STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 6 to Contract Number MA071B5500028C

C O

N

TR

A C

TO

R

FRONTIER COMMUNICATIONS OF

MICHIGAN INC

180S Clinton Ave

Rochester NY 14646-0001

Erick Gamble

231-724-5127

Erick.gamble@ftr.com

CV0029249

ST

A

TE

Pr og ra m

M an ag er

Jennifer Scriver DTMB

ScriverJ@michigan.gov

C on tr ac t A dm in is tr at or Mecca Martin DTMB

(517) 230-5694

MartinM42@michigan.gov

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE

November 1, 2014

INITIAL EXPIRATION DATE

October 31, 2019

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE

BEFORE

October 31, 2027

PAYMENT TERMS

n/a

DELIVERY TIMEFRAME

n/a

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

n/a

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

0 Years

REVISED EXP. DATE

CURRENT VALUE

$8,272,032.00

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$8,272,032.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 2/27/2026, the following amendment is incorporated into this Contract.

"Accessibility Requirements"

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites, applications, content, and electronic documents.

Due to a change in the law, the State is required to comply with specific accessibility standards for websites, applications, content and documents.

Starting 4/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level AA."

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Internet Service Provider

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

November 1, 2014 October 31, 2019 5 - 12 Months October 31, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

180S Clinton Ave

Rochester NY 14646-0001

Erick Gamble

231-724-5127

Erick.gamble@ftr.com

CV0029249

FRONTIER COMMUNICATIONS

CORPORATION

C O

N

TR

A C

TO

R

(517) 282-1272

PennyM2@michigan.gov

Lauren Stempek

(517) 243-4008

Meghan Penny DTMB

StempekL@Michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/an/a

Change Notice Number 5

Contract Number MA071B5500028C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Months 3 Years October 31, 2027

$8,122,032.00 $150,000.00 $8,272,032.00

DESCRIPTION

Effective 10/30/2024, the State is adding $150,000.00 in funding and three option years to this contract through Chapter 5.7.6 of procurement policy for useful life. The State is executing all 3 options now making the new expiration date 10/31/2027. Additionally, this contract hereby updates the attached terms and conditions to this contract.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Procurement approval, and State Administrative Board approval on 10/29/2024.

Michigan.gov/MiProcurement

Effective 10/30/2024, this Contract is amended as provided in this Change Notice No. 5 to Contract No. 071B5500028. All other terms, conditions, pricing and specifications remain the same.

Section 1.601 is revised so that the following provision is hereby deleted from Section 1.601 in its entirety:

Method of Payment The Contractors will be paid by the methods listed in the SOW.

Section 2.001 is hereby deleted in its entirety and replaced with the following:

2.001 CONTRACT TERM

All outstanding Purchase Orders must also expire upon the termination for any of the reasons listed in Section 2.150 of the Contract, unless otherwise extended under the Contract. Absent an early termination for any reason, Purchase Orders issued but not expired, by the end of the Contract’s stated term, shall remain in effect for the balance of the fiscal year for which they were issued. The Term of this Contract is extended until 10/31/2027.

Section 2.048 is hereby deleted in its entirety and replaced with the

2.048 ELECTRONIC PAYMENT REQUIREMENT

The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT). Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment.

The following Section 2.102a is hereby added to the Contract as follows:

2.102a State Data.

1. Ownership. The State’s data (“State Data,” which will be treated by Contractor as Confidential Information) includes (a) User Data; (b) all data made available to Contractor during the Term, including but not http://www.michigan.gov/SIGMAVSS limited to all text, sound, video, image files, or software; and (c) any other data collected, used, Processed, stored, or generated in connection with the Services, including but not limited to

i. personally identifiable information (“PII”) collected, used, Processed, stored, or generated as the result of the Services, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed, and

ii. protected health information (“PHI”) collected, used, Processed, stored, or generated as the result of the Services, which is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and its related rules and regulations.

2. State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State.

3. Contractor’s Use of State Data. Contractor is provided a limited license to State Data for the sole and exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Services. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Contract and applicable law; (c) keep and maintain State Data in the continental United States; and (d) not use, sell, rent, transfer, mine, distribute, commercially exploit, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent.

