HomeMy WebLinkAboutDEPARTMENT OF JUSTICEINSURANCE NOT REQUIRED
WORK MAY PROCEED
CLERK OF COUNCIL
DATE: Department of Justice (DOJ)
Statement of Work
o. ►T �+) APR 2 7 2023
�M.w,cf6w fR
1. Purpose
Return FULLLY EXECUTED
Copy to COTC, M-30
STATEMENT OF WORK
N-2023-098
COPY
The California Department of Justice (DOJ), California Justice Inform:
(CJISD), Technology Support Bureau (TSB), also referred to as State
hereafter referred to as Agency, enter into this Agreement for the pure av, U, U., ru yiuviue
JusticeMDM application services to the Agency.
2. Background
The Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security
Policy hereinafter referred as the FBI CJIS Security Policy (CSP), outlines the requirements
agencies need to adhere to in order to access CJIS data on mobile devices. In the spring of 2013,
the DOJ Hawkins Data Center (HDC) successfully completed the deployment of mobile devices
with access to CJIS data to DOJ Special Agents. Using this newly developed solution, DOJ is
assisting its Law Enforcement Agency Partners (LEAP) in being able to access CJIS data on their
Agency owned devices. This service is built to suit, modular in design and available to all LEAP in
good standing.
3. Term
The term of this Agreement will commence on 01/01/2023 through 12/31/2023 as noted on the
attached Std. 213 (the'Effective' term). Extensions will be made by amendment at the same
terms and conditions.
4. Order of Precedence
In the event of a discrepancy and/or inconsistency between the attachments of this Agreement,
the descending order displayed on the Std. 213 shall take precedence.
5. Scope and Description
JusticeMOM - This level of service does not include access to Criminal Justice Information and is
strictly for the use of those jurisdictions wishing to take advantage of the California Department of
Justice's services for Mobile Device Management (MDM). If an agency wishes to utilize their own
infrastructure to access Criminal Justice Information they can do so with the approval of a
California Law Enforcement Telecommunications System (CLETS) upgrade application to the
CLETS Administration Section (CAS) and the CLETS Advisory Committee (CAC).
Agency and DOJ will review DOJ's performance and discuss other issues related to service
planning. During these reviews, the Agency is obligated to present any changes in the workload
requirements and to report on any changes in the service quality or delivery. In addition, DOJ is
obligated to advise the Agency of any changes which will affect service quality, ability to meet the
workload requirements of client agencies and/or variances in schedules or cost.
A. JusticeMDM Team will be responsible for the following:
1. Install, configure, monitor and maintain physical server hardware located at DOJ
facilities.
2. Install, configure, and monitor virtual server instance(s) running on hardware at DOJ
facilities.
Page 1 of 6
Department of Justice (DOJ)
Statement of Work
3. Provide Simple Mail Transport Protocol (SMTP) service for the MDM instance for routing
MDM email traffic.
4. Serve as the central point of contact and liaison for HDC operations, network, server,
password issues and security sections by the DOJ Computer Operations Unit.
5. Provide server and network support to authorized subscribing Agency's administrators
during regular business hours 8:00 a.m. to 5:00 p.m. (Pacific Standard Time) Monday
through Friday, excluding holidays and provide afterhours call back services for support
of MDM infrastructure and services.
6. Maintain licensing for subscribing agency.
7. Maintain separate MDM instance of subscribing LEAP for security.
8. Purchase and provide MDM licenses, as stated in Exhibit D, Costs and Payment Method,
to Agency during the term of the Agreement.
9. Provide invoice(s) for the MDM licenses to Agency.
10. Provide Virtual Machine (VM) Server licensing for two VM's each at HDC and DOJ's
Disaster Recovery (DR) location.
11. Create and maintain Apple Push Notification Service certificates for agencies.
B. The DOJ will provide the following services:
1. California Justice Information Services Division (CJISD), Information Security and Digital
Investigation'Services Section
• Oversee and maintain end point CJIS security'requirements
2. CJISD, IT Agreements &Procurement Unit (ITCPU)
Maintain and administer the Agreement
Prepare. Agreement amendments and renewals
Submit request to DOJ's Accounting Office to invoice Agency -for reimbursement of
costs
3. TSB will provide the core support services for the JusticeMDM as shown in the diagram
below.
