Access for Santa Clara Police Department to Mobile-ID devices and MID system
AGREEMENT BETWEEN THE COUNTY OF SANTA CLARA
AND THE SANTA CLARA POLICE DEPARTMENT
This Agreement is made and entered into by and between the County of Santa Clara (“County”), on behalf of its Office of the Sheriff, and Santa Clara Police Department (“SCPD”) to govern access by SCPD to the California Department of Justice’s (DOJ) Mobile ID (MID) system via mobile fingerprint capture devices (“Mobile ID devices”). County and SCPD are referred to each as a “Party” and collectively as the “Parties.”
WHEREAS, the MID system provides local law enforcement officers with a rapid identification service that checks fingerprints captured in the field using Mobile ID devices against state and federal databases, including the Repository for Individuals of Special Concern database and the Next Generation Index Unsolved Latent File;
WHEREAS, during its March 29, 2022 meeting, the local Remote Access Network (RAN) Board for Santa Clara County approved the expenditure of Senate Bill 720 funding for the purchase of 90 new Mobile ID devices to replace existing devices used by the Office of the Sheriff and other local law enforcement agencies;
WHEREAS, the County, on behalf of its Office of the Sheriff, entered into a memorandum of understanding (MOU) with the California DOJ to provide access to the MID system to the Office of the Sheriff and other local law enforcement agencies in Santa Clara County;
WHEREAS, the County, on behalf of its Office of the Sheriff, has entered into an agreement with a private vendor to procure new Mobile-ID devices for use by its deputies as well as the law enforcement officers of other local law enforcement agencies;
WHEREAS, SCPD desires to use the new Mobile-ID devices funded by the local RAN Board, and potentially purchase additional devices through the Office of the Sheriff, to access the MID system.
NOW, THEREFORE, in consideration of the mutual covenants and promises herein contained, County and SCPD, intending to be bound, hereby agree as follows:
1. DESCRIPTION OF AGREEMENT
This document and the following exhibits are specifically incorporated by reference and shall be collectively referenced hereafter as the “Agreement”:
Exhibit A Security
Exhibit B Cost Allocation
Exhibit C Scope of Work
Access for Santa Clara Police Department to Mobile-ID devices and MID system
In the event of an inconsistency or conflict between or among the provisions of this Agreement, the inconsistency or conflict shall be resolved by giving precedence in the following order: (1) This document; (2) Exhibit A; (3) Exhibit C; (4) Exhibit B.
2. AGREEMENT TERM
The Agreement shall be effective upon execution by the Parties (the “Effective Date”). The Agreement shall remain in effect for a period of five years from the Effective Date, unless terminated earlier by one of the Parties pursuant to Section 9.
3. DEFINITIONS
Unless otherwise defined, the following terms shall have the meanings as set forth below:
a. “County” shall mean the County of Santa Clara, a political subdivision of the State of California.
b. “County Confidential Information” shall include all material, non-public information (including material, non-public County Data) appearing in any form (including, without limitation, written, oral or displayed), that is disclosed, directly or indirectly, through any means of communication by County, its agents or employees, to SCPD, its agents or employees, or any of its affiliates or representatives.
c. “County Data” shall mean data and information received by SCPD from County. County Data includes any information or data, except for MID Data, that is transported across a County network, or that resides in a County-owned information system, or on a network or system under the control and management of a contractor for use by County. As between SCPD and County, all County Data shall remain the property of County.
d. “MID Data” shall mean data and information received by SCPD from the MID system, including data from federal and state databases.
e. “Days” or “days” shall mean calendar days.
f. “State” shall mean the State of California.
4. NON-EXCLUSIVE AGREEMENT
The Agreement does not establish an exclusive contract between the County and the SCPD. By way of example and not limitation, the County reserves its rights to enter into similar agreements with other law enforcement agencies.
