A performance bond on the part of the contractor for 100 percent of the contract price. A “performance bond” is one executed in connection with a contract to secure fulfillment of all the contractor's obligations under such contract. 2 CFR 200.325(b) A payment bond on the part of the contractor for 100 percent of the contract price.
A “payment bond” is one executed in connection with a contract to assure payment as required by law of all persons supplying labor and material in the execution of the work provided for in the contract. 2 CFR 200.325(c)
CONTRACTING PROVISIONS
Appendix II to Part 200 - Contract Provisions for Non-Federal Entity Contracts Under Federal Awards. In addition to other provisions required by the Federal agency or non-Federal entity, all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable.
A. Remedies: Contracts for more than the simplified acquisition threshold currently set at $150,000, which is the inflation adjusted amount determined by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) as authorized by 41 U.S.C. 1908, must address administrative, contractual, or legal remedies in instances where contractors violate or breach contract terms, and provide for such sanctions and penalties as appropriate.
B. Termination: All contracts in excess of $10,000 must address termination for cause and for convenience by the non-Federal entity including the manner by which it will be effected and the basis for settlement.
C. Equal Employment Opportunity: Except as otherwise provided under 41 CFR Part 60, all contracts that meet the definition of “federally assisted construction contract” in 41 CFR Part 60-1.3 must include the equal opportunity clause provided under 41 CFR 60-1.4(b), in accordance with Executive Order 11246, “Equal Employment Opportunity” ( 30 FR 12319, 12935, 3 CFR Part, 1964-1965 Comp., p. 339), as amended by Executive Order 11375, “Amending Executive Order 11246 Relating to Equal Employment Opportunity,” and implementing regulations at 41 CFR part 60, “Office of Federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor.”
D. Davis-Bacon Act, as amended: (40 U.S.C. 3141- 3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act ( 40 U.S.C. 3141- 3144) as supplemented by Department of Labor regulations ( 29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. The non- Federal entity must place a copy of the current prevailing wage determination issued by the Department of Labor in each solicitation. The decision to award a contract or subcontract must be conditioned upon the acceptance of the wage determination. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency. The contracts must also include a provision for compliance with the: Copeland “Anti-Kickback” Act: ( 40 U.S.C. 3145), as supplemented by Department of Labor regulations ( 29 CFR Part 3, “Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States”). The Act provides that each contractor or sub-recipient must be prohibited from inducing, by any means, any person employed in the construction, completion, or repair of public work, to give up any part of the compensation to which he or she is otherwise entitled. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency.
E. Contract Work Hours and Safety Standards Act: (40 U.S.C. 3701- 3708). Where applicable, all contracts awarded by the non-Federal entity in excess of $100,000 that involve the employment of mechanics or laborers must include a provision for compliance with 40 U.S.C. 3702 and 3704, as
supplemented by Department of Labor regulations ( 29 CFR Part 5). Under 40 U.S.C. 3702 of the Act, each contractor must be required to compute the wages of every mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the standard work week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and provide that no laborer or mechanic must be required to work in surroundings or under working conditions which are unsanitary, hazardous or dangerous. These requirements do not apply to the purchases of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence.
F. Rights to Inventions Made Under a Contract or Agreement: If the Federal award meets the definition of “funding agreement” under 37 CFR § 401.2 (a) and the recipient or sub-recipient wishes to enter into a contract with a small business firm or nonprofit organization regarding the substitution of parties, assignment or performance of experimental, developmental, or research work under that “funding agreement,” the recipient or sub-recipient must comply with the requirements of 37 CFR Part 401, “Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements,” and any implementing regulations issued by the awarding agency.
G. Clean Air Act: ( 42 U.S.C. 7401- 7671q.) and the Federal Water Pollution Control Act ( 33 U.S.C. 1251- 1387), as amended - Contracts and sub-grants of amounts in excess of $150,000 must contain a provision that requires the non-Federal award to agree to comply with all applicable standards, orders or the Clean Air Act ( 42 U.S.C. 7401- 7671q) and the Federal Water Pollution Control Act as amended ( 33 U.S.C. 1251- 1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).
