AGENDA – REGULAR
HOUSING AUTHORITY
JUNE 17, 2025
PAGE NO. 1
AGENDA
SPECIAL MEETING
REDONDO BEACH HOUSING AUTHORITY
TUESDAY, JUNE 17, 2025 - 6:00 P.M.
REDONDO BEACH COUNCIL CHAMBERS
415 DIAMOND STREET
CALL MEETING TO ORDER
ROLL CALL
A. APPROVAL OF ORDER OF AGENDA
B. ADDITIONAL ITEMS FOR IMMEDIATE CONSIDERATION
B1. BLUE FOLDER ITEMS
Blue folder items are additional back up material to administrative reports and/or public comments received after the printing and distribution of the agenda packet for receive and file.
C. CONSENT CALENDAR #C1 through #C3
Business items, except those formally noticed for public hearing, or those pulled for discussion are assigned to the Consent Calendar. The Authority Members may request that any Consent Calendar item(s) be removed, discussed, and acted upon separately. Items removed from the Consent Calendar will be taken up under the “Excluded Consent Calendar” section below. Those items remaining on the Consent Calendar will be approved in one motion following Oral Communications.
C1. APPROVAL OF AFFIDAVIT OF POSTING for the Regular Housing Authority meeting of June 17, 2025.
C2. APPROVAL OF MOTION TO READ BY TITLE ONLY and waive further reading of all Ordinances and Resolutions listed on the agenda.
C3. RECEIVE AND FILE THE QUARTERLY STATUS REPORT ON SECTION 8 AND
FAIR HOUSING PROGRAMS
Contact: ELIZABETH HAUSE, HOUSING ADMINISTRATOR
D. EXCLUDED CONSENT CALENDAR ITEMS
E. PUBLIC PARTICIPATION ON NON-AGENDA ITEMS
This section is intended to provide members of the public with the opportunity to comment on any subject that does not appear on this agenda for action. This section is limited to 30 minutes. Each speaker will be afforded three minutes to address the Commission. Each speaker will be permitted to speak only once. Written requests, if any, will be considered first under this section.
F. EX PARTE COMMUNICATIONS
This section is intended to allow all officials the opportunity to reveal any disclosure or ex parte communication about the following public hearings.
G. PUBLIC HEARINGS
H. OLD BUSINESS
I. NEW BUSINESS
I1. DISCUSSION AND POSSIBLE ACTION REGARDING THE APPROVAL OF
A MEMORANDUM OF UNDERSTANDING WITH THE COUNTY OF LOS
ANGELES DEPARTMENT OF CHILDREN AND FAMILY SERVICES FOR THE
IMPLEMENTATION OF THE FOSTER YOUTH TO INDEPENDENCE
PROTECTION VOUCHER PROGRAM
Recommendation: Approve MOU with DCFS for the administration of the Foster Youth to Independence Voucher Program.
CONTACT: ELIZABETH HAUSE, HOUSING ADMINISTRATOR
J. MEMBERS ITEMS AND REFERRALS TO STAFF
K. ADJOURNMENT
The next scheduled meeting of the Redondo Beach Housing Authority is a Regular meeting on Tuesday, September 2, 2025 at 6:00 p.m. in the City Hall Council Chambers, 415 Diamond Street, Redondo Beach, California.
It is the intention of the City of Redondo Beach to comply with the Americans with Disabilities Act (ADA) in all respects. If, as an attendee or a participant of this meeting you will need special assistance beyond what is normally provided, the City will attempt to accommodate you in every reasonable manner. Please contact the City Clerk’s Office at (310) 318-0656 at least forty-eight (48) hours prior to the meeting to inform us of your particular needs and to determine if accommodation is feasible. Please advise us at that time if you will need accommodations to attend or participate in meetings on a regular basis.
An Agenda Packet is available 24 hours a day at www.redondo.org under the City Clerk and during City Hall hours. Agenda Packets are also available for review in the Office of the City Clerk.
Any writings or documents provided to a majority of the members of the Authority regarding any item on this agenda will be made available for public inspection at the City Clerk’s Counter at City Hall located at 415 Diamond Street during normal business hours.
AGENDA – REGULAR
HOUSING AUTHORITY
June 17, 2025
PAGE NO. 2
STATE OF CALIFORNIA )
COUNTY OF LOS ANGELES ) SS
CITY OF REDONDO BEACH )
AFFIDAVIT OF POSTING
In compliance with the Brown Act, the following materials have been posted at the locations indicated below.
Legislative Body
Posting Type
Posting Locations
Redondo Beach Housing Authority
Agenda – June 17, 2025 Special Meeting
415 Diamond Street, Redondo Beach, CA 90277
City Hall Kiosk
City Clerk’s Counter, Door “1”
Meeting Date & Time June 17, 2025 6:00 p.m.
As Housing Administrator of the City of Redondo Beach, I declare, under penalty of perjury, the document noted above was posted at the date displayed below.
Elizabeth Hause, Housing Administrator
Date: June 12, 2025
Community Services Department 1922 Artesia Boulevard
Redondo Beach, California 90278
www.redondo.org
tel: 310 318-0610
fax: 310 798-8273
To:
From:
Subject:
Administrative Report
Authority Action Date: June 17, 2025
CHAIRMAN AND MEMBERS OF THE HOUSING AUTHORITY
ELIZABETH HAUSE, HOUSING ADMINISTRATOR
STATUS REPORT ON THE SECTION 8 AND FAIR HOUSING
PROGRAMS
U2 RECOMMENDATION
Receive and file a quarterly status report on the Section 8 and Fair Housing Programs.
UEXECUTIVE SUMMARY
The City of Redondo Beach Housing Authority (RBHA) receives federal funding from the U.S. Department of Housing and Urban Development (HUD) to operate the Section 8 Program. Section 8 is a rent assistance program that enables very low-income persons to live in decent, safe and sanitary, privately-owned housing. Program participants in Redondo Beach select their own rental housing per program guidelines. This report includes information regarding Housing Authority activity for the months of January, February, and March of 2025.
The Housing Authority continues to operate the Section 8 Program within its available resources. On May 12, 2025, HUD notified the Housing Authority that it would receive $8,842,587 in Housing Assistance Payment (HAP) funding for CY 2025. On May 21, 2024, the Housing Authority received notification from the Los Angeles Community Development Authority (LACDA) of continued funding of the Homeless Incentive Program for Fiscal Year 2024-2025. The amount of funding under this agreement, if approved, is not to exceed $57,179.
Consistent with HUD guidelines and current funding levels, the Housing Authority’s goal is to backfill vacant voucher slots as they become available through attrition and/or terminations. The vacant slots are filled by families who are on the Redondo Beach Section 8 waiting list. There are approximately 971 families currently on the Housing Choice Voucher (HCV) program waiting list.
Administrative Report
Status Report on the Section 8 Program
BACKGROUND
SSection 8 Program Activity
The Housing Authority is currently assisting 472 households under the Section 8 HCV Program. Of those households, approximately 356 are headed by elderly and/or disabled persons; the remaining 116 are families headed by non-elderly, non-disabled persons.
During the months of April, May and June of 2025, the Housing Authority executed 6 new contracts. The Housing Authority also renewed 140 leases. Two (2) tenants moved out of their subsidized unit and is permanently off the program. During this reporting quarter, the Housing Authority spent $2,433,012.71 on housing assistance payments. The average per-unit client rent subsidy for this period was $1,717/month.