5. SCOPE OF COUNTY’S RIGHTS
Access for Santa Clara Police Department to Mobile-ID devices and MID system
The rights and remedies of the County provided under any of the provisions of this Agreement shall not be exclusive and are in addition to any other rights and remedies provided by law or equity.
6. PAYMENT
The County shall allot six (6) of the Mobile ID devices procured through Senate Bill 720 funding to the SCPD. This funding will also cover the following expenses for these devices: software and hardware licensing and maintenance, cellular connectivity, and IT resources.
SCPD shall remit payments on a quarterly basis to the County for software and hardware licensing and maintenance, cellular connectivity, and IT resources, as set forth in Exhibit B (Cost Allocation) for any additional Mobile ID devices purchased by SCPD. SCPD shall contact the County if it is interested in purchasing additional devices.
7. TRAVEL
Each Party shall be solely responsible for its own travel, lodging, boarding and out-of-pocket expenses. Neither Party shall compensate or reimburse the other for any such costs.
8. LIMITATION OF LIABILITY
SCPD acknowledges and agrees that the services which the County is providing hereunder do not include any consideration for assumption by County of the risk of SCPD’s damages which may arise in connection with SCPD’s use of the MID system and third-party software and devices. Accordingly, SCPD agrees that County shall not be liable to SCPD or its users for any damages, including loss-of-profit, indirect, incidental, special, consequential, liquidated, exemplary, or punitive damages arising out of the licensing, sublicensing or use of the MID system, and third-party software and devices. In no event shall the County’s liability exceed the fee paid by SCPD to County for Mobile-ID devices under this Agreement.
9. TERMINATION OF AGREEMENT
Either Party may terminate this Agreement for any reason by providing the other Party with at least thirty (30) days’ prior written notice of such termination.
10. NO ASSIGNMENT OR DELEGATION WITHOUT PRIOR WRITTEN CONSENT
SCPD may not assign any of its rights or delegate any of its duties under this Agreement without the prior written consent of County. No assignment or delegation will release SCPD from any of its obligations or alter any of its obligations to be performed under the Agreement. Any attempted assignment, delegation or subcontracting in violation of this provision is voidable at the option of the County and constitutes material breach by SCPD. As used in this provision, “assignment” and “delegation” means any sale, gift, pledge, hypothecation, encumbrance, or other transfer of all or any portion of the rights, obligations, or liabilities in or arising from this Agreement to any person or entity, whether by operation of law or otherwise, and regardless of Access for Santa Clara Police Department to Mobile-ID devices and MID system
the legal form of the transaction in which the attempted transfer occurs.
11. INDEMNIFICATION
SCPD shall indemnify, defend, and hold harmless the County, its officers, agents and employees and the State of California, its officers, agents and employees from any claim, liability, loss, injury, cost or damage arising out of, or in connection with, performance of this Agreement by SCPD and/or its agents, employees or sub-contractors, excepting only loss, injury, cost or damage caused by the sole negligence or willful misconduct of personnel employed by the County. The foregoing obligation includes any claim, liability, loss, injury, cost or damage (1) arising from the violation of any applicable statutes, rules, regulation and orders of the United States and State of California or (2) due to the injury or death of an individual or the loss or damage to any real or tangible personal property. It is the intent of the parties to this Agreement to provide the broadest possible coverage for the County. SCPD shall reimburse the County for all costs, attorneys’ fees, expenses and liabilities incurred with respect to any litigation in which SCPD contests its obligation to indemnify, defend and/or hold harmless the County under this Agreement and does not prevail in that contest.
For avoidance of doubt, the obligation described in this paragraph includes, but is not limited to, the obligation to indemnify, defend and hold harmless the County in any situation where the State requires the County to indemnify, defend or hold harmless the State as a result of action or inaction by SCPD.
12. NOTICES
All notices, requests, demands or other communications provided for or required by this Agreement shall be in writing. Notices shall be deemed to have been given when sent by registered or certified mail; when sent by overnight carrier with proof of sending; when sent by email if receipt is confirmed; or upon confirmation to sender of receipt of a facsimile communication followed by a mailed hard copy from sender. Notices shall be addressed to the individuals identified in this Section as the Office of the Sheriff Contact and the SCPD Contact.
