorporated herein, provided that any amended RFR or Response terms result in best value, lower costs, or a more cost effective Contract.
Interim Contracts. Check this option for an Interim Contract to prevent a lapse of Contract performance whenever an existing Contract is being re-procured but the new procurement has not been completed, to bridge the gap during implementation between an expiring and a new procurement, or to contract with an interim Contractor when a current Contractor is unable to complete full performance under a Contract.
Contract Employee. Check this option when the Department requires a renewal or other amendment to the performance of a Contract Employee.
Legislative/Legal or Other. Check this option when legislation, an existing legal obligation, prohibition or other circumstance exempts or prohibits a Contract from being competitively procured, or identify any other procurement exception not already listed.
Legislative “earmarks” exempt the Contract solely from procurement requirements, and all other Contract and state finance laws and policies apply. Attach supporting documentation to explain and justify the exemption and whether Contractor selection has been publicly State of Utah Bid CH16012
3/22/2016 4:23 PM p. 155
#15..
- 486 -
COMMONWEALTH OF MASSACHUSETTS ~ STANDARD CONTRACT FORM
(Updated 3/21/2014) Page 3 of 5
posted.
COMMONWEALTH TERMS AND CONDITIONS
Identify which Commonwealth Terms and Conditions the Contractor has executed and is incorporated by reference into this Contract. This Form is signed only once and recorded on the Vendor Customer File (VCUST). See Vendor File and W-9s Policy.
COMPENSATION
Identify if the Contract is a Rate Contract (with no stated Maximum Obligation) or a Maximum Obligation Contract (with a stated Maximum Obligation) and identify the Maximum Obligation. If the Contract is being amended, enter the new Maximum Obligation based upon the increase or decreasing Amendment. The Total Maximum Obligation must reflect the total funding for the dates of service under the contract, including the Amendment amount if the Contract is being amended. The Maximum Obligation must match the MMARS encumbrance. Funding and allotments must be verified as available and encumbered prior to incurring obligations. If a Contract includes both a Maximum Obligation component and Rate Contract component, check off both, specific Maximum Obligation amounts or amended amounts and Attachments must clearly outline the Contract breakdown to match the encumbrance.
PAYMENTS AND PROMPT PAY DISCOUNTS
Payments are processed within a 45 day payment cycle through EFT in accordance with the Commonwealth Bill Paying Policy for investment and cash flow purposes.
Departments may NOT negotiate accelerated payments and Payees are NOT entitled to accelerated payments UNLESS a prompt payment discount (PPD) is provided to support the Commonwealth’s loss of investment earnings for this earlier payment, or unless a payments is legally mandated to be made in less than 45 days (e.g., construction contracts, Ready Payments under G.L. c. 29, s. 23A). See Prompt Pay Discounts Policy.
PPD are identified as a percentage discount which will be automatically deducted when an accelerated payment is made. Reduced contracts rates may not be negotiated to replace a PPD. If PPD fields are left blank please identify that the Contractor agrees to the standard 45 day cycle; a statutory/legal exemption such as Ready Payments (G.L. c. 29, § 23A); or only an initial accelerated payment for reimbursements or start up costs for a grant, with subsequent payments scheduled to support standard EFT 45 day payment cycle. Financial hardship is not a sufficient justification to accelerate cash flow for all payments under a Contract. Initial grant or contract payments may be accelerated for the first invoice or initial grant installment, but subsequent periodic installments or invoice payments should be scheduled to support the Payee cash flow needs and the standard 45 day EFT payment cycle in accordance with the Bill Paying Policy. Any accelerated payment that does not provide for a PPD must have a legal justification in Contract file for audit purposes explaining why accelerated payments were allowable without a PPD.
BRIEF DESCRIPTION OF CONTRACT PERFORMANCE
Enter a brief description of the Contract performance, project name and/or other identifying information for the Contract to specifically identify the Contract performance, match the Contract with attachments, determine the appropriate expenditure code (as listed in the Expenditure Classification Handbook) or to identify or clarify important information related to the Contract such as the Fiscal Year(s) of performance (ex. “FY2012” or “FY2012-14”).
Identify settlements or other exceptions and attach more detailed justification and supporting documents. Enter “Multi-Department Use” if other Departments can access procurement. For Amendments, identify the purpose and what items are being amended.
Merely stating "see attached" or referencing attachments without a narrative description of performance is insufficient.
ANTICIPATED START DATE
The Department and Contractor must certify WHEN obligations under this Contract/Amendment may be incurred. Option 1 is the default option when performance may begin as of the Effective Date (latest signature date and any required approvals). If the parties want a new Contract or renewal to begin as of the upcoming fiscal year then list the fiscal year(s) (ex. “FY2012” or “FY2012-14”) in the Brief Description section.
Performance starts and encumbrances reflect the default Effective Date (if no FY is listed) or the later FY start date (if a FY is listed). Use Option 2 only when the Contract will be signed well in advance of the start date and identify a specific future start date. Do not use Option 2 for a fiscal year start unless it is certain that the Contract will be signed prior to fiscal year. Option 3 is used in lieu of the Settlement and Release Form when the Contract/Amendment is signed late, and obligations have already been incurred by the Contractor prior to the Effective Date for which the Department has either requested, accepted or deemed legally eligible for reimbursement, and the Contract includes supporting documents justifying the performance or proof of eligibility, and approximate costs. Any obligations incurred outside the scope of the Effective Date under any Option listed, even if the incorrect Option is selected, shall be automatically deemed a settlement included under the terms of the Contract and upon payment to the Contractor will release the Commonwealth from further obligations for the identified performance. All settlement payments require justification and must be under same encumbrance and object codes as the Contract payments. Performance dates are subject to G.L. c.4, § 9.
CONTRACT END DATE
The Department must enter the date that Contract performance will terminate. If the Contract is being amended and the Contract End Date is not changing, this date must be re-entered again here. A Contract must be signed for at least the initial duration but not longer than the period of procurement listed in the RFR, or other solicitation document (if applicable). No new performance is allowable beyond the end date without an amendment, but the Department may allow a Contractor to complete minimal close out performance obligations if substantial performance has been made prior to the termination date of the Contract and prior to the end of the fiscal year in which payments are appropriated, provided that any close out performance is subject to appropriation and funding limits under state finance law, and CTR may adjust encumbrances and payments in the state accounting system to enable final close out payments. Performance dates are subject to G.L. c.4, § 9.
CERTIFICATIONS AND EXECUTION
See Department Head Signature Authorization Policy and the Contractor Authorized Signatory Listing for policies on Contractor and Department signatures.
Authorizing Signature for Contractor/Date: The Authorized Contractor Signatory must (in their own handwriting and in ink) sign AND enter the date the Contract is signed. See section above under “Anticipated Contract Start Date”. Acceptance of payment by the Contractor shall waive any right of the Contractor to claim the Contract/Amendment is not valid and the Contractor may not void the Contract. Rubber stamps, typed or other images are not acceptable. Proof of Contractor signature authorization on a Contractor Authorized Signatory Listing may be required by the Department if not already on file.
Contractor Name /Title: The Contractor Authorized Signatory’s name and title must appear legibly as it appears on the Contractor Authorized Signatory Listing.
Authorizing Signature For Commonwealth/Date: The Authorized Department Signatory must (in their own handwriting and in ink) sign AND enter the date the Contract is signed.
See section above under “Anticipated Start Date”. Rubber stamps, typed or other images are not accepted. The Authorized Signatory must be an employee within the Department legally responsible for the Contract. See Department Head Signature Authorization. The Department must have the legislative funding appropriated for all the costs of this Contract or funding allocated under an approved Interdepartmental Service Agreement (ISA). A Department may not contract for performance to be delivered to or by another state department without specific legislative authorization (unless this Contract is a Statewide Contract). For Contracts requiring Secretariat signoff, evidence of Secretariat signoff must be included in the Contract file.
Department Name /Title: Enter the Authorized Signatory’s name and title legibly.
CONTRACTOR CERTIFICATIONS AND LEGAL REFERENCES
Notwithstanding verbal or other representations by the parties, the “Effective Date” of this Contract or Amendment shall be the latest date that this Contract or Amendment has been executed by an authorized signatory of the Contractor, the Department, or a later Contract or Amendment Start Date specified, subject to any required approvals. The Contractor makes all certifications required under this Contract under the pains and penalties of perjury, and agrees to provide any required documentation upon request to support compliance, and agrees that all terms governing performance of this Contract and doing business in Massachusetts are attached or incorporated by reference herein:
Commonwealth and Contractor Ownership RIghts. The Contractor certifies and agrees that the Commonwealth is entitled to ownership and possession of all “deliverables” purchased or developed with Contract funds. A Department may not relinquish Commonwealth rights to deliverables nor may Contractors sell products developed with Commonwealth resources without just compensation. The Contract should detail all Commonwealth deliverables and ownership rights and any Contractor proprietary rights.
Qualifications. The Contractor certifies it is qualified and shall at all times remain qualified to perform this Contract; that performance shall be timely and meet or exceed industry standards for the performance required, including obtaining requisite licenses, registrations, permits, resources for performance, and sufficient professional, liability; and other appropriate insurance to cover the performance. If the Contractor is a business, the Contractor certifies that it is listed under the Secretary of State’s website as licensed to do business in Massachusetts, as required by law.
Business Ethics and Fraud, Waste and Abuse Prevention. The Contractor certifies that performance under this Contract, in addition to meeting the terms of the Contract, will be made using ethical business standards and good stewardship of taxpayer and other public funding and resources to prevent fraud, waste and abuse.
Collusion. The Contractor certifies that this Contract has been offered in good faith and without collusion, fraud or unfair trade practices with any other person, that any actions to avoid or frustrate fair and open competition are prohibited by law, and shall be grounds for rejection or disqualification of a Response or termination of this Contract.
Public Records and Access The Contractor shall provide full access to records related to performance and compliance to the Department and officials listed under Executive Order 195 and G.L. c. 11, s.12 seven (7) years beginning on the first day after the final payment State of Utah Bid CH16012
3/22/2016 4:23 PM p. 156
#15..
- 487 -
COMMONWEALTH OF MASSACHUSETTS ~ STANDARD CONTRACT FORM
(Updated 3/21/2014) Page 4 of 5
under this Contract or such longer period necessary for the resolution of any litigation, claim, negotiation, audit or other inquiry involving this Contract. Access to view Contractor records related to any breach or allegation of fraud, waste and/or abuse may not be denied and Contractor can not claim confidentiality or trade secret protections solely for viewing but not retaining documents. Routine Contract performance compliance reports or documents related to any alleged breach or allegation of non-compliance, fraud, waste, abuse or collusion may be provided electronically and shall be provided at Contractor’s own expense. Reasonable costs for copies of non-routine Contract related records shall not exceed the rates for public records under 950 C.M.R. 32.00.
Debarment. The Contractor certifies that neither it nor any of its subcontractors are currently debarred or suspended by the federal or state government under any law or regulation including, Executive Order 147; G.L. c. 29, s. 29F G.L. c.30, § 39R, G.L. c.149, § 27C, G.L. c.149, § 44C, G.L. c.149, § 148B and G.L. c. 152, s. 25C.
Applicable Laws. The Contractor shall comply with all applicable state laws and regulations including but not limited to the applicable Massachusetts General Laws; the Official Code of Massachusetts Regulations; Code of Massachusetts Regulations (unofficial); 801 CMR 21.00 (Procurement of Commodity and Service Procurements, Including Human and Social Services); 815 CMR 2.00 (Grants and Subsidies); 808 CMR
1.00 (Compliance, Reporting and Auditing for Human And Social Services); AICPA Standards; confidentiality of Department records under G.L. c. 66A; and the Massachusetts Constitution Article XVIII if applicable.
Invoices. The Contractor must submit invoices in accordance with the terms of the Contract and the Commonwealth Bill Paying Policy. Contractors must be able to reconcile and properly attribute concurrent payments from multiple Departments. Final invoices in any fiscal year must be submitted no later than August 15th for performance made and received (goods delivered, services completed) prior to June 30th, in order to make payment for that performance prior to the close of the fiscal year to prevent reversion of appropriated funds. Failure to submit timely invoices by August 15th or other date listed in the Contract shall authorize the Department to issue an estimated payment based upon the Department’s determination of performance delivered and accepted. The Contractor’s acceptance of this estimated payment releases the Commonwealth from further claims for these invoices. If budgetary funds revert due to the Contractor’s failure to submit timely final invoices, or for disputing an estimated payment, the Department may deduct a penalty up to 10% from any final payment in the next fiscal year for failure to submit timely invoices.
Payments Subject To Appropriation. Pursuant to G.L. c. 29 § 26, § 27 and § 29, Departments are required to expend funds only for the purposes set forth by the Legislature and within the funding limits established through appropriation, allotment and subsidiary, including mandated allotment reductions triggered by G.L. c. 29, § 9C. A Department cannot authorize or accept performance in excess of an existing appropriation and allotment, or sufficient non-appropriated available funds. Any oral or written representations, commitments, or assurances made by the Department or any other Commonwealth representative are not binding. The Commonwealth has no legal obligation to compensate a Contractor for performance that is not requested and is intentionally delivered by a Contractor outside the scope of a Contract. Contractors should verify funding prior to beginning performance.
Intercept. Contractors may be registered as Customers in the Vendor file if the Contractor owes a Commonwealth debt. Unresolved and undisputed debts, and overpayments of Contract payments that are not reimbursed timely shall be subject to intercept pursuant to G.L. c. 7A, s. 3 and 815 CMR 9.00. Contract overpayments will be subject to immediate intercept or payment offset. The Contractor may not penalize any state Department or assess late fees, cancel a Contract or other services if amounts are intercepted or offset due to recoupment of an overpayment, outstanding taxes, child support, other overdue debts or Contract overpayments.
Tax Law Compliance. The Contractor certifies under the pains and penalties of perjury tax compliance with Federal tax laws; state tax laws including but not limited to G.L. c. 62C, G.L. c. 62C, s. 49A; compliance with all state tax laws, reporting of employees and contractors, withholding and remitting of tax withholdings and child support and is in good standing with respect to all state taxes and returns due; reporting of employees and contractors under G.L. c. 62E, withholding and remitting child support including G.L. c. 119A, s. 12; TIR 05-11; New Independent Contractor Provisions and applicable TIRs.
Bankruptcy, Judgments, Potential Structural Changes, Pending Legal Matters and Conflicts. The Contractor certifies it has not been in bankruptcy and/or receivership within the last three calendar years, and the Contractor certifies that it will immediately notify the Department in writing at least 45 days prior to filing for bankruptcy and/or receivership, any potential structural change in its organization, or if there is any risk to the solvency of the Contractor that may impact the Contractor’s ability to timely fulfill the terms of this Contract or Amendment. The Contractor certifies that at any time during the period of the Contract the Contractor is required to affirmatively disclose in writing to the Department Contract Manager the details of any judgment, criminal conviction, investigation or litigation pending against the Contractor or any of its officers, directors, employees, agents, or subcontractors, including any potential conflicts of interest of which the Contractor has knowledge, or learns of during the Contract term. Law firms or Attorneys providing legal services are required to identify any potential conflict with representation of any Department client in accordance with Massachusetts Board of Bar Overseers (BBO) rules.
Federal Anti-Lobbying and Other Federal Requirements. If receiving federal funds, the Contractor certifies compliance with federal anti-lobbying requirements including 31 USC 1352; other federal requirements; Executive Order 11246; Air Pollution Act; Federal Water Pollution Control Act and Federal Employment Laws.
Protection of Personal Data and Information. The Contractor certifies that all steps will be taken to ensure the security and confidentiality of all Commonwealth data for which the Contractor becomes a holder, either as part of performance or inadvertently during performance, with special attention to restricting access, use and disbursement of personal data and information under G.L. c. 93H and c. 66A and Executive Order 504. The Contractor is required to comply with G.L. c. 93I for the proper disposal of all paper and electronic media, backups or systems containing personal data and information, provided further that the Contractor is required to ensure that any personal data or information transmitted electronically or through a portable device be properly encrypted using (at a minimum) Information Technology Division (ITD) Protection of Sensitive Information, provided further that any Contractor having access to credit card or banking information of Commonwealth customers certifies that the Contractor is PCI compliant in accordance with the Payment Card Industry Council Standards and shall provide confirmation compliance during the Contract, provide further that the Contractor shall immediately notify the Department in the event of any security breach including the unauthorized access, disbursement, use or disposal of personal data or information, and in the event of a security breach, the Contractor shall cooperate fully with the Commonwealth and provide access to any information necessary for the Commonwealth to respond to the security breach and shall be fully responsible for any damages associated with the Contractor’s breach including but not limited to G.L. c. 214, s. 3B.
Corporate and Business Filings and Reports. The Contractor certifies compliance with any certification, filing, reporting and service of process requirements of the Secretary of the Commonwealth, the Office of the Attorney General or other Departments as related to its conduct of business in the Commonwealth; and with its incorporating state (or foreign entity).
Employer Requirements. Contractors that are employers certify compliance with applicable state and federal employment laws or regulations, including but not limited to G.L. c. 5, s. 1 (Prevailing Wages for Printing and Distribution of Public Documents); G.L. c. 7, s. 22 (Prevailing Wages for Contracts for Meat Products and Clothing and Apparel); minimum wages and prevailing wage programs and payments; unemployment insurance and contributions; workers’ compensation and insurance, child labor laws, AGO fair labor practices; G.L. c. 149 (Labor and Industries); G.L. c. 150A (Labor Relations); G.L. c. 151 and 455 CMR 2.00 (Minimum Fair Wages); G.L. c. 151A (Employment and Training); G. L. c. 151B (Unlawful Discrimination); G.L. c. 151E (Business Discrimination); G.L. c. 152 (Workers’ Compensation); G.L. c.153 (Liability for Injuries); 29 USC c. 8 (Federal Fair Labor Standards); 29 USC c. 28 and the Federal Family and Medical Leave Act.
Federal And State Laws And Regulations Prohibiting Discrimination including but not limited to the Federal Equal Employment Oppurtunity (EEO) Laws the Americans with Disabilities Act,; 42 U.S.C Sec. 12,101, et seq., the Rehabilitation Act, 29 USC c. 16 s. 794; 29 USC c. 16. s. 701; 29 USC c. 14, 623; the 42 USC c. 45; (Federal Fair Housing Act); G.
L. c. 151B (Unlawful Discrimination); G.L. c. 151E (Business Discrimination); the Public Accommodations Law G.L. c. 272, s. 92A; G.L. c. 272, s. 98 and 98A, Massachusetts Constitution Article CXIV and G.L. c. 93, s. 103; 47 USC c. 5, sc. II, Part II, s. 255 (Telecommunication Act; Chapter 149, Section 105D, G.L. c. 151C, G.L. c. 272, Section 92A, Section 98 and Section 98A, and G.L. c. 111, Section 199A, and Massachusetts Disability-Based Non-Discrimination Standards For Executive Branch Entities, and related Standards and Guidance, authorized under Massachusetts Executive Order or any disability-based protection arising from state or federal law or precedent. See also MCAD and MCAD links and Resources.
Small Business Purchasing Program (SBPP). A Contractor may be eligible to participate in the SBPP, created pursuant to Executive Order 523, if qualified through the SBPP COMMBUYS subscription process at: www.commbuys.com and with acceptance of the terms of the SBPP participation agreement.
Limitation of Liability for Information Technology Contracts (and other Contracts as Authorized). The Information Technology Mandatory Specifications and the IT Acquisition Accessibility Contract Language are incorporated by reference into Information Technology Contracts. The following language will apply to Information Technology contracts in the U01, U02, U03, U04, U05, U06, U07, U08, U09, U10, U75, U98 object codes in the Expenditure Classification Handbook or other Contracts as approved by CTR or OSD.
Pursuant to Section 11. Indemnification of the Commonwealth Terms and Conditions, the term “other damages” shall include, but shall not be limited to, the reasonable costs the Commonwealth incurs to repair, return, replace or seek cover (purchase of comparable substitute commodities and services) under a Contract. “Other damages” shall not include damages to the Commonwealth as a result of third party claims, provided, however, that the foregoing in no way limits the Commonwealth’s right of recovery for personal injury or property damages or patent and copyright infringement under Section 11 nor the Commonwealth’s ability to join the contractor as a third party defendant. Further, the term State of Utah Bid CH16012
3/22/2016 4:23 PM p. 157
#15..
- 488 -
COMMONWEALTH OF MASSACHUSETTS ~ STANDARD CONTRACT FORM
(Updated 3/21/2014) Page 5 of 5
“other damages” shall not include, and in no event shall the contractor be liable for, damages for the Commonwealth’s use of contractor provided products or services, loss of Commonwealth records, or data (or other intangible property), loss of use of equipment, lost revenue, lost savings or lost profits of the Commonwealth. In no event shall “other damages” exceed the greater of $100,000, or two times the value of the product or service (as defined in the Contract scope of work) that is the subject of the claim. Section 11 sets forth the contractor’s entire liability under a Contract. Nothing in this section shall limit the Commonwealth’s ability to negotiate higher limitations of liability in a particular Contract, provided that any such limitation must specifically reference Section 11 of the Commonwealth Terms and Conditions. In the event the limitation of liability conflicts with accounting standards which mandate that there can be no cap of damages, the limitation shall be considered waived for that audit engagement. These terms may be applied to other Contracts only with prior written confirmation from the Operational Services Division or the Office of the Comptroller. The terms in this Clarification may not be modified.
Northern Ireland Certification. Pursuant to G.L. c. 7 s. 22C for state agencies, state authorities, the House of Representatives or the state Senate, by signing this Contract the Contractor certifies that it does not employ ten or more employees in an office or other facility in Northern Ireland and if the Contractor employs ten or more employees in an office or other facility located in Northern Ireland the Contractor certifies that it does not discriminate in employment, compensation, or the terms, conditions and privileges of employment on account of religious or political belief; and it promotes religious tolerance within the work place, and the eradication of any manifestations of religious and other illegal discrimination; and the Contractor is not engaged in the manufacture, distribution or sale of firearms, munitions, including rubber or plastic bullets, tear gas, armored vehicles or military aircraft for use or deployment in any activity in Northern Ireland.
Pandemic, Disaster or Emergency Performance. In the event of a serious emergency, pandemic or disaster outside the control of the Department, the Department may negotiate emergency performance from the Contractor to address the immediate needs of the Commonwealth even if not contemplated under the original Contract or procurement.
Payments are subject to appropriation and other payment terms.
Consultant Contractor Certifications (For Consultant Contracts “HH” and “NN” and “U05” object codes subject to G.L. Chapter 29, s. 29A). Contractors must make required disclosures as part of the RFR Response or using the Consultant Contractor Mandatory Submission Form.
Attorneys. Attorneys or firms providing legal services or representing Commonwealth Departments may be subject to G.L. c. 30, s. 65, and if providing litigation services must be approved by the Office of the Attorney General to appear on behalf of a Department, and shall have a continuing obligation to notify the Commonwealth of any conflicts of interest arising under the Contract.
Subcontractor Performance. The Contractor certifies full responsibility for Contract performance, including subcontractors, and that comparable Contract terms will be included in subcontracts, and that the Department will not be required to directly or indirectly manage subcontractors or have any payment obligations to subcontractors. .
EXECUTIVE ORDERS
For covered Executive state Departments, the Contractor certifies compliance with applicable Executive Orders (see also Massachusetts Executive Orders), including but not limited to the specific orders listed below. A breach during period of a Contract may be considered a material breach and subject Contractor to appropriate monetary or Contract sanctions.
Executive Order 481. Prohibiting the Use of Undocumented Workers on State Contracts.
For all state agencies in the Executive Branch, including all executive offices, boards, commissions, agencies, Departments, divisions, councils, bureaus, and offices, now existing and hereafter established, by signing this Contract the Contractor certifies under the pains and penalties of perjury that they shall not knowingly use undocumented workers in connection with the performance of this Contract; that, pursuant to federal requirements, shall verify the immigration status of workers assigned to a Contract without engaging in unlawful discrimination; and shall not knowingly or recklessly alter, falsify, or accept altered or falsified documents from any such worker
Executive Order 130. Anti-Boycott. The Contractor warrants, represents and agrees that during the time this Contract is in effect, neither it nor any affiliated company, as hereafter defined, participates in or cooperates with an international boycott (See IRC § 999(b)(3)- (4), and IRS Audit Guidelines Boycotts) or engages in conduct declared to be unlawful by G.L. c. 151E, s. 2. A breach in the warranty, representation, and agreement contained in this paragraph, without limiting such other rights as it may have, the Commonwealth shall be entitled to rescind this Contract. As used herein, an affiliated company shall be any business entity of which at least 51% of the ownership interests are directly or indirectly owned by the Contractor or by a person or persons or business entity or entities directly or indirectly owning at least 51% of the ownership interests of the Contractor, or which directly or indirectly owns at least 51% of the ownership interests of the Contractor.
Executive Order 346. Hiring of State Employees By State Contractors Contractor certifies compliance with both the conflict of interest law G.L. c. 268A specifically s. 5 (f) and this order; and includes limitations regarding the hiring of state employees by private companies contracting with the Commonwealth. A privatization contract shall be deemed to include a specific prohibition against the hiring at any time during the term of Contract, and for any position in the Contractor's company, any state management employee who is, was, or will be involved in the preparation of the RFP, the negotiations leading to the awarding of the Contract, the decision to award the Contract, and/or the supervision or oversight of performance under the Contract.
Executive Order 444. Disclosure of Family Relationships With Other State Employees.
Each person applying for employment (including Contract work) within the Executive Branch under the Governor must disclose in writing the names of all immediate family related to immediate family by marriage who serve as employees or elected officials of the Commonwealth. All disclosures made by applicants hired by the Executive Branch under the Governor shall be made available for public inspection to the extent permissible by law by the official with whom such disclosure has been filed.
Executive Order 504. Regarding the Security and Confidentiality of Personal Information.
For all Contracts involving the Contractor’s access to personal information, as defined in G.L. c. 93H, and personal data, as defined in G.L. c. 66A, owned or controlled by Executive Department agencies, or access to agency systems containing such information or data (herein collectively “personal information”), Contractor certifies under the pains and penalties of perjury that the Contractor (1) has read Commonwealth of Massachusetts Executive Order 504 and agrees to protect any and all personal information; and (2) has reviewed all of the Commonwealth Information Technology Division’s Security Policies. Notwithstanding any contractual provision to the contrary, in connection with the Contractor’s performance under this Contract, for all state agencies in the Executive Department, including all executive offices, boards, commissions, agencies, departments, divisions, councils, bureaus, and offices, now existing and hereafter established, the Contractor shall: (1) obtain a copy, review, and comply with the contracting agency’s Information Security Program (ISP) and any pertinent security guidelines, standards, and policies; (2) comply with all of the Commonwealth of Massachusetts Information Technology Division’s “Security Policies”) (3) communicate and enforce the contracting agency’s ISP and such Security Policies against all employees (whether such employees are direct or contracted) and subcontractors; (4) implement and maintain any other reasonable appropriate security procedures and practices necessary to protect personal information to which the Contractor is given access by the contracting agency from the unauthorized access, destruction, use, modification, disclosure or loss; (5) be responsible for the full or partial breach of any of these terms by its employees (whether such employees are direct or contracted) or subcontractors during or after the term of this Contract, and any breach of these terms may be regarded as a material breach of this Contract; (6) in the event of any unauthorized access, destruction, use, modification, disclosure or loss of the personal information (collectively referred to as the “unauthorized use”): (a) immediately notify the contracting agency if the Contractor becomes aware of the unauthorized use; (b) provide full cooperation and access to information necessary for the contracting agency to determine the scope of the unauthorized use; and (c) provide full cooperation and access to information necessary for the contracting agency and the Contractor to fulfill any notification requirements. Breach of these terms may be regarded as a material breach of this Contract, such that the Commonwealth may exercise any and all contractual rights and remedies, including without limitation indemnification under Section 11 of the Commonwealth’s Terms and Conditions, withholding of payments, Contract suspension, or termination. In addition, the Contractor may be subject to applicable statutory or regulatory penalties, including and without limitation, those imposed pursuant to G.L. c. 93H and under G.L. c. 214, § 3B for violations under M.G.L c. 66A.
Executive Orders 523, 524 and 526. Executive Order 526 (Order Regarding NonDiscrimination, Diversity, Equal Opportunity and Affirmative Action which supersedes Executive Order 478). Executive Order 524 (Establishing the Massachusetts Supplier Diversity Program which supersedes Executive Order 390). Executive Order 523 (Establishing the Massachusetts Small Business Purchasing Program.) All programs, activities, and services provided, performed, licensed, chartered, funded, regulated, or contracted for by the state shall be conducted without unlawful discrimination based on race, color, age, gender, ethnicity, sexual orientation, gender identity or expression, religion, creed, ancestry, national origin, disability, veteran’s status (including Vietnam-era veterans), or background. The Contractor and any subcontractors may not engage in discriminatory employment practices; and the Contractor certifies compliance with applicable federal and state laws, rules, and regulations governing fair labor and employment practices; and the Contractor commits to purchase supplies and services from certified minority or women-owned businesses, small businesses, or businesses owned by socially or economically disadvantaged persons or persons with disabilities. These provisions shall be enforced through the contracting agency, OSD, and/or the Massachusetts Commission Against Discrimination. Any breach shall be regarded as a material breach of the contract that may subject the contractor to appropriate sanctions.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 158
#15..
- 489 -
Revised: March 12, 2015
Supplier Diversity Program (SDP) Plan Commitment
SDP Plan Form #1
(To be submitted with Bid Response)
Contract/RFR Document Number:
Supplier Diversity Program (SDP) Resources:
• Resources available to assist Prime Bidders in finding potential Minority Business Enterprises (MBE) and Women Business Enterprises (WBE) partners can be found on the Supplier Diversity Program Webpage (www.mass.gov/sdp).
• Resources available to assist Prime Bidders in finding potential Service-Disabled Veteran-Owned Business Enterprise (SDVOBE) partners can be found on the Supplier Diversity Office Webpage (www.mass.gov/sdo). • The Supplier Diversity Program offers training on the SDP Plan requirements. The dates of upcoming trainings can be found on the OSD Training Courses Webpage. In addition, the SDP Webinar can be located on the Supplier Diversity Program Webpage (www.mass.gov/sdp).
Instructions: Completing all parts of this form is mandatory. Please read instructions in the SDP section of the solicitation. Complete one form and submit with Bid.
Part I Bidder/Contractor Information (Required)
Business Name: Contact Name: Phone # ( ) - Email address:
Part II Financial Commitment (Required)
Provide a specific percentage committed (as a percentage of Bidder/Contractor sales derived from this contract for the life of the contract) to be spent with all certified SDP Partners that the Bidder will propose if awarded a Contract. Please note that prime bidders who are SDO-certified must also submit an SDP Plan Form.
SDP Percentage Committed in Bid Response for Life of Contract: % State of Utah Bid CH16012
3/22/2016 4:23 PM p. 159
#15..
- 490 -
Revised: March 12, 2015
Supplier Diversity Program (SDP) Plan - Declaration of SDP Partner(s) SDP Plan Form #2
(Must be submitted by Contractor within a period of up to 30 days (or as stated in RFR) of Contract Execution) Contract/RFR Document Number:
*The Supplier Diversity Office and contracting Department reserve the right to contact SDP Partners at any time to request that they attest to the amounts reported to have been paid to them by the Contractor.
** SDP Partner Certification Acronyms: MBE = Minority-owned Business Enterprise; WBE = Women-owned Business Enterprise; SDVOBE = Service-Disabled Veteran-owned Business Enterprise.
*** Certification Status can be checked on the Supplier Diversity Program Webpage (www.mass.gov/sdp).
Supplier Diversity Program (SDP) Resources:
• Resources available to assist Prime Bidders in finding potential Minority Business Enterprises (MBE) and Women Business Enterprises (WBE) partners can be found on the Supplier Diversity Program Webpage (www.mass.gov/sdp). • Resources available to assist Prime Bidders in finding potential Service-Disabled Veteran-Owned Business Enterprise (SDVOBE) partners can be found on the Supplier Diversity Office Webpage (www.mass.gov/sdo). • The Supplier Diversity Program offers training on the SDP Plan requirements. The dates of upcoming trainings can be found on the OSD Training Courses Webpage. In addition, the SDP Webinar can be located on the Supplier Diversity Program Webpage (www.mass.gov/sdp).
Instructions: Completing all parts of this form is mandatory. Please read instructions in the SDP section of the solicitation. Complete one form and submit within a period of up to 30 days (or as stated in RFR) of Contract Execution. See SDP and SDVOBE Resource information below to assist in partnering with certified businesses.
Part I Contractor Information (Required)
Business Name: Contact Name: Phone # ( ) - Email address:
Please note that prime bidders who are SDO-certified must also submit an SDP Plan Form and may not list themselves as an SDP Partner. Check any of the following that are applicable to the Bidder:
Minority-owned Business Enterprise (MBE); Certification Expiration Date (If applicable): / / Women-owned Business Enterprise (WBE); Certification Expiration Date (If applicable): / / Non-Profit Organization (NPO); Certification Expiration Date (If applicable): / / Service-Disabled Veteran-owned Business Enterprise (SDVOBE); Certification Expiration Date (If applicable): / / Identify Business Opportunities for SDP Partners (Optional):
Final SDP Percentage Committed for Life of Contract: %
Part II Contractor’s SDP Partners (Required) (Fill in Applicable Lines; Insert Additional Rows as Needed) Planned SDP Partner’s Company Name Planned SDP Partner’s Contact Person’s Email Address*
Check Planned SDP
Partner’s Certification(s)**
@ .
MBE
WBE
MNPO/WNPO/MWNPO
SDVOBE
@ .
MBE
WBE
MNPO/WNPO/M/WNPO
SDVOBE
@ .
MBE
WBE
MNPO/WNPO/MWNPO
SDVOBE
@ .
MBE
WBE
MNPO/WNPO/M/WNPO
SDVOBE
Alternative to Contractor Providing List of SDP Partners (above): If specifically authorized in the Request for Response (RFR) to utilize this option, by checking the box at right, Contractor acknowledges that they do not yet have any SDP Partners but will meet the percentage commitment in Part I (above) and all other contract requirements and will work with the SDO to identify and establish business relationships with SDO Partners:
Part III Under the pains and penalties of perjury I certify that the information provided on this form is accurate. (Required)
Name: Title: Signature:
(May be left blank if submitted electronically)
Date: / /
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 160
#15..
- 491 -
1 Ρεϖισεδ 2/27/2015
ΣΤΑΤΕWΙDΕ ΧΟΝΤΡΑΧΤ ΑDΜΙΝΙΣΤΡΑΤΙΟΝ ΦΕΕ
ΘΥΑΡΤΕΡΛΨΡΕΠΟΡΤ
Ρεπορτινγ Περιοδ ανδ Παψmεντ Dεαδλινε: Ινδιχατε ωηιχη χαλενδαρ ψεαρ ανδ θυαρτερ τηισ ρεπορτ χοϖερσ (χηεχκ ονλψ ονε θυαρτερ):
Χαλενδαρ Ψεαρ: 20− −
− Φιρστ Θυαρτερ: ϑανυαρψ 1στ – Μαρχη 31στ (Ρεπορτ ανδ Παψmεντ Dυε βψ Μαψ 15τη) − Σεχονδ Θυαρτερ: Απριλ 1στ – ϑυνε 30τη (Ρεπορτ ανδ Παψmεντ Dυε βψ Αυγυστ 15τη) − Τηιρδ Θυαρτερ: ϑυλψ 1στ – Σεπτεmβερ 30τη (Ρεπορτ ανδ Παψmεντ Dυε βψ Νοϖεmβερ 15τη) − Φουρτη Θυαρτερ: Οχτοβερ 1 – Dεχεmβερ 31στ (Ρεπορτ ανδ Παψmεντ Dυε βψ Φεβρυαρψ 15τη) Υνδερ παινσ ανδ πεναλτιεσ οφ περϕυρψ, Ι ηερεβψ δεχλαρε τηατ τηισ ισ α τρυε ανδ αχχυρατε ρεπορτ οφ παψmεντσ ανδ φεεσ δυε πυρσυαντ το τηε τερmσ οφ τηε αβοϖε−ρεφερενχεδ Στατεωιδε Χοντραχτ.
Ελεχτρονιχ Σιγνατυρε:
Dατε:
ΣΤΑΤΕWΙDΕ ΧΟΝΤΡΑΧΤ DΟΧ ΝΟ. ΜΑΣΣΑΧΗΥΣΕΤΤΣ 10−DΙΓΙΤ ςΕΝDΟΡ ΧΟDΕ ςΧ
ΛΕΓΑΛ ΧΟΜΠΑΝΨ ΝΑΜΕ DΟΙΝΓ ΒΥΣΙΝΕΣΣ ΑΣ (DΒΑ) (ιφ αππλιχαβλε) ΠΕΡΣΟΝ ΧΟΜΠΛΕΤΙΝΓ ΤΗΙΣ ΦΟΡΜ:
ΦΙΡΣΤ ΝΑΜΕ Μ.Ι. ΛΑΣΤ ΝΑΜΕ
ΕΜΑΙΛ ΑDDΡΕΣΣ ΤΕΛΕΠΗΟΝΕ ΦΑΞ
ΑDDΡΕΣΣ ΛΙΝΕ 1 ΑDDΡΕΣΣ ΛΙΝΕ 2
ΧΙΤΨ ΣΤΑΤΕ ΖΙΠ
ΛΙΝΕ ΣΤΑΤΕWΙDΕ ΧΟΝΤΡΑΧΤ ΑDΜΙΝΙΣΤΡΑΤΙΟΝ ΦΕΕ WΟΡΚΣΗΕΕΤ
1. Τοταλ παψmεντσ ρεχειϖεδ το δατε φροm Ελιγιβλε Εντιτιεσι ιν τηισ φεε Θυαρτερ: ∃ .00
2. Μυλτιπλιεδ βψ 1% Χοντραχτ Αδmινιστρατιον Φεε: ξ 0.01
3. Τοταλ Θυαρτερλψ Φεε Dυε (Λινε 1 mυλτιπλιεδ βψ Λινε 2): ∃ .00
4. Plus: Previous Quarter’s Deferred payment due (if applicable) (παψmεντσ mαψ ονλψ βε δεφερρεδ ιφ αmουντ δυε ωασ υνδερ ∃50.00): ∃ .00
5. Τοταλ Παψmεντσ Dυε ανδ Παιδ το ΟΣD (Λινε 3 πλυσ Λινε 4) .00
6. Νο παψmεντ ισ συβmιττεδ ωιτη τηισ ρεπορτ βεχαυσε:
Νο παψmεντσ ωερε ρεχειϖεδ τηισ θυαρτερ ΟΡ
Παψmεντ δυε ωουλδ βε λεσσ τηαν ∃50.00 ανδ ισ δεφερρεδ υντιλ τηε νεξτ θυαρτερ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 161
#15..
- 492 -
2 Ρεϖισεδ 2/27/2015
Ινστρυχτιονσ:
1. Υσε ονε φορm φορ εαχη Στατεωιδε Χοντραχτ συβϕεχτ το τηισ φεε.
2. Ρεπορτ ΟΝΛΨ τοταλ παψmεντσ ρεχειϖεδ δυρινγ τηε ρεπορτινγ περιοδ σπεχιφιεδ ον τηε φροντ παγε οφ τηε φορm.
3. Ινχλυδε τηε πρεϖιουσ quarter’s δεφερρεδ παψmεντ ιφ αππλιχαβλε ον Λινε 4.
4. Α χοmπλετεδ ρεπορτ ισ ρεθυιρεδ, εϖεν ιφ:
α. Νο παψmεντσ ωερε ρεχειϖεδ τηισ θυαρτερ ορ
β. Παψmεντ δυε ωουλδ βε λεσσ τηαν ∃50 ανδ δεφερρεδ υντιλ τηε νεξτ θυαρτερ.
5. Αλλ παψmεντσ χαν βε mαδε τηρουγη τηε σεχυρε παψmεντ χεντερ ωηιχη ψου χαν αχχεσσ τηρουγη τηε Αδmινιστρατιον Φεε εmαιλ Νοτιχε.
6. Τηισ Στατεωιδε Χοντραχτορ Αδmινιστρατιον Φεε Ρεπορτ ΑΝD αππλιχαβλε Χοντραχτ Αδmινιστρατιον Φεεσ mυστ βε ρεχειϖεδ νο λατερ τηαν 45 δαψσ αφτερ τηε ενδ οφ τηε Ρεπορτινγ Περιοδ.
7. Φαιλυρε το προϖιδε τηε ρεπορτ ανδ αππλιχαβλε φεεσ mαψ ρεσυλτ ιν τηε Χοντραχτορ βεινγ φουνδ ιν δεφαυλτ ανδ συβϕεχτ το τηε πεναλτιεσ προϖιδεδ φορ ιν τηε Στατεωιδε Χοντραχτ Αδmινιστρατιον Φεε πολιχψ τηατ ισ ινχλυδεδ ιν τηισ Στατεωιδε Χοντραχτ, ωηιχη ισ ινχορπορατεδ βψ ρεφερενχε ιντο τηισ φορm.
Φορ ινφορmατιον χονχερνινγ τηε υσε οφ τηισ φορm ανδ/ορ Χοντραχτ Αδmινιστρατιον Φεεσ, πλεασε χονταχτ τηε Οπερατιοναλ Σερϖιχεσ Dιϖισιον ατ (617) 720−3300 ανδ ασκ το σπεακ ωιτη τηε Χοντραχτ Αδmινιστρατιον Φεε Αυδιτορ.
i
Eligible Entities include, but are not limited to: a) Cities, towns, districts, counties and other political subdivisions; b) Executive, Legislative and Judicial Branches, including all departments and elected offices therein; c) Independent public authorities, commissions, and quasi-public agencies; d) Local public libraries, public school districts, and charter schools; e) Public hospitals owned by the Commonwealth; f) Public institutions of higher education; g) Public purchasing cooperatives; h) Non-profit, UFR-certified organizations that are doing business with the Commonwealth; i) Other states and territories with no prior approval by the State Purchasing Agent required; and j) Other entities when designated in writing by the State Purchasing Agent.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 162
#15..
- 493 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 163
#15..
- 494 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 164
#15..
- 495 -
Χοmmονωεαλτη οφ Μασσαχηυσεττσ
σπεχιφιχ τερmσ ανδ χονδιτιονσ
Τηε φολλοωινγ τερmσ ανδ χονδιτιονσ αρε το βε ινχορπορατεδ ιντο ανψ Παρτιχιπατινγ Αδδενδυm ωιτη τηε Χοmmονωεαλτη υνδερ τηε ΝΑΣΠΟ ςαλυεΠοιντ Χοοπερατιϖε Χοντραχτ φορ Χλουδ Σολυτιονσ 2016 ñ 2026.
Vendors seeking to execute a Participating Addendum with the Commonwealth of Massachusetts will be required to execute the Commonwealth Terms and Conditions, (Attachment A), and the Commonwealth Standard Contract Form, (Attachment B). The order of precedence for documents governing the Participating Addendum shall be as stated in paragraph 15 of the Commonwealth Terms and Conditions.
In addition, for any contract executed by the Commonwealth of Massachusetts under the Participating Addendum, the following documents will be added to the order of precedence, in this order: the Commonwealth solicitation, if any (e.g., an RFQ); any negotiated terms and conditions between the Commonwealth and the vendor; and the vendor's response to the Commonwealth solicitation. 1 PARTICIPATION
The following are the Commonwealth entities (“Eligible Entities”) that are designated by the State Purchasing Agent as eligible to use the Participating Addendum known as Statewide Contract ITS60:
a) Cities, towns, districts, counties and other political subdivisions; b) Executive, Legislative and Judicial Branches, including all Departments and elected offices therein;
c) Independent public authorities, commissions and quasi-public agencies; d) Local public libraries, public school districts and charter schools; e) Public hospitals owned by the Commonwealth;
f) Public institutions of higher education;
g) Public purchasing cooperatives;
h) Non-profit, UFR-certified organizations that are doing business with the Commonwealth; i) Other entities when designated in writing by the State Purchasing Agent. 2 COMMBUYS MARKET CENTER
COMMBUYS will be the official source of information for Commonwealth Statewide Contracts resulting from Participating Addenda executed with the Commonwealth and is publicly accessible at no charge at www.commbuys.com. All vendors executing a Participating Addendum with the Commonwealth agree that: (a) they will maintain an active seller account in COMMBUYS; (b) they will, when directed to do so by the Operational Services Division (OSD), activate and maintain a COMMBUYS-enabled catalog using Commonwealth Commodity Codes; (c) they will comply with all requests by OSD to utilize COMMBUYS for the purposes of conducting all aspects of purchasing and invoicing with the Commonwealth, as added functionality for the COMMBUYS system is activated; (d) in the event the Commonwealth adopts an alternate market center system, Vendors will be required to utilize such system, as directed by OSD. Commonwealth Commodity Codes are based on the United Nations Standard Products and Services Code (UNSPSC). 3 SUPPLIER DIVERSITY PROGRAM (SDP)
Massachusetts Executive Order 524 and Executive Order 565 establish a policy to promote the award of state contracts in a manner that develops and strengthens Minority and Women Business Enterprises (M/WBEs) that resulted in the Supplier Diversity Program in Public Contracting. Similarly, Executive Orders 546 and 565 established the Service-Disabled Veteran-Owned Business Enterprise (SDVOBE) Program, the Veteran-Owned Business Enterprise Program, and the Lesbian Gay Bixsexual and Transgender-owned (LGBT) Business Enterprise Program to encourage the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 165
#15..
- 496 -
participation of businesses owned and controlled by these business categories in all areas of state procurement and contracting, thereby including them in the SDP. All Vendors, regardless of their certification status, must identify a commitment in the form of a specific percentage of sales made under the resulting contract that will be spent with a Certified Partner(s), using SDP Plan Form #1 – SDP Plan Commitment (Attachment C). This percentage commitment will extend for the life of any resulting contract.