Contractor’s misuse of State Data may violate state or federal laws, including but not limited to MCL 752.795.

4. Loss or Compromise of State Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable:

i. (a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence;

ii. (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State;

iii. in the case of PII or PHI, at the State’s sole election:

1. with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within 5 calendar days of the occurrence; or

2. reimburse the State for any costs in notifying the affected individuals;

iv. in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than 24 months following the date of notification to such individuals;

v. (c) perform or take any other actions required to comply with applicable law as a result of the occurrence;

vi. (d) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution;

vii. (e) pay for any costs associated with required notification and credit monitoring to affected individuals; and

viii. (f) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence;

ix. be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State; and

x. provide to the State a detailed plan within 10 calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum:

name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery. Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination.

xi. The parties agree that any damages relating to a breach of this Section 20 are to be considered direct damages and not consequential damages.

5. Third-Party Requests. Contractor will immediately notify the State upon receipt of any third-party requests which in any way might reasonably require access to State Data. Contractor will notify the State Program Managers or their designees by the fastest means available and also in writing. Contractor must provide such notification within twenty-four (24) hours from Contractor’s receipt of the request. Contractor will not respond to subpoenas, service of process, FOIA requests, and other legal requests related to the State without first notifying the State. Upon request by the State, Contractor must provide to the State, its proposed response to the third-party request with adequate time for the State to review, and, as it deems necessary, to revise the response, object, or take other action.

6. “User Data” means all data, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, Processed, generated or output by any device, system or network by or on behalf of the State, including any and all works, inventions, data, analyses and other information and materials resulting from any use of the Software by or on behalf of the State under this Contract.

I. The following provision is added as a new section 2.102b

1. Data Privacy and Information Security. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in Schedule E to this Contract.

2. Schedule E is added to this Contract.

3. “Process” means to perform any operation or set of operations on any data, information, material, work, expression or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or (c) block, erase or destroy.

“Processing” and “Processed” have correlative meanings.

The following subsection (o) is hereby added to Section 2.121 WARRANTIES AND REPRESENTATIONS, as follows:

(o) Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606.

Section 2.201 is hereby deleted in its entirety and replaced with the

2.201 NONDISCRIMINATION.

Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position. Breach of this covenant is a material breach of the Contract.

The following Section 2.201a is hereby added to the Contract, as follows:

2.201a ACCESSIBILITY REQUIREMENTS.

i. All Deliverables created or provided by Contractor under this Contract, including associated content and documentation, must at all times conform to the Digital Accessibility Standards. Contractor must provide a completed PAT for each such deliverable provided under the Contract.

All “Not Applicable" or “N/A” responses to the specifications, if any, must be fully explained. A description of the evaluation methods used to support such conformance claims, including, if applicable, any third-party testing, must be provided. Throughout the Term of the Contract, at no additional costs to the State, Contractor must:

1. promptly respond to and resolve, in a manner acceptable to the State, any complaint the State receives regarding the accessibility of any Deliverable;

2. upon the State’s written request, provide Deliverables in one or more alternative formats and within timeframes specified by the State; and

3. participate in State of Michigan Digital Standards Review described below.

ii. State of Michigan Digital Standards Review. Prior to Deliverables being accepted, put into production, or as otherwise required by the State, the State may conduct a Digital Standards Review to assess their accessibility and compliance with the Digital Accessibility Standards.

Contractor must assist the State with each such review, including submitting documentation or other information regarding accessibility and compliance with the Digital Accessibility Standards. Contractor must, at its sole cost and expense, remediate all issues resulting from such review in a manner and timeframe accepted in writing by the State, which may include providing a remediation status report and updated PAT to the State and a re-assessment of accessibility.

iii. Warranty. Contractor warrants that all conformance claims regarding conformance to the Digital Accessibility Standards made by Contractor pursuant to this Contract, including all information provided in any PAT Contractor provides to the State, are true and correct. If the State determines such conformance claims provided by the Contractor represent a higher level of conformance than what is actually provided to the State, Contractor will, at its sole cost and expense, promptly remediate its Software to align with Contractor’s stated conformance claims in accordance with plans and timelines that are approved in writing by the State. If Contractor is unable to resolve such issues in a manner acceptable to the State, in addition to all other remedies available to the State, the State may terminate this Contract for cause.

iv. Indemnification. Contractor must, without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State arising out of Contractor’s failure to comply with the foregoing accessibility standard.

v. Failure to comply with the requirements in this Section will constitute a material breach of this Contract.