Each party may designate a different person and address by sending written notice to the other party, to be effective no sooner than ten (10) days after the date of receipt of the notice.
Office of the Sheriff Contact: John Zore ( [email protected] )
County of Santa Clara Sheriff’s Office
55 W. Younger Ave.
San José, CA 95110
(408) 808-4650
(408) 808-4662
SCPD Contact: Luis Martin ([email protected]
)
Santa Clara Police Department
601 El Camino Real
Santa Clara, CA 95050
(408) 615-4751
Access for Santa Clara Police Department to Mobile-ID devices and MID system
13. INFORMATION SECURITY COMPLIANCE
For purposes of this section, the following definitions shall apply:
a. “Breach” shall mean unauthorized access to, or use of, County Data, MID Data, or information security networks or systems that compromises confidentiality, integrity, and/or availability those systems or County Data.
b. “Independent Penetration Testing,” or “pen testing,” shall mean the County’s practice— by using an independent third party—of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. c. “Risk Assessment” shall mean the process by which the County’s Information Security Office (“ISO”) assesses (i) the SCPD’s information security program, and related aspects, by identifying, analyzing, and understanding how the SCPD will store, process and transmit County Data and MID Data; and (ii) the potential impact on the County of any security risks, weaknesses and threats related to safeguarding County assets and County Data and MID Data. The Risk Assessment usually includes the ISO’s evaluation of documentation provided by the SCPD.
SCPD shall do all of the following:
a. Maintain or improve upon its information security posture at the time of the County’s initial Risk Assessment as reasonably determined by the County. SCPD shall provide written notice to the County’s Information Security Office (“ISO”) of any changes or deficiencies to its information security posture.
b. Protect the confidentiality, integrity, availability of County Data and MID Data and comply with any information security requirements provided to SCPD by the ISO for the entire term of the Agreement.
c. Follow any updated security requirements for the remaining term of the Agreement if the County re-evaluates the Risk Assessment, conducts periodic audits, and/or completes annual Independent Penetration Testing.
d. Upon discovering any Breach that could impact the County, whether caused by SCPD, its officers, employees, contractors or agents or others, SCPD shall notify the ISO at [email protected] and the Office of the Sheriff Contact identified in Section 12 within 24 hours and shall, as soon as reasonably possible, submit an Incident Report. SCPD shall also comply with all of its other obligations in this Agreement relating to breaches and potential breaches. The Incident Report shall, at a minimum, include the following information:
i. Name of person reporting the incident
ii. Date of report
iii. Date of incident
iv. Points of contact, including phone number, extension, and email address v. Location(s) of incident
vi. Incident description
vii. System(s) affected (e.g. CAD, RMS, file server, etc.) viii. Method of detection
ix. Actions taken/resolution
Access for Santa Clara Police Department to Mobile-ID devices and MID system
14. CONFIDENTIALITY
SCPD agrees to comply with all applicable federal and state data privacy and security laws, regulations, and policies, including but not limited to California Penal Code §§ 11100 et seq. and 13100 et seq.
15. COUNTY DATA AND MID DATA
a. SCPD shall not acquire any ownership interest in County Data (including County Confidential Information) or MID Data. As between SCPD and County, all County Confidential Information and/or County Data shall remain the property of the County.