Page 2 of 6
Department of Justice (DOJ)
Statement of Work
„v =a 41,ivw LtW Mt•.�nIY,YV Nalwo.�
M,weMW �14d, 1ewl Ql�new
{JIvwY IYy1,w„\ OI YYO
C. Agency
Exhibit A
The Agency is obligated to contact DOJ's Computer Operations Unit when reporting any
problems with the JusticeMDM solution (see System and Software Maintenance section for
contact information).
Changes in workload projections, equipment configurations, application configuration, service
changes, or additional clients may increase charges and require a modification of this Agreement.
The Agency will be responsible for the following:
1. Provision and manage Agency users within the JusticeMDM solution.
2. Provision Agency mobile devices with JusficeMDM solution.
3. Provide troubleshooting and technical support for Agency mobile devices.
4. Ensure Policy compliance with CJIS Security Policy on all devices that will access CJIS data
as stated in Exhibit B.
5. Maintain applications in the Agency Application Store.
6. Manage deployment of policies, configuration and applications to Agency mobile devices.
7. Manage accounts and licenses for Agency instance using the MOM Console.
B. Request number of Clients/devices on an annual basis as part of the Agreement renewal,
which should commence 90 days prior to expiration annually.
9. The Agency will reconcile licenses being used annually.
Amendments
The Contractor will allow amendment(s) to this Agreement for additional time and money at the
rates evaluated and considered, through a formal Agreement amendment. The Agreement award
is subject to availability of funds approved for this purpose.
Page 3 of 6
Department of Justice (DOJ)
Statement of Work
Exhibit A
The Contractor shall not be authorized to deliver or commence performance of services as described in
the Agreement until written approval has been obtained from all entities. Any delivery or performance of
service commenced prior to the Contractor obtaining all written approvals shall be considered voluntary
on the part of the Contractor and non-compensable by DOJ.
No amendment or variation of the Agreement terms shall be valid unless made in writing, signed by both
parties, and approved as required. No oral understanding not incorporated in the Agreement is binding on
any of the parties.
6. Proiect Representatives
Project representative for the term of the Agreement will be:
State Agency: Department of Justice
Contractor: City of Santa Ana
Name: (To be determined after Agreement award)
Name: Mike Fetner, Melanie Torres, Victor Ochoa
Address:
Address:
20 Civic Center Plaza M-42
City, State, Zip
City, State, Zip
Santa Ana, CA 92701
Phone:( )
Phone:( )
714-647-5384, 714-647-5373.714-647-5496
Email:
Email:
MFetner(a'Dsanta-ans.orq, Mtorres(a_santa-
ana.o . VOch a an a-ana.or
Either party may make changes to the Project Representatives by giving written notice to the other party.
Said changes shall not require an amendment to this Agreement.
Page 4 of 6
N-2023-098
Department of Justice (DOJ)
Statement of Work
Exhibit A
IN WITNESS WHEREOF, the parties hereto have executed this Agreement on the day and year as
indicated:
Chris Cademarti, Bureau Director
California Department of Justice
California Justice Information Services Division
Technology Support Bureau
Chris Cademarti, Acting Chief/CIO
California Justice Information Services Division
Department of Justice
Chris Ryan, Division Chief
California Department of Justice
Division of Operations
Sonny Mangat, Information Security Officer
California Department of Justice
California Justice Information Services Division
Enterprise Services Bureau
Cybersecurity Branch
"
Kristine Ri46e, City Manager '—
City of Santa Ana
Jenn r Hal of th ouncil
anta Ana
Date
Date
Date
Date
Date
a
Date
Page 5 of 6
Department of Justice (DOJ)
Statement of Work
r e,�
iu la, Chief Technology
Santa Ana
Tamara Bogosian; Senior Assistant City Attorney
City of.Santa Ana
Exhibit A
2 /13 d3
Date
2/10/2023
Date
Page 6 of 6
Department of Justice (DOJ)
Budget Detail and Payment Provisions Exhibit B
EXHIBIT B
BUDGET DETAIL AND PAYMENT PROVISIONS
1. Payment
For full and satisfactory performance of the services provided pursuant to this Agreement, the
Department of Justice shall pay the Contractor per attached Cost Worksheet, Exhibit B-1. The total
amount which may be paid under this Agreement shall not exceed the amount indicated in Exhibit B-1
with the actual amount being dependent upon the extent of the Contractor's services required by the
Department of Justice.
