071B5500025.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 24 to Contract Number MA071B5500025C

C U

RREN

T C

O N

TRAC

TO

R

MERIT NETWORK INC

1000 Oakbrook Drive Suite 200 Ann Arbor MI 48104

Jameka Williams

(734) 527-5761 jamekaw@merit.edu

CV0025865

N

EW

C O

N

TRAC

TO

R

MERIT NETWORK INC

880 Technology Drive Suite B Ann Arbor MI 48108

Kevin St. Onge

734-476-2316 kdstonge@merit.edu

CV0025865

STATE CONTACTS

Program

M anager

Various DTMB C ontract

Adm inistrator

Mecca Martin DTMB

(517) 230-5694

MartinM42@michigan.gov

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE

October 14, 2014

INITIAL EXPIRATION DATE

October 31, 2019

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE BEFORE

October 31, 2027

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

n/a

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

n/a

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

0 Years

REVISED EXP. DATE

October 31, 2028

CURRENT VALUE

$9,885,041.50

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$9,885,041.50

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 8/4/2026, this Contract is hereby extended 1 year with 2 (1) Year Options. The revised contract expiration date is 10/31/2028.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement Services approval, and State Administrative Board approval on 8/4/2026.

CHANGE NOTICE NO. 24 TO CONTRACT NO. MA071B5500025C

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

DTMB Jennifer Scriver 517-284-9230 ScriverJ@michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

DTMB

320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 31, 2019 5 - 12 Months October 31, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1000 Oakbrook Drive Suite 200

Ann Arbor MI 48104

Jameka Williams

(734) 527-5761 jamekaw@merit.edu

CV0025865

MERIT NETWORK INC

C O

N

TR

A C

TO

R

Mecca Martin

(517) 230-5694

DTMB

Various DTMB

MartinM42@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/aNet 45

Change Notice Number 23

Contract Number MA071B5500025C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$11,235,041.50 $0.00 $11,235,041.50

DESCRIPTION

Effective 07/21/2025, the contract is amended to incorporate the below ADA Compliance Language. No additional funding is required.

Please note the Contract Administrator has been changed to Mecca Martin.

Please note the State Program Manager has been changed to Jennifer Scriver

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites, applications, content, and electronic documents. Due to a change in the law, the State is required to comply with specific accessibility standards for websites, applications, content and documents. Starting 4/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level

AA.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

AGENCY NAME PHONE EMAIL

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

DTMB Jennifer Scriver 517-284-9230 ScriverJ@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 23 TO CONTRACT NO. MA071B5500025C

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 31, 2019 5 - 12 Months October 31, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1000 Oakbrook Drive Suite 200

Ann Arbor MI 48104

Jameka Williams

(734) 527-5761 jamekaw@merit.edu

CV0025865

MERIT NETWORK INC

C O

N

TR

A C

TO

R

Lauren Stempek

(517) 243-4008

DTMB

Various - Primary Meghan Penny stempekl@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/aNet 45

Change Notice Number 22

Contract Number MA071B5500025C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$11,235,041.50 $0.00 $11,235,041.50

DESCRIPTION

Effective 3/25/2025, this change notice is issued as a clerical correction to Change Notice 21, as the Revised Expiration date that was executed in Change Notice 20 should have carried over and read 10/31/2027. Please see this clerical correction has now been made and the accurate expiration date is now displayed - 10/31/2027.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

(517) 282-1272

PennyM2@michigan.gov

DTMB Meghan Penny 517-282-1272 PennyM2@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

Program Managers for

CHANGE NOTICE NO. 22 TO CONTRACT NO. MA071B5500025C

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 31, 2019 5 - 12 Months October 31, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1000 Oakbrook Drive Suite 200

Ann Arbor MI 48104

Jameka Williams

(734) 527-5761 jamekaw@merit.edu

CV0025865

MERIT NETWORK INC

C O

N

TR

A C

TO

R

Lauren Stempek

(517) 243-4008

Various - Primary Meghan Penny

StempekL@Michigan.Gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/aNet 45

Change Notice Number 21

Contract Number MA071B5500025C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$11,186,237.50 $48,804.00 $11,235,041.50

DESCRIPTION

Effective 3/6/2025, this contract hereby adds $48,804.00 in funds to cover the two Statements of Works attached. The first Statement of work adds $20,100.00 in funds to cover services for Camp Grayling to execute the 3-year renewal for internet access services, optional fee-services as described in the SOW.

