AMENDMENT #47 T-437A 06-X COPIER HARD DRIVE SECURITY -AGENCY RESPONSIBILITIES AND PROCEDURES -CONTRACTOR OPTIONS AND PRICING INFORMATION

Transcription

1 State of New Jersey DEPARTMENT OF THE TREASURY CHRIS CHRISTIE DIVISION OF PURCHASE AND PROPERTY ANDREW P. SIDAMON-ERISTOFF Governor PURCHASE BUREAU State Treasurer P. O. BOX 230 KIM GUADAGNO Trenton, New Jersey Lt. Governor AMENDMENT #47 T-437A 06-X COPIER HARD DRIVE SECURITY -AGENCY RESPONSIBILITIES AND PROCEDURES -CONTRACTOR OPTIONS AND PRICING INFORMATION TO: All State Agencies and Political Subdivisions DATE: 10/20/10 FROM: Alan Krupa, Senior Buyer Purchase Bureau SUBJECT: Copiers, Digital, Laser, Multi-Function and Copy Center Cost Per Copy ORIGINAL CONTRACT PERIOD: 01/01/06-12/31/07 (2 YEARS) 1st EXTENSION: 01/01/08-12/31/08 (1 YEAR) 2 ND EXTENSION: 01/01/09 06/30/09 (6 MONTHS) 3 RD EXTENSION: 07/01/09 12/31/09 (6 MONTHS) 4 TH EXTENSION: 01/01/10 06/30/10 (6 MONTHS) 5 TH EXTENSION: 07/01/10 12/31/10 (6 MONTHS) The Cost Per Copy (CPC)contract is a rental agreement with the Contractor. The Contractor owns the copier and all accessories. The Using Agency is responsible for the electronic data contained on a CPC rental. The information and pricing contained in this Amendment #47 is provided as a source for ensuring data is secure at the time of retiring a machine and, if desired, while a machine is in use. If an Agency is holding a machine(s) because of the recent Purchase Bureau directive dated July 20, 2010, this Amendment supersedes that directive concerning T-437A rentals and Agencies can proceed with the process of securing data and returning machines to the Contractor. New Jersey Is An Equal Opportunity Employer Printed on Recycled Paper and Recyclable 1 of 45

2 July 20, 2010 directive from the Purchase Bureau: Effective immediately, and until further notice, all CPU s, laptops, servers or any other devices with image/data storage capabilities cannot be surplused, destroyed, or otherwise transferred out of your Department, Agency or Commission. Any equipment under this category must be securely held on location pending forthcoming guidance. This includes copiers and multi-function devices that include a hard drive. Please forward this notice to all IT personnel under your jurisdiction, and to any other personnel involved in the storage, handling, transfer, transportation or disposal aspect of these types of assets. Guy Bocage Acting Director NJ Purchase Bureau In this Amendment, options are provided by Contractors for such things as hard drive removal, deletion, encryption and overwriting. It is the responsibility of the Using Agency to ensure electronic data contained on copiers is secure. Refer to State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT) A price line will be added to each contract that must be used for any applicable hard drive security charges. Users should request written quotations for their files. The new contract line can be identified by the words Hard Drive Security in the line description. Refer to the applicable supplemental attachment for Amendment 47 for each respective contractor. Current Contractors #64038 Oce Imagistics #64039 Ikon Office Solutions #64040 Sharp Electronics #64041 Stewart Business Systems #64042 Xerox Corporation #64043 Lanier Worldwide Inc. #64044 Konica Minolta #64045 Canon USA Inc. #64046 Canon Business Solutions Inc. #64047 Oce North America Inc. #64048 Kyocera Mita America Inc. #65260 Image Systems For Business Hard Drive Security options will be included in any future contracts that have yet to be awarded. Please keep this amendment with your copy of the Notice of Award for future reference. PB 04/13/17 2 of 45

3 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 CANON BUSINESS SOLUTIONS INC. #64046 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 3 of 45

4 4 of 45

5 5 of 45

6 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 CANON USA #64045 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 6 of 45

7 7 of 45

8 8 of 45

9 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 IKON CONTRACT #64039 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 9 of 45