After contract execution, if any,Vendors must submit a completed SDP Plan Form #2 – Declaration of SDP Partners (Attachment D) identifying a Certified Partner(s) no later than 30 days after contract execution. Vendors may defer identification of their SDP Partner(s) by checking the box in Part II, thereby acknowledging their SDP Plan commitment. Failure to submit a completed SDP Plan Form #2 by the deadline may result in penalties including contract suspension or termination. 4 PERFORMANCE AND PAYMENT TIME FRAMES WHICH CONTINUE BEYOND THE DURATION OF THE CONTRACT.
All agreements for services entered into during the duration of this contract and whose performance and payment time frames extend beyond the duration of this contract shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No new agreements for services may be executed after the contract has expired.
Any contract termination or suspension pursuant to this section shall not automatically terminate any agreements for services already in place unless the department also terminates said agreements for service, which were executed pursuant to the main contract. 5 STATEWIDE CONTRACT ADMINISTRATION FEE AND REPORT
This Statewide Contract is subject to a 1% Contract Administration Fee, which is created pursuant to MGL c. 7, § 3B, 801 CMR 4.02 and incorporated by reference into Statewide Contracts with the Operational Services Division (OSD). The price stated in any Vendor’s Statewide Contract shall be inclusive of this fee and Vendors shall not reflect this fee as a separate line item on customer invoices.
This fee will be based on 1% of the total dollar amounts, adjusted for credits or refunds, paid by Eligible Entities to the Vendor based on your statewide contract. All ”Statewide Contracts” awarded and all purchase orders and purchases made pursuant to this Agreement are subject to this fee regardless of whether the contract was awarded for statewide or regional coverage.
Note that if the 1% Administration Fee is deductible as a business expense for federal income tax purposes, it is also deductible as an expense for Massachusetts tax purposes.
5.1 Quarterly Fee Payment:
For each Payment Period, Statewide Contractor shall pay to OSD a fee equal to one percent (1%) of the total payments (adjusted for credits or refunds) received from all Eligible Entities that have purchased from the Statewide Contractor pursuant to this Agreement. All payments will be based on full calendar quarters (Payment Periods) and must be received by OSD on or before 45 days after the last day of the Payment Period (as specified below) or a Contractor will be considered in breach of contract:
Quarter Reporting/Payment Period Quarterly Report/Payment Due Date First Quarter January 1st – March 31st May 15th
Second Quarter April 1st – June 30th August 15th
Third Quarter July 1st – September 30th November 15th
Fourth Quarter October 1 – December 31st February 15th
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 166
#15..
- 497 -
Quarterly payments will include any periods less than a full calendar quarter if a contract does not start at the first day of a quarter or end on the last day of the quarter.
Payments are to be made through a web-based secure payment center, which can be accessed through a link provided to Statewide Contractors by OSD. All Administration Fee payments are to be made directly through the secure payment center. The secure payment center allows payments to be made via Automatic Clearing House (ACH) or by using one of the following credit cards: American Express, Discover, MasterCard and/or Visa.
Please note that there is no charge to vendors to use ACH as OSD covers the nominal fee charged by the secure payment center for using the ACH payment method. OSD will NOT cover the convenience fee for selecting to pay by credit card. This is a fee the contractor is responsible for paying and is non-refundable; the fee is over and above the 1% Administration Fee and it is calculated at 2.49% of the 1% Administration Fee to be paid. Prior to the due date for the Statewide Contractor’s Administration Fee payment, the Statewide Contractor will receive an email communication from OSD that includes all required information the Statewide Contractor must use to submit payments via the secure payment center. Electronically submitting your payment, which is comprised of the 1% administration fee of the total payments received by the Contractor from all Eligible Entities for the Quarter, will serve as the Statewide Contractor Administration Fee Report. If the total Administration Fees due for the Payment and Reporting Period are less than $50, a Statewide Contractor may carry over that balance to the next Payment and Reporting Period until the cumulative amount owed is $50 or greater (see Quarterly Reporting below for instructions).
6 QUARTERLY REPORTING:
Vendor shall submit one Statewide Contractor Administration Fee Report (Attachment E) for each Statewide Contract for each Payment Period. If an amount greater than $50 is due for the Payment Period, then the electronic submission of the payment shall serve as submission of the Statewide Contractor Administration Fee Report, as referenced in the Quarterly Fee Payment section above.
However, if the total Statewide Contractor Administration Fee due is between $0 and $50, then the Vendor must submit one Statewide Contractor Administration Fee Report for each Statewide Contract for each Payment Period. If you are submitting this report, it must be completely filled out, signed by the Vendor via electronic signature under the pains and penalties of perjury and emailed to [email protected].
Vendor shall submit one Vendor Sales and SDP Report (see Attachment F for sample) for each Statewide Contract for each Reporting Period. It is the Commonwealth’s intention to accept the reporting format specified in the NASPO ValuePoint Master Agreement with each Vendor, subject to whether, in the sole opinion of the Commonwealth, the negotiated report format provides substantially the same or greater detail required in Attachment F. In all cases, Vendors will be required to submit the SDP reporting tab of Attachment F.
7 AUDIT
During the term of this Agreement and for a period of six years thereafter, the Operational Services Division, its auditors, the Office of the Inspector General or other authorized representatives shall be afforded access at reasonable times to Vendor’s accounting records, including sales information on any system, reports or files, in order to audit all records relating to goods sold or services performed pursuant to this Agreement. If such an audit indicates that Vendor has materially underpaid OSD, then the Vendor shall remit the underpayment and be responsible for payment of any costs associated with the audit.
8 ADDITIONAL CLOUD TERMS
Bidders who are IaaS and PaaS resellers or providers will be expected to comply with the terms of MassIT RFR 16-21, “Brokered IaaS/PaaS Cloud Services,” available online at https://www.commbuys.com/bso/external/bidDetail.sdo?docId=BD-16-1060-ITD00-ITD00- State of Utah Bid CH16012
3/22/2016 4:23 PM p. 167
#15..
- 498 -
00000005782. These terms will be added to the Bidder's Participating Addendum with Massachusetts. In particular, see the following mandatory requirements and terms:
− Mandatory contract requirements, RFR Sections 3.2 and 3.4 − Project-specific terms and conditions, RFR Exhibit 10 − Mandatory legal privacy and security requirements, RFR Exhibits 12-14 Bidders who are SaaS resellers or providers will be expected to comply with the Commonwealth of Massachusetts standard cloud terms, available online
at https://www.commbuys.com/bso/external/bidDetail.sdo?docId=BD-15-1080-OSD01-OSD10- 00000003276 (see document entitled “SaaS doc”). These terms will be added to the Bidder's Participating Addendum with Massachusetts.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 168
#15..
- 499 -
Missouri
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 169
#15..
- 500 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 170
#15..
- 501 -
Montana
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 171
#15..
- 502 -
State of New Jersey
Compliance Terms and Conditions
Rev: 12/11/2015 Compliance T&C Page 1 of 4
The following terms and conditions shall be deemed incorporated by reference into each Participating Addendum entered into by the State of New Jersey under an awarded Master Agreement. The State of New Jersey reserves the right to add additional terms and conditions to each Participating Addendum.
1. LAW REQUIRING MANDATORY COMPLIANCE BY ALL CONTRACTORS - The statutes, laws or codes cited herein are available for review at the New Jersey State Library, 185 West State Street, Trenton, New Jersey 08625. The contractor must comply with all local, State and Federal laws, rules and regulations applicable to this contract and to the solutions and/or services provided hereunder. The contractor must comply with all State and Federal data and privacy laws, rules and regulations applicable to contractor under the contract.
1.1 BUSINESS REGISTRATION – Pursuant to N.J.S.A. 52:32-44, the State is prohibited from entering into a contract with an entity unless the bidder and each subcontractor named in the proposal have a valid Business Registration Certificate on file with the Division of Revenue.
The contractor and any subcontractor providing goods or performing services under the contract, and each of their affiliates, shall, during the term of the contract, collect and remit to the Director of the Division of Taxation in the Department of the Treasury the use tax due pursuant to the “Sales and Use Tax Act, P.L. 1966, c. 30 (N.J.S.A. 54:32B-1 et seq.) on all their sales of tangible personal property delivered into the State. Any questions in this regard can be directed to the Division of Revenue at (609) 292-1730. Form NJ-REG can be filed online at http://www.state.nj.us/treasury/revenue/busregcert.shtml.
1.2 ANTI-DISCRIMINATION - All parties to any contract with the State agree not to discriminate in employment and agree to abide by all anti-discrimination laws including those contained within N.J.S.A. 10:2-1 through N.J.S.A. 10:2-4, N.J.S.A. l0:5-1 et seq. and N.J.S.A. l0:5-31 through 10:5-38, and all rules and regulations issued thereunder are hereby incorporated by reference.
1.3 ADDITIONAL AFFIRMATIVE ACTION REQUIREMENTS -
N.J.S.A. 10:5-33 and N.J.A.C. 17:27-3.5 require that during the performance of this contract, the contractor must agree as follows:
a) The contractor or subcontractor, where applicable, will not discriminate against any employee or applicant for employment because of age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex. Except with respect to affectional or sexual orientation and gender identity or expression, the contractor will take affirmative action to ensure that such applicants are recruited and employed, and that employees are treated during employment, without regard to their age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex. Such action shall include, but not be limited to the following: employment, upgrading, demotion, or transfer; recruitment or recruitment advertising; layoff or termination; rates of pay or other forms of compensation; and selection for training, including apprenticeship. The contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices to be provided by the contracting officer setting forth the provisions of this nondiscrimination clause;
b) The contractor or subcontractor, where applicable will, in all solicitations or advertisements for employees placed by or on behalf of the contractor, state that all qualified applicants will receive consideration for employment without regard to age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex; c) The contractor or subcontractor where applicable, will send to each labor union or representative of workers with which it has a collective bargaining agreement or other contract or understanding, a notice, to be provided by the agency contracting officer, advising the labor union or workers' representative of the contractor's commitments under this act and shall post copies of the notice in conspicuous places available to employees and applicants for employment.
N.J.A.C. 17:27-3.7 requires all contractors and subcontractors, if any, to further agree as follows;
1. The contractor or subcontractor agrees to make good faith efforts to meet targeted county employment goals established in accordance with N.J.A.C. 17:27-5.2.
2. The contractor or subcontractor agrees to inform in writing its appropriate recruitment agencies including, but not limited to, employment agencies, placement bureaus, colleges, universities, and labor unions, that it does not discriminate on the basis of age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex, and that it will discontinue the use of any recruitment agency which engages in direct or indirect discriminatory practices.
3. The contractor or subcontractor agrees to revise any of its testing procedures, if necessary, to assure that all personnel testing conforms with the principles of job-related testing, as established by the statutes and New Jersey
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 172
#15..
- 503 -
State of New Jersey
Compliance Terms and Conditions
Rev: 12/11/2015 Compliance T&C Page 2 of 4
court decisions of the State of New Jersey and as established by applicable Federal law and applicable Federal court decisions.
4. In conforming with the targeted employment goals, the contractor or subcontractor agrees to review all procedures relating to transfer, upgrading, downgrading and layoff to ensure that all such actions are taken without regard to age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex, consistent with the statutes and court decisions of the State of New Jersey, and applicable Federal law and applicable Federal court decisions.
1.4 PREVAILING WAGE ACT - Pursuant to the New Jersey Prevailing Wage Act (N.J.S.A. 34: 11-56.26 et seq.), contractor guarantees that it has not been suspended or debarred by the Commissioner, New Jersey Department of Labor and Workforce Development, for violation of the provisions of the Prevailing Wage Act and/or the Public Works Contractor Registration Acts; contractor also guarantees that it will comply with the provisions of the Prevailing Wage and Public Works Contractor Registration Acts, where required and to the extent applicable to this contract.
1.5 AMERICANS WITH DISABILITIES ACT - The contractor must comply with all provisions of the Americans with Disabilities Act (ADA), P.L 101-336, in accordance with 42 U.S.C. 12101, et seq.
1.6 MACBRIDE PRINCIPLES – The contractor must certify pursuant to N.J.S.A. 52:34-12.2 that it either has no ongoing business activities in Northern Ireland and does not maintain a physical presence therein or that it will take lawful steps in good faith to conduct any business operations it has in Northern Ireland in accordance with the MacBride principles of nondiscrimination in employment as set forth in N.J.S.A. 52:18A-89.5 and in conformance with the United Kingdom’s Fair Employment (Northern Ireland) Act of 1989, and permit independent monitoring of their compliance with those principles.
1.7 PAY TO PLAY PROHIBITIONS – Pursuant to N.J.S.A. 19:44A-20.13 et seq (L.2005, c. 51), and specifically, N.J.S.A. 19:44A-20.21, it shall be a breach of the terms of the contract for the business entity to:
a. make or solicit a contribution in violation of the statute; b. knowingly conceal or misrepresent a contribution given or received; c. make or solicit contributions through intermediaries for the purpose of concealing or misrepresenting the source of the contribution;
d. make or solicit any contribution on the condition or with the agreement that it will be contributed to a campaign committee or any candidate of holder of the public office of Governor, or to any State or county party committee;
e. engage or employ a lobbyist or consultant with the intent or understanding that such lobbyist or consultant would make or solicit any contribution, which if made or solicited by the business entity itself, would subject that entity to the restrictions of the Legislation; f. fund contributions made by third parties, including consultants, attorneys, family members, and employees;
g. engage in any exchange of contributions to circumvent the intent of the Legislation; or h. directly or indirectly through or by any other person or means, do any act which would subject that entity to the restrictions of the Legislation.
1.8 POLITICAL CONTRIBUTION DISCLOSURE – The contractor is advised of its responsibility to file an annual disclosure statement on political contributions with the New Jersey Election Law Enforcement Commission (ELEC), pursuant to N.J.S.A. 19:44A-20.27 (L. 2005, c. 271, §3 as amended) if in a calendar year the contractor receives one or more contracts valued at $50,000.00 or more. It is the contractor’s responsibility to determine if filing is necessary. Failure to file can result in the imposition of penalties by ELEC. Additional information about this requirement is available from ELEC by calling 1(888) 313-3532 or on the internet at http://www.elec.state.nj.us/.
1.9 STANDARDS PROHIBITING CONFLICTS OF INTEREST - The following prohibitions on contractor activities shall apply to all contracts or purchase agreements made with the State of New Jersey, pursuant to Executive Order No. 189 (1988).
a. No vendor shall pay, offer to pay, or agree to pay, either directly or indirectly, any fee, commission, compensation, gift, gratuity, or other thing of value of any kind to any State officer or employee or special State officer or employee, as defined by N.J.S.A. 52:13D-13b. and e., in the Department of the Treasury or any other agency with which such vendor transacts or offers or proposes to transact business, or to any member of the immediate family, as defined by N.J.S.A. 52:13D-13i., of any such officer or employee, or partnership, firm or corporation with which they are employed or associated, or in which such officer or employee has an interest within the meaning of N.J.S.A. 52: 13D-13g.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 173
#15..
- 504 -
State of New Jersey
Compliance Terms and Conditions
Rev: 12/11/2015 Compliance T&C Page 3 of 4
b. The solicitation of any fee, commission, compensation, gift, gratuity or other thing of value by any State officer or employee or special State officer or employee from any State vendor shall be reported in writing forthwith by the vendor to the Attorney General and the Executive Commission on Ethical Standards.
c. No vendor may, directly or indirectly, undertake any private business, commercial or entrepreneurial relationship with, whether or not pursuant to employment, contract or other agreement, express or implied, or sell any interest in such vendor to, any State officer or employee or special State officer or employee having any duties or responsibilities in connection with the purchase, acquisition or sale of any property or services by or to any State agency or any instrumentality thereof, or with any person, firm or entity with which he is employed or associated or in which he has an interest within the meaning of N.J.S.A. 52: 130-13g. Any relationships subject to this provision shall be reported in writing forthwith to the Executive Commission on Ethical Standards, which may grant a waiver of this restriction upon application of the State officer or employee or special State officer or employee upon a finding that the present or proposed relationship does not present the potential, actuality or appearance of a conflict of interest.
d. No vendor shall influence, or attempt to influence or cause to be influenced, any State officer or employee or special State officer or employee in his official capacity in any manner which might tend to impair the objectivity or independence of judgment of said officer or employee. e. No vendor shall cause or influence, or attempt to cause or influence, any State officer or employee or special State officer or employee to use, or attempt to use, his official position to secure unwarranted privileges or advantages for the vendor or any other person. f. The provisions cited above in paragraphs 2.8a through 2.8e shall not be construed to prohibit a State officer or employee or Special State officer or employee from receiving gifts from or contracting with vendors under the same terms and conditions as are offered or made available to members of the general public subject to any guidelines the Executive Commission on Ethical Standards may promulgate under paragraph 3c of Executive Order No. 189.
1.10 NOTICE TO ALL CONTRACTORS SET-OFF FOR STATE TAX NOTICE - Pursuant to L 1995, c. 159, effective January 1, 1996, and notwithstanding any provision of the law to the contrary, whenever any taxpayer, partnership or S corporation under contract to provide goods or services or construction projects to the State of New Jersey or its agencies or instrumentalities, including the legislative and judicial branches of State government, is entitled to payment for those goods or services at the same time a taxpayer, partner or shareholder of that entity is indebted for any State tax, the Director of the Division of Taxation shall seek to set off that taxpayer’s or shareholder’s share of the payment due the taxpayer, partnership, or S corporation. The amount set off shall not allow for the deduction of any expenses or other deductions which might be attributable to the taxpayer, partner or shareholder subject to set-off under this act.
The Director of the Division of Taxation shall give notice to the set-off to the taxpayer and provide an opportunity for a hearing within thirty (30) days of such notice under the procedures for protests established under R.S. 54:49-18. No requests for conference, protest, or subsequent appeal to the Tax Court from any protest under this section shall stay the collection of the indebtedness. Interest that may be payable by the State, pursuant to P.L. 1987, c.184 (c.52:32-32 et seq.), to the taxpayer shall be stayed.
1.11 COMPLIANCE - STATE LAWS; JURISDICTION - It is agreed and understood that any contracts and/or orders shall be governed and construed and the rights and obligations of the parties hereto shall be determined in accordance with the laws of the STATE OF NEW JERSEY, without giving effect to its conflict of laws. Any action brought regarding the contract or products or services purchased thereunder shall be filed in the appropriate Division of the State of New Jersey Superior Court.
1.12 OWNERSHIP DISCLOSURE – In accordance with N.J.S.A. 52:25-24.2, contractor shall disclose the names and addresses of all of its owners holding 10% or more of the corporation's stock or interest during the term of the contract, by submitting an Ownership Disclosure Form at time of contract award. The contractor has the continuing obligation to notify the Division of any change in its ownership affecting 10% or more of its ownership as soon as such change has been completed.
1.13 PROHIBITED INVESTMENT IN IRAN - Pursuant to N.J.S.A. 52:32-55 et seq., the contractor must utilize the Disclosure of Investment Activities in Iran form to certify that neither the contractor, nor one of its parents, subsidiaries, and/or affiliates (as defined in N.J.S.A. 52:32-56(e)(3)), is listed on the Department of the Treasury’s List of Persons or Entities Engaging in Prohibited Investment Activities in Iran and that neither the contractor, nor one of its parents, subsidiaries, and/or affiliates, is involved in any of the investment activities set forth in N.J.S.A. 52:32-56(f). If the contractor is unable to so certify, the contractor shall provide a detailed and precise description of such activities as directed on the form.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 174
#15..
- 505 -
State of New Jersey
Compliance Terms and Conditions
Rev: 12/11/2015 Compliance T&C Page 4 of 4
2. LAW REQUIRING MANDATORY COMPLIANCE BY CONTRACTORS UNDER
CIRCUMSTANCES SET FORTH IN LAW OR BASED ON THE TYPE OF CONTRACT
2.1 COMPLIANCE - CODES – The contractor must comply with NJUCC and the latest NEC70, B.O.C.A. Basic Building code, OSHA and all applicable codes for this requirement. The contractor shall be responsible for securing and paying all necessary permits, where applicable.
2.2 PUBLIC WORKS CONTRACTOR REGISTRATION ACT - The New Jersey Public Works Contractor Registration Act requires all contractors, subcontractors and lower tier subcontractor(s) who engage in any contract for public work as defined in N.J.S.A. 34:11-56.26 be first registered with the New Jersey Department of Labor and Workforce Development. Any questions regarding the registration process should be directed to the Division of Wage and Hour Compliance at (609) 292-9464.
2.3 COMPLIANCE WITH ACCESSIBILITY STANDARDS – The contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973.
2.4 BUILDING SERVICE – Pursuant to N.J.S.A. 34:11-56.58 et seq., in any contract for building services, as defined in N.J.S.A. 34:11-56.59, the employees of the contractor or subcontractors shall be paid prevailing wage for building services rates, as defined in N.J.S.A. 34:11.56.59. The prevailing wage shall be adjusted annually during the term of the contract.
2.5 THE WORKER AND COMMUNITY RIGHT TO KNOW ACT - The provisions of N.J.S.A. 34:5A-l et seq. which require the labeling of all containers of hazardous substances are applicable to this contract. Therefore, all goods offered for purchase to the State must be labeled by the contractor in compliance with the provisions of the statute.
2.6 BUY AMERICAN – Pursuant to N.J.S.A. 52:32-1, if applicable to the contract, if manufactured items or farm products will be provided under this contract to be used in a public work, they shall be manufactured or produced in the United States and the contractor shall be required to so certify.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 175
#15..
- 506 -
North Dakota
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 176
#15..
- 507 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 177
#15..
- 508 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 178
#15..
- 509 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 179
#15..
- 510 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 180
#15..
- 511 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 181
#15..
- 512 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 182
#15..
- 513 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 183
#15..
- 514 -
Rhode Island
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 184
#15..
- 515 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 185
#15..
- 516 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 186
#15..
- 517 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 187
#15..
- 518 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 188
#15..
- 519 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 189
#15..
- 520 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 190
#15..
- 521 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 191
#15..
- 522 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 192
#15..
- 523 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 193
#15..
- 524 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 194
#15..
- 525 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 195
#15..
- 526 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 196
#15..
- 527 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 197
#15..
- 528 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 198
#15..
- 529 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 199
#15..
- 530 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 200
#15..
- 531 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 201
#15..
- 532 -
MANDATORY TERMS AND CONDITIONS:
1. Required Approvals. The State is not bound by this Contract until it is duly approved by the Parties and all appropriate State officials in accordance with applicable Tennessee laws and regulations. Depending upon the specifics of this Contract, this may include approvals by the Commissioner of Finance and Administration, the Commissioner of Human Resources, the Comptroller of the Treasury, and the Chief Procurement Officer. Approvals shall be evidenced by a signature or electronic approval.
2. Communications and Contacts. All instructions, notices, consents, demands, or other communications required or contemplated by this Contract shall be in writing and shall be made by certified, first class mail, return receipt requested and postage prepaid, by overnight courier service with an asset tracking system, or by email or facsimile transmission with recipient confirmation. All communications, regardless of method of transmission, shall be addressed to the respective Party at the appropriate mailing address, facsimile number, or email address as stated below or any other address provided in writing by a Party.
The State:
State Contact Name & Title
State Agency Name
Address
Email Address
Telephone # Number
FAX # Number
The Contractor:
Contractor Contact Name & Title
Contractor Name
Address
Email Address
Telephone # Number
FAX # Number
All instructions, notices, consents, demands, or other communications shall be considered effective upon receipt or recipient confirmation as may be required.
3. Modification and Amendment. This Contract may be modified only by a written amendment signed by all Parties and approved by all applicable State officials. The State’s exercise of a valid Renewal Option or Term Extension does not constitute an amendment so long as there are no other changes to the Contract’s terms and conditions.
4. Subject to Funds Availability. The Contract is subject to the appropriation and availability of State or federal funds. In the event that the funds are not appropriated or are otherwise unavailable, the State reserves the right to terminate this Contract upon written notice to the Contractor. The State’s exercise of its right to terminate this Contract shall not constitute a breach of Contract by the State. Upon receipt of the written notice, the Contractor shall cease all work associated with the Contract. If the State terminates this Contract due to lack of funds availability, the Contractor shall be entitled to compensation for all conforming goods requested and accepted by the State and for all satisfactory and authorized services completed as of the termination date. Should the State exercise its right to terminate this Contract due to unavailability of funds, the Contractor shall have no right to recover from the State any actual, general, special, incidental, consequential, or any other damages of any description or amount.
Tennessee
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 202
#15..
- 533 -
5. Termination for Convenience. The State may terminate this Contract for convenience without cause and for any reason. The State shall give the Contractor at least thirty (30) days written notice before the termination date. The Contractor shall be entitled to compensation for all conforming goods delivered and accepted by the State or for satisfactory, authorized services completed as of the termination date. In no event shall the State be liable to the Contractor for compensation for any goods neither requested nor accepted by the State or for any services neither requested by the State nor satisfactorily performed by the Contractor. In no event shall the State’s exercise of its right to terminate this Contract for convenience relieve the Contractor of any liability to the State for any damages or claims arising under this Contract.
6. Termination for Cause. If the Contractor fails to properly perform its obligations under this Contract in a timely or proper manner, or if the Contractor materially violates any terms of this Contract (“Breach Condition”),the State shall have the right to immediately terminate the Contract and withhold payments in excess of compensation for completed services or provided goods.
Notwithstanding the above, the Contractor shall not be relieved of liability to the State for damages sustained by virtue of any Breach Condition and the State may seek other remedies allowed at law or in equity for breach of this Contract.
7. Assignment and Subcontracting. The Contractor shall not assign this Contract or enter into a subcontract for any of the goods or services provided under this Contract without the prior written approval of the State. Notwithstanding any use of the approved subcontractors, the Contractor shall be the prime contractor and responsible for compliance with all terms and conditions of this Contract. The State reserves the right to request additional information or impose additional terms and conditions before approving an assignment of this Contract in whole or in part or the use of subcontractors in fulfilling the Contractor’s obligations under this Contract.
8. Conflicts of Interest. The Contractor warrants that no part of the Contractor’s compensation shall be paid directly or indirectly to an employee or official of the State of Tennessee as wages, compensation, or gifts in exchange for acting as an officer, agent, employee, subcontractor, or consultant to the Contractor in connection with any work contemplated or performed under this Contract.
The Contractor acknowledges, understands, and agrees that this Contract shall be null and void if the Contractor is, or within the past six (6) months has been, an employee of the State of Tennessee or if the Contractor is an entity in which a controlling interest is held by an individual who is, or within the past six (6) months has been, an employee of the State of Tennessee.
9. Nondiscrimination. The Contractor hereby agrees, warrants, and assures that no person shall be excluded from participation in, be denied benefits of, or be otherwise subjected to discrimination in the performance of this Contract or in the employment practices of the Contractor on the grounds of handicap or disability, age, race, creed, color, religion, sex, national origin, or any other classification protected by federal or state law. The Contractor shall, upon request, show proof of nondiscrimination and shall post in conspicuous places, available to all employees and applicants, notices of nondiscrimination.
10. Prohibition of Illegal Immigrants. The requirements of Tenn. Code Ann. § 12-3-309 addressing the use of illegal immigrants in the performance of any contract to supply goods or services to the state of Tennessee, shall be a material provision of this Contract, a breach of which shall be grounds for monetary and other penalties, up to and including termination of this Contract. a. The Contractor agrees that the Contractor shall not knowingly utilize the services of an illegal immigrant in the performance of this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant in the performance of this Contract. The Contractor shall reaffirm this attestation, in writing, by submitting to the State a completed and signed copy of the document at Attachment Reference, semi-annually during the Term. If the Contractor is a party to more than one State of Utah Bid CH16012
3/22/2016 4:23 PM p. 203
#15..
- 534 -
contract with the State, the Contractor may submit one attestation that applies to all contracts with the State. All Contractor attestations shall be maintained by the Contractor and made available to State officials upon request.
b. Prior to the use of any subcontractor in the performance of this Contract, and semiannually thereafter, during the Term, the Contractor shall obtain and retain a current, written attestation that the subcontractor shall not knowingly utilize the services of an illegal immigrant to perform work under this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant to perform work under this Contract. Attestations obtained from subcontractors shall be maintained by the Contractor and made available to State officials upon request. c. The Contractor shall maintain records for all personnel used in the performance of this Contract. Contractor’s records shall be subject to review and random inspection at any reasonable time upon reasonable notice by the State.
d. The Contractor understands and agrees that failure to comply with this section will be subject to the sanctions of Tenn. Code Ann. § 12-3-309 for acts or omissions occurring after its effective date.
e. For purposes of this Contract, "illegal immigrant" shall be defined as any person who is not: (i) a United States citizen; (ii) a Lawful Permanent Resident; (iii) a person whose physical presence in the United States is authorized; (iv) allowed by the federal Department of Homeland Security and who, under federal immigration laws or regulations, is authorized to be employed in the U.S.; or (v) is otherwise authorized to provide services under the Contract.
11. Records. The Contractor shall maintain documentation for all charges under this Contract. The books, records, and documents of the Contractor, for work performed or money received under this Contract, shall be maintained for a period of five (5) full years from the date of the final payment and shall be subject to audit at any reasonable time and upon reasonable notice by the State, the Comptroller of the Treasury, or their duly appointed representatives. The financial statements shall be prepared in accordance with generally accepted accounting principles.
12. Monitoring. The Contractor’s activities conducted and records maintained pursuant to this Contract shall be subject to monitoring and evaluation by the State, the Comptroller of the Treasury, or their duly appointed representatives.
13. Progress Reports. The Contractor shall submit brief, periodic, progress reports to the State as requested.
14. Strict Performance. Failure by any Party to this Contract to require, in any one or more cases, the strict performance of any of the terms, covenants, conditions, or provisions of this Contract shall not be construed as a waiver or relinquishment of any term, covenant, condition, or provision. No term or condition of this Contract shall be held to be waived, modified, or deleted except by a written amendment signed by the Parties.
15. Independent Contractor. The Parties shall not act as employees, partners, joint venturers, or associates of one another. The Parties are independent contracting entities. Nothing in this Contract shall be construed to create an employer/employee relationship or to allow either Party to exercise control or direction over the manner or method by which the other transacts its business affairs or provides its usual services. The employees or agents of one Party are not employees or agents of the other Party.
16 Patient Protection and Affordable Care Act. The Contractor agrees that it will be responsible for compliance with the Patient Protection and Affordable Care Act (“PPACA”) with respect to itself State of Utah Bid CH16012
3/22/2016 4:23 PM p. 204
#15..
- 535 -
and its employees, including any obligation to report health insurance coverage, provide health insurance coverage, or pay any financial assessment, tax, or penalty for not providing health insurance. The Contractor shall indemnify the State and hold it harmless for any costs to the State arising from Contractor’s failure to fulfill its PPACA responsibilities for itself or its employees.
17. Limitation of State’s Liability. The State shall have no liability except as specifically provided in this Contract. In no event will the State be liable to the Contractor or any other party for any lost revenues, lost profits, loss of business, decrease in the value of any securities or cash position, time, money, goodwill, or any indirect, special, incidental, punitive, exemplary or consequential damages of any nature, whether based on warranty, contract, statute, regulation, tort (including but not limited to negligence), or any other legal theory that may arise under this Contract or otherwise. Notwithstanding anything else herein, the State’s total liability under this Contract (including without limitation any exhibits, schedules, amendments or other attachments to the Contract) or otherwise shall under no circumstances exceed the Estimated Liability. This limitation of liability is cumulative and not per incident.
18. Limitation of Contractor’s Liability. In accordance with Tenn. Code Ann. § 12-3-701, the Contractor’s liability for all claims arising under this Contract shall be limited to an amount equal to two (2) times the Estimated Liability amount detailed in Section #. and as may be amended, PROVIDED THAT in no event shall this Section limit the liability of the Contractor for: (i) intellectual property or any Contractor indemnity obligations for infringement for third-party intellectual property rights; (ii) any claims covered by any specific provision in the Contract providing for liquidated damages; or (iii) any claims for intentional torts, criminal acts, fraudulent conduct, or acts or omissions that result in personal injuries or death.
19. Hold Harmless. The Contractor agrees to indemnify and hold harmless the State of Tennessee as well as its officers, agents, and employees from and against any and all claims, liabilities, losses, and causes of action which may arise, accrue, or result to any person, firm, corporation, or other entity which may be injured or damaged as a result of acts, omissions, or negligence on the part of the Contractor, its employees, or any person acting for or on its or their behalf relating to this Contract. The Contractor further agrees it shall be liable for the reasonable cost of attorneys for the State to enforce the terms of this Contract.
In the event of any suit or claim, the Parties shall give each other immediate notice and provide all necessary assistance to respond. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann. § 8-6-106.
20. HIPAA Compliance. The State and Contractor shall comply with obligations under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Health Information Technology for Economic and Clinical Health (“HITECH”) Act and any other relevant laws and regulations regarding privacy (collectively the “Privacy Rules”). The obligations set forth in this Section shall survive the termination of this Contract.
a. Contractor warrants to the State that it is familiar with the requirements of the Privacy Rules, and will comply with all applicable requirements in the course of this Contract. b. Contractor warrants that it will cooperate with the State, including cooperation and coordination with State privacy officials and other compliance officers required by the Privacy Rules, in the course of performance of the Contract so that both parties will be in compliance with the Privacy Rules.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 205
#15..
- 536 -
c. The State and the Contractor will sign documents, including but not limited to business associate agreements, as required by the Privacy Rules and that are reasonably necessary to keep the State and Contractor in compliance with the Privacy Rules. This provision shall not apply if information received or delivered by the parties under this Contract is NOT “protected health information” as defined by the Privacy Rules, or if the Privacy Rules permit the parties to receive or deliver the information without entering into a business associate agreement or signing another document. d. The Contractor will indemnify the State and hold it harmless for any violation by the Contractor or its subcontractors of the Privacy Rules. This includes the costs of responding to a breach of protected health information, the costs of responding to a government enforcement action related to the breach, and any fines, penalties, or damages paid by the State because of the violation.
21. Tennessee Consolidated Retirement System. Subject to statutory exceptions contained in Tenn.
Code Ann. §§ 8-36-801, et seq., the law governing the Tennessee Consolidated Retirement System (“TCRS”), provides that if a retired member of TCRS, or of any superseded system administered by TCRS, or of any local retirement fund established under Tenn. Code Ann. §§ 8- 35-101, et seq., accepts State employment, the member's retirement allowance is suspended during the period of the employment. Accordingly and notwithstanding any provision of this Contract to the contrary, the Contractor agrees that if it is later determined that the true nature of the working relationship between the Contractor and the State under this Contract is that of “employee/employer” and not that of an independent contractor, the Contractor, if a retired member of TCRS, may be required to repay to TCRS the amount of retirement benefits the Contractor received from TCRS during the Term.
22. Tennessee Department of Revenue Registration. The Contractor shall comply with all applicable registration requirements contained in Tenn. Code Ann. §§ 67-6-601 – 608. Compliance with applicable registration requirements is a material requirement of this Contract.
23. Debarment and Suspension. The Contractor certifies, to the best of its knowledge and belief, that it, its current and future principals, its current and future subcontractors and their principals:
a. are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from covered transactions by any federal or state department or agency;
b. have not within a three (3) year period preceding this Contract been convicted of, or had a civil judgment rendered against them from commission of fraud, or a criminal offense in connection with obtaining, attempting to obtain, or performing a public (federal, state, or local) transaction or grant under a public transaction; violation of federal or state antitrust statutes or commission of embezzlement, theft, forgery, bribery, falsification, or destruction of records, making false statements, or receiving stolen property; c. are not presently indicted or otherwise criminally or civilly charged by a government entity (federal, state, or local) with commission of any of the offenses detailed in section b. of this certification; and
d. have not within a three (3) year period preceding this Contract had one or more public transactions (federal, state, or local) terminated for cause or default.
The Contractor shall provide immediate written notice to the State if at any time it learns that there was an earlier failure to disclose information or that due to changed circumstances, its principals or the principals of its subcontractors are excluded or disqualified.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 206
#15..
- 537 -
24. Force Majeure. “Force Majeure Event” means fire, flood, earthquake, elements of nature or acts of God, wars, riots, civil disorders, rebellions or revolutions, acts of terrorism or any other similar cause beyond the reasonable control of the Party except to the extent that the non-performing Party is at fault in failing to prevent or causing the default or delay, and provided that the default or delay cannot reasonably be circumvented by the non-performing Party through the use of alternate sources, workaround plans or other means. A strike, lockout or labor dispute shall not excuse either Party from its obligations under this Contract. Except as set forth in this Section, any failure or delay by a Party in the performance of its obligations under this Contract arising from a Force Majeure Event is not a default under this Contract or grounds for termination. The non-performing Party will be excused from performing those obligations directly affected by the Force Majeure Event, and only for as long as the Force Majeure Event continues, provided that the Party continues to use diligent, good faith efforts to resume performance without delay. The occurrence of a Force Majeure Event affecting Contractor’s representatives, suppliers, subcontractors, customers or business apart from this Contract is not a Force Majeure Event under this Contract. Contractor will promptly notify the State of any delay caused by a Force Majeure Event (to be confirmed in a written notice to the State within one (1) day of the inception of the delay) that a Force Majeure Event has occurred, and will describe in reasonable detail the nature of the Force Majeure Event. If any Force Majeure Event results in a delay in Contractor’s performance longer than forty-eight (48) hours, the State may, upon notice to Contractor: (a) cease payment of the fees until Contractor resumes performance of the affected obligations; or (b) immediately terminate this Contract or any purchase order, in whole or in part, without further payment except for fees then due and payable. Contractor will not increase its charges under this Contract or charge the State any fees other than those provided for in this Contract as the result of a Force Majeure Event.
25. State and Federal Compliance. The Contractor shall comply with all applicable state and federal laws and regulations in the performance of this Contract.
26. Governing Law. This Contract shall be governed by and construed in accordance with the laws of the State of Tennessee. The Tennessee Claims Commission or the state or federal courts in Tennessee shall be the venue for all claims, disputes, or disagreements arising under this Contract. The Contractor acknowledges and agrees that any rights, claims, or remedies against the State of Tennessee or its employees arising under this Contract shall be subject to and limited to those rights and remedies available under Tenn. Code Ann. §§ 9-8-101 - 407.
27. Entire Agreement. This Contract is complete and contains the entire understanding between the Parties relating to its subject matter, including all the terms and conditions of the Parties’ agreement. This Contract supersedes any and all prior understandings, representations, negotiations, and agreements between the Parties, whether written or oral.
28. Severability. If any terms and conditions of this Contract are held to be invalid or unenforceable as a matter of law, the other terms and conditions of this Contract shall not be affected and shall remain in full force and effect. The terms and conditions of this Contract are severable.
29. Headings. Section headings of this Contract are for reference purposes only and shall not be construed as part of this Contract.
30. Incorporation of Additional Documents. Each of the following documents is included as a part of this Contract by reference. In the event of a discrepancy or ambiguity regarding the Contractor’s duties, responsibilities, and performance under this Contract, these items shall govern in order of precedence below:
a. any amendment to this Contract, with the latter in time controlling over any earlier amendments;
b. this Contract with any attachments or exhibits (excluding the items listed at subsections c. through f., below), which includes [identify attachments and exhibits]; State of Utah Bid CH16012
3/22/2016 4:23 PM p. 207
#15..
- 538 -
c. any clarifications of or addenda to the Contractor’s proposal seeking this Contract; d. the State solicitation, as may be amended, requesting responses in competition for this Contract;
e. any technical specifications provided to proposers during the procurement process to award this Contract; and
f. the Contractor’s response seeking this Contract.
31. Intellectual Property. The Contractor agrees to indemnify and hold harmless the State of Tennessee as well as its officers, agents, and employees from and against any and all claims or suits which may be brought against the State concerning or arising out of any claim of an alleged patent, copyright, trade secret or other intellectual property infringement. In any such claim or action brought against the State, the Contractor shall satisfy and indemnify the State for the amount of any settlement or final judgment, and the Contractor shall be responsible for all legal or other fees or expenses incurred by the State arising from any such claim. The State shall give the Contractor notice of any such claim or suit, however, the failure of the State to give such notice shall only relieve Contractor of its obligations under this Section to the extent Contractor can demonstrate actual prejudice arising from the State’s failure to give notice. This Section shall not grant the Contractor, through its attorneys, the right to represent the State of Tennessee in any legal matter, as provided in Tenn. Code Ann. § 8-6-106.
32. Prohibited Advertising or Marketing. The Contractor shall not suggest or imply in advertising or marketing materials that Contractor's goods or services are endorsed by the State. The restrictions on Contractor advertising or marketing materials under this Section shall survive the termination of this Contract.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 208
#15..
- 539 -
Στατε οφ Wασηινγτον:
ASSｷデｷﾗﾐ;ﾉ デWヴﾏゲ ;ﾐS IﾗﾐSｷデｷﾗﾐゲ ゲヮWIｷaｷI デﾗ W;ゲｴｷﾐｪデﾗﾐ Sデ;デWげゲ P;ヴデｷIｷヮ;デｷﾐｪ ASSWﾐS┌ﾏ ;ヴW ;ゲ aﾗﾉﾉﾗ┘ゲぎ Μαναγεmεντ Φεε. M;ﾐ;ｪWﾏWﾐデ FWW ｷゲ ; Iﾗゲデ ヴWIﾗ┗Wヴ┞ aWW ;ゲゲﾗIｷ;デWS ┘ｷデｴ W;ゲｴｷﾐｪデﾗﾐげゲ αδmινιστρατιον οφ τηε Παρτιχιπατινγ Αδδενδυm ωιτη Χοντραχτορσ. Χοντραχτορ σηαλλ παψ W;ゲｴｷﾐｪデﾗﾐげゲ M;ﾐ;ｪWﾏWﾐデ FWW ﾗa ヰくΑヴ ヮWヴIWﾐデ ﾗa デｴW ｪヴﾗゲゲ ゲ;ﾉWゲ ;ﾐS ヴWヮﾗヴデ ゲ;ﾉWゲが ｷﾐIﾉ┌Sｷﾐｪ ζερο σαλεσ, εαχη θυαρτερ.
Σεχυριτψ Dεσιγν Ρεϖιεω. Πριορ το φιναλ εξεχυτιον οφ α Πυρχηασινγ Εντιτιεσ χοντραχτ ωιτη α Cﾗﾐデヴ;Iデﾗヴが デｴW Cﾗﾐデヴ;Iデﾗヴげゲ ;ヮヮﾉｷI;τιον(σ) ωιλλ βε συβϕεχτ το α Σεχυριτψ Dεσιγν Ρεϖιεω περφορmεδ βψ Wασηινγτον Τεχηνολογψ Σολυτιονσ το ενσυρε χοmπλιανχε ωιτη Οφφιχε οφ τηε Χηιεφ Ινφορmατιον Οφφιχερ (ΟΧΙΟ) Σεχυριτψ Πολιχιεσ.
Σενσιτιϖε Ρεχορδσ ορ Dατα. Χοντραχτορσ αχκνοωλεδγε τηατ Παρτιχιπατινγ Εντιτιεσ mαψ ηαϖε ϖαρψινγ λεϖελσ οφ σενσιτιϖε ορ χονφιδεντιαλ ρεχορδσ ανδ/ορ δατα. Ασ σετ φορτη βελοω, ρεχορδσ ανδ/ορ δατα χλασσιφιεδ ασ Χατεγορψ 1 ορ 2 Dατα mαψ βε σηαρεδ βψ τηε διρεχτιον οφ τηε Παρτιχιπατινγ Εντιτψ ανδ Χατεγορψ 3 ανδ 4 Dατα σηαλλ νοτ βε ρελεασεδ βψ Χοντραχτορ:
Χατεγορψ 1 Dατα ισ πυβλιχ ινφορmατιον ανδ χαν βε ρελεασεδ το τηε πυβλιχ, δοεσ νοτ νεεδ προτεχτιον φροm υναυτηοριζεδ δισχλοσυρε ανδ νεεδσ Χοντραχτορ το προϖιδε ιντεγριτψ ανδ αϖαιλαβιλιτψ προτεχτιον χοντρολσ.
Χατεγορψ 2 Dατα ισ σενσιτιϖε ινφορmατιον ανδ mαψ νοτ βε σπεχιφιχαλλψ προτεχτεδ φροm δισχλοσυρε βψ λαω ανδ ισ φορ οφφιχιαλ υσε ονλψ. Χοντραχτορ σηαλλ νοτ ρελεασε το τηε πυβλιχ υνλεσσ σπεχιφιχαλλψ ρεθυεστεδ ανδ αφτερ ρεχειϖινγ πριορ αππροϖαλ βψ Πυρχηασινγ Εντιτψ βεφορε συχη ρελεασε.
Χατεγορψ 3 Dατα ισ χονφιδεντιαλ ινφορmατιον ανδ ισ σπεχιφιχαλλψ προτεχτεδ φροm δισχλοσυρε βψ λαω. Χοντραχτορ σηαλλ νοτ ρελεασε Χατεγορψ 3 Dατα.
Χατεγορψ 4 Dατα ισ χονφιδεντιαλ ινφορmατιον ωηιχη ρεθυιρεσ σπεχιαλ ηανδλινγ ανδ ισ σπεχιφιχαλλψ προτεχτεδ φροm δισχλοσυρε βψ λαω. Χοντραχτορ σηαλλ νοτ ρελεασε Χατεγορψ 4 Dατα.
Σερϖιχε Οργανιζατιον Χοντρολ (ΣΟΧ) 2 Αυδιτ Ρεπορτσ. Χοντραχτορ δατα χεντερ(σ) ηανδλινγ Wασηινγτον Στατε Χατεγορψ 3 ανδ 4 δατα σηαλλ περφορm ινδεπενδεντ ΣΟΧ 2 αυδιτσ ατ λεαστ αννυαλλψ ατ ιτσ εξπενσε.
