071B5500026.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 8 to Contract Number MA071B5500026C

C U

RREN

T C

O N

TRAC

TO

R

EVERSTREAM HOLDING COMPANY LLC

3950 Sparks Drive SE Grand Rapids MI 49546

Melissa Duke

517-862-2759 mduke@everstream.net

CV0014924

N

EW

C O

N

TRAC

TO

R

Bluebird Midwest, LLC dba Bluebird Fiber

9201 Ward Pkwy, Suite 300 Kansas City MO 64116

Melissa Duke

517-862-2759 melissa.duke@bluebirdfiber.com

CV0137168

STATE CONTACTS

Program

M anager

Various Various C ontract

Adm inistrator

Mecca Martin DTMB

(517) 230-5694

MartinM42@michigan.gov

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE

October 14, 2014

INITIAL EXPIRATION DATE

October 13, 2019

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE BEFORE

October 13, 2027

PAYMENT TERMS

n/a

DELIVERY TIMEFRAME

Net 45

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

n/a

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

0 Years

REVISED EXP. DATE

CURRENT VALUE

$3,446,800.00

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$3,446,800.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 5/20/2026, The DTMB Program Manager has changed to: Jennifer Scriver.

The following amendment is incorporated into this Contract per the language below:

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites, applications, content, and electronic documents. Due to a change in the law, the State is required to comply with specific accessibility standards for websites, applications, content, and documents.

Starting 4/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level AA.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 8 TO CONTRACT NO. MA071B5500026C

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

MDOS Kim Metzger 517-243-6717 MetzgerK@michigan.gov

MDOT Jason Bodell (989) 370-1526 BodellJ@michigan.gov

DTMB Jennifer Scriver 517-284-9230 ScriverJ@michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 13, 2019 5 - 12 Months October 13, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

3950 Sparks Drive SE

Grand Rapids MI 49546

Melissa Duke

517-862-2759 mduke@everstream.net

CV0014924

EVERSTREAM HOLDING COMPANY

LLC

C O

N

TR

A C

TO

R

Lauren Stempek

(517) 243-4008

DTMB

Various - Primary Ashley Adrian stempekl@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Net 45n/a

Change Notice Number 7

Contract Number MA071B5500026C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$3,414,800.00 $32,000.00 $3,446,800.00

DESCRIPTION

Effective 2/28/2025, the Michigan Department of State’s (MDOS) hereby adds $32,000.00 in funding to cover costs for the move to Everstream’s services at the Saint Johns branch per the attached quote.

Additionally, MDOS is adding a Program Manager as noted in the Program Manager table below.

Please note that the Program Manager for the State has been changed to Ashely Adrian.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

(517) 331-4622

AdrianA1@michigan.gov

AGENCY NAME PHONE EMAIL

DTMB Ashley Adrian 517-525-9338 AdrianA1@michigan.gov

MDOS Kim Metzger 517-243-6717 MetzgerK@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 7 TO CONTRACT NO. MA071B5500026C

Michigan.gov/MiProcurement

Version 2021-1 1 of 1

STATEMENT OF WORK -

IT CHANGE NOTICE

1087 S US Highway 27 A Location: Headend

Z Location: 1087 S US Highway 27 Ste A-19, Saint Johns, MI 48879

QTY Product Name Bandwidth (Mps)

Term Non- Recurring Charges

Monthly Recurring Charges

1.0 Dedicated Internet Access 100 36 $500.00 $875.00

1.0 IPv4 Blocks /30 (1 Gateway, 1 Usable)

36 $0.00

Total Monthly Recurring Charges: $31,500.00

Total Non-Recurring Charges: $500.00

Total Charges: $32,000.00

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number 071B5500026. This purchase order, statement of work, and the terms and conditions of Contract Number 071B5500026 constitute the entire agreement between the State and the Contractor.

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 13, 2019 5 - 12 Months October 13, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

3950 Sparks Drive SE

Grand Rapids MI 49546

Melissa Duke

517-862-2759 mduke@everstream.net

CV0014924

EVERSTREAM HOLDING COMPANY

LLC

C O

N

TR

A C

TO

R

Lauren Stempek

(517) 243-4008

DTMB

Various - Primary Meghan Penny stempekl@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Net 45n/a

Change Notice Number 6

Contract Number MA071B5500026C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$3,355,910.00 $58,890.00 $3,414,800.00

DESCRIPTION

Effective 12/30/2024, the Michigan Department of Transportation (MDOT) is adding $58,890.00 in funding to cover costs for the installation, operations, and maintenance of an EPLS circuit through the current expiration date of 10/31/2027 per the attached quote. Additionally, MDOT is adding a Program Manager as noted in the Program Manager table below.