10 Joseph Archut Government and Education Team Manager IKON Office Solutions, Inc. Suite # 500, 640 Freedom Business Center King of Prussia, PA jarchut@ikon.com July 8, 2010 Re: NJ Contract (T437A, T437C and T2075) Hard Drive Security Issue Alan Krupa State of NJ, Department of the Treasury Division of Purchase and Property 33 West State Street Trenton, NJ Dear Mr. Krupa, This letter is in response to your request for information dated 7/27/2010 relative to copier hard drives for copiers placed against any of these contracts. For currently placed models that have hard drives and for units obtained in the future we offer a hard drive overwrite or removal at the end of the term. The removed hard drive would be turned over to the agency or Poli-Sub for destruction. The removal is the surest way to guarantee the destruction of any confidential material stored on these hard drives. The cost for this removal is: IKON is willing to do this for no additional charge for any agency replacing a current IKON copier with a new IKON copier. If the Agency or Poli-Sub is at the end of their contract term and are not replacing the copier with another copier from IKON we will perform this service for a reduced charge of $ per system. For new equipment orders; agencies and Poli-Subs can choose to elect the Hard Drive Removal at the end of the term or they may choose to: Add an optional Security System for on the fly overwriting of the hard drive. This would be a good option for new units because it not only solves the end of term issue but adds an extra layer of security as the hard drive could never be read even if stolen or somehow compromised prior to the end of term. IKON would provide this option for new placements for an additional $4.84 per month on top of the current monthly base charge. IKON is offering these options for all copier placement scenarios and placement methods. If you have any questions, please do not hesitate to call. Sincerely, Joseph Archut Joseph Archut Government Team Manager 10 of 45

11 Hard Drive Removal: This is the surest and least expensive method of guaranteeing the safety of confidential material already stored on the hard drives of existing copiers in the field. An IKON Technician will remove the existing copier hard drive and turn it over to the state agency for destruction along with the destruction of other computer hard drives. Once returned to the IKON warehouse IKON will install a new hard drive in the used equipment. Once the hard drive is removed the copier will not function thus further guaranteeing confidentiality is protected. The hard drive removal will need to be coordinated closely to the delivery of the new copier. End of Term Hard Drive Overwrite: For some copiers in the field IKON can send a technician to overwrite the data at the end of the contract term. This is generally a one pass overwrite and will make information recovery by most data recovery companies practically impossible. It is believed (but widely debated) in the industry that a single pass with zeroes doesn t completely erase magnetic artifacts from a disk, and therefore is still possible to recover the data from the drive. This type of recovery would require the use of specialized and very expensive equipment like an electron microscope, and significant technical knowledge. Once the data is overwritten, the copier must be shutdown to prevent further use to make sure confidential material is not added to the hard drive prior to pick up. Ongoing Overwrite and Encryption: For new placements IKON recommends state agencies consider adding an optional Data Overwrite Security System. Ricoh s Data Overwrite Security System destroys latent digital images stored on the MFP s hard drive by writing over the image with random sequences of 1 s and 0 s. A simple display panel icon provides visual feedback regarding the overwrite process, e.g., completed or in-process. The three pass data overwrite process makes any effort to access and reconstruct stored print/copy files virtually impossible and conforms to National Security Agency recommended methods of managing classified information. They are certified to an EAL of of 45

12 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 KONICA MINOLTA #64044 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 12 of 45

13 Konica Minolta bizhub Hard Drive Security Konica Minolta bizhub MFP s have built in Hard Disk Drive security. Once a print is finished, the information is immediately and automatically erased from the HDD and RAM memory. Other built in security features include: HDD Auto Deletion- The copier can be set to erase all information on the HDD after preselected tiime intervals. In this scenario, all user boxes will also be erased. Hard Drive Overwrite- This is the most widely used method of HDD security. The Konica Minolta bizhub devices can be set to overwrite erased data up to 8 times, 4X more than what is required by the National Security Agency. The instructions for turning this on can be found in the operator s manual. HDD Password Protection- When enabled through the adminstrator s functions, a 20 digit alphanumeric password is set for the HDD. Once set, if the hard drive is removed from the machine it will no longer work. The instructions for turning this on can be found in the operator s manual. Konica Minolta also has a HDD encryption kit available if there is concern that the HDD may be hacked while on the network. This encryption kit can be purchased for about $250 (depending on model). Konica Minolta can wipe the HDD for you for a flat fee of $275. If the end user would like to keep the HDD at the end of service or when moving the machine to another location, Konica Minolta will provide a price on a case by case basis. Konica Minolta Business Solutions USA, Inc Washington Blvd., Suite 450 Arlington, VA of 45