H. Debarment and Suspension: (Executive Orders 12549 and 12689) – Verify that a vendor is not debarred, suspended or otherwise excluded from or ineligible for participation in Federal Assistance programs or activities. Confirm and document that vendors are not on the federal government’s Excluded Party list found at www.sam.gov.
I. Byrd Anti-Lobbying Amendment: ( 31 U.S.C. 1352) - Contractors that apply or bid for an award exceeding $100,000 must file the required certification. Each tier certifies to the tier above that it will not use, and has not used, Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352. Each tier must also disclose any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award. Such disclosures are forwarded from tier-to-tier up to the non-Federal award.
ATTACHMENT A. - City of Richmond - RFP/RFQ Evaluation Committee Guidelines (Sample Documents)
The Evaluation Committee (EC) has the authority to review and evaluate proposals received by the City in response to a specific Request for Proposals (RFP) or Request for Qualifications (RFQ) for the purpose of identifying the most competitive or best qualified proposal(s) from responsive and responsible offerors.
General guidelines:
Identifying Evaluation Committee Members. The members of the EC should be identified prior to the solicitation issuance. Members of the EC should have professional interest and expertise to evaluate proposals and make recommendations that could lead to the selection of one or more offeror(s) who will provide products/services to the City in an acceptable manner pursuant to the RFP/RFQ.
EC Member Participation Form. The Project Manager (PM) will send an Evaluation Committee Member Participation Form to the individual EC members and each member shall return an executed copy to the PM.
Preparing the Evaluation Rating Matrix (Attachment C). The EC will identify mandatory, non-mandatory requirements, in addition to establishing evaluation criteria and assigned weight. The evaluation criteria and assigned weight shall be consistent with the criteria defined in the RFP/RFQ.
Initial Review of Proposals. The PM will review received Proposals for compliance with the submittal criteria and content requirements. The EC will review Proposals that are deemed “responsive and responsible”. A responsive RFP/RFQ is one that meets all the terms, conditions and specification of the RFP/RFQ. A responsible RFP/RFQ is one where the proposer has the overall capability to satisfactorily perform the contract. “Non-Responsible” Proposals will not be evaluated and shall be rejected from any further consideration by the City.
Submitting Proposals to the EC. The EC members who have executed the Evaluation Committee Member Participation Form will be provided with all “responsive and responsible” Proposals and evaluation forms.
Independent and Individual Review. The EC shall review the received Proposals and independently score each Proposal. Scores shall be in accordance with the Evaluation Rating Matrix and shall represent each evaluator’s best objective judgment.
Convening EC Committee Meetings. The EC meeting(s) shall be convened by the PM on the date and time designated. Each member will bring his/her completed technical evaluation form. The EC members will discuss the individual scores and, as a result of the discussion, each member may adjust the member’s individual scoring up or down as appropriate. The PM shall average the individual scores to determine the Offeror’s score for that particular question/requirement.
Analyzing Cost Proposals. When applicable, the City may utilize lowest cost, lowest total cost, Total Cost of Ownership (TCO) or greatest savings to determine best offeror; provided, however, the City must abide by any statements within the RFP regarding cost evaluation.
Overall Scores Preceding Negotiations. The EC will identify which offeror(s) submitted the best ranked, responsive and responsible proposal(s) according to the evaluation and scoring by the EC. The Cost and Evaluation Rating Matrix summary or such other appropriate document should be used to determine the award recommendation and the offeror(s) that will participate in negotiations, if applicable.
Convening a Negotiation Team. If the EC elects to initiate negotiations, as approved by the PM, in order to ensure that the City is receiving the best value and/or the most cost-efficient goods and/or services, then a Negotiation Team (NT) will convene. The NT may include any or all members of the EC or other individuals as appropriate; provided, however, only the EC may rescore proposal revisions following negotiations. The NT will develop the Negotiation Plan and Negotiation Script.