All other terms, conditions, specifications and pricing remain the same. Per Contractor and Agency Agreement, and DTMB Central Procurement Services approval.

(517) 282-1272

PennyM2@Michigan.gov

DTMB Meghan Penny (517) 282-1272 PennyM2@michigan.gov

MDOT Jason Bodell (989) 370-1526 BodellJ@michigan.gov

Program Managers for

CHANGE NOTICE NO. 6 TO CONTRACT NO. MA071B5500026C

STATEMENT OF WORK -

IT CHANGE NOTICE

Version 2 (3/2021) 1

QTY Product Name Bandwidth (Mps)

Term Non- Recurring Charges

Monthly Recurring Charges

1.0 Point-to-Point 100 36 $36,750.00 $615.00

Total Monthly Recurring Charges: $615.00

Total Non-Recurring Charges: $36,750.00

Total Charges: $58,890.00

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number 071B5500026. This purchase order, statement of work, and the terms and conditions of Contract Number 071B5500026 constitute the entire agreement between the State and the Contractor.

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 13, 2019 5 - 12 Months October 13, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

3950 Sparks Drive SE

Grand Rapids MI 49546

Melissa Duke

517-862-2759 mduke@everstream.net

CV0014924

EVERSTREAM HOLDING COMPANY

LLC

C O

N

TR

A C

TO

R

(517) 282-1272

PennyM2@michigan.gov

Lauren Stempek

(517) 243-4008

Meghan Penny DTMB

StempekL@Michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Net 45n/a

Change Notice Number 5

Contract Number MA071B5500026C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Months 3 Years October 13, 2027

$2,555,910.00 $800,000.00 $3,355,910.00

DESCRIPTION

Effective 10/9/2024, the State is adding $800,000.00 in funding and three option years to this contract through Chapter 5.7.6 of procurement policy for useful life. The State is executing all 3 options now making the new expiration date 10/13/2027. Additionally, this contract hereby updates the attached terms and conditions to this contract.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Procurement approval, and State Administrative Board approval on 10/08/2024.

Effective 10/09/2024, this Contract is amended as provided in this Change Notice No. 5 to Contract No. 071B5500026. All other terms, conditions, pricing and specifications remain the same.

Section 1.601 is revised so that the following provision is hereby deleted from Section 1.601 in its entirety:

Method of Payment The Contractors will be paid by the methods listed in the SOW.

Section 2.001 is hereby deleted in its entirety and replaced with the following:

2.001 CONTRACT TERM

All outstanding Purchase Orders must also expire upon the termination for any of the reasons listed in Section 2.150 of the Contract, unless otherwise extended under the Contract. Absent an early termination for any reason, Purchase Orders issued but not expired, by the end of the Contract’s stated term, shall remain in effect for the balance of the fiscal year for which they were issued. The Term of this Contract is extended until 10/31/2027.

Section 2.048 is hereby deleted in its entirety and replaced with the

2.048 ELECTRONIC PAYMENT REQUIREMENT

The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT). Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment.

The following Section 2.102a is hereby added to the Contract as follows:

2.102a STATE DATA.

1. Ownership. The State’s data (“State Data,” which will be treated by Contractor as Confidential Information) includes (a) User Data; (b) all data made available to Contractor during the Term, including but not http://www.michigan.gov/SIGMAVSS limited to all text, sound, video, image files, or software; and (c) any other data collected, used, Processed, stored, or generated in connection with the Services, including but not limited to

i. personally identifiable information (“PII”) collected, used, Processed, stored, or generated as the result of the Services, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed, and

ii. protected health information (“PHI”) collected, used, Processed, stored, or generated as the result of the Services, which is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and its related rules and regulations.

iii. Notwithstanding the forgoing, Contractor may provide certain PII as required by the order of a court with proper jurisdiction.

2. State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State.

3. Contractor’s Use of State Data. Contractor is provided a limited license to State Data for the sole and exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Services. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Contract and applicable law; (c) keep and maintain State Data in the continental United States; and (d) not use, sell, rent, transfer, mine, distribute, commercially exploit, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent.

Contractor’s misuse of State Data may violate state or federal laws, including but not limited to MCL 752.795.