The Contractor understands that no Federal or State income tax shall be withheld from the payments
under this Agreement. However, the State of California is required to report all payments to the
Internal Revenue Service and Franchise Tax Board for tax purposes.
2. Invoicing
The Agreement costs will be billed annually. Invoices shall be sent to the Agency in advance for the
purchase of all items including but not limited to software licenses, equipment, and communication
costs.
Agency agrees to pay DOJ for services within thirty (30) days upon receipt of a DOJ invoice for costs
described in the DOJ Services and Support Costs table below.
Total Reimbursement Amount:
Custom and additional services are available upon request. The cost of these additional services will
be determined on an individual basis. To obtain additional services. Agency will submit a written request
to the JusticeMobile@doj.ca.gov.
Agency can increase the number of licenses at any time during the Agreement term by submitting a
written request to ITCPU at ITMOU@doj.ca.gov with a copy to: JusticeMobile@doj.ca.gov.
Send all requests for invoicing and general questions related to this Agreement to:
Department of Justice
IT Contracts & Procurement Unit
Attention: Anthony Nguyen
4949 Broadway, Room D-232
Sacramento, CA 95820
Or email to: ITMOU andoi.ca.aov
All invoices should be billed to/mailed to the following address:
City of Santa Ana
20 Civic Center Plaza M-42
Santa Ana, CA 92701
Attn: Melanie Torres, Information Technology Department, 714-647-5373, MTorres@santa-ana.org
Page 1 of 1
Department of Justice (DOJ)
Cost Worksheet
EXHIBIT B-1
COST WORKSHEET
Costs for JusticeMDM:
Note: Please remove any rows that are not applicable.
Exhibit B-1
Cost per
Description
Quantity
Device
Total
License*
MDM License(s) including maintenance and
associated hardware costs for each year
750
$50.00
$37,500
True -up cost for 150 additional MDM License(s)
including maintenance and associated hardware
N/A
N/A
$4,536.99
costs.
Total
750
$42,036.99
*Software license and maintenance cost can Fluctuate
therefore; the costs above are an estimate. An annual
Security Review of system setup and configuration is
provided at no charge.
Page 1 of 1
Department of Justice (DOJ)
Special Terms and Conditions
EXHIBIT C
SPECIAL TERMS AND CONDITIONS
1. State of Confidentiality
Exhibit G
The DOJ has criminal justice and other confidential data in its custody. Unauthorized inspection or
disclosure of criminal justice data or other confidential data is punishable by law. Unauthorized
inspection or disclosure of criminal justice data and other confidential data may be punishable by jail
time and/or a fine.
Each Agency and each of its employees who may have access to the confidential or sensitive data of
the other agency will be required to have on file a signed confidentiality statement, attesting to the
fact that it/he/she is aware of the confidential data and the penalties for unauthorized disclosure
thereof under applicable state and federal law. The confidentiality statement shall be renewed every
two (2) years.
2. Use of Information:
The Agency agrees that the information furnished or securedpursuant to this contract shall be used
solely for the purposes descdbed in the Purpose outlined in the Section 1 of the contract. The Agency
further agrees that information obtained under this contract will not be reproduced, published, sold or
released in original or in any other form.
3. Data Ownership:
The criminal justice information or sensitive information being provided under this contract remains
the exclusive property of the respective criminal justice agency that submitted the data to the DOJ.