SCPD shall not, without County’s written permission, use, disclose, or make, keep, or maintain copies of County Data (including County Confidential Information) or MID Data other than in the performance of its law enforcement and criminal justice functions and its obligations under this Agreement. SCPD shall keep County Data (including County Confidential Information) and MID Data in strict confidence, using the same standard of care as it does with respect to its own confidential information, but in no event less than a reasonable degree of care. SCPD’s obligations to protect the confidentiality of County Data and MID Data survive termination or expiration of this Agreement.
b. SCPD shall be responsible for establishing and maintaining an information security program that is designed to ensure the security and confidentiality of County Data and MID Data, protect against any anticipated threats or hazards to the security or integrity of County Data and MID Data, and protect against unauthorized access to or use of County Data or MID Data that could result in substantial harm or inconvenience to County or any end users.
c. SCPD shall take appropriate action to address any incident of unauthorized access to County Data or MID Data, including addressing and/or remedying the issue that resulted in such unauthorized access, and notifying County by phone or in writing within 24 hours of any incident of unauthorized access to County Data or MID Data, or any other breach in SCPD’s security that materially affects County or end users. If the initial notification is by phone, SCPD shall provide a written notice within 5 days of the incident. SCPD shall be responsible for ensuring compliance by its officers, employees, agents, and subcontractors with the confidentiality, privacy, and information security requirements of this Agreement. Should County Confidential Information and/or legally protected County Data or MID Data be divulged to unauthorized third parties, SCPD shall comply with all applicable federal and state laws and regulations, including but not limited to California Civil Code sections 1798.29 and 1798.82 at SCPD’s sole expense. SCPD shall not charge County for any expenses associated with SCPD’s compliance with these obligations. d. SCPD shall defend, indemnify and hold County harmless against any claim, liability, loss, injury or damage arising out of, or in connection with, the unauthorized use, access, and/or disclosure of information by SCPD and/or its agents, employees or sub- contractors, excepting only loss, injury or damage caused by the sole negligence or willful misconduct of personnel employed by the County.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
16. COUNTY NO-SMOKING POLICY
SCPD and its employees, agents and subcontractors, shall comply with the County’s No Smoking Policy, as set forth in the Board of Supervisors Policy Manual section 3.47 (as amended from time to time), which prohibits smoking: (1) at the Santa Clara Valley Medical Center Campus and all County-owned and operated health facilities, (2) within thirty (30) feet surrounding County-owned buildings and leased buildings where the County is the sole occupant, and (3) in all County vehicles.
17. DISPUTES
In the event of any dispute arising out of or relating to this Agreement, the parties shall attempt, in good faith, to promptly resolve the dispute mutually between themselves. If the dispute cannot be resolved by mutual agreement, nothing herein shall preclude either party’s right to pursue remedy or relief by civil litigation, pursuant to the laws of the State of California.
18. INDEPENDENT CONTRACTOR
SCPD shall be solely responsible for the acts and omissions of its officers, agents, employees, contractors, and subcontractors, if any. Nothing herein shall be considered as creating a partnership or joint venture between the County and SCPD. No officer, agent, employee, contractor, or subcontractor of SCPD shall be considered an officer, agent, or employee of County, nor shall any such person be entitled to any benefits available or granted solely to employees of the County.
19. SEVERABILITY
Should any part of this Agreement between County and the SCPD be held to be invalid, illegal, or unenforceable in any respect, such invalidity, illegality, or unenforceability shall not affect the validity of the remainder of the Agreement which shall continue in full force and effect, provided that such remainder can, absent the excised portion, be reasonably interpreted to give the effect to the intentions of the parties.
20. NON-WAIVER
No waiver of a breach, failure of any condition, or any right or remedy contained in or granted by the provisions of this Agreement will be effective unless it is in writing and signed by County.
No waiver of any breach, failure, right, or remedy will be deemed a waiver of any other breach, failure, right, or remedy, whether similar or not, nor will any waiver constitute a continuing waiver unless the writing signed by the County so specifies.
21. HEADINGS AND TITLES
The titles and headings in this Agreement are included principally for convenience and do not by themselves limit the construction or interpretation of any provision in this Agreement, nor affect the rights or obligations of the parties to this Agreement.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
22. HANDWRITTEN WORDS
Handwritten or typed words have no greater weight than printed words in the interpretation or construction of this Agreement.