The Housing Authority’s goal, as outlined in the 5-year and 1-year agency plans, is to assist an average of approximately 648 families. The Housing Authority’s attrition rate is approximately zero to one per month.
Project-Based Voucher (PBV) Program
Effective July 1, 2024, the Redondo Beach Housing Authority implemented the Project-Based Voucher (PBV) program, which is part of the HCV program. The RBHA allocated 20 project-based vouchers to the Project Homekey site, the Moonstone, owned by Century Moonstone, LLC. Preference for placement at the Moonstone is given to eligible Redondo Beach pallet shelter residents, followed by the Redondo Beach chronically homeless, elderly individuals who are experiencing homelessness or are at risk of being homeless and to honorably discharged Veterans.
The RBHA PBV program will be administered under the City’s Housing Choice Voucher Program policies and procedures. Individuals referred to Century Moonstone, LLC will be subject to the same criminal background and income eligibility screening as families accepted through the waiting list. Additionally, PBV program participants will be responsible for complying with the same program rules and federal regulations to maintain their housing assistance.
The RBHA has a total of 20 families housed at The Moonstone. The waiting list for the PBV program is currently open but is by referral only. Referrals must be submitted to the Housing Authority by the City’s Homeless Housing Navigator or by an approved Coordinated Entry System (CES) agency.
HUD-VASH Vouchers
Veterans experiencing homelessness are referred to the Housing Authority by the Veteran’s Affairs office. RBHA has a total of 34 veterans housed in Redondo Beach under the HUD-VASH program. The goal of RBHA is to utilize all VASH vouchers allocated to the city. The renewal of these vouchers is included in the overall program Administrative Report
Status Report on the Section 8 Program
funding for CY 2025.
’U
Section 8 Funding U
Housing Assistance Payments (HAP) are comprised of HUD monies provided to the Housing Authority for rental assistance payments made to landlords on behalf of qualifying Section 8 program participants.
In May of 2025, HUD notified the Housing Authority that it would receive $8,842,587 in HAP funding for CY 2025 (this is the total funding for the HCV and VASH Program). For comparison purposes, the Housing Authority received $7,486,748 for CY 2024.
The Housing Authority receives full funding plus ongoing administrative fee funding to administer up to 29 Emergency Housing Vouchers. EHV eligible recipients are individuals and families who are experiencing homelessness; at risk of experiencing homelessness; fleeing, or attempting to flee domestic violence, dating violence, sexual assault, stalking, or human trafficking; or were recently homeless and for whom providing rental assistance will prevent the family’s homelessness or having high risk of housing instability. RBHA has partnered with the Los Angeles Homeless Services Authority, LAHSA, for program support and family referrals.
On March 6, 2025, all PHA’s were directed to stop issuing Emergency Housing Vouchers (EHV). The RBHA will continue to administer the current 21 EHVs with funding available through March 2026. Staff is awaiting further guidance from HUD on how to most efficiently transition current EHV vouchers to potential HCVs.
The EHV Vouchers are already administered under the City’s HCV Program policies and procedures, where families accepted through the EHV program will be subject to the same criminal background and income eligibility screening as families accepted through the waiting list. Additionally, EHV families will be responsible for complying with the same program rules and federal regulations to maintain their housing assistance. On February 16, 2022, the RBHA entered into an intra-agency agreement with the Los Angeles County Development Authority (LACDA); this intra-agency agreement allows EHV voucher holders to secure housing anywhere within the Los Angeles County area where their housing voucher is accepted.
Payment Standards
The Department of Housing and Urban Development (HUD) requires Housing Authorities to establish a payment standard in the “basic” approvable range 90%-110% of the published fair market rent (FMR) for Los Angeles County.
The basic range complies with section 24 of the Code of Federal Regulations Administrative Report
Status Report on the Section 8 Program
(CFR)
982.503 and Public and Indian Housing (PIH) Notice 2002-20. Rental rates and rent increases continue to burden many of our low-income families that live in subsidized rental units under the Section 8 program.
On August 4, 2023, the Department of Housing and Urban Development (HUD) granted RBHA an exception payment standard for the HUD-VASH voucher program. The RBHA now has authorization to set the HUD-VASH payment standard between 111% to 160% of the 2024 FMRs. Effective February 1, 2024 the VASH payment standards for RBHA were increased to 135% of the Federal Fiscal Year (FFY) 2024 Fair Market Rents. This increase in payment standard will enable veterans to competitively search and secure housing throughout Los Angeles County.
The Housing Authority reviews and updates its payment standards for the Section 8 rental assistance program on an annual basis or as needed. The payment standards are updated to reflect current rental market conditions to offer Section 8 families greater housing choices. Effective February 1, 2024 RBHA’s payment standards for the HCV (Housing Choice Voucher Program) and the EHV (Emergency Housing Voucher Program) were increased to 95% of the Federal Fiscal Year (FFY) 2024 Small Area Fair Market Rents. Payment standards for the HCV, VASH, and EHV programs had been last increased in March 2023. The following Payment Standards became effective February 1, 2024:
90277 90278 VASH (for both Zip
Codes)
0 Bedroom $2,261 $2,062 $2,399
1 Bedroom $2,546 $2,328 $2,708
2 Bedroom $3,230 $2,955 $3,434
3 Bedroom $4,142 $3,791 $4,405
4 Bedroom $4,570 $4,180 $4,860
Housing Authority Staff
The Housing Authority staff consists of 4 full-time and 1 part-time personnel who manage Section 8 client files, interview program candidates from the waiting list, perform housing inspections, provide customer service, and submit required information to HUD.
Administrative Report
Status Report on the Section 8 Program
Section 8 Waiting List
The Section 8 tenant-based voucher waiting list has been closed to new enrollees since September 2015. This strategy is consistent with funding, the agency’s 5-year plan, and the discretionary authority granted to the Housing Authority. In January 2023 the HCV Section 8 waiting list was purged. Applicants who failed to reply or indicate continued interest were removed from the waiting list. There are now approximately 965 families left on the Redondo Beach Section 8 waiting list. The goal for the waiting list is to maintain an active pool of applicants at all times. Preference on the tenantbased voucher waiting list is given to Redondo Beach residents and to persons who work in Redondo Beach. Priority is also given to the elderly, disabled, families (2 or more people in a household), honorably discharged Veterans of the U.S. Armed Forces, and individuals experiencing homelessness. Section 8 waiting list applicants that wish to check their status on the waiting list are encouraged to visit 2www.waitlistcheck.comU27Tor call (855) 361-9512.
Statistics on the families on the Section 8 tenant-based voucher waiting list are detailed below.
WAITLIST TOTALS *
Applicants on the RBHA Section 8 List 971
Families with Children 495 50.98%
Elderly Families 262 26.11%
Families with Disabilities
*there is overlap in categories
WAITLIST TOTALS BY INCOME
444 45.73%
Extremely Low Income 697 71.78%
Very Low Income 227 23.21%
Low Income 0 0.00%
Over Income 47 4.87%
WAITLIST TOTALS BY PREFERENCE
Live or Work in Redondo Beach 2
Honorably Discharged Veterans 0
Families, Elderly or Disabled 947
Ineligible for Preferences 24
Administrative Report
Status Report on the Section 8 Program
Fair Housing Program
The Housing Authority continues to refer customers who need fair housing assistance to the Housing Rights Center, an agency partially funded by the City’s CDBG Program.
Persons needing assistance can contact the Housing Rights Center at (800) 477- 5977. Their services include housing discrimination investigations, landlord/tenant mediation and counseling services.
COORDINATION
This report was prepared by the Housing Division of the Community Services Department.