14 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 IMAGE SYSTEMS FOR BUSINESS #65260 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 14 of 45

15 15 of 45

16 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 OCE IMAGISTICS #64038 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 16 of 45

17 Océ North America Policy on Customer Data Security for Returned Equipment Océ North America ( Océ ) 100 Oakview Drive Trumbull, CT The purpose of Océ North America Policy on Customer Data Security for Returned Equipment ( Policy ) is to describe for the customer the options that are currently available for securing customer s data on any Océ equipment that 1) contains a hard disk drive and 2) is returned to Océ. It is the responsibility of the customer to ensure that customer s data is handled in accordance with customer s requirements and/or internal policies and procedures prior to pick-up and return of any Océ equipment containing a hard disk drive. Océ shall not be liable for the release or disclosure of, or failure to destroy, customer data that has not been handled in accordance with this Policy or customer s own standard practices and/or internal policies for handling such data. In connection with office printing equipment: To protect the security of Customer data upon pickup and return of Océ equipment with hard disk drives to Océ, the Customer must exercise one of the following three Options: 1. Customers that have purchased security software/hardware, or units that contain any of the following can manage their own data needs: Deletion The hard disk drive directory is deleted making data unrecoverable by any users through the devices control panel, however if the hard drive is removed from the unit, 3rd party recovery software could be used to reconstruct the data. Encryption - End user data is secured against unauthorized viewing through the device control panel, or if the drive is removed. The encryption key password must be activated and not be released by the Customer to insure data integrity. Overwrite - Data is overwritten a minimum of 3 times to insure the data is unrecoverable from the device control panel, or if the drive is removed. The above will enable the Customer to determine the level of security required without intervention from Océ, and to complete sanitization of data prior to pick-up. The procedures should be outlined in the applicable User Manual, and if not, please contact your sales representative. If not included in the original sale, Customers may purchase available security software/hardware for their own use at an additional charge. 2. Customers that have purchased, or will purchase, available security software/hardware, or units that contain hard disk drive Deletion, Encryption or Océ HD Data Security Policy Rev. 6/3/ of 45

18 Overwrite capabilities and require that an Océ technician complete the procedure at the Customer s location can schedule a specific service call before the equipment is returned. There is an additional charge for this service. 3. Customers that require removal and retention of the hard disk drives by an Océ technician can schedule a specific service call before the equipment is returned. There is an additional charge for this service. To support Customer requirements, Océ offers the above options. Unless Customer properly uses an Océ provided Overwrite capability as set forth in Option 1 (if available); requests the Overwrite capability in Option 2 (if available), or requests Option 3, Océ makes no representation as to the destruction of Customer data on returned equipment; and Océ shall not be liable for the release or disclosure of, or failure to destroy, Customer data. In connection with production printing equipment: The following option is available to Océ customers in order to protect the security of customer data that may be located on the hard disk drive of any Océ production printing equipment that has been returned to Océ: For production printing equipment customers, at the time that customer informs Océ that the equipment will be returned to Océ and if customer is concerned about sensitive data on the original hard disk, it is the customer s responsibility to purchase from Océ a replacement hard drive for the Océ equipment. At the time of de-installation, the original hard disk will be removed from the Océ equipment and given to the customer. It is the customer s responsibility to dispose of the original hard drive according to customer s internal policies and procedures governing such disposal. In connection with wide format printing equipment: As a standard practice, Océ electronically cleans all images located on the hard disk drives of returned wide format equipment. Océ also strongly recommends that customers scrub data from the hard disk of all equipment prior to the equipment leaving the customer site as Océ does not accept any responsibility for the security of data remaining on the equipment. Océ offers the following options for customers wishing to protect the security of data on hard disk drives prior to releasing the equipment from the customer site: 1. Customer may purchase from Océ a removable hard drive that has dual images from Océ. The standard image is in the printer at all times and only removed when necessary to print all sensitive data (which is stored on the second hard drive). Hard drives are changed as needed. The standard image is returned to Océ with the Océ Océ HD Data Security Policy Rev. 6/3/ of 45