Confidential criminal justice and sensitive datarinformation are not open to the public and require
special precautions to protect from loss and unauthorized use, disclosure, modification, or
destruction. The recipient agency shall have the right to use and process the disclosed information for
the purposes stated in the Purpose outlined in Section 1 of this contract. All rights shall be revoked
and terminated immediately upon termination of this contract.
4. Employee Access to Information:
The Agency agrees that the information obtained will be kept in the strictest confidence and shall
make information available to its own employees only on a "need to know" basis. The "need to know"
standard is met by authorized employees who need the information to perform their official duties in
connection with the uses of the information authorized by the contract. The Agency recognizes its
responsibilities to protect the confidentiality of the information in their custody as provided by law and
ensures such information is disclosed only to those individuals and of such purpose, authorized by
the respective laws.
5. Information Security:
Information security is defined as the preservation of the confidentiality, integrity, and availability of
information. A secure environment is required to protect the confidential information obtained by
pursuant to this contract. The Agency will store information so that it is physically secure from
unauthorized access. All data and records received will be securely maintained and accessible only
by the employees of the specified program who are committed to protect the data from unauthorized
access, use or disclosure.
6. Cloud Computing Environment:
Page 1 of 5
Department of Justice (DOJ)
Special Terms and Conditions
A Cloud Computing Environment cannot be used to receive, transmit, store or process DOJ's
confidential criminal justice data.
7. Destruction of Records:
Exhibit C
All records received by Agency from DOJ and any documents created, copies made, or files
attributed to the records received will be destroyed within 30 days of completion of the business
purpose for which it was obtained. The records shall be destroyed in a manner to be deemed
unusable or unreadable and to the extent that an individual record can no longer be reasonably
ascertained.
S. Safeguard Review:
The DOJ retains the right to conduct on site safeguard review of the Agency use of DOJ information
and security controls established. The DOJ will provide a minimum of seven (7) days' notice of a
safeguard review being conducted by DOJ staff.
'9. Potential Subcontractors:
Prior to the use of a subcontractor(s) to store, use, process, transmit, and/or access DOJ data,
notification to, and written approval from DOJ is required 60 days in advance. The notification must
include complete name and address of the entity, purpose for use of a subcontractor, location(s)
where the data is or will be stored or used, and contact information.
Nothing contained in this contract or otherwise shall create any contractual relationship between the
DOJ and any subcontractors, and no subcontract shall relieve the Agency of its responsibilities and
'obligations hereunder. The Agency agrees to be as fully responsible to the D0J for the acts and
omissions of its subcontractors and of, persons either directly or indirectly employed by any of them,
as it is for the acts and omissions of persons directly employed by the Agency. The Agency, obligation
to pay its subcontractors is an independent obligation from the DOJ's obligation, if any, to make
payments to the Agency.
As a result, the DOJ shall have no obligation to pay or to verify the payment of any monies to any
subcontractor.
Page 2 of 5
Department of Justice (DOJ)
Special Terms and Conditions
10. System and Software Maintenance:
Hours of Operation:
DOJ systems are monitored 24x7x365 by the DOJ Computer Operations Unit
Exhibit C
Contact
Phone
Email
Business
Hours
DOJ Computer
(916) 227-3000
HDC.Comouter0oerations(a)doi.
24x7x365
ca.eov
Operations Unit
support
Service Level Agreement:
The Service Level Agreement (SLA) outlines the response and resolution times agreed upon by
DOJ and the Agency per the criticality defined below:
Critical
1. A problem that severely impacts the use of JusticeMDM software in the production
environment.
2. The production system is down or unusable as a result of a problem.
3. A degraded mode of operation is not available or acceptable.
4. Problem causes mission -critical impact on customer's operation with no acceptable
workaround or functionality to perform tasks essential to customer operations.
High
1. A problem where the JusticeMDM software is functioning, but production environment
usage is reduced.
2. System is up and running and the problem causes moderate or limited impact while most
business operations remain functional.
3: Service is necessary, but an immediate resolution is not essential.
4. The problem is important to long-term productivity but not causing an immediate work
stoppage.
