AG 19-113 - Department of DOR WA State RETURN TO: T�>a-ri A A r m luEXT: Z 5 1
CITY OF FEDERAL WA AW DEPARTMENT ROUTING FORM
ORIGINATING DEPT./DIV: I
ORIGINATING STAFF PERSON: �p�_ _; EXT: 3. DATE REQ.BY:
TYPE OF DOCUMENT(CHECK ONE):
❑ CONTRACTOR SELECTION DOCUMENT(E.G.,RFB,RFP,RFQ)
❑ PUBLIC WORKS CONTRACT ❑ SMALL OR LIMITED PUBLIC WORKS CONTRACT
❑ PROFESSIONAL SERVICE AGREEMENT ❑ MAINTENANCE AGREEMENT
❑ GOODS AND SERVICE AGREEMENT ❑ HUMAN SERVICES/CDBG
❑ REAL ESTATE DOCUMENT ❑ SECURITY DOCUMENT(E.G.BOND RELATED DOCUMENTS)
❑ ORDINANCE ❑ RESOLUTION
• CONTRACT AMENDMENT(AG#): ❑ INTERLOCAL
OTHER GQ1A&SL
PROJECT NAME: 1705i-1440 b-1 Cr'Vt S Tk j Saro-u, S 4re04A k-
NAME OF CONTRACTOR:
ADDRESS: TELEPHONE
E-MAIL: FAX:
SIGNATURE NAME: TITLE
EXHIBITS AND ATTACHMENTS:❑ SCOPE,WORK OR SERVICES ❑ COMPENSATION ❑ INSURANCE REQUIREMENTS/CERTIFICATE ❑ ALL
OTHER REFERENCED EXHIBITS ❑ PROOF OF AUTHORITY TO SIGN ❑ REQUIRED LICENSES ❑ PRIOR CONTRACT/AMENDMENTS
TERM: COMMENCEMENT DATE: 1 el"" -� COMPLETION DATE:
TOTAL COMPENSATION$ (INCLUDE EXPENSES AND SALES TAX,IF ANY)
(IF CALCULATED ON HOURLY LABOR CHARGE—ATTACH SCHEDULES OF EMPLOYEES TITLES AND HOLIDAY RATES)
REIMBURSABLE EXPENSE:❑YES ❑NO IF YES,MAXIMUM DOLLAR AMOUNT: $
IS SALES TAX OWED ❑YES LINO IF YES,$ PAID BY:ElCONTRACTOR ElCITY
RETAINAGE: RETAINAGE AMOUNT: ElRETAINAGE AGREEMENT(SEE CONTRACT) OR ❑RETAINAGE BOND PROVIDE
❑ PURCHASING: PLEASE CHARGE TO:
0. DOCUMENT/CONTRACT REVIEW INITIAL/DATE REVIEWED INITIAL/DATE APPROVED
❑ PROJECT MANAGER
,;;?'IDIRECTOR �'x- %,9
❑ RISK MANAGEMENT (IF APPLICABLE)
❑ LAW
1. COUNCIL APPROVAL(IF APPLICABLE) SCHEDULED COMMITTEE DATE: COMMITTEE APPROVAL DATE: f I
SCHEDULED COUNCIL DATE: COUNCIL APPROVAL DATE: -7 P d
2. CONTRACT SIGNATURE ROUTING
❑ SENT TO VENDOR/CONTRACTOR DATE SENT: DATE REC'D:
ElATTACH: SIGNATURE AUTHORITY, INSURANCE CERTIFICATE,LICENSES,EXHIBITS
❑ CREATE ELECTRONIC REMINDER/NOTIFICATION FOR I MONTH PRIOR TO EXPIRATION DATE
(Include dept.support staff if necessary and feel free to set notification more than a month in advance if council approval is needed.)