19 equipment, and the customer retains the removable hard drive containing the sensitive data. 2. Customer may purchase an Océ Power Logic controller with the electronic shredding option. Océ HD Data Security Policy Rev. 6/3/ of 45

20 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 KYOCERA MITA AMERICA INC. #64048 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 20 of 45

21 KYOCERA MITA AMERICA, INC. 225 SAND ROAD, P.O. BOX FAIRFIELD, NEW JERSEY (973) Kyocera National and Government Accounts In recent weeks, news reports about Multifunctional Products (MFPs) and data security have prompted customers to ask questions regarding the security of their document imaging devices. The information in this document is for Kyocera National and Government Account Customers and pertains to Kyocera MFPs and Printers that have Hard Disk Drives (HDD) installed. The disk drives in these products are similar to the HDDs found in personal computers which retain certain processed data. If a model does not have an HDD, customer document data (not device information) is cleared from memory when the device is turned off. Kyocera Mita America is committed to delivering the most reliable and secure MFPs and Printers for our customers, and recognizes the importance of data security. Security initiatives and risk management for any organization can be unique, and depending on customer requirements, a number of alternatives exist to assist in meeting compliance and organizational objectives. I. Hard Disk Drive Reformat MFP/Printer End of Life Options The least costly alternative for any National and Government Account Customer is the Hard Disk Drive Reformat capability that is standard on all HDD-equipped MFPs and Printers. This alternative is ideal for customers with low-priority security issues based on their daily workflow, however, this option should not be considered an absolute data recovery deterrent. The following alternatives and the required steps explain how this can be accomplished. A. HDD Reformat by Customer (must be at the device) 1. Customer calls the Kyocera Hotline at to speak to an authorized technician. 2. Report the model and serial number to technician. 3. While at the device, the technician will walk caller through the necessary steps to reformat the HDD. 4. The procedure could take approximately 40 minutes, depending on the amount of data stored on the HDD. 5. At the end of the procedure, a message will appear on-screen that the reformat is complete. 6. Device should be taken out of service and officially retired. Continued use of the device after the reformat procedure will require the reformat procedure to be repeated. 21 of 45

22 B. HDD Reformat by Authorized Dealer 1. Customer will contact their Kyocera National or Government Account Manager (NAM/GAM). 2. NAM/GAM will coordinate service call for HDD Reformat with authorized servicing dealer. 3. Dealer will contact customer to set appointment. 4. A fee of $ (per device) will be charged for this service. II. Hard Disk Drive Remove and Replace For some National and Government Account Customers, a stronger deterrent and means to protect data may be required. For these organizations, at the end of product life, an authorized servicing dealer can remove the HDD from the device at the customer s location and replace it with a new HDD. A. Remove and Replace HDD by Dealer 1. Customer will contact Kyocera NAM/GAM to place order for removal and replacement of the HDD. 2. NAM/GAM will coordinate service call for Hard Disk Drive Remove and Replace with authorized servicing dealer. 3. Dealer will contact customer to set appointment. 4. A fee of $ per device will be charged for the service call, plus the cost of a hard drive (see attached). 5. During the service call, the existing HDD will be removed and given to the customer, and a new HDD will be installed. 6. The HDD removed belongs to the customer at that point, and it is the customer s responsibility to take care of it according to their own security guidelines. 7. The device is taken out of service and officially retired. Continued use after this procedure is at the customer s liability and responsibility. Any deviation from this plan and procedure is not recommended by Kyocera and is at the customer s responsibility. MFP/Printer Current Installation Options III. Addition of a Data Security Kit Kyocera Mita offers optional Data Security Kits for HDD-equipped MFPs and Printers for enhanced security for all National and Government Accounts. All Kyocera data security kits include a 3x overwrite feature; and once installed, the overwrite procedure occurs after the completion of any print, scan, copy or fax job. This procedure is accomplished on the drive sector used for data processing. During this process, data is overwritten and destroyed to prevent recovery and breach. In automatic mode, customer interaction is not required. 22 of 45