W;ゲｴｷﾐｪデﾗﾐげゲ EﾉWIデヴﾗﾐｷI B┌ゲｷﾐWゲゲ Sﾗﾉ┌デｷﾗﾐ ふWEBSぶく Χοντραχτορσ mυστ ρεγιστερ ιτσ φιρm ιν WΕΒΣ το ρεχειϖε νοτιφιχατιον οφ αmενδmεντσ ανδ αννουνχεmεντσ ρελατινγ το τηε Παρτιχιπατινγ Αδδενδυm. Χοντραχτορσ σηουλδ ρεγιστερ ιν ονε ορ mορε Χοmmοδιτψ Χοδεσ ωηιχη ρεφλεχτσ Cﾗﾐデヴ;Iデﾗヴげゲ ゲﾗﾉ┌デｷﾗﾐ ﾗaaWヴｷﾐｪく
W;ゲｴｷﾐｪデﾗﾐげゲ TWヴﾏゲ わ CﾗﾐSｷデｷﾗﾐゲ aﾗヴ Cﾗﾐデヴ;Iデく Νοτωιτηστανδινγ ανψ προϖισιον το τηε χοντραρψ, Cﾗﾐデヴ;Iデﾗヴ ;Iﾆﾐﾗ┘ﾉWSｪWゲ ;ﾐS ;ｪヴWWゲ デｴ;デ P;ヴデｷIｷヮ;デｷﾐｪ Eﾐデｷデ┞げゲ Iﾗﾐデヴ;Iデ ゲｴ;ﾉﾉ Iﾗﾏヮﾉ┞ ┘ｷデｴ Wασηινγτον λαω ανδ τηατ συχη αγρεεmεντ σηαλλ βε συβϕεχτ το Wασηινγτον ϖενυε ανδ χηοιχε οφ Washington
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 209
#15..
- 540 -
λαω ανδ στατε ρεθυιρεmεντσ ρελατινγ το αϖαιλαβιλιτψ οφ φυνδσ ορ ωιτηδραωαλ οφ αυτηοριτψ.
Cﾗﾐデヴ;Iデﾗヴ a┌ヴデｴWヴ ;Iﾆﾐﾗ┘ﾉWSｪWゲ ;ﾐS ;ｪヴWWゲ デｴ;デ P;ヴデｷIｷヮ;デｷﾐｪ Eﾐデｷデ┞げゲ Iﾗﾐデヴ;Iデ ゲｴ;ﾉﾉ ｷﾐIﾉ┌SW ; σιξ ψεαρ στατυτε οφ λιmιτατιονσ (υνλεσσ εξτενδεδ φορ πενδινγ λιτιγατιον) ανδ ρεχορδκεεπινγ ρεθυιρεmεντ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 210
#15..
- 541 -
West Virginia
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 211
#15..
- 542 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 212
#15..
- 543 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 213
#15..
- 544 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 214
#15..
- 545 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 215
#15..
- 546 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 216
#15..
- 547 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 217
#15..
- 548 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 218
#15..
- 549 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 219
#15..
- 550 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 220
#15..
- 551 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 221
#15..
- 552 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 222
#15..
- 553 -
1 ΣΤΑΤΕ ΟΦ WΙΣΧΟΝΣΙΝ ΧΟΜΜΟDΙΤΙΕΣ ΧΟΝΤΡΑΧΤ
1. DΕΦΙΝΙΤΙΟΝΣ. Wορδσ ανδ τερmσ σηαλλ βε γιϖεν τηειρ ορδιναρψ ανδ υσυαλ mεανινγσ. Υνλεσσ νεγοτιατεδ οτηερωισε βψ τηε παρτιεσ, ωηερε χαπιταλιζεδ, τηε φολλοωινγ ωορδσ ανδ τερmσ σηαλλ ηαϖε τηε mεανινγσ ινδιχατεδ. Τηε mεανινγσ σηαλλ βε αππλιχαβλε το τηε σινγυλαρ, πλυραλ, mασχυλινε, φεmινινε ανδ νευτερ οφ τηε ωορδσ ανδ τερmσ.
ìΑχχεπτανχεî mεανσ α mανιφεστατιον οφ ασσεντ βψ τηε Στατε το τηε τερmσ, Σερϖιχεσ, Γοοδσ ορ οτηερ ιτεmσ οφφερεδ βψ τηε Χοντραχτορ υνδερ τηε Χοντραχτ αφτερ Ινσπεχτιον βψ τηε Στατε. ìΑγενχψî ορ ìΣτατε Αγενχψî mεανσ αν οφφιχε, δεπαρτmεντ, αγενχψ, ινστιτυτιον οφ ηιγηερ εδυχατιον, ασσοχιατιον, σοχιετψ ορ οτηερ βοδψ ιν τηε Στατε οφ Wισχονσιν γοϖερνmεντ χρεατεδ ορ αυτηοριζεδ το βε χρεατεδ βψ τηε Στατε Χονστιτυτιον ορ ανψ λαω, ωηιχη ισ εντιτλεδ το εξπενδ mονεψσ αππροπριατεδ βψ λαω, ινχλυδινγ τηε λεγισλατυρε ανδ τηε χουρτσ, βυτ νοτ ινχλυδινγ αν αυτηοριτψ, ασ δεφινεδ ιν Wισ. Στατ. σ. 16.70(2).
ìΒυσινεσσ Dαψî mεανσ ανψ δαψ ον ωηιχη τηε Χοντραχτινγ Αγενχψ ισ οπεν φορ βυσινεσσ. ìΧονφιδεντιαλ Ινφορmατιονî mεανσ αλλ τανγιβλε ανδ ιντανγιβλε ινφορmατιον ανδ mατεριαλσ βεινγ δισχλοσεδ ιν χοννεχτιον ωιτη τηισ Χοντραχτ, ιν ανψ φορm ορ mεδιυm ωιτηουτ ρεγαρδ το ωηετηερ τηε ινφορmατιον ισ οωνεδ βψ τηε Στατε ορ βψ α τηιρδ παρτψ, ωηιχη σατισφιεσ ατ λεαστ ονε οφ τηε φολλοωινγ χριτερια: (ι) Περσοναλλψ Ιδεντιφιαβλε Ινφορmατιον; (ιι) Προπριεταρψ Ινφορmατιον; (ιιι) νον−πυβλιχ ινφορmατιον ρελατεδ το τηε Στατεíσ εmπλοψεεσ, χυστοmερσ, τεχηνολογψ (ινχλυδινγ δατα βασεσ, δατα προχεσσινγ ανδ χοmmυνιχατιονσ νετωορκινγ σψστεmσ), σχηεmατιχσ, σπεχιφιχατιονσ, ανδ αλλ ινφορmατιον ορ mατεριαλσ δεριϖεδ τηερεφροm ορ βασεδ τηερεον; ορ (ιϖ) ινφορmατιον εξπρεσσλψ δεσιγνατεδ ασ χονφιδεντιαλ ιν ωριτινγ βψ τηε Στατε. Χονφιδεντιαλ Ινφορmατιον ινχλυδεσ αλλ ινφορmατιον τηατ ισ ρεστριχτεδ ορ προηιβιτεδ φροm δισχλοσυρε βψ στατε ορ φεδεραλ λαω.
ìΧοντραχτεδ Περσοννελî mεανσ α Χοντραχτορíσ εmπλοψεεσ ορ οτηερ περσοννελ (ινχλυδινγ οφφιχερσ, αγεντσ ανδ Συβχοντραχτορσ) προϖιδεδ βψ τηε Χοντραχτορ το ρενδερ Σερϖιχεσ υνδερ τηισ Χοντραχτ.
ìΧοντραχτινγ Αγενχψî mεανσ τηε Αγενχψ εντερινγ ιντο τηισ Χοντραχτ ον βεηαλφ οφ τηε Στατε. ìDαψî mεανσ χαλενδαρ δαψ υνλεσσ οτηερωισε σπεχιφιεδ ιν τηισ Χοντραχτ. ìDεφαυλτî mεανσ τηε οmισσιον ορ φαιλυρε το περφορm α χοντραχτυαλ δυτψ ορ προϖιδε Γοοδσ ορ Σερϖιχεσ ασ χοντραχτυαλλψ ρεθυιρεδ.
ìΓοοδσî mεανσ αρτιχλεσ οφ τραδε ορ ιτεmσ οφ mερχηανδισε, συππλιεσ, ραω mατεριαλσ, ορ φινισηεδ προδυχτσ, ανδ mαψ αλσο ινχλυδε ινχιδενταλ ορ ρελατεδ Σερϖιχεσ ασ τηε σιτυατιον mαψ ρεθυιρε.
ìΙνσπεχτιονî mεανσ αν εξαmινατιον οφ Γοοδσ προϖιδεδ υνδερ τηισ Χοντραχτ ιν ορδερ το δετερmινε τηειρ φιτνεσσ φορ υσε
Wisconsin
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 223
#15..
- 554 -
2 ìΠερσοναλλψ Ιδεντιφιαβλε Ινφορmατιονî mεανσ αν ινδιϖιδυαλíσ λαστ ναmε ανδ τηε ινδιϖιδυαλíσ φιρστ ναmε ορ φιρστ ινιτιαλ, ιν χοmβινατιον ωιτη ανδ λινκεδ το ανψ οφ τηε φολλοωινγ ελεmεντσ, ιφ τηατ ελεmεντ ισ νοτ πυβλιχλψ αϖαιλαβλε ινφορmατιον ανδ ισ νοτ ενχρψπτεδ, ρεδαχτεδ, ορ αλτερεδ ιν ανψ mαννερ τηατ ρενδερσ τηε ελεmεντ υνρεαδαβλε: (α) τηε ινδιϖιδυαλíσ Σοχιαλ Σεχυριτψ νυmβερ; (β) τηε ινδιϖιδυαλíσ δριϖερíσ λιχενσε νυmβερ ορ στατε ιδεντιφιχατιον νυmβερ; (χ) τηε νυmβερ οφ τηε ινδιϖιδυαλíσ φινανχιαλ αχχουντ, ινχλυδινγ α χρεδιτ ορ δεβιτ χαρδ αχχουντ νυmβερ, ορ ανψ σεχυριτψ χοδε, αχχεσσ χοδε, ορ πασσωορδ τηατ ωουλδ περmιτ αχχεσσ το τηε ινδιϖιδυαλíσ φινανχιαλ αχχουντ; (δ) τηε ινδιϖιδυαλíσ DΝΑ προφιλε; ορ (ε) τηε ινδιϖιδυαλíσ υνιθυε βιοmετριχ δατα, ινχλυδινγ φινγερπριντ, ϖοιχε πριντ, ρετινα ορ ιρισ ιmαγε, ορ ανψ οτηερ υνιθυε πηψσιχαλ ρεπρεσεντατιον, ανδ ανψ οτηερ ινφορmατιον προτεχτεδ βψ στατε ορ φεδεραλ λαω. ìΠροπριεταρψ Ινφορmατιονî mεανσ ινφορmατιον, ινχλυδινγ α φορmυλα, παττερν, χοmπιλατιον, προγραm, δεϖιχε, mετηοδ, τεχηνιθυε ορ προχεσσ το ωηιχη αλλ οφ τηε φολλοωινγ αππλψ:
α. Τηε ινφορmατιον δεριϖεσ ινδεπενδεντ εχονοmιχ ϖαλυε, αχτυαλ ορ ποτεντιαλ, φροm νοτ βεινγ γενεραλλψ κνοων το, ανδ νοτ βεινγ ρεαδιλψ ασχερταιναβλε βψ προπερ mεανσ βψ, οτηερ περσονσ ωηο χαν οβταιν εχονοmιχ ϖαλυε φροm ιτσ δισχλοσυρε ορ υσε. β. Τηε ινφορmατιον ισ τηε συβϕεχτ οφ εφφορτσ το mαινταιν ιτσ σεχρεχψ τηατ αρε ρεασοναβλε υνδερ τηε χιρχυmστανχεσ.
ìΠροπερλψ−συβmιττεδ Ινϖοιχεî ισ ονε τηατ ισ συβmιττεδ ιν αχχορδανχε ωιτη ινστρυχτιονσ χονταινεδ ον τηε Στατεíσ Πυρχηασε Ορδερ, ινχλυδεσ α ρεφερενχε το τηε προπερ Πυρχηασε Ορδερ νυmβερ, ανδ ισ συβmιττεδ το τηε προπερ αδδρεσσ φορ προχεσσινγ. ìΠυρχηασε Ορδερî mεανσ τηε Στατεíσ στανδαρδ δοχυmεντ οφ α πυρχηασε οφ Γοοδσ ορ Σερϖιχεσ. ìΣερϖιχεσî mεανσ αλλ ωορκ περφορmεδ, ανδ λαβορ, αχτιονσ, ρεχοmmενδατιονσ, πλανσ, ρεσεαρχη, χυστοmιζατιονσ, mοδιφιχατιονσ, δοχυmεντατιον, ανδ mαιντενανχε ανδ συππορτ προϖιδεδ βψ τηε Χοντραχτορ νεχεσσαρψ το φυλφιλλ τηατ ωηιχη τηε Χοντραχτορ ισ οβλιγατεδ το αχχοmπλιση υνδερ τηισ Χοντραχτ.
ìΣτατεî mεανσ τηε Στατε οφ Wισχονσιν.
ìΣυβχοντραχτî mεανσ αν αγρεεmεντ, ωριττεν ορ οραλ, βετωεεν τηε Χοντραχτορ ανδ ανψ οτηερ παρτψ το φυλφιλλ τηε ρεθυιρεmεντσ ανδ περφορmανχε οβλιγατιονσ οφ τηισ Χοντραχτ. ìΣυβχοντραχτορî mεανσ αν εντιτψ τηατ εντερσ ιντο α Συβχοντραχτ, ωιτη τηε Χοντραχτορ φορ τηε πυρποσε οφ δελιϖερινγ Γοοδσ ορ ρενδερινγ Σερϖιχεσ το τηε Στατε. ìWορκ Χεντερî mεανσ α χηαριταβλε οργανιζατιον ορ νονπροφιτ ινστιτυτιον ωηιχη ισ λιχενσεδ υνδερ σ. 104.07 ανδ ινχορπορατεδ ιν τηισ Στατε ορ α υνιτ οφ χουντψ γοϖερνmεντ ωηιχη ισ οπερατεδ φορ τηε πυρποσε οφ χαρρψινγ ουτ α προγραm οφ ρεηαβιλιτατιον φορ σεϖερελψ ηανδιχαππεδ ινδιϖιδυαλσ ανδ φορ προϖιδινγ τηε ινδιϖιδυαλσ ωιτη ρεmυνερατιϖε εmπλοψmεντ ορ οτηερ οχχυπατιοναλ ρεηαβιλιτατινγ αχτιϖιτψ οφ αν εδυχατιοναλ ορ τηεραπευτιχ νατυρε, ανδ ωηιχη ισ ενγαγεδ ιν τηε προδυχτιον οφ mατεριαλσ, συππλιεσ ορ εθυιπmεντ ορ τηε περφορmανχε οφ χοντραχτυαλ σερϖιχεσ ιν χοννεχτιον ωιτη ωηιχη νοτ λεσσ τηαν 75% οφ τηε τοταλ ηουρσ οφ διρεχτ λαβορ αρε περφορmεδ βψ σεϖερελψ ηανδιχαππεδ ινδιϖιδυαλσ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 224
#15..
- 555 -
3 2. ΑΠΠΛΙΧΑΒΛΕ ΛΑW. Τηισ Χοντραχτ σηαλλ βε γοϖερνεδ βψ τηε λαωσ οφ τηε Στατε οφ Wισχονσιν. ςενυε φορ ανψ αχτιον βρουγητ υνδερ τηισ Χοντραχτ σηαλλ λιε ιν Μαδισον, Dανε Χουντψ, Wισχονσιν.
3. ΤΕΡΜ. Τηε ινιτιαλ τερm οφ τηισ Χοντραχτ σηαλλ βε φορ ____ ψεαρ(σ) φροm τηε εφφεχτιϖε δατε. Τηισ Χοντραχτ ισ ελιγιβλε φορ ____ mυτυαλλψ αγρεεδ υπον _____−ψεαρ ρενεωαλσ, υνλεσσ τερmινατεδ ασ προϖιδεδ ηερειν.
4. ΤΕΡΜΙΝΑΤΙΟΝ ΦΟΡ ΧΑΥΣΕ. Τηε Στατε mαψ τερmινατε τηισ Χοντραχτ αφτερ προϖιδινγ τηε Χοντραχτορ ωιτη _____ (____) Dαψσ ωριττεν νοτιχε οφ τηε Χοντραχτορíσ ριγητ το χυρε α φαιλυρε οφ τηε Χοντραχτορ το περφορm υνδερ τηε τερmσ οφ τηισ Χοντραχτ.
Τηε Χοντραχτορ mαψ τερmινατε τηισ Χοντραχτ αφτερ προϖιδινγ τηε Στατε ωιτη _____ (____) Dαψσ ωριττεν νοτιχε οφ τηε Στατεíσ ριγητ το χυρε α φαιλυρε οφ τηε Στατε το περφορm υνδερ τηε τερmσ οφ τηισ Χοντραχτ.
5. ΤΕΡΜΙΝΑΤΙΟΝ ΦΟΡ ΧΟΝςΕΝΙΕΝΧΕ. Τηε Στατε mαψ τερmινατε τηισ Χοντραχτ ατ ανψ τιmε, ωιτηουτ χαυσε, βψ προϖιδινγ α ωριττεν νοτιχε το τηε οτηερ παρτψ ατ λεαστ _______ (____) Dαψσ ιν αδϖανχε οφ τηε ιντενδεδ δατε οφ τερmινατιον.
Χοντραχτορ mαψ τερmινατε τηισ Χοντραχτ ατ ανψ τιmε, ωιτηουτ χαυσε, βψ προϖιδινγ α ωριττεν νοτιχε το τηε οτηερ παρτψ ατ λεαστ _______ (____) Dαψσ ιν αδϖανχε οφ τηε ιντενδεδ δατε οφ τερmινατιον.
Ιν τηε εϖεντ οφ α τερmινατιον φορ χονϖενιενχε, τηε Χοντραχτορ σηαλλ βε εντιτλεδ το ρεχειϖε χοmπενσατιον φορ ανψ χοmπλετεδ ορ παρτιαλλψ χοmπλετεδ Σερϖιχεσ ρενδερεδ ορ Γοοδσ προϖιδεδ υνδερ τηε Χοντραχτ. Χοmπενσατιον φορ παρτιαλλψ χοmπλετεδ Σερϖιχεσ σηαλλ βε νο mορε τηαν τηε περχενταγε οφ χοmπλετιον οφ τηε Σερϖιχεσ ρεθυεστεδ, ασ δετερmινεδ βψ τηε Στατε ιν ιτσ σολε δισχρετιον, mυλτιπλιεδ βψ τηε χορρεσπονδινγ παψmεντ φορ χοmπλετιον οφ συχη Σερϖιχεσ ασ σετ φορτη ιν τηε Χοντραχτ. Αλτερνατιϖελψ, ατ τηε σολε δισχρετιον οφ τηε Στατε, τηε Χοντραχτορ mαψ βε χοmπενσατεδ φορ τηε αχτυαλ Σερϖιχε ηουρσ προϖιδεδ. Τηε Στατε σηαλλ βε εντιτλεδ το α ρεφυνδ φορ Γοοδσ ορ Σερϖιχεσ παιδ φορ βυτ νοτ ρεχειϖεδ ορ ιmπλεmεντεδ, συχη ρεφυνδ το βε παιδ ωιτηιν 30 Dαψσ οφ ωριττεν νοτιχε το τηε Χοντραχτορ ρεθυεστινγ τηε ρεφυνδ.
6. ΧΟΝΤΡΑΧΤ ΧΑΝΧΕΛΛΑΤΙΟΝ:
(α) Τηε Στατε ρεσερϖεσ τηε ριγητ το χανχελ τηισ Χοντραχτ ιν ωηολε ορ ιν παρτ ωιτηουτ πεναλτψ, ανδ ωιτηουτ πριορ νοτιχε, ιφ τηε Χοντραχτορ:
Φιλεσ α πετιτιον ιν βανκρυπτχψ, βεχοmεσ ινσολϖεντ, ορ οτηερωισε τακεσ αχτιον το δισσολϖε ασ α λεγαλ εντιτψ
Μακεσ αν ασσιγνmεντ φορ τηε βενεφιτ οφ χρεδιτορσ
Φαιλσ το mαινταιν ανδ κεεπ ιν φορχε αλλ ρεθυιρεδ ινσυρανχε, περmιτσ ανδ λιχενσεσ ασ προϖιδεδ ιν τηισ Χοντραχτ;
Φαιλσ το mαινταιν τηε χονφιδεντιαλιτψ οφ τηε Στατεíσ ινφορmατιον τηατ ισ χονσιδερεδ το βε Χονφιδεντιαλ Ινφορmατιον, ορ
Περφορmσ ιν α mαννερ τηατ τηρεατενσ τηε ηεαλτη ορ σαφετψ οφ α Στατε εmπλοψεε, χιτιζεν, ορ χυστοmερ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 225
#15..
- 556 -
4 (β) Τηε Στατε ρεσερϖεσ τηε ριγητ το χανχελ τηισ Χοντραχτ ιν ωηολε ορ ιν παρτ ωιτηουτ πεναλτψ, ωιτη 30 δαψσí νοτιχε, ιφ τηε Χοντραχτορ:
Φαιλσ το φολλοω τηε σαλεσ ανδ υσε ταξ χερτιφιχατιον ρεθυιρεmεντσ οφ σ. 77.66 οφ τηε Wισχονσιν Στατυτεσ;
Ινχυρσ α δελινθυεντ Wισχονσιν ταξ λιαβιλιτψ;
Φαιλσ το συβmιτ α νον−δισχριmινατιον ορ αφφιρmατιϖε αχτιον πλαν ασ ρεθυιρεδ ηερειν. Φαιλσ το φολλοω τηε νον−δισχριmινατιον ορ αφφιρmατιϖε αχτιον ρεθυιρεmεντσ οφ συβχη.
ΙΙ, Χηαπτερ 111 οφ τηε Wισχονσιν Στατυτεσ (Wισχονσινíσ Φαιρ Εmπλοψmεντ Λαω); ορ Βεχοmεσ α στατε ορ φεδεραλλψ δεβαρρεδ χοντραχτορ.
7. ΠΟΣΤ ΧΟΝΤΡΑΧΤ ΟΒΛΙΓΑΤΙΟΝΣ. Υπον τηε τερmινατιον οφ τηισ Χοντραχτ φορ ανψ ρεασον, ορ υπον Χοντραχτ εξπιρατιον, εαχη παρτψ σηαλλ βε ρελεασεδ φροm αλλ οβλιγατιονσ το τηε οτηερ παρτψ αρισινγ αφτερ τηε δατε οφ τερmινατιον ορ εξπιρατιον, εξχεπτ φορ τηοσε τηατ βψ τηειρ τερmσ συρϖιϖε συχη τερmινατιον ορ εξπιρατιον.
8. ΧΟΝΤΡΑΧΤΟΡ ΧΟΜΠΛΙΑΝΧΕ ΑΝD ΡΕΣΠΟΝΣΙΒΙΛΙΤΨ ΦΟΡ ΑΧΤΙΟΝΣ. Τηε Χοντραχτορ σηαλλ ατ αλλ τιmεσ χοmπλψ ωιτη ανδ οβσερϖε αλλ φεδεραλ, στατε, ανδ λοχαλ λαωσ, ορδινανχεσ, ανδ ρεγυλατιονσ τηατ αρε ιν εφφεχτ δυρινγ τηε τερm οφ τηισ Χοντραχτ τηατ mαψ αφφεχτ τηε Χοντραχτορíσ ωορκ ορ οβλιγατιονσ ηερευνδερ.
Τηε Χοντραχτορ σηαλλ βε σολελψ ρεσπονσιβλε φορ ιτσ αχτιονσ ανδ τηοσε οφ ιτσ αγεντσ, εmπλοψεεσ, ορ Συβχοντραχτορσ. Νειτηερ τηε Χοντραχτορ νορ ανψ οφ τηε φορεγοινγ παρτιεσ ηασ αυτηοριτψ το αχτ ορ σπεακ ον βεηαλφ οφ τηε Στατε.
9. DΕΛΑΨ ΑΝD ΡΕΜΕDΨ. Ιφ τηε Χοντραχτορ φαιλσ το ρεmεδψ ανψ δελαψ ορ οτηερ προβλεm ιν ιτσ περφορmανχε οφ ιτσ Χοντραχτ οβλιγατιονσ αφτερ ρεχειϖινγ ρεασοναβλε νοτιχε φροm τηε Στατε το δο σο, τηε Χοντραχτορ σηαλλ ρειmβυρσε τηε Στατε φορ αλλ ρεασοναβλε χοστσ ινχυρρεδ ασ α διρεχτ χονσεθυενχε οφ τηε Χοντραχτορíσ δελαψ, αχτιον, ορ ιναχτιον. Ιν χασε οφ φαιλυρε το δελιϖερ Γοοδσ ορ Σερϖιχεσ ιν αχχορδανχε ωιτη τηισ Χοντραχτ, τηε Στατε, υπον ωριττεν νοτιχε το τηε Χοντραχτορ, mαψ προχυρε συχη Γοοδσ ορ Σερϖιχεσ φροm οτηερ σουρχεσ ασ νεχεσσαρψ, ανδ τηε Χοντραχτορ σηαλλ βε ρεσπονσιβλε φορ τηε αδδιτιοναλ χοστ, ινχλυδινγ τηε χοστ οφ ρε−προχυρεmεντ, πυρχηασε πριχε ανδ αδmινιστρατιϖε φεεσ. Τηισ ρεmεδψ σηαλλ βε ιν αδδιτιον το ανψ οτηερ λεγαλ ρεmεδιεσ αϖαιλαβλε το τηε Στατε
10. WΟΡΚ ΧΕΝΤΕΡ ΧΡΙΤΕΡΙΑ. Τηε Χοντραχτορ σηαλλ ιmπλεmεντ προχεσσεσ τηατ αλλοω Αγενχιεσ το σατισφψ τηε Στατε∋σ οβλιγατιον το πυρχηασε γοοδσ ανδ σερϖιχεσ προδυχεδ βψ Wορκ Χεντερσ χερτιφιεδ υνδερ τηε Στατεíσ Wορκ Χεντερ Λαω, ♣16.752, Wισ. Στατ. Τηε Χοντραχτορ σηαλλ ινχλυδε γοοδσ προϖιδεδ βψ Wορκ Χεντερσ ιν ιτσ χαταλογ φορ Αγενχιεσ ανδ βλοχκ τηε σαλε οφ χοmπαραβλε ιτεmσ το Αγενχιεσ.
11. ΝΟΝ−ΑΠΠΡΟΠΡΙΑΤΙΟΝ. Τηε Στατε ρεσερϖεσ τηε ριγητ το χανχελ τηισ Χοντραχτ ιν ωηολε ορ ιν παρτ ωιτηουτ πεναλτψ ιφ τηε Λεγισλατυρε φαιλσ το αππροπριατε φυνδσ νεχεσσαρψ το χοmπλετε τηε Χοντραχτ.
12. ΧΟΝΤΡΑΧΤΟΡíΣ ΙΝΣΥΡΑΝΧΕ ΡΕΣΠΟΝΣΙΒΙΛΙΤΨ. Τηε Χοντραχτορ σηαλλ mαινταιν τηε φολλοωινγ ινσυρανχε χοϖεραγε:
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 226
#15..
- 557 -
5 Wορκερ∋σ χοmπενσατιον ινσυρανχε, ασ ρεθυιρεδ υνδερ Χηαπτερ 102 οφ τηε Wισχονσιν Στατυτεσ, φορ αλλ οφ τηε Χοντραχτορíσ εmπλοψεεσ ανδ Χοντραχτεδ Περσοννελ ενγαγεδ ιν τηε ωορκ περφορmεδ υνδερ τηισ Χοντραχτ;
Χοmmερχιαλ λιαβιλιτψ, βοδιλψ ινϕυρψ ανδ προπερτψ δαmαγε ινσυρανχε αγαινστ ανψ χλαιm(σ) τηατ mαψ οχχυρ ιν χαρρψινγ ουτ τηε τερmσ οφ τηισ Χοντραχτ, ωιτη α mινιmυm χοϖεραγε οφ ονε mιλλιον δολλαρσ (∃1,000,000) λιαβιλιτψ φορ βοδιλψ ινϕυρψ ανδ προπερτψ δαmαγε ινχλυδινγ προδυχτσ λιαβιλιτψ ανδ χοmπλετεδ οπερατιονσ; ανδ Μοτορ ϖεηιχλε ινσυρανχε φορ αλλ οωνεδ, νον−οωνεδ ανδ ηιρεδ ϖεηιχλεσ τηατ αρε υσεδ ιν χαρρψινγ ουτ τηε τερmσ οφ τηισ Χοντραχτ, ωιτη α mινιmυm χοϖεραγε οφ ονε mιλλιον δολλαρσ (∃1,000,000) περ οχχυρρενχε χοmβινεδ σινγλε λιmιτ φορ αυτοmοβιλε λιαβιλιτψ ανδ προπερτψ δαmαγε.
Χερτιφιχατε οφ Ινσυρανχε, σηοωινγ υπ−το−δατε χοϖεραγε, σηαλλ βε ον φιλε ιν τηε Χοντραχτινγ Αγενχψ βεφορε τηε Χοντραχτ mαψ χοmmενχε.
Τηε Στατε ρεσερϖεσ τηε ριγητ το ρεθυιρε ηιγηερ ορ λοωερ ινσυρανχε λιmιτσ ωηερε ωαρραντεδ.
13. ΝΟΝDΙΣΧΡΙΜΙΝΑΤΙΟΝ ΑΝD ΑΦΦΙΡΜΑΤΙςΕ ΑΧΤΙΟΝ. Τηε Χοντραχτορ σηαλλ νοτ δισχριmινατε αγαινστ ανψ εmπλοψεε ορ αππλιχαντ φορ εmπλοψmεντ βεχαυσε οφ αγε, ραχε, ρελιγιον, χολορ, ηανδιχαπ, σεξ, πηψσιχαλ χονδιτιον, νατιοναλ οριγιν, δεϖελοπmενταλ δισαβιλιτψ ασ δεφινεδ ιν ♣
51.01(5), Wισ. Στατσ., ορ σεξυαλ οριεντατιον ασ δεφινεδ ιν ♣ 111.32(13m), Wισ. Στατσ. Τηισ προϖισιον σηαλλ ινχλυδε, βυτ ισ νοτ λιmιτεδ το, εmπλοψmεντ, υπγραδινγ, δεmοτιον ορ τρανσφερ; ρεχρυιτmεντ ορ ρεχρυιτmεντ αδϖερτισινγ; λαψοφφ ορ τερmινατιον; ρατεσ οφ παψ ορ οτηερ φορmσ οφ χοmπενσατιον; ανδ σελεχτιον φορ τραινινγ, ινχλυδινγ αππρεντιχεσηιπ. Εξχεπτ ωιτη ρεσπεχτ το σεξυαλ οριεντατιον, τηε Χοντραχτορ σηαλλ τακε αφφιρmατιϖε αχτιον το ενσυρε εθυαλ εmπλοψmεντ οππορτυνιτιεσ.
Υνλεσσ εξεmπτεδ βψ ωορκφορχε σιζε (50 ορ φεωερ εmπλοψεεσ) ορ Χοντραχτ αmουντ (∃50,000 ορ λεσσ), τηε Χοντραχτορ mυστ συβmιτ α ωριττεν αφφιρmατιϖε αχτιον πλαν το τηε Στατε.
Τηε Χοντραχτορ σηαλλ ποστ τηε νοτιχε προϖιδεδ βψ τηε Στατε, σεττινγ φορτη τηε προϖισιονσ οφ τηε Στατε∋σ νονδισχριmινατιον λαωσ, ιν ιτσ ωορκπλαχε, ωεβσιτε ορ χονσπιχυουσ πλαχεσ ιν ορδερ τηατ τηε Χοντραχτορíσ εmπλοψεεσ ανδ αππλιχαντσ φορ εmπλοψmεντ αρε αβλε το ρεαδ ιτ.
Φαιλυρε το χοmπλψ ωιτη τηε χονδιτιονσ οφ τηισ προϖισιον mαψ ρεσυλτ ιν τηε φολλοωινγ χονσεθυενχεσ:
τερmινατιον οφ τηισ Χοντραχτ ασ προϖιδεδ ιν Σεχτιον 6, Χοντραχτ Χανχελλατιον ηερειν, δεσιγνατιον οφ τηε Χοντραχτορ ασ ∀ινελιγιβλε∀ φορ φυτυρε χονσιδερατιον ασ α ρεσπονσιβλε, θυαλιφιεδ βιδδερ ορ προποσερ φορ Στατε χοντραχτσ, ορ ωιτηηολδινγ οφ α παψmεντ δυε υνδερ τηε Χοντραχτ υντιλ τηε Χοντραχτορ ισ ιν χοmπλιανχε
14. ΣΤΑΤΕ ΠΑΨΜΕΝΤ ΟΦΦΣΕΤΣ ΦΟΡ ΧΟΝΤΡΑΧΤΟΡíΣ DΕΛΙΝΘΥΕΝΧΨ. Τηε Στατε σηαλλ οφφσετ παψmεντσ mαδε το τηε Χοντραχτορ υνδερ τηισ Χοντραχτ ιν αν αmουντ νεχεσσαρψ το σατισφψ α χερτιφιεδ ορ ϖεριφιαβλε δελινθυεντ παψmεντ οωεδ το τηε Στατε ορ ανψ στατε ορ λοχαλ υνιτ οφ γοϖερνmεντ. Τηε Στατε αλσο ρεσερϖεσ τηε ριγητ το χανχελ τηισ Χοντραχτ ασ προϖιδεδ ιν Σεχτιον 6, Χοντραχτ Χανχελλατιον, ιφ τηε δελινθυενχψ ισ νοτ σατισφιεδ βψ τηε οφφσετ ορ οτηερ mεανσ δυρινγ τηε τερm οφ τηε Χοντραχτ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 227
#15..
- 558 -
6 15. ΧΟΝΤΡΑΧΤΟΡ ΙΝDΕΜΝΙΦΙΧΑΤΙΟΝ. Χοντραχτορ σηαλλ ηολδ τηε Στατε ηαρmλεσσ ανδ σηαλλ δεφενδ ανδ ινδεmνιφψ τηε Στατε, ιτσ Αγενχιεσ, οφφιχερσ ανδ εmπλοψεεσ αγαινστ ανψ ανδ αλλ χλαιmσ, συιτσ, αχτιονσ, λιαβιλιτιεσ ανδ χοστσ οφ ανψ κινδ, ινχλυδινγ αττορνεψ∋σ φεεσ, φορ περσοναλ ινϕυρψ ορ δαmαγε το προπερτψ αρισινγ φροm τηε αχτσ ορ οmισσιονσ οφ τηε Χοντραχτορ, ιτσ αγεντσ, οφφιχερσ, εmπλοψεεσ ορ Συβχοντραχτορσ.
16. ΧΟΝΦΙDΕΝΤΙΑΛ ΙΝΦΟΡΜΑΤΙΟΝ.
(α) Dισχλοσυρεσ
Ιν χοννεχτιον ωιτη τηε περφορmανχε οφ ωορκ ηερευνδερ, ιτ mαψ βε νεχεσσαρψ φορ τηε Στατε το δισχλοσε το τηε Χοντραχτορ Χονφιδεντιαλ Ινφορmατιον. Τηε Χοντραχτορ σηαλλ νοτ υσε συχη ινφορmατιον φορ ανψ πυρποσε οτηερ τηαν τηε λιmιτεδ πυρποσεσ σετ φορτη ιν τηισ Χοντραχτ, ανδ αλλ ρελατεδ ανδ νεχεσσαρψ αχτιονσ τακεν ιν φυλφιλλmεντ οφ τηε οβλιγατιονσ τηερευνδερ. Τηε Χοντραχτορ σηαλλ ηολδ αλλ συχη ινφορmατιον ιν χονφιδενχε, ανδ σηαλλ νοτ δισχλοσε συχη ινφορmατιον το ανψ περσονσ οτηερ τηαν ιτσ διρεχτορσ, οφφιχερσ, εmπλοψεεσ, ανδ αγεντσ ωηο ηαϖε α βυσινεσσ−ρελατεδ νεεδ το ηαϖε αχχεσσ το συχη ινφορmατιον ιν φυρτηερανχε οφ τηε λιmιτεδ πυρποσεσ οφ τηισ Χοντραχτ ανδ ωηο ηαϖε βεεν αππρισεδ οφ, ανδ αγρεε το mαινταιν, τηε χονφιδεντιαλ νατυρε οφ συχη ινφορmατιον ιν αχχορδανχε ωιτη τηε τερmσ οφ τηισ Χοντραχτ.
Χοντραχτορ σηαλλ ινστιτυτε ανδ mαινταιν συχη σεχυριτψ προχεδυρεσ ασ αρε χοmmερχιαλλψ ρεασοναβλε το mαινταιν τηε χονφιδεντιαλιτψ οφ συχη ινφορmατιον ωηιλε ιν ιτσ ποσσεσσιον ορ χοντρολ ινχλυδινγ τρανσπορτατιον, ωηετηερ πηψσιχαλλψ ορ ελεχτρονιχαλλψ. Ιφ Χοντραχτορ βεχοmεσ αωαρε οφ α δατα σεχυριτψ βρεαχη, ιτ σηαλλ νοτιφψ τηε Στατε ιmmεδιατελψ ανδ χοοπερατε ωιτη τηε Στατε ρεγαρδινγ ρεχοϖερψ, ρεmεδιατιον, ανδ τηε νεχεσσιτψ το ινϖολϖε λαω ενφορχεmεντ, ιφ ανψ.
Χοντραχτορ σηαλλ ενσυρε τηατ αλλ ινδιχατιονσ οφ χονφιδεντιαλιτψ χονταινεδ ον ορ ινχλυδεδ ιν ανψ ιτεm οφ συχη ινφορmατιον σηαλλ βε ρεπροδυχεδ βψ Χοντραχτορ ον ανψ ρεπροδυχτιον, mοδιφιχατιον, ορ τρανσλατιον οφ συχη Χονφιδεντιαλ Ινφορmατιον. Ιφ ρεθυεστεδ βψ τηε Στατε, Χοντραχτορ σηαλλ mακε α ρεασοναβλε εφφορτ το αδδ α προπριεταρψ νοτιχε ορ ινδιχατιον οφ χονφιδεντιαλιτψ το ανψ τανγιβλε mατεριαλσ ωιτηιν ιτσ ποσσεσσιον τηατ χονταιν συχη ινφορmατιον οφ τηε Στατε, ασ διρεχτεδ.
Τηε Χοντραχτορ σηαλλ mαινταιν αλλ συχη ινφορmατιον φορ α περιοδ οφ τηρεε (3) ψεαρσ φροm τηε δατε οφ τερmινατιον οφ τηισ Χοντραχτ, ανδ σηαλλ τηερεαφτερ ρετυρν ορ δεστροψ σαιδ ινφορmατιον ασ διρεχτεδ βψ τηε Στατε.
(β) Εθυιταβλε Ρελιεφ; Ινδεmνιφιχατιον ιν Εϖεντ οφ Χοντραχτορ Βρεαχη Ινδεmνιφιχατιον: Ιν τηε εϖεντ οφ α βρεαχη οφ τηισ Σεχτιον βψ Χοντραχτορ, Χοντραχτορ σηαλλ ινδεmνιφψ, δεφενδ ανδ ηολδ ηαρmλεσσ τηε Στατε οφ Wισχονσιν ανδ ανψ οφ ιτσ οφφιχερσ, εmπλοψεεσ, ορ αγεντσ φροm ανψ χλαιmσ αρισινγ φροm τηε αχτσ ορ οmισσιονσ οφ τηε Χοντραχτορ, ανδ ιτσ Συβχοντραχτορσ, εmπλοψεεσ ανδ αγεντσ, ινχλυδινγ βυτ νοτ λιmιτεδ το δισαλλοωανχεσ ορ πεναλτιεσ φροm φεδεραλ οϖερσιγητ αγενχιεσ, ανδ ανψ χουρτ χοστσ, εξπενσεσ, ανδ ρεασοναβλε αττορνεψ φεεσ, ινχυρρεδ βψ τηε Στατε ιν τηε ενφορχεmεντ οφ τηισ Σεχτιον ανδ, ωιτη ρεσπεχτ το Περσοναλλψ Ιδεντιφιαβλε Ινφορmατιον, τηε χοστσ οφ mονιτορινγ τηε χρεδιτ οφ αλλ περσονσ ωηοσε Περσοναλλψ Ιδεντιφιαβλε Ινφορmατιον ωασ δισχλοσεδ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 228
#15..
- 559 -
7 Εθυιταβλε Ρελιεφ: Τηε Χοντραχτορ αχκνοωλεδγεσ ανδ αγρεεσ τηατ τηε υναυτηοριζεδ υσε, δισχλοσυρε, ορ λοσσ οφ Χονφιδεντιαλ Ινφορmατιον mαψ χαυσε ιmmεδιατε ανδ ιρρεπαραβλε ινϕυρψ το τηε ινδιϖιδυαλσ ωηοσε ινφορmατιον ισ δισχλοσεδ ανδ το τηε Στατε, ωηιχη ινϕυρψ ωιλλ νοτ βε χοmπενσαβλε βψ mονεψ δαmαγεσ ανδ φορ ωηιχη τηερε ισ νοτ αν αδεθυατε ρεmεδψ αϖαιλαβλε ατ λαω. Αχχορδινγλψ, τηε παρτιεσ σπεχιφιχαλλψ αγρεε τηατ τηε Στατε, ον ιτσ οων βεηαλφ ορ ον βεηαλφ οφ τηε αφφεχτεδ ινδιϖιδυαλσ, mαψ σεεκ ινϕυνχτιϖε ορ οτηερ εθυιταβλε ρελιεφ το πρεϖεντ ορ χυρταιλ ανψ συχη βρεαχη, τηρεατενεδ ορ αχτυαλ, ωιτηουτ ποστινγ σεχυριτψ ανδ ωιτηουτ πρεϕυδιχε το συχη οτηερ ριγητσ ασ mαψ βε αϖαιλαβλε υνδερ τηισ Χοντραχτ ορ υνδερ αππλιχαβλε λαω.
17. ΙΝΤΕΛΛΕΧΤΥΑΛ ΠΡΟΠΕΡΤΨ ΙΝΦΡΙΝΓΕΜΕΝΤ ΑΝD ΛΑΒΟΡ ΣΤΑΝDΑΡDΣ. Τηε Χοντραχτορ γυαραντεεσ τηατ ανψ ιτεmσ προϖιδεδ το τηε Στατε ηερευνδερ ωερε mανυφαχτυρεδ ορ προδυχεδ ιν αχχορδανχε ωιτη αππλιχαβλε στατε ανδ φεδεραλ λαβορ λαωσ, ανδ τηατ τηε σαλε ορ υσε οφ σαιδ ιτεmσ σηαλλ νοτ ινφρινγε ανψ Υνιτεδ Στατεσ πατεντ, χοπψριγητ, ορ οτηερ ιντελλεχτυαλ προπερτψ ριγητσ οφ οτηερσ. Τηε Χοντραχτορ σηαλλ ατ ιτσ οων εξπενσε ινδεmνιφψ, δεφενδ ανδ ηολδ τηε Στατε ηαρmλεσσ φροm ανψ χλαιmσ βρουγητ αγαινστ τηε Στατε φορ ανψ αλλεγεδ πατεντ, χοπψριγητ ορ οτηερ ιντελλεχτυαλ προπερτψ ριγητ ινφρινγεmεντ δυε το τηε σαλε ορ υσε οφ συχη ιτεmσ, προϖιδεδ τηατ τηε Χοντραχτορ ισ προmπτλψ νοτιφιεδ οφ συχη συιτ, ανδ ισ γιϖεν αλλ ρελατεδ δοχυmεντσ. Τηε Χοντραχτορ σηαλλ παψ αλλ χοστσ, δαmαγεσ, ανδ προφιτσ ρεχοϖεραβλε ιν ανψ συχη ινφρινγεmεντ λαωσυιτ.
18. ΣΗΙΠΠΙΝΓ. Εξχεπτ ασ οτηερωισε σπεχιφιεδ ηερειν, Γοοδσ σηαλλ βε σηιππεδ, Φ.Ο.Β. Dεστινατιον, ανδ τηε Στατε σηαλλ αχχεπτ λεγαλ τιτλε οφ Γοοδσ ατ τηε ποιντ οφ δελιϖερψ. Φρειγητ χηαργεσ σηαλλ νοτ βε παιδ βψ τηε Στατε, βυτ ρατηερ σηαλλ βε πρεπαιδ βψ τηε Χοντραχτορ. Υνλεσσ οτηερωισε σπεχιφιεδ, τηε Χοντραχτορ σηαλλ δετερmινε τηε mοδε οφ φρειγητ ανδ σηαλλ αχχεπτ ρεσπονσιβιλιτψ φορ παψmεντ οφ φρειγητ χηαργεσ ανδ προχεσσινγ οφ φρειγητ χλαιmσ.
19. ΡΙΣΚ ΟΦ ΛΟΣΣ. Τηε Χοντραχτορ σηαλλ βεαρ αλλ ρισκσ οφ λοσσ, ινϕυρψ ορ δεστρυχτιον οφ τηε Γοοδσ ορδερεδ ηερειν τηατ οχχυρ πριορ το δελιϖερψ. Συχη λοσσ, ινϕυρψ ορ δεστρυχτιον σηαλλ νοτ ρελεασε τηε Χοντραχτορ φροm ανψ οβλιγατιον ηερευνδερ.