INITIAL/DATE SIGNED
L PARTMENT
P'SIGNATORY(MAYOR OR DIRECTOR)
❑ CITY CLERK
❑ ASSIGNED AG# AG#
❑ SIGNED COPY RETURNED DATE SENT: `1
:OMMENTS:
t:C71i►j'�Ll.� aJ>
InmR
DOR Ccntract Number.K1765
BUSINESS LICENSING SERVICES AGREEMENT
I Parties and Contact lnfortnatrrrR
This Business Licensing Services Agreement("Agreement") is entered into between the parties identified
below:
State of Washington City of Federal Way
Department of DOR
Business Licensing Service
("Revenue) ("Partner)
Mailing PO Box 47475 33325 81"Avenue South
Address Olympia,WA 98504-7475 Federal Way,WA 98003
Delivery ,6500 Linderson Way,SW,Ste. 102 33325 891 Avenue South
Address Tumwaler,WA 98501 Federal Way,WA 98003
Contact Katie Early Ade'Ariwoola, MBA, CGFM
Person Phone: (360)705-6607 Finance Director
E-mail: KatieE@dor.wa gov Phone: (253)835-2520
Email:Ade.Ariwoola@cityoffederalway com
II PLL; ')!ue iJt1(]_�5 t�h i)fUUr'i;
The purpose of this Agreement is to establish the terms under which the Business Licensing Services
(BLS)program of the Department of Revenue will act as Partner's agent for the purpose of collecting,
processing,and disbursing information,licenses, and fees related to Partner's licensing or other
regulatory activities, hereafter referred to as Confidential Licensing Information Partner retains all power
and authority over its business licensing and other regulatory activities except as expressly delegated to
Revenue under this Agreement.
Per RCW 35.090.020(1)"a city that requires a general business license of any person that engages in
business activities within that city must partner with the department(Revenue)to have such license
issued,and renewed if the city requires renewal,through the business licensing service in accordance
with chapter 19.02 RCW."
III.Effective Date
This Agreement is effective as of(check one): ❑ (mm/dd/yyyy)
the date of the last signature Z of the parties.
IV Services Provided by Revenue
Revenue will perform the services identified in this Section IV using best efforts in a manner determined
by Revenue in good faith to be appropriate considering objectives,costs,and effectiveness.
• Distribute and process initial and renewal internet and/or paper-based applications for Partner's
business licensing and/or other regulatory activities.
Page 1 of 10
DOR Conlract Number K1765
• Collect and process license fees and licensing information received from applicants and
licensees. Disburse collected fees as directed by Partner
• Issue Business License with Partner's license endorsement as authorized by Partner.
Provide routine reports on Partner's business licenses as requested by Partner,which may
include daily lists of new business applications and renewals,fees processed each day,weekly
list of pending accounts, and lists of businesses for which fees have been transferred.
• Maintain electronic or microfilm images of all paper documents and electronic representations of
electronic filings received by Revenue from applicants and provide copies or certified copies as
requested.
• Maintain a database containing information received from applicants and licensees(the BLS
Database)
• Provide technical assistance to establish and configure appropriate BLS Database access and
secure access for Partner statf.
• Provide initial training to Partner staff in the use of the BLS Database,and ongoing training to
address changes to the BLS database/access protocols or in Partner staff. Training will occur at
Partner's location, over the telephone, or online, as agreed upon by the parties.
• Effect reasonable modifications in the BLS system,database, process,or forms to accommodate
Partner's licensing or other regulatory requirements. Revenue will consult with Partner in
evaluating alternatives and determining the most feasible and timely means of achieving Partner
objectives.
• Timely notify Partner of other modifications to the BLS system, database, process,or forms,
including modifications accommodating other BLS partners
V. Partner Obligations
• Timely provide Revenue with all information requested to implement Partner's participation in the
BLS program.
• Follow all requirements identified by Revenue as necessary for participation in the BLS program,
including using :
o The Business License Application and other forms and processes established by
Revenue;
o The"Business License"document for proof of licensure under Partner's licensing or
regulatory program.
o The Unified Business Identifier(UBI)number to identify licensees and license accounts in
all communications with Revenue.