SCHEDULE E – DATA SECURITY

REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy.

In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400013002-Acceptable-Use-of-Information-Technology- Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an https://www.michigan.gov/dtmb/policies/it-policies alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, backed up in the United States, its territories or Canada;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

https://www.uptimeinstitute.com/ https://sam.gov/content/home

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Solution; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Solution; and (iii) unauthorized access to any of the State Data;

5.10 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.11 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.12 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

5.13 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State Systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least 5 Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s (if applicable) FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans as required by the State Web Application Security Standard and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Authenticated interactive scanning of application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must either a) grant the State the right to dynamically scan a deployed version of the Software; or b) in lieu of the State performing the scan, Contractor must dynamically scan a deployed version of the Software using a State approved application scanning tool, and provide the State with a vulnerabilities assessment after Contractor has completed such scan.

These scans and assessments i) must be completed and provided to the

State quarterly (dates to be provided by the State) and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans. These scans must be completed for all source code initially, for all updated source code, and for all source code for each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans.

9.3 Software Composition Analysis (SCA) – Third-Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third-party and open source software, all included third-party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third-party and open source software initially, for all updated third-party and open source software, and for all third party and open source software in each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans if not provided as part of SAST and/or DAST reporting.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 Contractor must ensure their infrastructure and applications are scanned using an approved scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly and provide the scan’s assessments to the State in a format that is specified by the State and used to track the remediation. Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements documented in the State’s PSPs.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Solution to meet the applicable requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 4 to

Contract Number 071B5500028

PennyM2@michigan.gov

Meghan Penny

Lauren Stempek erick.gamble@ftr.com

Erick Gamble

Rochester, NY 14646-0001

FRONTIER COMMUNICATIONS CORPORATION

CV0001247

231-724-5127

180S Clinton Ave

(517) 243-4008 S

T A

T E

P ro g ra m

M a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-282-1272

DTMB

stempekl@michigan.gov

$8,122,032.00

November 1, 2014 October 31, 2023

INTERNET SERVICE PROVIDER

October 31, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☒ P-Card ☒ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 12 - Month ☐ October 31, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $8,122,032.00

Effective 8/24/2023, the State is executing the final available option year on this contract. The revised contract expiration date is 10/31/2024.

Please note that for the State the Contract Administrator has been changed to Lauren Stempek and the Program Manager has been changed to Meghan Penny.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

DTMB

AGENCY NAME PHONE EMAIL

Multi-Agency and Statewide Contracts

Program Managers for

CHANGE NOTICE NO. 4 TO CONTRACT NO. 071B5500028

Meghan Penny 517-282-1272 PennyM2@michigan.govDTMB

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 3 to

071B5500028Contract Number

AdrianA1@michigan.gov

Ashley Adrian

KeriAnn Trumble erick.gamble@ftr.com

Erick Gamble

Rochester, NY 14646-0001

FRONTIER COMMUNICATIONS CORPORATION

CV0001247

231-724-5127

180S Clinton Ave

989-259-2625 S

T A

T E

P ro g ram an ag er C o n tract A d m in istrato r

C O

N T

R A

C T

O R

517-525-9338

DTMB

trumblek1@michigan.gov

$8,122,032.00

November 1, 2014 October 31, 2021

INTERNET SERVICE PROVIDER

October 31, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☒ P-Card ☒ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 2 - 1 year options ☐ October 31, 2023

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $8,122,032.00

Effective 7/22/2021, the State is exercising the third and fourth of 5 available option years. The revised contract expiration date is October 31, 2023.

Please note the Contract Administrator has been changed to KeriAnn Trumble and the Vendor Contact has been updated to Erick Gamble.