23 23 of 45

24 June 18, 2010 Hard Drive/Data Security Kit Pricing MODELS SUGGESTED HDD / DATA AND RETAIL SECURITY KIT ACCESSORIES DESCRIPTION PRICE PRICING TASKalfa P.P.M. Digital Copier with standard 300 sheet paper drawer HD-5A 40.0 GB Hard Disk Drive Unit for Printer $ $ 194 TASKalfa P.P.M. Digital Copier with standard 300 x 2 sheet paper drawers HD-5A 40.0 GB Hard Disk Drive Unit for Printer $ $ 194 STRATOS KM C.P.M. Digital Copier with duplexing (Std. Print/Scan/Copy) Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 7NH3M080G002H01 (1) 80GB HDD $ 383 KM C.P.M. Digital Copier with duplexing (Std.Copy) HD-ME GB Hard Disk Drive Unit for Printer $ $ 277 KM C.P.M. Digital Copier with duplexing (Std. Print/Scan/Copy) Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 7NH3M080G002H01 (1) 80GB HDD $ 383 TASKalfa 300i 30 PPM Monochrome MFP Data Security Kit E HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 302K (1) 160GB HDD $ 231 KM-2530/3530/ /35/40 C.P.M. Digital Copier HD-ME GB HDD for Printer $ $ 277 KM C.P.M. Digital Copier HD-ME GB HDD for Printer $ $ 277 KM C.P.M. Digital Copier HD-ME GB HDD for Printer $ $ 277 FALCON 2's KM C.P.M. Digital Copier with duplexing HD-70 HDD for Copier $ $ 202 HD-ME GB Hard Disk Drive Unit $ $ 277 KM C.P.M. Digital Copier with duplexing HD-70 HDD for Copier $ $ 202 HD-ME GB Hard Disk Drive Unit $ $ 277 KM C.P.M. Digital Copier with duplexing HD-70 HDD for Copier $ $ 202 HD-ME GB Hard Disk Drive Unit $ $ 277 FALCON 3's KM C.P.M. Digital Copier with duplexing (Std. Print/Scan/Copy) Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 7NH3M040G001H01 (1) 40GB HDD $ 375 KM C.P.M. Digital Copier with duplexing (Std. Print/Scan/Copy) Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 7NH3M040G001H01 (1) 40GB HDD $ 375 KM C.P.M. Digital Copier with duplexing (Std. Print/Scan/Copy) Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 7NH3M040G001H01 (1) 40GB HDD $ of 45

25 June 18, 2010 Hard Drive/Data Security Kit Pricing MODELS SUGGESTED HDD / DATA AND RETAIL SECURITY KIT ACCESSORIES DESCRIPTION PRICE PRICING FALCON 4's TASKalfa 420i 42 PPM Monochrome MFP Data Security Kit E HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 302KS93060 (1) 160GB HDD $ 427 TASKalfa 520i 52 PPM Monochrome MFP Data Security Kit E HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 302KS93060 (1) 160GB HDD $ 427 KM C.P.M. Digital Copier Data Security Kit (B) HDD Erase Kit for Copy/Print $ $ 231 HD-ME GB Hard Disk Drive Unit for Printer $ $ 277 KM C.P.M. Digital Copier HD-ME GB Hard Disk Drive Unit $ $ 277 KM C.P.M. Digital Copier Data Security Kit (B) HDD Erase Kit for Copy/Print $ $ 231 HD-ME GB Hard Disk Drive Unit for Printer $ $ 277 TASKalfa C.P.M. Monochrome MFP Data Security Kit (B) HDD Erase Kit for Copy/Print $ $ 231 HD-10 HDD for Printer $ $ 349 TASKalfa C.P.M. Monochrome MFP Data Security Kit (B) HDD Erase Kit for Copy/Print $ $ 231 HD-10 HDD for Printer $ $ 349 COLOR KM-C /25 C.P.M. Digital Color MFP with standard PCL Print, Scan, I FAX KM-C /32 C.P.M. Digital Color MFP with standard PCL Print, Scan, I FAX KM-C /32 C.P.M. Digital Color MFP with standard PCL Print, Scan, I FAX Data Security (D) Data Security $ $ 231 HD-5 HDD for Printer (40GB) $ $ 277 VOYAGER 1.5 KM-C2525E (Color) 25/25 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan KM-C2525E (B/W) 25/25 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan KM-C3225E (Color) KM-C3225E (B/W) 25/32 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan 25/32 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan KM-C3232E (Color) KM-C3232E (B/W) 32/32 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan 32/32 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan KM-C4035E (Color) 35/40 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan KM-C4035E (B/W) 35/40 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan Data Security (D) Data Security $ $ 231 HD-ME GB Hard Disk Drive Unit for Printer $ $ of 45