• Obtain and maintain at its own cost, all necessary equipment and online services required at
Partner's business location(s)to support Partner's access into and use of the BLS Database.
End-to-end testing will take place until such time as Revenue is satisfied.
• Ensure Partner Licensing and Information Technology staff are available to respond promptly to
Revenue. Partner staff will be knowledgeable of Partner operations and/or technology and be
able to assist Revenue staff with process improvements and/or troubleshooting.
• Provide timely advance notice to Revenue of potential changes to Partner business licensing
requirements, fees or processes.
Page 2 of 1o
DCR C:u'itr_, lA cn r_r K'71-!)
• Upon request by Revenue, provide statistical data associated with the BLS Partner Partnership
Agreement such as Full Time Equivalent(FTE)savings, change in number of Partner licensees,
and change in revenue flow.
VI Compensation
Services identified in this Agreement are provided by Revenue at no charge with the exception of the
following:
• Partner shall reimburse Revenue the costs of developing and producing ad hoc informational
reports. Ad hoc reports will be created only if requested by the Partner and agreed-upon by
Revenue.
• Partner shall reimburse Revenue's expenses for the implementation of changes to the BLS
process, if requested by the Partner and agreed-upon by Revenue.
• All project coordination costs, including travel-related expenses, shall be absorbed by the
respective parties for their own staff.
Partner will provide and maintain with Revenue its current billing addresses and the personnel,if any,to
whom invoices should be directed. Revenue shall submit invoices to Partner as-needed, but in no event
more frequently than monthly. Partner shall pay all invoices by warrant or account transfer within thirty
(30) calendar days of the invoice issue date. Upon expiration or termination of this Agreement,any claim
for payment not already made shall be submitted within ninety(90)calendar days after the
expiration/termination date or the end of the fiscal year,whichever is earlier.
VIII. ConCidentialitV and Data Sharing
The parties agree to the confidentiality and data sharing provisions set forth in Exhibit A and incorporated
herein by this reference.
IX.Term and Termination
This agreement is effective until terminated. Either party may terminate this Agreement upon ninety(90)
calendar days'prior written notice to the other party.This agreement may also be amended by mutual
written agreement of both parties.
X. Disputes
The parties agree to participate in good faith mediation to resolve any disputes that are not otherwise
resolved by agreement,prior to any action in court or by arbitration. At any time,either party may initiate
formal mediation by providing written request to the other party setting forth a brief description of the
dispute and a proposed mediator. If the parties cannot agree upon a mediator within fifteen (15)calendar
days after receipt of the written request for mediation, the parties shall use a mediation service that
selects the mediator for the parties. Each party shall be responsible for one-half of the mediation fees, if
any, and its own costs and attomeys'fees.
Page 3 of 10
DOR Contract Number Ki 765
XI. Miscellaneous
A. Governing Law and Venue. This Agreement shall be governed by the laws of the State of
Washington.Any action arising out of this Agreement must be commenced in Thurston County,
Washington
B. Interpretation. This Agreement shall be interpreted to the extent possible in a manner consistent
with all applicable laws and not strictly for or against either party.
C. No Waiver. The failure of either party to enforce any term in any one or more instance will not be
construed as a waiver or otherwise affect any future right to insist upon strict performance of the
term. No waiver of any term of this Agreement shall be effective unless made in writing and
signed by personnel authorized to bind the party against whom enforcement is sought.
D_ Assignment and Delegation. Either party may assign any right or interest,or delegate any duty or
obligation, arising under this Agreement upon thirty(30)days written notice to the other party.
E. Severability. If any provision of this Agreement is held invalid by a court of competent jurisdiction,
the remaining provisions of this Agreement shall be given effect to the extent consistent with
applicable law and the fundamental purpose of this Agreement.
F. Survival. Terms of this Agreement which by their nature would continue beyond termination will
survive termination of this Agreement for any reason,including without limitation, Sections 3
through 7 in Exhibit A.