23. AMBIGUITY
Any rule of construction to the effect that ambiguities are to be resolved against the drafting party does not apply in interpreting this Agreement.
24. ENTIRE AGREEMENT, MERGER
This Agreement and its Exhibits constitute the final, complete and exclusive statement of the terms of the agreement between the Parties. It incorporates and supersedes all the agreements, covenants and understandings between the parties concerning the subject matter hereof, and all such agreements, covenants and understandings have been merged into this Agreement. No prior or contemporaneous agreement or understanding, verbal or otherwise, of the parties or their agents shall be valid or enforceable unless embodied in this Agreement.
25. EXECUTION AND COUNTERPARTS
This Agreement may be executed in one or more counterparts, each of which will be considered an original, but all of which together will constitute one and the same instrument. The parties agree that this Agreement, its amendments, and ancillary agreements to be entered into in connection with this Agreement will be considered signed when the signature of a party is delivered a method described herein.
26. ELECTRONIC COPIES/SIGNATURES
Unless otherwise prohibited by law or County policy, the parties agree that an electronic copy of a signed contract, or an electronically signed contract, has the same force and legal effect as a contract executed with an original ink signature. The term “electronic copy of a signed contract” refers to a transmission by facsimile, electronic mail, or other electronic means of a copy of an original signed contract in a portable document or other format. The term “electronically signed contract” means a contract that is executed by applying an electronic signature using technology approved by the County.
27. SURVIVAL
All representations, indemnification obligations, and duties contained in this Agreement, or in any instrument, certificate, exhibit, or other writing intended by the Parties to survive this Agreement, will survive the termination of this Agreement.
28. GOVERNING LAW, JURISDICTION, AND VENUE
Access for Santa Clara Police Department to Mobile-ID devices and MID system
This Agreement shall be construed and interpreted according to the laws of the State of California, excluding its conflict of law principles. Proper venue for legal actions shall be exclusively vested in state or federal courts in Santa Clara County. The parties agree that subject matter and personal jurisdiction are proper in state or federal court in Santa Clara County.
Parties waive all venue and jurisdiction objections.
29. COUNTING DAYS
The time in which any act provided by this Agreement is to be performed is computed by excluding the first day and including the last, unless the last day is a Saturday, Sunday, or other legal holiday, and then it is also excluded.
30. MODIFICATION
This Agreement may be supplemented, amended, or modified only by the mutual agreement of the parties. No supplement, amendment, or modification of this Agreement will be binding on County unless it is in writing and signed by the County's authorized representative.
31. THIRD PARTY BENEFICIARIES
This Agreement does not, and is not intended to, confer any rights, remedies, or benefits on any person or entity other than the parties.
32. AUTHORITY
Each party executing the Agreement on behalf of such entity represents that he or she is duly authorized to execute and deliver this Agreement on the entity’s behalf, including, as applicable, the Board of Supervisors, the Board of Directors, or Executive Director. This Agreement shall not be effective or binding unless it is in writing and approved by the County’s authorized representative, or authorized designee, as evidenced by his or her signature as set forth in this Agreement.
IN WITNESS WHEREOF, the Parties have executed this Agreement on the date indicated below. This Agreement is not binding until fully executed by all Parties.
COUNTY OF SANTA CLARA SANTA CLARA POLICE
DEPARTMENT
____________________________________ ____________________________________ Gene Clark, Date Kenn Lee Date
Chief Procurement Officer Finance Director
Access for Santa Clara Police Department to Mobile-ID devices and MID system
APPROVED
_____________________________________ ____________________________________ Robert Jonsen, Date Jōvan D. Grogan Date
Sheriff City Manager
APPROVED AS TO FORM AND LEGALITY
_____________________________________ ____________________________________ Tara Lundstrom Date Glen Googins Date
Deputy County Counsel City Attorney
Access for Santa Clara Police Department to Mobile-ID devices and MID system
EXHIBIT A
SECURITY
1. PURPOSE
This Exhibit is intended to satisfy the requirement in Section 5.1.1 of the FBI CJIS Security Policy that the County of Santa Clara’s Office of the Sheriff and SCPD establish a formal information sharing agreement before exchanging federal Criminal Justice Information (“CJI”).