20. ΙDΕΝΤΙΦΙΧΑΤΙΟΝ. Αλλ ινϖοιχεσ, παχκινγ λιστσ, παχκαγεσ, σηιππινγ νοτιχεσ, ινστρυχτιον mανυαλσ, ανδ οτηερ ωριττεν δοχυmεντσ αφφεχτινγ αν ορδερ ηερευνδερ σηαλλ χονταιν τηε αππλιχαβλε Στατε Πυρχηασε Ορδερ νυmβερ. Παχκινγ λιστσ σηαλλ βε ενχλοσεδ ιν εαχη ανδ εϖερψ βοξ ορ παχκαγε σηιππεδ πυρσυαντ το αν ορδερ, ινδιχατινγ τηε χοντεντσ τηερειν. Στανδαρδ χοmmερχιαλ παχκαγινγ, παχκινγ ανδ σηιππινγ χονταινερσ σηαλλ βε υσεδ. Ιφ ρεθυεστεδ βψ τηε Στατε, αλλ σηιππινγ χονταινερσ σηαλλ βε λεγιβλψ mαρκεδ ορ λαβελεδ ον τηε ουτσιδε ωιτη Στατε Πυρχηασε Ορδερ νυmβερ, προδυχτ δεσχριπτιον, ανδ θυαντιτψ, ορ ασ οτηερωισε διρεχτεδ βψ τηε Στατε.
21. ΛΙΕΝΣ, ΧΛΑΙΜΣ ΑΝD ΕΝΧΥΜΒΡΑΝΧΕΣ. Τηε Χοντραχτορ ωαρραντσ ανδ ρεπρεσεντσ τηατ αλλ Γοοδσ ορδερεδ ηερευνδερ αρε φρεε ανδ χλεαρ οφ αλλ λιενσ, χλαιmσ ορ ενχυmβρανχεσ οφ ανψ κινδ.
22. WΑΡΡΑΝΤΨ ΟΦ ΙΤΕΜΣ ΟΦΦΕΡΕD. Γοοδσ δελιϖερεδ ανδ Σερϖιχεσ ρενδερεδ σηαλλ βε στριχτλψ ιν αχχορδανχε ωιτη τηε ορδερ πλαχεδ ανδ mαψ νοτ δεϖιατε ιν ανψ ωαψ φροm τηε τερmσ, χονδιτιονσ ορ σπεχιφιχατιονσ οφ τηισ Χοντραχτ, ωιτηουτ τηε πριορ ωριττεν αππροϖαλ οφ τηε Στατε.
Εθυιπmεντ, mατεριαλσ, ορ συππλιεσ δελιϖερεδ υνδερ τηισ Χοντραχτ αρε συβϕεχτ το Ινσπεχτιον ανδ τεστινγ υπον ρεχειπτ.
Τηε Χοντραχτορ ωαρραντσ τηατ τηε Γοοδσ προϖιδεδ σηαλλ χονφορm το τηε σπεχιφιχατιονσ ιν τηισ Χοντραχτ, αρε φιτ ανδ συφφιχιεντ φορ τηε πυρποσε mανυφαχτυρεδ, οφ γοοδ mατεριαλ ανδ ωορκmανσηιπ, ανδ φρεε φροm δεφεχτ. Γοοδσ οφφερεδ mυστ βε νεω ανδ υνυσεδ ανδ οφ τηε λατεστ mοδελ ορ mανυφαχτυρε, υνλεσσ οτηερωισε σπεχιφιεδ βψ τηε Στατε. Ιτεmσ σηαλλ βε εθυαλ ιν State of Utah Bid CH16012
3/22/2016 4:23 PM p. 229
#15..
- 560 -
8 θυαλιτψ ανδ περφορmανχε το τηε στανδαρδσ ινδιχατεδ ηερειν. Γοοδσ δελιϖερεδ τηατ δο νοτ χονφορm το τηε Χοντραχτ τερmσ, χονδιτιονσ, ανδ σπεχιφιχατιονσ mαψ βε ρεϕεχτεδ ανδ ρετυρνεδ ατ τηε Χοντραχτορíσ εξπενσε. Τηε Χοντραχτορ σηαλλ ασσιγν το τηε Στατε ιτσ ριγητ το ρεχοϖερ υνδερ ανψ ωαρραντιεσ αππλιχαβλε το τηε Γοοδσ οφφερεδ. Dεσχριπτιονσ υσεδ ηερειν αρε σπεχιφιεδ σολελψ φορ τηε πυρποσε οφ ινδιχατινγ στανδαρδσ οφ θυαλιτψ, περφορmανχε, ανδ/ορ υσε δεσιρεδ.
23. ΡΕΧΕΙΠΤ ΟΦ ΓΟΟDΣ. Τηε Στατε∋σ ρεχειπτ οφ Γοοδσ υπον δελιϖερψ ισ φορ τηε σολε πυρποσε οφ ιδεντιφιχατιον. Συχη ιδεντιφιχατιον σηαλλ νοτ βε χονστρυεδ ασ Αχχεπτανχε οφ τηε Γοοδσ ιφ τηεψ δο νοτ χονφορm το χοντραχτυαλ ρεθυιρεmεντσ. Ιφ τηερε αρε ανψ αππαρεντ δεφεχτσ ιν τηε Γοοδσ ατ τηε τιmε οφ δελιϖερψ, τηε Στατε σηαλλ προmπτλψ νοτιφψ τηε Χοντραχτορ οφ ιτσ ρεϕεχτιον οφ σαιδ Γοοδσ. Wιτηουτ λιmιτινγ ανψ οτηερ ριγητσ, τηε Στατε, ατ ιτσ οπτιον, mαψ ρεθυιρε τηε Χοντραχτορ το:
α. Ρεπαιρ ορ ρεπλαχε ανψ ορ αλλ οφ τηε δεφεχτιϖε ανδ ρεϕεχτεδ Γοοδσ ατ Χοντραχτορ∋σ εξπενσε,
β. Ρεφυνδ τηε πριχε οφ ανψ ορ αλλ οφ τηε δεφεχτιϖε ανδ ρεϕεχτεδ Γοοδσ, ανδ χ. Αχχεπτ τηε ρετυρν οφ ανψ ορ αλλ οφ τηε δεφεχτιϖε ανδ ρεϕεχτεδ Γοοδσ.
Ιφ ρεϕεχτεδ, τηε Γοοδσ σηαλλ ρεmαιν τηε προπερτψ οφ τηε Χοντραχτορ.
24. ΙΝDΕΠΕΝDΕΝΤ ΧΟΝΤΡΑΧΤΟΡ. Τηε Χοντραχτορ σηαλλ αχτ ασ αν ινδεπενδεντ χοντραχτορ ιν προϖιδινγ ανψ ανδ αλλ Γοοδσ ανδ Σερϖιχεσ υνδερ τηισ Χοντραχτ ανδ, εξχεπτ ασ οτηερωισε ουτλινεδ ηερειν, σηαλλ mαινταιν χοmπλετε χοντρολ οϖερ ιτσ εmπλοψεεσ, Χοντραχτεδ Περσοννελ, ανδ Συβχοντραχτορσ, ιφ ανψ.
25. ΣΤΑΤΕ ΕΜΠΛΟΨΕΕΣ. Τηε Χοντραχτορ mαψ νοτ χοντραχτ ωιτη ορ εmπλοψ α Στατε εmπλοψεε ορ αν ινδιϖιδυαλ ρεταινεδ ασ α φυλλ−τιmε χοντραχτορ βψ τηε Στατε δυρινγ τηε τερm οφ τηισ Χοντραχτ.
26. ΑΝΤΙΤΡΥΣΤ ΑΣΣΙΓΝΜΕΝΤ. Βψ εντερινγ ιντο τηισ Χοντραχτ, τηε Χοντραχτορ χονϖεψσ, σελλσ, ασσιγνσ ανδ τρανσφερσ το τηε Στατε αλλ ριγητσ, τιτλε ανδ ιντερεστ ιν ανδ το αλλ χαυσεσ οφ αχτιον, χλαιmσ ανδ δεmανδσ οφ ωηατεϖερ νατυρε ιτ mαψ νοω ηαϖε ορ ηερεαφτερ αχθυιρε υνδερ τηε αντιτρυστ λαωσ οφ τηε Υνιτεδ Στατεσ ανδ τηε Στατε, ρελατινγ σπεχιφιχαλλψ το τηατ προπορτιονατε αmουντ οφ τηε παρτιχυλαρ Γοοδσ ορ Σερϖιχεσ πυρχηασεδ ορ αχθυιρεδ βψ τηε Στατε υνδερ τηισ Χοντραχτ.
27. ΡΕΦΥΝD ΟΦ ΧΡΕDΙΤΣ. Wιτηιν σιξτψ (60) Dαψσ οφ τηε Στατεíσ ρεθυεστ, τηε Χοντραχτορ σηαλλ παψ το τηε Στατε ανψ χρεδιτσ ρεσυλτινγ φροm αν ορδερ τηατ τηε Στατε δετερmινεσ χαννοτ βε αππλιεδ το φυτυρε ινϖοιχεσ.
28. ΟWΝΕΡΣΗΙΠ ΡΙΓΗΤΣ. Υνλεσσ αν οωνερσηιπ ιντερεστ ισ γραντεδ ορ ρεσερϖεδ ιν τηισ Χοντραχτ, α Στατε Πυρχηασε Ορδερ ισσυεδ υνδερ τηισ Χοντραχτ σηαλλ αλλοω τηε Στατε υνρεστριχτεδ αυτηοριτψ το ρεπροδυχε, διστριβυτε, ανδ υσε ανψ συβmιττεδ ρεπορτ, δατα, ορ mατεριαλ, ανδ ανψ σοφτωαρε ορ mοδιφιχατιονσ ανδ ανψ ασσοχιατεδ δοχυmεντατιον τηατ ισ δεσιγνεδ ορ δεϖελοπεδ ανδ δελιϖερεδ το τηε Στατε ασ παρτ οφ τηε περφορmανχε οφ τηε Χοντραχτ.
29. ΠΡΟΜΠΤ ΠΑΨΜΕΝΤ. Τηε Στατε σηαλλ παψ τηε Χοντραχτορ Προπερλψ−συβmιττεδ Ινϖοιχεσ ωιτηιν τηιρτψ (30) Dαψσ οφ ρεχειπτ, προϖιδεδ τηατ τηε Γοοδσ ορ Σερϖιχεσ το βε προϖιδεδ το τηε Στατε ηαϖε βεεν δελιϖερεδ, ρενδερεδ, ορ ινσταλλεδ, ανδ αχχεπτεδ ασ σπεχιφιεδ ιν τηε σολιχιτατιον δοχυmεντ ορ τηισ Χοντραχτ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 230
#15..
- 561 -
9 Ιφ τηε Στατε φαιλσ το παψ α Προπερλψ−συβmιττεδ Ινϖοιχε ωιτηιν τηιρτψ (30) Dαψσ οφ ρεχειπτ, ιτ σηαλλ παψ α λατε παψmεντ πεναλτψ ασ προϖιδεδ ιν ♣16.528, Wισ. Στατσ. Ηοωεϖερ, ιφ τηε Στατε δεχλαρεσ α γοοδ φαιτη δισπυτε ιν ρεγαρδ το αν ινϖοιχε πυρσυαντ το ♣ 16.528 (3)(ε), Wισ. Στατσ., ιτ mαψ παψ ανψ υνδισπυτεδ πορτιον οφ σαιδ ινϖοιχε, ανδ ωιλλ βε εξεmπτ φροm τηε προmπτ παψmεντ ρεθυιρεmεντ φορ τηε δισπυτεδ πορτιον.
30. ΣΤΑΤΕ ΤΑΞ ΕΞΕΜΠΤΙΟΝ. Τηε Στατε ισ εξεmπτ φροm παψmεντ οφ Wισχονσιν σαλεσ ορ υσε ταξ ον αλλ πυρχηασεσ.
31. ΠΡΟΜΟΤΙΟΝΑΛ ΑDςΕΡΤΙΣΙΝΓ ΑΝD ΝΕWΣ ΡΕΛΕΑΣΕΣ. Ρεφερενχε το ορ υσε οφ τηε Στατε οφ Wισχονσιν, τηε Γρεατ Σεαλ οφ τηε Στατε, τηε Wισχονσιν Χοατ οφ Αρmσ, ανψ Αγενχψ ορ οτηερ συβυνιτσ οφ τηε Στατε γοϖερνmεντ, ορ ανψ Στατε οφφιχιαλ ορ εmπλοψεε, φορ χοmmερχιαλ προmοτιον ισ στριχτλψ προηιβιτεδ. Νεωσ ρελεασεσ ορ ρελεασε οφ βροαδχαστ ε−mαιλσ περταινινγ το τηισ Χοντραχτ σηαλλ νοτ βε mαδε ωιτηουτ πριορ ωριττεν αππροϖαλ οφ τηε Στατε.
32. ΝΟΤΙΧΕ ΑΝD ΧΗΑΝΓΕ ΟΦ ΧΟΝΤΑΧΤ ΙΝΦΟΡΜΑΤΙΟΝ. Ανψ νοτιχε ρεθυιρεδ ορ περmιττεδ το βε γιϖεν ηερευνδερ σηαλλ βε δεεmεδ το ηαϖε βεεν γιϖεν ον τηε δατε οφ δελιϖερψ ορ τηρεε (3) Βυσινεσσ Dαψσ αφτερ mαιλινγ βψ ποσταλ σερϖιχε, χερτιφιεδ ορ ρεγιστερεδ mαιλ−ρεχειπτ ρεθυεστεδ.
Ιν τηε εϖεντ τηε Χοντραχτορ mοϖεσ ορ υπδατεσ χονταχτ ινφορmατιον, τηε Χοντραχτορ σηαλλ ινφορm τηε Στατε οφ συχη χηανγεσ ιν ωριτινγ ωιτηιν τεν (10) Βυσινεσσ Dαψσ. Τηε Στατε σηαλλ νοτ βε ηελδ ρεσπονσιβλε φορ παψmεντσ ον Πυρχηασε Ορδερσ δελαψεδ δυε το τηε Χοντραχτορíσ φαιλυρε το προϖιδε συχη νοτιχε
33. ΡΕΧΟΡDΣ, ΡΕΧΟΡDΚΕΕΠΙΝΓ ΑΝD ΡΕΧΟΡD ΡΕΤΕΝΤΙΟΝ. Πυρσυαντ το ♣19.36 (3) οφ τηε Wισχονσιν Στατυτεσ, αλλ ρεχορδσ οφ τηε Χοντραχτορ τηατ αρε προδυχεδ ορ χολλεχτεδ υνδερ τηισ Χοντραχτ αρε συβϕεχτ το δισχλοσυρε πυρσυαντ το α πυβλιχ ρεχορδσ ρεθυεστ. Τηε Χοντραχτορ σηαλλ εσταβλιση ανδ mαινταιν αδεθυατε ρεχορδσ οφ αλλ δοχυmεντατιον δεϖελοπεδ ορ χοmπιλεδ ανδ εξπενδιτυρεσ ινχυρρεδ υνδερ τηισ Χοντραχτ. Αλλ εξπενδιτυρε ρεχορδσ σηαλλ βε κεπτ ιν αχχορδανχε ωιτη Γενεραλλψ Αχχεπτεδ Αχχουντινγ Προχεδυρεσ (ΓΑΑΠ). Αλλ προχεδυρεσ σηαλλ βε ιν αχχορδανχε ωιτη φεδεραλ, στατε ανδ λοχαλ λαωσ ορ ορδινανχεσ. Τηε Χοντραχτορ, φολλοωινγ φιναλ παψmεντ, σηαλλ ρεταιν αλλ ρεχορδσ προδυχεδ ορ χολλεχτεδ υνδερ τηισ Χοντραχτ φορ τηρεε (3) ψεαρσ.
34. ΕΞΑΜΙΝΑΤΙΟΝ ΟΦ ΡΕΧΟΡDΣ. Τηε Στατε σηαλλ ατ ανψ τιmε δυρινγ νορmαλ βυσινεσσ ηουρσ, υπον ρεασοναβλε νοτιχε, ηαϖε αχχεσσ το ανδ τηε ριγητ το εξαmινε, αυδιτ, εξχερπτ, τρανσχριβε, ανδ χοπψ, ον Χοντραχτορ∋σ πρεmισεσ, ανψ οφ τηε Χοντραχτορíσ ρεχορδσ ανδ χοmπυτερ δατα στοραγε mεδια ινϖολϖινγ τρανσαχτιονσ διρεχτλψ περτινεντ το τηισ Χοντραχτ. Ιφ τηε mατεριαλ ισ ον χοmπυτερ δατα στοραγε mεδια, τηε Χοντραχτορ σηαλλ προϖιδε χοπιεσ οφ τηε δατα στοραγε mεδια ορ α χοmπυτερ πριντουτ οφ συχη ιφ τηε Στατε σο ρεθυεστσ. Ανψ χηαργεσ φορ χοπιεσ οφ βοοκσ, δοχυmεντσ, παπερσ, ρεχορδσ, χοmπυτερ δατα στοραγε mεδια ορ χοmπυτερ πριντουτσ προϖιδεδ βψ τηε Χοντραχτορ σηαλλ νοτ εξχεεδ τηε αχτυαλ χοστ το τηε Χοντραχτορ. Τηισ προϖισιον σηαλλ συρϖιϖε τηε τερmινατιον, χανχελλατιον, ορ εξπιρατιον οφ τηισ Χοντραχτ.
35. ΒΡΕΑΧΗ ΝΟΤ WΑΙςΕΡ. Α φαιλυρε το εξερχισε ανψ ριγητ, ορ α δελαψ ιν εξερχισινγ ανψ ριγητ, ποωερ ορ ρεmεδψ ηερευνδερ ον τηε παρτ οφ ειτηερ παρτψ σηαλλ νοτ οπερατε ασ α ωαιϖερ τηερεοφ. Ανψ εξπρεσσ ωαιϖερ σηαλλ βε ιν ωριτινγ ανδ σηαλλ νοτ αφφεχτ ανψ εϖεντ ορ Dεφαυλτ οτηερ τηαν τηε εϖεντ ορ Dεφαυλτ σπεχιφιεδ ιν συχη ωαιϖερ. Α ωαιϖερ οφ ανψ χοϖεναντ, τερm ορ χονδιτιον χονταινεδ ηερειν σηαλλ νοτ βε χονστρυεδ ασ α ωαιϖερ οφ ανψ συβσεθυεντ βρεαχη οφ τηε σαmε χοϖεναντ, τερm ορ χονδιτιον. Τηε mακινγ οφ ανψ παψmεντ το τηε Χοντραχτορ υνδερ State of Utah Bid CH16012
3/22/2016 4:23 PM p. 231
#15..
- 562 -
10 τηισ Χοντραχτ σηαλλ νοτ χονστιτυτε α ωαιϖερ οφ Dεφαυλτ, εϖιδενχε οφ προπερ Χοντραχτορ περφορmανχε, ορ Αχχεπτανχε οφ ανψ δεφεχτιϖε ιτεm ορ ωορκ φυρνισηεδ βψ τηε Χοντραχτορ.
36. ΑΣΣΙΓΝΜΕΝΤ ΟΦ ΧΟΝΤΡΑΧΤ. Τηε Χοντραχτορ σηαλλ προϖιδε πριορ ωριττεν νοτιχε το τηε Στατε βεφορε ασσιγνινγ τηισ Χοντραχτ το ανοτηερ παρτψ. Τηε Στατε ρεσερϖεσ τηε ριγητ το ωιτηηολδ αππροϖαλ οφ ανψ συχη ασσιγνmεντ. Τηε τερmσ ανδ χονδιτιονσ οφ τηισ Χοντραχτ ασ ωελλ ασ ανψ ριγητσ οβλιγατιονσ ανδ λιαβιλιτιεσ ασσοχιατεδ ωιτη συχη σηαλλ συρϖιϖε ανψ ανδ αλλ ασσιγνmεντσ, mεργερσ, ορ αχθυισιτιονσ βψ α τηιρδ παρτψ υντιλ χανχελλεδ ιν ωριτινγ βψ βοτη παρτιεσ.
37. ΣΕςΕΡΑΒΙΛΙΤΨ. Ιφ ανψ προϖισιον οφ τηισ Χοντραχτ ισ φουνδ βψ α χουρτ οφ χοmπετεντ ϕυρισδιχτιον το βε ινϖαλιδ ορ υνενφορχεαβλε, τηε ρεmαινδερ οφ τηε Χοντραχτ σηαλλ ρεmαιν ϖαλιδ ανδ ιν φυλλ φορχε ανδ εφφεχτ. Τηε ινϖαλιδ προϖισιον σηαλλ βε ρεπλαχεδ βψ α ϖαλιδ προϖισιον τηατ χοmεσ χλοσεστ ιν ιντεντ το τηε ινϖαλιδ προϖισιον.
38. ΧΟΝΤΡΑΧΤ DΙΣΠΥΤΕ ΡΕΣΟΛΥΤΙΟΝ. Ιν τηε εϖεντ οφ ανψ δισπυτε ορ δισαγρεεmεντ βετωεεν τηε παρτιεσ υνδερ τηισ Χοντραχτ, ωηετηερ ωιτη ρεσπεχτ το τηε ιντερπρετατιον οφ ανψ προϖισιον οφ τηισ Χοντραχτ, ορ ωιτη ρεσπεχτ το τηε περφορmανχε οφ ειτηερ παρτψ ηερετο, εαχη παρτψ σηαλλ απποιντ α ρεπρεσεντατιϖε το mεετ φορ τηε πυρποσε οφ ενδεαϖορινγ το ρεσολϖε συχη δισπυτε ορ νεγοτιατε φορ αν αδϕυστmεντ το συχη προϖισιον. Νο λεγαλ αχτιον οφ ανψ κινδ, εξχεπτ φορ τηε σεεκινγ οφ εθυιταβλε ρελιεφ ιν τηε χασε οφ τηε πυβλιχíσ ηεαλτη, σαφετψ ορ ωελφαρε, mαψ βεγιν ιν ρεγαρδ το τηε δισπυτε υντιλ τηισ δισπυτε ρεσολυτιον προχεδυρε ηασ βεεν ελεϖατεδ το τηε Χοντραχτορíσ ηιγηεστ εξεχυτιϖε αυτηοριτψ ανδ τηε εθυιϖαλεντ εξεχυτιϖε αυτηοριτψ ωιτηιν τηε Χοντραχτινγ Αγενχψ, ανδ ειτηερ οφ τηε ρεπρεσεντατιϖεσ ιν γοοδ φαιτη χονχλυδεσ, αφτερ α γοοδ φαιτη αττεmπτ το ρεσολϖε τηε δισπυτε, τηατ αmιχαβλε ρεσολυτιον τηρουγη χοντινυεδ νεγοτιατιον οφ τηε mαττερ ατ ισσυε δοεσ νοτ αππεαρ λικελψ.
39. ΝΟ ΓΥΑΡΑΝΤΕΕ ΟΦ ΘΥΑΝΤΙΤΨ. Τηε Στατε mαψ οβταιν ρελατεδ Γοοδσ ανδ Σερϖιχεσ φροm οτηερ σουρχεσ δυρινγ τηε τερm οφ τηισ Χοντραχτ. Τηε Στατε mακεσ νο εξπρεσσ ορ ιmπλιεδ ωαρραντιεσ ωηατσοεϖερ τηατ ανψ παρτιχυλαρ θυαντιτψ ορ δολλαρ αmουντ οφ Γοοδσ ορ Σερϖιχεσ ωιλλ βε προχυρεδ τηρουγη τηισ Χοντραχτ.
40. ΤΕΡΜΙΝΑΤΙΟΝ ΟΦ ΠΥΡΧΗΑΣΕ ΟΡDΕΡ. Τηε Στατε mαψ τερmινατε α σπεχιφιχ Πυρχηασε Ορδερ ισσυεδ υνδερ τηισ Χοντραχτ ιφ ιτ δετερmινεσ τηατ τηε Χοντραχτορ ισ υναβλε το δελιϖερ τηε Γοοδσ ρεθυιρεδ ιν α τιmελψ mαννερ, ιν ορδερ το mεετ τηε βυσινεσσ νεεδσ οφ τηε Στατε.
41. ΦΟΡΧΕ ΜΑϑΕΥΡΕ. Νειτηερ παρτψ σηαλλ βε ιν δεφαυλτ βψ ρεασον οφ ανψ φαιλυρε ιν περφορmανχε οφ τηισ Χοντραχτ ιν αχχορδανχε ωιτη ρεασοναβλε χοντρολ ανδ ωιτηουτ φαυλτ ορ νεγλιγενχε ον τηειρ παρτ. Συχη χαυσεσ mαψ ινχλυδε, βυτ αρε νοτ ρεστριχτεδ το, αχτσ οφ νατυρε ορ τηε πυβλιχ ενεmψ, αχτσ οφ τηε γοϖερνmεντ ιν ειτηερ ιτσ σοϖερειγν ορ χοντραχτυαλ χαπαχιτψ, φιρεσ, φλοοδσ, επιδεmιχσ, θυαραντινε ρεστριχτιονσ, στρικεσ, φρειγητ εmβαργοεσ ανδ υνυσυαλλψ σεϖερε ωεατηερ, βυτ ιν εϖερψ χασε τηε φαιλυρε το περφορm συχη mυστ βε βεψονδ τηε ρεασοναβλε χοντρολ ανδ ωιτηουτ τηε φαυλτ ορ νεγλιγενχε οφ τηε παρτψ.
42. ΤΙΜΕ ΙΣ ΟΦ ΤΗΕ ΕΣΣΕΝΧΕ. Τιmελψ προϖισιον οφ τηε Γοοδσ ορ Σερϖιχεσ ρεθυιρεδ υνδερ τηισ Χοντραχτ σηαλλ βε οφ τηε εσσενχε οφ τηε Χοντραχτ, ινχλυδινγ τηε προϖισιον οφ τηε Γοοδσ ορ Σερϖιχεσ ωιτηιν τηε τιmε αγρεεδ ορ ον α δατε σπεχιφιεδ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 232
#15..
- 563 -
11 43. ΝΟ ΑΓΕΝΧΨ ΡΕΛΑΤΙΟΝΣΗΙΠ. Τηε Χοντραχτορ σηαλλ νοτ τακε ανψ αχτιον, ορ mακε ανψ οmισσιον, τηατ mαψ ιmπλψ, ορ χαυσε οτηερσ ρεασοναβλψ το ινφερ τηατ τηε Χοντραχτορ ισ αχτινγ ασ τηε Στατεíσ αγεντ ιν ανψ mαττερ ορ ιν ανψ ωαψ νοτ εξπρεσσλψ αυτηοριζεδ βψ τηισ Χοντραχτ.
44. DΙΣΧΛΟΣΥΡΕ. Ιφ α στατε πυβλιχ οφφιχιαλ (ασ δεφινεδ ιν ♣19.42 (14) οφ τηε Wισχονσιν Στατυτεσ) ορ αν οργανιζατιον ιν ωηιχη α στατε πυβλιχ οφφιχιαλ ηολδσ ατ λεαστ α 10% ιντερεστ ισ ορ βεχοmεσ α παρτψ το τηισ Αγρεεmεντ, ιτ σηαλλ βε ϖοιδαβλε βψ τηε Στατε υνλεσσ αππροπριατε δισχλοσυρε ισ mαδε το τηε Στατε οφ Wισχονσιν Γοϖερνmεντ Αχχουνταβιλιτψ Βοαρδ, 212 Εαστ Wασηινγτον Αϖενυε, Μαδισον, Wισχονσιν 53703 (Τελεπηονε 608−266−8005).
45. ΟΤΗΕΡ DΟΧΥΜΕΝΤΣ. Τηε παρτιεσ το τηισ Χοντραχτ υνδερστανδ ανδ αγρεε τηατ στανδαρδ φορmσ ορ τεmπλατεσ mαψ βε υσεδ φορ ϖαριουσ πυρποσεσ, ινχλυδινγ βυτ νοτ λιmιτεδ το, πυρχηασε ορδερσ, ινϖοιχεσ, θυοτεσ, ëWεβσιτε Τερmσ ανδ/ορ Χονδιτιονσí ορ ëχλιχκ το αχχεπτí αγρεεmεντ(σ), σοmε οφ ωηιχη mαψ χονταιν βοιλερπλατε ορ στανδαρδ τερmσ ανδ χονδιτιονσ (ìΟτηερ Dοχυmεντσî). Ηοωεϖερ, ανψ υσε οφ Οτηερ Dοχυmεντσ αρε νοτ α παρτ οφ τηισ Χοντραχτ ανδ αρε δεεmεδ το βε φορ αδmινιστρατιϖε χονϖενιενχε ονλψ ανδ τηε τερmσ τηερειν αρε οφ νο εφφεχτ, ηαϖε νο φορχε οφ λαω ανδ δο νοτ mοδιφψ τηε τερmσ οφ τηισ Χοντραχτ.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 233
#15..
- 564 -
1 ATTACHMENT A: STATE OF UTAH STANDARD INFORMATION TECHNOLOGY TERMS AND CONDITIONS
STATE OF UTAH COOPERATIVE INFORMATION TECHNOLOGY CONTRACT This is a State Cooperative Contract for information technology products and services meaning all computerized and auxiliary automated information handling, including: (a) systems design and analysis; (b) acquisition, storage, and conversion of data; (c) computer programming; (d) information storage and retrieval; (e) voice, radio, video, and data communications; (f) requisite systems controls; (g) simulation; and (h) all related interactions between people and machines.
1. DEFINITIONS:
a. “Access to Secure Public Facilities, Data, and Technology” means Contractor will (A) enter upon secure premises controlled, held, leased, or occupied by the State of Utah or an Eligible User; (B) maintain, develop, or have access to any deployed hardware, software, firmware, or any other technology, that is in use by the State of Utah or an Eligible User; or (C) have access to or receive any Public Data or Confidential Information during the course of performing this Contract. b. “Authorized Persons” means the Contractor’s employees, officers, partners, Subcontractors or other agents of Contractor who need to access Public Data to enable the Contractor to perform its responsibilities under this Contract. c. “Confidential Information” means information that is deemed as confidential under applicable record laws. The State of Utah and the Eligible Users reserves the right to identify, during and after this Contract, additional reasonable types of categories of information that must be kept confidential under federal and state laws by Contractor. d. “Contract” means the Contract Signature Page(s), including all referenced attachments and documents incorporated by reference. This Contract may include any purchase orders that result from the parties entering into this Contract. e. “Contract Signature Page(s)” means the cover page that Division and Contractor sign. f. “Contractor” means the individual or entity delivering the Goods, Custom Deliverables, or performing the Services identified in this Contract. The term “Contractor” shall include Contractor’s agents, officers, employees, partners, and/or any other person or entity for which Contractor may be liable under federal, state, or local laws. g. “Custom Deliverable” means the Work Product that Contractor is required to deliver to Eligible Users under this Contract. h. “Data Breach” means the unauthorized access by a non-authorized person(s) which results in unauthorized acquisition of Public Data and compromises the security, confidentiality, or integrity of Public Data. It is within an Eligible User’s sole discretion to determine whether the unauthorized access is a Security Incident or a Data Breach. i. “Division” means the State of Utah Division of Purchasing. j. “DTS” means the Department of Technology Services.
k. “Eligible User(s)” means the State of Utah’s government departments, institutions, agencies, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), and, as applicable, nonprofit organizations, agencies of the federal government, or any other entity authorized by the laws of the State of Utah to participate in State Cooperative Contracts will be allowed to use this Contract.
l. “Federal Criminal Background Check” means an in depth background check conducted and processed by the FBI that covers all states. Federal Criminal Background Check reports will show if applicant has had any criminal cases filed against them that violated federal criminal law.
m. “Good” means any deliverable not classified as a Custom Deliverable or Service that Contractor is required to deliver to the Eligible Users under this Contract.
n. “Non-Public Data” means data, other than personal data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the State of Utah and the federal government because it contains information that is exempt by state, federal and local statutes, ordinances, or administrative rules from access by the general public as public information.
o. “Personal Data” means data that includes information relating to a person that identifies the person by a person’s first name or first initial and last name and has any of the following personally identifiable information (PII): government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information; including account number, credit or debit card numbers; or protected health information (PHI) relating to a person. p. “Proposal” means Contractor’s response documents, including attachments, to the Division’s Solicitation. q. “Protected Health Information” (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. r. “Security Incident” means the potentially unauthorized access by non-authorized persons to Public Data that Contractor believes could reasonably result in the use, disclosure or theft of Public Data within the possession or control of the Contractor. A Security Incident may or may not turn into a Data Breach. It is within an Eligible User’s sole discretion to determine whether the unauthorized access is a Security Incident or a Data Breach.
Utah
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 234
#15..
- 565 -
2 s. “Services” means the furnishing of labor, time, or effort by Contractor as set forth in this Contract, including but not limited to installation, configuration, implementation, technical support, warranty maintenance, and other support services. t. “Solicitation” means the documents used by the Division to solicit Contractor’s Proposal for the Goods, Custom Deliverables, or Services identified in this Contract.
u. “Public Data” means all Confidential Information, Non-Public Data, Personal Data, and Protected Health Information that is created or in any way originating with the State of Utah or an Eligible User whether such data or output is stored on the State of Utah’s or an Eligible User’s hardware, Contractor’s hardware, or exists in any system owned, maintained or otherwise controlled by the State of Utah, an Eligible User, or by Contractor. Public Data includes any federal data, that the State of Utah or an Eligible User controls or maintains, that is protected under federal laws, statutes, and regulations. v. “State of Utah” means the State of Utah, in its entirety, including its institutions, agencies, departments, divisions, authorities, instrumentalities, boards, commissions, elected or appointed officers, employees, agents, and authorized volunteers. w. “Subcontractors” means subcontractors or subconsultants, at any tier, that are under the direct or indirect control or responsibility of Contractor, and includes all independent contractors, agents, employees, or anyone else for whom the Contractor may be liable, at any tier, including a person or entity that is, or will be, providing or performing an essential aspect of this Contract, including Contractor’s manufacturers, distributors, and suppliers. x. “Work Product” means every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor or Contractor’s Subcontractors (either alone or with others) pursuant to this Contract. Work Product shall be considered a work made for hire under federal, state, and local laws; and all interest and title shall be transferred to and owned by the ordering Eligible User. Notwithstanding anything in the immediately preceding sentence to the contrary, Work Product does not include any Eligible User intellectual property, Contractor’s intellectual property (that it owned or licensed prior to this Contract) or Third Party intellectual property.
2. CONTRACT JURISDICTION, CHOICE OF LAW, AND VENUE: This Contract shall be governed by the laws, rules, and regulations of the State of Utah. Any action or proceeding arising from this Contract shall be brought in a court of competent jurisdiction in the State of Utah. Venue shall be in Salt Lake City, in the Third Judicial District Court for Salt Lake County.
3. LAWS AND REGULATIONS: At all times during this Contract, Contractor and all the Goods delivered under this Contract will comply with all applicable federal and state constitutions, laws, rules, codes, orders, and regulations, including applicable licensure and certification requirements.
4. NO WAIVER OF SOVEREIGN IMMUNITY: In no event shall this Contract be considered a waiver by the Division, an Eligible User, or the State of Utah of any form of defense or immunity, whether sovereign immunity, governmental immunity, or any other immunity based on the Eleventh Amendment to the Constitution of the United States or otherwise, from any claim or from the jurisdiction of any court.
5. RECORDS ADMINISTRATION: Contractor shall maintain or supervise the maintenance of all records necessary to properly account for Contractor’s performance and the payments made by an Eligible User to Contractor under this Contract. These records shall be retained by Contractor for at least six (6) years after final payment, or until all audits initiated within the six (6) years have been completed, whichever is later. Contractor agrees to allow, at no additional cost, State of Utah and federal auditors, and the Division access to all such records.
6. CERTIFY REGISTRATION AND USE OF EMPLOYMENT "STATUS VERIFICATION SYSTEM”: This Status Verification System, also referred to as “E-verify”, requirement only applies to contracts issued through a Request for Proposal process and to sole sources that are included within a Request for Proposal. (1) Contractor certifies as to its own entity, under penalty of perjury, that Contractor has registered and is participating in the Status Verification System to verify the work eligibility status of Contractor’s new employees that are employed in the State of Utah in accordance with applicable immigration laws including Section 63G-12-302, Utah Code, as amended. (2) Contractor shall require that the following provision be placed in each subcontract at every tier: “The subcontractor shall certify to the main (prime or general) contractor by affidavit that the subcontractor has verified through the Status Verification System the employment status of each new employee of the respective subcontractor, all in accordance with applicable immigration laws including Section 63G-12-302, Utah Code, as amended, and to comply with all applicable employee status verification laws. Such affidavit must be provided prior to the notice to proceed for the subcontractor to perform the work.” (3) Contractor’s failure to comply with this section will be considered a material breach of this Contract. (4) Contractor shall protect, indemnify, and hold harmless the Division, the Eligible Users, and the State of Utah, and anyone that the State of Utah may be liable for, against any claim, damages, or liability arising out of or resulting from violations of the above Status Verification System Section whether violated by employees, agents, or contractors of the following: (a) Contractor; (b) Subcontractor at any tier; and/or (c) any entity or person for whom the Contractor or Subcontractor may be liable.
7. CONFLICT OF INTEREST: Contractor represents that none of its officers or employees are officers or employees of the State of Utah, unless disclosure has been made to the Division.
8. CONFLICT OF INTEREST WITH STATE EMPLOYEES: Contractor agrees to comply and cooperate in good faith will all conflict of interest and ethic laws.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 235
#15..
- 566 -
3 9. INDEPENDENT CONTRACTOR: Contractor’s legal status is that of an independent contractor, and in no manner shall Contractor be deemed an employee or agent of the Division, the Eligible Users, or the State of Utah, and therefore is not entitled to any of the benefits associated with such employment. Contractor, as an independent contractor, shall have no authorization, express or implied, to bind the Division, the Eligible Users, or the State of Utah to any agreements, settlements, liabilities, or understandings whatsoever, and agrees not to perform any acts as an agent for the Division, the Eligible Users, or the State of Utah. Contractor shall remain responsible for all applicable federal, state, and local taxes, and all FICA contributions.
10. CONTRACTOR ACCESS TO SECURE Public FACILITIES, PUBLIC DATA, AND TECHNOLOGY: An employee of Contractor or a Subcontractor may be required to complete a Federal Criminal Background Check, if said employee of Contractor or a Subcontractor will have Access to Secure Public Facilities, Public Data, and Technology. Contractor shall provide the Eligible User with sufficient personal information (at Contractor’s own expense) so that a Federal Criminal Background Check may be completed by the Eligible User, at the Eligible User’s expense. The Eligible User will also provide Contractor with a Disclosure Form and Confidentiality Agreement which must be filled out by Contractor and returned to the Eligible User. Additionally, each employee of Contractor or a Subcontractor, who will have Access to Secure Public Facilities, Public Data, and Technology, will be scheduled by the Eligible User to be fingerprinted, at a minimum of one week prior to having such access. At the time of fingerprinting, said employee of Contractor or a Subcontractor will disclose, in full, any past record of felony or misdemeanor convictions. The Eligible User is authorized to conduct a Federal Criminal Background Check based upon the fingerprints and personal information provided. The Eligible User may use this same information to complete a Name Check in the Utah Criminal Justice Information System (UCJIS) every two years and reserves the right to revoke Access to Secure State Facilities, Data, and Technology granted in the event of any negative results. Contractor agrees to notify the Eligible User if an arrest or conviction of any employee of Contractor or a Subcontractor that has Access to Secure Public Facilities, Public Data and Technology occurs during this Contract.
Contractor, in executing any duty or exercising any right under this Contract, shall not cause or permit any of its employees or employees of a Subcontractor (if any) who have been convicted of a felony or misdemeanor to have Access to Secure Public Facilities, Public Data, and Technology. A felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred.
11. DRUG-FREE WORKPLACE: Contractor agrees to abide by the Eligible User’s drug-free workplace policies while on the Eligible User’s or the State of Utah’s premises.
12. CODE OF CONDUCT: If Contractor is working at facilities controlled or owned by the State of Utah, Contractor agrees to follow and enforce the applicable code of conduct. Contractor will assure that each employee or each employee of Subcontractor(s) under Contractor’s supervision receives a copy of such code of conduct.
13. INDEMNITY CLAUSE: Contractor shall be fully liable for the actions of its agents, employees, officers, partners, and Subcontractors, and shall fully indemnify, defend, and save harmless the Division, the Eligible Users, and the State of Utah from all claims, losses, suits, actions, damages, and costs of every name and description arising out of Contractor’s performance of this Contract caused by any intentional act or negligence of Contractor, its agents, employees, officers, partners, or Subcontractors, without limitation; provided, however, that the Contractor shall not indemnify for that portion of any claim, loss, or damage arising hereunder due to the sole fault of the Division, the Eligible User, or the State of Utah. The parties agree that if there are any limitations of the Contractor’s liability, including a limitation of liability clause for anyone for whom the Contractor is responsible, such limitations of liability will not apply to injuries to persons, including death, or to damages to property.
14. EMPLOYMENT PRACTICES: Contractor agrees to abide by the following employment laws: (i)Title VI and VII of the Civil Rights Act of 1964 (42 U.S.C. 2000e) which prohibits discrimination against any employee or applicant for employment or any applicant or recipient of services, on the basis of race, religion, color, or national origin; (ii) Executive Order No. 11246, as amended, which prohibits discrimination on the basis of sex; (iii) 45 CFR 90 which prohibits discrimination on the basis of age; (iv) Section 504 of the Rehabilitation Act of 1973, or the Americans with Disabilities Act of 1990 which prohibits discrimination on the basis of disabilities; and (v) Utah's Executive Order, dated December 13, 2006, which prohibits unlawful harassment in the work place.
Contractor further agrees to abide by any other laws, regulations, or orders that prohibit the discrimination of any kind of any of Contractor’s employees.
15. SEVERABILITY: A declaration or order by any court that any provision of this Contract is illegal and void shall not affect the legality and enforceability of any other provision of this Contract, unless the provisions are mutually dependent.
16. AMENDMENTS: This Contract may only be amended by the mutual written agreement of the parties, which amendment will be attached to this Contract. Automatic renewals will not apply to this Contract.
17. DEBARMENT: Contractor certifies that it is not presently nor has ever been debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this Contract, by any governmental department or agency, whether international, national, state, or local. Contractor must notify the Division within thirty (30) days if debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from participation in any contract by any governmental entity during this Contract.
18. TERMINATION: Unless otherwise stated in this Contract, this Contract may be terminated, with cause by either party, in advance of the specified termination date, upon written notice being given by the other party. The party in violation will be given fourteen (14) calendar days after notification to correct and cease the violations, after which this Contract may be terminated for cause at any time. This Contract may also be terminated without cause (for convenience), in advance of the specified expiration date, by either party, upon sixty (60) calendar days prior written notice being given the other party. The parties may also agree to terminate this Contract prior to the expiration of this Contract by written agreement.
If Services apply to this Contract, then Contractor shall be compensated for the Services properly performed under this Contract up to the effective date of the notice of termination. Contractor agrees that in the event of such termination for cause or without cause, Contractor’s sole remedy and monetary recovery from the Division, the Eligible Users, or the State of Utah is limited to full payment State of Utah Bid CH16012
3/22/2016 4:23 PM p. 236
#15..
- 567 -
4 for all work properly performed as authorized under this Contract up to the date of termination as well as any reasonable monies owed as a result of Contractor having to terminate other contracts necessarily and appropriately entered into by Contractor pursuant to this Contract.
19. SUSPENSION OF WORK: Should circumstances arise which would cause the Division to suspend Contractor’s responsibilities under this Contract, but not terminate this Contract, this will be done by formal written notice pursuant to the terms of this Contract.
Contractor’s responsibilities may be reinstated upon advance formal written notice from the Division.
20. NONAPPROPRIATION OF FUNDS, REDUCTION OF FUNDS, OR CHANGES IN LAW: Upon thirty (30) days written notice delivered to the Contractor, this Contract may be terminated in whole or in part at the sole discretion of the Division or an Eligible User, if it is reasonably determined that: (i) a change in Federal or State legislation or applicable laws materially affects the ability of either party to perform under the terms of this Contract; or (ii) that a change in available funds affects an Eligible User’s ability to pay under this Contract. A change of available funds as used in this paragraph, includes, but is not limited to, a change in Federal or State funding, whether as a result of a legislative act or by order of the President or the Governor.
If a written notice is delivered under this section, the Eligible User will reimburse Contractor for the Goods or Services properly ordered until the effective date of said notice. The Eligible User will not be liable for any performance, commitments, penalties, or liquidated damages that accrue after the effective date of said written notice.
21. SALES TAX EXEMPTION: The Goods, Custom Deliverables, or Services being purchased by the Eligible Users under this Contract are being paid from the Eligible User’s funds and used in the exercise of the Eligible User’s essential function as an Eligible User. The Eligible User will provide Contractor with a copy of its sales tax exemption number upon request. It is the Contractor’s responsibility to request the sales tax exemption number from the Eligible User.
22. TITLE AND OWNERSHIP WARRANTY: Contractor warrants, represents and conveys full ownership, clear title free of all liens and encumbrances to any Good or Custom Deliverable delivered to the Eligible Users under this Contract. Contractor fully indemnifies the Eligible Users for any loss, damages or actions arising from a breach of this warranty without limitation.
23. HARDWARE WARRANTY: Contractor agrees to warrant and assume responsibility for all hardware portions of any Good or Custom Deliverable, that it licenses, contracts, or sells under this Contract, for a period of one (1) year. Contractor acknowledges that all warranties granted to the Division and Eligible Users by the Uniform Commercial Code of the State of Utah apply to this Contract. Product liability disclaimers and/or warranty disclaimers from Contractor are not applicable to this Contract. In general, the Contractor warrants that the hardware: (a) will perform as specified in the Proposal; (b) will live up to all specific claims listed in the Proposal; (c) will be suitable for the ordinary purposes for which the hardware is used; (d) will be suitable for any special purposes that the Division has relied on Contractor’s skill or judgment to consider when it advised the Division about the hardware in the Proposal; (e) the hardware has been properly designed and manufactured; and (f) is free of significant defects or unusual problems.
