HomeMy WebLinkAbout5569 • DocuSign Envelope ID:BA7D5D57-BA30-4C77-871 F-05B0906BACDD
� �on�^�G.�- !S,5-�o9
DATA LICENSING CONTRACT
WASNIN6i0M5T1iEDEP�RTMEMiOF INTERNET HOSTING PUBLISHING SERVICE(IHPS) DOL Contract No.: K5786
�• LICENSiNG
BREMERTON MUNICIPAL COURT DOL Account No.:
❑ New �Renewal
Contract
Cantract start date Contract end date Contract amount
Upon execution July 31, 2021 Non-financial
Purpose(brief description)
This License Agreement("Contract") establishes the requirements and authorization for the Licensee to receive
access to DOL Data through its Internet Hosting Publishing Services (IHPS) systems. This Contract cancels and
su ersedes DOL Contract number s K4486 and an other a reements for the same services.
Licensee
Licensee name Address
Bremerton Municipal Court 550 Park Avenue
Bremerton,WA 98337
Contract manager (Area code)Telephone Email
Dawn Nelson 360-473-5242 dawn.nelson ci.bremerton.wa.us
Contact#2 (Area code)Telephone Email
Licensee Employer ldentification Number(EIN) Licensee Uniform Business Identifier(UBI)
91-6001231 N/A
Department of Licensing (DOL)
Department administration Division
Data Licensin Unit Pro ram Services Division
Contract manager Contact address
PO Box 2076
Kristie Pettibone 01 mpia, WA 98507-2076
(Area code)Telephone Email
360 902-3657 da scomm dol.wa. ov
Attachments
This Contract consists of the following attachment(s)and document(s):
Data Licensing Statement#1—Access to IHPS
Attachment A,Data Security Requirements
The following documents are available online at htta://www.dol.wa.gov/vehicleregistration/externaldans.html:
Agency Access Request form(425-009)
Em lo ee Access/Chan e Re uest form 425-011
The terms and conditions of this Contract are an integration and representation of the final,entire and exclusive
understanding between the parties superseding,all previous agreements,writings,and communications,oral or otherwise,
regarding the subject matter of this Contract.The intent of the parties is that the effective date of this Contract shall be
upon execution by both parties.The parties signing below represent that they have read and understand this Contract,and
have the authorit to execute this Contract.
Licensee Signature Date DOL Signature Date
DocuSipned by: DoeuSlgned by:
�� ����� 4/29/2016 ��^'a'' d� ��`^""�''^' 4/29/Z016
PRINT Licensee Name Name
Dawn Nelson Tamara Dohrman
Print TiUe Pnnt Title
Court Administrator Assistant Director
Administrative Services Division
E-Mail E-Mail
dawn.nelson(a�ci.bremerton.wa.us TDohrman dol.wa. ov
Phone Phone
360-473-5242 360-902-4044
K5785 Page 1 of 11 4/21I2016
' DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-05B09066ACDD
, TERMS AND CONDITIONS
Upon execution, this Contract is entered into by and between the Washington State, Department of Licensing
(hereinafter called"DOL"), and the Licensee listed on the previous page (hereinafter called "Licensee"). In
consideration of the terms and conditions contained herein, the parties agree as follows:
1. PURPOSE
The purpose of this Contract is to set out the terms and conditions under which DOL will provide to the Licensee
access to the following systems:
❑ Driver and Plate Search (DAPS)
� Internet Host Publishing Service(IHPS)
2. AUTHORITY
Licensee will comply with all statutory and administrative rules regulating the confidentiality of Data obtained from
DOL, including, but not limited to:
• For DAPS: RCW 39.34,42.56, 46.12, and 46.52;WAC 308-10; and Federal Driver Privacy Protection Act
(DPPA) 18 U.S.C. §2721 through§2725 or other applicable law as currently written or hereafter amended.
• For IHPS: RCW 46.61.513,46.52.130, and 46.52.120; and Federal Driver Privacy Protection Act(DPPA) 18
U.S.C. §2721 through§2725 or other applicable law as currently written or hereafter amended.
