Cal. Pub. Cont. Code § 12112

(a) Any contract for information technology goods or services, to be manufactured or performed by the contractor especially for the state and not suitable for sale to others in the ordinary course of the contractor’s business may provide, on the terms and conditions that the controlling department, as specified in Section 12100, deems necessary to protect the state’s interests, for progress payments for work performed and costs incurred at the contractor’s shop or plant, provided that not less than 10 percent of the contract price is required to be withheld until final delivery and acceptance of the goods or services. Notwithstanding this subdivision, if the department determines that lesser withholding levels are appropriate based upon an evaluation of risk determined under subdivision (b) and the contract price is ten million dollars ($10,000,000) or more, the department shall withhold no less than 5 percent of the contract price until final delivery and acceptance of the goods or services. If the department determines that lesser withholding levels are appropriate based on an evaluation of risk determined under subdivision (b) and the contract price is less than ten million dollars ($10,000,000), the department shall withhold no less than 3 percent of the contract price until final delivery and acceptance of the goods or services.
(b) The Department of General Services, in consultation with the Department of Finance, shall develop and maintain criteria for the evaluation of risk to the state that results from the acquisition of information technology. This risk analysis shall determine the need for financial protection that is in the best interest of the state, including, but not limited to, any of the following:
1. (1) An acceptable performance bond as described in Chapter 2 (commencing with Section 995.010) of Title 14 of Part 2 of the Code of Civil Procedure.
2. (2) Any surety as defined in Section 2787 of the Civil Code.
3. (3) A letter of credit as described in Division 5 (commencing with Section 5101) of the Commercial Code.
4. (4) Protection in the form of contract terms.
5. (5) Any other form of security or guaranty of performance in an amount sufficient to protect the state in the case of default by the contractor providing information technology, or any other breach or malfunction of the goods or services, or both.
(c) For purposes of this section, “information technology” means information technology goods or services, or both, as appropriate.