As required by Section 5.1.1, this Exhibit outlines the roles and responsibilities between the Office of the Sheriff and SCPD and specifies the security controls and conditions described in the FBI CJIS Security Policy, as well as the CLETS Policies, Practices, and Procedures (“CLETS PPP”).
2. ROLES AND RESPONSIBILITIES
It is the responsibility of both Parties to ensure the protection of CJI and other information received through the Mobile ID system (“Mobile ID Data”). Although each Party may impose more stringent protection measures, each must, at a minimum, meet the requirements set forth in this Exhibit.
SCPD will be responsible for the following:
• Applying appropriate security measures, as applicable, to ensure the physical security of the Mobile ID device(s);
• Ensuring the information and systems under this Agreement are used only for authorized purposes;
• Ensuring that all SCPD personnel with access to Mobile ID Data and the Mobile ID system satisfy the fingerprint-based criminal background screening, training, and certification requirements mandated by the FBI CJIS Security Policy and the CLETS PPP;
Additionally, each Party must establish an information security structure that provides for an Information Security Officer (ISO) or a security point of contact.
3. SECURITY AWARENESS TRAINING
All users with authorized access to Mobile ID Data and the Mobile ID system shall receive the appropriate level of security training (i.e., Levels 1 through 4 based on their role in the organization and job function) within six months of initial assignment and biennially thereafter.
The training must cover the topics required for each level by the FBI CJIS Security Policy and CLETS PPP.
4. INCIDENT RESPONSE
Access for Santa Clara Police Department to Mobile-ID devices and MID system
Each Party shall have an appropriate incident response plan in place. To ensure the protection of Mobile ID Data, each Parties shall: (i) establish operational incident handling procedures that include adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and promptly report incidents to appropriate agency officials and/or authorities. Upon request, SCPD will provide the Office of the Sheriff with the incident response plan for its systems connecting to the Mobile ID system.
Sections 13 and 15 of the Agreement specify the SCPD’s obligations for reporting incidents to the County.
5. AUDITING AND ACCOUNTABILITY
Each Party shall implement audit and accountability controls to increase the probability of authorized users conforming to a prescribed pattern of behavior. The Office of the Sheriff is responsible for generating and maintaining audit logs for the Mobile ID system. This system must be able to generate audit logs for defined events, including those set forth in FBI CJIS Security Policy § 5.4.1.1. At a minimum, this system shall produce, at the application and/or operating system level, audit records containing sufficient information to establish what events occurred, the sources of the events, and the outcomes of the events.
Audit logs must contain the following events and contents:
Events:
• Successful and unsuccessful system log-on attempts.
• Successful and unsuccessful attempts to use:
o access permission on a user account, file, directory or other system resource; o create permission on a user account, file, directory or other system resource; o write permission on a user account, file, directory or other system resource; o delete permission on a user account, file, directory or other system resource; o change permission on a user account, file, directory or other system resource. • Successful and unsuccessful attempts to change account passwords. • Successful and unsuccessful actions by privileged accounts (i.e. root, Oracle, DBA, admin, etc.).
• Successful and unsuccessful attempts for users to:
o access the audit log file;
o modify the audit log file;
o destroy the audit log file.
Content:
• Date and time of the event.
• The component of the information system (e.g., software component, hardware component) where the event occurred.
• Type of event.
• User/subject identity.
• Outcome (success or failure) of the event.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
The Office of the Sheriff will conduct an audit review and analysis of audit logs on a weekly basis for indications of inappropriate or unusual activity; investigate suspicious activity or suspected violations; report findings to appropriate officials; and take necessary actions.
The Office of the Sheriff shall protect audit information and audit tools from modification, deletion, and unauthorized access. The Office of the Sheriff is required to keep audit logs for a minimum of three years.