3. DEFINITIONS
As used throughout this Contract, the following terms shall have the meanings set forth below:
a) "Abstract Driver Record"or"ADR" means the information contained in the official abstract of driving
record maintained by DOL. The Record includes Personal Information, accidents, violations, Failure to
Appears(FTAs), and driving privilege statuses.
b) "Confidential Information" means information that may be exempt from disclosure to the public or other
unauthorized persons under either chapter 42.56 Revised Code of Washington (RCW) or other state or
federal statutes and data defined as more sensitive than "public" and requires security protection.
Confidential Inforrnation includes, but is not limited to, Personal Information; agency security data; banking
profiles; and individually identifiable health information and protected health information as set forth in 45
CFR� 164.501 as currently enacted and subsequently amended or revised.
c) "Contract"shall mean these terms and conditions, Data Licensing Statement(s), and any amendments, or
attachments properly executed.
d) "DAPS" means the Driver and Plate Search application. DAPS is an application in a browser environment
and is available for search queries on driver identiry and vehicle ownership information only.
e) "Data" means information contained in the vehicle and driver Records provided to Contractor under this
Contract via DAPS and/or IHPS.
fl "Data Security" means protecting and securing information from unauthorized access, use, disclosure,
disruption, modification, perusal, inspection, recording or destruction. This applies regardless of the form the
Data may take(electronic, physical, etc.).
g) "Data Security Requirements" means the minimum requirements, as outlined in Attachment A, Data
Security Requirements, which the Licensee must comply with to ensure DOL Data is secure.
h) "Data Security Breach" or"Breach" means unauthorized acquisition of computerized Data that
compromises the security, confidentiality, or integrity of Personal Information as defined in RCW 19.255.010
and RCW 42.56.590.
i) "DOL" means the Washington State Department of Licensing.
j) "IHPS" means the Internet Host Publishing Service application also known as the Internet Query System.
IHPS is an application in a browser environment and is available to obtain DOL ADR Data.
k) "Licensee" means the primary agency, firm, provider, organization, individual, agent and/or other entity
accessing the DAPS and/or IHPS data systems under this Contract.
K5785 Page 2 of 11 4/21/2076
- DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-0580906BACDD
, /) "Permissible Use" means only those uses authorized in this Contract.
m) "Personal Information" means information identifiable to any person, including, but not limited to
information that relates to a person's name, health, finances, education, business, use or receipt of
governmental services or other activities, addresses (except 5-digit zip code), telephone numbers, social
security numbers, driver license numbers, e-mail addresses, credit card information, law enforcement
records or other identifying numbers or Protected Health Information, any financial identifiers, and other
information that may be exempt from disclosure to the public or other unauthorized persons under either
RCW 42.56.360, 42.56 RCW, or other state and federal statutes.
n) "RCW" means the Revised Code of Washington. All references in this document to RCW chapters or
sections shall include any successors, amended, or replacement statues.
o) "Record"or"Records" means the compilation of Data associated with driver, identicard, vehicles, motor
vehicles and/or vessels as defined in applicable Washington State law(such as RCWs 42.56.130,
46.04.670, 46.04.320 and 88.02.310).
p) "SecureAccess Washington"or"SAW" is a single sign-on application gateway created by Washington
State's Department of Enterprise Services and allows Internet access to multiple online government services
with the use of a unique single self-generated User-ID and password.
g) "User"means an employee(s)or agent(s)or authorized entity of the Licensee who is authorized to perform on
behalf of the Licensee and who will access the DAPS and/or IHPS application.
r) "WAC" means the Washington Administrative Code. All references in this document to WAC chapters or
sections shall include any successor, amended, or replacement statues
4. DATA LICENSING STATEMENTS
The attached Data Licensing Statement(s)outline the respective roles and responsibilities of the parties. As
needed, Data Licensing Sfatements will be issued by amendment against this Contract. Each Data Licensing
Stafemenf will be numbered and will identify the specific DOL Data required, the uses allowed for that Data and
other details as deemed appropriate.