The Selfridge Statement of Work adds funds in the amount of $28,704.00 to cover the 3-year renewal for internet access services and optional fee services as described in the SOW.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

(517) 282-1272

PennyM2@Michigan.Gov

DTMB

DTMB Meghan Penny 517-282-1272 PennyM2@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

Program Managers for

CHANGE NOTICE NO. 21 TO CONTRACT NO. MA071B5500025C

Michigan.gov/MiProcurement

STATEMENT OF WORK -

IT CHANGE NOTICE

Version 2 (3/2021) 1

Project Title:

Camp Grayling Joint Maneuvering Training Center – 3 Year

Period of Coverage:

10/01/2024 – 10/31/2027

Requesting Department:

DTMB – Chief Technology Office

Date:

3/1/2025

Agency Project Manager:

Stephanie Jeppesen

Phone:

(517) 335-6899

DTMB Project Manager:

Meghan Penny

Phone:

BACKGROUND:

Merit has been providing Internet access services, optional fee-services, and other mutually agreed-upon services to Camp Grayling Joint Maneuvering Training Center, and they are going to continue these services for the next 3 years through 10/31/2027.

PAYMENT SCHEDULE:

1 Gbps Fiber Connection with 1 Gbps Bandwidth – 5 year

Product Details Quantity One-Time Price

Total One- Time

Recurring Price

Total Recurring

Setup & Installation

1 $76,680.00 $76,680.00 $0.00 $0.00

Setup & Installation – Discount

1 ($68,900.00) ($68,900.00) $0.00 $0.00

Startup Allowance

1 ($7,030.00) ($7,030.00) $0.00 $0.00

Contracted Bandwidth – 1 Gbps

1 $0.00 $0.00 $17,100.00 $17,100.00

Network Access 1 $0.00 $0.00 $2,250.00 $2,250.00

Annual Recurring Total: $19,350.00

One-Time Total: $750.00

IT CHANGE NOTICE

Version 2 (3/2021) 2

One-Time Summary

Description Amount

1 Gbps Fiber Connection with 1 Gbps Bandwidth – 5 Year $750.00

Non- Recurring Total: $750.00

Annual Recurring Expenses Summary

Description Amount

1 Gbps Fiber Connection with 1 Gbps Bandwidth – 5 Year $19,350.00

Annual Recurring Total: $19,350.00

Payment will be made on an annual basis. DTMB will pay CONTRACTOR upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment. The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

IT CHANGE NOTICE

Version 2 (3/2021) 3

PROJECT CONTACTS:

The designated Agency Project Manager is:

Stephanie Jeppesen DTMB – Michigan Cybersecurity

(517) 245-5693 JeppesenS@michigan.gov

The designated DTMB Project Manager is:

Meghan Penny DTMB – Chief Technology Office

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number 071B5500025. This purchase order, statement of work, and the terms and conditions of Contract Number 071B5500025 constitute the entire agreement between the State and the Contractor.

mailto:JeppesenS@michigan.gov mailto:PennyM2@michigan.gov

IT CHANGE NOTICE

Version 2 (3/2021) 1

Project Title:

Selfridge Airforce Base Internet Service Renewal – 3 Year

Period of Coverage:

10/01/2024 – 10/31/2027

Requesting Department:

DTMB – Chief Technology Office

Date:

3/1/2025

Agency Project Manager:

Stephanie Jeppesen

Phone:

(517) 335-6899

DTMB Project Manager:

Meghan Penny

Merit has been providing Internet access services, optional fee-services, and other mutually agreed-upon services to Selfridge Air Force Base, and they are going to continue these services for the next 3 years through 09/30/2027.