4. Loss or Compromise of State Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable:

i. (a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence;

ii. (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State;

iii. in the case of PII or PHI, at the State’s sole election:

1. with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within 5 calendar days of the occurrence; or

2. reimburse the State for any costs in notifying the affected individuals;

iv. in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than 24 months following the date of notification to such individuals;

v. (c) perform or take any other actions required to comply with applicable law as a result of the occurrence;

vi. (d) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution;

vii. (e) pay for any costs associated with required notification and credit monitoring to affected individuals; and

viii. (f) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence;

ix. be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State; and

x. provide to the State a detailed plan within 10 calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum:

name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery. Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination.

xi. The parties agree that any damages relating to a breach of this Section 20 are to be considered direct damages and not consequential damages.

5. Third-Party Requests. Contractor will immediately notify the State upon receipt of any third-party requests which in any way might reasonably require access to State Data. Contractor will notify the State Program Managers or their designees by the fastest means available and also in writing. Contractor must provide such notification within twenty-four (24) hours from Contractor’s receipt of the request. Contractor will not respond to subpoenas, service of process, FOIA requests, and other legal requests related to the State without notifying the State either prior to any such response, or if advance notice to the State is precluded by law or court order, as soon as it may become legally permissible. Upon request by the State, Contractor must provide to the State, its proposed response to the third-party request with adequate time for the State to review, and, as it deems necessary, to revise the response, object, or take other action.

6. “User Data” means all data, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, Processed, generated or output by any device, system or network by or on behalf of the State, including any and all works, inventions, data, analyses and other information and materials resulting from any use of the Software by or on behalf of the State under this Contract.

The following Section 2.102b is hereby added to the Contract as follows:

2.102b DATA PRIVACY

1. Data Privacy and Information Security. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in Schedule E to this Contract.

2. Schedule E is added to this Contract.

3. “Process” means to perform any operation or set of operations on any data, information, material, work, expression or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or (c) block, erase or destroy.

“Processing” and “Processed” have correlative meanings.

The following subsection (o) is hereby added to Section 2.121 WARRANTIES AND REPRESENTATIONS, as follows:

(o) Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606.

Section 2.201 is hereby deleted in its entirety and replaced with the

2.201 NONDISCRIMINATION.

Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position. Breach of this covenant is a material breach of the Contract.

The following Section 2.201a is hereby added to the Contract, as follows:

2.201a ACCESSIBILITY REQUIREMENTS.

i. All Deliverables created or provided by Contractor under this Contract, including associated content and documentation, must at all times conform to the Digital Accessibility Standards. Contractor must provide a completed PAT for each such deliverable provided under the Contract.

All “Not Applicable" or “N/A” responses to the specifications, if any, must be fully explained. A description of the evaluation methods used to support such conformance claims, including, if applicable, any third-party testing, must be provided. Throughout the Term of the Contract, at no additional costs to the State, Contractor must:

1. promptly respond to and resolve, in a manner acceptable to the State, any complaint the State receives regarding the accessibility of any Deliverable;

2. upon the State’s written request, provide Deliverables in one or more alternative formats and within timeframes specified by the State; and

3. participate in State of Michigan Digital Standards Review described below.

ii. State of Michigan Digital Standards Review. Prior to Deliverables being accepted, put into production, or as otherwise required by the State, the State may conduct a Digital Standards Review to assess their accessibility and compliance with the Digital Accessibility Standards.

Contractor must assist the State with each such review, including submitting documentation or other information regarding accessibility and compliance with the Digital Accessibility Standards. Contractor must, at its sole cost and expense, remediate all issues resulting from such review in a manner and timeframe accepted in writing by the State, which may include providing a remediation status report and updated PAT to the State and a re-assessment of accessibility.

iii. Warranty. Contractor warrants that all conformance claims regarding conformance to the Digital Accessibility Standards made by Contractor pursuant to this Contract, including all information provided in any PAT Contractor provides to the State, are true and correct. If the State determines such conformance claims provided by the Contractor represent a higher level of conformance than what is actually provided to the State, Contractor will, at its sole cost and expense, promptly remediate its Software to align with Contractor’s stated conformance claims in accordance with plans and timelines that are approved in writing by the State. If Contractor is unable to resolve such issues in a manner acceptable to the State, in addition to all other remedies available to the State, the State may terminate this Contract for cause.

iv. Indemnification. Contractor must, without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State arising out of Contractor’s failure to comply with the foregoing accessibility standard.