5. PERIDD OF PERFORMANCE
This Contract may be extended for periods of up to flve (5) years in duration and shall be affected by written
Contract amendment prior to expiration. Prior to an extension or renewal being issued, the Licensee must submit
a new Agency Access Request form (425-009).
6. CONTRACT MANAGEMENT
The Contract manager for each of the parties as listed on page one(1) shall be responsible for and shall be the
contact person for all communications regarding the performance of this Contract. The Licensee is required to
notify the DOL Contract manager in writing within thirty (30) days of changes to contact information, business
mailing address.
7. ALTERAT/ONS AND AMENDMENTS
This Contract may be amended by written agreement to this Contract. Such amendments shall not be binding
unless they are in writing and signed by personnel authorized to bind each of the parties.
8. COMPENSATION
This is a non-financial Contract.
9. SAFEGUARDING OF PERSONAL INFORMAT/ON
The Licensee shall not use or disclose Personal Information in any manner that would constitute a violation of
federal law or applicable provisions of Washington State law. The Licensee agrees to comply with all federal and
state laws and regulations, as currently enacted or revised, regarding Data Security and electronic Data
interchange of Personal Information.
The Licensee shall protect Personal Information collected, used, or acquired in connection with this Contract,
against unauthorized use, disclosure, modification, or loss. The Licensee shall ensure its directors, officers,
employees, or agents use it solely for the purposes as set forth in this Contract. The Licensee agrees not to
release, divulge, publish, transfer, sell or otherwise make it known to unauthorized persons without the express
written consent of DOL or as otherwise authorized by law. The Licensee agrees to implement physical,
electronic, and managerial policies, procedures, and safeguards to prevent unauthorized access, use, or
disclosure. DOL reserves the rights to monitor, audit, or investigate the use of Personal Information collected,
used or acquired by the Licensee through this Contract.
K5785 Page 3 of 11 4/21/2016
- DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-0560906BACDD
, Licensee shall notify DOL immediately of becoming aware of any unauthorized access, use, disclosure, or Breach.
Any breach of this clause may result in termination of the Contract, suspension of on-line access accounts, and the
demand for return of all Confidential Information.
10.AUDITS
a) Audit Requirements: DOL may require Licensee to undergo Data Security and Permissible Use audits at
any time to ensure compliance with state and federal laws, and the terms and conditions of this Contract,
particularly if it suspects a Breach or misuse of DOL Data. The Licensee will bear all costs associated with
these audits.
b) Corrective Action Plans
Within thirty(30)days after receiving the results of an audit, Licensee must submit a corrective action plan
for each violation identified by an audit. For each violation, the corrective action plan must outline the
following:
• Steps to be taken to correct the violation; and
• A timeline for the steps, including the anticipated completion date.
11.DISPUTES
The parties agree that time is of the essence in resolving disputes. In the event a dispute arises under this Contract,
it shall be conveyed to the DOL using the following process:
a) When a bona fide dispute concerning a question of fact arises befinreen DOL and the Licensee and it cannot
be resolved, either party may request a dispute hearing with DOL's Contracts Office. The request for a
dispute hearing must:
� be in writing; state the disputed issues;
• state the relative positions of the parties;
• state the Licensee's name, address, and DOL Contract number;
• be mailed to the other party's Contract manager within three(3) business days after the parties agree
they cannot resolve the dispute; and
• be mailed to:
Department of Licensing
Contracts Office
P.O. Box 9047
Olympia WA 98507-9047
b) The responding party will have five (5) business days to respond in writing to the requesting party's
statement. This response will be sent to both the DOL Contracts Office and the requesting party.
c) The DOL Contracts Office shall review the written statements of the parties and reply in writing to both parties
within ten (10) business days. The DOL Contracts Office may extend this period if necessary by notifying the
parties.
d) The decision of DOL's Contracts Office shall be final and conclusive unless, within five (5) business days
from the date DOL mailed the decision, the Licensee requests intervention by the Governor, as provided by
chapter 43.17 RCW and informs DOL of this decision in writing within five (5) business days of the DOL
decision date.
e) Each party shall be responsible for its own expenses in all dispute-related matters.