5. A workaround may exist.
Standard
1. A problem with JusticeMDM that does not have significant impact to the customer's
business operations.
�.— The software -continues to function.-
3. A workaround may exist.
4. Low impact on the ability for the software to provide full functionality.
5. Annoyances or issues that can be repaired during standard planned maintenance
windows.
Low
1. Request for Enhancement.
2. General Usage Questions.
Page 3 of 5
Department of Justice (DOJ)
Special Terms and Conditions
Service Level during regular Business Hours (7 a.m. to 5 p.m.)
Exhibit C
Service Level
Response
Resolution
Critical
<30 minutes
1 hour
High
1 hour
2 hours
Standard
2 hours
4 hours
Low
4 hours
8 hours
Resolution means that DOJ has resolved the issue or escalated the issue appropriately to
the software vendor.
Service Level during non -regular Business Hours (5:01 p.m. to 6:59 a.m.)
Service Level
Response
Resolution
Critical
1 hour
2 hours
High
2 hours
4 hours
Standard
Next business day
Next maintenance
window
Low
Next business day
Next business day
Resolution means that DOJ has resolved the issue, escalated the issue appropriately to the
software vendor, or provided a response to re uestor.
If escalation path is slow or no response occurs contact one of the following:
Jason Collins
Chris Cademarti
(916)210-5055
(916)210-5221
Supervisor
Director
Enterprise In Systems Unit
Technology Support Bureau
Technology Support Bureau
If the level of service related to a request is not satisfactory contact Chris Cademarti, Director,
Technology Support Bureau at Chris.Cademarti@doj.ca.gov. Agency input will be appropriately
categorized and processed and a response will be provided indicating the action taken.
Maintenance Process
System software and hardware upgrades and maintenance will be routinely conducted to provide
optimum reliable service performance. Scheduled downtime for system maintenance will be
limited to non -regular business hours; however, security updates requiring immediate attention
will be performed when needed. During scheduled maintenance pedods, users may experience
temporary interruptions. The Agency will receive an e-mail notification of scheduled maintenance
activities three (3) calendar days before scheduled service interruptions. The notification will
include an abbreviated overview of planned activities and potential service interruption.
Scheduled, non -emergency downtime
System maintenance will be limited to non -regular business hours. The Agency will receive an e-
mail notification of scheduled maintenance activities three (3) calendar days prior to scheduled
service interruptions. The notification will include an abbreviated overview of planned activities
and potential service interruption.
Unscheduled, emergency downtime
Page 4 of 5
Department of Justice (DOJ)
Special Terms and Conditions
Exhibit C
Unscheduled system maintenance will be conducted only when a system component has failed
without warning, or the operational integrity or system security is faced with an immediate failure.
If possible, the Agency will receive an e-mail announcement of unscheduled emergency
maintenance activities prior to the unscheduled service interruption. The notification will include
an abbreviated overview of planned activities and potential service interruption.
Change Management Process
DOJ agrees to notify the Agency in advance of any technical or system changes that will affect
the JusticeMDM system or access to the system. This includes any scheduled maintenance
periods, or emergency maintenance; disconnection or suspension of the service by either agency
party; modifications to agreed upon configurations or outages.
Contacts for such notification are listed in the Responsible Parties section.
Disaster Recovery Process
In the event of a major service disruption or major catastrophic event, DOJ agrees to coordinate
the recovery of JusticeMDM to meet the recovery time objective for the system or service. DOJ
will address the JusticeMDM service after all DOJ systems have been addressed.
11. Miscellaneous Provisions Including Termination:
Agency or DOJ may terminate this agreement with at least ninety (90) calendar days written notice
prior to the effective date of such termination, which date shall be specified in such notice. Early
termination of the contract by the State may result in a refund to the Agency. Agency termination will
result in the forfeiture of fees paid through the end of contract agreement term.