Capturing Negotiation Results & Award Recommendation. If the City elects to negotiate with identified offerors, the offerors will each be asked to submit a Proposal Revision following each round of negotiations, which Proposal Revision will then augment the original RFP submission. Each Proposal Revision will be evaluated and re-scored by
the EC utilizing the same evaluation criteria. Upon completion of negotiations, the PM will prepare the Evaluation and Selection Report and obtain EC’s signatures approving the award recommendation.
Final Contract Award. Based on the recommendations contained in the Evaluation and Selection Report, the PM will prepare an Agenda Report to present to Council. Upon Council approval, the PM will process the contract to be executed by the offeror and the City.
Maintaining Agency Records. All evaluation/negotiation documents/forms completed by each evaluator and by the EC and NT will be collected by the PM and become part of the official records and subject to the Public Records Act.
ATTACHMENT B. - EVALUATION COMMITTEE MEMBERS PARTICIPATION FORM
(Solicitation Title)
REQUEST FOR PROPOSAL
(Sample Documents)
You have been asked to participate in the evaluation of offers that have been received as the result of the competitive solicitation referenced above.
It is essential that the integrity of the evaluation process is maintained to ensure that each bidder or offeror is given fair and equal consideration. Your knowledge of and/or past or current association with particular firms and/or individuals must not influence your evaluation. The written responses to the solicitation and any subsequent respective clarifications and/or negotiations must stand alone, and you are required to be particularly objective and guard against any tendency to favor a particular firm or individual.
You are required to report to the Project Manager any actual or potential conflict of interest.
An additional consideration is the need to maintain confidentiality during the evaluation regarding the contents of the offerors’ or bidders’ responses, as well as the proceedings of the evaluation committee. Any inquiries regarding the evaluation of this particular solicitation must be directed to the Project Manager.
You are asked to read and sign the following statement:
I have read, understand, and agree to the above, and I will adhere to the policies presented. I do not know of any conflict of interest on my part, nor have I accepted any gratuities or favors from potential offerors or bidders, which would compromise my objectivity. I shall keep all evaluation proceedings in strict confidence prior to contract award. I will do my best to base my recommendation for contract award solely upon the evaluation criteria in the solicitation and each offeror’s or bidder’s response.
Committee Member Signature Date
Print Name and Title of Committee Member Date
ATTACHMENT C. - City of Richmond RFP SCORE SHEET
Solicitation Title
(Sample Documents)
Vendor Evaluator Name
Evaluation Criteria
Weight
%
Assigned
Score 1-
10 Total
Points
Comments
1. Qualifications of Firm
1.1 Technical experience in performing work of a
closely similar nature
1.2 Experience working with public agencies
1.3 Strength and stability of the firm
1.4 Strength, stability, experience and technical competence of subcontractors
1.5 Assessment by client references
1.6 Knowledge of applicable laws and regulations.
%
2. Staffing and Project Organization
2.1 Qualifications of project staff
2.1.1 Key personnel
2.1.2 Project Manager
2.2 Key personnel’s level of involvement in performing related work cited in “Qualifications of the Firm” section
2.3 Logic of project organization
2.4 Adequacy of labor commitment;
2.5 Concurrence in the restrictions on changes in key personnel
2.6 Ability to deal with City staff
%
3. Work Plan
Depth of Offeror’s understanding of City’s requirements and overall quality of work plan
Logic, clarity and specificity of work plan
Appropriateness of labor distribution among the tasks
Ability to meet the project deadline
Reasonableness of proposed schedule;
Utility of suggested technical or procedural innovations.
%
4. Cost and Price
ASSIGN POINTS FOR COST
%
TOTAL POINTS =
LOW
PRICE/PROPOSAL
PRICE X WEIGHT
5. Interviews/Presentation – (Optional)
5.1 Quality and clarity of presentation
5.2 Ability of presenter to answer questions
5.3 Demonstrations (if required)
5.4 Demonstrated understanding of the project
%
TOTAL WEIGHT MUST EQUAL: 100%
Scoring Mechanisms
For the evaluation criteria, the following scoring mechanism will be used. The points awarded for each criterion are determined by multiplying the weight by the assigned score.