26 June 18, 2010 Hard Drive/Data Security Kit Pricing MODELS SUGGESTED HDD / DATA AND RETAIL SECURITY KIT ACCESSORIES DESCRIPTION PRICE PRICING TASKalfa ci TASKalfa250ci (Color) 25/25 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan TASKalfa300ci (Color) 30/30 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan TASKalfa400ci (Color) 40/40 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan TASKalfa500ci (Color) 50/40 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan Data Security (E) Data Security $ $ 335 HDD-Part # 302JZ93160 (1) 160GB HDD [TA250ci/300ci Only] $ 276 HDD-Part # 302H (2) 160GB HDD [TA400ci/500ci Only] $ 558 TASKalfa552ci (Color) 55/50 C.P.M. Digital Color MFP with standard PCL/PS Print, Scan Data Security (E) Data Security $ $ 335 HDD-Part # 302H (2) 160GB HDD $ 558 PRINTERS FS-2020D 37 PPM Laser Printer FS-3920DN 42 PPM Laser Printer FS-4020DN 47 PPM Laser Printer HD-5A 40.0 GB Hard Disk Drive Unit for Printer $ $ 237 FS-C8100DN 32 PPM Color Laser Printer Data Security (D) Data Security $ $ 231 HD-ME GB Hard Disk Drive Unit for Printer $ $ 277 FS-C8500DN 55/50 PPM Color Printer Data Security Kit E HDD Erase Kit for Copy/Print $ $ 335 HDD-Part # 302K (1) 160GB HDD $ 231 FS-9120DN 36 PPM Modular Laser Printing System FS-9520DN 51 PPM Modular Laser Printing System HD-ME GB Hard Disk Drive Unit $ $ 277 FS-9130DN 40 PPM Modular Laser Printing System FS-9530DN 51 PPM Modular Laser Printing System Data Security Kit C HDD Erase Kit for Copy/Print $ $ 335 HD-ME GB Hard Disk Drive Unit for Printer $ $ of 45

27 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 LANIER #64043 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 27 of 45

28 Alan Krupa State of New Jersey Department of the Treasury Purchase Bureau PO Box 230 Trenton, NJ Alan, Options for Hard Drive Security Ricoh s Data Overwrite Security System* (DOSS) option offers added security to all types of customer mission critical documents and proprietary information. The DOSS option overwrites temporary data stored on the system s internal hard disk drive by using a three pass overwrite process of random sequences of 1s and 0s, making it incredibly difficult to reconstruct images or files. T437A T437C Band Model DOSS Band Model DOSS 1 Lanier LD533SP (3351Sp) $ Lanier LD528C $ Lanier LD140SP (4001SP) $ Lanier LD528C $ Lanier LD360 (6001) $ Lanier LD528C $ Lanier LD370 (7001) $ Lanier LD528C $ Lanier LD370 (7001) $ Lanier LD528C $ Lanier LD380 (8001) $ Lanier LD533C $ Lanier LD380 (8001) $ Lanier LD550C $ Lanier LD380 (8001) $ Lanier LD540C $ Lanier LD380 (8001) $ Lanier LD365C $ Lanier Pro907EX $ Lanier LD365C $ Lanier Pro907EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ of 45

29 Ricoh's Hard Drive Surrender Program option is only available for models that will support hard drive technology. The HD Surrender Option includes all labor and any materials required. Under this option Ricoh would surrender the Hard Drive prior to the unit being removed from the Agency or Eligible Entity. T437A Band Model HD Surrender T437C 1 Lanier LD533SP (3351Sp) $ 8.37 Band Model HD Surrender 1 Lanier LD528SP $ Lanier LD528C $ Lanier LD140SP (4001SP) $ Lanier LD528C $ Lanier LD140SP $ Lanier LD528C $ Lanier LD360 (6001) $ Lanier LD528C $ Lanier LD150SP $ Lanier LD528C $ Lanier LD370 (7001) $ Lanier LD533C $ Lanier LD370 (7001) $ Lanier LD550C $ Lanier LD380 (8001) $ Lanier LD540C $ Lanier LD380 (8001) $ Lanier LD365C $ Lanier LD380 (8001) $ Lanier LD365C $ Lanier LD380 (8001) $ Lanier Pro907EX $ Lanier Pro907EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ of 45