12. Confidentiality and Access:
All agency systems and users are expected to protect DOJ's Law Enforcement Network and
associated information, in accordance with the Privacy Act and Trade Secrets Act (18 U.S. Code
1905), the Unauthorized Access Act (18 U.S. Code 2701 and 2710), the California Information
Practices Act of 1977 (Civil Code 1798), and the State Administrative Manual Chapter 5300 — 5365.3.
Page 5 of 5
Department of Justice (DOJ)
Miscellaneous Provisions
EXHIBIT D
MISCELLANEOUS PROVISIONS
1. Applicable Law:
Exhibit D
This contract shall be governed by and shall be interpreted in accordance with the laws of the State
of California; venue of any action brought with regard to this contract shall be in Sacramento
County, Sacramento, California.
2. Compliance with Statutes and Regulations:
a. The Stale and Agency warrants and certifies that in the performance of this contract, it will
comply with all applicable statutes, rules, regulations and orders stated in this contract. The
Agency agrees to indemnify the State against any loss, cost, damage or liability by reason of
the Agency violation of this provision.
b. The State will notify the Agency of any such claim in writing and tender the defense thereof
within a reasonable time; and
c. The Agency will have sole control of the defense of any action on such claim and all
negotiations for Its settlement or compromise; provided that (i) when substantial principles of
government or public law are involved, when litigation might create precedent affecting future
State operations or liability, or when involvement of the State is otherwise mandated by law,
the State may participate in such action at its own expense with respect to attorneys' fees
and costs (but not liability); (ii) where a settlement would impose liability on the State, affect
principles of California government or public law, or impact the authority of the State, the
State will have the right to approved or disapprove any settlement or compromise, which
approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably
cooperate in the defense and in any related settlement negotiations.
3. Termination for the Convenience of the State:
a. The State may terminate services under this contract for its convenience in whole or, from
time to time, in part, if the DOJ determines that a termination is in the State's interest. The
DOJ shall terminate by delivering to the Agency a Notice of Termination specifying the extent
of termination and the effective date thereof with at least (90) calendar days written notice
prior to the effective date of such termination, which shall be specified in such notice.
b. After receipt of a Notice of Termination, and except as directed by the State, the Agency shall
Immediately proceed with the following obligations, as applicable, regardless of any delay in
determining or adjusting any amounts due under this clause. The Agency shall:
— --i-Stop the use oPservices as specified-irf the Notice ofTerminatiori
ii. Place no further requests for materials, services, or facilities, except as necessary to
complete the continuing portion of the contract.
iii. Terminate all subcontracts to the extent they relate to the work terminated.
iv. Settle all outstanding liabilities or obligations by refund or forfeiture of fees paid as
stated in Section 11. Miscellaneous Provisions including Termination.
c. After termination, the Agency shall submit a final termination settlement proposal to the State
in the form and with the information prescribed by the State. The Agency shall submit the
Page 1 of 4
Department of Justice (DOJ)
Miscellaneous Provisions
Exhibit D
proposal promptly, but no later than 90 days after the effective date of termination, unless a
different time is provided in the Purpose or in the Notice of Termination.
d. The Agency and the State may agree upon the whole or any part of the amount to be
refunded as requested under subsection (c) above.
e. Unless otherwise set forth in the Purpose if the Agency and the State fail to agree on the
amount to be paid because of the termination for convenience, the State will pay the Agency
the following amounts; provided that in no event will total payments exceed the amount
payable to the Agency if the contract had been fully performed:
i. The contract price for Deliverables or services accepted or retained by the State and
not previously paid for, adjusted for any savings on freight and other charges; and
ii. The total of:
A. The reasonable costs incurred in the performance of the work terminated,
including initial costs and preparatory expenses allocable thereto, but
excluding any cost attributable to Deliverables or services paid or to be paid;
B. The reasonable cost of settling and paying termination settlement proposals
under terminated subcontracts that are property chargeable to the terminated
portion of the.conlract and
C. Reasonable storage, transportation, demobilization, unamortized overhead
and capital costs, and other costs reasonably incurred by the Agency in
winding down and terminating its work.
f. The Agency will use generally accepted accounting principles, or accounting principles
otherwise agreed to in writing by the parties, and sound business practices in determining all
costs claimed, agreed to, or determined under this clause.