Exceptional (Assigned Scores - 9 to 10) –
The approach will yield a result that exceeds the Objectives qualitatively.
The proposal offers an approach or features with little or no risk.
The response covers areas not originally addressed within the RFP category and includes additional information and recommendations that would prove both valuable and beneficial to the City of Richmond.
This response is considered an excellent approach demonstrating the Supplier’s authoritative knowledge and understanding of the project.
Exceeds Objectives (Assigned Scores - 7 to 8) –
A very good response that shows experience and knowledge within the category. The Supplier provides insight into their expertise, knowledge and understanding of the subject matter.
The collective approach yields a qualitative benefit to the project that is beyond the minimum objectives.
The approach being proposed or the majority of the features are acceptable or above the objectives set out in the RFP.
The Supplier can easily implement additional features or options. A minimal number of resources will be required from the City of Richmond.
Meets Objectives (Assigned Scores - 5 to 6) –
The approach or the majority of the features proposed meet the objectives.
No apparent deficiencies noted. Some items could be improved upon but are still considered acceptable.
To enhance them may require rework and resources from the Supplier and/or the City.
The ranking should reflect some qualitative achievement(s) such as acceptable delivery timeframe, end- user training program, etc.
Fails to Meet Objectives (Assigned Scores - below 5)-
The proposed approach or a majority of the features for the item are deficient. The approach taken is undesirable and correction would require a major and material change in the proposal.
The correction of any deficiencies either collectively or individually, poses a serious problem in correction or has a "domino" effect on the other design features.
OPERATIONS BULLETIN
WORKFORCE INNOVATION
AND OPPORTUNITY ACT
Policy Number ETP 04-0612
CORWDB Approval Date: 6-14-2012
Revised: 10-2014; 12-2018; 6-2020
PII Policy, Procedures & Protocols
Pg. 1 0f 8
Personally Identifiable Information
Secure Data Transfer Policy
This policy is developed and maintained in accordance with the following resource documents:
California SB168, Title 1.81.1 – Confidentiality of Social Security Numbers, California AB763 – Privacy: Social Security Numbers,
EDD, Directive WSD 17-01
Department of Labor (DOL), 29 CFR Part 38, Section 38.41(b)(3) Department of Labor (DOL), Training and Employment Guidance Letter (TEGL) No. 39-11, DOL, Training and Employment Guidance Letter (TEGL) 05-08 Workforce Innovation and Opportunity Act of 2014 (WIOA) Department of Justice (DOJ), Privacy Act of 1974,
Federal Information Security Management Act (FISMA)
Information Practices Act of 1977 (Title 1.8 [commencing with Section 1798] of Part 4 of Division 3 of the Civil Code),
Sections 11015.5 and 11019.9 of the Government Code, and Sections 1094 and 1095 of the California Unemployment Insurance Code.
POLICY
The City of Richmond, Employment and Training Pr ogram (CRETP), Workforce Development Board secures all client personal information against loss, damage, modification, unauthorized access, or disclosure as required by federal and California Law, and the State Workforce Development Administrative Manual policy. Information voluntarily provided by the client will be protected by the appropriate computer, network, and Internet technical security controls at the employee and departmental level to prevent unauthorized access. Some of these security controls are: password and user identification verification, data encryption, confidential transmissions, secure storage areas, and audit trails. All confidential client information is primarily stored on the EDD CalJOBS secure server; which is the preferable storage method fo r all workforce development client data. If it is necessary to scan or temporarily store client electronic data, this is done through the City of Richmond, secured by permission, file server. Internet cloud data storage is not used for client data storage.
The CRETP does not store or use personal informa tion submitted by the client any longer than necessary. If no longer required and in order to prevent unauthorized access or use of the data, the client’s personally identifiable information is destroyed via purging, magnetic degaussing/erasing, shredding and/or other means of authorized confidential destruction. Regularly scheduled archiving, purging, and proper disposal of records and information is a standard practice throughout the City of Richmond local government agency.
