Attachment 3 NASPO AMENDMENT — Mayor and City Council, March 5, 2025 (part 3 of 3)

BILLING
Any Product added to the NASPO ValuePoint Master Agreement must be billed by the Master Agreement Contractor and not by any third party.

COST:

Include a cost matrix to include NASPO ValuePoint contract pricing.

Upon signature, NASPO ValuePoint approves the addition of the product(s) and/or service(s) referenced herein to the Contract.

Upon signature, Contractor assures that all product(s) and/or service(s) referenced herein meet the terms and conditions of the Contract and understands that NASPO ValueP oint reserves the right to audit Contractor for compliance in accordance with the terms and conditions of the Contract. NASPO ValuePoint also reserves the right (a) to request additional information with respect to the product(s) and/or service(s) throughout the life of the Contract if in the best interest of NASPO ValuePoint.

Contract Vendor:

BY: _____________________________
NAME: _____________________________
TITLE: _____________________________
DATE: _____________________________
NASPO ValuePoint
BY: _____________________________
NAME: _____________________________
TITLE: _____________________________
DATE: _____________________________
DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC NASPO ValuePoint Wireless Data, Voice and Accessories
Product Add Request
0$Attachment N New Product Request Log

Page 1 of 1 ends

ACTION LOG
Submit updated Action Log with each Request. Log must provide history of previous requests.

CONTRACT VENDOR:__________________________
Contact Name and Email (for questions):__________________________________ DATE:__________________
DATE

SUBMITTED
ACTION REQUESTED: DATE

APPROVED
DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭWireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement DϭϳϲͲϭ
Attachment S
Wireless Data, Voice and Accessories
Security Disclosure Stateme nt
A. Purchasing entities are concerned about the security and privacy of information and data related to the performance of this contract. The type of data and information transmitted, stored and processed by the products and services will vary based on the purchasing entities requirements. As a result, it is not possi ble to establish a single set of of security requirements all products and services awarded under this contract must meet. Each purchasing entity purchasing from this contract will determine which products and services have the appropriate cyber security and data controls in place to meet their specific needs. To assist public entities each offeror must submit a Security Disclosure Statement with their proposal.

B. To qual i f y f or any aw ard unde r thi s contract, the Of f e ror must submit a Security Disclosure Statement addressing all of the elements listed belo w. i. In responding, Offeror must address not only the security mec hanisms used by the bidder and its direct subsidiaries, but any partners, subcontractors or other 3rd parties who would be involved in implementing, operating, or in any way coming into contact with the service
ii. Offeror must represent and warrant the accuracy and currency of the information on the completed statement. Offerors are encouraged to complete and submit both exhibits to Attachment D to their proposal.

C. Security Disclosure Statement information required. Offeror shall describe all policies, procedures, measures, methods, certifications and standards the offered product and/or service has in place to protect the purchasing entities security and privacy of information and data involved in the performance of this contract for each numbered statement below. Description responses shall also include; i. If for the specific product or service offered, the numbered security statement is not appropriate because it does not as a matter of accepted DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭ Wireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement security practice related to the product or service offered, the offeror shall indicate in a statement that it is not applicable and briefly explain why.
ii. If the specific product or service offered does not comply with the the numbered statement, the offer shall indicate, “does not comply. 1) Me thods and me asure s take n to hol d, prote ct, and di spose of data during and following completion of any contract services. Include how access to a Purchasing Entity’s user accounts or data will not be allowed, except in the course of data center operations, response to service or technical issues, as required by the express terms of the Master Agreement, the applicable Participating Addendum, and/or the applicable Service Level Agreement. 2) Security measures to secure and protect the confidentiality of information and data that is obtained, created, stored, transmitted, processed or otherwise held or managed by the product or service during the performance of all work related to performance of this contract. Include all data confidentiality standards and practices that prevent the exposure to unauthorized personnel, but also managing and reviewing access that administrators have to stored data.
3) Data encryption methods and standards in place to encrypt data at rest and in transit. This includes but is not limited to, encryption standards employed to protect data in transit over either wired or wireless (e.g. cellular, Wi-Fi, or other), and how that might change over the life of the contract.
4) Measures to protect Information about the cost, type, quantity and location of state communications facilities, system assets, plans, procedures, contract information, billing information and other information identified as sensitive by the purchasing entity related to the performance of all work under this contract.
5) Risk and policy management and enforcement measures in place to protect the security of physical assets and information. 6) How distributed access is controlled and managed across IT assets, including data, applications, networks and platforms within the solution. 7) Security management in place to secure data and applications, including threats from outside the service center as well as other customers co-located w i thi n the same se rv i ce ce nte r.
8) De scri be the l oggi ng proce ss i ncl udi ng:
a. The types of services and devices
logged, b. The event types logged, and
c. The information fields will be made available to the authorized Purchasing Entity if requested in their PA after award of the master agreement.
9) Se curi ty Te chni cal Re f e re nce A rchi te cture s are i n pl ace re garding Offerors employees who have access to sensitive data.

DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭ Wireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement 11) An itemized list of all cyber security standards and, security certifications in place that the products and service offered comply with to ensure appropriate controls and data confidentiality are in place, as well as those in process at time of response. Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800- 171, FIPS 200 and FedRAMP (Moderate, High) i f the y apply. Include detailed response on how security standards and certifications will be maintained and updated to meet best practices for maintenance and operations.
12) A detailed list of all third-party attestations, security credentials and certifications, and reports relating to data security, integrity , and othe r controls in place.
13) NIST Cybersecurity Framework, April 16, 2018,Version 1.1 https://doi.or g/10 .60 28 /N IST .CSW P.04 16 20 18: Describe how the offeror is prepared to utilize the NIST Cybersecurity Framework for Turnkey Internet of Things, Other Turnkey Wireless, Applications and Services (Cate gory 3) and Wireless Transport Options (Category 4) as may be implemented by the Purchasing Entity, which may include, but is not limited to:
a. Convey the purchasing entities’ cyber security requireme nts, b. Ide nti f y Functi ons, Cate gori e s, Subcate gori es, and Inf ormati ve References that describe specific cybersecurity activities will provide in the Offerors’s system, products or services under contract with the Purchasing Entity,
c. Communicate cyber security requirements through Cyber Supply Chain Risk Management (SCRM), and
d. Other cybersecurity risk management activities of Offeror’s system, products or services under contract with the purchasing entity. 14) N IST Cybe rse curi ty Frame w ork, Tabl e 2 Frame w ork Core : For e ach subcategory of the all 15 Categories of the NIST Cybersecurity Framework, list the specific standards and certifications, the products or services offered comply with at the time or your proposal. Categories Include:
a. Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.
b. Business Environment (ID.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.
c. Governance (ID.GV): The policies, procedures, and processes to DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭ Wireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.
d. Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.
e. Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
f. Supply Chain Risk Management (ID.SC): The organization’s priorities, constraints, risk tolerances, and assumptions are established and use d to support ri sk de ci si ons associ ate d w i th managi ng suppl y chain risk. The organization has established and implemented th e processes to identify, assess and manage supply chain risks. g. Identity Management, Authentication and Access Control (PR.AC):

Access to physical and logical assets and associated facilities i s limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.
h. Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are trained to perform their cybersecurity related duties and responsibilities consistent with related policies, procedures, and agreements.
i. Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.
j. Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among
organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets. k. Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.
l. Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.
m. Anomalies and Events (DE.AE): Anomalous activity is detected and DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC the potential impact of events is understood.
n. Security Continuous Monitoring (DE.CM): The information system and assets are monitored to identify cybersecurity events and verify the effectiveness of protective measures.
o. Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure awareness of anomalous events.
p. Re sponse P l anni ng ( RS.RP ) : Re sponse proce sse s and proce dure s are executed and maintained, to ensure response to detected cybersecurity incidents.
q. Communications (RS.CO): Response activities are coordinated with internal and external stakeholders (e.g. external support from law enforcement agencies).
r. Analysis (RS.AN): Analysis is conducted to ensure effective response and support recovery activities.
s. Mi ti gati on ( RS.MI ) : A cti v i ti e s are pe rf orme d to pre v e nt e x pansion of an e v e nt, mi ti gate i ts e f f e cts, and re sol v e the i nci de nt. t. Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.
u. Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure restoration of systems or assets affected by cybersecurity incidents.
v. Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future
activities.
w. Communications (RC.CO): Restoration activities are coordinated with internal and external parties (e.g. coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors).
15) Data Breach/Incident policies and procedures regarding notification to both the purchasing entity of a security incident and/or data breach, as defined in this RFP, and the mitigation of such a breach. Include how proposer will work with Purchasing Entities before, during, and after a Security Incident and a Data Breach. Include information such as:
a. Personnel who will be involved at various stages, include detail on how the Contract Manager will be involved;
b. Response times;
c. Incident levels;
d. Processes and timelines;
e. Methods of communication and assistance; and
f. Other information vital to understanding the service you provide.

Provider should take into consideration that Purchasing Entities may have different DϭϳϲͲϭWireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭWireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement notification requirements based on applicable laws and the categorization type of the data being processed or stored.
16) Method for compliance with all applicable laws related to data privacy and security including state Security Breach Notification Laws dealing with personally identifiable information (PII). Describe any legal o bligations related to security the offeror will meet over the life of the contract and describe how offeror will report changes to these obligations to the public entity.