4. Indemnification:
The Agency agrees to indemnify, defend and save harmless the State, its officers, agents and
employees from any and all third party claims, costs (including without limitation reasonable
attorneys' fees), and losses due to the injury or death of any individual, or the loss or damage to
any real or tangible personal property, resulting from the willful misconduct or negligent acts or
omissions of the Agency or any of its affiliates, agents, subcontractors, employees, suppliers, or
laborers furnishing or supplying work, services, materials, or supplies in connection with the
performance of this contract. Such defense and payment will be conditional upon the following:
a- The -State will -notify the -Agency of -any such claim in writing -and tender -the defense thereof- ---
within a reasonable time; and
b. The Agency will have sole control of the defense of any action on such claim and all
negotiations for its settlement or compromise; provided that (i) when substantial principles of
government or public law are involved, when litigation might create precedent affecting the
future State operations or liability, or when involvement of the State is otherwise mandated by
law, the State may participate in such action at its own expense with respect to attorneys'
fees and costs (but not liability; (ii) where a settlement would impose liability on the State,
affect principles of California government or public law, or impact the authority of the State,
the State will have the rights to approve or disapprove any settlement or compromise, which
Page 2 of 4
Department of Justice (DOJ)
Miscellaneous Provisions
Exhibit D
approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably
cooperate in the defense and in any related settlement negotiations.
5. Confidentiality of Data:
All financial, statistical, personal, technical and other data and information relating to the State's
operation which are designated confidential by the State and made available to the Agency in order
to carry out this contract, or which become available to the Agency in carrying out this contract,
shall be protected by the Agency from unauthorized use and disclosure through the observance of
the same or more effective procedural requirements as are applicable to the State. If the methods
and procedures ,employed by the Agency for the protection of the Agency data and information are
deemed by the State to be adequate for the protection of the State's confidential information, such
methods and procedures may be used, with the written consent of the State, to carry out the intent
of this paragraph. The Agency shall hot be required under the provisions of this paragraph to keep
confidential any data or information which is or becomes publicly available, is already rightfully in
the Agency's possession without obligation of confidentiality, is independently developed by the
Agency outside the scope of this contract, or is rightfully obtained from third parties.
6. News Releases:
Unless "otherwise exempted, news releases, endorsements, advertising, and social media content
pertaining to this contract shall not be made without prior written approval of the DOJ.
Contract Modification:
No amendment or variation of the terms of this contract shall be valid unless made in writing,
signed by the parties and approved as required. No oral understanding or agreement not
incorporated in the contract is binding on any of the parties.
8. Change Management Process:
Each agency agrees to notify the other agency in advance of any changes associated with this
contract, including technical or system changes, that will affect or impact either the business or
technical environment of either agency. This may include any scheduled maintenance periods, or
emergency maintenance; disconnection or suspension of the service by either agency party;
modifications to agreed upon configurations or outages.
Contacts for such notification are listed in the Responsible Parties section of the contract.
9. Rules of Behavior:
All agency systems_ and users are expected to protect DOJ's Law Enforcement Network and
McL t 10 V:JtiOge
1905), the Unauthorized Access Act (18 U.S. Code 2701 and 2710), the California Information
Practices Act of 1977 (Civil Code 1798), and the State Administrative Manual Chapter 5300 -
5365.3.
Page 3 of 4
Department of Justice (DOJ)
Miscellaneous Provisions Exhibit D
10. Issue Resolution Procedure:
If the Agency or DOJ has a concern regarding the services, deliverables, invoicing, or contract
terms and conditions which cannot be informally resolved, the Agency or DOJ will document their
concern and advise the responsible parties. Once an issue has been Identified, a meeting will take
place within thirty (30) calendar days, between the Agency and the DOJ to discuss and resolve the
issue. If an agreement cannot be reached, all information pertaining to the Issue shall be elevated
to the Executive Management of the Agency and DOJ.
Contacts for such notification are listed in the Responsible Parties section of the contract.