PAYMENT SCHEDULE:

Product Details Amount

Network Access – 10/01/2024 – 09/30/2025 $10,704.00

1.0 Gbps Contracted Bandwidth with 1 Gbps Fiber Connection – 10/01/2024 – 09/30/2025 $18,000.00

Network Access – 10/01/2025 – 9/30/2026 $10,704.00

1.0 Gbps Contracted Bandwidth with 1 Gbps Fiber Connection – 10/01/2025 – 09/30/2026 $18,000.00

Network Access – 10/01/2026 – 09/30/2027 $10,704.00

1.0 Gbps Contracted Bandwidth with 1 Gbps Fiber Connection – 10/01/2026 – 09/30/2027 $18,000.00

Non-Recurring Total $0.00

Annual Recurring Total $28,704.00

State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment. The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

IT CHANGE NOTICE

Version 2 (3/2021) 2

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

EXPENSES:

PROJECT CONTACTS:

The designated Agency Project Manager is:

Stephanie Jeppesen DTMB – Michigan Cybersecurity

(517) 245-5693 JeppesenS@michigan.gov

The designated DTMB Project Manager is:

Meghan Penny DTMB – Chief Technology Office working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number 071B5500025. This purchase order, statement of work, and the terms and conditions of Contract mailto:JeppesenS@michigan.gov mailto:PennyM2@michigan.gov

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

November 1, 2014 October 31, 2019 5 - 12 Months October 31, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1000 Oakbrook Drive Suite 200

Ann Arbor MI 48104

Jameka Williams

(734) 527-5761 jamekaw@merit.edu

CV0025865

MERIT NETWORK INC

C O

N

TR

A C

TO

R

517-282-1272

PennyM2@michigan.gov

Lauren Stempek

(517) 243-4008

Meghan Penny DTMB

StempekL@Michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Net 45n/a

Change Notice Number 20

Contract Number MA071B5500025C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Months 3 Years October 31, 2027

$10,236,237.50 $950,000.00 $11,186,237.50

DESCRIPTION

Effective 10/30/2024, the State is adding $950,000.00 in funding and three option years to this contract through Chapter 5.7.6 of procurement policy for useful life. The State is executing all 3 options now making the new expiration date 10/31/2027.

Please note that the Program Manager for the State has been updated to Meghan Penny.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Procurement approval, and State Administrative Board approval on 10/29/2024.

Effective 10/30/2024, this Contract is amended as provided in this Change Notice No. 20 to Contract No. 071B5500025. All other terms, conditions, pricing and specifications remain the same.

Section 1.601 is revised so that the following provision is hereby deleted from Section 1.601 in its entirety:

Method of Payment The Contractors will be paid by the methods listed in the SOW.

Section 2.001 is hereby deleted in its entirety and replaced with the following:

2.001 CONTRACT TERM

All outstanding Purchase Orders must also expire upon the termination for any of the reasons listed in Section 2.150 of the Contract, unless otherwise extended under the Contract. Absent an early termination for any reason, Purchase Orders issued but not expired, by the end of the Contract’s stated term, shall remain in effect for the balance of the fiscal year for which they were issued. The Term of this Contract is extended until 10/31/2027.

Section 2.048 is hereby deleted in its entirety and replaced with the

2.048 ELECTRONIC PAYMENT REQUIREMENT

The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT). Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment.

The following Section 2.102a is hereby added to the Contract as follows:

2.102a STATE DATA.

1. Ownership. The State’s data (“State Data),” which will be treated by Contractor as Confidential Information) includes (a) User Data; (b) all data http://www.michigan.gov/SIGMAVSS made available to Contractor during the Term, including but not limited to all text, sound, video, image files, or software; and (c) any other data collected, used, Processed, stored, or generated in connection with the Services, including but not limited to

i. personally identifiable information (“PII”) collected, used, Processed, stored, or generated as the result of the Services, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed, and

ii. protected health information (“PHI”) collected, used, Processed, stored, or generated as the result of the Services, which is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and its related rules and regulations.