Failure to comply with the requirements in this Section will constitute a material breach of this Contract.

SCHEDULE E – DATA SECURITY

REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy.

In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400013002-Acceptable-Use-of-Information-Technology- Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an https://www.michigan.gov/dtmb/policies/it-policies alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, backed up in the United States, its territories or Canada;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

https://www.uptimeinstitute.com/ https://sam.gov/content/home

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Solution; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Solution; and (iii) unauthorized access to any of the State Data;

5.10 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.11 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.12 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

5.13 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State Systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least 5 Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s (if applicable) FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans as required by the State Web Application Security Standard and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Authenticated interactive scanning of application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must either a) grant the State the right to dynamically scan a deployed version of the Software; or b) in lieu of the State performing the scan, Contractor must dynamically scan a deployed version of the Software using a State approved application scanning tool, and provide the State with a vulnerabilities assessment after Contractor has completed such scan.

These scans and assessments i) must be completed and provided to the

State quarterly (dates to be provided by the State) and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans. These scans must be completed for all source code initially, for all updated source code, and for all source code for each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans.

9.3 Software Composition Analysis (SCA) – Third-Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third-party and open source software, all included third-party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third-party and open source software initially, for all updated third-party and open source software, and for all third party and open source software in each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans if not provided as part of SAST and/or DAST reporting.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 Contractor must ensure their infrastructure and applications are scanned using an approved scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly and provide the scan’s assessments to the State in a format that is specified by the State and used to track the remediation. Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements documented in the State’s PSPs.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Solution to meet the applicable requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

October 14, 2014 October 13, 2019 5 - 12 Months October 13, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

3950 Sparks Drive SE

Grand Rapids MI 49546

Melissa Duke

517-862-2759 mduke@everstream.net

CV0014924

EVERSTREAM HOLDING COMPANY

LLC

C O

N

TR

A C

TO

R

Lauren Stempek

(517) 243-4008

Various - Primary

StempekL@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Net 45N/A

Change Notice Number 4

Contract Number MA071B5500026C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$2,525,880.00 $30,030.00 $2,555,910.00

DESCRIPTION

Effective 8/2/2024, The Michigan Department of State (MDOS) is adding $30,030.00 in funding to cover annual internet service at a new location, additionally MDOS is adding a Program Manger as noted in the Program Manager table below.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

Meghan Penny

(517) 282-1272

PennyM2@michigan.gov

DTMB Meghan Penny 517-282-1272 PennyM2@michigan.gov

MDOS Kim Metzger 517-243-6717 MetzgerK@michigan.gov

Program Managers for

CHANGE NOTICE NO. 4 TO CONTRACT NO. MA071B5500026C

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 3 to

071B5500026Contract Number

AdrianA1@michigan.gov

Ashley Adrian

KeriAnn Trumble lwilliams@everstream.net

Larry Williams

Grand Rapids, MI 49546

EVERSTREAM HOLDING COMPANY LLC

CV0014924

616-268-1956

3950 Sparks Drive SE

989-259-2625 S

T A

T E

P ro g ram an ag er C o n tract A d m in istrato r

C O

N T

R A

C T

O R

517-525-9338

DTMB

trumblek1@michigan.gov

$2,460,900.00

October 14, 2014 October 13, 2021

INTERNET SERVICE PROVIDER

October 13, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 3 years ☐ October 13, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$64,980.00 $2,525,880.00

Effective 7/8/2021, the State is exercising the 3 final option years and the contract is increased by $64,980.00 to cover recurring monthly fees for the 1G circuit. The revised expiration date is 10/13/2024.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

DTMB

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to

071B5500026Contract Number

AdrianA1@michigan.gov

Ashley Adrian

Jordan Sherlock smurphy@everstream.net

Sara Murphy

Grand Rapids, MI 49546

Everstream Holding Company LLC.

616-608-8944

3950 Sparks Drive SE

517-243-5556 S T A T E

P ro g ra m a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

517-525-9338

DTMB

sherlockj@michigan.gov

October 14, 2014 October 13, 2019October 13, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 24 Months ☐ October 13, 2021

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00

Effective 10/14/2019 the state is excersing 2 option years. The revised contract expiration date is 10/13/2021. Please note that the Contract Administrator has been updated to Jordan Sherlock, the Program Manager is now updated to Ashley Adrian, and the Vendor Contact is now Sara Murphy.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

DocuSign Envelope ID: E984F6F0-35C9-430F-9005-10E86290652C

Com link'

1515 Turf Lane

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

PO Box 30026 525 W. Allegan, Lansing, Ml 48933

CONTRACT CHANGE NOTICE

Change Notice Number 001 to

Contract Number 07185500026

Everstream Holding Company LLC.