FISCAL IMPACT
The Section 8 Program is funded solely with grant monies from the U.S. Department of Housing and Urban Development. The Housing Authority’s funding allocation for FY 2025-26 is $8,842,587.
Submitted by: Approved for forwarding by:
Elizabeth Hause, Housing Administrator Mike Witzansky, City Manager Authority Action Date: JUNE 17, 2025
To: CHAIRMAN AND MEMBERS OF THE HOUSING AUTHORITY
From: ELIZABETH HAUSE, HOUSING ADMINISTRATOR
Subject: DISCUSSION AND POSSIBLE ACTION REGARDING THE APPROVAL
OF A MEMORANDUM OF UNDERSTANDING WITH THE COUNTY OF
LOS ANGELES DEPARTMENT OF CHILDREN AND FAMILY SERVICES
FOR THE IMPLEMENTATION OF THE FOSTER YOUTH TO
INDEPENDENCE PROTECTION VOUCHER PROGRAM
EXECUTIVE SUMMARY
The Foster Youth to Independence (FYI) program is a federally funded housing initiative aimed at preventing homelessness among youth transitioning out of the foster care system. Through a partnership with Los Angeles County DCFS, the Redondo Beach Housing Authority will administer up to five HUD-funded housing vouchers for eligible youth, paired with wraparound supportive services. The program supports housing stability, self-sufficiency, and long-term success for vulnerable transition-age youth.
Staff recommends approval of the MOU with DCFS to implement the FYI program locally.
BACKGROUND
In 2024, the Redondo Beach Housing Authority (RBHA) was notified of the Foster Youth to Independence (FYI) initiative, a specialized voucher program launched by the U.S.
Department of Housing and Urban Development (HUD). This program provides Tenant Protection Vouchers (TPVs) to youth with current or prior involvement in the foster care system to support their transition to independent adulthood.
Program Purpose
The FYI initiative is designed to prevent homelessness among young people exiting the child welfare system by providing up to 36 months of rental assistance under the Housing Choice Voucher (HCV) program. The program is intended to support youth who:
• Are between the ages of 18 and 24 (have not yet turned 25); • Are exiting foster care or will exit within 90 days per a transition plan; • Are homeless or at risk of homelessness.
Eligible youth may qualify for up to an additional 24 months of support if they meet the requirements under the Fostering Stable Housing Opportunities (FSHO) amendments. In Administrative Report
Administrative Report June 17, 2025
Foster Youth to Independence Voucher Program
addition to housing support, the program mandates the provision of wraparound supportive services aimed at fostering self-sufficiency.
Roles and Responsibilities
The City’s MOU with Los Angeles County DCFS establishes a partnership to implement the FYI TPV program, under which DCFS will identify and support eligible foster youth, and the Redondo Beach Housing Authority will determine eligibility and issue housing vouchers.
RBHA will:
• Accept up to five (5) FYI referrals from DCFS on an on-demand basis; • Administer vouchers in accordance with federal HCV guidelines; • Provide orientation and connections to local support programs; • Coordinate with DCFS monthly to monitor program progress; • Train DCFS staff as needed on program procedures.
DCFS will:
• Prioritize and refer eligible youth based on vulnerability indicators (e.g., housing instability, lack of family support, disabilities);
• Provide services such as housing search assistance, job readiness support, counseling, life skills training, and education planning; • Maintain ongoing case management for the duration of each participant’s involvement (ideally 36 months);
• Ensure communication and monthly reporting to RBHA;
• Support ongoing collaboration and cross-agency training to enhance program delivery.
Program Goals and Next Steps
The FYI program is part of a broader regional strategy to reduce youth homelessness and improve outcomes for transition-age youth. The program aims to ensure at least 90% of participants remain housed for one year, while promoting long-term stability and self-sufficiency through individualized case planning. If approved, RBHA staff will coordinate with DCFS to implement the program, process referrals, begin monthly reporting, and monitor funding opportunities to sustain or expand participation. Staff recommends the Housing Authority approve the MOU with DCFS, allowing the implementation of the FYI program in Redondo Beach.
COORDINATION
This report was prepared by the Community Services Department.
FISCAL IMPACT
There is no fiscal impact to the City, as the FYI Tenant Protection Vouchers and associated rental subsidies are fully funded by HUD.
Administrative Report June 17, 2025
Foster Youth to Independence Voucher Program
Submitted by: Approved for forwarding by:
Elizabeth Hause, Community Services Director Mike Witzansky, City Manager Attachments:
• MOU Foster Youth to Independence Program
1 MEMORANDUM OF UNDERSTANDING BETWEEN
COUNTY OF LOS ANGELES DEPARTMENT OF CHILDREN AND FAMILY
SERVICES
AND
CITY OF REDONDO BEACH HOUSING AUTHORITY FOR
FOSTER YOUTH TO INDEPENDENCE TENANT PROTECTION VOUCHERS I. Introduction and Purpose:
Through the Foster Youth to Independence (FYI) initiative, the U.S. Department of Housing and Urban Development (HUD) will provide Tenant Protection Vouchers (TPVs), for youth eligible under the Family Unification Program (FUP), to conform with “Home Together,” the Federal Strategic Plan to prevent and end homelessness. These TPVs will be subject to availability and are collectively referred to as the FUP - FYI TPV Program. Through this targeted allocation, HUD is investing in local, cross-system collaborative efforts to prevent and end homelessness among youth with a current or prior history of child welfare involvement. The success of these efforts requires that community partners coordinate effectively to identify, target, and connect eligible youth at-risk of or experiencing homelessness to housing and related supports.
This Memorandum of Understanding (MOU) is between the County of Los Angeles Department of Children and Family Services (DCFS), and the City of Redondo Beach Housing Authority (PHA).
a. PHA and DCFS commit to administer the FUP - FYI TPV Program such that, to the maximum extent feasible, it serves to:
i. Ensure that rental assistance payments help youth participating in DCFS child welfare system to find affordable and decent housing in a safe and supportive environment;
ii. Ensure that youth leaving foster care are safe and secure, and are not subject to inadequate housing as a result of neglect;
iii. Empower youth to resolve their own problems, to effectively utilize service systems and community institutions by providing supportive services to address the youths’ needs beyond the housing stabilization; iv. Ensure that problems arising from homelessness or inadequate housing are identified as early as possible and engage youth in a change process to remedy these problems; and,
v. Help youth to transition to adulthood and to become self-sufficient. b. PHA will cooperate with DCFS to administer the FUP-FYI TPVs and will provide any assistance needed to help DCFS administer and achieve its goals in regard to the FUP - FYI TPV Program. All named agencies will continue to 2 collaborate in terms of program implementation, modifications to ensure that youth receive the best support possible to ensure housing stability. Over the last several years, DCFS has been working in Los Angeles County with the Homeless Initiative (HI) to formulate a plan to address homelessness within the Los Angeles County. With the guidance of the HI, DCFS has been working on developing a County action plan to address the homelessness issue in Los Angeles County and has established baseline data to assist in accomplishing the goals of HI. This partnership will continue to support the administration of the FUP – FYI TPV program and be integrated into the overall County HI’s continuum of services.
c. The FUP - FYI TPV Program’s desired outcomes are as follows:
i. At least 90 percent of youth participating in the FUP- FYI TPV Program will obtain and maintain FUP - FYI TPV-subsidized housing for at least one year.