12. ORDER OF PRECEDENCE
All rights and obligations of the parties to this Contract shall be subject to and governed by the items listed in this
section, which are incorporated herein. In the event of an inconsistency in this Contract, unless otherwise
provided in this Contract, the inconsistency shall be resolved by giving precedence in the following order:
1. Applicable state and federal statutes and rules;
2. This Contract's Terms and Conditions;
3. Attachment A, Data Security Requirements;
4. Data Licensing Sfatement(s) issued against this Contract;
5. Agency Access Request(425-009) and Employee Access/Change Request(425-011); and
6. Any other provisions of the Contract incorporated by reference or otherwise.
K5785 Page 4 of 11 4/21/2016
• DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-05B09066ACDD
13. SECURITY OF DATA
Licensee agrees to comply with the Attachment A, Dara Security Requirements, as described herein. Licensee
shall take due care to protect the Data from unauthorized physical and electronic access as described in this
Contract.
14.ACCESS TO DATA
The Data shall be provided by DOL using SAW. SAW is considered to have a strong authentication mechanism.
SAW adds an additional layer of protection to the DAPS and IHPS Data available via the tnternet.
15. INDEPENDENT CAPACITY
The employees or agents of each party who are engaged in the performance of,this Contract shall continue to be
employees or agents of that party and shall not be considered for any purpose to be employees or agents of the
other party.
16. FUND/NG CONTINGENCY
In the event funding from state, federal, or other sources is withdrawn, reduced, or limited in any way after the
effective date of this Contract and prior to normal completion, either party may suspend or terminate this
Contract without advance notice and without penalty. At the sole discretion of DOL this Contract may be subject
to renegotiation under any new funding limitations and/or conditions.
17. TERMINATION FOR CONFLICT OF INTEREST
DOL may, by written notice to the Licensee terminate this Contract if it is found after due notice and examination
by DOL that there is a violation of the Ethics in Public Service Act, chapter 42.52 RCW; or any similar statute
involving the Licensee in the performance under this Contract.
18. TERMINAT/ON FOR CAUSE
Any violation of the restrictions, conditions or requirements contained in this Contract constitutes grounds for DOL
to terminate this Contract immediately and without notice.
19. TERMINAT/ON FOR CONVENIENCE
Either party may terminate this Contract by giving written notice to the other party at least fifteen (15) business
days before the effective date of termination. Written notice may include, but is not limited to notice provided by
United States Postal Service(USPS), email or FAX.
20. TERMINATION OFACCESS
Each party may at its discretion disqualify an individual authorized by the other party from gaining access to
Data in the DAPS or IHPS system. Notice of termination of access will be by written notice and become
effective upon receipt by the other party. Termination of access of one individual by either party does not affect
other individuals authorized under this Contract.
21. TERMINAT/ON FOR WITHDRAWAL OF AUTHOR/TY
In the event that the authority of DOL to perform any of its duties under this Contract is withdrawn, reduced, or
limited in any way after the commencement of this Contract and prior to normal completion, DOL may terminate
this Contract.
22. TERMlNATION PROCEDURE
After receipt of a notice of termination, and except as otherwise directed by DOL's Contract manager, the
Licensee shall take such action as may be necessary, or as DOL's Contract manager may direct, for the
protection and preservation of DOL Data which is in the possession of the Licensee.
23. RECORDS MA/NTENANCE
The Licensee shall maintain books, records, documents and other evidence of accounting and Data Security
procedures and practices. These records shall be subject at all reasonable times to inspection, review, or audit
by personnel duly authorized by DOL, the Office of the State Auditor, and federal officials so authorized by law,
rule, regulation, or contract.
The Licensee shall maintain records relating to this Contract and the use of Data described herein. All records
and other material relevant to this Contract shall be retained for six (6) years after expiration or termination of this
Contract.