G. No third party beneficiaries. This Agreement is for the benefit of the parties and their successors
and may not be enforced by any non-party.
H. Amendments. No amendment to this Agreement is enforceable unless made in uniting and
signed by personnel authorized to bind the party against whom enforcement is sought.
I. Merger and integration. This Agreement contains all the terms and conditions agreed upon by
the parties.-No_other_understandings,_oral_or otherwise,-regarding the subject matter of this
Agreement shall be deemed to exist or to bind any of the parties.
J. Changes in law. The provisions of this Agreement shall be deemed to change in a manner that is
consistent with any changes to any directly applicable statutory authority,provided that the
change is consistent with the manifest intent of this Agreement and does not conflict with any of
its express provisions. Any such change to this Agreement shall be effective on the effective date
of the change in authority.
Page 4 of 10
DOR Contract Number:K1765
IN WITNESS WHEREOF,this Agreement is executed effective as of the date specified above
State of Washington Partner
Department of Revenue
Business Licensing Services
Date Date +'
Template approved as to form Approved as to form
On File 4 `
Kelly Owings,
Assistant Attorney General for Washington State Gln A-M4*
Date
t
Page 5 of 10
DOR Contract Number K1765
EXHIBIT A
CONFIDENTIALITY AND DATA SHARING
AGREEMENT
I. Purpose and Scope
The following provisions establish the terms under which the Department of Revenue("Revenue") and
Partner wili snare confidentiai data pursuant to the Business Licensing Services Agreement(the
"Agreement")_
II. Definitions
A. "Confidential Licensing Information"(CLI) has the same meaning as"Licensing Information"
under Revised Code of Washington (RCW) 19.02.115(1)(b).CLI is classified as at least Category
3 data under Washington's Standard for Securing Information Technology Assets, Office of the
Chief Information Officer(OCIO)Standard No. 141.10.
B. "Confidential Tax Information"(CTI) has the same meaning as"Return,""Tax Information,"and
"Taxpayer Identity' under.RCW 82.32.330(b), (c), &(e). CTI is classified as at least-Category 3
data under Washington's Standard for Securing Information Technology Assets, OCIO Standard
No. 141.10.
C. "Confidential"refers to data classified as at least Category 3 data under Washington's Standard
for Securing Information Technology Assets, OCIO Standard No. 141.10.
D "Portable Devices"refers to small portable computing devices. Examples of portable devices
include,but are not limited to handhelds/PDAs, Ultramobile PCs,flash memory devices(e.g.,
USB flash drives, personal media players), portable hard disks,and laptop/notebook computers.
E. "Portable Media"refers to small portable digital storage media. Examples of portable media
include, but are not limited to optical media(e.g.,CDs, DVDs, Blu-Rays), magnetic media(e.g.,
floppy disks, tape,Zip or Jaz disks), or flash media(e.g., CompactFlash, SD, MMC).
F. "Data"refers to individual pieces of information.
G. "Cloud"refers to a non-Partner data center(s)offering infrastructure,operating system platform,
or software services. A more complete definition of"cloud"can be found in the National Institute
of Standards(NIST) Special Publication 800-145.
H "Encryption"refers to enciphering data with a NIST-approved algorithm or cryptographic module
using a NIST-approved key length.
I. "Complex Password"or"Complex Passphrase°refers to a secret phrase,string of characters,
numbers, or symbols used for authentication that is not easily guessable and meets an
established industry guideline for complexity and length,such as NIST Special Publication 800-
118,
III.Data Classification,Authorized Use,Access,and Disclosure
A. Data Classification: Data shared under this Agreement is considered confidential and classified
as at least Category 3 data under Washington's Standard for Securing Information Technology
Assets, OCIO Standard No. 141 10.
B. Permitted Uses: Business licensing information may be used for official purposes only.
C. Permitted Access: Business licensing information may be accessed only by Partner's employees
and agents that have a bona fide need to access such information in carrying out their official
duties.