ii. Two years after the youth move(s) to a Section 8-subsidized unit or after the date of reunification, in the case of a previous out-of-home placement, at least 65 percent of such youth will remain with their families whether or not they continue living in Section 8-subsidized housing. d. The names, staff positions, and contact information at DCFS and PHA who will serve as the lead FUP - FYI TPV Program liaisons are as follows:
Name, title and address of DCFS liaisons:
County of Los Angeles
Department of Children and Family Services
510 S. Vermont Ave, 14th Floor
Los Angeles, CA, 90020
Attention: Michael Scoggins, Children Services Administrator III Email Address: [email protected]
Phone Number: (213) 763-9334
Robert Castaneda, Children Services Administrator II
510 S. Vermont Ave, 14th Floor
Los Angeles, CA, 90020
Email Address: [email protected]
Phone Number: (213) 763-9307
Name and title of PHA liaison:
City of Redondo Beach
Community Services Department
1922 Artesia Blvd.
3 Redondo Beach, CA 90278
Attention: Elizabeth Hause
Email Address: [email protected]
Phone Number: ( 310) 697-3391
II. Term
The term of the MOU will be effective on June 3, 2025, and will continue through July 31, 2027, unless terminated earlier pursuant to the terms of this agreement.
III. Statement of Cooperation:
DCFS agrees to cooperate with HUD and will provide requested data to HUD or HUD-approved contractor(s), delegated with the responsibility of program evaluation, consistent with applicable confidentiality laws, including but not limited to California Welfare and Institutions Code section 827, et seq., and to follow all evaluation protocols established by HUD or HUD-approved contractor(s), including other applicable assignment procedures. All named agencies will communicate on an ongoing and as needed basis to ensure that HUD receives the requested information.
IV. Definition of Youth Population Eligible for FYI TPV Assistance:
The FUP-eligible youth is defined as a youth that DCFS has certified to be:
a. at least 18 years old, and not more than 24 years of age, and who has left foster care, or will leave foster care within 90 days, in accordance with a transition plan described in section 475(5)(H) of the Social Security Act at age 16 or older; and
b. homeless or at-risk of becoming homeless, as these terms are defined at 24 CFR 578.3 and 24 CFR 576.2.
Eligibility is not limited to single persons, for example, pregnant and/or parenting youth are eligible to receive assistance if they meet eligibility requirements.
V. Housing Search Assistance:
DCFS-involved youth are impacted by issues of child abuse and neglect and have multiple and complex challenges due to other issues including health, mental health, substance abuse, and domestic violence that impact the youth’s ability to obtain and maintain stable housing.
4 DCFS will identify and prioritize at-risk homeless youth and work closely with PHA to assist FUP-eligible youth to locate housing units and to secure appropriate eligible units.
DCFS will provide case management services to youth with open DCFS case(s) through various contracted providers that offer various services such as inhome counseling, teaching and demonstrating life skills, short term counseling, long term mental health counseling, domestic violence and substance abuse services, parenting classes, transportation, concrete supports (food, clothing, financial assistance with rent and deposit, furniture and appliances) and advocacy to navigate various public systems. Additionally, DCFS will provide housing stabilization and case management. These services will be provided prior to and after permanent housing is secured and will be focused on coordinating and delivering services that ensure long-term housing stability.
VI. Services to Be Provided to FUP-Eligible Youths:
FUP-eligible youths will be an integral part of the FUP - FYI TPV Program.
Based on the youth’s needs, PHA will designate up to 5 TPVs for FUP-eligible youth on an on-demand basis.
Currently, DCFS’ youth receive various services such as those outlined below either directly through DCFS or through contracted community providers. All youth who are in the FUP - FYI TPV Program are eligible to receive the following services as needed and as outlined in their individual case plans:
a. Basic life skills information and counseling on money management, use of credit, housekeeping, proper nutrition concepts, meal preparation, and access to health care (e.g., doctors, medication, and mental and behavioral health services);
b. Counseling on compliance with rental lease requirements and with Housing Choice Voucher (HCV) program participant requirements, including assistance or referrals for assistance on security deposits, utility hook-up fees, and utility deposits;
c. Providing assurances to owners of rental property that are reasonable and necessary to assist a FUP-eligible youth to rent a unit with a TPV; 5 d. Job preparation and attainment counseling (where to look, how to apply, appropriate dress code, grooming, relationships with supervisory personnel, etc.);
e. Educational and career advancement counseling regarding attainment of general equivalency diploma (GED); attendance and financing of education at a technical school, trade school or college; including successful work ethic and attitude models; and
f. Formulation of needs assessment and individualized case plan for each FUP- eligible youth detailing services to be received and ensuring participation of each FUP-eligible youth in assessment and implementation of actions taken to address their needs (includes obtainment of FUP-eligible youth’s commitment to plan to satisfy the requirement to sign a service plan agreeing to attend counseling and training sessions and take other actions as deemed appropriate to youth’s successful transition from foster care).
Note: A youth’s failure to fulfill obligations under the service plan is not grounds to terminate the youth from the FUP – FYI TPV Program.
All the above services will be provided for a period of up to 36 months to FUP-eligible youth receiving rental assistance through the use of a FYI TPV, regardless of age. For example, if a FUP-eligible youth enters the program at age 24, DCFS may continue to provide 36 months of service, even though after two months, the youth no longer meets the initial age of eligibility requirements.
VII. PHA Responsibilities:
PHA agrees to the following:
a. PHA will accept referrals of youth certified by DCFS as eligible for assistance under FUP - FYI TPV. PHA, upon receipt of the referrals from DCFS, will enter the clients’ information into the PHA’s client data management system. If the youth has already been entered into the PHA’s client data management system as an applicant on the HCV waitlist, the data management system will produce a message indicating that a duplicate record exists. b. PHA will determine if youth ages 18 through 24 referred by DCFS are eligible for HCV assistance and place eligible youths on the HCV waitlist. Eligibility will be determined in accordance with the applicable HCV regulations and procedures, including income determinations incorporating Electronic 6 Verification and HUD’s Enterprise Income Verification system, as applicable, and asset verification. If a youth is found to be ineligible for not meeting the HCV requirements, including but not limited to, income eligibility, or not passing criminal background checks, the PHA reserves the right to deny the issuance of a voucher for that referral.
c. PHA will administer the FUP – FYI TPVs to FUP-eligible youth with identified housing needs. FUP-eligible youth may also be enrolled in or eligible to participate in DCFS Youth Development Services program, that provides comprehensive services and resources to assist Transition Age Youth (TAY) successfully transition from dependency to self-sufficiency. d. PHA will amend the administrative plan, in accordance with applicable program regulations and requirements, if needed.
e. PHA will administer the FUP – FYI TPVs in accordance with all applicable program regulations and requirements.
f. PHA will refer FUP-eligible youth to the Family Self Sufficiency Program Coordinator, if needed, who will assist and connect the youth to related programs and services with the objective to reduce the dependency on welfare assistance, HCV assistance, public assistance, or any Federal, State, or local rent or homeownership subsidies.
This is accomplished by providing linkages to resources within the community, which may include but are not limited to case management, job training, educational workshops, counseling, and other forms of social assistance that assist participants in achieving economic independence.
Participation by the FUP-eligible youth is voluntary.
g. PHA will comply with the provisions of this MOU.
h. If changes are made to the rules governing the FUP - FYI TPV or to PHA’s HCV policies and procedures as they pertain to FUP - FYI TPV, or in the event that new DCFS staff are assigned to the FUP - FYI TPV Program, PHA will conduct training to ensure that DCFS staff are familiarized with PHA’s current HCV procedures as they pertain to the FUP - FYI TPV Program and have the capacity to interface with PHA effectively throughout the referral process. During such training, DCFS will be provided with any updated PHA forms pertaining to the FUP - FYI TPV process and will be briefed on any 7 updated FUP - FYI TPV rules and/or updated PHA HCV policies and procedures pertaining to the program.