Agency and DOJ agree that they will continue to carry out all their contract responsibilities that are
not affected by the issue.
11. Disputes:
The parties shall deal in good faith and attempt to resolve potential disputes informally. If the
dispute persists, the Agency shall submit to the DOJ Division Chief or designee a written demand
for a final decision regarding the disposition of any dispute between the parties arising under,
related to or involving this contract. The, Agency's written demand shall be fully supported by factual
information, and if such demand involves a cost adjustment to the contract, the contract shall
include with the demand a written statement signed by an authorized person indicating that the
demand is made in good faith, that the supporting data are accurate and complete and that the
amount requested accurately reflects the contract adjustment for which the Agency believes the
State is liable, The DOJ Division Chief or designee shall have 30 days after receipt of the Agency's
written demand invoking this Section "Disputes" to render a written decision.
Page 4 of 4
Department of Justice (DOJ)
Breach Response
EXHIBIT E
BREACH RESPONSE
1. Discovery of Breach:
Exhibit E
Agency shall notify DOJ immediately by telephone call and email upon the discovery of any
breach of security of any systems and/or files containing classified criminal justice data (in
whatever form, paper or electronic) if the data involved was, or is reasonably believed to have
been acquired by an unauthorized person, or there is an intrusion, potential loss, actual loss, or
unauthorized use or disclosure of the data in violation of this contract, this provision, or applicable
state or federal law.
Notification shall be provided to the DOJ Program and Technical Manager, the DOJ Information
Security Officer and the DOJ Chief Information Officer. DOJ shall take:
Prompt corrective action to mitigate any risks or damages involved with the breach and to
protect the operating environment and
II. Any action pertaining to such unauthorized disclosure required by applicable Federal and
State laws and regulations.
2. Investigation of Breach:
Agency shall immediately investigate such security incident, breach, or unauthorized use or
disclosure of criminal justice data or any other confidential data. Within 24 hours of the discovery,
Agency shall notify the DOJ Program and Technical Manager, the DOJ Information Security
Officer and the DOJ Chief Information Officer of:
The data elements involved and the extent of the data involved in the breach,
II. A description of the unauthorized persons known or reasonably believed to have
improperly used or disclosed confidential data,
III. A description of where the confidential data is believed to have been improperly
transmitted, sent, or utilized,
IV. A description of the probable causes of the improper use or disclosure; and
V. Whether Civil Code sections 1798.29 or 1798.82 or any other federal or state laws
requiring individual notifications of breaches are triggered.
VI. Full, detailed corrective action plan, including information on measures that were taken to
halt and/or contain the Incident and/or Breach.
3. Written Report:
Agency shall provide a written report of the investigation to the DOJ Program and Technical
Manager, the DOJ Information Security Office and the DOJ Chief Information Officer within forty-
eight (48) hours of the discovery of the breach or unauthorized use or disclosure. The report shall
include, but not be limited to, the information specified above, as well as a full, detailed corrective
action plan, including information on measures that were taken to halt and/or contain the
improper use or disclosure.
Page 1 of 2
Department of Justice (DOJ)
Breach Response Exhibit E
A description of the unauthorized persons known or reasonably believed to have
improperly used or disclosed confidential data,
II. A description of where the confidential data is believed to have been improperly
transmitted, sent, or utilized,
III. A description of the probable causes of the improper use on disclosure; and
IV. Whether Civil Code sections 1798.28 or 1798.82 or any other federal or state laws
requiring individual notifications of breaches are triggered.
V. Full, detailed corrective iaction plan, including information on measures that were taken to
halt and/or contain the Incident and/or Breach.
Name, Title, Agency
Business Address
Email
Sonny Mangat, DOJ
4949 Broadway
Information Security
Sacramento, CA 95820
DOJISO@doj.ca.gov
Officer
Chris Cademarti,
Acting Chief/CIO
California Justice
Information Services
4949 Broadway
CIOApproval@doi.ca.gov
Division
Sacramento, CA 95820
Department of Justice
Page 2 of 2