All other terms, conditions, specifications, and pricing remain the same. Per contractor, agency, and DTMB Central Procurement approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

DTMB

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to

071B5500028Contract Number

AdrianA1@michigan.gov

Ashley Adrian

Jordan Sherlock bill.ives@ftr.com

Bill Ives

Rochester, NY 14646-0001

FRONTIER COMMUNICATIONS CORPORATION

CV0001247

517-315-7909

180S Clinton Ave

517-243-5556 S T A T E

P ro g ra m a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

517-525-9338

DTMB

sherlockj@michigan.gov

$8,122,032.00

November 1, 2014 October 31, 2019

INTERNET SERVICE PROVIDER

October 31, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 24 Months ☐ October 13, 2021

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $8,122,032.00

Effective 10/14/2019 the State is exercising (2) option years. The new expiration date is 10/13/2021. Please note that the Contract Administrator has been changed to Jordan Sherlock, and the Program Manager has been changed to Ashley Adrian.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Procurement approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

Form No. DTMB-3522 (Rev. 4/2012) AUTHORITY: Act 431 of 1984 COMPLETION: Required PENALTY: Contract will not be executed unless form is filed

DEPARTMENT OF TECHNOLOGY, MANAGEMENT AND BUDGET

PROCUREMENT

P.O. BOX 30026, LANSING, MI 48909

OR

525 W. ALLEGAN, LANSING, MI 48933

CONTRACT NO. 071B5500028

between

THE STATE OF MICHIGAN

and

NAME & ADDRESS OF CONTRACTOR: PRIMARY CONTACT EMAIL

Frontier Communications of America, Inc.

Bill Ives Bill.ives@ftr.com

180 S. Clinton Ave. TELEPHONE CONTRACTOR #, MAIL CODE

Rochester, NY 14646-0001 (517) 315-7909

STATE CONTACTS AGENCY NAME PHONE EMAIL

CONTRACT COMPLIANCE

INSPECTOR: DTMB Scott Hall 517-241-4255 Halls9@michigan.gov

BUYER: DTMB Mike Breen 517-284-7002 breenm@michigan.gov

CONTRACT SUMMARY:

DESCRIPTION:

Enterprise Internet Service Provider

INITIAL TERM EFFECTIVE DATE INITIAL EXPIRATION DATE AVAILABLE OPTIONS

5 years November 1, 2014 October 31, 2019 5, one year

PAYMENT TERMS F.O.B SHIPPED SHIPPED FROM

N/A N/A N/A N/A

ALTERNATE PAYMENT OPTIONS: AVAILABLE TO MiDEAL PARTICIPANTS

P-card Direct Voucher (DV) Other YES NO

MINIMUM DELIVERY REQUIREMENTS:

N/A

MISCELLANEOUS INFORMATION:

N/A

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION: $8,122,032.00

AUTHORITY: Act 431 of 1984 COMPLETION: Required PENALTY: Contract will not be executed unless form is filed

DEPARTMENT OF TECHNOLOGY, MANAGEMENT AND BUDGET

PROCUREMENT

P.O. BOX 30026, LANSING, MI 48909

OR

525 W. ALLEGAN, LANSING, MI 48933

CONTRACT NO. 071B5500028

between

THE STATE OF MICHIGAN

and

NAME & ADDRESS OF CONTRACTOR: PRIMARY CONTACT EMAIL

Frontier Communications of America, Inc.

Bill Ives Bill.ives@ftr.com

180 S. Clinton Ave. TELEPHONE CONTRACTOR #, MAIL CODE

Rochester, NY 14646-0001 (517) 315-7909

STATE CONTACTS AGENCY NAME PHONE EMAIL

CONTRACT COMPLIANCE

INSPECTOR: DTMB Scott Hall 517-241-4255 Halls9@michigan.gov

BUYER: DTMB Mike Breen 517-284-7002 breenm@michigan.gov

CONTRACT SUMMARY:

DESCRIPTION:

Enterprise Internet Service Provider

INITIAL TERM EFFECTIVE DATE INITIAL EXPIRATION DATE AVAILABLE OPTIONS

5 years November 1, 2014 October 31, 2019 5, one year

PAYMENT TERMS F.O.B SHIPPED SHIPPED FROM

N/A N/A N/A N/A

ALTERNATE PAYMENT OPTIONS: AVAILABLE TO MiDEAL PARTICIPANTS

P-card Direct Voucher (DV) Other YES NO

MINIMUM DELIVERY REQUIREMENTS:

N/A

MISCELLANEOUS INFORMATION:

N/A

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION: $8,122,032.00

THIS IS NOT AN ORDER: This Contract Agreement is awarded on the basis of our inquiry bearing the solicitation #084R4300003. Orders for delivery will be issued directly by the Department of Technology, Management & Budget through the issuance of a Purchase Order Form.