24. SOFTWARE WARRANTY: Contractor warrants that for a period of ninety (90) days from the date of Acceptance that the software portions of the Goods and Custom Deliverables, that Contractor licenses, contracts, or sells to the Eligible Users under this Contract, will: (a) perform in accordance with the specific claims provided in the Proposal; (b) be suitable for the ordinary purposes for which such Goods and Custom Deliverables are used; (c) be suitable for any special purposes that the Eligible User has relied on Contractor’s skill or judgment to consider when it advised the Eligible User about the Goods or Custom Deliverables in its Proposal; (d) have been properly designed and manufactured; and (e) be free of significant defects or unusual problems.
Contractor agrees to provide the Eligible Users with bug fixes, including informing the Eligible Users of any known software bugs or software defects that may affect the Eligible User’s use of the software during the Contract.
25. WARRANTY REMEDIES: Upon breach of the hardware or software warranty, Contractor will repair or replace (at no charge to the Eligible Users) the Goods or Custom Deliverables whose nonconformance is discovered and made known to Contractor. If the repaired and/or replaced products prove to be inadequate, or fail to meet the performance of its essential purpose, Contractor will refund the full amount of any payments that have been made for the failing products. The rights and remedies of the parties under this warranty are in addition to any other rights and remedies of the parties provided by law or equity.
26. UPDATES AND UPGRADES: Contractor grants to the Eligible Users a non-exclusive, non-transferable license to use upgrades and updates provided by Contractor during the term of this Contract. Such upgrades and updates are subject to the terms of this Contract. The Eligible Users shall download, distribute, and install all updates as released by Contractor during this Contract, and Contractor strongly suggests that the Eligible Users also download, distribute, and install all upgrades as released by Contractor during this Contract.
27. BUG FIXING AND REMOTE DIAGNOSTICS: Contractor shall use commercially reasonable efforts to provide work-around solutions or patches to reported software problems. With an Eligible User’s prior written authorization, Contractor may perform remote diagnostics to work on reported problems, subject to Contractor’s obligation of this Contract. In the event that an Eligible User declines remote diagnostics, Contractor and the Eligible User may agree to on-site technical support, subject to the terms of this Contract.
28. TECHNICAL SUPPORT AND MAINTENANCE: If technical support and maintenance is a part of the Goods or Custom Deliverables that Contractor provides under this Contract, Contractor will use commercially reasonable efforts to respond, in a reasonable time, when technical support or maintenance requests regarding the Goods or Custom Deliverables are made to Contractor.
29. SECURE PROTECTION AND HANDLING OF PUBLIC DATA: If Contractor is given Public Data as part of this Contract, the protection of Public Data shall be an integral part of the business activities of Contractor to ensure that there is no inappropriate or unauthorized use of Public Data. To the extent that Contractor is given Public Data, Contractor shall safeguard the confidentiality, integrity and availability of the Public Data and comply with the following conditions:
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 237
#15..
- 568 -
5 1. Network Security: Contractor agrees at all times to maintain network security that - at a minimum - includes: network firewall provisioning, intrusion detection, and regular third party penetration testing. Contractor also agrees to maintain network security that conforms to one of the following:
(1) Those standards the State of Utah applies to its own network, found outlined in DTS Policy 5000-0002 Enterprise Information Security Policy (copy available upon request);
(2) Current standards set forth and maintained by the National Institute of Standards and Technology, includes those at:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf; or (3) Any generally recognized comparable standard that Contractor then applies to its own network and approved by DTS in writing.
2. Public Data Security: Contractor agrees to protect and maintain the security of Public Data with protection that is at least as good as or better than that maintained by the State of Utah. These security measures included but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification).
3. Public Data Transmission: Contractor agrees that any and all transmission or exchange of system application data with the Eligible Users and State of Utah and/or any other parties expressly designated by the State of Utah, shall take place via secure means (ex. HTTPS or FTPS).
4. Public Data Storage: Contractor agrees that all Public Data will be stored and maintained in data centers in the United States.
Contractor agrees that no Public Data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, except for devices that are used and kept only at Contractor’s United States data centers, unless such medium is part of the Contractor's designated backup and recovery process. Contractor shall permit its employees and Subcontractors to access non-Public Data remotely only as required to provide technical support. Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited by this contract.
5. Public Data Encryption: Contractor agrees to store all data provided to Contractor, including State, as part of its designated backup and recovery process in encrypted form, using no less than 128 bit key.
6. Password Protection: Contractor agrees that any portable or laptop computer that has access to the Eligible Users or State of Utah networks, or stores any Public Data is equipped with strong and secure password protection.
7. Public Data Re-Use: Contractor agrees that any and all data exchanged shall be used expressly and solely for the purpose enumerated in this Contract. Contractor further agrees that no Public Data of any kind shall be transmitted, exchanged, or otherwise passed to other Contractors or interested parties except on a case-by-case basis as specifically agreed to in writing by the Eligible Users.
8. Public Data Destruction: The Contractor agrees that upon expiration or termination of this Contract it shall erase, destroy, and render unreadable all Public Data from all non-state computer systems and backups, and certify in writing that these actions have been completed within thirty (30) days of the expiration or termination of this Contract or within seven (7) days of the request of the Eligible User, whichever shall come first, unless the Eligible User provides Contractor with a written directive. It is understood by the parties that the Eligible User’s written directive may request that certain data be preserved in accordance with applicable law.
9. Services Shall Be Performed Within United States: Contractor agrees that all of the Services related to Public Data that it provides to the Eligible Users will be performed by Contractor and Subcontractor(s) within the borders and jurisdiction of the United States.
30. SECURITY INCIDENT OR DATA BREACH NOTIFICATION: Contractor shall immediately inform an Eligible User of any Security Incident or Data Breach.
1. Incident Response: Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement and seeking external expertise as mutually agreed upon, defined by law or contained in this Contract. Discussing Security Incidents with the Eligible User should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes, defined by law or contained in this Contract.
2. Security Incident Reporting Requirements: Contractor shall report a Security Incident to the Eligible User immediately if Contractor reasonably believes there has been a Security Incident.
3. Breach Reporting Requirements: If Contractor has actual knowledge of a confirmed Data Breach that affects the security of any Public Data that is subject to applicable data breach notification law, Contractor shall: (a) promptly notify the Eligible User within 24 hours or sooner, unless shorter time is required by applicable law; (b) take commercially reasonable measures to address the Data Breach in a timely manner; and (c) be responsible for its Data Breach responsibilities, as provided in the next Section.
31. DATA BREACH RESPONSIBILITIES: This Section only applies when a Data Breach occurs. Contractor agrees to comply with all applicable laws that require the notification of individuals in the event of a Data Breach or other events requiring notification in accordance with DTS Policy 5000-0002 Enterprise Information Security Policy (copy available upon request). In the event of a Data Breach or other event requiring notification under applicable law (Utah Code § 13-44-101 thru 301 et al), Contractor shall: (a) cooperate with the Eligible User by sharing information relevant to the Data Breach; (b) promptly implement necessary remedial measures, if necessary; (c) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in relation to the Data Breach; and (d) in accordance with applicable laws indemnify, hold harmless, and defend DTS and the State of Utah against any claims, damages, or other harm State of Utah Bid CH16012
3/22/2016 4:23 PM p. 238
#15..
- 569 -
6 related to such Data Breach. If the Data Breach requires public notification, all communication shall be coordinated with the Eligible User. Contractor shall be responsible for all notification and remedial costs and damages.
32. CHANGE MANAGEMENT: If Contractor develops software for the State of Utah then the following paragraphs apply:
1. Contractor agrees to comply with DTS Policy 4000-0003, Software Development Life Cycle Policy. The Software Development Life Cycle Policy requires any Contractor developing software for the State of Utah to work with DTS in implementing a Software Development Lifecycle (SDLC) that addresses key issues of security, accessibility, mobile device access, and standards compliance. Upon request, the Division agrees to provide Contractor with a copy of the latest version of the Software Development Life Cycle Policy.
2. Contractor agrees to comply with DTS Policy 4000-0004, Change Management Policy. Per the Change Management Policy, any Goods or Custom Deliverables furnished or Services performed by Contractor which have the potential to cause any form of outage or to modify Eligible User’s or the State of Utah’s infrastructure must be reviewed by the DTS Change Management Committee. The Eligible User will notify Contractor if this change control requirement is applicable. Following this notification, any outages or Data Breaches which are a direct result of Contractor’s failure to comply with the Eligible User’s instructions and policies following notification will result in Contractor’s liability for any and all damages resulting from or associated with the outage or Data Breach. Upon request, the Division agrees to provide Contractor with a copy of the latest version of the DTS Change Management Policy 4000-0004.
33. PUBLIC INFORMATION: Contractor agrees that this Contract, any related purchase orders, related invoices, related pricing lists, and the Proposal will be public documents, and may be available for distribution in accordance with the State of Utah’s Government Records Access and Management Act (GRAMA). Contractor gives the Division, the Eligible Users, and the State of Utah express permission to make copies of this Contract, any related purchase orders, related invoices, related pricing lists, and Proposal in accordance with GRAMA. The permission to make copies as noted will take precedence over any statements of confidentiality, proprietary information, copyright information, or similar notation. The Division, the Eligible Users, or the State of Utah will not inform Contractor of any request for a copy of this Contract, including any related purchase orders, related invoices, related pricing lists, or the Proposal.
36. DELIVERY: Unless otherwise specified in this Contract, all deliveries will be F.O.B. destination with all transportation and handling charges paid by Contractor. Contractor is responsible for including any freight charges due by the Eligible User to Contractor when providing quotes to the Eligible User unless otherwise specified in this Contract. Invoices listing freight charges that were not identified in the quote prior to shipment, unless otherwise specified in this Contract, will be returned to the Contractor to remove such costs. Responsibility and liability for loss or damage will remain with Contractor until final inspection and acceptance when responsibility will pass to the Eligible Users except as to latent defects, fraud, and Contractor's warranty obligations.
37. ELECTRONIC DELIVERY: Contractor may electronically deliver any Good or Custom Deliverable to Eligible Users or provide any Good and Custom Deliverable for download from the Internet, if approved in writing by the Eligible Users. Contractor should take all reasonable and necessary steps to ensure that the confidentiality of those electronic deliveries is preserved in the electronic delivery process, and are reminded that failure to do so may constitute a breach of obligations owed to the Eligible Users under this Contract. Contractor warrants that all electronic deliveries will be free of known, within reasonable industry standards, malware, bugs, Trojan horses, etc. Any electronic delivery that includes Public Data that Contractor processes or stores must be delivered within the specifications of this Contract.
38. ACCEPTANCE PERIOD: A Good, Custom Deliverable, or Service furnished under this Contract shall function in accordance with the specifications identified in this Contract and Solicitation. If the Goods and Custom Deliverables delivered do not conform to the specifications identified in this Contract and Solicitation (“Defects”), the Eligible Users shall within thirty (30) calendar days of the delivery date (“Acceptance Period”) to notify Contractor in writing of the Defects. Contractor agrees that upon receiving such notice, it shall use reasonable efforts to correct the Defects within fifteen (15) calendar days (“Cure Period”). The Eligible User’s acceptance of a Good, Custom Deliverable, or Services occurs at the end of the Acceptance Period or Cure Period.
If after the Cure Period, a Good, Custom Deliverable, or Service still has Defects, then the Eligible User may, at its option: (a) declare Contractor to be in breach and terminate this Contract; (b) demand replacement conforming Goods, Custom Deliverables, or Services from Contractor at no additional cost to the Eligible User; or (c) continue the Cure Period for an additional time period agreed upon by the Eligible User and Contractor in writing. Contractor shall pay all costs related to the preparation and shipping of the products returned pursuant to this section. No products shall be accepted and no charges shall be paid until acceptance is met.
The warranty period will begin upon the end of the Acceptance Period.
39. ORDERING AND INVOICING: All orders will be shipped promptly in accordance with the delivery schedule. Contractor will promptly submit invoices (within 30 days of shipment or delivery of services) to the appropriate Eligible User. The contract number shall be listed on all invoices, freight tickets, and correspondence relating to an order under this Contract. The prices paid by the Eligible Users will be those prices listed in this Contract. The Eligible Users have the right to adjust or return any invoice reflecting incorrect pricing.
40. PROMPT PAYMENT DISCOUNT: Contractor may quote a prompt payment discount based upon early payment. Contractor shall list payment discount terms on invoices. The prompt payment discount will apply to payments made with purchasing cards and checks. The date from which discount time is calculated will be the date a correct invoice is received.
41. PAYMENT:
1. Payments will be made within thirty (30) days from a correct invoice is received, whichever is later. After sixty (60) days from the date a correct invoice is received by the appropriate State official, the Contractor may assess interest on overdue, undisputed account charges up to a maximum of the interest rate paid by the IRS on taxpayer refund claims, plus two percent, computed similarly as the requirements of Section 15-6-3, Utah Prompt Payment Act of Utah Code, as amended. The IRS interest rate is adjusted quarterly, and is applied on a per annum basis, on the invoice amount that is overdue.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 239
#15..
- 570 -
7 2. Unless otherwise stated in this Contract, all payments to Contractor will be remitted by mail, by electronic funds transfer, or by the Eligible User’s purchasing card (major credit card). The Division will not allow Contractor to charge electronic payment fees of any kind.
3. The acceptance by Contractor of final payment without a written protest filed with the Eligible User within ten (10) working days of receipt of final payment shall release the Eligible User, the Division, and the State of Utah from all claims and all liability to Contractor for fees and costs pursuant to this Contract.
4. Contractor agrees that if during, or subsequent to the Contract an audit determines that payments were incorrectly reported or paid by the Eligible Users to Contractor, then Contractor shall, upon written request, immediately refund to the Eligible Users any such overpayments.
42. INDEMNIFICATION – INTELLECTUAL PROPERTY: Contractor warrants that any Good, Custom Deliverable, or Service furnished by Contractor under this Contract, including its use by the Eligible Users in unaltered form, will not, to Contractor’s knowledge, infringe any third party copyrights, patents, trade secrets, and/or other proprietary rights that exist on the effective date of this Contract and/or that arise or are enforceable under the law of the United States of America.
Contractor will release, indemnify, and hold the Division, the Eligible Users, and the State of Utah harmless from liability or damages of any kind or nature, including Contractor's use of any copyrighted or un-copyrighted composition, secret process, patented or un-patented invention, article, or appliance furnished or used in Contractor’s performance of this Contract. Additionally, if such a claim or liability is based upon an allegation that a Good, Custom Deliverable, or Service furnished by Contractor infringes on any right protected by any patent, copyright, trademark, trade secret, and/or proprietary right of any third party, Contractor agrees to indemnify and hold harmless the Division, the Eligible Users, and the State of Utah for any judgments, settlements, reasonable costs, and reasonable attorneys’ fees resulting from such a claim or liability. Contractor shall defend all actions brought upon such matters to be indemnified hereunder and pay all costs and expenses incidental thereto; however, the Eligible Users shall have the right, at its option, to participate in the defense of any such action without relieving Contractor of any obligation hereunder. The parties agree that if there are any limitations of liability, including a limitation of liability clause in this Contract, such limitations of liability will not apply to this Section.
43. OWNERSHIP IN INTELLECTUAL PROPERTY: The parties each recognize that each has no right, title, or interest, proprietary or otherwise, in or to the name or any logo, or intellectual property owned or licensed by the other. Each agree that, without prior written consent of the other or as described in this Contract, it shall not use the name, any logo, or intellectual property owned or licensed by the other.
44. OWNERSHIP IN CUSTOM DELIVERABLES: In the event that Contractor provides Custom Deliverables to the Eligible Users, pursuant to this Contract, Contractor grants the ownership in Custom Deliverables, which have been developed and delivered by Contractor exclusively for Eligible Users and are specifically within the framework of fulfilling Contractor’s contractual obligations under this contract. Custom Deliverables shall be deemed work made for hire, such that all intellectual property rights, title and interest in the Custom Deliverables shall pass to the Eligible Users, to the extent that the Custom Deliverables are not recognized as work made for hire, Contractor hereby assigns to the Eligible Users any and all copyrights in and to the Custom Deliverables, subject to the following:
1. Contractor has received payment for the Custom Deliverables,
2. Each party will retain all rights to patents, utility models, mask works, copyrights, trademarks, trade secrets, and any other form of protection afforded by law to inventions, models, designs, technical information, and applications (“Intellectual Property Rights”) that it owned or controlled prior to the effective date of this contract or that it develops or acquires from activities independent of the services performed under this contract (“Background IP”), and
3. Contractor will retain all right, title, and interest in and to all Intellectual Property Rights in or related to the services, or tangible components thereof, including but not limited to (a) all know-how, intellectual property, methodologies, processes, technologies, algorithms, software, or development tools used in performing the Services (collectively, the “Utilities”), and (b) such ideas, concepts, know-how, processes and reusable reports, designs, charts, plans, specifications, documentation, forms, templates, or output which are supplied or otherwise used by or on behalf of Contractor in the course of performing the Services or creating the Custom Deliverables, other than portions that specifically incorporate proprietary or Confidential Information or Custom Deliverables of Eligible Users (collectively, the “Residual IP”), even if embedded in the Custom Deliverables.
4. Custom Deliverables, not including Contractor’s Intellectual Property Rights, Background IP, and Residual IP, may not be marketed or distributed without written approval by the Eligible Users.
Contractor agrees to grant to the Eligible Users a perpetual, irrevocable, royalty-free license to use Contractor’s Background IP, Utilities, and Residual IP, as defined above, solely for the Eligible Users and the State of Utah to use the Custom Deliverables. The Eligible Users reserves a royalty-free, nonexclusive, and irrevocable license to reproduce, publish, or otherwise use and to authorize others to use, for the Eligible User’s internal purposes, such Custom Deliverables. For the Goods delivered that consist of Contractor’s scripts and code and are not considered Custom Deliverables or Work Product, for any reason whatsoever, Contractor grants the Eligible User a non-exclusive, non-transferable, irrevocable, perpetual right to use, copy, and create derivative works from such, without the right to sublicense, for the Eligible User’s internal business operation under this Contract. The Eligible User and the Division may not participate in the transfer or sale of, create derivative works from, or in any way exploit Contractor’s Intellectual Property Rights, in whole or in part.
45. OWNERSHIP, PROTECTION AND USE OF RECORDS: Except for confidential medical records held by direct care providers, the Eligible Users shall own exclusive title to all information gathered, reports developed, and conclusions reached in performance of this Contract. Contractor may not use, except in meeting its obligations under this Contract, information gathered, reports developed, or conclusions reached in performance of this Contract without the express written consent of the Eligible User.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 240
#15..
- 571 -
8 Contractor agrees to maintain the confidentiality of records it holds for the Eligible Users as required by applicable federal, state, or local laws.
46. PROTECTION, AND USE OF CONFIDENTIAL FEDERAL, STATE, OR LOCAL GOVERNMENT INTERNAL BUSINESS PROCESSES AND PROCEDURES: In the event that the Eligible User provides Contractor with confidential federal or state business processes, policies, procedures, or practices, pursuant to this Contract, Contractor agrees to hold such information in confidence, in accordance with applicable laws and industry standards of confidentiality , and not to copy, reproduce, sell, assign, license, market, transfer, or otherwise dispose of, give, or disclose such information to third parties or use such information for any purpose whatsoever other than the performance of this Contract.
47. PROTECTION, AND RETURN OF DOCUMENTS AND DATA UPON CONTRACT TERMINATION OR COMPLETION: All documents and data pertaining to work required by this Contract will be the property of the Eligible Users, and must be delivered to the Eligible Users within thirty (30) working days after termination or expiration of this Contract, regardless of the reason for contract termination, and without restriction or limitation to their future use. The costs for returning documents and data to the Eligible Users are included in this Contract.
48. CONFIDENTIALITY: Confidential Information may be disclosed to the Contractor under the terms of this Contract. If Confidential Information is disclosed to Contractor then Contractor agrees to adhere to the following:
Contractor will: (a) limit disclosure of any Confidential Information to Authorized Persons who have a need to know such Confidential Information in connection with the current or contemplated business relationship between the parties to which this Contract relates, and only for that purpose; (b) advise its Authorized Persons of the proprietary nature of the Confidential Information and of the obligations set forth in this Contract and require such Authorized Persons to keep the Confidential Information confidential; (c) shall keep all Confidential Information strictly confidential by using a reasonable degree of care, but not less than the degree of care used by it in safeguarding its own confidential information; and (d) not disclose any Confidential Information received by it to any third parties, except as otherwise agreed to in writing by the Eligible Users. Contractor will promptly notify the Eligible Users of any misuse or misappropriation of Confidential Information that comes to Contractor’s attention.
Contractor shall be responsible for any breach of this duty of confidentiality contract by any of their officers, agents, subcontractors at any tier, and any of their respective representatives, including any required remedies and/or notifications under applicable law (Utah Code Section 13-44-101 thru 301 et al). Contractor shall indemnify, hold harmless, and defend the Division, the Eligible Users, and State of Utah from claims related to a breach of these confidentiality requirements by Contractor or anyone for whom the Contractor is liable. This duty of confidentiality shall be ongoing and survive the term of this Contract.
49. ASSIGNMENT/SUBCONTRACT: Contractor will not assign, sell, transfer, subcontract or sublet rights, or delegate responsibilities under this Contract, in whole or in part, without the prior written approval of the Division.
50. DEFAULT AND REMEDIES: Any of the following events will constitute cause for the Division to declare Contractor in default of this Contract: (a) nonperformance of contractual requirements or (b) a material breach of any term or condition of this Contract.
The Division will issue a written notice of default providing a fourteen (14) day period in which Contractor will have an opportunity to cure. Time allowed for cure will not diminish or eliminate Contractor's liability for damages. If the default remains, after Contractor has been provided the opportunity to cure, the Division may do one or more of the following: (a) exercise any remedy provided by law; (b) terminate this Contract and any related contracts or portions thereof; (c) impose liquidated damages, if liquidated damages are listed in the contract; (d) suspend Contractor from receiving future solicitations; or (e) request a full refund of the Goods, Custom Deliverables, or Services furnished by Contractor that are defective or Services that were inadequately performed under this Contract.
51. TERMINATION UPON DEFAULT: In the event this Contract is terminated as a result of a default by Contractor, the Division may procure or otherwise obtain, upon such terms and conditions as the Division deems appropriate, Goods, Custom Deliverables, or Services similar to those terminated, and Contractor shall be liable to the Division for any and all cover costs and damages arising therefrom, including attorneys’ fees, excess costs and fees, and cost of cover together with incidental or consequential damages, incurred by the Division in obtaining similar Goods, Custom Deliverables, or Services.
52. FORCE MAJEURE: Neither party to this Contract will be held responsible for delay or default caused by fire, riot, acts of God and/or war which is beyond that party's reasonable control. The Division and the Eligible Users may immediately terminate this Contract after determining such delay will reasonably prevent successful performance of this Contract.
53. PROCUREMENT ETHICS: Contractor understands that a person who is interested in any way in the sale of any supplies, services, products, construction, or insurance to the State of Utah is violating the law if the person gives or offers to give any compensation, gratuity, contribution, loan, or reward, or any promise thereof to any person acting as a procurement officer on behalf of the State of Utah, or who in any official capacity participates in the procurement of such supplies, services, products, construction, or insurance, whether it is given for their own use or for the use or benefit of any other person or organization.
54. WORKERS’ COMPENSATION: Contractor shall maintain during the term of this Contract, workers’ compensation insurance for all its employees as well as any subcontractor employees related to this Contract. Worker’s compensation insurance shall cover full liability under the worker’s compensation laws of the jurisdiction in which the service is performed at the statutory limits required by said jurisdiction. Contractor acknowledges that within thirty (30) days of contract award, Contractor and/or Subcontractors must submit proof of certificate of insurance that meets the above requirements.
55. LIABILITY INSURANCE: Contractor agrees to provide and to maintain during the performance of this Contract, at its sole expense, a policy of general liability insurance. The limits of the policy shall be no less than $1,000,000.00 for each occurrence and $3,000,000.00 aggregate. It shall be the responsibility of Contractor to require any of their Subcontractor(s) to secure the same insurance coverage as prescribed herein for the Contractor.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 241
#15..
- 572 -
9 Contractor must provide proof of insurance to the Division and must add the State of Utah as an additional insured with notice of cancellation. Contractor acknowledges that within thirty (30) days of contract award, Contractor and/or Contractor’s Subcontractors must submit proof of certificate of insurance that meets the above requirements. Failure to provide proof of insurance, as required, could result in this Contract being terminated for cause.
56. CONFLICT OF TERMS: Contractor terms and conditions that apply must be in writing and attached to this Contract. No other terms and conditions will apply to this Contract including terms listed or referenced on a Contractor’s website, terms listed in a Contractor quotation/sales order, purchase orders, etc. In the event of any conflict in the contract terms and conditions, the order of precedence shall be: (a) this Attachment A; (b) Contract Signature Page(s); (c) State of Utah’s Additional Terms and Conditions, if any; and (d) Contractor Terms and Conditions, if any. Attachment A will be given precedence over any provisions including, limitation of liability, indemnification, standard of care, insurance, or warranty, and will not be nullified by or exception created by more specific terms elsewhere in this Contract.
57. ENTIRE AGREEMENT: This Contract shall constitute the entire agreement between the parties, and supersedes any and all other prior and contemporaneous agreements and understandings between the parties, whether oral or written.
58. SURVIVORSHIP: This paragraph defines the specific contractual provisions that will remain in effect after expiration of, the completion of, or termination of this Contract, for whatever reason: (a) Contract Jurisdiction, Choice of Law, and Venue; (b) Secure Protection and Handling of Public Data; (c) Data Breach Responsibilities; (d) Ownership in Custom Deliverables; (e) Ownership, Protection, and Use of Records, including Residuals of such records; and (f) Ownership, Protection, and Use of Confidential Federal, State, or Local Government Internal Business Processes, including Residuals of such confidential business processes; (g) Ownership, Protection, and Return of Documents and Data Upon Contract Termination or Completion; (h) Confidentiality; (i) Conflict of Terms; and (j) any other terms that by their nature would survive the expiration of, completion, or termination of this contract.
59. WAIVER: The waiver by either party of any provision, term, covenant, or condition of this Contract shall not be deemed to be a waiver of any other provision, term, covenant, or condition of this Contract nor any subsequent breach of the same or any other provision, term, covenant, or condition of this Contract.
60. CONTRACT INFORMATION: During the duration of this Contract, the Division of Purchasing is required to make available contact information of Contractor to the State of Utah Department of Workforce Services. The State of Utah Department of Workforce Services may contact Contractor during the duration of this Contract to inquire about Contractor’s job vacancies.
61. COMPLIANCE WITH ACCESSIBILITY STANDARDS: Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973. Contractors must also adhere to Utah Administrative rule R895-14-1-3- 3, which states that vendors developing new websites or applications are required to meet accessibility guidelines subject to rule R895 and correct any items that do not meet these guidelines at no cost to the agency; and Rule R895-14-1-4-2, which states that vendors proposing IT products and services shall provide Voluntary Product Accessibility Template® (VPAT™) documents.
Contractor acknowledges that all Goods and Custom Deliverables that it licenses, contracts, or sells to DTS under this contract are accessible to people with disabilities.
62. RIGHT TO AUDIT: Contractor agrees to, upon written request, permit Division, or a third party designated by the Division, to perform an assessment, audit, examination, or review of all of Contractor’s sites and environments - including physical, technical, and virtual sites and environments - in order to confirm Contractor’s compliance with this Contract; associated Scopes of Work; and applicable laws, regulations, and industry standards. Contractor shall fully cooperate with such assessment by providing access to knowledgeable personnel; physical premises; records; technical and physical infrastructures; and any other person, place, or object which may assist the Division or its designee in completing such assessment. In addition, upon request, Contractor shall provide the Division with the results of any audit performed by or on behalf of Contractor that would assist the Division or its designee in confirming Contractor’s compliance with this Contract; associated Scopes of Work; and applicable laws, regulations, and industry standards.
63. LARGE VOLUME DISCOUNT PRICING: Eligible Users may seek to obtain additional volume discount pricing for large orders provided Contractor is willing to offer additional discounts for large volume orders. No amendment to this Contract is necessary for Contractor to offer discount pricing to an Eligible User for large volume purchases.
64. ELIGIBLE USER PARTICIPATION: Participation under this Contract by Eligible Users is voluntarily determined by each Eligible User. Contractor agrees to supply each Eligible User with Goods based upon the same terms, conditions and prices of this Contract.
65. INDIVIDUAL CUSTOMERS: Each Eligible User that purchases Goods from this Contract will be treated as if they were individual customers. Each Eligible User will be responsible to follow the terms and conditions of this Contract. Contractor agrees that each Eligible User will be responsible for their own charges, fees, and liabilities. Contractor shall apply the charges to each Eligible User individually. The Division is not responsible for any unpaid invoice.
66. QUANTITY ESTIMATES: The Division does not guarantee any purchase amount under this Contract. Estimated quantities are for Solicitation purposes only and are not to be construed as a guarantee.
67. ORDERING: Orders will be placed by the using Eligible User directly with Contractor. All orders will be shipped promptly in accordance with the terms of this Contract.
68. REPORTS AND FEES:
1. Administrative Fee: Contractor agrees to provide a quarterly administrative fee to the State in the form of a Check or EFT payment. The fee will be payable to the “State of Utah Division of Purchasing” and will be sent to State of Utah, Division of Purchasing, 3150 State Office Building, Capitol Hill, PO Box 141061, Salt Lake City, UT 84114. The Administrative Fee will State of Utah Bid CH16012
3/22/2016 4:23 PM p. 242
#15..
- 573 -
10 be the amount listed in the Solicitation and will apply to all purchases (net of any returns, credits, or adjustments) made under this Contract.
2. Quarterly Reports: Contractor agrees to provide a quarterly utilization report, reflecting net sales to the State during the associated fee period. The report will show the quantities and dollar volume of purchases by each agency and political subdivision. The quarterly report will be provided in secure electronic format and/or submitted electronically to the Utah reports email address: [email protected].
3. Report Schedule: Quarterly utilization reports shall be made in accordance with the following schedule:
Period End Reports Due
March 31 April 30
June 30 July 31
September 30 October 31
December 31 January 31
4. Fee Payment: After the Division receives the quarterly utilization report it will send Contractor an invoice for the total quarterly administrative fee owed to the Division. Contractor shall pay the quarterly administrative fee within thirty (30) days from receipt of invoice.
5. Timely Reports and Fees: If the quarterly administrative fee is not paid by thirty (30) days of receipt of invoice or quarterly utilization reports are not received by the report due date, then Contractor will be in material breach of this Contract.
If Services are applicable to this Contract, the following terms and conditions apply to this Contract:
69. TIME IS OF THE ESSENCE: The Services shall be completed by any applicable deadline stated in this Contract. For all Services, time is of the essence.
70. PERFORMANCE EVALUATION: The Division may conduct a performance evaluation of Contractor’s Services, including Contractor’s Subcontractors, if any. Results of any evaluation may be made available to the Contractor upon Contractor’s request.
71. ADDITIONAL INSURANCE REQUIREMENTS:
1. Professional liability insurance in the amount as described in the Solicitation for this Contract, if applicable.
2. Any other insurance policies described or referenced in the Solicitation for this Contract.
3. Any type of insurance or any increase of limits of liability not described in this Contract which the Contractor requires for its own protection or on account of any federal, state, or local statute, rule, or regulation shall be its own responsibility, and shall be provided at Contractor’s own expense.
4. The carrying of insurance required by this Contract shall not be interpreted as relieving the Contractor of any other responsibility or liability under this Contract or any applicable law, statute, rule, regulation, or order. Contractor must provide proof of the above listed policies within thirty (30) days of being awarded this Contract.
72. STANDARD OF CARE: The Services of Contractor and its Subcontractors shall be performed in accordance with the standard of care exercised by licensed members of their respective professions having substantial experience providing similar services which similarities include the type, magnitude, and complexity of the Services that are the subject of this Contract.
73. STATE REVIEWS, LIMITATIONS: The Division reserves the right to perform plan checks, plan reviews, other reviews, and/or comment upon the Services of Contractor.
(Revision Date: 3 August 2015)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 243
#15..
- 574 -
PARTICIPATING ADDENDUM
(hereinafter “Addendum”)
For
NASPO VALUEPOINT Add description of goods & servcies
MASTER AGREEMENT NO. Add contract no.
(hereinafter “Master Agreement”)
Between
Insert Contractor Name
(hereinafter “Contractor”)
and
State of Hawaii
(hereinafter “Participating State”)
State of Hawaii, State Procurement Office (SPO) Price List Contact No. add PL No.
This Addendum will add the State of Hawaii as a Participating State to purchase from the NASPO ValuePoint Master Agreement Number insert contract number with insert contractor name.
1. Scope:
This addendum covers NASPO ValuePoint describe services lead by insert lead State for use by state agencies and other entities located in the Participating State authorized by the state’s statutes to utilize state contracts.
2. Participation:
All jurisdictions located within the State of Hawaii, which have obtained prior written approval by its Chief Procurement Officer, will be allowed to purchase from the Master Agreement. Private nonprofit health or human services organizations with current purchase of service contracts governed by Hawaii Revised Statutes (HRS) chapter 103F are eligible to participate in the SPO price/vendor list contracts upon mutual agreement between the Contractor and the non-profit. (Each such participating jurisdiction and participating nonprofit is hereinafter referred to as a “Participating Entity”). Issues of interpretation and eligibility for participation are solely within the authority of the Administrator, State Procurement Office.
3. Changes: Replace with specific changes or statements that no changes are required A. Usage Reports. Contractor shall submit a quarterly State of Hawaii gross sales report to the Participating State contact person listed in Paragraph 5 (or as amended), below, in accordance with the following schedule (or as required):
Quarter Ending Report Due
March 31 April 30
June 30 July 31
September 30 October 31
December 31 January 31
The quarterly report will be subtotaled by each Purchasing Entity. The quarterly report shall also include any adjustments from prior periods.
Hawaii
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 244
#15..
- 575 -
B. The validity of this Addendum, any of its terms or provisions, as well as the right and duties of the parties in this Addendum, shall be governed by the laws of the State of Hawaii. A copy of the Attorney General’s General Conditions can be found at http://spo.hawaii.gov/wp-content/uploads/2014/02/103D-General-Conditions.pdf.
Any action at law or in equity to enforce or interpret the provisions of this Addendum shall be brought in a court of competent jurisdiction in Honolulu, Hawaii. A view of Hawaii
C. Inspection of Facilities. Pursuant to HRS § 103D-316, the Participating State, at reasonable times, may inspect the part of the plant or place of business of the Contractor or any subcontractor that is related to the performance of a Master Agreement and this Addendum.
D. Campaign Contributions. The Contractor is notified of the applicability of HRS § 11- 355, which prohibits campaign contributions from Contractor during the term of the Addendum if the contractor is paid with funds appropriated by the Hawaii State Legislature.
E. Purchases by State of Hawaii government entities under this Master Agreement is not mandatory. This Addendum is secondary and non-exclusive.
F. The State of Hawaii’s purchasing card (pCard) is required to be used by the States executive departments/agencies (excluding the Department of Education, the Hawaii Health System Corporation, the Office of Hawaiian Affairs, and the University of Hawaii) for all orders totaling less than $2,500. For purchases of $2,500 or more, agencies may use the pCard, subject to its credit limit or issue a purchase order.
Contractor(s) shall forward original invoice(s), directly to the ordering agency.
General excise tax shall not be applied to the delivery charge.
Pursuant to HRS § 103-10, Participating State and any agency of the Participating State or any county, shall have thirty (30) calendar days after receipt of invoice or satisfactory delivery of goods to make payment. Any interest for delinquent payment shall be as allowed by HRS § 103-10.
G. Pursuant to HRS §103D-310(c), if Contractor is doing business in the Participating State, Contractor is required to comply with all laws governing entities doing business in the Participating State, including the following HRS chapters.
1. Chapter 237, General Excise Tax Law;
2. Chapter 383, Hawaii Employment Security Law;
3. Chapter 386, Workers’ Compensation;
4. Chapter 392, Temporary Disability Insurance;
5. Chapter 393, Prepaid Health Care Act; and
6. Certificate of Good Standing for entities doing business in the State.
The Hawaii Compliance Express (HCE) is utilized for verification of compliance.
The SPO will conduct periodic checks to confirm Contractor’s compliance on HCE throughout the term of the Addendum.
H. Effective Date and Contract Period. This Addendum is effective upon the date of execution by the Participating State and shall continue for the term set forth in the Master Agreement.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 245
#15..
- 576 -
4. Lease Agreements:
Leasing is not authorized by this Addendum
5. Primary Contact:
The primary contact individual for this Addendum are as follows (or their named successors:
Participating State
Name: Name of purchasing specialist
Address: State Procurement Office
1151 Punchbowl Street, Room 416
Honolulu, HI 96813
Telephone: phone number
Fax: (808) 586-0570
E-Mail: specialist e-mail address
Contractor
Name:
Address:
Telephone:
Fax:
E-Mail:
6. Subcontractors:
Subcontractors are (or are not) allows under this Addendum.
7. Freight Charges (unless otherwise stated in the master contract):
Prices proposed will be the delivered price to any state agency or political subdivision.
All deliveries will be F.O.B. destination with all transportation and handling charges paid by the Contractor. Responsibility and liability for loss or damage will remain with Contractor until final inspection and acceptance when responsibility will pass to the Buyer except as to latent defects, fraud, and Contractor’s warranty obligations. Any portion of a full order originally shipped without transportation charges (that failed to ship with the original order, thereby becoming back-ordered) will also be shipped without transportation charges.
8. Purchase Order and Payment Instructions:
All purchase orders issued by Participating Entities under this Addendum shall include the Participating State contract number: SPO Price List Contract No. 16-07 and the NASPO ValuePoint Master Agreement Number 06913.
Purchase Orders and Payments shall be made to add contractor name or authorized subcontractors, if any.
9. Participating Entity as Individual Customer:
Each Participating Entity shall be treated as an individual customer. Except to the extent modified by this Addendum, each Participating Entity will be responsible to follow the terms and conditions of the Master Agreement; and will have the same rights and State of Utah Bid CH16012
3/22/2016 4:23 PM p. 246
#15..
- 577 -
responsibilities for their purchases as the Lead State has in the Master Agreement.
Each Participating Entity will be responsible for its own charges, fees, and liabilities.
Each Participating Entity will have the same rights to any indemnity or to recover any costs allowed in the Master Agreement for their purchases. The Contractor will apply the charges to each Participating Entity individually.
10. Entire Contract:
This Addendum and the Master Agreement set forth the entire agreement, and all the conditions, understandings, promises, warranties and representations among the parties with respect to this Addendum and the Master Agreement, and supersedes any prior communications, representations or agreements whether, oral or written, with respect to the subject matter hereof.
Terms and conditions inconsistent with, contrary or in addition to the terms and conditions of this Addendum and the Master Agreement, that are included in any purchase order or otherwise shall be void. The terms and conditions of this Addendum and the Master Agreement shall govern in the case of any such inconsistent, contrary, or IN VIEW OF THE ABOVE, the parties execute this Addendum by their signatures, on the dates below.
Participating State: STATE OF HAWAII Contractor:
Signature: Signature:
Name: SARAH ALLEN Name:
Title: Administrator, SPO Title:
Date: Date:
APPROVED AS TO FORM:
Deputy Attorney General
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 247
#15..
- 578 -
Attachment G – Cost Schedule
_________________________________________________________________________________________________ Solicitation Number CH16012
NASPO ValuePoint Cloud Solutions RFP
Cloud Solutions By Category. Specify Discount Percent % Offered for products in each category. Highest discount will apply for products referenced in detail listings for multiple categories. Provide a detailed product offering for each category.
Software as a Service Discount % ______
Infrastructure as a Service Discount % ______
Platform as a Services Discount % ______
Value Added Services Discount %_______
-------------------------------------------------------------------------------------------------------------------------- Additional Value Added Services:
Maintenance Services
Onsite Hourly Rate $ ____________
Remote Hourly Rate $ ___________
Professional Services
Deployment Services Onsite Hourly Rate $ ____________ Remote Hourly Rate $ ___________
Consulting/Advisory Services Onsite Hourly Rate $ ____________ Remote Hourly Rate $ ___________
Architectural Design Services Onsite Hourly Rate $ ____________ Remote Hourly Rate $ ___________
Statement of Work Services Onsite Hourly Rate $ ____________ Remote Hourly Rate $ ___________
Partner Services Onsite Hourly Rate $ ____________
Remote Hourly Rate $ ___________
Training Deployment Services Onsite Hourly Rate $ ____________ Online Hourly Rate $ ____________
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 248
#15..
- 579 -
Attachment H – Identification of Service Models Matrix
Offerors must complete the following form to identify the service models your firm offers under this RFP. You may provide a list of the different SaaS, IaaS, and/or PaaS services that you offer, including the Categorization of Risk that you have the ability to store and secure. This document is to provide purchasing entities and eligible users a quick snap shot of the cloud solutions your firm provides.
Service Model: Low Risk Data Moderate Risk Data High Risk Data Deployment Models Offered:
Saas
IaaS
PaaS
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 249
#15..
- 580 -
State of Utah Vendor Information Form
12/15/2014
Legal Company Name (include d/b/a if applicable) Federal Tax Identification Number State of Utah Sales Tax ID Number Ordering Address City State Zip Code
Remittance Address (if different from ordering address) City State Zip Code Type
Proprietorship Partnership
Government
For-Profit Corporation Non-Profit Corporation
Company Contact Person
Telephone Number (include area code) Fax Number (include area code) Company’s Internet Web Address Email Address
Offeror’s Authorized Representative’s Signature
Type or Print Name
Position or Title of Authorized Representative
Date:
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 250
#15..
- 581 -
State of Vermont
Instructions, Terms and Conditions and Required Forms
For Multi-State Cooperative Procurements
1. Confidentiality of Bid Documents: The successful response will become part of the contract file and will become a matter of public record as will all other responses received. If the response includes material that is considered by the bidder to be proprietary and confidential under the Vermont Public Records Act, 1 V.S.A. § 315 et seq., the bidder shall clearly designate the material as such, and include a explaining why such material should be considered confidential. The bidder must identify each page or section of the response that it believes is proprietary and confidential with sufficient grounds to justify each exemption from release, including the prospective harm to the competitive position of the bidder if the identified material were to be released. Under no circumstances can the entire response or price information be marked confidential. Responses that do not comply with the above may not be considered.
2. Certification for apparel, footwear, and textiles (sweatshop prohibition): If the subject matter of this solicitation concerns the sale of apparel, footwear, or textiles, then each bidder must provide certification from each supplier that meets the requirements of 29 V.S.A. §922(a) as well as a list of the names and addresses of each supplier, as required by 29 V.S.A. §922(b). In addition, any contract resulting from such solicitation must include the following language:
Contractor certifies that if, at any time during the contract period, there are changes to the information in the certification or to the list of suppliers the contractor will promptly inform the Commissioner of Buildings and General Services of such changes.
3. Vermont Contract Provisions: Any contract resulting from this solicitation must include the following provisions:
a. Standard State Provisions for Multistate Procurements, a copy of which is included herein. Note:
These provisions may be modified if, in the determination of the State, the terms of the Master Agreement awarded by the Lead State are no less protective than the standard State provisions. b. Other State Provisions for Information Technology Procurements (“Attachment D – Other Provisions”), a copy of which is included included herein. Note: These provisions are to be modified to meet the needs of the State depending on the particular technology procurement and the terms of the Master Agreement awarded by the Lead State. c. Notice to Third Party Licensors/Suppliers of Software Products: Contractor shall provide the following notice to its third party licensors which are licensing or deemed to license their products to the State in connection with the State’s use of any product or service supplied by Contractor to the State under this agreement:
To the extent Contractor’ third party licensors license Software products to the State of Vermont (the “State”), in connection with the State’s use of Contractor’s products, such licensor (“Licensor”) shall agree as follows:
(a) The State shall not be required to defend or indemnify Licensor or otherwise be liable for the expenses or reimbursement, including attorneys’ fees, collection costs or license verification costs of Licensor;
(b) The State shall not be required to agree to binding arbitration or otherwise waive the State’s right to a jury trial;
(c) The State’s use of Licensor’s product shall be governed by and construed in accordance with the laws of the State of Vermont and any action or proceeding brought by either the State or Licensor in connection with the State’s use of Licensor’s product shall be brought and enforced in the Superior Court of the State of Vermont, Civil Division, Washington Unit.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 251
#15..
- 582 -
(d) The State shall not waive nor be deemed to waive the immunities, defenses, rights or actions arising out of State’s sovereign status or under the Eleventh Amendment to the United States Constitution.
(e) Licensor confidentiality shall be subject to the Vermont Public Records Act, 1 V.S.A. § 315 et seq.
(f) Limitations or exclusions of liability shall not apply to State claims arising out of (i) Licensor’s obligation to indemnify the State for infringement; (ii) personal injury or damage to real or personal property; or (iii) gross negligence, fraud or intentional misconduct. The parties acknowledge and agree that limits of liability shall not apply to third party claims arising from the acts or omissions of a party in the performance of this Agreement. (g) To the extent Licensor is a “data collector” for purposes of 9 V.S.A. § 2430, Licensor shall comply with all applicable requirements of 9 V.S.A. § 2435. (h) Licensor shall have no right to access State systems to audit the State’s use of Licensor’s product; upon request, the State shall provide Licensor with a certified report concerning the State’s use of any software licensed for State use. Settlement payment shall be the exclusive remedy for any non-compliance.