30 Ricoh's Hard Drive Encryption* option provides security for information that needs to be stored on the MFP or printer and reused again. Examples of information that may need to be stored for reuse include administrator and user passwords and address books. The Hard Drive Encryption Option differs from DOSS in that the information encrypted is not destroyed, but locked up so only authorized users may access the information. DOSS destroys data so it cannot be reused. The Hard Drive Encryption Option and DOSS may be used in conjunction and will not interfere with MFP or printer operation. T437A T437C Band Model HD Encryption Band Model HD Encryption 1 Lanier LD533SP (3351Sp) $ Lanier LD528C $ Lanier LD528SP $ Lanier LD528C $ Lanier LD140SP (4001SP) $ Lanier LD528C $ Lanier LD140SP $ Lanier LD528C $ Lanier LD360 (6001) $ Lanier LD528C $ Lanier LD150SP $ Lanier LD533C $ Lanier LD370 (7001) $ Lanier LD550C $ Lanier LD370 (7001) $ Lanier LD540C $ Lanier LD380 (8001) $ Lanier LD365C $ Lanier LD380 (8001) $ Lanier LD365C $ Lanier LD380 (8001) $ Lanier LD380 (8001) $ Lanier Pro907EX $ Lanier Pro907EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ Lanier Pro1107EX $ 4.84 *Ricoh has the ability to add both Data Overwrite and Hard Drive Encryption on units already installed. Ricoh would only charge the State of New Jersey $120/hr if the customer decides to install these security options 30 of 45

31 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 OCE NORTH AMERICA #64047 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 31 of 45

32 Océ North America Policy on Customer Data Security for Returned Equipment Océ North America ( Océ ) 100 Oakview Drive Trumbull, CT The purpose of Océ North America Policy on Customer Data Security for Returned Equipment ( Policy ) is to describe for the customer the options that are currently available for securing customer s data on any Océ equipment that 1) contains a hard disk drive and 2) is returned to Océ. It is the responsibility of the customer to ensure that customer s data is handled in accordance with customer s requirements and/or internal policies and procedures prior to pick-up and return of any Océ equipment containing a hard disk drive. Océ shall not be liable for the release or disclosure of, or failure to destroy, customer data that has not been handled in accordance with this Policy or customer s own standard practices and/or internal policies for handling such data. In connection with office printing equipment: To protect the security of Customer data upon pickup and return of Océ equipment with hard disk drives to Océ, the Customer must exercise one of the following three Options: 1. Customers that have purchased security software/hardware, or units that contain any of the following can manage their own data needs: Deletion The hard disk drive directory is deleted making data unrecoverable by any users through the devices control panel, however if the hard drive is removed from the unit, 3rd party recovery software could be used to reconstruct the data. Encryption - End user data is secured against unauthorized viewing through the device control panel, or if the drive is removed. The encryption key password must be activated and not be released by the Customer to insure data integrity. Overwrite - Data is overwritten a minimum of 3 times to insure the data is unrecoverable from the device control panel, or if the drive is removed. The above will enable the Customer to determine the level of security required without intervention from Océ, and to complete sanitization of data prior to pick-up. The procedures should be outlined in the applicable User Manual, and if not, please contact your sales representative. If not included in the original sale, Customers may purchase available security software/hardware for their own use at an additional charge. 2. Customers that have purchased, or will purchase, available security software/hardware, or units that contain hard disk drive Deletion, Encryption or Océ HD Data Security Policy Rev. 6/3/ of 45