D. Permitted Disclosure: Business licensing information received under the Agreement must not be
disclosed to non-parties unless the disclosure is:
1) Ordered under any judicial or administrative proceeding;or
2) OtherMse expressly authorized by Revenue in writing.
Page 6 of 1 U
DOR Contract NumLer K 1705
IV. Confidentiality
Partner and Revenue each agree to keep confidential and secure from unauthorized use, access, or
disclosure all confidential data received under the Agreement.
A. Ensuring Security: Partner shall establish and implement physical, electronic, and managerial
policies, procedures, and safeguards to ensure that all confidential data exchanged under this
Agreement is secure from unauthorized use, access, or disclosure
B. Proof of Security. Revenue reserves the right to monitor, audit, or investigate Partner's security
policies, procedures, and safeguards for confidential data. Partner agrees to provide information
or proof of its security policies, procedures, and safeguards as reasonably requested by
Revenue.
V. Statutory Prohibition Against Disclosure; Confidentiality Agreement
A. Criminal Sanctions. RCW 19.02.115(2)prohibits the disclosure of Confidential Licensing
Information, except as expressly authorized under RCW 19.02.115(3). RCW 82 32 330(2)
prohibits the disclosure of Confidential Tax Information except as expressly authorized under
RCW 82 32.330(3). It is a misdemeanor for any person acquiring Confidential Licensing
Information or Confidential Tax Information under this Agreement to disclose such information in
violation of the disclosure limitations stated in RCW 19.02 115 and RCW 82.32 330. Partner will
require employees with access to Confidential Licensing Information and/or Confidential Tax
Information to sign a copy of the confidentiality agreement attached at Exhibit C.
VI. Breach of Confidentiality
In the event of any use, access, or disclosure of confidential data by Partner,or its employees or agents
in material violation of the terms of this Agreement:
A. Partner shall notify Revenue in writing as soon as practicable,but no later than three working
days,after determining that a violation has occurred.
B. Revenue may immediately terminate this Agreement and require the certified return or
destruction of all records containing confidential data received under the Agreement.
VIII. Data Security
Confidential data provided by Revenue shall be stored in a secure physical location and on Partner-
owned devices with access limited to the least number of staff needed to complete the purpose of this
Agreement.
A. Partner agrees to store data only on one or more of the following media and protect the data as
described:
1) Workstation hard disk drives
a) Access to the data stored on local workstation hard disk drives will be restricted to
authorized users by requiring logon to the local workstation using a unique user ID and
complex password, passphrase, or other authentication mechanisms which provide equal
or greater security,such as biometrics or smart cards.
b) If the workstation is not located in a secure physical location, hard drive must be
encrypted.
c) Workstations must be maintained with current anti-malware or anti-virus software.
d) Software and operating system security patches on workstations must be kept current.
Page 7 of 10
DOR Contract Number K1765
2) Network servers
a) Access to data stored on hard disks mounted on network servers and made available
through shared folders will be restricted to authorized users through the use of access
control lists,which will grant access only after the authorized user has authenticated to
the network using a unique user ID and complex password,passphrase,or other
authentication mechanisms that provide equal or greater security,such as biometrics or
smart cards.
b) Data on disks mounted to such servers must be located in a secure physical location.
c) Senyers must be maintained with current anti-malware or anti-virus software.
d) Software and operating system security patches on servers must be kept current.
3) Backup tapes or backup media
a) Partner may archive Revenue data for disaster recovery(DR)or data recovery purposes.
b) Backup devices, tapes, or media must be kept in a secure physical location.
c) Backup tapes and media must be encrypted.
d) When being transported outside of a secure physical location,tapes or media must be
under the physical control of Partner staff with authorization to access the data or under
the physical control of a secure courier contracted by Partner for transportation purposes.