Licensee is a government agency, and the parties have mutually determined that the Licensee shall adhere to its
required retention schedule.
K5785 Page 5 of 11 4/21/2016
� DocuSign Envelope ID:BA7D5D57-BA30-4C77-871 F-05609066ACDD
. Without agreeing that litigation or claims are legally authorized, if any litigation, claim, or audit is started before
the expiration of the six(6) year period, the records shall be retained until all litigation, claims, or audit findings
involving the records have been resolved including any appeals and remands.
Records and other documents, in any medium, furnished by one party to this Contract to the other party, will
remain the property of the furnishing party, unless otherwise agreed. The receiving party will not disclose or
make available this material to any third parties without first giving notice to the furnishing party and giving it a
reasonable opportunity to respond. Each party will utilize reasonable security procedures and protections to
assure that records and documents provided by the other party are not erroneously disclosed to third parties.
The Dispute Board shall review the facts, Contract terms and applicable statutes and rules and make a
determination of the dispute. The determination of the Dispute Board shall be final and binding on the parties
hereto.
24. DATA DISPOSITION
If Licensee is exempt by statute from the Data Disposal requirements in Attachment A, Data Security Requirements,
Licensee will not be required to comply with Data Disposal requirements. Licensee shall adhere to any required
retention schedule. Otherwise, the Licensee will be required to dispose of Data as outlined in Attachment A, Data
Security Requirements.
25.ASS/GNABILITY
The Licensee shall not assign this Contract, nor any claim arising under this Contract without the prior written
consent of DOL,which consent shall not be unreasonably withheld.
26. COMPLIANCE W/TH APPUCABLE LAW
At all times during the term of this Contract, the Licensee shall comply with all applicable federal, state, and local
laws and regulations, including but not limited to, nondiscrimination laws and regulations.
27. GOVERNANCE
This Contract shall be construed and interpreted in accordance with the laws of the state of Washington and the
venue of any action brought hereunder shall be in the Superior Court for Thurston County.
28. INDEMN/FICAT/ON
Each party to this Contract shall indemnify, defend and hold harmless the other party from and against all claims
for damages resulting from its own acts and/or omissions and those of its officers, employees and agents arising
out of or resulting from the performance of this Contract.
29. LEGAL FEES
Unless otherwise specified by law, in the event of litigation or other action brought to enforce Contract terms,
each party shall bear its own legal fees and costs.
30. LIMITAT/ON OF SIGNATURE AUTHORITY
Only DOL's Director or designated delegate by writing shall have the expressed, implied, or apparent authority to
alter, amend, modify, or waive any clause or condition of this Contract. Furthermore, any alteration, amendment,
modification, or waiver of any clause or condition of this Contract is not effective or binding unless made in
writing and signed by DOL's Director or delegate.
31. RELEASE OF INFORMATION TO OTHER TH/RD PART/ES
DOL Data will not be shared with any third parties, unless otherwise allowed herein or without prior written
approval by DOL.
32. RIGHTS OF INSPECT/ON
Licensee shall provide right of access to the other party, or any of its officers, or to any other authorized agent or
official of the state of Washington or the federal government at all reasonable times, in order to monitor and
evaluate performance, compliance, and/or quality assurance of internal policies and procedures, and/or records
relating to the safeguarding, use, and disclosure of Confidential Information obtained or used as a result of this
Contract. Licensee shall make available information necessary for the other party to comply with an individual's
right to access, amend, and receive an accounting of disclosures of their Confidential Information.
33. SEVERAB/LITY
If any term or condition of this Contract is held invalid, such, invalidity shall not affect the validity of the other
terms or conditions of this Contract.
K5785 Page 6 of 11 4/21/2016
' DocuSign Envelope ID:BA7D5D57-BA30-4C77-871 F-0560906BACDD
• 34. SURVIVORSHIP
All transactions executed pursuant to the authority of this Contract shall be bound by all of the terms and
conditions set forth herein, notwithstanding the expiration of the initial term of this Contract or any extension
thereof. Further, the terms and conditions contained in this Contract that by their sense and context are intended
to survive the completion of the performance, cancellation or termination of this Contract shall so survive.