VIII. DCFS Responsibilities:
DCFS commits to the following plan:
a. DCFS will identify and prioritize FUP-eligible youth whose housing stability is impacted by the following:
• Currently homeless or living in an unsafe environment for youth (which could be due to criminal activity, sex abuse, condition of the home, etc.);
• History of substance abuse, mental health issues, evictions, unstable housing, frequent moves, absent without leave, child welfare involvement;
• Current physical, mental, or emotional disabilities;
• Lack of job skills or ability to work; and,
• Lack of safe and appropriate family support.
b. DCFS will ensure that referrals are made as the youth are identified, and not only upon successful completion of other aspects of case management plans.
c. DCFS will identify FUP-eligible youth who are current and former foster youth. Priority will be given to those who are at-risk of becoming homeless and will or have recently exited one of DCFS’ housing programs.
FUP-eligible youth who receive FUP – FYI TPVs will receive case management services.
d. DCFS will provide all FUP-eligible youth with case management services that include the completion of ongoing case planning needs assessments as well as termination needs assessments. During the development of the needs assessments, a FUP-eligible youth will report whether they have a permanent housing exit destination or if they instead require housing assistance because they are at risk of becoming homeless. e. DCFS will commit sufficient staffing resources to the FUP - FYI TPV Program to ensure that the foregoing process is carried out as efficiently as possible.
8 f. DCFS will provide written certification to PHA that a youth is FUP-eligible, based upon the criteria established in HUD’s Foster Youth to Independence Tenant Protection Vouchers (FYI-TPV) policy.
g. DCFS will communicate with PHA via a monthly FUP - FYI TPV report maintained by PHA, which will track each referred FUP-eligible youth throughout the lifetime of the FUP- FYI TPV process. The Monthly FYI TPV Report includes data points for the date of the youth’s first interview appointment, the date of the TPV appointment, and the date the client is issued a FYI TPV. PHA will communicate with DCFS on a monthly basis to identify whether or not PHA has any identified FUP – FYI TPVs available for issuance.
h. FUP-eligible youth will receive ongoing case management services, including, at minimum: ongoing needs assessments and referrals to Community Based Supportive Services (CBSS) and to Supportive Housing Division service providers for comprehensive services and resources to assist youth with to successfully transitioning from dependency to selfsufficiency. CBSS providers will provide regular contact for at least six months subsequent to FUP - FYI TPV issuance, and, ideally for 36 additional months during the period of FUP - FYI TPV participation. i. FUP-eligible youth, whose DCFS cases are terminated, will also be provided with Prevention and Aftercare support that includes case navigation, linkages to services, parenting education, financial literacy training, structured parent-child and family-centered activities, neighborhood and community action groups, peer support groups, and other concrete services. j. Upon notification that FUP - FYI TPVs have been issued, DCFS’ program manager will train the PHA staff on the DCFS referral procedures, as needed. Agencies will develop cross training to ensure consistency in the program administration.
k. DCFS will conduct monthly meetings with PHA to continue the services collaboration to ensure the ongoing administration of the FUP - FYI TPV Program and to continue the collaboration for the Countywide initiative to address homelessness.
l. DCFS will comply with the provisions of this MOU.
9 IX. Confidentiality
To the maximum extent provided under law, the parties to this MOU will comply with all applicable laws pertaining to confidentiality including, but is not limited to, the confidentiality provisions of California Welfare and Institutions Code §§ 827 and 10850, as well as California Department of Social Services Manual of Policies and Procedures Division 19, FERPA, (20 U.S.C. § 1232g), and 34 CFR Part 99.
X. Data Privacy and Security
All parties shall ensure that all data related to the FUP - FYI TPV Program is managed and stored in compliance with applicable federal, state, and local data privacy laws and regulations including the Information Security and Privacy protocols outlined in the attached Exhibit A: Information Security and Privacy Requirements. This exhibit provides comprehensive guidance on confidentiality, data handling, and information protection. The parties shall establish clear protocols for data sharing, ensuring that only authorized personnel have access to sensitive information.
XI. Notices
All notices, consents, requests, demands, and other communications required under this MOU will be in writing and will be deemed effective: 1) by electronic mail; 2) personal delivery; 3) confirmed delivery by courier services; or 4) the United States mail, addressed to the FUP - FYI TPV Program Liaison set forth in Section I.(d) above.
Changes may be made in the names or addresses of persons to whom notices are to be given by giving notice in the manner prescribed in this section.
XII. Assignment
No right or obligation arising under this MOU is assignable by PHA or DFCS, in whole or in part, without the prior written consent of the other party.
XIII. Independent Contractor Status
PHA and DCFS will perform the services as contained herein as independent contractors, not as an employee of the other party or under the other party’s supervision or control. This MOU is by and between PHA and DCFS, and is not intended, and will not be construed, to create the relationship of agent, servant, employee, partnership, joint venture, or association, between PHA and DCFS. 10 XIV. Amendments
Any changes, modification, or extension to this MOU will be enacted only by a written amendment executed by PHA and DCFS.
XV. Termination
Either party may terminate this MOU with or without cause but will endeavor to give 30-day prior written notice. The notice of termination will specify the date upon which such termination becomes effective.
XVI. Entire Agreement
This MOU constitutes the complete and exclusive statement of understanding between the parties and supersedes all previous agreements relating to the subject matter of this MOU.
[SIGNATURES FOLLOW ON NEXT PAGE]
11 IN WITNESS WHEREOF, DCFS AND PHA by and through their duly authorized representatives have caused this MOU to be subscribed to on the day and year first above written.
CITY OF REDONDO BEACH COUNTY OF LOS ANGELES
DEPARTMENT OF
PUBLIC HOUSING AUTHORITY CHILDREN AND FAMILY SERVICES
By: __________________________________ By: __________________________ James A. Light, Brandon T. Nichols,
Chairman of the Housing Authority Director
Date: ________________________________ Date: ________________________
ATTEST: ATTEST:
By: __________________________________ By: __________________________ Eleanor Manzano,
Clerk-Controller of the Housing Authority
APPROVED AS TO FORM: APPROVED AS TO FORM:
BY THE OFFICE OF LOS ANGELES
COUNTY COUNSEL
Dawyn R. Harrison, County Counsel
By: __________________________________ By: __________________________ Joy Ford, David Beaudet,
Legal Counsel of the Housing Authority Senior Deputy County Counsel 05/19/25
12 EXHIBIT A
INFORMATION SECURITY AND PRIVACY REQUIREMENTS
See the attached requirements.
Information Security and Privacy
10/30/2020 Version
INFORMATION SECURITY AND PRIVACY
REQUIREMENTS
The County of Los Angeles (“County”) is committed to safeguarding the Integrity of the County systems, data, information, and protecting the privacy rights of the individuals that it serves. This Information Security and Privacy Requirements Exhibit (“Exhibit”) sets forth the County and the Contractor’s commitment and agreement to fulfill each of their obligations under applicable state or federal laws, rules, or regulations, as well as applicable industry standards concerning privacy, data protections, information security, confidentiality, availability, and integrity of such information. The Information Security and Privacy Requirements and Procedures in this Exhibit are to be established by the Contractor before the effective date of the Contract and maintained throughout the term of the Contract.