The CRETP employees will only use personal information submitted by the participant as it relates to eligibility for providing program services. CRETP employees are educated regarding the requirements of working with confidential and personally identifiable information as well as the consequences of misuse. CRETP employees will attend mandatory y early reviews of all acts, policies, and codes relating to protecting Personal Identifiable Information. CRETP will not sell or distribute personal information to any non-governmental entity without the client’s consent or as authorized by law or regulation.
All CRETP data transmissions of PII will require pr ior approval by administrative staff and will be severely scrutinized and approved on a case-by case basis. CRETP Director and Fiscal Manager will be responsible for ensuring that no PII data be transmitted without prior encryption in accordance with FIPS 140-2.
As a public agency, the CRETP understands the importance of maintaining the client’s privacy and will make every attempt to maintain their confidence and trust regarding the collection and use of personal information.
In accordance with the Department of Labor Personal Identifiable Information (PII) policy, the City of Richmond Workforce Development Board will ensur e that their employees are aware of their responsibilities regarding the protection of client’s PII. In addition to the forgoing, if employees become aware of a theft or loss of PII, they are required to immediately inform their Program Manager who will contact their EDD Regional Advisor. In the event thei r Regional Advisor is not available, they are to immediately report the theft or loss to the DOL Computer Security Incident Response Capability (CSIRC) team at [email protected].
STAFF COMPLIANCE
All CRETP employees with access to participant PII and/or confidential information must sign an acknowledgement that they have read the policy, understand the confidential nature of participant data and the potential sanctions for improper disclosure, and agree to abide by all other requirements and terms contained therein.
Unauthorized disclosure of confidential or privileged information is a serious violation of this policy.
Any failure to comply with confidentiality requirements identified in this policy may result in termination or suspension of contract or employment, or the im position of special conditions or restrictions to protect the privacy of participants or the integrity of PII data. Misuse or noncompliance with PII data safeguards could lead to civil and criminal sanctions per federal and state laws.
All CRETP staff and representatives are expected to return materials containing privileged or confidential information at the time of separation from employment or expiration of service.
DISCLAIMER
This policy is based on the City of Richmond, Workforce Development Board’s interpretation of the statute, along with the Workforce Innovation and Opportunity Act; Final Rule released by the U.S.
Department of Labor, and federal and state policies relating to WIOA implementation. This policy will be reviewed and updated periodically based on any additional federal or state guidance.
PII PROTECTION PROCEDURES
Whether written or oral and regardless of format, staff must maintain confidentiality of the following:
I nformation that was created or received by a heal thcare provider, health plan, employer or healthcare clearinghouse . This includes any case notes, chart entries, or treatment notes that relate to heath information.
Information that is related to an individuals' physical or mental health or medical condition in the past, present or future ; healthcare provided or to be provided to an individual; or payment for health care provided to an individual in the past, present or future.
Information that identifies an individual, employee or participant.
The misuse or unauthori zed release of personal and confidential information or records by any WIOA service provider staff may be subject to a civ il penalty and other applicable sanctions under state and federal law.
Every individual receiving WIOA or other services mu st be informed of their right to not share their personal and confidential information and that this request does not affect their eligibility for WIOA services.
Medical and Disability Information:
Personal and confidential information that contains health information related to a physical or mental disability, medical diagnosis or perception of a disability related to the individual must be kept in a separate locked file and apart from working files.
Any medical information contained in case notes must be redacted from the participant file; the original notes must be placed in the participant's medical file.
To minimize the need for staff to access a medical file, only the portion of the participant's information that reveals the presence of a disability should be included in the medical file.
Access to the medical files:
Must be limited and should only be accessed with the approval of program management and when such access is necessary to facilitate a WIOA participant's access to services or to support an ongoing service plan; or
First aid and safety personnel may be provided participant medical information in the event of an emergency; or
Local , state or federal monitors in compliance with 29 CFR Part 32.44(c) and 29 CFR Part 38.60 may have access to medical files for monitoring purposes.