6. ACCESS CONTROL
SCPD shall manage information system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts by notifying the Office of the Sheriff’s IT Staff.
SCPD shall validate information system accounts at least annually and shall document the validation process. SCPD shall only grant access based on the following:
• Valid need-to-know/need-to-share as determined by the Office of the Sheriff; and • Satisfaction of all personnel security criteria.
SCPD shall notify the Office of the Sheriff as soon as reasonably possible of the following:
• A user’s information system usage or need-to-know or need-to-share changes. • A user is terminated or transferred or associated accounts are removed, disabled, or otherwise secured.
The Office of the Sheriff shall develop access control policies and associated access enforcement mechanisms to control access between users and objects in the Mobile ID system.
Systems that handle Mobile ID Data shall display an approved system use notification message, before granting access, informing potential users of various usages and monitoring rules.
7. MEDIA PROTECTION
Each Party shall restrict all access to digital and physical media in all forms to authorized individuals. Each Party must have a policy and procedures in place that define securely handling, transporting, and storing media.
Media Protection must include the following:
• Media should be restricted to authorized personnel, if physical and personnel restrictions are not feasible then the data must be encrypted.
• For transporting media, encryption is required.
• Sanitization of media shall mean overwrite at least three times or degauss digital media prior to disposal or release for reuse by unauthorized individuals. • Inoperable media shall be destroyed (cut up, shredded, etc.). • Physical media shall be destroyed by shredding or incineration.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
Each Party shall take appropriate measures for media sanitization and disposal that adhere to the FBI CJIS Security Policy’s requirements for media sanitization and disposal. Each Party shall have a Certificate of Destruction, which shall be witnessed or carried out by authorized personnel.
8. SYSTEM AND COMMUNICATIONS PROTECTION AND INFORMATION
INTEGRITY
Each Party will utilize systems and communications safeguards that range from boundary and transmission protections to securing a virtualized environment.
Applications, services, or information systems must have safeguards in place that detect and protect against unauthorized changes to software and information.
The network infrastructure must control the flow of information between interconnected systems.
The Office of the Sheriff shall have the following IT security protections in place:
• Boundary Protection (including use of proxies, gateways, guards, encrypted tunnels, firewalls, and routers that employ rule sets of establish configuration settings that restrict information system services or provide a packet filtering capability); • Encryption in Transit that is FIPS 140-2 certified and use a symmetric cipher key strength of at least 128-bit strength;
• Encryption at Rest that is FIPS 197 certified (AES) and at least 256-bit strength; • An Intrusion Detection System (IDS) that is network-based and/or host-based intrusion detection or prevention tools;
• Usage restrictions, change default administrative passwords, and a Virtual Local Area Network (VLAN) technology that segments VoIP traffic from data traffic if using a Voice over Internet Protocol (VoIP) capability;
• Virtualization
o Audit log files for all virtual machines and hosts must have the capability to store the logs outside the hosts virtual environment
o Virtual Machines that are Internet facing (web servers, portal servers, etc.) shall be physically separate from Virtual Machines (VMs) that process CJI internally or be separated by a virtual firewall
• Patch schedule in place to fix vulnerabilities;
• Malicious code protection that includes automatic updates for all systems with Internet access; and
• Spam and spyware protection.
9. PERSONNEL SECURITY
All SCPD personnel who have access to unencrypted Mobile ID Data will adhere to the FBI CJIS Security Policy’s personnel screening requirements before access is granted. All other requirements include the following:
Access for Santa Clara Police Department to Mobile-ID devices and MID system
• Upon termination of personnel accessing the Mobile ID system, SCPD shall notify the Office of the Sheriff as soon as reasonably possible to terminate access. SCPD will coordinate and ensure all access is terminated.
• Upon personnel transfer, SCPD shall ensure appropriate actions, such as closing and establishing accounts and changing system access authorizations, are conducted. • Upon personnel sanctions, SCPD shall employ a formal sanctions process for personnel failing to comply with established information security policies and procedures.