Notice of Contract #: 071B5500028

FOR THE CONTRACTOR: FOR THE STATE:

Frontier Communications of America, Inc.

Firm Name Signature Bill Pemble, IT Division Director

Authorized Agent Signature Name/Title

DTMB Procurement Authorized Agent (Print or Type) Enter Name of Agency

Date Date

Table of Contents

Article 1 – Statement of Work (SOW) 8

1.000 Project Identification 8

1.001 Project Request 8

1.002 Background 8

1.100 Scope of Work and Deliverables 8

1.101 In Scope 8

1.102 Out Of Scope 8

1.103 Environment 9

1.104 Work and Deliverables – WAN Service Provider(s) 10

1.104 Work and Deliverables – Enterprise Internet Service Provider(s) 16

1.200 Roles and Responsibilities 21

1.201 Contractor Staff, Roles, and Responsibilities 21

1.202 State Staff, Roles, and Responsibilities 22

1.203 Other Roles and Responsibilities 23

1.300 Contract Management 23

1.301 Contract Management 23

1.302 Reports 24

1.400 Project Management 24

1.401 RESERVED 24

1.402 Risk Management 24

1.500 Acceptance 25

1.501 Criteria 25

1.502 Final Acceptance 25

1.600 Compensation and Payment 25

1.601 Compensation and Payment 25

1.602 Reserved 26

2.000 Contract Structure and Term 27

2.001 Contract Term 27

2.002 Options to Renew 27

2.003 Legal Effect 27

2.004 Attachments & Exhibits 27

2.005 Ordering 28

2.006 Order of Precedence 28

2.007 Headings 28

2.008 Form, Function & Utility 28

2.009 Reformation and Severability 28

2.010 Consents and Approvals 28

2.011 No Waiver of Default 28

2.012 Survival 28

2.020 Contract Administration 29

2.021 Issuing Office 29

2.022 Contract Compliance Inspector 29

2.023 Project Manager 29

2.024 Change Requests 29

2.025 Notices 30

2.026 Binding Commitments 31

2.027 Relationship of the Parties 31

2.028 Covenant of Good Faith 31

2.029 Assignments 31

2.030 General Provisions 32

2.031 Administrative Fee and Reporting 32

2.032 Media Releases 32

2.033 Contract Distribution 32

2.034 Permits 32

2.035 Website Incorporation 32

2.036 Future Bidding Preclusion 32

2.037 Freedom of Information 32

2.038 Disaster Recovery 32

2.040 Financial Provisions 33

2.041 Fixed Prices for Services/Deliverables 33

2.042 Adjustments for Reductions in Scope of Services/Deliverables 33

2.043 Services/Deliverables Covered 33

2.044 Invoicing and Payment – In General 33

2.045 Pro-ration 33

2.046 Antitrust Assignment 34

2.047 Final Payment 34

2.048 Electronic Payment Requirement 34

2.050 Taxes 34

2.051 Employment Taxes 34

2.052 Sales and Use Taxes 34

2.060 Contract Management 34

2.061 Contractor Personnel Qualifications 34

2.062 Contractor Key Personnel 34

2.063 Re-assignment of Personnel at the State’s Request 35

2.064 Contractor Personnel Location 35

2.065 Contractor Identification 35

2.066 Cooperation with Third Parties 35

2.067 Contract Management Responsibilities 36

2.068 Contractor Return of State Equipment/Resources 36

2.070 Subcontracting by Contractor 36

2.071 Contractor full Responsibility 36

2.072 State Consent to delegation 36

2.073 Subcontractor bound to Contract 36

2.074 Flow Down 37

2.075 Competitive Selection 37

2.080 State Responsibilities 37

2.081 Equipment 37

2.082 Facilities 37

2.090 Security 37

2.091 Background Checks 37

2.100 Confidentiality 37

2.101 Confidentiality 37

2.102 Protection and Destruction of Confidential Information 38