These requirements and procedures are a minimum standard and are in addition to the requirements of the underlying base agreement between the County and Contractor (the “Contract”) and any other agreements between the parties. However, it is the Contractor's sole obligation to: (i) implement appropriate and reasonable measures to secure and protect its systems and all County information against internal and external threats and risks; and (ii) continuously review and revise those measures to address ongoing threats and risks.
Failure to comply with the minimum requirements and procedures set forth in this Exhibit will constitute a material, non-curable breach of Contract by the Contractor, entitling the County, in addition to the cumulative of all other remedies available to it at law, in equity, or under the Contract, to immediately terminate the Contract. To the extent there are conflicts between this Exhibit and the Contract, this Exhibit shall prevail unless stated otherwise.
1. DEFINITIONS
Unless otherwise defined in the Contract, the definitions herein contained are specific to the uses within this exhibit.
a. Availability: the condition of information being accessible and usable upon demand by an authorized entity (workforce member or process).
b. Confidentiality: the condition that information is not disclosed to system entities (users, processes, devices) unless they have been authorized to access the information. c. County Information: all data and information belonging to the County. d. Data: a subset of information comprised of qualitative or quantitative values. e. Incident: a suspected, attempted, successful, or imminent threat of unauthorized electronic and/or physical access, use, disclosure, breach, modification, or destruction of information; interference with information technology operations; or significant violation of County policy. f. Information: any communication or representation of knowledge or understanding such as facts, data, or opinions in any medium or form, including electronic, textual, numerical, graphic, cartographic, narrative, or audiovisual.
g. Information Security Policy: high level statements of intention and direction of an organization used to create an organization’s Information Security Program as formally expressed by its top management. h. Information Security Program: formalized and implemented Information Security Policies, standards, and procedures that are documented describing the program management safeguards and common controls in place or those planned for meeting the County’s information security requirements. i. Information Technology: any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, Information Security and Privacy
10/30/2020 Version
switching, interchange, transmission, or reception of data or information. j. Integrity: the condition whereby data or information has not been improperly modified or destroyed and authenticity of the data or information can be ensured. k. Mobile Device Management (MDM): software that allows information technology administrators to control, secure, and enforce policies on smartphones, tablets, and other endpoints. l. Privacy Policy: high level statements of intention and direction of an organization used to create an organization’s Privacy Program as formally expressed, by its top management. m. Privacy Program: a formal document that provides an overview of an organization’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the organization’s privacy official and other staff, the strategic goals and objectives of the Privacy Program, and the program management controls and common controls implemented or proposed for meeting applicable privacy requirements and managing privacy risks. n. Risk: a measure of the extent to which the County is threatened by a potential circumstance or event.
Risk is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.
o. Threat: any circumstance or event with the potential to adversely impact the County’s operations (including mission, functions, image, or reputation), organizational assets, individuals, or other organizations through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
p. Vulnerability: a weakness in a system, application, network, or process that is subject to exploitation or misuse.
q. Workforce Member: employees, volunteers, and other persons whose conduct, in the performance of work for Los Angeles County, is under the direct control of Los Angeles County, whether or not they are paid by Los Angeles County. This includes, but may not be limited to, full and part time elected or appointed officials, employees, affiliates, associates, students, volunteers, and staff from third party entities who provide service to the County.
2. INFORMATION SECURITY AND PRIVACY PROGRAMS
a. Information Security Program. The Contractor shall maintain an agency-wide Information Security Program designed to evaluate risks to the confidentiality, availability, and integrity of the County’s information covered under this Contract.
The Contractor’s Information Security Program shall include the creation and maintenance of information security policies, standards, and procedures. Information Security Policies, standards, and procedures will be communicated to all Contractor employees in a relevant, accessible, and understandable form and will be regularly reviewed and evaluated to ensure operational effectiveness, compliance with all applicable laws and regulations, and address new and emerging threats and risks.
The Contractor shall exercise the same degree of care in safeguarding and protecting the County’s information that the Contractor exercises with respect to its own information and data, but in no event less than a reasonable degree of care. The Contractor will implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentiality, integrity, and availability of County information.
The Contractor’s Information Security Program shall:
• Protect the confidentiality, integrity, and availability of County information in the Contractor’s possession or control;
• Protect against any anticipated threats or hazards to the confidentiality, integrity, and availability of Information Security and Privacy
10/30/2020 Version
County information;
• Protect against unauthorized or unlawful access, use, disclosure, alteration, or destruction of County information;
• Protect against accidental loss or destruction of, or damage to, County information; and • Safeguard the County’s information in compliance with any applicable laws and regulations, which applies to the Contractor.
b. Privacy Program. The Contractor shall establish and maintain an agency-wide Privacy Program designed to incorporate privacy policies and practices in its business operations to provide safeguards for information, including County information. The Contractor’s Privacy Program shall include the development of, and ongoing reviews and updates to, privacy policies, guidelines, procedures and appropriate workforce privacy training within its organization. These privacy policies, guidelines, procedures, and appropriate training will be provided to all Contractor employees, agents, and volunteers.
The Contractor’s privacy policies, guidelines, and procedures shall be continuously reviewed and updated for effectiveness and compliance with applicable laws and regulations, and to appropriately respond to new and emerging threats and risks. The Contractor’s privacy program shall perform ongoing monitoring and audits of operations to identify and mitigate privacy threats.
The Contractor shall exercise the same degree of care in safeguarding the privacy of County information that the Contractor exercises with respect to its own information, but in no event less than a reasonable degree of care. The Contractor will implement, maintain, and use appropriate privacy practices and protocols to preserve the confidentiality of County information.
The Contractor’s Privacy Program shall include:
• A Privacy Program framework that identifies and ensures that the Contractor complies with all applicable laws and regulations;
• External and internal privacy policies, procedures, and controls to support the privacy program; • Protections against unauthorized or unlawful access, use, disclosure, alteration, or destruction of County information;
• A training program that covers privacy policies, protocols, and awareness; • A response plan to address privacy incidents and privacy breaches; and • Ongoing privacy assessments and audits.
3. PROPERTY RIGHTS TO COUNTY INFORMATION
All County information is deemed property of the County, and the County shall retain exclusive rights and ownership thereto. County information shall not be used by the Contractor for any purpose other than as required under this Contract nor shall such or any part of such be disclosed, sold, assigned, leased, or otherwise disposed of, to third parties by the Contractor, or commercially exploited or otherwise used by, or on behalf of, the Contractor, its officers, directors, employees, or agents. The Contractor may assert no lien on or right to withhold from the County, any County information it receives from, receives addressed to, or stores on behalf of, the County. Notwithstanding the foregoing, the Contractor may aggregate, compile, and use County information in order to improve, develop, or enhance the system software and/or other services offered, or to be offered, by the Contractor, provided that (i) no County information in such aggregated or compiled pool is identifiable as originating from or can be traced back to the County, and (ii) such data or information cannot be associated or matched with the identity of an individual alone; or linkable to a specific individual.
4. CONTRACTOR’S USE OF COUNTY INFORMATION
Information Security and Privacy
10/30/2020 Version
The Contractor shall collect, maintain, or use County information in compliance with all applicable local, state, and federal laws and regulations governing the collection, maintenance, transmission, dissemination, storage, use, and destruction of County information, including, but not limited to, (i) any state and federal law governing the protection of personal information, (ii) any state and federal security breach notification laws, and (iii) the rules, regulations, and directives of the Federal Trade Commission, as amended from time to time.