4) Cloud Storage
a) Revenue will meet cloud and data requirements in Washington's Standard for Securing
Information Technology Assets,OCIO Standard 141.10.
b) Revenue and Partner will, at a minimum, meet the following requirements:
i. Encrypt the data at rest and in transit.
ii. Control access to the cloud environment with a unique user ID and complex password,
passphrase, or stronger authentication method such as a physical token or biometrics.
iii. Cloud provider data center(s)and systems must be Service Organization Control
(SOC)2 Type II certified.
5) All data provided by Revenue shall be stored on a secure environment by city staff.The City
will implement these policies to ensure this security:
a) Staff will not store or place any Revenue material on any portable devices or portable
media (USB devices, CU/DVD,etc.).
b) Staff will not email information provided by Revenue to anyone outside of City staff.
c)_ Staff shall-only access-Revenue information on a City network computer.
d) Staff will not save any Revenue reports or data on the hard drive of any City
computer. It shall only be stored on a City network.
B. Protection of Data in Transit
Partner agrees that any retransmission of Revenue data over a network, other than the Partner's
internal business network will be encrypted.
Page 8 of 10
DOR Conlrac:NL]Mhe K1 7G),,
IX. Data Segregation
Revenue data must be segregated or otherwise distinguishable from non-Revenue data This is to ensure
that if the data is breached through unauthorized access it can be reported to Revenue and when the
data is no longer needed by Partner, all Revenue data can be identified for return or destruction
X.Data Breach Notification
If Partner or its agents detect a compromise or potential compromise in the data security for Revenue
data such that data may have been accessed or disclosed without proper authorization, Partner shall give
notice to Revenue within one(1)business day of discovering the compromise or potential compromise.
Partner shall take corrective action as soon as practicable to eliminate the cause of the breach and shall
be responsible for ensuring that appropriate notice is made to those individuals whose personal
information may have been improperly accessed or disclosed. At a minimum, notification to Revenue will
include:
A. The date and time of the event;
B. A description of the Revenue data involved in the event; and
C Corrective actions the Partner is taking to prevent further compromise of data,
XI. Disposition of Data
A. Records furnished to the Partner in any medium remain the property of Revenue
B. Revenue data no longer needed by the Partner must be disposed of following the data
destruction procedures in this Agreement
C. Upon the destruction of Revenue data,the partner shall complete a Certification of Data
Disposition (attached to this Agreement as Exhibit B), and submit it to the Contract Manager
within 15 days of the date of disposal
XII. Data Destruction Procedures
The following are acceptable destruction methods for various types of media At least one method
defined under the various types of media must be used to destroy Revenue data for that media type.
A Optical discs
1) Incinerate the disc(s);or
2) Shred the discs.
B. Magnetic tape(s)
1) Degauss;
2) Incinerate; or
3) Crosscut shredding
C. Digital files on server or workstation hard drives or similar media
1) For mechanical hard drives, use a"wipe"utility which will overwrite the data at least 3 times
using either random or single character data;
2) For solid state hard drives, use a"secure erase"utility that resets all cells to zero;
3) Degauss sufficiently to ensure that the data cannot be reconstructed; or
4) Physically destroy disk(s)
Page 9 of 10
DOR Contract Number K1765
D. Portable media
1) For mechanical hard drives,use a'wipe"utility which will overwrite the data at least 3times
using either random or single character data;
2) For solid state hard drives and devices, use a"secure erase'utility that resets all cells to
zero;
3) Degauss sufficiently to ensure that the data cannot be reconstructed;
d) Physically destroying disk(s)or devices;or
5) For SmartPhones and similar small portable devices use one of the following:
a) If the devices are encrypted and secured with a complex password,the data is
considered destroyed. Before disposal or reissuance of the device,make sure the data
is encrypted and then reset the device to original or new condition;or
b) If a Mobile Device Management(MDM)solution for the device exists, enable the remote
wipe command to destroy the data.
E. Cloud Storage
Use the cloud provider's procedures to permanently delete the files and folders.
'"*'end**'
Page 10 of 10