2.103 PCI DATA Security Standard 38

2.104 Exclusions 38

2.105 No Implied Rights 38

2.106 Security Breach Notification 39

2.107 Respective Obligations 39

2.110 Records and Inspections 39

2.111 Inspection of Work Performed 39

2.112 Retention of Records 39

2.113 Examination of Records 39

2.114 Audit Resolution 39

2.115 Errors 39

2.120 Warranties 40

2.121 Warranties and Representations 40

2.122 Warranty of Merchantability 41

2.123 Warranty of Fitness for a Particular Purpose 41

2.124 Warranty of Title 41

2.125 Equipment Warranty 41

2.126 Equipment to be New 41

2.127 Prohibited Products 42

2.128 Consequences for Breach 42

2.130 Insurance 42

2.13.1 Liability Insurance 42

2.132 Subcontractor Insurance Coverage 44

2.133 Certificates of Insurance 44

2.140 Indemnification 45

2.141 General Indemnification 45

2.142 Code Indemnification 45

2.143 Employee Indemnification 45

2.144 Patent/Copyright Infringement Indemnification 45

2.145 Continuation of Indemnification Obligations 45

2.146 Indemnification Procedures 46

2.150 Termination/Cancellation 46

2.151 Notice and Right to Cure 46

2.152 Termination for Cause 46

2.153 Termination for Convenience 47

2.154 Termination for Non-Appropriation 47

2.155 Termination for Criminal Conviction 47

2.156 Termination for Approvals Rescinded 48

2.157 Rights and Obligations upon Termination 48

2.158 Reservation of Rights 48

2.160 Termination by Contractor 48

2.161 Termination by Contractor 48

2.170 Transition Responsibilities 49

2.171 Contractor Transition Responsibilities 49

2.172 Contractor Personnel Transition 49

2.173 Contractor Information Transition 49

2.174 Contractor Software Transition 49

2.175 Transition Payments 49

2.176 State Transition Responsibilities 49

2.180 Stop Work 49

2.181 Stop Work Orders 49

2.182 Cancellation or Expiration of Stop Work Order 50

2.183 Allowance of Contractor Costs 50

2.190 Dispute Resolution 50

2.191 In General 50

2.192 Informal Dispute Resolution 50

2.193 Injunctive Relief 51

2.194 Continued Performance 51

2.200 Federal and State Contract Requirements 51

2.201 Nondiscrimination 51

2.202 Unfair Labor Practices 51

2.203 Workplace Safety and Discriminatory Harassment 51

2.204 Prevailing Wage 51

2.210 Governing Law 52

2.211 Governing Law 52

2.212 Compliance with Laws 52

2.213 Jurisdiction 52

2.220 Limitation of Liability 52

2.221 Limitation of Liability 52

2.230 Disclosure Responsibilities 52

2.231 Disclosure of Litigation 52

2.232 Call Center Disclosure 53

2.233 Bankruptcy 53

2.240 Performance 54

2.241 Time of Performance 54

2.242 Service Level Agreement (SLA) 54

2.243 Liquidated Damages 54

2.244 Excusable Failure 55

2.250 Approval of Deliverables 55

2.251 Reserved 55

2.252 Reserved 56

2.253 Reserved 56

2.254 Process for Approval of Written Deliverables 56

2.255 Reserved 56

2.256 Reserved 56

2.260 Ownership 56

2.261 Ownership of Work Product by State 56

2.262 Vesting of Rights 56

2.263 Rights in Data 56

2.264 Ownership of Materials 57

2.270 State Standards 57

2.271 Existing Technology Standards 57

2.272 Acceptable Use Policy 57

2.273 Systems Changes 57

2.274 Electronic Receipt Processing Standard 57

2.280 Extended Purchasing Program 57

2.281 Extended Purchasing Program 57

2.290 Environmental Provision 58

2.291 Environmental Provision 58

2.300 Deliverables 59

2.301…