When all services, including follow-up services, are complete and the participant file is ready to be archived, participant medical and disability-related information that had been previously filed away from the active file must remain filed separately. The case management archived folder must be marked adequately to alert staff that there is a file containing medical and disability information stored in a separate secure location.
Archived retention case management folders containing medical and/or disability information must be clearly marked with the identifying blue dot, signifying that there is a secured MIS folder containing this confidential information. Staff and representatives should retain participant PII only for the period required for assessment or performance purposes. Thereafter, all data must be destroyed by a qualified company to minimize risk of breach.
Staff should be discreet when verbally communicating personal and confidential information and ensure the receiver(s) are authorized to receive the information.
Staff must not leave personal and confidential information lying out in the open and unattended (e.g., copies or print jobs left unattended on the copy machine or printers). Personal and confidential information must be stored in a secure location when not in use or shredded if no longer necessary. Personal and confidential information should not be tossed in the regular trash or recycle bins.
Transmission Of Confidential Information:
Staff and representatives should avoid communicating sensitive information or PII about an applicant or participant to partner agencies or other staff via em ail. If it is necessary, staff and representatives must ensure that the intended recipient is the only individual that has access to the information and that the recipient understands they must also protect the information. Staff and representatives must only communicate sensitive information or PII through WDB emails and not through third party or personal email addresses.
PII and other sensitive data transmitted via email or stored on mobile data storage (such as thumb drives) must be encrypted. Staff and representatives must not e-mail unencrypted sensitive PII to any entity, including the Department of Labor, WDB staff, or contractors. Staff and representatives should discourage participants from emailing personal and confidential information to their case managers.
Any information posted to social media sites is considered public record and is subject to public disclosure. No sensitive information or PII should be posted to social media sites.
Care shall also be taken to ensure that unauthorized individuals do not overhear any discussion of confidential information.
OPERATIONS BULLETIN
WORKFORCE INNOVATION
AND OPPORTUNITY ACT
Policy Number ETP 04-0612
CORWDB Approval Date: 6-14-2012
Revised: 10-2014; 12-2018
PII Policy, Procedures & Protocols
Pg. 5 0f 8
SENSITIVE PII PROTOCOLS
PII That Is Always Sensitive:
The following personal identifiers, when maintained by City of Richmond (COR) Employment & Training Dept., are Sensitive PII even if they are not coupled with additional PII or contextual information:
Complete (9-digit) SSN – EDD continues to review and reduce its use of SSN because they are especially sensitive identifiers that can increase individuals’ risk of identity theft if compromised. COR grant programs and offices will minimize access to, use of, and or display of SSNs wherever possible. Whenever possible, staff and representatives will use unique identifiers for participant tracking instead of social security numbers. While social security numbers may be needed for initial eligibility or performance purposes, a unique identifier should be linked to each individual record and used thereafter. This includes such records as training or contract documents. If social security numbers are to be used for specific tracking purposes, they must be stored or used in such a way that it is not attributable to the individual. For example, a training document should not include the participant name and social security number, rather the participant name and a truncated social security number or CalJOBS User ID Number. biometric identifiers (e.g., fingerprint, iris scan, voice print)
Social Security numbers may not be listed on anything mailed to a client or to another agency unless required by law, or the document is a form or application. Social Security numbers may not be left on a voice mail message.
The following information is Sens itive PII when grouped with the person’s name or other unique identifier, such as address or phone number:
citizenship or immigration status
medical information
driver’s license number
passport number
full date of birth
authentication information such as mother’s maiden name or passwords portions of SSNs such as last four digits
financial information such as account numbers
How Must You Safeguard Sensitive PII?
You should exercise due care when handling all PII and all information you encounter in the course of your work for COR. Sensitive PII, however, requires special handling because of the increased risk of harm to an individual if it is compromised. The following handling guidelines apply to everyone working for or on behalf of COR and explain how you must handle Sensitive PII at COR.