5. SHARING COUNTY INFORMATION AND DATA
The Contractor shall not share, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, County information to a third party for monetary or other valuable consideration.
a. Retention of County Information. The Contractor shall not retain any County information for any period longer than necessary for the Contractor to fulfill its obligations and applicable law, whichever is longest.
6. CONTRACTOR EMPLOYEES
The Contractor shall perform background and security investigation procedures in the manner prescribed in this section unless the Contract prescribes procedures for conducting background and security investigations and those procedures are no less stringent than the procedures described in this section.
To the extent permitted by applicable law, the Contractor shall screen and conduct background investigations on all Contractor employees and Subcontractors as appropriate to their role, with access to County information for potential security risks. Such background investigations must be obtained through fingerprints submitted to the California Department of Justice to include State, local, and federal-level review and conducted in accordance with the law, may include criminal and financial history to the extent permitted under the law, and will be repeated on a regular basis. The fees associated with the background investigation shall be at the expense of the Contractor, regardless of whether the member of the Contractor’s staff passes or fails the background investigation. The Contractor, in compliance with its legal obligations, shall conduct an individualized assessment of their employees, agents, and volunteers regarding the nature and gravity of a criminal offense or conduct; the time that has passed since a criminal offense or conduct and completion of the sentence; and the nature of the access to County information to ensure that no individual accesses County information whose past criminal conduct poses a risk or threat to County information.
The Contractor shall require all employees, agents, and volunteersto abide by the requirements in this Exhibit, as set forth in the Contract, and sign an appropriate written confidentiality/non-disclosure agreement with the Contractor.
The Contractor shall supply each of its employees with appropriate, annual training regarding information security procedures, risks, and threats. The Contractor agreesthat training will cover, but may not be limited to the following topics:
a) Secure Authentication: The importance of utilizing secure authentication, including proper management of authentication credentials (login name and password) and multi-factor authentication. b) Social Engineering Attacks: Identifying different forms of social engineering including, but not limited to, phishing, phone scams, and impersonation calls.
c) Handling of County Information: The proper identification,storage, transfer, archiving, and destruction of County information.
d) Causes of Unintentional Information Exposure: Provide awareness of causes of unintentional exposure of information such as lost mobile devices, emailing information to inappropriate recipients, etc. e) Identifying and Reporting Incidents: Awareness of the most common indicators of an incident and how Information Security and Privacy
10/30/2020 Version
such indicators should be reported within the organization. f) Privacy: The Contractor’s privacy policies and procedures as described in Section 2b. Privacy Program.
The Contractor shall have an established set of procedures to ensure the Contractor’s employees promptly report actual and/or suspected breaches of security.
7. SUBCONTRACTORS AND THIRD PARTIES
The County acknowledges that in the course of performing its services, the Contractor may desire or require the use of goods, services, and/or assistance of Subcontractors or other third parties or suppliers. The terms of this Exhibit shall also apply to all Subcontractors and third parties. The Contractor or third party shall be subject to the following terms and conditions each Subcontractor and third party must agree in writing to comply with and be bound by the applicable terms and conditions of this Exhibit, both for itself and to enable the Contractor to be and remain in compliance with its obligations hereunder, including those provisions relating to confidentiality, integrity, availability, disclosures, security, and such other terms and conditions as may be reasonably necessary to effectuate the Contract including this Exhibit.
The Contractor will provide notice to the County’s Chief Information Security Officer and/or Chief Privacy Officer prior to subcontracting services subject to this Exhibit.
8. STORAGE AND TRANSMISSION OF COUNTY INFORMATION
All County information shall be rendered unusable, unreadable, or indecipherable to unauthorized individuals.
Without limiting the generality of the foregoing, the Contractor will encrypt all workstations, portable devices (such as mobile, wearables, tablets,) and removable media (such as portable or removable hard disks, floppy disks, USB memory drives, CDs, DVDs, magnetic tape, and all other removable storage media) that store County information in accordance with Federal Information Processing Standard (FIPS) 140-2 or otherwise approved by the County’s Chief Information Security Officer.
The Contractor will encrypt County information transmitted on networks outside of the Contractor’s control with Transport Layer Security (TLS) or Internet Protocol Security (IPSec), at a minimum cipher strength of 128 bit or an equivalent secure transmission protocol or method approved by County’s Chief Information Security Officer.
All mobile devices storing County information shall be managed by a Mobile Device Management system.
Such system must provide provisions to enforce a password/passcode on enrolled mobile devices. All workstations/personal computers (including laptops, 2-in-1s, and tablets) will maintain the latest operating system security patches and the latest virus definitions. Virus scans must be performed at least monthly.
Request for less frequent scanning must be approved in writing by the County’s Chief Information Security Officer.
9. RETURN OR DESTRUCTION OF COUNTY INFORMATION
The Contractor shall return or destroy County information in the manner prescribed in this section unless the Contract prescribes procedures for returning or destroying County information and those procedures are no less stringent than the procedures described in this section. a. Return or Destruction. Upon the County’s written request, or upon expiration or termination of this Contract for any reason, Contractor shall (i) promptly return or destroy, at the County’s option, all originals and copies of all documents and materials it has received containing County information; or (ii) if return or destruction is not permissible under applicable law, continue to protect such information in accordance with the terms of this Contract; and (iii) deliver or destroy, at the County’s option, all originals and copies of all summaries, records, descriptions, modifications, negatives, drawings, adoptions and other documents or materials, whether in writing or in machine-readable form, prepared by the Contractor, prepared under its direction, or at its request, from the documents and materials referred to in Subsection (i) of this section. For all documents or materials referred to in Subsections (i) and (ii) of this Information Security and Privacy
10/30/2020 Version
section that the County requests be returned to the County, the Contractor shall provide a written attestation on agency letterhead certifying that all documents and materials have been delivered to the County. For documents or materials referred to in Subsections (i) and (ii) of this Section that the County requests be destroyed, the Contractor shall provide an attestation on agency letterhead and certified documentation from a media destruction firm consistent with subdivision b of this section. Upon termination or expiration of the Contract or at any time upon the County’s request, the Contractor shall return all hardware, if any, provided by the County to the Contractor. The hardware should be physically sealed and returned via a bonded courier, or as otherwise directed by the County. b. Method of Destruction. The Contractor shall destroy all originals and copies by (i) cross-cut shredding paper, film, or other hardcopy media so that the information cannot be read or otherwise reconstructed; and (ii) purging, or destroying electronic media containing County information consistent with NIST Special Publication 800-88, “Guidelines for Media Sanitization” such that the County information cannot be retrieved. The Contractor will provide an attestation on agency letterhead and certified documentation from a media destruction firm, detailing the destruction method used and the County information involved, the date of destruction, and the agency or individual who performed the destruction. Such statement will be sent to the designated County contract manager within ten (10) days of termination or expiration of the Contract or at any time upon the County’s request. On termination or expiration of this Contract, the County will return or destroy all Contractor’s information marked as confidential (excluding items licensed to the County hereunder, or that provided to the County by the Contractor hereunder), at the County’s option.
10. PHYSICAL AND ENVIRONMENTAL SECURITY
All Contractor facilities that process County information will be located in secure areas and protected by perimeter security such as barrier access controls (e.g., the use of guards and entry badges) that provide a physically secure environment from unauthorized access, damage, and interference.
All Contractor facilities that process County information will be maintained with physical and environmental controls (temperature and humidity) that meet or exceed hardware manufacturer’s specifications.
