Washington State Department of Licensing (DOL) 5/16/2024

Attachment E - Audit and Annual Internal Assessment AUDITS Licensee shall obtain Permissible Use and Data Security audits as required by RCW 46.12.630 and this Agreement. Data Security audits must demonstrate compliance with Data Security standards adopted by the Washington State Office of the Chief Information Officer (OCIO), and as set forth in Attachment B - Data Security Requirements. At a minimum, audit(s) must determine whether Data Security policies, procedures, and controls are in place to ensure compliance with all Data Security Requirements set forth herein, and as required by state and federal law. Permissible Use Audits must demonstrate compliance with Permissible Use standards as set forth on Attachment D – Permissible Use Requirements. Audit(s) must determine whether Permissible Use policies, procedures, and controls are in place to ensure compliance with all Permissible Use requirements in this Agreement. DOL will accept all audits that are in compliance with RCW 46.12.630. A. Timing of Audit(s): Licensee must submit a Data Security audit and provide DOL with the complete audit report prior to commencing its Access Period and receiving any Data under this License. If Licensee does not provide a complete audit report within six (6) months of the execution date of this Agreement, then this Agreement will be automatically terminated without further notice. DOL may allow more than six (6) months to provide a complete audit report through written notice if a request is received from Licensee prior to the end of the six (6) month period. Any extension issued under the provisions of this paragraph is subject to Licensee demonstrating substantial progress toward completing an audit report. B. Selection of Auditor: The Data Security audit must be performed by an independent third-party auditor. Licensee may select the auditor, providing that at a minimum the auditor meets one of the following certifications: American Institute of Certified Public Accountants’ (AICPA), Certified Information Privacy Professional (CIPP), ANSI-ASQ National Accreditation Board (ANAB) or other nationally recognized certification. Alternatively, if the Licensee chooses not to select its own auditor, or if DOL does not accept the audit, DOL will then select the auditor on the Licensee’s behalf. If DOL selects the auditor, Licensee must hold DOL and its selected auditor harmless from any real or perceived damages to the Licensee’s company as a result of the audit findings. Licensee has the option to collaborate with DOL in advance to develop the specifics for the scope of an audit, and to predetermine whether an auditor selected by the Licensee meets the standards necessary for DOL’s approval. The Permissible Use and all contract compliance audits will be performed by DOL or its designated agent. C. Cost of Audit: Licensee will be responsible for all costs associated with the audits. If DOL selects the auditor, Licensee will prepay the estimated audit costs. If the actual costs of the audit differ in amount from the estimate, DOL will reimburse or invoice Licensee the difference; final payment must be made within thirty (30) days of receiving the final invoice. D. Corrective Action Plans: Corrective actions plans are required for all deficiencies identified in an audit. DOL has sole discretion on whether such deficiencies should prohibit Licensee’s access to Data. If DOL agrees to maintain access to Data, such access is contingent on the following: • Within a timeframe established by DOL, Licensee must submit a corrective action plan for each deficiency identified by the audit. For each deficiency, the corrective action plan must outline the steps to be taken to correct the deficiency, and a timeline for completing all corrective steps. • DOL will determine whether Licensee is substantially complying with the corrective action plan. If Licensee is not in substantial compliance, then DOL may suspend access to the Data or take other actions as allowed in this Agreement.