Collect Sensitive PII Only as Authorized
Be sure that when you collect Sensitive PII, you have the legal authority to do so an d if necessary have a Privacy Act system of records notice (SORN) in place that describes the information:
If you are electronically collecting or maintaining Sensitive PII, be sure your database or information technology system has an approved Privacy Impact Assessment (PIA) and is in
compliance with the Federal Information System Management Act (FISMA). This refers to our current CalJOBS client data tracking system and the City of Richmond Information Tec hnology, secured by permission, file server.
When collecting Sensitive PII from members of the public or WIOA clients, do not create unapproved paper or electronic forms or processes to collect Sensitive PII:
Collecting personal data from members of the public may trigger separate requirements under Paperwork Reduction Act (PRA).
Limit Use of Sensitive PII
Only access Sensitive PII when you need to know that information, that is, when your need for the information relates to your official duties:
If you work for COR as a contractor, you must have a nondisclosure agreement (NDA) on file with COR prior to handling Sensitive PII.
Does not access or share Sensitive PII for entertainment or any other purpose unless it is related to your mission need to know.
Remember that you must secure Sensitive PII in a locked drawer, cabinet, cupboard, safe, or other secure container when you are not using it. Never leave Sensitive PII unattended and unsecured.
Only use Sensitive PII for official purposes:
Use must be compatible with notices, such as Privacy Act System of Records Notice (SORN), Privacy Impact Assessment (PIA), and Privacy Act Statements provided to the individuals from whom the information was collected. If you are unsure about whether a specific use is appropriate, you should confirm with your supervisor or Component Privacy Officer.
Do not browse files containing Sensitive PII out of curiosity or for personal reasons.
Share Sensitive PII only as authorized:
You are authorized to share Sensitive PII with another COR employee or contractor if the recipient’s need for the information is related to his or her official duties. You are authorized to share Sensitive PII outside of COR if there is a published routine use in the applicable policy.
Refer requests for Sensitive PII from members of the public, the media, or other outside entities to your Component FOIA or Disclosure Officer.
Minimize Proliferation of Sensitive PII
Do not create unnecessary or duplic ative collections of Sensitive PI I, such as duplic ate, ancillary, “shadow,” or “under the radar” files. Minimizing proliferation of Sensitive PII helps to keep it more secure and reduces the risk of a data breach:
If you need to create duplicate copies of Sensitive PII to perform a particular task or project, delete or destroy them when they are no longer needed.
Unauthorized replication may constitute an unauthorized or illegal Privacy Act system o f records. The R egulatory Compliance Officer or the MIS Administrator should be consulted to provide guidance specific to the situation.
When you need to print, copy, or extract Sensitive PII from a larger dataset, target your actions to obtain data on only the specific individuals and the specific data elements you need to perform the task at hand.
Follow retention and disposal policies:
The retention of Sensitive PII extracted from a system is not to extend beyond the records retention schedule or as identified in the applicable PII and Retention Policy. Use appropriate destruction techniques to dispose of Sensitive PII. Shred (do not recycle) papers containing Sensitive PII.
Computer drives and other electronic storage devices must be wiped of Sensitive PII before they are re-issued for use.
Until you dispose of Sensitive PII, keep it secured in a locked drawer, cabinet, cupboard, safe, or other secure container when you are not using it. Never leave Sensitive PII unattended and unsecured.
Secure Sensitive PII
When you handle, process, transmit, and/or store Sensitive PII, you should limit the potential for unauthorized disclosure. To do this, protect ag ainst “shoulder surfing,” eavesdropping, or overhearing by anyone without a need to know the Sensitive PII.
Sensitive PII may be saved, stored, or hosted on the preferred EDD CalJOBS secure server. In some instances of data collection and electronic transfer, client data may be stored temporarily on the COR, secured by permission, file server equipment (including contractor-owned equipment or system that is approved to be used as an EDD or COR system.)
Note that these rules also apply to individuals on an approved e-mail list.