(i) Fair Employment Practices and Americans with Disabilities Act: Licensor agrees to comply with the requirement of Title 21V.S.A. Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent applicable. Licensor shall also ensure, to the full extent required by the Americans with Disabilities Act of 1990, as amended, that qualified individuals with disabilities receive equitable access to the services, programs, and activities provided by Licensor under this Agreement. Licensor further agrees to include this provision in all subcontracts for services performed in the State of Vermont. (j) Licensor certifies under the pains and penalties of perjury that Licensor is in good standing with respect to, or in full compliance with, a plan to pay any and all taxes due the State of Vermont.
(k) Licensor certifies that neither Licensor nor Licensor’s principals (officers, directors, owners, or partners) are presently debarred, suspended, proposed for debarment, declared ineligible or excluded from participation in federal programs, or programs supported in whole or in part by federal funds. Licensor further certifies under pains and penalties of perjury that Licensor is not presently debarred, suspended, nor named on the State’s debarment list at:
http://bgs.vermont.gov/purchasing/debarment
The State’s use of the Contractor’s product, including the third party products embedded therein, shall constitute the third party licensor’s acceptance of the foregoing terms.
4. Required Forms: The following forms, each included herein, are to be completed and submitted as part of the response to this solicitation, as applicable:
a. Certificate of Compliance
b. Offshore Outsourcing Questionnaire
c. Environmental Information Form
d. Towns and Schools Questionnaire
e. Econometric Modeling Questionnaire
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 252
#15..
- 583 -
STATE OF VERMONT
STANDARD STATE PROVISIONS
FOR MULTI-STATE PROCUREMENTS
REVISED DECEMBER 2015
1. Governing Law, Jurisdiction and Venue; No Waiver of Jury Trial: The specific contract to which this form is attached (hereinafter “Agreement”) will be governed by the laws of the State of Vermont.
Any action or proceeding brought by either the State or the Contractor in connection with this Agreement shall be brought and enforced in the Superior Court of the State of Vermont, Civil Division, Washington Unit. The Contractor irrevocably submits to the jurisdiction of this court for any action or proceeding regarding this Agreement.
Contractor agrees that the State shall not be required to submit to binding arbitration or waive its right to a jury trial.
2. Sovereign Immunity: The State reserves all immunities, defenses, rights or actions arising out of the State’s sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver of the State’s immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason of the State’s entry into this Agreement.
3. Independence: The Contractor will act in an independent capacity and not as officers or employees of the State.
4. Defense and Indemnity: The Contractor shall defend the State and its officers and employees against all third Contractor claims or suits arising in whole or in part from any act or omission of the Contractor or of any agent of the Contractor in connection with the performance of this Agreement. The State shall notify the Contractor in the event of any such claim or suit, and the Contractor shall immediately retain counsel and otherwise provide a complete defense against the entire claim or suit. The State retains the right to participate at its own expense in the defense of any claim. The State shall have the right to approve all proposed settlements of such claims or suits. In the event the State withholds approval to settle any such claim, then the Contractor shall proceed with the defense of the claim but under those circumstances, the Contractor’s indemnification obligations shall be limited to the amount of the proposed settlement initially rejected by the State.
After a final judgment or settlement the Contractor may request recoupment of specific defense costs and may file suit in Washington Superior Court requesting recoupment. The Contractor shall be entitled to recoup costs only upon a showing that such costs were entirely unrelated to the defense of any claim arising from an act or omission of the Contractor in connection with the performance of this Agreement.
The Contractor shall indemnify the State and its officers and employees in the event that the State, its officers or employees become legally obligated to pay any damages or losses arising from any act or omission of the Contractor or an agent of the Contractor in connection with the performance of this Agreement.
The Contractor agrees that in no event shall the terms of this Agreement nor any document required by the Contractor in connection with its performance under this Agreement obligate the State to defend or indemnify the Contractor or otherwise be liable for the expenses or reimbursement, including attorneys’ fees, collection costs or other costs of the Contractor except to the extent awarded by a court of competent jurisdiction.
5. Insurance: Before commencing work on this Agreement the Contractor must provide certificates of insurance to show that the following minimum coverages are in effect. It is the responsibility of the Contractor to maintain current certificates of insurance on file with the State through the term of the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 253
#15..
- 584 -
Agreement. No warranty is made that the coverages and limits listed herein are adequate to cover and protect the interests of the Contractor for the Contractor’s operations. These are solely minimums that have been established to protect the interests of the State.
Workers Compensation: With respect to all operations performed, the Contractor shall carry workers’ compensation insurance in accordance with the laws of the State of Vermont.
General Liability and Property Damage: With respect to all operations performed under this Agreement, the Contractor shall carry general liability insurance having all major divisions of coverage including, but not limited to:
Premises - Operations
Products and Completed Operations
Personal Injury Liability
Contractual Liability
The policy shall be on an occurrence form and limits shall not be less than:
$1,000,000 Per Occurrence
$1,000,000 General Aggregate
$1,000,000 Products/Completed Operations Aggregate
$ 50,000 Fire/ Legal/Liability
Automotive Liability: The Contractor shall carry automotive liability insurance covering all motor vehicles, including hired and non-owned coverage, used in connection with the Agreement. Limits of coverage shall not be less than $1,000,000 combined single limit.
Additional Insured. The General Liability and Property Damage and Automobile coverages required for performance of this Agreement shall include the State of Vermont and its agencies, departments, officers and employees as Additional Insureds. Coverage shall be primary and non-contributory with any other insurance and self-insurance.
Notice of Cancellation or Change. There shall be no cancellation, material change, potential exhaustion of aggregate limits or non-renewal of insurance coverage(s) without thirty (30) days written notice from the Contractor or its insurer(s) to the State. Any failure to comply with the reporting provisions of this clause shall constitute a material breach of this Agreement and shall be grounds for immediate termination of this Agreement.
6. Reliance by the State on Representations: All payments by the State under this Agreement will be made in reliance upon the accuracy of all prior representations by the Contractor, including but not limited to bills, invoices, progress reports and other proofs of work.
7. False Claims Act: The Contractor acknowledges that it is subject to the Vermont False Claims Act as set forth in 32 V.S.A. § 630 et seq. If the Contractor violates the Vermont False Claims Act it shall be liable to the State for civil penalties, treble damages and the costs of the investigation and prosecution of such violation, including attorney’s fees, except as the same may be reduced by a court of competent jurisdiction in accordance with the False Claims Act. The Contractor’s liability to the State under the False Claims Act shall not be limited notwithstanding any agreement of the State to otherwise limit Contractor’s liability for State claims.
8. Whistleblower Protections. The Contractor shall not discriminate or retaliate against one of its employees or agents for disclosing information concerning a violation of law, fraud, waste, abuse of State of Utah Bid CH16012
3/22/2016 4:23 PM p. 254
#15..
- 585 -
authority or acts threatening health or safety, including but not limited to allegations concerning the False Claims Act. Further, the Contractor shall not require such employees or agents to forego monetary awards as a result of such disclosures, nor should they be required to report misconduct to the Contractor or its agents prior to reporting to any governmental entity and/or the public.
9. Federal Requirements:
A. Internal Controls: In the case that this Agreement is an award that is funded in whole or in part by Federal funds, in accordance with 2 CFR Part II, §200.303, the Contractor must establish and maintain effective internal control over the Federal award to provide reasonable assurance that the Contractor is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
B. Mandatory Disclosures: In the case that this Agreement is an award funded in whole or in part by Federal funds, in accordance with 2CFR Part II, §200.113, Contractor must disclose, in a timely manner, in writing to the State, all violations of Federal criminal law involving fraud, bribery, or gratuity violations potentially affecting the Federal award. Failure to make required disclosures may result in the imposition of sanctions which may include disallowance of costs incurred, withholding of payments, termination of the Agreement, suspension/debarment, etc.
10. Records Available for Audit: The Contractor shall maintain all records pertaining to performance under this agreement. “Records” means any written or recorded information, regardless of physical form or characteristics, which is produced or acquired by the Party in the performance of this agreement.
Records produced or acquired in a machine readable electronic format shall be maintained in that format.
The records described shall be made available at reasonable times during the period of the Agreement and for three years thereafter or for any period required by law for inspection by any authorized representatives of the State or Federal Government. If any litigation, claim, or audit is started before the expiration of the three-year period, the records shall be retained until all litigation, claims or audit findings involving the records have been resolved.
11. Fair Employment Practices and Americans with Disabilities Act: Contractor agrees to comply with the requirement of 21 V.S.A. Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent applicable. Contractor shall also ensure, to the full extent required by the Americans with Disabilities Act of 1990, as amended, that qualified individuals with disabilities receive equitable access to the services, programs, and activities provided by the Contractor under this Agreement. Contractor further agrees to include this provision in all subcontracts.
12. Set Off: The State may set off any sums which the Contractor owes the State against any sums due the Contractor under this Agreement; provided, however, that any set off of amounts due the State of Vermont as taxes shall be in accordance with the procedures more specifically provided hereinafter.
13. Taxes Due to the State:
A. Contractor understands and acknowledges responsibility, if applicable, for compliance with State tax laws, including income tax withholding for employees performing services within the State, payment of use tax on property used within the State, corporate and/or personal income tax on income earned within the State.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 255
#15..
- 586 -
B. Contractor certifies under the pains and penalties of perjury that, as of the date the Agreement is signed, the Contractor is in good standing with respect to, or in full compliance with, a plan to pay any and all taxes due the State of Vermont.
C. Contractor understands that final payment under this Agreement may be withheld if the Commissioner of Taxes determines that the Contractor is not in good standing with respect to or in full compliance with a plan to pay any and all taxes due to the State of Vermont.
D. Contractor also understands the State may set off taxes (and related penalties, interest and fees) due to the State of Vermont, but only if the Contractor has failed to make an appeal within the time allowed by law, or an appeal has been taken and finally determined and the Contractor has no further legal recourse to contest the amounts due.
14. Taxation of Purchases. All State purchases must be invoiced tax free. An exemption certificate will be furnished upon request with respect to otherwise taxable items.
15. Sub-Agreements: Contractor shall not assign or subcontract the performance of this Agreement or any portion thereof to any other Contractor without the prior written approval of the State. Contractor also agrees to include in all subcontract agreements a tax certification in accordance with paragraph 16 above.
Contractor shall be responsible and liable to the State for all acts or omissions of subcontractors and any other person performing work under this Agreement pursuant to an agreement with Contractor or any subcontractor.
16. No Gifts or Gratuities: Contractor shall not give title or possession of anything of substantial value (including property, currency, travel and/or education programs) to any officer or employee of the State during the term of this Agreement.
17. Copies: Contractor shall use reasonable best efforts to ensure that all written reports prepared under this Agreement are printed using both sides of the paper.
18. Certification Regarding Debarment: Contractor certifies under pains and penalties of perjury that, as of the date that this Agreement is signed, neither Contractor nor Contractor’s principals (officers, directors, owners, or partners) are presently debarred, suspended, proposed for debarment, declared ineligible or excluded from participation in federal programs, or programs supported in whole or in part by federal funds.
Contractor further certifies under pains and penalties of perjury that, as of the date that this Agreement is signed, Contractor is not presently debarred, suspended, nor named on the State’s debarment list at:
http://bgs.vermont.gov/purchasing/debarment
19. Conflict of Interest: Contractor shall fully disclose, in writing, any conflicts of interest or potential conflicts of interest. Contractor agrees that the failure to disclose any such conflicts shall constitute a material breach of this Agreement and shall be grounds for immediate termination of this Agreement.
20. Confidentiality: Contractor acknowledges and agrees that this Agreement and any and all information obtained by the State from the Contractor in connection with this Agreement are subject to the State of Vermont Public Records Act, 1 V.S.A. § 315 et seq.
21. Force Majeure: Neither the State nor the Contractor shall be liable to the other for any failure or delay of performance of any obligations under this Agreement to the extent such failure or delay shall have been wholly or principally caused by acts or events beyond its reasonable control rendering State of Utah Bid CH16012
3/22/2016 4:23 PM p. 256
#15..
- 587 -
performance illegal or impossible (excluding strikes or lock-outs) (“Force Majeure”). Where Force Majeure is asserted, the nonperforming Contractor must prove that it made all reasonable efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued performance of its obligations under this Agreement, substantially fulfilled all non-excused obligations, and timely notified the other Contractor of the likelihood or actual occurrence of an event described in this paragraph.
22. Marketing: Contractor shall not refer to the State in any publicity materials, information pamphlets, press releases, research reports, advertising, sales promotions, trade shows, or marketing materials or similar communications to third parties except with the prior written consent of the State.
23. Termination: In addition to any right of the State to terminate for convenience, the State may terminate this Agreement as follows:
A. Non-Appropriation: If this Agreement extends into more than one fiscal year of the State (July 1 to June 30), and if appropriations are insufficient to support this Agreement, the State may cancel at the end of the fiscal year, or otherwise upon the expiration of existing appropriation authority.
B. Termination for Cause: Either Contractor may terminate this Agreement if a Contractor materially breaches its obligations under this Agreement, and such breach is not cured within thirty (30) days after delivery of the non-breaching Contractor’s notice or such longer time as the non-breaching Contractor may specify in the notice.
C. No Implied Waiver of Remedies. A Contractor’s delay or failure to exercise any right, power or remedy under this Agreement shall not impair any such right, power or remedy, or be construed as a waiver of any such right, power or remedy. All waivers must be in writing.
24. Location of State Data. No State data received, obtained, or generated by the Contractor in connection with performance under this Agreement shall be processed, transmitted, stored, or transferred by any means outside continental United States, except with the express written permission of the State. (End of Standard Provisions)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 257
#15..
- 588 -
RFP:
DATE:
CERTIFICATE OF COMPLIANCE
This form must be completed in its entirety and submitted as part of the response for the proposal to be considered valid.
TAXES: Pursuant to 32 V.S.A. § 3113, bidder hereby certifies, under the pains and penalties of perjury, that the company/individual is in good standing with respect to, or in full compliance with a plan to pay, any and all taxes due to the State of Vermont as of the date this statement is made. A person is in good standing if no taxes are due, if the liability for any tax that may be due is on appeal, or if the person is in compliance with a payment plan approved by the Commissioner of Taxes.
INSURANCE: Bidder certifies that the company/individual is in compliance with, or is prepared to comply with, the insurance requirements as detailed in Section 4 of the State of Vermont Additional Terms and Conditions to the NASPO Terms and Conditions and Required Forms Cooperative Procurements. Certificates of insurance must be provided prior to issuance of a contract and/or purchase order. If the certificate(s) of insurance is/are not received by the Office of Purchasing & Contracting within five (5) days of notification of award, the State of Vermont reserves the right to select another vendor. Please reference the RFP and/or RFQ # when submitting the certificate of insurance.
CERTIFICATION FOR APPAREL, FOOTWEAR, AND TEXTILES (SWEATSHOP PROHIBITION): Bidder certifies that the company/individual is in compliance with the requirements as detailed in Section 7 of the State of Vermont Additional Terms and Conditions to the NASPO Terms and Conditions and Required Forms Cooperative Procurements. The contractor must provide certification from each supplier that meets the requirements of 29 V.S.A. §922(a) as well as a list of the names and addresses of each supplier, as required by 29 V.S.A. §922(b). Contractor certifies that if, at any time during the contract period, there are changes to the information in the certification or to the list of supplier the contractor will promptly inform the Commissioner of Buildings and General Services of such changes. The state reserves the right to ask for additional information and / or certifications any time during the contract period. Failure of the vendor to comply with any provision of this certification will be considered a default of the vendor’s contract obligations.
CONTRACT TERMS: The undersigned hereby acknowledges and agrees to the State of Vermont Additional Terms and Conditions to the NASPO Terms and Conditions and Required Forms Cooperative Procurements.
TERMS OF SALE: The undersigned agrees to furnish the products or services listed at the prices quoted. The Terms of Sales are Net 30 days from receipt of service or invoice, whichever is later. Percentage discounts may be offered for prompt payments of invoices, however such discounts must be in effect for a period of 30 days or more in order to be considered in making awards.
FORM OF PAYMENT: Would you accept the Visa Purchasing Card as a form of payment? ____ Yes ____ No Insurance Certificate(s): Attached ______________ Will provide upon notification of award ____________ Delivery Offered: _______ days after notice of award Terms of Sale: ___________________ (If Discount)
Quotation Valid for: _____ days Date: __________
Name of Company: __________________________ Contact Name: ______________________________ Address: ___________________________________ Fax Number: ___________________________ ___________________________________________ E-mail: _______________________________ By: _______________________________________ Name: _______________________________ Signature (Bid Not Valid Unless Signed) (Type or Print) All returned quotes and related documents must be identified with our request for quote number.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 258
#15..
- 589 -
Offshore Outsourcing Questionnaire
Vendors must indicate whether or not any services are or will be performed in a country other than the United Sates. Indicate N/A if not applicable.
Services:
Proposed Service to be
Outsourced Bid Total Offshore Dollars
Represents what % of
total Contract Dollars
Outsourced Work
Location (Country) Subcontractor
If any or all of the services are or will be outsourced offshore, Vendors are required to provide a cost estimate of what the cost would be to provide the same services onshore and/or in Vermont.
Proposed Service to be
Outsourced
Bid Total if provided
Onshore
Bid Total if provided in
Vermont Cost Impact Onshore Work Location Subcontractor
Name of Bidder: Signature of Bidder: Date
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 259
#15..
- 590 -
ENVIRONMENTAL INFORMATION FORM
June 1, 2008
RECYCLED MATERIALS OR PRODUCTS:
All bidders are to complete the following information in reference to each item being quoted. Additional pages may be used if necessary.
ITEM # BRAND/MANUFACTURER % OF RECYCLED CONTENT % POST CONSUMER CONTENT
MERCURY CONTENT CERTIFICATION:
The undersigned hereby certifies that none of the items quoted in this RFQ/RFP and any contract issued as a result contain mercury except as identified below. Bidders shall also specify the amount of mercury contained in any of the products listed below. Additional pages may be used if necessary.
ITEM PART # MERCURY CONTENT
Name of Bidder: Signature of Bidder: Date:
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 260
#15..
- 591 -
TOWNS AND SCHOOLS QUESTIONNAIRE
PROVISIONS FOR THE PURCHASE OF SUPPLIES, MATERIALS, AND
EQUIPMENT FOR TOWNS, SCHOOLS, POLITICAL SUBDIVISIONS,
AND INDEPENDENT COLLEGES¹ OF THE STATE OF VERMONT
The Office of Purchasing & Contracting keeps a current file of the contracts that are available to the political subdivisions and colleges. We are continually interested in expanding this file and would appreciate a positive response to the following questions:
1. Will you furnish these products and services to the political subdivisions of the State of Vermont at the same prices, terms and conditions as you quoted in this response? Yes _________ No _________ If no, kindly outline below the prices, terms, and conditions under which you will agree to supply these needs.
2. Will you furnish these products and services to the independent colleges of the State of Vermont at the same prices, terms and conditions as you quoted in this response? Yes ________ No __________ If no, kindly outline below the prices, terms, and conditions under which you will agree to supply these needs.
It should be noted that if you agree to extend these contract terms and prices to the political subdivisions or to independent colleges, all such items furnished will be billed directly to and paid for by the political subdivision or college and neither the State of Vermont, nor its Commissioner of Buildings and General Services, personally or officially, assumes any responsibility.
RESPONSE TITLE: FIRM NAME:
DATE: BY:
¹Independent Colleges are "any institution of higher education chartered in VT and accredited or holding a certificate of approval from the State Board of Education."
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 261
#15..
- 592 -
Econometric Modeling Questionnaire
For bid amounts exceeding $100,000.00 bidders are required to respond to the questions identified below.
Act 112 of the Acts of 2012, “An act relating to evaluating net costs of government purchasing,” requires the Secretary of Administration and the legislative economist to design and implement a pilot project to help measure the net fiscal impact to the state of certain identified purchases. In order to accomplish this goal, we are seeking data on contracts for goods and services to support the econometric evaluation.
Questions have been identified that may assist the state in the data collection process which will ultimately be used for Econometric Modeling. Indicate N/A if not applicable.
1. Vermont-based company?
Yes: No
2. Describe your companies presence in Vermont:
Description:
3. Indicate number of employees residing in Vermont:
4. Indicate percentage (%) of employees residing in Vermont: (%)
5. Indicate Vermont payroll for most recent fiscal year: $
6. Indicate percent (%) of total payroll in Vermont: (%) When responding to questions 7 and 8, please indicate: Yes, No, or Not known at time of bid.
7. If Out-of-State Vendor (see Question 1), do you expect to use Vermont subcontractors to fulfill any portion of the Contract? Or, will Vermont be the source of any portion of goods sold?
8. If Vermont Vendor (see Question 1), will out-of-state subcontractors or goods sourced outside of Vermont be used to fulfill any portion of the contract? ___________ Name of Bidder:
Signature of Bidder:
Date:
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 262
#15..
- 593 -
ATTACHMENT D
OTHER PROVISIONS
1. ORDER OF PRECEDENCE; CONTRACTOR DOCUMENTATION
The parties specifically agree that any language or provisions contained in a Contractor Document is of no force and effect if such language or provisions conflict with the terms of Attachment C or Attachment D to this Contract. Further, in no event shall any Contractor Document: (a) require indemnification by the State of the Contractor; (b) waive the State’s right to a jury trial; (c) establish jurisdiction in any venue other than the Superior Court of the State of Vermont, Civil Division, Washington Unit; (d) designate a governing law other than the laws of the State of Vermont; (e) constitute an implied or deemed waiver of the immunities, defenses, rights or actions arising out of State’s sovereign status or under the Eleventh Amendment to the United States Constitution; or (f) limit the time within which an action may be brought hereunder.
For purposes of this Attachment D, “Contractor Document” shall mean one or more document, agreement or other instrument required by the Contractor in connection with the performance of the services set forth in Attachment A hereto, regardless of format, including Contractor’s [insert title of attachment] attached hereto as Attachment __ and any other paper or “shrinkwrap,” “clickwrap” or other electronic version thereof.
Notwithstanding any other provision or other unilateral license terms which may be issued by Contractor after the effective date of this Contract, and irrespective of whether any such provisions have been proposed prior to or after the issuance of an order for the products and services being purchased by the State, as applicable, the components of which are licensed under the Contractor Documents, or the fact that such other agreement may be affixed to or accompany the products and services being purchased by the State, as applicable, upon delivery (“shrink wrap”), the terms and conditions set forth herein shall supersede and govern licensing and delivery of all products and services hereunder.
2. TERM OF CONTRACTOR’S DOCUMENTS
Contractor acknowledges and agrees that, to the extent a Contractor Document provides for alternate term or termination provisions, including automatic renewals, such sections shall be waived and shall have no force and effect. All Contractor Documents shall run concurrently with the term of this Contract; provided, however, to the extent the State has purchased a perpetual license to use the Contractor’s software, hardware or other services, such license shall remain in place unless expressly terminated in accordance with the terms of this Contract.
3. OWNERSHIP AND LICENSE IN DELIVERABLES
3.1 Contractor Intellectual Property. Contractor shall retain all right, title and interest in and to all Contractor Intellectual Property that Contractor delivers to the State in accordance with Attachment A of this Contract. “Contractor Intellectual Property” means any intellectual property, tangible or intangible, that is owned by Contractor and contained in or necessary for the use of the items that Contractor is required to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 263
#15..
- 594 -
deliver to the State under this Contract, including Work Product (“Deliverables”).
Should the State require a license for the use of Contractor Intellectual Property in connection with the development or use of the Deliverables, the Contractor shall grant the State a royalty-free license for such development and use. For the avoidance of doubt, Work Product shall not be deemed to include Contractor Intellectual Property, provided the State shall be granted an irrevocable, perpetual, non-exclusive royalty-free license to any such Contractor Intellectual Property that is incorporated into Work Product.
3.2 State Intellectual Property; State Intellectual Property; User Name. The State shall retain all right, title and interest in and to (i) all content and all property, data and information furnished by or on behalf of the State or any agency, commission or board thereof, and to all information that is created under this Contract, including, but not limited to, all data that is generated under this Contract as a result of the use by Contractor, the State or any third party of any technology systems or knowledge bases that are developed for the State and used by Contractor hereunder, and all other rights, tangible or intangible; and (ii) all State trademarks, trade names, logos and other State identifiers, Internet uniform resource locators, State user name or names, Internet addresses and e-mail addresses obtained or developed pursuant to this Contract (collectively, “State Intellectual Property”).
Contractor may not use State Intellectual Property for any purpose other than as specified in this Contract. Upon expiration or termination of this Contract, Contractor shall return or destroy all State Intellectual Property and all copies thereof, and Contractor shall have no further right or license to such State Intellectual Property.
Contractor acquires no rights or licenses, including, without limitation, intellectual property rights or licenses, to use State Intellectual Property for its own purposes. In no event shall the Contractor claim any security interest in State Intellectual Property.
3.3 Work Product. [ALTERNATIVE LANGUAGE AVAILABLE FOR SAAS SOLUTIONS] All Work Product shall belong exclusively to the State, with the State having the sole and exclusive right to apply for, obtain, register, hold and renew, in its own name and/or for its own benefit, all patents and copyrights, and all applications and registrations, renewals and continuations thereof and/or any and all other appropriate protection. To the extent exclusive title and/or complete and exclusive ownership rights in and to any Work Product may not originally vest in the State by operation of law or otherwise as contemplated hereunder, Contractor shall immediately upon request, unconditionally and irrevocably assign, transfer and convey to the State all right, title and interest therein. “Work Product” means any tangible or intangible ideas, inventions, improvements, modifications, discoveries, development, customization, configuration, methodologies or processes, designs, models, drawings, photographs, reports, formulas, algorithms, patterns, devices, compilations, databases, computer programs, work of authorship, specifications, operating instructions, procedures manuals or other documentation, technique, know-how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection), State of Utah Bid CH16012
3/22/2016 4:23 PM p. 264
#15..
- 595 -
that is specifically made, conceived, discovered or reduced to practice by Contractor, either solely or jointly with others, pursuant to this Contract. Work Product does not include Contractor Intellectual Property or third party intellectual property.
To the extent delivered under this Contract, upon full payment to Contractor in accordance with Attachment B, and subject to the terms and conditions contained herein, Contractor hereby (i) assigns to State all rights in and to all Deliverables, except to the extent they include any Contractor Intellectual Property; and (ii) grants to State a perpetual, non-exclusive, irrevocable, royalty-free license to use for State’s internal business purposes, any Contractor Intellectual Property included in the Deliverables in connection with its use of the Deliverables and, subject to the State’s obligations with respect to Confidential Information, authorize others to do the same on the State’s behalf. Except for the foregoing license grant, Contractor or its licensors retain all rights in and to all Contractor Intellectual Property.
The Contractor shall not sell or copyright a Deliverable without explicit permission from the State.
If the Contractor is operating a system or application on behalf of the State of Vermont, then the Contractor shall not make information entered into the system or application available for uses by any other party than the State of Vermont, without prior authorization by the State. Nothing herein shall entitle the State to pre-existing Contractor Intellectual Property or Contractor Intellectual Property developed outside of this Contract with no assistance from State.
4. CONFIDENTIALITY AND NON-DISCLOSURE; SECURITY BREACH
REPORTING
4.1 Confidentiality of Contractor Information. The Contractor acknowledges and agrees that this Contract and any and all Contractor information obtained by the State in connection with this Contract are subject to the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq. The State will not disclose information for which a reasonable claim of exemption can be made pursuant to 1 V.S.A. § 317(c), including, but not limited to, trade secrets, proprietary information or financial information, including any formulae, plan, pattern, process, tool, mechanism, compound, procedure, production data, or compilation of information which is not patented, which is known only to the Contractor, and which gives the Contractor an opportunity to obtain business advantage over competitors who do not know it or use it.
The State shall immediately notify Contractor of any request made under the Access to Public Records Act, or any request or demand by any court, governmental agency or other person asserting a demand or request for Contractor information. Contractor may, in its discretion, seek an appropriate protective order, or otherwise defend any right it may have to maintain the confidentiality of such information under applicable State law within three business days of the State’s receipt of any such request.
Contractor agrees that it will not make any claim against the State if the State makes State of Utah Bid CH16012
3/22/2016 4:23 PM p. 265
#15..
- 596 -
available to the public any information in accordance with the Access to Public Records Act or in response to a binding order from a court or governmental body or agency compelling its production. Contractor shall indemnify the State for any costs or expenses incurred by the State, including, but not limited to, attorneys’ fees awarded in accordance with 1 V.S.A. § 320, in connection with any action brought in connection with Contractor’s attempts to prevent or unreasonably delay public disclosure of Contractor’s information if a final decision of a court of competent jurisdiction determines that the State improperly withheld such information and that the improper withholding was based on Contractor’s attempts to prevent public disclosure of Contractor’s information.
The State agrees that (a) it will use the Contractor information only as may be necessary in the course of performing duties, receiving services or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of Contractor information as it provides to protect its own similar confidential and proprietary information; (c) except as required by the Access to Records Act, it will not disclose such information orally or in writing to any third party unless that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the Contractor’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity.
Contractor may affix an appropriate legend to Contractor information that is provided under this Contract to reflect the Contractor’s determination that any such information is a trade secret, proprietary information or financial information at time of delivery or disclosure.
4.2 Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law. [In addition to the provisions of this Section, the Party shall execute the HIPAA Business Associate Agreement attached as Attachment __]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States.
Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees not to publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form or authorize or permit others to do so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its State of Utah Bid CH16012
3/22/2016 4:23 PM p. 266
#15..
- 597 -
staff who must have the information on a “need to know” basis. The Contractor shall use State Data only for the purposes of and in accordance with this Contract. The Contractor shall provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information.
The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.
4.3 Security of State Information. The Contractor represents and warrants that it has implemented and it shall maintain during the term of this Contract the highest industry standard administrative, technical, and physical safeguards and controls consistent with NIST Special Publication 800-53 (version 4 or higher) and Federal Information Processing Standards Publication 200 and designed to (i) ensure the security and confidentiality of State Data; (ii) protect against any anticipated security threats or hazards to the security or integrity of the State Data; and (iii) protect against unauthorized access to or use of State Data. Such measures shall include at a minimum: (1) access controls on information systems, including controls to authenticate and permit access to State Data only to authorized individuals and controls to prevent the Contractor employees from providing State Data to unauthorized individuals who may seek to obtain this information (whether through fraudulent means or otherwise); (2) industry-standard firewall protection; (3) encryption of electronic State Data while in transit from the Contractor networks to external networks; (4) measures to store in a secure fashion all State Data which shall include multiple levels of authentication; (5) dual control procedures, segregation of duties, and pre-employment criminal background checks for employees with responsibilities for or access to State Data; (6) measures to ensure that the State Data shall not be altered or corrupted without the prior written consent of the State; (7) measures to protect against destruction, loss or damage of State Data due to potential environmental hazards, such as fire and water damage; (8) staff training to implement the information security measures; and (9) monitoring of the security of any portions of the Contractor systems that are used in the provision of the services against intrusion on a twenty-four (24) hour a day basis.
4.4 Back-Up Policies: The Contractor’s back-up policies have been made available to the State upon execution of this Contract under separate cover. The Contractor shall provide the State with not less than thirty (30) days advance written notice of any material amendment or modification of such policies.
4.5 Security Breaches; Security Breach Reporting. To the extent the Contractor or its subcontractors, affiliates or agents handles, collects, stores, disseminates or otherwise deals with State Data, the Contractor acknowledges that in the performance of its obligations under this Contract, it will be a “data collector” pursuant to Chapter 62 of State of Utah Bid CH16012
3/22/2016 4:23 PM p. 267
#15..
- 598 -
Title 9 of the Vermont Statutes (9 V.S.A. §2430(3)). The Contractor shall have policies and procedures in place for the effective management of Security Breaches, as defined below.
In addition to the requirements set forth in any applicable Business Associate Agreement as may be attached to this Contract, in the event of any actual security breach or reasonable belief of an actual security breach the Contractor either suffers or learns of that either compromises or could compromise State Data (including, as applicable, PII, PHI or ePHI) in any format or media, whether encrypted or unencrypted (for example, but not limited to: physical trespass on a secure facility; intrusion or hacking or other brute force attack on any State environment; loss or theft of a PC, laptop, desktop, tablet, smartphone, removable data storage device or other portable device; loss or theft of printed materials; or failure of security policies) (collectively, a “Security Breach”), the Contractor shall immediately determine the nature and extent of the Security Breach, contain the incident by stopping the unauthorized practice, recover records, shut down the system that was breached, revoke access and/or correct weaknesses in physical security. Contractor shall analyze and document the incident and provide the required notices, as set forth below.
In accordance with Section 9 V.S.A. §2435(b)(3), the Contractor shall notify the Office of the Attorney General, or in the case of a Security Breach by a data collector regulated by the Vermont Department of Financial Regulation (“DFR”), DFR, within fourteen (14) business days of the Contractor’s discovery of the Security Breach. The notice shall provide a preliminary description of the breach. The foregoing notice requirement shall be included in the subcontracts of any of Contractor’s subcontractors, affiliates or agents which may be “data collectors” hereunder. Except to the extent delayed upon request of law enforcement in accordance with 9 V.S.A. §2435(b)(4), within thirty days of the Security Breach or when the Contractor provides notice to consumers pursuant to this Contract, whichever is sooner, the Contractor shall report to the State: (i) the nature of the Security Breach; (ii) the State Data used or disclosed; (iii) who made the unauthorized use or received the unauthorized disclosure; (iv) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and (v) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure. The Contractor shall provide such other information, including a written report, as reasonably requested by the State.
The Contractor agrees to comply with all applicable laws, as such laws may be amended from time to time (including, but not limited to, Chapter 62 of Title 9 of the Vermont Statutes and all applicable State and federal laws, rules or regulations) that require notification in the event of unauthorized release of personally-identifiable information or other event requiring notification. Further, the Contractor agrees to fully cooperate with the State, assume responsibility for such notice if the State determines it to be appropriate under the circumstances of any particular Security Breach, and assume all costs associated with a Security Breach, including but not limited to, notice, outside investigation and services (including mailing, call center, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 268
#15..
- 599 -
forensics, counsel and/or crisis management), and/or credit monitoring, in the sole determination of the State.
In addition to any other indemnification obligations in this Contract, the Contractor shall fully indemnify and save harmless the State from any costs, loss or damage to the State resulting from a Security Breach or the unauthorized disclosure of State Data by the Contractor, its officers, agents, employees, and subcontractors. 5 SUBCONTRACTORS
Contractor shall be responsible for directing and supervising each of its subcontractors and any other person performing any of the Work under an agreement with Contractor.
Contractor has provided to the State a list of all subcontractors and subcontractors’ subcontractors, together with the identity of those subcontractors’ workers compensation insurance providers. Contractor shall be responsible and liable to the State for all acts or omissions of subcontractors and any other person performing any of the Services under an agreement with Contractor or any subcontractor.
6 CONTRACTOR’S REPRESENTATIONS AND WARRANTIES
6.1 General Representations and Warranties. The Contractor represents, warrants and covenants that:
(i) The Contractor has all requisite power and authority to execute, deliver and perform its obligations under this Contract and the execution, delivery and performance of this Contract by the Contractor has been duly authorized by the Contractor.
(ii) There is no pending litigation, arbitrated matter or other dispute to which the Contractor is a party which, if decided unfavorably to the Contractor, would reasonably be expected to have a material adverse effect on the Contractor’s ability to fulfill its obligations under this Contract. (iii) The Contractor will comply with all laws applicable to its performance of the services and otherwise to the Contractor in connection with its obligations under this Contract.
(iv) The Contractor (a) owns, or has the right to use under valid and enforceable agreements, all intellectual property rights reasonably necessary for and related to delivery of the services and provision of the Deliverables as set forth in this Contract; (b) shall be responsible for and have full authority to license all proprietary and/or third party software modules, including algorithms and protocols, that Contractor incorporates into its product; and (c) none of the Deliverables or other materials or technology provided by the Contractor to the State will infringe upon or misappropriate the intellectual property rights of any third party.
(v) The Contractor has adequate resources to fulfill its obligations under this Contract.
(vi) Neither Contractor nor Contractor’s subcontractors has past state or federal violations, convictions or suspensions relating to miscoding of employees in NCCI job codes for purposes of differentiating between independent contractors and employees.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 269
#15..
- 600 -
6.2 Contractor’s Performance Warranties. Contractor represents and warrants to the State that:
(i) All Deliverables will be free from material errors and shall perform in accordance with the specifications therefor.
(ii) Each and all of the services shall be performed in a timely, diligent, professional and workpersonlike manner, in accordance with the highest professional or technical standards applicable to such services, by qualified persons with the technical skills, training and experience to perform such services in the planned environment. At its own expense and without limiting any other rights or remedies of the State hereunder, the Contractor shall re-perform any services that the State has determined to be unsatisfactory in its reasonable discretion; the State shall have no obligation to pay for services it has determined to be unsatisfactory.. (iii) All Deliverables supplied by the Contractor to the State shall be transferred free and clear of any and all restrictions on the conditions of transfer, modification, licensing, sublicensing and free and clear of any and all lines, claims, mortgages, security interests, liabilities and encumbrances or any kind. (iv) Any time software is delivered to the State, whether delivered via electronic media or the internet, no portion of such software or the media upon which it is stored or delivered will have any type of software routine or other element which is designed to facilitate unauthorized access to or intrusion upon; or unrequested disabling or erasure of; or unauthorized interference with the operation of any hardware, software, data or peripheral equipment of or utilized by the State.
Notwithstanding the foregoing, Contractor assumes no responsibility for the State’s negligence or failure to protect data from viruses, or any unintended modification, destruction or disclosure.
6.3 Limitation on Disclaimer. The express warranties set forth in this Contract shall be in lieu of all other warranties, express or implied.
6.4 Effect of Breach of Warranty. If, at any time during the term of this Contract, software or the results of Contractor’s work fail to perform according to any warranty of Contractor under this Contract, the State shall promptly notify Contractor in writing of such alleged nonconformance, and Contractor shall provide at no additional cost of any kind to the State, the maintenance required. 7 INDEMNIFICATION
The Contractor acknowledges and agrees that the laws and the public policy of the State of Vermont prohibit the State from agreeing to indemnify contractors and other parties.
The Contractor agrees that, to the extent a Contractor Document expressly provides for or implies indemnification of the Contractor and/or other third parties by the State, such sections shall be waived and shall have no force and effect with respect to the State. 8 PROFESSIONAL LIABILITY AND CYBER LIABILITY INSURANCE
COVERAGE
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 270
#15..
- 601 -
In addition to the insurance required in Attachment C to this Contract, before commencing work on this Contract and throughout the term of this Contract, Contractor agrees to procure and maintain (a) Technology Professional Liability insurance for any and all services performed under this Contract, with minimum third party coverage of $__________ per claim, $____________ aggregate; and (b) first party Breach Notification Coverage of not less than $_____________.
Before commencing work on this Contract the Contractor must provide certificates of insurance to show that the foregoing minimum coverages are in effect.
With respect to the first party Breach Notification Coverage, Contractor shall name the State of Vermont and its officers and employees as additional insureds for liability arising out of this Agreement.
8 LIMITATION OF LIABILITY.
IN NO EVENT WILL THE CONTRACTOR’S LIABILITY FOR ANY DAMAGES TO THE STATE EVER EXCEED __________________________________. LIMITS OF
LIABILITY FOR STATE CLAIMS WHICH MAY BE AGREED BY THE STATE SHALL NOT APPLY TO STATE CLAIMS ARISING OUT OF: (A) CONTRACTOR’S OBLIGATION TO INDEMNIFY THE STATE; (B) CONTRACTOR’S
CONFIDENTIALITY OBLIGATIONS TO THE STATE; (C) PERSONAL INJURY OR DAMAGE TO REAL OR PERSONAL PROPERTY; (D) CONTRACTOR’S GROSS NEGLIGENCE, FRAUD OR INTENTIONAL MISCONDUCT; OR (E) VIOLATIONS OF THE STATE OF VERMONT FRAUDULENT CLAIMS ACT. IN NO EVENT SHALL CONTRACTOR’S LIABILITY BE LIMITED FOR THIRD PARTY CLAIMS AGAINST THE CONTRACTOR WHICH MAY ARISE OUT OF CONTRACTOR’S ACTS OR OMISSIONS IN THE PERFORMANCE OF THIS CONTRACT.
NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT,
INCIDENTAL OR SPECIAL DAMAGES, DAMAGES WHICH ARE
UNFORESEEABLE TO THE PARTIES AT THE TIME OF CONTRACTING,
DAMAGES WHICH ARE NOT PROXIMATELY CAUSED BY A PARTY, SUCH AS
LOSS OF ANTICIPATED BUSINESS, OR LOST PROFITS, INCOME, GOODWILL,
OR REVENUE IN CONNECTION WITH OR ARISING OUT OF THE SUBJECT MATTER OF THIS CONTRACT.
The provisions of this Section shall apply notwithstanding any other provisions of this Contract or any other agreement, and shall survive the expiration or termination of this Contract.
9 SOVEREIGN IMMUNITY
The Contractor acknowledges that the State reserves all immunities, defenses, rights or actions arising out of the State’s sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver of any such immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason of the State’s entry into this Contract.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 271
#15..
- 602 -
10 DISPUTE RESOLUTION
10.1 Governing Law; Jurisdiction. The Contractor agrees that this Contract, including any Contractor Document, shall be governed by and construed in accordance with the laws of the State of Vermont and that any action or proceeding brought by either the State or the Contractor in connection with this Contract shall be brought and enforced in the Superior Court of the State of Vermont, Civil Division, Washington Unit. The Contractor irrevocably submits to the jurisdiction of such court in respect of any such action or proceeding. The State shall not be liable for attorneys’ fees in any proceeding.
10.2 Contractor Default. The Contractor shall be in default under this Contract if Contractor commits any material breach of any covenant, warranty, obligation or certification under this Contract, fails to perform the Services in conformance with the specifications and warranties provided in this Contract, or clearly manifests an intent not to perform future obligations under this Contract, and such breach or default is not cured, or such manifestation of an intent not to perform is not corrected by reasonable written assurances of performance within thirty (30) days after delivery of the State’s notice period, or such longer period as the State may specify in such notice.
10.3 State Default. State shall be in default under this Contract if State commits any material breach or default of any covenant, warranty, or obligation under this Contract and State fails to cure such failure within thirty (30) business days after delivery of Contractor’s notice or such longer period as Contractor may specify in such notice.
10.4 Trial by Jury. The Contractor acknowledges and agrees that public policy prohibits the State from agreeing to arbitration and/or from waiving any right to a trial by jury. Therefore, Contractor further acknowledges and agrees that, to the extent a Contractor Document expressly provides for arbitration or waiver of the State’s right to a jury trial of the Contractor and/or other third parties by the State, such sections shall be waived and shall have no force and effect with respect to the State.
10.5 Trade Secret, Patent, and Copyright Infringement. The State shall not be deemed to waive any of its rights or remedies at law or in equity in the event of Contractor’s trade secret, patent and/or copyright infringement.
10.6 Limits on Actions Prohibited. The Contractor acknowledges and agrees that 12 V.S.A. § 465 renders null and void any contractual provision which limits the time in which an action may be brought under the contract, or waives the statute of limitations.
10.7 Continuity of Performance. In the event of a dispute between the Contractor and the State, each party will continue to perform its obligations under this Contract during the resolution of such dispute unless and until this Contract is terminated in accordance with its terms.
11 REMEDIES FOR DEFAULT
In the event either party is in default under this Contract, the non-defaulting party may, at its option, pursue any or all of the remedies available to it under this Contract, including termination for cause, and at law or in equity.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 272
#15..
- 603 -
12 TERMINATION
12.1 Termination Assistance. [ALTERNATIVE LANGUAGE AVAILABLE FOR SAAS] Upon nearing the end of the final term of this Contract, and without respect to either the cause or time of such termination, the Contractor shall take all reasonable and prudent measures to facilitate the transition to a successor provider, to the extent required by the State. The primary activities in this turnover are focused on transition planning to ensure operational readiness for the State and/or successor provider. This includes both a knowledge transfer period, and the turnover of the solution and supporting services to the State and/or successor provider. The State shall sign-off on each defined transition milestone to ensure that all transition Deliverables (set forth below), and exit criteria are fully executed based on agreed upon Contract terms.
Upon the sooner of a date specified in a notice of termination from either party, or within 90 days of Contract expiration, the Contractor shall:
Deliverable 1 - Develop a System Turnover Plan at no additional cost to the State.
The Solution Turnover Plan shall include, at minimum:
• Proposed approach to Turnover.
• Tasks and subtasks for Turnover.
• Schedule for Turnover.
• Entrance and exit criteria.
• Readiness walkthrough process.
• Documentation update procedures during Turnover.
• Description of Contractor coordination activities that will occur during the Turnover Phase that will be implemented to ensure continued functionality of the Solution and services as deemed appropriate by the State.
Deliverable 2 - Develop a Solution Requirements Statement at no additional cost that would be required by the State and/or successor provider to fully take over the Solution, technical, and business functions outlined in the Contract. The Statement shall also include an estimate of the number, type, and salary of personnel required to perform the other functions of the project work, implemented solution, and all supporting services. The Statement shall be separated by type of activity of the personnel. The Statement shall include all facilities and any other resources required to operate the Solution, including, but not limited to:
• Telecommunications networks.
• Office space.
• Hardware.
• Software.
• Other technology.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 273
#15..
- 604 -
The Statement shall be based on the Contractor’s experience in the operation of the Solution and shall include actual Contractor resources devoted to operations activities.
Deliverable 3 - Develop and submit a Transition Plan including, at minimum:
• Proposed approach to transition.
• Proposed approach for conducting a knowledge transfer from the Contractor to the State or successor provider.
• Proposed approach for consolidating applicable sections from the Contractor’s Turnover Plan into the transition planning activity.
• Tasks and activities for transition.
• Personnel and level of effort in hours.
• Completion date.
• Transition Milestones.
• Entrance and exit criteria.
• Schedule for transition.
• Production program and documentation update procedures during transition. • Readiness walkthrough.
