Loading...
HomeMy WebLinkAboutGrant Related - BOCC (005)K20-169J�'-S DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) ZCOM4ISSIOvE DSHS and County DSHS Contract Number washington state Agreement on Data 2063-91217 Department of Social 7 &Health Services Security Requirements Transforming lives These General Terms and Conditions are between the state of Washington County contract Number Department of Social and Health Services (DSHS) and the County identified below. These General Terms and Conditions govern work to be performed under any Program Agreement between the parties. These Data Security Requirements supersede and replace any previously executed Data Security Requirements as of the start date below. TERM OF AGREEMENT: The term of this Agreement on General Terms and Conditions shall start and end on the following dates, unless terminated sooner as provided herein. START DATE: October 15th, 2020 END DATE: June 30th, 2023 COUNTYNAME DSHS INDEXNUMBER Grant County 1221 COUNTYADDRESS PO Box 1057 Moses Lake, WA 98837 COUNTYTELEPHONE COUNTYFAX (509)764-2644 (509)765-4124 DSHS CENTRAL CONTRACT SERVICES ADDRESS DSHS CENTRAL CONTRACT SERVICES TELEPHONE Central Contracts and Legal Services (360) 664-6055 P.O. Box 45811 Olympia, WA 98504-5811 By their signatures below, the parties agree to this A reement on General Terms and Conditions. RE(S) DATE(S) PRINTED NAME(S) AND TITLE(S) TELEPHONENUMBER (INCLUDE AREA CODE) ASSI.NA Cindy CarterChair �y y _7Sy- aD DATE PRINTED NAME AND TITLE TELEPHONENUMBER (INCLUDE AREA CODE) Clarissa Brechwald Contracts Consultant (360)664-6052 DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) ZCOM4ISSIOvE Data Security Requirements Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions: a. "AES" means the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology (http://nvipubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf). b. "Authorized Users(s)" means an individual or individuals with a business need to access DSHS Confidential Information, and who has or have been authorized to do so. c. "Business Associate Agreement" means an agreement between DSHS and a contractor who is receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability and Accountability Act of 1996. The agreement establishes permitted and required uses and disclosures of protected health information (PHI) in accordance with HIPAA requirements and provides obligations for business associates to safeguard the information. d. "Category 4 Data" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. Data classified as Category 4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §1232g; 34 CFR Part 99; Internal Revenue Service Publication 1075 (https://www.irs.gov/pub/irs-pdf/pl075.pdf); Substance Abuse and Mental Health Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20. e. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include Tunes, Dropbox, Box.com, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace. f. "Encrypt" means to encode Confidential Information into a format that can only be read by those possessing a "key"; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. g. "FedRAMP" means the Federal Risk and Authorization Management Program (see www.fedramp.gov), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services. h. "Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9.10-2020) Page 2 I. "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as IDS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. j. "Multi -factor Authentication" means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PIM' means a personal identification number, a series of numbers which act as a password for a device. Since PINS are typically only four to six characters, PINS are usually used in conjunction with another factor of authentication, such as a fingerprint. k. 'Portable Device" means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device. I. "Portable Media" means any machine readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device. m. "Secure Area" means an area to which only authorized representatives of the entity possessing the Confidential Information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access to the Confidential Information is not available to unauthorized personnel. In otherwise Secure Areas, such as an office with restricted access, the Data must be secured in such a way as to prevent access by non -authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non -authorized staff cannot access it. n. 'Trusted Network' means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DSHS Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data. o. "Unique User ID" means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. Supersession of Prior Data Security Agreement. If the Parties hereto have previously entered into a previous Data Security Requirements Agreement, both Parties hereby agree that upon mutual execution of this Agreement this Agreement shall take precedence as the sole Data Security Agreement between the Parties and any previously executed contract is terminated and of no further force and effect. Authority. The security requirements described in this document reflect the applicable requirements of Standard 141.10 (https://ocio.wa.gov/policies) of the Office of the Chief Information Officer for the state of Washington, and of the DSHS Information Security Policy and Standards Manual. Reference material related to these requirements can be found here: https://www.dshs.wa.gov/ffa/keeping-dshs- DSHS Central Contract Services 6046CF DSHS and County Agreement on Data Security Requirements (9-10.2020) Page 3 client -information -private -and -secure, which is a site developed by the DSHS Information Security Office and hosted by DSHS Central Contracts and Legal Services. 