2. State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State.

3. Contractor’s Use of State Data. Contractor is provided a limited license to State Data for the sole and exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Services. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Contract and applicable law; (c) keep and maintain State Data in the continental United States; and (d) not use, sell, rent, transfer, mine, distribute, commercially exploit, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent.

Contractor’s misuse of State Data may violate state or federal laws, including but not limited to MCL 752.795.

4. Loss or Compromise of State Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable:

i. (a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence;

ii. (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State;

iii. in the case of PII or PHI, at the State’s sole election:

1. with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within 5 calendar days of the occurrence; or

2. reimburse the State for any costs in notifying the affected individuals;

iv. in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than 24 months following the date of notification to such individuals;

v. (c) perform or take any other actions required to comply with applicable law as a result of the occurrence;

vi. (d) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution;

vii. (e) pay for any costs associated with required notification and credit monitoring to affected individuals; and

viii. (f) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence;

ix. be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State; and

x. provide to the State a detailed plan within 10 calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum:

name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery. Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination.

xi. The parties agree that any damages relating to a breach of this Section 20 are to be considered direct damages and not consequential damages.

5. Third-Party Requests. Contractor will immediately notify the State upon receipt of any third-party requests which in any way might reasonably require access to State Data. Contractor will notify the State Program Managers or their designees by the fastest means available and also in writing. Contractor must provide such notification within twenty-four (24) hours from Contractor’s receipt of the request. Contractor will not respond to subpoenas, service of process, FOIA requests, and other legal requests related to the State without first notifying the State. Upon request by the State, Contractor must provide to the State, its proposed response to the third-party request with adequate time for the State to review, and, as it deems necessary, to revise the response, object, or take other action.

6. “User Data” means all data, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, Processed, generated or output by any device, system or network by or on behalf of the State, including any and all works, inventions, data, analyses and other information and materials resulting from any use of the Software by or on behalf of the State under this Contract.

The following Section 2.102b is hereby added to the Contract as follows:

2.102b DATA PRIVACY

1. Data Privacy and Information Security. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in Schedule E to this Contract.

2. Schedule E is hereby added to this Contract and incorporated by reference.

3. “Process” means to perform any operation or set of operations on any data, information, material, work, expression or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or (c) block, erase or destroy.

“Processing” and “Processed” have correlative meanings.

The following subsection (o) is hereby added to Section 2.121 WARRANTIES AND REPRESENTATIONS, as follows:

(o) Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606.

Section 2.201 is hereby deleted in its entirety and replaced with the

2.201 NONDISCRIMINATION.

Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position. Breach of this covenant is a material breach of the Contract.

The following Section 2.201a is hereby added to the Contract, as follows:

2.201a ACCESSIBILITY REQUIREMENTS.

i. All Deliverables created or provided by Contractor under this Contract, including associated content and documentation, must at all times conform to the Digital Accessibility Standards. Contractor must provide a completed PAT for each such deliverable provided under the Contract.

All “Not Applicable" or “N/A” responses to the specifications, if any, must be fully explained. A description of the evaluation methods used to support such conformance claims, including, if applicable, any third-party testing, must be provided. Throughout the Term of the Contract, at no additional costs to the State, Contractor must:

1. promptly respond to and resolve, in a manner acceptable to the State, any complaint the State receives regarding the accessibility of any Deliverable;

2. upon the State’s written request, provide Deliverables in one or more alternative formats and within timeframes specified by the State; and

3. participate in State of Michigan Digital Standards Review described below.

ii. State of Michigan Digital Standards Review. Prior to Deliverables being accepted, put into production, or as otherwise required by the State, the State may conduct a Digital Standards Review to assess their accessibility and compliance with the Digital Accessibility Standards.