• Parallel test procedures.
• Provider training.
• Interface testing.
The Contractor shall execute the Transition Plan and activities at no additional cost.
The Contactor agrees, after receipt of a notice of termination, and except as otherwise directed by the State, the Contactor shall:
1. Stop work under the Contract on the date, and to the extent, specified in the notice;
2. Immediately deliver to the State all State Data and historical project records in a form acceptable to the State, and copies of all subcontracts and all third party contracts executed in connection with the performance of the Services;
3. Place no further orders or subcontracts for Services, except as may be necessary for completion of such portion of the work under the Contract that is not terminated as specified in writing by the State;
4. Assign, to the extent applicable or as the State may require, all subcontracts and all third party contracts executed in connection with the performance of the Services to the State or a successor provider, as the State may require; State of Utah Bid CH16012
3/22/2016 4:23 PM p. 274
#15..
- 605 -
5. Perform, as the State may require, such knowledge transfer and other services as are required to allow the Services to continue without interruption or adverse effect and to facilitate orderly migration and transfer of the services to the successor provider;
6. Complete performance of such part of the work as shall not have been terminated; and
7. Take such action as may be necessary, or as the State may direct, for the protection and preservation of the property related to this Contract which is in the possession of the Contractor and in which the State has or may acquire an interest and to transfer that property to the State or a successor provider.
Contractor acknowledges that, if it were to breach, or threaten to breach, its obligation to provide the State with the foregoing assistance, the State would be immediately and irreparably harmed and monetary compensation would not be measurable or adequate. In such circumstances, the State shall be entitled to obtain such injunctive, declaratory or other equitable relief as the State deems necessary to prevent such breach or threatened breach, without the requirement of posting any bond and Contractor waives any right it may have to allege or plead or prove that the State is not entitled to injunctive, declaratory or other equitable relief. If the court should find that Contractor has breached (or attempted or threatened to breach) any such obligations, Contractor agrees that without any additional findings of irreparable injury or other conditions to injunctive or any equitable relief, Contractor will not oppose the entry of an order compelling its performance and restraining Contractor from any further breaches (or attempted or threatened breaches).
12.3 Contractor Bankruptcy. Contractor acknowledges that if Contractor, as a debtor in possession, or a trustee in bankruptcy in a case under Section 365(n) of Title 11, United States Code (the "Bankruptcy Code"), rejects this Contract, the State may elect to retain its rights under this Contract as provided in Section 365(n) of the Bankruptcy Code. Upon written request of the State to Contractor or the Bankruptcy Trustee, Contractor or such Bankruptcy Trustee shall not interfere with the rights of the State as provided in this Contract, including the right to obtain the State Intellectual Property.
13 ACCESS TO STATE DATA; RETURN OF PROPERTY
13.1 Access to State Data. Within ten (10) business days of a request by State, the Contractor will make available to State a complete and secure (i.e. encrypted and appropriately authenticated) download file of State Intellectual Property and State Data in a format acceptable to State including all schema and transformation definitions and/or delimited text files with documented, detailed schema definitions along with attachments in their native format. Provided, however, in the event the Contractor ceases conducting business in the normal course, becomes insolvent, makes a general assignment for the benefit of creditors, suffers or permits the appointment of a receiver for its business or State of Utah Bid CH16012
3/22/2016 4:23 PM p. 275
#15..
- 606 -
assets or avails itself of or becomes subject to any proceeding under the Federal Bankruptcy Act or any statute of any state relating to insolvency or the protection of rights of creditors, the Contractor shall immediately return all State Intellectual Property and State Data to State control; including, but not limited to, making all necessary access to applicable remote systems available to the State for purposes of downloading all State Data.
13.2 Return of Property. Upon termination of this Contract for any reason whatsoever, Contractor shall immediately deliver to State all State Intellectual Property and State Data (including without limitation any Deliverables for which State has made payment in whole or in part), that are in the possession or under the control of Contractor in whatever stage of development and form of recordation such State property is expressed or embodied at that time.
The Contractor’s policies regarding the retrieval of data upon the termination of services have been made available to the State upon execution of this Contract under separate cover. The Contractor shall provide the State with not less than thirty (30) days advance written notice of any material amendment or modification of such policies. 14 STATE FACILITIES
During the term of this Contract, the State may make available to Contractor space in any State facility applicable to the Services, subject to the conditions that Contractor: (i) shall only use such space solely and exclusively for and in support of the Services; (ii) shall not use State facilities to provide goods or services to or for the benefit of any third party; (iii) shall comply with the leases, security, use and rules and agreements applicable to the State facilities; (iv) shall not use State facilities for any unlawful purpose; (v) shall comply with all policies and procedures governing access to and use of State facilities that are provided to Contractor in writing; (vi) instruct Contractor personnel not to photograph or record, duplicate, disclose, transmit or communicate any State information, materials, data or other items, tangible or intangible, obtained or available as a result of permitted use of State facilities; and (vii) return such space to the State in the same condition it was in at the commencement of this Contract, ordinary wear and tear excepted. State facilities will be made available to Contractor on an “AS IS, WHERE IS” basis, with no warranties whatsoever.
15 AUDIT
15.1 Audit Rights. Contractor will maintain and cause its permitted contractors to maintain a complete audit trail of all transactions and activities, financial and nonfinancial, in connection with this Contract. Contractor will provide to the State, its internal or external auditors, clients, inspectors, regulators and other designated representatives, at reasonable times (and in the case of State or federal regulators, at any time required by such regulators) access to Contractor personnel and to any and all Contractor facilities or where the required information, data and records are maintained, for the purpose of performing audits and inspections (including unannounced and random audits) of Contractor and/or Contractor personnel and/or any or all of the records, data and information applicable to this Contract. At a minimum, such audits, inspections and access shall be conducted to the extent permitted or required by any laws applicable to the State or Contractor (or such higher or more rigorous standards, if any, as State or Contractor applies to its own State of Utah Bid CH16012
3/22/2016 4:23 PM p. 276
#15..
- 607 -
similar businesses, operations or activities), to (i) verify the accuracy of charges and invoices; (ii) verify the integrity of State Data and examine the systems that process, store, maintain, support and transmit that data; (iii) examine and verify Contractor’s and/or its permitted contractors’ operations and security procedures and controls; (iv) examine and verify Contractor’s and/or its permitted contractors’ disaster recovery planning and testing, business resumption and continuity planning and testing, contingency arrangements and insurance coverage; and (v) examine Contractor’s and/or its permitted contractors’ performance of the Services including audits of: (1) practices and procedures; (2) systems, communications and information technology; (3) general controls and physical and data/information security practices and procedures; (4) quality initiatives and quality assurance, (5) contingency and continuity planning, disaster recovery and back-up procedures for processes, resources and data; (6) Contractor’s and/or its permitted contractors’ efficiency and costs in performing Services; (7) compliance with the terms of this Contract and applicable laws, and (9) any other matters reasonably requested by the State.
Contractor shall provide and cause its permitted contractors to provide full cooperation to such auditors, inspectors, regulators and representatives in connection with audit functions and with regard to examinations by regulatory authorities, including the installation and operation of audit software.
15.2 Software Licensee Compliance Report. In lieu of any requirement that may be in a Contractor Document that the State provide the Contractor with access to its system for the purpose of determining State compliance with the terms of the Contractor Document, upon request and not more frequently than annually, the State will provide Contractor with a certified report concerning the State’s use of any software licensed for State use pursuant this Contract. The parties agree that any noncompliance indicated by the report shall not constitute infringement of the licensor’s intellectual property rights, and that settlement payment mutually agreeable to the parties shall be the exclusive remedy for any such non-compliance.
15.3 Operations Security. The Contractor shall cause an SSAE 16 SOC 2 Type 2 audit report to be conducted annually. The audit results and the Contractor’s plan for addressing or resolution of the audit results shall be shared with the State within sixty (60) days of the Contractor's receipt of the audit results. Further, on an annual basis, within 90 days of the end of the Contractor’s fiscal year, the Contractor shall transmit its annual audited financial statements to the State.
16 CONFLICTS OF INTEREST
Contractor agrees that during the term of this Contract, its performance shall be solely in the best interest of the State. Contractor will not perform services for any person or entity which has also contracted with the State of Vermont in connection with the same project, without express written consent of the State. Contractor shall fully disclose, in writing, any such conflicts of interest, including the nature and extent of the work to be performed for any other person or entity so that the State may be fully informed prior to giving any consent. Contractor agrees that the failure to disclose any such conflicts shall be deemed State of Utah Bid CH16012
3/22/2016 4:23 PM p. 277
#15..
- 608 -
an event of default under this Contract, and this Contract shall be terminable immediately.
17 MISCELLANEOUS
17.1 Taxes. Most State purchases are not subject to federal or state sales or excise taxes and must be invoiced tax free. An exemption certificate will be furnished upon request covering taxable items. The Contractor agrees to pay all Vermont taxes which may be due as a result of this Contract.
17.2 Force Majeure. Neither the State nor the Contractor shall be liable to the other for any failure or delay of performance of any obligations hereunder to the extent such failure or delay shall have been wholly or principally caused by acts or events beyond its reasonable control making it illegal or impossible to perform their obligations under this Contract, including without limitation, acts of God, acts of civil or military authority, fires, floods, earthquakes or other natural disasters, war or riots.
If a party asserts Force Majeure as an excuse for failure to perform the party’s obligation, then the nonperforming party must prove that it made all reasonable efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued performance of its obligations under this Contract, substantially fulfilled all non-excused obligations, and timely notified the other party of the likelihood or actual occurrence of an event described in this paragraph.
17.3 Marketing. Neither party to this Contract shall refer to the other party in any publicity materials, information pamphlets, press releases, research reports, advertising, sales promotions, trade shows, or marketing materials or similar communications to third parties except with the prior written consent of such party prior to release.
18 IRS TERMS IF FEDERAL TAX INFO WILL BE PROCESSED OR STORED (Per IRS Publication 1075)
In addition to any other security standard or requirements set forth in this Contract, the Contractor agrees as follows:
A. PERFORMANCE
In performance of this Contract, the Contractor agrees to comply with and assume responsibility for compliance by its employees with the following requirements:
1. All work will be done under the supervision of the Contractor or the Contractor's employees.
2. Any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this Contract.
Disclosure to anyone other than an officer or employee of the Contractor will be prohibited.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 278
#15..
- 609 -
3. All returns and return information will be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.
4. The Contractor certifies that the data processed during the performance of this Contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the Contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the Contractor certifies that any IRS data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.
5. Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the State or his or her designee. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and will provide the State or its designee with a statement containing the date of destruction, description of material destroyed, and the method used.
6. All computer systems processing, storing, or transmitting Federal tax information must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to Federal tax information.
7. No work involving Federal tax information furnished under this Contract will be subcontracted without prior written approval of the IRS.
8. The Contractor will maintain a list of employees authorized access. Such list will be provided to the State and, upon request, to the IRS reviewing office.
9. The State will have the right to void the Contract if the Contractor fails to provide the safeguards described above.
B. CRIMINAL/CIVIL SANCTIONS:
1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.
2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and State of Utah Bid CH16012
3/22/2016 4:23 PM p. 279
#15..
- 610 -
shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431.
3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a.
Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.
C. INSPECTION:
The IRS and the State shall have the right to send its officers and employees into the offices and plants of the Contractor for inspection of the facilities and operations provided for the performance of any work under this Contract. On the basis of such inspection, specific measures may be required in cases where the Contractor is found to be noncompliant with Contract safeguards.
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 280
#15..
- 611 -
AICPA
TSC 2009
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
TSC
2014
BITS Shared
Assessments
AUP v5.0
BITS Shared
Assessments
SIG v6.0
BSI
Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA
Guidance
V3.0
ENISA IAF
95/46/EC - European
Union Data Protection
Directive
FedRAMP Security
Controls
(Final Release, Jan
2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA
GAPP
(Aug
2009)
HIPAA/HITECH
(Omnibus
Rule)
ISO/IEC
27001:2005
ISO/IEC
27001:2013 ITAR Jericho Forum
Mexico - Federal Law on
Protection of Personal
Data Held by Private
Parties
NERC
CIP NIST SP800-53 R3 NIST SP800-53 R4 Appendix J NZISM PCI DSS v2.0 PCI DSS v3.0 Yes No Not
Applicable
Domain >
Container >
Capability
Public Private PA ID PA level
AIS-01.1 Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology
Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?
AIS-01.2 Do you use an automated source code analysis tool to detect security defects in code prior to production?
AIS-01.3 Do you use manual source-code analysis to detect security defects in code prior to production?
AIS-01.4 Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
AIS-01.5 (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
AIS-02.1 Are all identified security, contractual and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets and information systems? AIS- 02.2 Are all requirements and trust levels for customers’ access defined and documented?
Application & Interface
Security
Data Integrity
AIS-03 AIS-03.1 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.
Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?
S3.4 (I3.2.0) The procedures related to completeness,
accuracy, timeliness, and authorization of inputs
are consistent with the documented system
processing integrity policies.
(I3.3.0) The procedures related to completeness,
accuracy, timeliness, and authorization of system
processing, including error correction and database
management, are consistent with documented
system processing integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.
(I3.5.0) There are procedures to enable tracing of
information inputs from their source to their final
disposition and vice versa.
PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-05 DSS06.02
DSS06.04
312.8 and 312.10 Application
Services >
Programming
Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11
1.2.6 45 CFR 164.312
(c)(1) (New)
45 CFR 164.312
(c)(2)(New)
45 CFR
164.312(e)(2)(i)(
New)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment
#11
CIP-003-3 -
R4.2
SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.
14.5 14.6
PA25 GP PCI DSS v2.0
6.3.1 PCI DSS v2.0
6.3.2 6.3.1
6.3.2 Application & Interface
Security
Data Security / Integrity
AIS-04 AIS-04.1 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alternation, or destruction.
Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?
(S3.4) Procedures exist to protect against
unauthorized access to system resources.
CC5.6 B.1 G.8.2.0.2,
G.8.2.0.3,
G.12.1, G.12.4,
G.12.9,
G.12.10,
G.16.2,
G.19.2.1,
G.19.3.2,
G.9.4, G.17.2,
G.17.3, G.17.4,
G.20.1
6 (B)
26 (A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-03 COBIT 4.1 DS5.11 APO09.01
APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and 312.10 BOSS > Data
Governance >
Rules for
Information
Leakage
Prevention
shared x Domain 10 6.02. (b)
6.04.03. (a)
Article 17 (1), (2),(3), (4) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8
1.1.0 1.2.2
1.2.6 4.2.3
5.2.1 7.1.2
7.2.1 7.2.2
7.2.3 7.2.4
8.2.1 8.2.2
8.2.3 8.2.5
9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.
16.5 16.8
17.4 PA20
PA25
PA29
GP
P
SGP
PCI DSS v2.0
2.3 PCI DSS v2.0
3.4.1,
PCI DSS v2.0
4.1 PCI DSS v2.0
4.1.1 PCI DSS v2.0
6.1 PCI DSS v2.0
6.3.2a
PCI DSS v2.0
6.5c
PCI DSS v2.0
8.3 PCI DSS v2.0
10.5.5 PCI DSS v2.0
11.5 2.3
3.4.1 4.1
4.1.1 6.1
6.3.2a
6.5c, 7.1, 7.2, 7.3,
8.1, 8.2, 8.3, 8.4,
8.5, 8.6, 8.7, 8.8
10.5.5, 10.8
11.5, 11.6
Audit Assurance &
Compliance
Audit Planning
AAC01AAC-01.1 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.
Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.
CC4.1 L.1, L.2, L.7,
L.9, L.11
58 (B) CO-01 COBIT 4.1 ME
2.1, ME 2.2 PO
9.5 PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16 Part 312 BOSS >
Compliance >
Audit Planning
shared x Domain 2,
4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6
10.2.5 45 CFR
164.312(b)
Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses
4.3(a),
4.3(b),
5.1(e),
5.1(f),
6.2(e),
9.1,
9.1(e),
9.2,
9.3(f),
Commandment #1
Commandment #2
Commandment #3
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance,
management,
operational, and technical
controls by conducting
regular assessments
5.1, 5.3, 5.4 PA15 SGP PCI DSS v2.0
2.1.2.b
AAC-02.1 Do you allow tenants to view your SOC2/ISO 27001 or similar thirdparty audit or certification reports? AAC-02.2 Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.3 Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.4 Do you conduct internal audits regularly as prescribed by industry best practices and guidance?
AAC-02.5 Do you conduct external audits regularly as prescribed by industry best practices and guidance?
AAC-02.6 Are the results of the penetration tests available to tenants at their request?
AAC-02.7 Are the results of internal and external audits available to tenants at their request?
AAC-02.8 Do you have an internal audit program that allows for crossfunctional audit of assessments? AAC-03.1 Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?
AAC-03.2 Do you have capability to recover data for a specific customer in the case of a failure or data loss?
AAC-03.3 Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?
AAC-03.4 Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? BCR-01.1 Do you provide tenants with geographically resilient hosting options? BCR-01.2 Do you provide tenants with infrastructure service failover capability to other providers?
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 BCR-02.1 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.
Are business continuity plans subject to test at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?
A3.3 (A3.3) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
A1.2 K.1.3, K.1.4.3,
K.1.4.6,
K.1.4.7,
K.1.4.8,
K.1.4.9,
K.1.4.10,
K.1.4.11,
K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS >
Operational Risk
Management >
Business
Continuity
provider x Domain 7,
8 6.07.01. (b)
6.07.01. (j)
6.07.01. (l)
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
45 CFR 164.308
(a)(7)(ii)(D)
A.14.1.5 A17.3.1 Commandment #1
Commandment #2
Commandment #3
CP-2
CP-3
CP-4
4.4 5.2(time limit)
6.3(whenever change
occurs)
PA15 SGP PCI DSS v2.0
12.9.2 12.9.2, 12.10.2
BCR-03.1 Do you provide tenants with documentation showing the transport route of their data between your systems?
BCR-03.2 Can tenants define how their data is transported and through which legal jurisdictions?
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 BCR-04.1 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system • Effectively using the system’s security features
Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?
S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that
personnel responsible for the design,
development, implementation, and operation of
systems affecting security have the qualifications
and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective
description of the system and its boundaries and
communicated such description to authorized
users.
CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
OP-02 COBIT 4.1 DS 9,
DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies
and Standards >
Job Aid Guidelines
shared x Domain 7,
8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-005-
3a - R1.3
CIP-007-3 -
R9
CP-9
CP-10
SA-5
SA-10
SA-11
10.5 13.5
17.1 PCI DSS v2.0
12.1 PCI DSS v2.0
12.2 PCI DSS v2.0
12.3 PCI DSS v2.0
12.4 1.1.2, 1.1.3, 2.2,
12.3 12.6
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 BCR-05.1 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.
Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-05 DSS01.03
DSS01.04
DSS01.05
Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)
6.08. (a)
6.09. (a)
6.09. (b)
6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
8.2.4 45 CFR 164.308
(a)(7)(i)
45 CFR
164.310(a)(2)(ii)
(New)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
CIP-004-3
R3.2
PE-1
PE-13
PE-14
PE-15
PE-18
8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,
5.1, 5.2, 5.3,
6.1, 6.2,
7.1, 7.2,
9.1, 9.2, 9.3, 9.4,
9.5, 9.6,
9.7, 9.8, 9.9,
12.2 Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 BCR-06.1 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.
Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
53 (A+)
75 (C+,
A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-06 DSS01.04
DSS01.05
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)
6.08. (a)
6.09. (a)
6.09. (b)
6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
45 CFR 164.310
(c)
A.9.2.1 A11.2.1 Commandment #1
Commandment #2
Commandment #3
PE-1
PE-5
PE-14
PE-15
PE-18
8.1 PA15 SGP PCI DSS v2.0
9.1.3 PCI DSS v2.0
9.5 PCI DSS v2.0
9.6 PCI DSS v2.0
9.9 PCI DSS v2.0
9.9.1 9.1.3
9.5 9.6
9.9 9.9.1, 12.2
BCR-07.1 If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities? BCR-07.2 If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time? BCR-07.3 If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider?
BCR-07.4 If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location?
BCR-07.5 Does your cloud solution include software/provider independent restore and recovery capabilities?
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 BCR-08.1 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?
A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk
assessment when commercially practicable.
A1.1
A1.2
F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
54 (A+) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-07 DSS01.04
DSS01.05
DSS04.01
DSS04.02
DSS04.03
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.08. (a)
6.09. (e)
6.09. (f)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
A.9.2.2
A.9.2.3
A 9.2.4
A.11.2.2,
A.11.2.3,
A.11.2.4
Commandment #1
Commandment #2
Commandment #3
CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14
8.1 8.2
8.3 8.4
PA15 SGP
BCR-09.1 Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?
BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants?
BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance?
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 BCR-10.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.
Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data,
processing integrity, system security and related
security policies and changes and updates to those
policies are communicated to entity personnel
responsible for implementing them.
CC3.2 G.1.1 45 (B) OP-01 COBIT 4.1 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Domain 7,
8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12
PCI DSS v2.0
12.1 PCI DSS v2.0
12.2 PCI DSS v2.0
12.3 PCI DSS v2.0
12.4 4.3, 10.8,
11.1.2,
12.1 12.2
12.3 12.4
12.5, 12.5.3,
12.6, 12.6.2,
12.10 BCR-11.1 Do you have technical control capabilities to enforce tenant data retention policies?
BCR-11.2 Do you have a documented procedure for responding to requests for tenant data from governments or third parties?
BCR-11.4 Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
BCR-11.5 Do you test your backup or redundancy mechanisms at least annually?
CCC-01.1 Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities?
CCC-01.2 Is documentation available that describes the installation, configuration and use of products/services/features?
CCC-02.1 Do you have controls in place to ensure that standards of quality are being met for all software development?
CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities?
Consensus Assessment Answers Notes
4.1.1, 4.2, 4.3
11.2 11.3
6.3.2, 6.6
11.2.1, 11.2.2,
11.2.3, 11.3.1,
11.3.2, 12.1.2.b,
12.8.4 3.1
12.9.1 12.9.3
12.9.4 12.9.6
4.1, 4.1.1, 9.1, 9.2
10.8, 11.6
3.1 3.1.a
3.2 9.9.1
9.5. 9.5.1
9.6. 9.7, 9.8
10.7, 12.10.1
6.3.2, 12.3.4
2.1, 2.2.4, 2.3, 2.5
3.3, 3.4, 3.6
4.1, 4.2
6.3.1, 6.3.2, 6.4.2,
6.4.3, 6.4.4,
6.4.5.2 6.7
7.1, 7.1.3, 7.1.4
8.3, 8.5.1, 8.7
9.1 9.1.2
9.2 10.5
11.5 12.3
12.8 BSGP
SGP
PA17 SGP
ODCA UM: PA R2.0
PA17
PA31
SGP
BSGP
PA18 GP
PA15 SGP
PA8
PA15
BSGP
SGP
PA8
PA15
14.5 14.6
9.2 6.1
1.2 2.2
3.3 5.2
6.4 10.1
10.2 10.3
10.4 10.5
10.6 3.3
12.1 12.5
14.5 (software)
6.4 6.4
13.1 12.1
2.2 4.1
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.
AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.
AR-4. Privacy Auditing
and Monitoring. These
assessments can be selfassessments or third
party audits that result in
reports on compliance
gaps identified in
programs, projects, and
information systems.
UL-2 INFORMATION
SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII)
externally, only for the
authorized purposes
identified in the Privacy
Act and/or described in its
notice(s) or for a purpose
that is compatible with
those purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of
Agreement, Letters of
Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and
specifically enumerate
the purposes for which
the PII may be used; c.
Monitors, audits, and
trains its staff on the
authorized sharing of PII
with third parties and on
the consequences of
unauthorized use or
sharing of PII; and d.
Evaluates any proposed
new instances of sharing
PII with third parties to
assess whether the
sharing is authorized and
whether additional or
new public notice is
required.
FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.
Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m
ITOS > IT
Operation >
Architecture
Governance
shared x
CSA Enterprise Architecture (formerly the Trusted
Cloud Initiative)
Application
Services >
Development
Process >
Software Quality
Assurance
shared x
BOSS > Legal
Services >
Contracts
shared x
BOSS >
Compliance >
Independent
Audits
shared x
BOSS >
Compliance >
Information
System
Regulatory
Mapping
shared x
BOSS >
Operational Risk
Management >
Business
Continuity
provider x
Infra Services >
Facility Security >
Environmental
Risk
Management
x
312.8 and 312.10
312.3, 312.8 and
312.10
Title 16 Part 312
312.4
312.8 and 312.10
312.3
APO09.03
APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
APO09.01
APO09.02
APO09.03
APO13.01
BAI02
DSS05
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
APO12.01
APO12.02
APO12.03
MEA03.01
DSS04.01
DSS04.02
DSS04.03
DSS04.05
DSS01.03
DSS01.04
DSS01.05
DSS04.03
BAI03.10
BAI04.03
BAI04.04
DSS03.05
BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
APO01.02
APO01.06
BAI02.04
BAI06.01
APO07.06
APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05
CC5.1
CC4.1
CC3.1
CC3.1
A1.2
A1.3
A1.1
A1.2
A1.3
A1.1
A1.2
CC4.1
CC3.1
A1.2
A1.3
A1.2
A1.3
I3.21
CC7.2
CC7.1
CC7.4
CC7.1
CC7.4
ITOS > IT
Operation >
Architecture
Governance
shared PCI DSS v2.0
6.3.2 Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).
S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system availability, confidentiality of data,
processing integrity, systems security and related
security policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.
C.2
I.1
I.2
I.4
C.2.4, G.4, G6,
I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8,
I.2.9, I.2.15,
I.2.18,
I.2.22.6,
I.2.7.1, I.2.13,
I.2.14, I.2.17,
I.2.20,
I.2.22.2,
I.2.22.4,
I.2.22.7,
I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14, I.3,
J.1.2.10, L.7,
L.9, L.10
27 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-04 None NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
1 (B)
Commandment #1
Commandment #2
Commandment #3
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13
PCI DSS v2.0
3.6.7 PCI DSS v2.0
6.4.5.2 PCI DSS v2.0
7.1.3 PCI DSS v2.0
8.5.1 PCI DSS v2.0
9.1 PCI DSS v2.0
9.1.2 PCI DSS v2.0
9.2b
PCI DSS v2.0
9.3.1 PCI DSS v2.0
10.5.2 PCI DSS v2.0
11.5 PCI DSS v2.0
12.3.1 PCI DSS v2.0
12.3.3 Chapter II
Article 11, 13
CIP-003-3 -
R4.1
CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
PCI DSS v2.0
3.1 PCI DSS v2.0
3.1.1 PCI DSS v2.0
3.2 PCI DSS v2.0
9.9.1 PCI DSS v2.0
9.5 PCI DSS v2.0
9.6 PCI DSS v2.0
10.7 Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been preauthorized by the organization's business leadership or other accountable business role or function.
S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system
components, including configurations consistent
with the defined system security policies.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.
I.2 I.1.1, I.1.2, I.2.
7.2, I.2.8,
I.2.9, I.2.10,
I.2.13, I.2.14,
I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-01 COBIT 4.1 A12, A
16.1 None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
1.2.6 BOSS > Data
Governance >
Data Retention
Rules
Business Continuity shared x
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.
A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.
(I3.20.0) Procedures exist to provide for
restoration and disaster recovery consistent with
the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the
completeness, accuracy, and timeliness of backup
data and systems.
D.2.2.9 36 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.
4.5.2 DG-04 COBIT 4.1 DS 4.1,
DS 4.2, DS 4.5,
DS 4.9, DS 11.6
Domain 5 6.03. (h)
6.07.01. (c)
Article 6(1) e NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
5.1.0 5.1.1
5.2.2 8.2.6
CIP-007-3 -
R6.1 -
R6.2 -
R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6
A11.2.4
A.17.1.1
A.17.1.2
Clauses
9.2(g)
7.5.3(b)
5.2 (c)
7.5.3(d)
5.3(a)
5.3(b)
8.1 8.3
A.12.3.1
A.8.2.3
Commandment #1
Commandment #2
Commandment #3
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4
45 CFR 164.308
(a)(7)(ii)(E)
ISO/IEC
27001:2005
A.14.1.2
A 14.1.4
Commandment #1
Commandment #2
Commandment #3
CIP-007-3 -
R8 - R8.1 -
R8.2 -
R8.3
RA-3
A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
45 CFR 164.308
(a)(7)(ii)(A)
45 CFR 164.310
(d)(2)(iv)
45 CFR
164.308(a)(7)(ii)
(D) (New)
45 CFR
164.316(b)(2)(i)
(New)
Clause 4.3.3
A.10.5.1
A.10.7.3
EAR 15 §
762.6
Period of
Retention
EAR 15
CFR §
786.2
Recordke
eping
Commandment
#11
Commandment #2
Commandment #5
Commandment
#11
45 CFR 164.310
(a)(2)(iv)
A.9.2.4
BSGP
SGP
PA10
PA29
COBIT 4.1 A13.3 Domain 7,
8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6
5.2.3 8.2.2
8.2.3 8.2.4
8.2.5 8.2.6
8.2.7 Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.
K.2 RS-02 Domain 7,
8 6.02. (a)
6.03.03. (c)
6.07. (a)
6.07. (b)
6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
Infra Services >
Equipment
Maintenance >
provider x
ITOS > Service
Delivery >
Information
Technology
Resiliency -
Resiliency
Analysis
A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.
F.2.19
PCI DSS v2.0
3.1.1 PCI DSS v2.0
3.1 45 CFR 164.308
(a)(7)(i)
45 CFR 164.308
(a)(7)(ii)(B)
45 CFR 164.308
(a)(7)(ii)(C)
45 CFR 164.308
(a)(7)(ii)(E)
45 CFR 164.310
(a)(2)(i)
45 CFR 164.312
(a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Commandment #1
Commandment #2
Commandment #3
ISO/IEC
27001:2005
Clause 4.2.1 b)
2)
Clause 4.2.1 c)
1)
Clause 4.2.1 g)
Clause 4.2.3 d)
6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses
4.2(b),
4.4,
5.2(c),
5.3(ab),
6.1.2,
6.1.3,
6.1.3(b),
7.5.3(b),
7.5.3(d),
8.1,
8.3 9.2(g),
9.3,
9.3(b),
9.3(f),
10.2,
A.8.2.1,
Clause 5.1(h)
A.17.1.2
A.17.1.2
A11.2.2,
A11.2.3
CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
PCI DSS v2.0
12.9.1 PCI DSS v2.0
12.9.3 PCI DSS v2.0
12.9.4 PCI DSS v2.0
12.9.6 PE-1
PE-4
PE-13
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment
#11
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
Business Continuity
Management &
Operational Resilience
Power /
Telecommunications
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls,
telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.
A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against
unauthorized access to system resource.
F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
9 (B)
10 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-08 Domain 7,
8 6.08. (a)
6.09. (c)
6.09. (f)
6.09. (g)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13
(1)
NIST SP800-53 R3 PE-13
(2)
NIST SP800-53 R3 PE-13
(3)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
provider x
COBIT 4.1 ME 3.1 Domain 2,
4 1.2.5
1.2.7 4.2.1
8.2.7 10.2.3
10.2.5 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18
1.2.6 Audit Assurance &
Compliance
Independent Audits
Domain 10
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.
K.1.2.3.
K.1.2.4,
K.1.2.5,
K.1.2.6,
K.1.2.7,
K.1.2.11,
K.1.2.13,
K.1.2.15
RS-03 Domain 7,
8 6.07. (a)
6.07. (b)
6.07. (c)
Article 17 (1), (2) NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17
AAC02Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures and compliance obligations.
S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.
L.2, L.4, L.7,
L.9, L.11
58 (B)
59 (B)
61 (C+,
A+)
76 (B)
77 (B)
CC7.1 COBIT 4.1 AI2.4
CCM v3.0.1 Compliance Mapping
45 CFR 6, 6.5
164.312(e)(2)(i)
A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-007-3 -
R5.1
SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
PCI DSS v2.0
6.5 Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, (removed all) identified security, contractual, and regulatory requirements for customer access shall be addressed.
Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section 1
Article 39, I. and VIII.
Chapter 8
Article 59
CIP-003-3 -
R1.3 -
R4.3
CIP-004-3
R4 - R4.2
CIP-005-
3a - R1 -
R1.1 -
R1.2
CA-1
CA-2
CA-6
RA-5
PCI DSS v2.0
11.2 PCI DSS v2.0
11.3 PCI DSS v2.0
6.6 PCI DSS v2.0
12.1.2.b
COBIT 4.1 DS5.5,
ME2.5, ME 3.1
PO 9.6
Domain 2,
4 6.03. (e)
6.07.01. (m)
6.07.01. (n)
A9.4.2
A9.4.1,
8.1*Partial,
A14.2.3,
8.1*partial,
A.14.2.7
A12.6.1,
A18.2.2
A9.1.1.
Clauses
4.3(a),
4.3(b),
5.1(e),
5.1(f),
9.1,
9.2,
9.3(f),
A18.2.1
Schedule 1 SA-01
(Section 5) 4.1
Accountability,
Subs. 4.1.3
Control Group CGID CID Control Specification Consensus Assessment Questions Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.
S3.10.0 (S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined processing integrity and related security
policies.
I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-04
C.2.1, C.2.3,
C.2.4, C.2.6.1,
H.1
10 (B)
11 (A+)
(S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.
CO-02
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC03Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.
Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.
OP-04
CONSENSUS ASSESSMENTS INITIATIVE
QUESTIONNAIRE v3.0.1
Commandment #6
Commandment #7
Commandment #8
CA-1
CA-2
CA-5
CA-6
A.6.2.1
A.6.2.2
A.11.1.1
1.2.2 1.2.6
6.2.1 6.2.2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
Domain 10 Article 17 (1), (2)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
S3.2a
45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
provider x
A.9.2.2
A.9.2.3
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* (partial)
A.14.2.7
A.18.1.3
A.18.1.4
A18.2.1
A.15.1.2
A.12.1.4
8.1* (partial)
8.1* (partial)
A.15.2.1
8.1* (partial)
A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* (partial)
A.14.2.2
8.1* (partial)
A.14.2.3
8.1* (partial)
A.14.2.4
8.1* (partial)
A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 281
#15..
- 612 -
CCC-03.1 Do you provide your tenants with documentation that describes your quality assurance process?
CCC-03.2 Is documentation describing known issues with certain products/services available?
CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?
CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 CCC-04.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.
Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.
CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13,
G.20.2,G.20.4,
G.20.5, G.7,
G.7.1, G.12.11,
H.2.16,
I.2.22.1,
I.2.22.3,
I.2.22.6, I.2.23
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-05 APO13.01
BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
312.8 and 312.10 ITOS > Service
Support >
Configuration
Management ->
Software
Mangement
shared x None NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1
8.1* (partial)
A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures
to protect against loss
and the unauthorized
access, destruction, use,
or disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.
Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
14.1 1.3.3
2.1, 2.2.2
3.6 4.1
5.1, 5.2, 5.3, 5.4
6.2 7.1
9.1 9.1.1
9.1.2 9.1.3
9.2 9.3
9.4 9.4.1
9.4.2 9.4.3
10.1, 10.2, 10.3,
10.4, 10.5, 10.6,
10.7 11.1, 11.4, 11.5
12.3 Change Control &
Configuration
Management
Production Changes
CCC-05 CCC-05.1 Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant) impacting (physical and virtual) application and systemsystem interface (API) designs and configurations, as well as infrastructure network and systems components. Technical measures shall be implemented to provide assurance that, prior to deployment, all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA).
Do you provide tenants with documentation that describes your production change management procedures and their
roles/rights/responsibilities within it?
A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that
only authorized, tested, and documented changes
are made to the system.
CC7.4
CC7.4
I.2.17, I.2.20,
I.2.22
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-02 COBIT 4.1 A16.1,
A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service
Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
1.2.6 45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4
8.1* (partial)
A.14.2.2
8.1* (partial)
A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment
#11
CIP-003-3 -
R6
CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.
Organizations also: (i)
implement technology to
audit for the security,
appropriate use, and loss
of PII; (ii) perform
reviews to ensure
physical security of
documents containing
PII; (iii) assess contractor
compliance with privacy
requirements; and (iv)
ensure that corrective
actions identified as part
of the assessment
process are tracked and
monitored until audit
findings are corrected.
The organization Senior
Agency Official for
Privacy (SAOP)/Chief
Privacy Officer (CPO)
coordinates monitoring
and auditing efforts with
information security
12.1 12.4
PA14 SGP PCI DSS v2.0
1.1.1 PCI DSS v2.0
6.3.2 PCI DSS v2.0
6.4 PCI DSS v2.0
6.1 1.1.1
6.3.2 6.4.5
DSI-01.1 Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?
DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?
DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?
DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?
DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?
DSI-02.1 Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?
DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?
DSI-03.1 Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
DSI-04.1 Are policies and procedures established for labeling, handling and the security of data and objects that contain data?
DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
Data Security &
Information Lifecycle
Management
Nonproduction Data
DSI-05 DSI-05.1 Production data shall not be replicated or used in non-production environments.
Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
C3.5.0
S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that
confidential information is protected during the
system development, testing, and change
processes in accordance with defined system
confidentiality and related security policies.
C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04
SRM > Policies
and Standards >
Technical
Standard (Data
Management
Security
Standard)
shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
1.2.6 45 CFR
164.308(a)(4)(ii)
(B)
A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1
8.1* (partial)
A.14.2.2.
Commandment #9
Commandment
#10
Commandment
#11
CIP-003-3 -
R6
SA-11
CM-04
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1
INVENTORY OF
PERSONALLY
IDENTIFIABLE
INFORMATION
17.8 PCI DSS v2.0
6.4.3 6.4.3
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 DSI-06.1 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.
Are the responsibilities regarding data stewardship defined, assigned, documented and communicated?
S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary
CC2.3
CC3.1
C.2.5.1,
C.2.5.2, D.1.3,
L.7
Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.
4.1.3 DG-01 COBIT 4.1 DS5.1,
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data
Governance >
Data Ownership /
Stewardship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
6.2.1 45 CFR 164.308
(a)(2)
A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment
#10
Chapter IV
Article 30
CIP-007-3 -
R1.1 -
R1.2
CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2 PURPOSE
SPECIFICATION.
3.4 3.7
12.5.5 12.10.4
DSI-07.1 Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?
DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
DCS-01.1 Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?
Datacenter Security
Controlled Access
Points
DCS02DCS-02.1 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.
Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) implemented? A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-03 COBIT 4.1 DS
12.3 APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services >
Facility Security >
Controlled
Physical Access
provider x Domain 8 6.08. (a)
6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18
99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18
8.1 8.2
PA4 BSGP PCI DSS v2.0
9.1 9.1
9.1.1 9.1.2, 9.1.3
9.2, 9.3, 9.4, 9.4.1,
9.4.2, 9.4.3, 9.4.4
Datacenter Security
Equipment
Identification
DCS03DCS-03.1 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.
Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?
S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.
CC5.1 D.1 D.1.1, D.1.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-13 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
312.3, 312.8 and
312.10
> > Domain 8 6.05. (a) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
IA-3
IA-4
PA22
PA33
GP
SGP
Datacenter Security
Offsite Authorization
DCS04DCS-04.1 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.
Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another? (e.g., offsite backups, business continuity failovers, replication) S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage,
backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access
to the defined system including, but not limited to:
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-06 EDM05.02
APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01
312.8 and 312.10 SRM > Facility
Security > Asset
Handling
provider x Domain 8 6.08. (a)
6.09. (j)
Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17
45 CFR 164.310
(d)(1) (New)
A.9.2.7
A.10.1.2
A.11.2.6
A.11.2.7
Commandment #4
Commandment #5
Commandment
#11
AC-17
MA-1
PE-1
PE-16
PE-17
12.5 19.1
PA4 BSGP PCI DSS v2.0
9.8 PCI DSS v2.0
9.9 9.6.3
Datacenter Security
Offsite equipment
DCS05DCS-05.1 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed.
Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
CC5.6 D.1 D.1.1, D.2.1.
D.2.2,
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-07 APO09.03
APO10.04
APO10.05
APO13.01
DSS01.02
312.8 and 312.10 BOSS > Data
Governance >
Secure Disposal
of Data
provider x Domain 8 6.05. (a)
6.05. (b)
6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310
(c )
45 CFR 164.310
(d)(1) (New)
45 CFR 164.310
(d)(2)(i) (New)
A.9.2.5
A.9.2.6
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
CM-8 12.6 PA4 BSGP PCI DSS v2.0
9.8 PCI DSS v2.0
9.9 PCI DSS v2.0
9.10 9.8, 9.8.1, 9.8.2
12.3 DCS-06.1 Can you provide evidence that policies, standards and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities and secure areas? DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards and procedures?
Datacenter Security
Secure Area
Authorization
DCS07DCS-07.1 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.
Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-04 DS 12.2, DS 12.3 APO13.01
APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)
6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18
99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4
PE-7
PE-16
PE-18
8.2 8.1
PA4 BSGP PCI DSS v2.0
9.1 PCI DSS v2.0
9.1.1 PCI DSS v2.0
9.1.2 PCI DSS v2.0
9.1.3 PCI DSS v2.0
9.2 9.1
9.1.1 9.1.3
Datacenter Security
Unauthorized Persons
Entry
DCS08DCS-08.1 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.
Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
CC5.5 G.21 F.2.18 Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-05 COBIT 4.1 DS
12.3 APO13.01
APO13.02
DSS05.05
DSS06.03
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)
6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16
99.31.a.1.ii 8.2.5
8.2.6 A.9.1.6 A.11.2.5
8.1* (partial)
A.12.1.2
Commandment #6
Commandment #7
MA-1
MA-2
PE-16
8.1 8.2
8.3 8.4
PA4 BSGP 9.1
9.1.1 9.1.2
9.2 9.3
9.4 9.4.1
9.4.2 9.4.3 Datacenter Security
User Access
DCS09DCS-09.1 Physical access to information assets and functions by users and support personnel shall be restricted.
Do you restrict physical access to information assets and functions by users and support personnel?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-02 APO13.01
APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services >
Facility Security >
Domain 8 6.08. (a)
6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18
99.31.a.1.ii 8.2.3 45 CFR
164.310(a)(1)
(New)
45 CFR
164.310(a)(2)(ii)
(New)
45 CFR
164.310(b)
(New)
45 CFR 164.310
( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Chapter II,
Article 19
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-18
8.1 8.2
PA4
PA13
PA24
BSGP
SGP
P
PCI DSS v2.0
9.1 9.1
9.1.1 9.1.2
9.2 9.3
9.4 9.4.1
9.4.2 9.4.3
9.4.4 9.5
9.5.1 Encryption & Key
Management
Entitlement
EKM01EKM-01.1 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.
Do you have key management policies binding keys to identifiable owners?
APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
SRM >
Cryptographic
Services > Key
Management
Annex
A.10.1
A.10.1.1
A.10.1.2
PA36 3.5, 7.1.3
8.1 8.1.1
8.2.2 EKM-02.1 Do you have a capability to allow creation of unique encryption keys 8.5 per tenant?
EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?
EKM-02.3 Do you maintain key management procedures?
EKM-02.4 Do you have documented ownership for each stage of the lifecycle of encryption keys?
EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?
EKM-03.1 Do you encrypt tenant data at rest (on disk/storage) within your environment?
EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g. identity-based encryption)?
EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? EKM-04.1 Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?
EKM-04.2 Are your encryption keys maintained by the cloud consumer or a trusted key management provider?
EKM-04.3 Do you store encryption keys in the cloud?
EKM-04.4 Do you have separate key management and key usage duties? GRM01.1Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
GRM01.2Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
GRM01.3Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?
GRM02.1Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
GRM02.2Do you conduct risk assessments associated with data governance requirements at least once a year?
Governance and Risk
Management
Management
Oversight
GRM03GRM03.1Managers are responsible for maintaining awareness of, and complying with, security policies, procedures and standards that are relevant to their area of responsibility.
Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of
responsibility?
S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
CC3.2
E.1 E.4 5 (B)
65 (B)
Schedule 1
(Section 5) 4.1
Accountability; 4.7
Safeguards, Sub
4.7.4 IS-14 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
COBIT 4.1 DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 3,
9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program
3.2 PCI DSS v2.0
12.6.1 PCI DSS v2.0
12.6.2 12.6, 7.3, 8.8, 9.10
6.1 6.2
6.3 6.4
6.5 6.6
6.7 3.1
9.6.1, 9.7.1
9.10 12.3
1.1.3 12.3.3
2.1.1 3.1
4.1 4.1.1
4.2 9.5, 9.5.1
9.6 9.7
9.8 9.9
3.1.1 9.8, 9.8.1, 9.8.2,
3.1 9.7.1
9.9 9.9.1
9.1 9.1.1
9.1.2 9.2
9.3 9.4
9.4.1 9.4.2
9.4.3 9.4.4
3.4.1 3.5
3.5.1 3.5.2
3.6 3.6.1
3.6.2 3.6.3
3.6.4 3.6.5
3.6.6 3.6.7
3.6.8,
4.1 6.5.3
8.2.1 8.2.2
2.1.1 2.3
3.3 3.4
3.4.1 4.1
4.1.1 4.2
4.3 6.5.3
6.5.4 8.2.1
3.5.2, 3.5.3
3.6.1, 3.6.3
1.1 1.1.1
1.1.2 1.1.3
1.1.4 1.1.5
1.1.6 2.2
2.2.1 2.2.2
2.2.3 2.2.4
12.2 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP
PA4 BSGP
PA36
PA25 GP
PA10
PA18
BSGP
GP
PA10 SGP
PA25
PA21
PA5
GP
GP
BSGP
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP
12.1 14.1
14.2 13.1
13.4 13.5
12.3 4.2
8.1 16.2
16.1 4.4
5.1 3.3
4.3 8.4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3
DISSEMINATION OF
PRIVACY PROGRAM
INFORMATION
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research.