Do not take Sensitive PII home or to any non-CRETP approved worksite, in either paper or electronic format, unless appropriately secured. Sensitive PII in electronic form must be encrypted. Paper documents must be under the control of the CRETP staff or locked in a secure container when not in use. Personally owned computers may not be used to save, store, or host Sensitive PII.
Physically secure sensitive PII (e.g., in a locked drawer, cabinet, or desk; in a safe; or in another locked container) when not in use or not otherwise under the control of a person with a need to know. Sensitive PII may be stored in a space where access control measures are employed to prevent unauthorized access by members of the public or other persons without a need to know (e.g., a locked room or floor, or other space where access is controlled by a guard, cipher lock, or card reader), but the use of such measures is not a substitute for physically securing sensitive PII in a locked container when not in use.
When you are e-mailing Sensitive PII outside of CRE TP, you must send the Sensitive PII within an encrypted attachment with the password provided separately (e.g., by phone or in person). As a last resort, the password can be sent in a separate email, but never in the same email containing the attachment.
Do not leave Sensitive PII unattended on a desk, network printer, fax machine, or copier. Do not send Sensitive PII to a fax machine without contacting the recipient to arr ange for its receipt.
Store Sensitive PII in shared access computer drives (“shared drives”) only if access is restricted to those with a need to know by permissions settings or passwords.
Staff must physically secure Sensitive PII when in transit. Do not mail or courier Sensitive PII on CDs, DVDs, hard drives, flash drives, USB drives, or other removable media unless the data is encrypted. Do not return failed hard drives to vendor for warranty if the device was ever used to store Sensitive PII, but sanitize or destroy the media. For example, do not pack laptops or electronic storage devices in checked baggage. Do not leave them in a car overnight or in plain sight in a parking lot.
If someone sends you Sensitive PII in an unprotected manner, you still must secure it once you receive it. If you receive a request to accept Sensitive PII in an encrypted format, you must be able to accept the Sensitive PII in that format so that the sender may comply with his or her requirements to encrypt Sensitive PII information.
What must you do if you suspect an incident?
COR defines a privacy incident as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons, other than authorized users and for an unauthorized purpose, have access or potential access to PII in usable form, whether physical or electronic. The term encompasses both suspected and confirmed incidents , whether intentional or inad vertent, involving PII which raise a reasonable risk of harm.
If at any point you suspect or know that Sensitive PII has been handled in a way that violates this policy, or otherwise suspect or know of a privacy incident at CRETP, regardless of the reason or severity of the incident, you must:
Report a privacy incident to your supervisor as soon as it is suspected or confirmed:
If your supervisor is unavailable or if there is a potential conflict of interest, report the incident to your Program Manager or the Fiscal Manager. Those officials must report the incident to the EDD Regional Advisor or DOL Computer Security Incident Response Capability (CSIRC) team at [email protected]. Document or maintain records of information and actions relevant to the incident, as it may be required in the privacy incident handling report.
Any alleged violations that may constitute criminal misconduct, identity theft or other serious misconduct, or reflect systematic violations within the Department will be reported to the DOL Office of the Inspector General (OIG) as part of the privacy incident reporting process.
Do not further compromise the information:
Beware of these common mistakes so that your response to a privacy incident does not constitute another incident:
Do not forward compromised information (e.g., SSN, full name, birth date, etc.) when reporting an incident.
If and when the compromised Sensitive PII is needed by your supervisor in order to respond to an incident, you will be given instructions on whether the compromised information needs to be forwarded to someone at COR.
If you see Sensitive PII in an email that you suspect constitutes a privacy incident, remember that the information is duplicated and further compromised if you forward it, reply, or “reply to all.”
Before you reply or forward an email, make sure that you remove any Sensitive PII that should not be disclosed from the email chain below.
Be careful when “hiding” columns in sp readsheets that contain Sensitive PII. When emailed to a recipient who is not aware that a spreadsheet contains hidden columns, that person may inadvertently forward that spreadsheet to someone who does not need to know that information.