10. MOBILE DEVICES
For all mobile devices accessing Mobile ID Data, the Office of the Sheriff shall:
• Be enrolled in a Mobile Device Management (MDM), which will allow the following:
o Establish usage restrictions and implementation guidance for mobile devices; and o Authorize, monitor, control wireless access to the information system.
The use of mobile devices requires the use of a Mobile Device Management (MDM). Any phones that have been rooted or jailbroken shall not be used to process, store, or transmit Mobile ID Data at any time.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
EXHIBIT B
COST ALLOCATION
Initial Purchase of a single unit*
DESCRIPTION PRICE
Javelin - Mobile ID Fingerprint Device Unit Pricing (Hardware only) - Quantity - 1 $3,262.00
Ares - Software per device - Quantity - 1 $600.00
SOTI MobiControl Subscriber Developer License per device per year $38.64 SOTI Premium Support - Device per device per year $8.88 Applicable Sales Tax** $305.82
Total: $4,215.34
Ongoing annual maintenance per device*
DESCRIPTION PRICE
Ares - Annual Software Maintenance per device - Quantity - 1 $120.00 Mobile ID Hardware Maintenance $225.60
SOTI MobiControl Subscriber Developer License per device per year $38.64 SOTI Premium Support - Device per device per year $8.88 AT&T Cellular*** $540.00
Sheriff Support Staff $600.00
Total: $1,533.12
*These costs represent the estimated Mobile ID costs for SCPD per device on any additional Mobile ID devices purchased by the Agency.
**Sales Tax Rate in San José, California is 9.375%
***These costs are estimates as they may vary based on usage.
Access for Santa Clara Police Department to Mobile-ID devices and MID system
EXHIBIT C
SCOPE OF WORK
The primary network, ARES Gateway server, AFIS, and SOTI server (collectively known as the “Mobile ID system”) are installed at 55 W. Younger Ave., San José, California—the headquarters for the Office of the Sheriff. The Office of the Sheriff will provide SCPD with access to the local AFIS and California DOJ and FBI databases and services via the Mobile ID system.
I. SCPD RESPONSIBILITIES
SCPD is responsible for the following:
a. SCPD will respond to all FBI inquiries regarding RISC transactions run by SCPD. b. SCPD must ensure:
o All personnel with access to the Mobile ID system must comply with the training and backgrounding requirements in the current version of the CLETS PPP and FBI CJIS Security Policy.
o All CLETS terminals must satisfy the physical security and cybersecurity requirements in the current version of the CLETS PPP and FBI CJIS Security Policy, including anti-virus and firewall requirements. c. SCPD must adhere to CLETS PPP’s personnel access policies and maintain user lists with CLETS access training dates for all SCPD users.
II. OFFICE OF THE SHERIFF RESPONSIBILITIES
The Office of the Sheriff is responsible for providing the following:
a. Mobile ID device setup, configuration, provisioning, installation, and testing; b. ARES Gateway and SOTI software configuration, installation, and testing; c. Mobile ID user account provisioning and management;
d. Mobile ID device and Mobile ID system upgrade or patch deployments; e. Mobile ID audit requests;
f. Network security and device access management and support; g. Technical assistance with resetting and troubleshooting Mobile ID devices, connectivity, and user accounts;
h. Help desk support related to hardware and software provided and managed by the Office of the Sheriff;
i. Quarterly billing statements per the State Fiscal year; j. Access to the AFIS, DOJ, and FBI networks for Mobile ID; and k. Network connectivity and support between the SCPD and the Office of the Sheriff.
The Office of the Sheriff is NOT responsible for providing the following:
a. Technical assistance related to SCPD software not related to Mobile ID access; or b. Technical assistance related to SCPD’s internal network; or Access for Santa Clara Police Department to Mobile-ID devices and MID system
c. Lost/stolen Mobile ID devices.