33 Overwrite capabilities and require that an Océ technician complete the procedure at the Customer s location can schedule a specific service call before the equipment is returned. There is an additional charge for this service. 3. Customers that require removal and retention of the hard disk drives by an Océ technician can schedule a specific service call before the equipment is returned. There is an additional charge for this service. To support Customer requirements, Océ offers the above options. Unless Customer properly uses an Océ provided Overwrite capability as set forth in Option 1 (if available); requests the Overwrite capability in Option 2 (if available), or requests Option 3, Océ makes no representation as to the destruction of Customer data on returned equipment; and Océ shall not be liable for the release or disclosure of, or failure to destroy, Customer data. In connection with production printing equipment: The following option is available to Océ customers in order to protect the security of customer data that may be located on the hard disk drive of any Océ production printing equipment that has been returned to Océ: For production printing equipment customers, at the time that customer informs Océ that the equipment will be returned to Océ and if customer is concerned about sensitive data on the original hard disk, it is the customer s responsibility to purchase from Océ a replacement hard drive for the Océ equipment. At the time of de-installation, the original hard disk will be removed from the Océ equipment and given to the customer. It is the customer s responsibility to dispose of the original hard drive according to customer s internal policies and procedures governing such disposal. In connection with wide format printing equipment: As a standard practice, Océ electronically cleans all images located on the hard disk drives of returned wide format equipment. Océ also strongly recommends that customers scrub data from the hard disk of all equipment prior to the equipment leaving the customer site as Océ does not accept any responsibility for the security of data remaining on the equipment. Océ offers the following options for customers wishing to protect the security of data on hard disk drives prior to releasing the equipment from the customer site: 1. Customer may purchase from Océ a removable hard drive that has dual images from Océ. The standard image is in the printer at all times and only removed when necessary to print all sensitive data (which is stored on the second hard drive). Hard drives are changed as needed. The standard image is returned to Océ with the Océ Océ HD Data Security Policy Rev. 6/3/ of 45

34 equipment, and the customer retains the removable hard drive containing the sensitive data. 2. Customer may purchase an Océ Power Logic controller with the electronic shredding option. Océ HD Data Security Policy Rev. 6/3/ of 45

35 CHRIS CHRISTIE Governor KIM GUADAGNO Lt. Governor DEPARTMENT OF THE TREASURY DIVISION OF PURCHASE AND PROPERTY PURCHASE BUREAU P.O. BOX 230 TRENTON, NJ ANDREW P. SIDAMON-ERISTOFF State Treasurer SUPPLEMENT TO AMENDMENT #47 EFFECTIVE OCTOBER 20, 2010 SHARP ELECTRONICS #64040 T-437A COST PER COPY SOLICITATION 06-X The purpose of this notice is to provide guidance for the proper disposal or sanitization of copiers that have been rented or will be rented using the current Black and White CPC contract. It also helps ensure that the information contained on such media is completely expunged before it leaves the State of New Jersey s control. See State of New Jersey IT Circular #152- Information Disposal and Media Sanitization (09-10-NJOIT): Hard drive security varies by manufacturer/contractor. Users should review the information provided for each respective contractor. New Jersey State Agencies should use the new contract line that has been titled Hard Drive Security to pay for any additional charges related to hard drive security. Contractors should supply specific quotations on company letterhead for reference/audit purposes. Alan Krupa Senior Buyer Purchase Bureau New Jersey Is an Equal Opportunity Employer Printed on Recycled and Recyclable Paper 35 of 45

36 SHARP ELECTRONICS CORPORATION Sharp Plaza P.O. Box B Mahwah, NJ James Driscoll, Government Account Manager Bus July 30, 2010 SHARP ELECTRONICS CORP. NJ STATE CONTRACT - T437A T437C T2075 Hard Disk Drive Data Security Clarification Sharp offers a broad array of standard and optional security features that are designed to help you protect your confidential and private information. To address the specific issue of image data on the hard drive, Sharp offers the optional Data Security Kit, which when equipped on the MFP provides additional security, including the following two key steps: 1. All data on the Hard Drive is stored in an encrypted format. 2. Once the job is complete, the data is overwritten up to seven (7) times. This can be done after every job, when the machine is turned on or on demand. If used correctly, this process renders the data on the drive virtually unrecoverable. If customers choose not to purchase a Sharp Data Security Kit, Sharp strongly recommends that at the end of the product life, you purchase a new Hard Drive for your MFP and retain and destroy the original Hard Drive that contains your confidential information. While many people have considered reformatting the Hard Drive as a measure to protect the information on the drive, we do not recommend this method as a secure alternative to protect the confidentiality of your information. In order to complete any of these actions, please contact your Sharp Authorized Service Provider. A list of Sharp copiers and their corresponding Data Security Kits, as well as the cost of the Hard Disk Removal is attached. 36 of 45