35. WAIVER
A failure by either party to exercise its rights under this Contract shall not preclude that party from subsequent
exercise of such rights and shall not constifute a waiver of any other rights under this Contract unless stated to be
such in a writing signed by an authorized representative of the parry and attached to this Contract.
****THE REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK****
K5785 Page 7 of 11 4/21/2016
- DocuSign Envelope ID:BA7D5D57-BA30-4C77-871 F-0560906BACDD
DATA LICENSING STATEMENT#1 —ACCESS TO IHPS
� PERM/SSIBLE USE OF DATA
The Licensee will limit the use and disclosure of DOL Data provided under this Contract to the following:
• Only for the limited purposes of carrying out activities pursuant to this Contract as described in Licensees
Agency Access Request(425-009) submitted prior to issuance of this Contract.
. For court proceedings and to assist the individuals in determining requirements to reinstate their Washington
driving privilege. The information shall not be divulged by the Licensee to any third party, except for lists of
Failure to Appear(FTA) and/or reinstatement Data and status, which may be divulged to the individual named
or his/her attorney.
• For use in connection with any civil, criminal, administrative,or arbitral proceeding in any federal, state, or local
court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of
litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, state,
or local court.
• Only be disseminated to authorized entities and persons,and used by them only for the purposes set forth
herein, in accordance with federal and state law, and will not be divulged to any unauthorized third party.
DOL Data may not be used for the following:
• For personal purposes and/or benefit. Any use of DOL Data for purposes other than to accomplish the Users
official job functions is grounds for immediate termination of this Contract as provided herein.
• Not sell or otherwise distribute any DOL Data. All exceptions must be pre-approved in writing by the DOL
Contract manager, setting out any limitations or conditions to which the approval is subject. Such written
approval must be granted by the DOL prior to the requested use of, or release of, Data that is subject to the
exception.
Z. DESCR/PT/ON OF DATA
This Contract governs the transfer and access to the following:
. Middle Initial Search
• All Failure to Appears(FTA)
• Reinstatement Status
• FTA Adjudications
• Record Status
. Driving History
• Driving Record Abstract
3. ROLES AND RESPONS/BIL/TIES
Licensee will:
• Take all steps necessary to ensure the application is accessible and used only by authorized Users to
accomplish their official job functions.
• Require each employee accessing the IHPS application to register with SAW.
• Have the ability and is responsible to cancel each Users SAW account.
• Ensure that DOL Data will not be shared, duplicated,or re-disclosed.
• Notify DOL in writing of employees who are eligible for access to the IHPS by using the Access/Change Request
form(425-009)provided by DOL at the IHPS website.
httn://www.dol.wa.qov/veh iclereQistration/externaldaps.html.
• Immediately notify DOL in writing of any changes to the access eligibility by using the forms provided by DOL.
Update and verify authorized Users list to DOL annually for accuracy and accountability for continued access to
IHPS.
• Ensure the Users maintain the confidentiality of DOL Data by:
o protecting their account numbers and complex passwords;
o instituting penalties for misuse of Data; and
o ensuring Users are familiar with the provisions of this Contract.
The Licensee's Contract manager will have the authority to authorize User for access or revocation of access.
DOL will:
K5785 Page 8 of 11 4/21/2016
- DocuSign Envelope ID:BA7D5D57-BA30-4C77-871 F-0560906BACDD
, • Make the IHPS available for access seven (7)days a week, with the exception of scheduled maintenance, and
unforeseen outages.
• Update User access as requested by Licensee's Contract manager.
. Provide support if needed to access IHPS.