4. Administrative Controls. The Contractor must have the following controls in place: a. A documented security policy governing the secure use of its computer network and systems, and which defines sanctions that may be applied to Contractor staff for violating that policy. b. If the Data shared under this agreement is classified as Category 4, the Contractor must be aware of and compliant with the applicable legal or regulatory requirements for that Category 4 Data. c. If Confidential Information shared under this agreement is classified as Category 4, the Contractor must have a documented risk assessment for the system(s) housing the Category 4 Data. 5. Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to authorized staff, the Contractor must: a. Have documented policies and procedures governing access to systems with the shared Data. b. Restrict access through administrative, physical, and technical controls to authorized staff. c. Ensure that user accounts are unique and that any given user account logon ID and password combination is known only to the one employee to whom that account is assigned. For purposes of non -repudiation, it must always be possible to determine which employee performed a given action on a system housing the Data based solely on the logon ID used to perform the action. d. Ensure that only authorized users are capable of accessing the Data. e. Ensure that an employee's access to the Data is removed immediately: (1) Upon suspected compromise of the user credentials. (2) When their employment, or the contract under which the Data is made available to them, is terminated. (3) When they no longer need access to the Data to fulfill the requirements of the contract. f. Have a process to periodically review and verify that only authorized users have access to systems containing DSHS Confidential Information. g. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Contractor's network, including: (1) A minimum length of 8 characters, and containing at least three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. (2) That a password does not contain a user's name, logon ID, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) Page 4 (4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. h. When accessing Confidential Information from an external location (the Data will traverse the Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: (1) Ensuring mitigations applied to the system don't allow end-user modification. (2) Not allowing the use of dial-up connections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network. (5) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than 30 minutes of inactivity. (6) Ensuring use of Multi -factor Authentication to connect from the external end point to the internal end point. L Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: (1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor (2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable) (3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable) j. If the contract specifically allows for the storage of Confidential Information on a Mobile Device, passcodes used on the device must: (1) Be a minimum of six alphanumeric characters. (2) Contain at least three unique character classes (upper case, lower case, letter, number). (3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. k. Render the device unusable after a maximum of 10 failed logon attempts. 6. Protection of Data. The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID DSHS Central Contract Services 8046CF DS HS and County Agreement on Data Security Requirements (9-10-2020) Page 5 and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section 9 Data Disposition, may be deferred until the disks are retired, replaced, or otherwise taken out of the Secure Area. c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be Stored in a Secure Area. Workstations which access DSHS Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by DSHS on optical discs which will be attached to network servers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e. Paper documents. Any paper records must be protected by storing the records in a Secure Area which is only accessible to authorized personnel. When not in use, such records must be stored in a Secure Area. f. Remote Access. Access to and use of the Data over the State Governmental Network (SGN) or Secure Access Washington (SAW) will be controlled by DSHS staff who will issue authentication credentials (e.g. a Unique User ID and Hardened Password) to Authorized Users on Contractor's staff. Contractor will notify DSHS staff immediately whenever an Authorized User in possession of such credentials is terminated or otherwise leaves the employ of the Contractor, and whenever an Authorized User's duties change such that the Authorized User no longer requires access to perform work for this Contract. g. Data storage on portable devices or media. (1) Except where otherwise specified herein, DSHS Data shall not be stored by the Contractor on portable devices or media unless specifically authorized within the terms and conditions of the Contract. If so authorized, the Data shall be given the following protections: (a) Encrypt the Data. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) Page 6 (b) Control access to devices with a Unique User ID and Hardened Password or stronger authentication method such as a physical token or biometrics. (c) Manually lock devices whenever they are left unattended and set devices to lock automatically after a period of inactivity, if this feature is available. Maximum period of inactivity is 20 minutes. (d) Apply administrative and physical security controls to Portable Devices and Portable Media by: I. Keeping them in a Secure Area when not in use, ii. Using check-in/check-out procedures when they are shared, and iii. Taking frequent inventories. (2) When being transported outside of a Secure Area, Portable Devices and Portable Media with DSHS Confidential Information must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. h. Data stored for backup purposes. (1) DSHS Confidential Information may be stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. Such storage is authorized until such time as that media would be reused during the course of normal backup operations. If backup media is retired while DSHS Confidential Information still exists upon it, such media will be destroyed at that time in accordance with the disposition requirements below in Section 9 Data Disposition. (2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. If so, such media will be protected as otherwise described in this exhibit. If this media is retired while DSHS Confidential Information still exists upon it, the data will be destroyed at that time in accordance with the disposition requirements below in Section 9 Data Disposition. i. Cloud storage. DSHS Confidential Information requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DSHS nor the Contractor has control of the environment in which the Data is stored. Forthis reason: (1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed. (b) The Data will be Encrypted while within the Contractor network. (c) The Data will remain Encrypted during transmission to the Cloud. (d) The Data will remain Encrypted at all times while residing within the Cloud storage solution. (e) The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DSHS. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) Page 7 (f) The Data will not be downloaded to non -authorized systems, meaning systems that are not on either the DSHS or Contractor networks. (g) The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within either the DSHS or Contractor's network. (2) Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub -Contractor, and agrees in writing to all of the requirements within this exhibit; or, (b) The Cloud storage solution used is Fed RAMP certified. (3) If the Data includes protected health information covered by the Health Insurance Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. 7. System Protection. To prevent compromise of systems which contain DSHS Data or through which that Data passes: a. Systems containing DSHS Data must have all security patches or hotfixes applied within 3 months of being made available. b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes. c. Systems containing DSHS Data shall have an Anti-Malware application, if available, installed. d. Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware database the system uses, will be no more than one update behind current. 8. Data Segregation. a. DSHS Data must be segregated or otherwise distinguishable from non-DSHS data. This is to ensure that when no longer needed by the Contractor, all DSHS Data can be identified for return or destruction. It also aids in determining whether DSHS Data has or may have been compromised in the event of a security breach. As such, one or more of the following methods will be used for data segregation. (1) DSHS Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non-DSHS Data. And/or, (2) DSHS Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to DSHS Data. And/or, (3) DSHS Data will be stored in a database which will contain no non-DSHS data. And/or, (4) DSHS Data will be stored within a database and will be distinguishable from non-DSHS data by the value of a specific field or fields within database records. (5) When stored as physical paper documents, DSHS Data will be physically segregated from non- DSHS data in a drawer, folder, or other container. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) Page 8 b. When it is not feasible or practical to segregate DSHS Data from non-DSHS data, then both the DSHS Data and the non-DSHS data with which it is commingled must be protected as described in this exhibit. Data Disposition. When the contracted work has been completed or when the Data is no longer needed, except as noted above in Section 6.b, Data shall be returned to DSHS or destroyed. Media on which Data may be stored and associated acceptable methods of destruction are as follows: Data stored on: Will be destroyed by: Server or workstation hard disks, or Using a "wipe' utility which will overwrite the Data at least three (3) times using either random or single Removable media (e.g. floppies, USB flash drives, character data, or portable hard disks) excluding optical discs Degaussing sufficiently to ensure that the Data cannot be reconstructed, or Physically destroying the disk Paper documents with sensitive or Confidential Recycling through a contracted firm, provided the Information contract with the recycler assures that the confidentiality of Data will be protected. Paper documents containing Confidential Infonnation On-site shredding, pulping, or incineration requiring special handling (e.g. protected health information Optical discs (e.g. CDs or DVDs) Incineration, shredding, or completely defacing the readable surface with a coarse abrasive Magnetic tae Degaussing, incinerating or crosscut shredding 10. Notification of Compromise or Potential Compromise. The compromise or potential compromise of DSHS shared Data must be reported to the DSHS Contact designated in the Contract within one (1) business day of discovery. If no DSHS Contact is designated in the Contract, then the notification must be reported to the DSHS Privacy Officer at dshspdvacyofficer@dshs.wa.gov. Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DSHS. Data shared with Subcontractors. If DSHS Data provided under this Contract is to be shared with a subcontractor, the Contract with the subcontractor must include all of the data security provisions within this Contract and within any amendments, attachments, or exhibits within this Contract. If the Contractor cannot protect the Data as articulated within this Contract, then the contract with the sub - Contractor must be submitted to the DSHS Contact specified for this contract for review and approval. DSHS Central Contract Services 8046CF DSHS and County Agreement on Data Security Requirements (9-10-2020) Page 9 K20-171 SETTLEMENT AGREEMENT THIS SETTLEMENT AGREEMENT is made as of the 1V day of October, 2020 by and between Grant County and the Grant County Assessor (together, "County") and REC Solar Grade Silicon LLC ("REC"). RECITALS A. REC is the owner of a polysilicon manufacturing facility in Moses Lake primarily identified for property tax purposes as Parcel No. 091759600 (the "Subject Property"). B. For January 1, 2012, the County assessed the Subject Property at $1,120,251,920. On January 7, 2013, the parties asked the Washington Board of Tax Appeals ("BTA") to accept a direct appeal to the BTA of REC's petition contesting the Assessor's valuation of Subject Property for assessment year 2012. For purposes of the petition, REC estimated the value of the Subject Property at $450,000,000 and, under RCW 84.52.018, paid taxes in 2013 based on that value. On remand, the BTA ordered a value of $774,000,000 for the Subject Property. REC petitioned for judicial review, and the case is now pending before the Washington Court of Appeals Division II as case number 52975-1. C. For January 1, 2013, the County assessed the Subject Property at $671,255,765. REC filed with the Grant County Board of Equalization ("BOE") a petition contesting the Assessor's valuation of the Subject Property for assessment year 2013. On July 24, 2014, the BOE ordered the value reduced to $250,000,000. The County appealed the BOE's order to the BTA on August 21, 2014. That appeal is now pending before the BTA as Docket No. 14-082. REC appealed the BOE's order to the BTA on August 25, 2014. That appeal is now pending before the BTA as Docket No. 14-084. D. For January 1, 2014, the County assessed the Subject Property at $601,051,115. The parties asked the BTA to accept a direct appeal to the BTA of REC's petition contesting the Assessor's valuation of the Subject Property for assessment year 2014. For purposes of the petition, REC estimated the value of the Subject Property at $234,795,350 and, under RCW 84.52.018, paid taxes in 2015 based on that value. That appeal is now pending before the BTA as Docket No. 14-110. E. For January 1, 2015, the County assessed the Subject Property at $360,051,020. REC filed with the BOE a petition contesting the Assessor's valuation of the Subject Property for assessment year 2015. On June 13, 2016, the BOE ordered the value reduced to $234,447,810. The County and REC both appealed the BOE's order to the BTA. Those cross-appeals are now pending before the BTA as Docket Nos. 16-097 and 16-101. F. At various times, the parties have engaged in good faith settlement discussions, most recently with an independent mediator's assistance on Friday, October 2, 2020, at which time they reached a mutually satisfactory resolution of their dispute for assessment years 2012 through 2015, on the terms and conditions set forth herein. Page 1 of 3 115040540.0 AGREEMENT NOW, THEREFORE, in consideration of the promises and mutual covenants contained herein, the parties agree as follows: 1. Stipulated values, tax, and interest. For each assessment of the Subject Property under appeal the parties agree to stipulate for settlement purposes only that the assessed value of the Subject Property shall be as set forth below, with additional property tax and interest as provided by RCW 84.52.018, where applicable, as also set forth below: Assessment/Tax Year 2012/2013 2013/2014 2014/2015 2015/2016 Stipulated Value Additional Tax Interest The amount of interest a schedule below and is pa under RCW 84.52.018 at example of the timing of t 2. Payment schedule. Pur notwithstanding the timii that REC will pay the C below: P., $774,000,000 $4,592,410.95 $427,000,000 $2,426,513.53 $398,795,350 $2,357,542.48 ` $4665,931.72 D C"T December 15, 2022 December 15, 2023 $1,750,000.00 December 15, 2024 $1,750,000.00 December 15, 2025 $1,750,000.00 December 15, 2026 $1,750,000.00 $3,657,601.32 Not applicable Not applicable Not applicable g to the payment nt of interest due on, regardless for tion I above, and s, the parties agree Iments as set forth 3. Dismissal of appeals. All appeals of the assessments on parcels or tax accounts shall be dismissed with prejudice for assessment years 2012 through 2015. Page 2 of 3 115040540.0 4. No further challenge. This Settlement Agreement is inclusive of any and all of RFC's real and personal property for the 2012 through 2015 assessment years and may not be challenged by either party at any time. 5. Documents effectuating agreement. The parties will execute and file with the BTA one or more stipulations for the appeals of the Subject Property for the 2012 through 2015 assessment years with a copy of this Settlement Agreement. The parties shall work together to formalize this Settlement Agreement with such additional documentation as may be necessary to effectuate its intent, including notice to the Court of Appeals. 6. Enforcement. In the event that REC fails to make a future payment as set forth in this Settlement Agreement, REC agrees that the County may pursue an expedited tax lien foreclosure against the Subject Property and waives any defenses to such foreclosure. REC further agrees that any costs and expenses incurred in the tax lien foreclosure, including reasonable attorney fees, and all applicable interest, shall be included. The County shall also be permitted to pursue collection of any past due amounts, including interest, for the applicable tax assessment year. This Settlement Agreement shall also not relieve REC from any other obligation or legal responsibility that is not set forth herein, including but not limited to, any environmental matter(s). A copy of this Settlement Agreement may be introduced into evidence in any proceeding to enforce the settlement pursuant to CR 2A. REC SOLAR GRADE SILICON, LLC GRANT COUNTY TORE TORVUND, CEO AND PRESIDENT RI HARD STEVENS, COMMISSIONER TOM TAYLOR, COMM SIONER rl I SLA CINDY CA R, C ISSIO ER, CHAIR Page 3 of 3 115040540.0