TR-2 SYSTEM OF
RECORDS NOTICES AND
PRIVACY ACT
STATEMENTS
TR-2 SYSTEM OF
RECORDS NOTICES AND
PRIVACY ACT
STATEMENTS
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1
INVENTORY OF
PERSONALLY
IDENTIFIABLE
INFORMATION
DM-2 DATA RETENTION
AND DISPOSAL
99.31.(a)(1)(ii)
ITOS > Service
Support >
Configuration
Management -
Physical
Inventory
provider x
SRM > Policies
and Standards >
Information
Security Policies
(Facility Security
Policy)
provider x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption,
Cryptographic
Services - Data-inTransit Encryption
shared x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM >
Governance Risk
& Compliance >
Technical
Standards
BOSS >
Operational Risk
Management >
Independent Risk
Management
shared x
ITOS > Service
Support > Release
Management
shared x
BOSS > Data
Governance >
Data
Classification
shared x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
shared x
shared x
312.3
312.8 and 312.10
312.2
312.3
312.8 and 312.10
312.8 and 312.10
312.1
APO11.01
APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
APO01.06
APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO13.01
BAI09.03
DSS01.01
APO01.06
APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO13.01
DSS01.04
DSS01.05
DSS04.01
DSS04.03
APO13.01
APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
APO13.01
DSS05.02
DSS05.03
DSS06.06
APO01.06
BAI09.02
BAI09.03
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
CC3.2
CC3.1
CC3.1
CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
CC3.1
CC3.1
CC5.7
PI1.5
CC5.1
C1.3
CC5.6
CC3.1
CC3.1
Domain 5
CC5.5
CC5.7
CC5.6
CC5.7
CC5.6
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
PCI DSS v2.0
12.1 PCI DSS v2.0
12.1.2 EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
AR-2 Privacy Impact and
Risk Assessment
A.12.1.1
A.15.2.2
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
Chapter II, Article 19 and
Chapter VI, Section I, Article
39 312.8 and 312.10 shared x CM-2
SA-2
SA-4
PCI DSS v1.2
1.1 PCI DSS v1.2
1.1.1 PCI DSS v1.2
1.1.2 PCI DSS v1.2
1.1.3 PCI DSS v1.2
1.1.4 PCI DSS v1.2
1.1.5 PCI DSS v1.2
1.1.6 PCI DSS v1.2
2.2 PCI DSS v1.2
2.2.1 PCI DSS v1.2
2.2.2 PCI DSS v1.2
2.2.3 PCI DSS v1.2
2.2.4 Governance and Risk
Management
Risk Assessments
GRM02Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.
L.4, L.5, L.6,
L.7
34 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
DG-08 COBIT 4.1 PO
9.1, PO 9.2, PO
9.4, DS 5.7
Domain 5 6.01. (d)
6.04.03. (a)
Article 6, Article 8, Article 17
(1)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
1.2.4 8.2.1
45 CFR
164.308(a)(1)(ii)
(A) (New)
45 CFR
164.308(a)(8)
(New)
Clause 4.2.1 c) &
g)
Clause 4.2.3 d)
Clause 4.3.1 &
4.3.3 Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
EAR 15
CFR
§736.2 (b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
Commandment
#11
45 CFR 164.312
(a)(2)(iv)
45 CFR 164.312
(e)(1)
45 CFR 164.312
(e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
Encryption & Key
Management
Key Generation
EKM02Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over
implementation of the control.
CIP-003-3 -
R4.2
AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8
PCI-DSS v2.0
2.1.1 PCI-DSS v2.0
3.4 PCI-DSS v2.0
3.4.1 PCI-DSS v2.0
4.1 PCI-DSS v2.0
4.1.1 PCI DSS v2.0
4.2 Encryption & Key
Management
Storage and Access
EKM04Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required.
Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.
Governance and Risk
Management
Baseline Requirements
GRM01Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use.
Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and established and authorized based on business need.
S1.1.0
S1.2.0(ai)
(S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include,
but may not be limited to, the following matters:
L.2 L.2, L.5, L.7
L.8, L.9, L.10
12 (B)
14 (B)
13 (B)
15 (B)
16 (C+,
A+)
21 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
IS-04 COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6
Domain 2 6.03.01. (a)
6.03.04. (a)
6.03.04. (b)
6.03.04. (c)
6.03.04. (e)
6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30
1.2.6 8.2.1
8.2.7 Encryption & Key
Management
Encryption
EKM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.
C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent
security techniques are used to protect
transmissions of user authentication and other
confidential information passed over the Internet
or other public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.
G.4
G.15
I.3
G.10.4, G.11.1,
G.11.2, G.12.1,
G.12.2, G.12.4,
G.12.10,
G.14.18,
G.14.19,
G.16.2,
G.16.18,
G.16.19,
G.17.16,
G.17.17,
G.18.13,
G.18.14,
G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-18 COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
COBIT 4.1 DS5.11
Domain 2 6.04.05. (a)
6.04.05. (c)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8
8.1.1 8.2.1
8.2.5 45 CFR 164.310
(a)(1)
45 CFR 164.310
(a)(2)(ii)
45 CFR
164.308(a)(3)(ii)
(A) (New)
45 CFR 164.310
(a)(2)(iii) (New)
A.5.1.1
A.9.1.3
A.9.1.5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -R2 -
R2.2
PE-2
PE-3
PE-4
PE-5
PE-6
PCI DSS v2.0
9.1 PCI DSS v2.0
9.2 PCI DSS v2.0
9.3 PCI DSS v2.0
9.4 (S3.6.0) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.
L.6 38 (B)
39 (C+)
IS-19 COBIT 4.1 DS5.8 Domain 2 6.04.04. (a)
6.04.04. (b)
6.04.04. (c)
6.04.04. (d)
6.04.04. (e)
6.04.05. (d)
6.04.05. (e)
6.04.08.02. (b)
Article 17 NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17
8.1.1 8.2.1
8.2.5 45 CFR 164.312
(a)(2)(iv)
45 CFR
164.312(e)(1)
(New)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Commandment #9
Commandment
#10
Commandment
#11
SC-12
SC-13
SC-17
SC-28
PCI-DSS v2.0
3.4.1 PCI-DSS v2.0
3.5 PCI-DSS v2.0
3.5.1 PCI-DSS v2.0
3.5.2 PCI-DSS v2.0
3.6 PCI-DSS v2.0
3.6.1 PCI-DSS v2.0
3.6.2 PCI-DSS v2.0
3.6.3 PCI-DSS v2.0
3.6.4 PCI-DSS v2.0
3.6.5 PCI-DSS v2.0
3.6.6 PCI-DSS v2.0
3.6.7 PCI-DSS v2.0
3.6.8 Datacenter Security 99.31.a.1.ii
Policy
DCS06Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas.
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
H.6 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.4.2,
F1.4.6,
F.1.4.7, F.1.7,
F.1.8, F.2.13,
F.2.14, F.2.15,
F.2.16, F.2.17,
F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-01 COBIT 4.1 DS5.7,
DS 12.1, DS 12.4
DS 4.9
Domain 8 6.08. (a)
6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
8.2.1 8.2.2
8.2.3 CIP-007-3 -
R7 - R7.1 -
R7.2 R7.3
MP-6
PE-1
PCI DSS v2.0
3.1.1 PCI DSS v2.0
9.10 PCI DSS v2.0
9.10.1 PCI DSS v2.0
9.10.2 PCI DSS v2.0
3.1 Datacenter Security
Asset Management
DCS01Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership y defined roles and responsibilities.
S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-08 Domain 8 Article 17 45 CFR 164.310
(d)(2)(iii)
A.7.1.1
A.7.1.2
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.
PCI DSS v2.0
9.9.1 PCI DSS v2.0
12.3.3 PCI DSS v2.0
12.3.4 NIST SP800-53 R3 CM-8
BOSS > Data
Governance >
Secure Disposal
of Data
C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
D.2.2.10,
D.2.2.11,
D.2.2.14,
37 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.
4.7.5 and 4.5.3
DG-05 COBIT 4.1 DS
11.4 Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1
5.1.0 5.2.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
PCI-DSS v2.0
2.1.1 PCI-DSS v2.0
4.1 PCI-DSS v2.0
4.1.1 PCI DSS v2.0
4.2 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
Commandment #8
Commandment #9
Commandment
#10
Chapter II
Article 8, 9, 11, 12, 14, 18, 19,
20, 21
CIP-003-3 -
R4 - R4.1
AC-16
MP-1
MP-3
PE-16
SI-12
SC-9
PCI DSS v2.0
9.5 PCI DSS v2.0
9.6 PCI DSS v2.0
9.7.1 PCI DSS v2.0
9.7.2 PCI DSS v2.0
9.10 SRM >
Cryptographic
Services > Data in
Transit Encryption
shared
45 CFR 164.310
(d)(2)(i)
45 CFR 164.310
(d)(2)(ii)
A.9.2.6
A.10.7.2
Commandment
#11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data.
Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.
S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.
G.13 D.2.2 DG-03 COBIT 4.1 PO
2.3, DS 11.6
Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
1.1.2 5.1.0
7.1.2 8.1.0
8.2.5 8.2.6
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inv entory , document, and maintain data f lows f or data that is resident (permanently or temporarily ) within the serv ice's applications and inf rastructure network and sy stems. In particular, prov iders shall ensure that data that is subject to geographic residency requirements not be migrated bey ond its def ined bounds.
Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.
S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(I13.3.a-e) The procedues related to
completeness, accuracy, timeliness, and
authorization of system processing, including error
correction and database management, are
consistent with documented system processing
integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.
G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1,
G.19.1.2,
G.19.1.3,
G.10.8, G.9.11,
G.14, G.15.1
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-28 COBIT 4.1 DS
5.10 5.11
Domain 2 Article 17
PCI DSS v2.0
1.1.1 PCI DSS v2.0
6.1 PCI DSS v2.0
6.4 Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.
S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
D.1.3, D.2.2 DG-02 COBIT 4.1 PO
2.3, DS 11.6
Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4
1.2.3 1.2.6
4.1.2 8.2.1
8.2.5 8.2.6
A.7.2.1 Commandment #9
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined qualty change control and testing process (e.g. ITIL Service Management) with established baselines, testing and release standards which focus on system availability, confidentiality and integrity of systems and services
General Provisions, Article 3,
V. and VI.
CIP-003-3 -
R4 - R5
RA-2
AC-4
PCI DSS v2.0
9.7.1 PCI DSS v2.0
9.10 PCI DSS v2.0
12.3 None 6.03.01. (b)
6.03.01. (d)
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
9.1.0 9.1.1
9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
Commandment #1
Commandment #2
Commandment #3
Domain 11
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* partial
A.14.2.2
8.1* partial
A.14.2.3
8.1* partial
A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
A.8.2.1
Clause
4.2 5.2,
7.5,
8.1 A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
A.11.2.7
A.8.3.2
Annex A.8
A.11.1.1
A.11.1.2
Clauses
5.2(c)
5.3(a)
5.3(b)
7.5.3(b)
7.5.3(d)
8.1 8.3
9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Annex
A.10.1
A.10.1.1
A.10.1.2
A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design,
acquisition, implementation, configuration,
modification, and management of infrastructure
and software are consistent with defined system
availability, confidentiality of data, processing
integrity, systems security and related security
policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.
C.1.7, G.1, G.6,
I.1, I.4.5,
I.2.18, I.22.1,
I.22.3, I.22.6,
I.2.23,
I.2.22.2,
I.2.22.4,
I.2.22.7.
I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14,I.2.2
0, I.2.17,
I.2.7.1, I.3,
J.2.10, L.9
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-03 COBIT 4.1 PO 8.1
A.14.1.1
A.18.2.3
Clauses
5.2(c)
5.3(a)
5.3(b)
6.1.2 6.1.2(a)(2)
6.1.3(b)
7.5.3(b)
7.5.3(d)
8.1 8.2
8.3 9.2(g)
A.18.1.1
A.18.1.3
A.18.1.4
A.8.2.2
CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
3.2.4 4.2.3
7.1.2 7.2.1
7.2.2 8.2.1
8.2.5 45 CFR
164.312(e)(1)
45 CFR
164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 282
#15..
- 613 -
GRM04.1
An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
GRM04.2Do you review your Information Security Management Program (ISMP) least once a year?
Governance and Risk
Management
Management Support
/ Involvement
GRM05GRM05.1Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.
Do you ensure your providers adhere to your information security and privacy policies?
S1.3.0 (S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.
The entity has prepared an objective description of
the system and its boundaries and communicated
such description to authorized users
The security obligations of users and the entity’s
security commitments to users are communicated
CC1.2 C.1 5 (B) Schedule 1
(Section 5), 4.1
Safeguards,
Subsec. 4.1.1
IS-02 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and 312.10 SRM >
Governance Risk
& Compliance >
Compliance
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii)
45 CFR 164.316
(b)(2)(iii)
Clause 5
A.6.1.1
All in section 5
plus clauses
4.4 4.2(b)
6.1.2(a)(1)
6.2 6.2(a)
6.2(d)
7.1 7.4
9.3 Commandment #3
Commandment #6
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 - R1.1
CM-1
PM-1
PM-11
4.1 PCI DSS v2.0
12.5 12.4
GRM06.1Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?
GRM06.2Do you have agreements to ensure your providers adhere to your information security and privacy policies?
GRM06.3Can you provide evidence of due diligence mapping of your controls, architecture and processes to regulations and/or standards? GRM06.4Do you disclose which controls, standards, certifications and/or regulations you comply with?
GRM07.1Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
GRM07.2Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures? Governance and Risk
Management
Business / Policy
Change Impacts
GRM08GRM08.1Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.
Do risk assessment results include updates to security policies, procedures, standards and controls to ensure they remain relevant and effective?
B.2
G.21
L.2
B.1.1, B.1.2,
B.1.6, B.1.7.2,
G.2, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-04 COBIT 4.1 PO 9.6 APO12
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x Domain 2,
4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause
4.2.1 a,
4.2(b)
4.3 c,
4.3(a&b)
4.4 5.1(c)
5.1(d)
5.1(e)
5.1(f)
5.1(g)
5.1(h)
5.2 5.2 e,
5.2(f)
5.3 6.1.1(e)(2),
6.1.2(a)(1)
6.2 CIP-009-3 -
R2
CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment
4.3 PCI DSS v2.0
12.1.3 12.2
GRM09.1Do you notify your tenants when you make material changes to your information security and/or privacy policies?
GRM09.2Do you perform, at minimum, annual reviews to your privacy and security policies?
GRM10.1Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
GRM10.2Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?
GRM11.1Do you have a documented, organization-wide program in place to manage risk?
GRM11.2Do you make available documentation of your organization-wide risk management program?
HRS-01.1 Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?
HRS-01.2 Is your Privacy Policy aligned with industry standards? Human Resources
Background Screening
HRS02HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.
Pursuant to local laws, regulations, ethics and contractual constraints, are all employment candidates, contractors and involved third parties subject to background verification? S3.11.0 (S3.11.0) Procedures exist to help ensure that
personnel responsible for the design,
development, implementation, and operation of
systems affecting confidentiality and security have
the qualifications and resources to fulfill their
responsibilities.
CC1.3
CC1.4
E.2 E.2 63 (B)
HR-01
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
COBIT 4.1 PO 7.6 APO07.01
APO07.05
APO07.06
312.8 and 312.10 BOSS > Human
Resources
Security >
Background
Screening
shared x None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3
1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
CIP-004-3 -
R2.2
PS-2
PS-3
9.29 PA27 BSGP PCI DSS v2.0
12.7 PCI DSS v2.0
12.8.3 12.7
12.8.3 HRS-03.1 Do you specifically train your employees regarding their specific role and the information security controls they must fulfill? HRS-03.2 Do you document employee acknowledgment of training they have completed?
HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?
HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?
HRS-04.1 Are documented policies, procedures and guidelines in place to govern change in employment and/or termination?
HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?
Human Resources
Portable / Mobile
Devices
HRS05HRS-05.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).
Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g. laptops, cell phones and personal digital assistants (PDAs)), which are generally higher-risk than nonportable devices (e.g., desktop computers at the provider organization’s facilities)?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
CC5.6 G.11, G12,
G.20.13,
G.20.14
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-32 COBIT 4.1 DS5.11
COBIT 4.1 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 Presentation
Services >
Presentation
Platform >
Endpoints -
Mobile Devices -
Mobile Device
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
1.2.6 3.2.4
8.2.6 45 CFR 164.310
(d)(1)
A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4
A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
All CIP-007-3 -
R7.1
AC-17
AC-18
AC-19
MP-2
MP-4
MP-6
19.1 19.2
19.3 PA33
PA34
SGP
SGP
PCI DSS v2.0
9.7 PCI DSS v2.0
9.7.2 PCI DSS v2.0
9.8 PCI DSS v2.0
9.9 PCI DSS v2.0
11.1 PCI DSS v2.0
12.3 11.1
12.3 Human Resources
Nondisclosure
Agreements
HRS06HRS-06.1 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.
Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals?
S4.1.0 (S4.1.0) The entity’s system availability,
confidentiality, processing integrity and security
performance is periodically reviewed and
compared with the defined system availability and
related security policies.
CC4.1 C.2.5 Schedule 1
(Section 5), 4.7 -
Safeguards
LG-01 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Compliance >
Intellectual
Property
Protection
shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
1.2.5 ISO/IEC
27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #8
Commandment #9
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY
AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
personally identifiable
information (PII) through
existing security controls;
and
PA7 BSGP PCI DSS v2.0
12.8.2 PCI DSS v2.0
12.8.3 PCI DSS v2.0
12.8.4 Human Resources
Roles / Responsibilities
HRS07HRS-07.1 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.
Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant? S1.2.f (S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.
B.1 B.1.5,
D.1.1,D.1.3.3,
E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1
(Section 5) 4.1
Accountability
IS-13 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
99.31(a)(1)(ii) 1.2.9
8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE AND
PRIVACY PROGRAM
Control: The organization:
Supplemental Guidance:
The development and
implementation of a
comprehensive
governance and privacy
program demonstrates
organizational
accountability for and
commitment to the
protection of individual
2.2 PA9
PA24
BSGP 12.8.5
HRS-08.1 Do you provide documentation regarding how you may or access tenant data and metadata?
HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (search engines, etc.)?
HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?
HRS-09.1 Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model segregation of duties implications and conflicts of interest) for all persons with access to tenant data?
HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? HRS-10.1 Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards and applicable regulatory requirements? HRS-10.2 Are users made aware of their responsibilities for maintaining a safe and secure working environment?
HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?
HRS-11.1 Do your data management policies and procedures address tenant and service level conflicts of interests?
HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?
IAM-01.1 Do you restrict, log and monitor access to your information security management systems? (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)
IAM-01.2 Do you monitor and log privileged access (administrator level) to information security management systems?
IAM-02.1 Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? IAM-02.2 Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM03IAM-03.1 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.
Do you use dedicated secure networks to provide management access to your cloud service infrastructure?
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).
CC5.1 H1.1, H1.2,
G.9.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-30 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
provider x Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
8.2.2 A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R2
CM-7
MA-3
MA-4
MA-5
15.4 PCI-DSS v2.0
9.1.2 1.2.2
7.1 7.1.2
7.1.3 7.2
7.2.3 9.1.2
9.1.3 IAM-04.1 Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?
9.3 12.3
12.6 12.4
8.1.8 10.5
7.1.2 7.1.4
7.2 8.1
8.1.5 8.5
3.5.1, 7.0
8.0 12.5.4
7.3 8.8
9.10 7.3, 8.8, 9.10, 12.1
12.2 12.1.1
12.2 12.2
PA27 BSGP
PA27 BSGP
BSGP
PA28 BSGP
PA30 BSGP
PA2
PA15
BSGP
SGP
1.1 3.3
5.1 5.2
5.3 5.4
7.1 12.2
17.7 18.1
18.3 3.2 (responsibility)
3.3 3.4
4.1 4.3
5.2 (residual Risk)
2.2 9.2
2.2 5.2
4.2 9.1
9.1 8.1
15.4 15.1
15.2 4.2
4.3 4.4
4.5 4.1
6.1 AR-2 Privacy Impact and
Risk Assessment
AR-5 PRIVACY
AWARENESS AND
TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that
personnel understand
privacy responsibilities
and procedures;
b. Administers basic
privacy training
[Assignment:
organization-defined
frequency, at least
annually] and targeted,
role-based privacy
training for personnel
having responsibility for
personally identifiable
information (PII) or for
activities that involve PII
[Assignment:
organization-defined
frequency, at least
annually]; and
c. Ensures that personnel
certify (manually or
electronically) acceptance
of responsibilities for
privacy requirements
[Assignment:
UL-1 INTERNAL USE
Control: The organization
uses personally
identifiable information
(PII) internally only for
the authorized purpose(s)
identified in the Privacy
Act and/or in public
notices.
99.31(a)(i)(ii)
99.31(a)(1)(ii)
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management
shared x
SRM > Policies
and Standards >
shared x
BOSS > Human
Resources
Security >
Employee
Awareness
shared x
BOSS > Data
Governance >
Clear Desk Policy
shared x
SRM > Policies
and Standards >
Information
Security Policies
SRM > InfoSec
Management >
Capabilitiy
Mapping
SRM > Policies
and Standards >
Information
Security Policies
shared x
SRM >
Governance Risk
& Compliance >
shared x
SRM >
Governance Risk
& Compliance >
Policy
Management
shared x
shared x
BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x
SRM > Policies
and Standards >
Information
Security Policies
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO07.04
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
APO12
EDM03.02
APO01.03
APO12
APO01.03
APO13.01
APO07.06
APO09.03
APO10.01
APO01.02
APO07.05
APO07.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.03
DSS05.05
CC3.2
CC1.2
CC2.3
CC6.2
CC2.5
CC3.2
CC3.1
CC3.3
CC3.1
CC5.6
CC2.2
CC2.3
CC5.4
CC3.2
CC6.2
CC2.2
CC2.3
CC5.1
CC5.5
CC5.6
45 CFR 164.308
(a)(3)(i)
45 CFR 164.312
(a)(1)
45 CFR 164.312
(a)(2)(ii)
45 CFR
164.308(a)(4)(ii)
(B) (New)
45 CFR
164.308(a)(4)(ii)
(c ) (New)
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
S3.2.g Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R5.1 -
R5.1.2
AC-1
IA-1
PCI DSS v2.0
3.5.1 PCI DSS v2.0
8.5.1 PCI DSS v2.0
12.5.4 Identity & Access
Management
Policies and Procedures
IAM04Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.
Identity & Access
Management
User Access Policy
IAM02User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customercontrolled access, suppliers' business relationships, or other thirdparty business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multifactor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).
B.1 B.1.8, B.1.21,
B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.
4.7.4 IS-07 COBIT 4.1 DS 5.4 Domain 2 6.01. (b)
6.01. (d)
6.02. (e)
6.03. (b)
6.03.04. (b)
6.03.04. (c)
6.03.05. (b)
6.03.05. (d)
6.03.06. (b)
6.04.01. (c)
6.04.01. (f)
6.04.02. (a)
6.04.02. (b)
6.04.02. (c)
6.04.03. (b)
6.04.06. (a)
6.04.08. (a)
6.04.08. (b)
6.04.08. (c)
6.04.08.03. (a)
6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
Identity & Access
Management
Audit Tools Access
IAM01Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-29 COBIT 4.1 DS 5.7 Domain 2 6.03. (i)
6.03. (j)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
8.1.0 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment
#11
CIP-003-3 -
R5.2
AU-9
AU-11
AU-14
PCI DSS v2.0
10.5.5 AT-2
AT-3
AT-4
PL-4
PCI DSS v2.0
8.5.7 PCI DSS v2.0
12.6.1 Human Resources
Workspace
HRS11Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity.
S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
E.1 E.4 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-17 Domain 2 NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #5
Commandment #6
Commandment #7
Commandment
#11
Human Resources
User Responsibility
HRS10All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality,
processing integrity and security policies and
changes and updates to those policies are
communicated to entity personnel responsible for
implementing them.
E.1 E.4 65 (B)
66 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.4
IS-16 COBIT 4.1 PO 4.6 Domain 2 Article 17 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
CC3.2 APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06
312.8 and 312.10
312.8 and 312.10
45 CFR 164.308
(a)(5)(i)
45 CFR 164.308
(a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Commandment #3
Commandment #6
SRM > GRC > shared x
AC-11
MP-2
MP-3
MP-4
Chapter VI, Section I, Article
39 and Chapyer VI, Section II,
Article 41
CIP-004-3 -
R1 - R2 -
R2.1
AT-1
AT-2
AT-3
AT-4
PCI DSS v2.0
12.6 PCI DSS v2.0
12.6.1 PCI DSS v2.0
12.6.2 1.2.10
8.2.1 45 CFR 164.308
(a)(5)(ii)(D)
Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Commandment #5
Commandment #6
Commandment #7
Chapter VI, Section I, Article
39 and Chapter VI, Section II,
Article 41
Human Resources
Training / Awareness
HRS09A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.
S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but
may not be limited to, the following matters:
k. Providing for training and other resources to
support its system security policies
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
E.1 E.4 65 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.
4.7.4 IS-11 COBIT 4.1 PO 7.4 Domain 2 6.01. (c)
6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
1.2.10 8.2.1
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and 312.10
Human Resources
Acceptable Use
HRS08Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.
S1.2
S3.9
(S1.2) The entity’s security policies include, but
may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
B.3 B.1.7, D.1.3.3,
E.3.2, E.3.5.1,
E.3.5.2
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-26 COBIT 4.1 DS 5.3 Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4
8.1.0 45 CFR 164.310
(b)
A.7.1.3 Commandment #1
Commandment #2
Commandment #3
Human Resources
Employment
Termination
HRS04Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.
AC-8
AC-20
PL-4
PCI-DSS v2.0
12.3.5 312.8 and 312.10
312.4, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access
to the system and information resources
maintained in the system including, but not limited
to, the following matters:
d. The process to make changes and updates to
user profiles
(S3.8.e) e. Procedures to prevent customers,
groups of individuals, or other entities from
accessing confidential information other than their
own
E.6 HR-03 COBIT 4.1 PO 7.8 None Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
8.2.2 10.2.5
GRM11Organizations shall develop and maintain an enterprise risk management framework to mitigate risk to an acceptable level. 45 CFR 164.308
(a)(3)(ii)(C)
A.8.3.1 Commandment #6
Commandment #7
312.3, 312.8 and
312.10
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security >
Employee
Termination
provider x
BOSS > Human
Resources
Security >
Employee Code
of Conduct
shared x
shared x
45 CFR 164.308
(a)(3)(ii)(C)
A.7.1.1
A.7.1.2
A.8.3.2
Governance and Risk
Management
Program
PS-4
Human Resources
Employment
Agreements
HRS03Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.
S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are
communicated to authorized users
C.1 E.3.5 66 (B) Schedule 1
(Section 5) 4.7
Safeguards,
Subsec. 4.7.4
HR-02 COBIT DS 2.1 None Article 17 NIST SP 800-53 R3 PS1 NIST SP 800-53 R3 PS2
NIST SP 800-53 R3 PS6
NIST SP 800-53 R3 PS7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
1.2.9 8.2.6
45 CFR
164.310(a)(1)
(New)
45 CFR
164.308(a)(4)(i)
(New)
A.6.1.5
A.8.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
PL-4
PS-6
PS-7
Human Resources
Asset Returns
HRS01Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
D.1 E.6.4 Schedule 1
(Section 5) 4.5
Limiting Use,
Disclosure and
Retention; 4.7
Safeguards, Subs.
4.7.5 IS-27 Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3
7.2.2 8.2.1
8.2.6 APO01.08
APO07.06
APO13.01
BAI09.03
45 CFR 164.308
(a)(1)(ii)(A)
Clause 4.2.1 c)
through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
CIP-002-3 -
R1.1 -
R1.2
CIP-005-
3a - R1 -
R1.2
CIP-009-3 -
R.1.1
PL-5
RA-2
RA-3
PCI DSS v2.0
12.1.2 BOSS >
Operational Risk
Management >
Risk
Management
Framework
S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.
L.2 A.1, L.1 Schedule 1
(Section 5), 4.7 -
Safeguards
RI-01 COBIT 4.1 PO 9.1 Domain 2,
4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1
312.8 and 312.10 1.2.4 45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(B) (New)
Clause 4.2.1 c)
through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Chapter II
Article 19
CIP-009-3 -
R4
AC-4
CA-2
CA-6
PM-9
RA-1
PCI DSS v2.0
12.1.2 Governance and Risk
Management
Assessments
GRM10Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).
S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality of
data, processing integrity, and system security is
assessed on a timely basis; policies are updated
for that assessment.
I.1
I.4
C.2.1, I.4.1,
I.5, G.15.1.3,
I.3
46 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-02 COBIT 4.1 PO 9.4 Domain 2,
4 6.03. (a)
6.08. (a)
Article 17 (1), (2) NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30
1.2.4 1.2.5
312.8 and 312.10
PL-4
PS-1
PS-8
Governance and Risk
Management
Policy Reviews
GRM09The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.
S1.1.0 (S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.
B.2 B.1.33. B.1.34, IS-05 COBIT 4.1 DS 5.2
DS 5.4
Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
1.2.1 8.2.7
10.2.3 45 CFR 164.316
(b)(2)(iii)
45 CFE
164.306(e)
(New)
Clause 4.2.3 f)
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
PCI DSS v2.0
12.1.3 CIP-003-3 -
R3.2 -
R3.3 -
R1.3
R3 - R3.1 -
R3.2 -
R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
8.1.0 8.1.1
45 CFR 164.316
(a)
45 CFR 164.316
(b)(1)(i)
45 CFR 164.316
(b)(2)(ii)
45 CFR
164.308(a)(2)
(New)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 -R1.1 -
R1.2 - R2 -
R2.1 -
R2.2 -
R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1
PCI DSS v2.0
12.1 PCI DSS v2.0
12.2 Governance and Risk
Management
Policy Enforcement
GRM07A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures.
Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.
S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(S2.4.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
B.1.5 Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-06 COBIT 4.1 PO 7.7 Domain 2 Article 17 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
10.2.4 45 CFR 164.308
(a)(1)(ii)(C)
A.8.2.3 Commandment #6
Commandment #7
Chapter X, Article 64
Governance and Risk
Management
Management Program
GRM04x1.2. (x1.2.) The entity’s system [availability,
processing integrity, confidentiality and related]
security policies include, but may not be limited to,
the following matters:
A.1, B.1 2 (B)
3 (B)
5 (B)
IS-01 COBIT 4.1 R2
DS5.2
COBIT 4.1 R2
DS5.5
Domain 2
Governance and Risk
Management
Policy
GRM06Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.
S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.
(S2.3.0) Responsibility and accountability for the
entity's system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
B.1 Schedule 1
(Section 5) 4.1
Accountability,
Subsec 4.1.4
IS-03 COBIT 4.1 DS5.2 APO01.03 Domain 2 6.02. (e)
APO01.04
APO13.01
APO13.02
Schedule 1
(Section 5), 4.1 -
Accountability; 4.7
Safeguards
Clause 8.1
A.5.1.2
Clause
4.2(b),
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1 9.3(a),
9.3(b)
9.3(b)(f)
Clause
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
A.8.1.1
A.8.1.2
A.8.1.4
A.13.2.4
A.7.1.2
A.7.3.1
A.8.1.3
PCI DSS v2.0
12.4 PCI DSS v2.0
12.8.2 PS-4
PS-5
Clause 7.2(a),
7.2(b)
A.7.2.2
Clause 7.2(a),
7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Clause 7.2(a),
7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6
Commandment #1
Commandment #2
Chapter II, Article 19 CIP-001-
1a - R1 -
R2
CIP-003-3 -
R1 - R1.1 -
R4
CIP-006-
3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program
Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 4.1 PA8
164.308(a)(1)(i)
45 CFR
164.308(a)(1)(ii)
(B)
45 CFR
164.316(b)(1)(i)
45 CFR
164.308(a)(3)(i)
(New)
45 CFR
164.306(a)
(New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4,
5, 6, 7, 8, 9, 10.
A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
PCI DSS v2.0
12.1 PCI DSS v2.0
12.2 12.1
12.2 Domain 12
Clause 4.3
Clause 5
4.4 4.2(b)
6.1.2(a)(1)
6.2 6.2(a)
6.2(d)
7.1 7.4
9.3 10.2
7.2(a)
7.2(b)
7.2(c)
7.2(d)
7.3(b)
7.3(c)
A5.1.1
A7.2.3
APO13.01
APO13.02
APO13.03
312.8 and 312.10 shared x
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 283
#15..
- 614 -
Identity & Access
Management
Segregation of Duties
IAM05IAM-05.1 User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.
Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering? S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.
CC5.1 Schedule 1
(Section 5) 4.7
Safeguards, Subs.
4.7.3(b)
IS-15 COBIT 4.1 DS 5.4 APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and 312.10 ITOS > Resource
Management >
Segregation of
Duties
shared x Domain 2 6.04.01. (d)
6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
99.31(a)(1)(ii) 8.2.2 45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR
164.308(a)(4)(ii)
(A) (New)
45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-007-3
R5.1.1
AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4
3.0 3.1
3.2 3.3
3.4 3.5
PA24 P PCI DSS v2.0
6.4.2 6.4.2, 7.3
8.8 9.10
IAM-06.1 Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-07.1 Do you provide multi-failure disaster recovery capability? IAM-07.2 Do you monitor service continuity with upstream providers in the event of provider failure?
IAM-07.3 Do you have more than one provider for each service you depend on?
IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?
IAM-07.5 Do you provide the tenant the ability to declare a disaster? IAM-07.6 Do you provided a tenant-triggered failover option? IAM-07.7 Do you share your business continuity and redundancy plans with your tenants?
IAM-08.1 Do you document how you grant and approve access to tenant data?
IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? IAM-09.1 Does your management provision the authorization and restrictions for user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?
IAM-09.2 Do your provide upon request user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? IAM-10.1 Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?
IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?
IAM-11.1 Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data
implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?
IAM-12.1 Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?
IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?
IAM-12.3 Do you support identity federation standards (SAML, SPML, WSFederation, etc.) as a means of authenticating/authorizing users? IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access? IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? IAM-12.7 Do you allow tenants to use third-party identity assurance services? IAM-12.8 Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement?
IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?
IAM12.10Do you support the ability to force password changes upon first logon?
IAM12.11Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?
IAM-13.1 Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored? IAM-13.2 Do you have a capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?
IVS-01.1 Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents?
IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?
IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?
IVS-01.4 Are audit logs centrally stored and retained?
IVS-01.5 Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?
IVS-02.1 Do you log and alert any changes made to virtual machine images regardless of their running state (e.g. dormant, off or running)? IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g. portals or alerts)?
Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 IVS-03.1 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.
Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.
CC6.2 G.7
G.8
G.13, G.14.8,
G.15.5, G.16.8,
G.17.6, G.18.3,
G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-12 COBIT 4.1 DS5.7 APO01.08
APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and 312.10 Infra Services >
Network Services
> Authoritative
Time Source
provider x Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
AU-1
AU-8
PCI DSS v2.0
10.4 10.4
IVS-04.1 Do you provide documentation regarding what levels of system (network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?
IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?
IVS-04.3 Do your system capacity requirements take into account current, projected and anticipated capacity needs for all systems used to provide services to the tenants?
IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual and business requirements for all the systems used to provide services to the tenants?
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 IVS-05.1 Implementers shall ensure that the security v ulnerability assessment tools or serv ices accommodate the v irtualization technologies used (e.g. v irtualization aware).
Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g. virtualization aware)?
APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
provider x Domain 1,
13 Clause
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2),
PA36 6.1
IVS-06.1 For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?
IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?
IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?
IVS-06.4 Are all firewall access control lists documented with business justification?
Infrastructure &
Virtualization Security
OS Hardening and Base
Conrols
IVS-07 IVS-07.1 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.
Are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs using technical controls (i.e antivirus, file integrity monitoring and logging) as part of their baseline build standard or template?
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.01
DSS05.03
DSS06.06
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1
2.1 2.2
2.5 5.1
IVS-08.1 For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes? IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?
IVS-08.3 Do you logically and physically segregate production and nonproduction environments? IVS-09.1 Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security IVS-09.2 requirements? Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory and contractual requirements?
IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and nonproduction environments? IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? IVS-10.1 Are secured and encrypted communication channels used when migrating physical servers, applications or data to virtual servers? IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications or data to virtual servers?
Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 IVS-11.1 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor
authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).
Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g. two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Privilege Use
Management -
Hypervisor
Governance and
Compliance
provider X Domain 1,
13 Clause
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
3.5.1, 3.6.6
IVS-12.1 Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? IVS-12.2 Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings? (e.g., encryption keys, passwords, SNMP community strings)
IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
IVS-13.1 Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?
IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and blackholing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denialof-service (DDoS) attacks? Interoperability &
Portability
APIs
IPY-01 IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.
Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
- BAI02.04
BAI03.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
Application
Services >
Programming
Interfaces >
provider X Domain 6 Clause
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2), Interoperability &
Portability
Data Request
IPY-02 IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) Is unstructured customer data available on request in an industrystandard format (e.g., .doc, .xls, or .pdf)?- APO01.03 APO01.06
APO03.01
APO08.01
APO09.03
DSS04.07
Information
Services >
Reporting
Services >
provider Domain 6 Clause
6.1.1,
6.1.1(e)(2)
6.1.2 6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c) IPY-03.1 Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?
5.0 7.1
7.1.2 7.2
10.1 10.2
10.3 10.4
10.5 10.6
10.7, 10.8
11.4, 11.5, 11.6
12.5.2 10.5.5, 12.10.5
1.1 1.1.2
1.1.3 1.1.5
1.1.6 1.2
1.2.1 1.2.2
1.2.3 1.3
2.2.2 2.2.3
2.2.4 2.5
4.1 6.4.1
6.4.2 1.1
1.2 1.2.1
1.2.3 1.3
1.4 2.1.1
2.2.3 2.2.4
2.3 6.4.1
6.4.2, 7.1
7.1.1 7.1.2
7.1.3 7.1.4
7.2 7.2.2
7.3 12.8
12.2 7.1
7.1.1 7.1.2
7.1.3 7.1.4
7.2 7.1
7.1.1 7.1.2
7.1.3 7.1.4
12.5.4 8.1.4
4.1 1.2.3
2.1.1 4.1
4.1.1 11.1, 11.1.a,
11.1.b, 11.1.c,
11.1.d, 11.1.1,
11.1.2 9.1.3
1.1 1.1.2
1.1.3 1.1.5
1.1.6 1.2
1.2.1 1.2.2
1.2.3 1.3
2.2.2 2.2.3
2.2.4 2.5
4.1 8.1.3
8.1.4 8.1.5, 12.5.4
8.0 10.1,
12.3 BSGP
BSGP
P
GP
PA11
PA12
PA13
PA24
BSGP
SGP
SGP
P
PA16 SGP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3 BSGP
PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP
PA24 GP
12.2 14.2
17.6 3.3
17.1 17.2
14.5 17.6
18.1 18.4
11.1 17.3
17.1 17.2
9.4 14.1
14.2 19.1
2.2 4.3
3.2 9.2
15.2 9.2
15.2 9.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.
Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m". UL-2 INFORMATION
SHARING WITH THIRD
PARTIES
AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.
Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m"
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.
Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m"
99.31(a)(1)(ii)
99.31(a)(1)(ii)
99.3 99.31(a)(1)(ii)
SRM >
Governance Risk
& Compliance >
Vendor
Management
shared x
Information
Services > User
Directory Services
> Active Directory
Services,
LDAP
Repositories,
X.500
Repositories,
DBMS
Repositories,
Meta Directory
Services,
Virtual Directory
Services
shared x
SRM > Policies
and Standards >
Technical Security
Standards
shared x
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
shared x
X
SRM >
Infrastructure
Protection
Services >
Network -
Wireless
Protection
provider X
ITOS > Service
Support > Release
Management -
Source Code
Management
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO13.01
APO13.02
DSS05.05
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
CC3.1
CC3.3
CC5.3
CC5.1
CC6.2
A1.1
A1.2
CC4.1
CC5.6
CC5.6
CC5.6
CC5.6
CC5.6
CC7.4
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).
45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.312
(b)
45 CFR
164.308(a)(5)(ii)
(c) (New)
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
Commandment #6
Commandment #7
Commandment
#11
CIP-007-3 -
R6.5
AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4
PCI DSS v2.0
10.1 PCI DSS
v2.0 10.2
PCI DSS
v2.010.3
PCI DSS v2.0
10.5 PCI DSS
v2.010.6
PCI DSS v2.0
10.7 PCI DSS v2.0
11.4 PCI DSS v2.0
12.5.2 PCI DSS
v2.0 12.9.5
Infrastructure &
Virtualization Security
Change Detection
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.
Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.
PCI DSS v2.0
1.2.3 PCI DSS v2.0
2.1.1 PCI DSS v2.0
4.1 PCI DSS v2.0
4.1.1 PCI DSS
v2.011.1
PCI DSS v2.0
9.1.3 Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.
CIP-004-3
R3
AC-4
SC-2
SC-3
SC-7
PCI DSS v2.0
1.1 PCI DSS v2.0
1.2 PCI DSS v2.0
1.2.1 PCI DSS v2.0
1.3 PCI DSS v2.0
1.4 Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-10 COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
8.2.5 45 CFR 164.312
(e)(1)(2)(ii)
45 CFR
164.308(a)(5)(ii)
(D) (New)
45 CFR
164.312(e)(1)
(New)
45 CFR
164.312(e)(2)(ii)
(New)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R3
CIP-007-3 -
R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Infrastructure &
Virtualization Security
Network Security
A.10.1.4
A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
Commandment #1
Commandment
#10
Commandment
#11
SC-2 PCI DSS v2.0
6.4.1 PCI DSS v2.0
6.4.2 Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and
configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
G.17 G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-09 COBIT 4.1 DS5.10 Domain 10 6.03.03. (b)
6.03.05. (a)
6.03.05. (b)
6.04.01. (a)
6.04.01. (g)
6.04.03. (c)
6.04.08.02. (a)
6.04.08.02. (b)
6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308
(a)(4)(ii)(A)
A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
Infrastructure &
Virtualization Security
Production /
Nonproduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets.
Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
B.1 I.2.7.1, I.2.20,
I.2.17,
I.2.22.2,
I.2.22.4,
I.2.22.10-14,
H.1.1
22 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-06 COBIT 4.1 DS5.7 Information Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 Services > Data
Governance >
Data Segregation
APO03.01 shared x
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
SA-4
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections, these configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and compensating controls.
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.
G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)
6.03.03. (d)
6.03.04. (d)
6.04.07. (a)
6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32
8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R2.2.4
SC-7 PCI DSS v2.0
1.1 PCI DSS v2.0
1.1.2 PCI DSS v2.0
1.1.3 PCI DSS v2.0
1.1.5 PCI DSS v2.0
1.1.6 PCI DSS v2.0
1.2 PCI DSS v2.0
1.2.1 PCI DSS v2.0
2.2.2, PCI DSS
v2.0 2.2.3
A.10.3.1 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Capacity / Resource
Planning
IVS-04 The av ailability , quality , and adequate capacity and resources shall be planned, prepared, and measured to deliv er the required sy stem perf ormance in accordance with legal, statutory , and regulatory compliance obligations. Projections of f uture capacity requirements shall be made to mitigate the risk of sy stem ov erload.
A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.
G.5 OP-03 COBIT 4.1 DS 3 Domain 7,
8 6.03.07. (a)
6.03.07. (b)
6.03.07. (c)
6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
312.8 and 312.10 ITOS > Service 1.2.4
Delivery >
Information
Technology
Resiliency -
Capacity Planning
provider x
PCI DSS v2.0
7.1.2 Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.
S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.
G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8,
G.14.9,
G.14.10,G.14.1
1, G.14.12,
G.15.5, G.15.7,
G.15.8, G.16.8,
G.16.9,
G.16.10,
G.15.9, G.17.5,
G.17.7, G.17.8,
G.17.6, G.17.9,
G.18.2, G.18.3,
G.18.5, G.18.6,
G.19.2.6,
G.19.3.1,
G.9.6.2,
G.9.6.3,
G.9.6.4,
G.9.19, H.2.16,
H.3.3, J.1, J.2,
L.5, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-14 COBIT 4.1 DS5.5
COBIT 4.1 DS5.6
COBIT 4.1 DS9.2
Domain 10 6.03. (i)
6.03. (j)
6.03.03. (a)
6.03.03. (d)
6.03.04. (e)
6.04.07. (a)
6.07.01. (a)
6.07.01. (c)
Article 17 NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
8.2.1 8.2.2
312.8 and 312.10
312.3, 312.8 and
312.10
BOSS > Security
Monitoring
Services > SIEM
shared x
Identity & Access
Management
Utility Programs Access
IAM13Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).
H.2.16 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-34 COBIT 4.1 DS5.7 Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
CIP-004-3
R2.2.3
CIP-007-3 -
R5.1.3 -
R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
A.11.4.1
A 11.4.4
A.11.5.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
CIP-007-3 -
R2.1 -
R2.2 -
R2.3
AC-5
AC-6
CM-7
SC-3
SC-19
PCI DSS v2.0
8.5.4 PCI DSS v2.0
8.5.5 Identity & Access
Management
User ID Credentials
IAM12Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) S3.2.b (S3.2.b) b. Identification and authentication of users.
B.1
H.5
E.6.2, E.6.3,
H.1.1, H.1.2,
H.2, H.3.2,
H.4, H.4.1,
H.4.5, H.4.8
6 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-02 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
Domain 10 6.03.04. (b)
6.03.04. (c)
6.03.05. (d)
6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10
45 CFR
164.308(a)(5)(ii)
(c) (New)
45 CFR 164.308
(a)(5)(ii)(D)
45 CFR 164.312
(a)(2)(i)
45 CFR 164.312
(a)(2)(iii)
45 CFR 164.312
(d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
Commandment #6
Commandment #7
Commandment #8
Commandment #9
CIP-004-3
R2.2.3
CIP-007-3 -
R5.2 -
R5.3.1 -
R5.3.2 -
R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
PCI DSS v2.0