D. Any Turnkey Internet of Things, Other Turnkey Wireless system that i ncorporate s SaaS, IaaS or PaaS or other cloud computing element shall complete, provide, and maintain a completed CSA STAR Registry Self-Assessment for that e l e me nt. 2 < https://cloudsec ur ityalliance .or g/st ar/self-asse ssme nt /#_ over view . Offeror must either submit a completed Consensus Assessments Initiative Questionnaire (CAIQ), or submit a report documenting compliance with Cloud Controls Matrix (CCM) that the CAIQ is based on for the element that cloud based.

As a partner in the DHS National Critical Infrastructure Commun ications Sector, T-Mobile is required to maintain high standards of security compliance, the details of which are not publicly disclosed for purposes of national security.

T-Mobile can provide a general statement of compliance for the required numbered security statements, and may be able to respond with further detail unde r special conditions.

As a general statement, T-Mobile is compliant with the current version of the NIST Cybersecurity Framework as further described below:

T-Mobile follows best practice security standards and guideline s in alignment with the NIST Cyber Security Framework, which specifies the following functio nal domains including 1) Identification, 2) Protection, 3) Detection, 4) Response, and 5 ) Recovery. Additionally, ISO 27001:2013 Information Security Management System and other app licable industry recognized frameworks are utilized.

T-Mobile has multiple physical and environmental policies and p rograms in place. Due to their sensitive nature, T-Mobile can not divulge all of our security methods and practices, but an example of some of the security measures are listed below:
• Cell Sites: Exterior fence with lock; building doors with loc ks; doors alarmed • Switch Sites: Building doors with locks / require card-key ac cess • Data Centers: Building doors with locks / require card-key ac cess; video surveillance systems. All visitors are required to sign in and out of T-Mob ile locations and to wear Visitor badges requiring escorts.

Due to their sensitive nature, we can’t divulge all of our secu rity methods and practices.

However, we can disclose the following:
• T-Mobile requires up-to-date anti-virus software installed on all corporate computers and configured to scan them. This software cannot be disabled by the end user. Data is stored in an encrypted format on all computer s. T-Mobile servers are backed-up on a regular basis, including storing encrypted d ata in off-site locations. Data backup intervals vary. Devices processed by our Business Operations groups are always flashed and wiped. This includes devices retu rned to the distribution centers within our warranty period. Corporate devi ces are built according to a standard security configuration.
• T-Mobile has a formalized and documented Change Management pol icy. Changes are formally documented and requests are reviewed by the Change Control Board to ensure they meet business needs, are technically correct, and w on’t adversely affect services. Only changes approved by the Change Control Board are permitted (with the exception of changes required to remedy a service outage). Managers responsible for the system operations monitor those systems for unauthorize d changes to their environment. Configuration management policy s tates that all proposed configuration changes must be because of a business ne ed; be verified in the lab environment; and follow Change Management procedures fo r introduction DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC DϭϳϲͲϭ Wireless Data, Voice and Accessories RFP Attachment S: Security Disclosure Statement into the production networks.
• All network traffic is monitored. We have network intrusion de tection systems and monitoring capability in place with corresponding Incident Resp onse Procedure that specifies actions to take upon notification of a security event . Our vulnerability scanning system is integrated within the Engineering networks w ith twice-monthly scanning done. If vulnerabilities are fo und, they are reported to the appropriate system owners. To ensure vulnerabilities have been addressed, f ollow-up testing is conducted.
• T-Mobile requires segregation of duties, which includes prohib iting individuals from approving their own access and requiring management-level appro val of all access, as well as reviewing and validating access requests. T-Mobile h as a formal wireless access policy mandating a standardized secure level of authenti cation and encryption.

Category (subcategory) Yes No Regional
Award?
Category 1: Wireless Voice and Data N/A
Category 2: Wireless Accessories and Equipment N/A
Category 3: Turnkey Wireless Solutions (Check this if any subcategories below)
Category 3: Subcategory A: Fleet Management
Category 3: Subcategory C: Mobile Integration/Mobile Substitution Solutions
DocuSign Envelope ID: E92D1967-A322-489B-A040-566E50455EE5 DocuSign Envelope ID: 04031A24-BA9C-48C2-9727-776570BE5B31 DocuSign Envelope ID: 5E2BDF7F-2CEC-4F57-AA84-F8696BD0F894 DocuSign Envelope ID: 37869B1E-12C0-4216-A9AD-9B24806E9F94 DocuSign Envelope ID: CB963A55-DA9B-4FEF-8EF1-A4061175D1CC

Mayor and City CouncilMarch 5, 2025

Mayor and City Council
March 5, 2025