Contractor must assist the State with each such review, including submitting documentation or other information regarding accessibility and compliance with the Digital Accessibility Standards. Contractor must, at its sole cost and expense, remediate all issues resulting from such review in a manner and timeframe accepted in writing by the State, which may include providing a remediation status report and updated PAT to the State and a re-assessment of accessibility.

iii. Warranty. Contractor warrants that all conformance claims regarding conformance to the Digital Accessibility Standards made by Contractor pursuant to this Contract, including all information provided in any PAT Contractor provides to the State, are true and correct. If the State determines such conformance claims provided by the Contractor represent a higher level of conformance than what is actually provided to the State, Contractor will, at its sole cost and expense, promptly remediate its Software to align with Contractor’s stated conformance claims in accordance with plans and timelines that are approved in writing by the State. If Contractor is unable to resolve such issues in a manner acceptable to the State, in addition to all other remedies available to the State, the State may terminate this Contract for cause.

iv. Indemnification. Contractor must, without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State arising out of Contractor’s failure to comply with the foregoing accessibility standard.

v. Failure to comply with the requirements in this Section will constitute a material breach of this Contract.

SCHEDULE E – DATA SECURITY

REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy.

In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400013002-Acceptable-Use-of-Information-Technology- Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an https://www.michigan.gov/dtmb/policies/it-policies alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, backed up in the United States, its territories or Canada;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

https://www.uptimeinstitute.com/ https://sam.gov/content/home

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Solution; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Solution; and (iii) unauthorized access to any of the State Data;

5.10 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.11 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.12 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

5.13 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State Systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least 5 Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s (if applicable) FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans as required by the State Web Application Security Standard and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Authenticated interactive scanning of application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must either a) grant the State the right to dynamically scan a deployed version of the Software; or b) in lieu of the State performing the scan, Contractor must dynamically scan a deployed version of the Software using a State approved application scanning tool, and provide the State with a vulnerabilities assessment after Contractor has completed such scan.

These scans and assessments i) must be completed and provided to the

State quarterly (dates to be provided by the State) and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans. These scans must be completed for all source code initially, for all updated source code, and for all source code for each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans.

9.3 Software Composition Analysis (SCA) – Third-Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third-party and open source software, all included third-party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third-party and open source software initially, for all updated third-party and open source software, and for all third party and open source software in each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans if not provided as part of SAST and/or DAST reporting.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 Contractor must ensure their infrastructure and applications are scanned using an approved scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly and provide the scan’s assessments to the State in a format that is specified by the State and used to track the remediation. Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements documented in the State’s PSPs.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Solution to meet the applicable requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 19 to

Contract Number 071B5500025

PennyM2@michigan.gov

Meghan Penny

Lauren Stempek jamekaw@merit.edu

Jameka Williams

Ann Arbor, MI 48104

MERIT NETWORK INC

CV0025865

(734) 527-5761

1000 Oakbrook Drive , Suite 200

(517) 243-4008 S

T A

T E

P ro g ra m a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-282-1272

DTMB

stempekl@michigan.gov

$9,831,467.50

November 1, 2014 October 31, 2024

INTERNET SERVICE PROVIDER

October 31, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

NET45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ October 31, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $9,831,467.50

Effective 8/7/2023, this contract is using $42,000.00 in existing funds to cover Cybersecurity Table Top Exercise services to be provided by Merit Network as described in the attached Statement of Work.

Please note that the Program Manager for the State has been changed to Meghan Penny.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

Program Managers for

CHANGE NOTICE NO. 19 TO CONTRACT NO. 071B5500025

Meghan Penny 517-282-1272 PennyM2@michigan.govDTMB

Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.govDTMB

Jayson Cavendish 517-243-8692 CavendishJ@michigan.govDTMB

IT CHANGE NOTICE

Version 2 (3/2021) 1

Project Title:

Cybersecurity Table Top Exercises Requesting Department:

DTMB – MCS

Agency Project Manager:

Stephanie Jeppesen

Phone:

517-245-5693

DTMB Project Manager:

Jayson Cavendish

517-243-8692

PROJECT OBJECTIVE:

Merit will provide Table Top Exercises that test and validate the State of Michigans ability to handle disaster response and recovery incidents, and execute procedures at an organization level.