11. OPERATIONAL MANAGEMENT, BUSINESS CONTINUITY, AND DISASTERRECOVERY The Contractor shall: (i) monitor and manage all of its information processing facilities, including, without limitation, implementing operational procedures, change management, and incident response procedures consistent with Section 14 SECURITY AND PRIVACY INCIDENTS; and (ii) deploy adequate anti-malware software and adequate back-up systems to ensure essential business information can be promptly recovered in the event of a disaster or media failure; and (iii) ensure its operating procedures are adequately documented and designed to protect information and computer media from theft and unauthorized access.
The Contractor must have business continuity and disaster recovery plans. These plans must include a geographically separate backup data center and a formal framework by which an unplanned event will be managed to minimize the loss of County information and services. The formal framework includes a defined backup policy and associated procedures, including documented policies and procedures designed to: (i) perform backup of data to a remote backup data center in a scheduled and timely manner; (ii) provide effective controls to safeguard backed-up data; (iii) securely transfer County information to and from backup location; (iv) fully restore applications and operating systems; and (v) demonstrate periodic testing of restoration from backup location. If the Contractor makes backups to removable media (as described in Section 9 STORAGE AND TRANSMISSION OF COUNTY INFORMATION), all such backups shall be encrypted in compliance with the encryption requirements noted above in Section 9 STORAGE AND TRANSMISSION OF COUNTY INFORMATION.
12. ACCESS CONTROL
Subject to and without limiting the requirements under Section 9 STORAGE AND TRANSMISSION OF Information Security and Privacy
10/30/2020 Version
COUNTY INFORMATION, County information: (i) may only be made available and accessible to those parties explicitly authorized under the Contract or otherwise expressly approved by the County Project Director or Project Manager in writing; and (ii) if transferred using removable media (as described in Section 9 STORAGE AND TRANSMISSION OF COUNTY INFORMATION) must be sent via a bonded courier and protected using encryption technology designated by the Contractor and approved by the County’s Chief Information Security Officer in writing. The foregoing requirements shall apply to backup media stored by the Contractor at off-site facilities.
The Contractor shall implement formal procedures to control access to County systems, services, and/or information including, but not limited to, user account management procedures and the following controls:
a. Network access to both internal and external network services shall be controlled, including, but not limited to, the use of industry standard and properly configured firewalls; b. Operating systems will be used to enforce access controls to computer resources including, but not limited to, multi-factor authentication, use of virtual private networks (VPN), authorization, and event logging; c. The Contractor will conduct regular, no less often than semi-annually, user access reviews to ensure that unnecessary and/or unused access to County information is removed in a timely manner; d. Applications will include access control to limit user access to County information and application system functions;
e. All systems will be monitored to detect deviation from access control policies and identify suspicious activity. The Contractor shall record, review, and act upon all events in accordance with incident response policies set forth in Section 14 SECURITY AND PRIVACY INCIDENTS; and f. In the event any hardware, storage media, or removable media (as described in Section 9 STORAGE AND TRANSMISSION OF COUNTY INFORMATION) must be disposed of or sent off-site for servicing, the Contractor shall ensure all County information has been eradicated from such hardware and/or media using industry best practices as discussed in Section 9 STORAGE AND TRANSMISSION OF COUNTY INFORMATION.
13. SECURITY AND PRIVACY INCIDENTS
In the event of a Security or Privacy Incident, the Contractor shall:
a. Promptly notify the DCFS’s Chief Information Security Officer of any incidents involving County information within forty-eight (48) hours of detection of the incident. All notifications shall be submitted via encrypted email and telephone.
Departmental Information Security Officer:
Allen Ohanian
Information Security Officer Address
(323) 567 9855
[email protected]; [email protected] b. Include the following information in all notices:
i. The date and time of discovery of the incident,
ii. The approximate date and time of the incident,
iii. A description of the type of County information involved in the reported incident, and iv. A summary of the relevant facts, including a description of measures being taken to respond to and remediate the incident, and any planned corrective actions as they are identified.
Information Security and Privacy
10/30/2020 Version
v. The name and contact information for the organization’s official representative(s) with relevant business and technical information relating to the incident. c. Cooperate with the County to investigate the incident and seek to identify the specific County information involved in the incident upon the County’s written request, without charge, unless the incident was caused by the acts or omissions of the County. As information about the incident is collected or otherwise becomes available to the Contractor, and unless prohibited by law, the Contractor shall provide information regarding the nature and consequences of the incident that are reasonably requested by the County to allow the County to notify affected individuals, government agencies, and/or credit bureaus. d. Immediately initiate the appropriate portions of their Business Continuity and/or Disaster Recovery plans in the event of an incident causing an interference with information technology operations. e. Assist and cooperate with forensic investigators, the County, law firms and and/or law enforcement agencies to help determine the nature, extent, and source of any incident, and reasonably assist and cooperate with the County on any additional disclosures that the County is required to make as a result of the incident.
14. AUDIT AND INSPECTION
a. Self-Audits. The Contractor shall periodically conduct audits, assessments, testing of the system of controls, and testing of information security and privacy procedures, including penetration testing, intrusion detection, and firewall configuration reviews. These periodic audits will be conducted at the Contractor’s sole cost and expense through either: (i) an internal independent audit function; (ii) a nationally recognized, external, independent auditor; or (iii) another independent auditor approved by the County.
The Contractor shall have a process for correcting control deficiencies that have been identified in the periodic audit, including follow up documentation providing evidence of such corrections.
15. CYBER LIABILITY INSURANCE
The Contractor shall secure and maintain cyber liability insurance coverage throughout the duration of the Agreement.
Information Security and Privacy
10/30/2020 Version
ADDENDUM B: CONTRACTOR HARDWARE CONNECTING TO COUNTY SYSTEMS Notwithstanding any other provisions in this Contract, the Contractor shall ensure the following provisions and security controls are established for any and all systems or hardware provided under this contract. a. Inventory: The Contractor must actively manage, including through inventory, tracking, loss prevention, replacement, updating, and correcting, all hardware devices covered under this Contract. The Contractor must be able to provide such management records to the County at inception of the contract and upon request.
b. Access Control: The Contractor agrees to manage access to all systems or hardware covered under this contract. This includes industry standard management of administrative privileges including, but not limited to, maintaining an inventory of administrative privileges, changing default passwords, use of unique passwords for each individual accessing systems or hardware under this Contract, and minimizing the number of individuals with administrative privileges to those strictly necessary. c. Operating System and Equipment Hygiene: The Contractor agrees to ensure that systems or hardware will be kept up to date, using only the most recent and supported operating systems, applications, and programs, including any patching or other solutions for vulnerabilities, within ninety (90) days of the release of such updates, upgrades, or patches. The Contractor agrees to ensure that the operating system is configured to eliminate any unnecessary applications, services and programs. d. Vulnerability Management: The Contractor agrees to continuously acquire, assess, and take action to identify and remediate vulnerabilities within the systems and hardware covered under this Contract. e. Media Encryption: Throughout the duration of this Contract, the Contractor will encrypt all workstations, portable devices (e.g., mobile, wearables, tablets,), and removable media (e.g., portable or removable hard disks, floppy disks, USB memory drives, CDs, DVDs, magnetic tape, and all other removable storage media) associated with systems and hardware provided under this Contract in accordance with Federal Information Processing Standard (FIPS) 140-2 or otherwise required or approved by the County’s Chief Information Security Officer (CISO). f. Malware Protection: The Contractor will provide and maintain industry-standard endpoint antivirus and antimalware protection on all systems and hardware.