� PROGRAM SUPPORT COMMUN/CAT/ONS
Licensee and User may contact DOL Data Sharing Contracts Unit for IHPS related questions and issues at:
The Program Support for DOL is:
Department of Licensing
Data Sharing Contracts Unit
PO Box 2076
Olympia,WA 98507-2076
Phone: 360-902-3708
E-Mail: dapscomm@dol.wa.gov
Monday-Friday 8:00 a.m.to 5:00 p.m., except state holidays
For questions and issues related to SAW, please contact Washington Technology Solutions(WaTech)at:
The Program Support for SAW is:
WaTech
Phone: 360-753-2454 (local)
888-241-7597(long distance)
E-Mail: Servicedesk@watech.wa.gov
K5785 Page 9 of 11 4/21/2016
. DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-0560906BACDD
ATTACHMENT A
DATA SECURITY REQUIREMENTS
DATA SECURITY REQUIREMENTS
1. Data Classification
The classification of the Data shared is considered:
❑ Category 1 —Public Information
❑ Category 2—Sensitive Information
❑ Category 3—Confidential Information
� Category 4—Confidential Information Requiring Special Handling
Data described in this Contract is assessed to be in the following data classification:
"Cateqorv 4—Confidential Information Reauirinq Special Handlinq"as defined by Attachment A, Data Security
Requirements.
Confidential Information requiring special handling is information that is specifically protected from disclosure by
law and for which:
a. Especially strict handling requirements are dictated, such as by statutes, regulations, or this Contract.
b. Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or
legal sanctions.
2. Computer Security
Licensee shall maintain the computers that access DOL Data by ensuring the operating system and software are
updated and patched regularly, such that they remain secure from known vulnerabilities. Licensee further agrees
that the computer device(s)are installed with an Anti-Virus solution and signatures updated frequently.
3. Access Security
Access to the Data will be restricted to authorized Users by requiring a login using a unique User ID and complex
password or other authentication mechanism which provides equal or greater security. Passwords must be
changed on a periodic basis and the sharing of User ID and passwords is strictly prohibited.
4. Data Storage
Licensee agrees that any and all DOL Data will be stored, processed, and maintained solely on designated
computing equipment and that no DOL Data at any time will be processed on or transferred to any portable
storage medium.
5. Data Transmission
Licensee agrees that any and all electronic transmission or exchange of system and application data with DOL
and/or any other parties expressly designated by DOL shall take place via secure means(e.g., HTTPS or SFTP).
6. Distribution of Data
Licensee shall ensure no DOL Data of any kind shall be transmitted, exchanged, or otherwise passed to other
Licensees/vendors or other parties except on a case-by-case basis as specifically agreed to in writing by DOL.
Licensee further agrees not to provide screen prints outside their control. Any screen print must be destroyed as
referenced in the Dafa Disposal section of these Data Security Requirements.
7. Data Disposal
tJnless otherwise specified in this Contract, Licensee agrees that upon termination of this Contract it shall erase,
destroy, and render unrecoverable all DOL Data and certify in writing that these actions have been completed
within thirty(30) days of the termination of this Contract or within seven (7) days of the request of DOL, whichever
shall come first. At a minimum, media sanitization is to be pertormed according to the standards enumerated by
NIST SP 800-88 Guidelines for Media Sanitization.
K5785 Page 10 of 11 4/21/2016
• DocuSign Envelope ID:BA7D5D57-BA30-4C77-871F-0560906BACDD
, 8. Security Breach Notification
Licensee agrees to comply with all applicable laws that require the notification of individuals in the event of
unauthorized release of DOL Data or other event requiring notification. In the event of a Breach of any of
Licensee's security obligations, or other event requiring notification under applicable law, Licensee agrees to the
following:
a) Notify DOL by telephone and e-mail of such an event within twenty-four(24) hours of discovery:
DOL Help Desk, phone: (360) 902-0111; email: hlbhelp@dol.wa.gov
b) Assume responsibility for informing all such individuals in accordance with applicable state and federal
laws.
c) Indemnify, hold harmless and defend DOL and its trustees, officers, and employees from and against any
claims, damages, or other harm related to such notification event.
d) Mitigate the risk of loss and comply with any notification or other requirements imposed by law or DOL.
K5785 Page 11 of 71 4/2112016