1515 Turf Lane

East Lansing, Ml 48823-6393 East Lansing, Ml 48823

Andre Cooks Robert McGowan

517-679-7517 517-679-5079 (o) 517-749-4783 (c) acooks@comlink.net rmcgowan@everstream.net

9396 2132

DESCRIPTION: change vendor name and tax ID number. All other terms and conditions remain the same

Revised 4/6/2016

Form No. DTMB-3522 (Rev. 4/2012) AUTHORITY: Act 431 of 1984 COMPLETION: Required PENALTY: Contract will not be executed unless form is filed

DEPARTMENT OF TECHNOLOGY, MANAGEMENT AND BUDGET

PROCUREMENT

P.O. BOX 30026, LANSING, MI 48909

OR

525 W. ALLEGAN, LANSING, MI 48933

NOTICE OF

CONTRACT NO. 071B5500026

between

THE STATE OF MICHIGAN

and

NAME & ADDRESS OF CONTRACTOR: PRIMARY CONTACT EMAIL

ComLink Andre Cooks acooks@comlink.net

1515 Turf Lane TELEPHONE CONTRACTOR #, MAIL CODE

East Lansing, MI 48823-6393 (517) 679-7517

STATE CONTACTS AGENCY NAME PHONE EMAIL

CONTRACT COMPLIANCE

INSPECTOR: DTMB Scott Hall 517-241-4255 Halls9@michigan.gov

BUYER: DTMB Mike Breen 517-284-7002 breenm@michigan.gov

CONTRACT SUMMARY:

DESCRIPTION:

Enterprise Internet Service Provider

INITIAL TERM EFFECTIVE DATE INITIAL EXPIRATION DATE AVAILABLE OPTIONS

5 years October 14, 2014 October 13, 2019 5, one year

PAYMENT TERMS F.O.B SHIPPED SHIPPED FROM

N/A N/A N/A N/A

ALTERNATE PAYMENT OPTIONS: AVAILABLE TO MiDEAL PARTICIPANTS

P-card Direct Voucher (DV) Other YES NO

MINIMUM DELIVERY REQUIREMENTS:

N/A

MISCELLANEOUS INFORMATION:

N/A

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION: $2,460,900.00

AUTHORITY: Act 431 of 1984 COMPLETION: Required PENALTY: Contract will not be executed unless form is filed

DEPARTMENT OF TECHNOLOGY, MANAGEMENT AND BUDGET

PROCUREMENT

P.O. BOX 30026, LANSING, MI 48909

OR

525 W. ALLEGAN, LANSING, MI 48933

CONTRACT NO. 071B5500026

between

THE STATE OF MICHIGAN

and

NAME & ADDRESS OF CONTRACTOR: PRIMARY CONTACT EMAIL

ComLink Andre Cooks acooks@comlink.net

1515 Turf Lane TELEPHONE CONTRACTOR #, MAIL CODE

East Lansing, MI 48823-6393 (517) 679-7517

STATE CONTACTS AGENCY NAME PHONE EMAIL

CONTRACT COMPLIANCE

INSPECTOR: DTMB Scott Hall 517-241-4255 Halls9@michigan.gov

BUYER: DTMB Mike Breen 517-284-7002 breenm@michigan.gov

CONTRACT SUMMARY:

DESCRIPTION:

Enterprise Internet Service Provider

INITIAL TERM EFFECTIVE DATE INITIAL EXPIRATION DATE AVAILABLE OPTIONS

5 years October 14, 2014 October 13, 2019 5, one year

PAYMENT TERMS F.O.B SHIPPED SHIPPED FROM

N/A N/A N/A N/A

ALTERNATE PAYMENT OPTIONS: AVAILABLE TO MiDEAL PARTICIPANTS

P-card Direct Voucher (DV) Other YES NO

MINIMUM DELIVERY REQUIREMENTS:

N/A

MISCELLANEOUS INFORMATION:

N/A

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION: $2,460,900.00

THIS IS NOT AN ORDER: This Contract Agreement is awarded on the basis of our inquiry…