071B7700099.pdf

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

PRE-QUAL PROGRAM STORAGE PLATFORMS AND INFRASTRUCTURE

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 26, 2017 January 25, 2024 5 - 12 Months January 25, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

36555 Corporate Dr.

Suite 200

Farmington Hills MI 48331

Aaron Vogler

(231) 286-7706

Aaron.Vogler@dell.com

CV0000807

EMC CORPORATION

C O

N

TR

A C

TO

R

517-284-8450

MarroquinC@michigan.gov

Shannon Romein

517-898-8102

DTMB

Chris Marroquin DTMB

Romeins@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 11

Contract Number MA071B7700099C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$185,759,084.00 $0.00 $185,759,084.00

DESCRIPTION

Effective 2/7/2025, the following Change Order is amended to the Contract to update the pricing table in Change Notice 10. No additional funding is needed for this change as the cost remains the same.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

Dell Global Services

V003-20131008

REQUEST FOR CHANGE FORM

Dell Customer Communication - Confidential

GENERAL INFORMATION

RFC Number: 001 Revision Number: 001

Create Date: 1/6/2025 Revision Date: 2/6/2025

RFC Title: Dell Change Order CO01 for Incident Recovery – State of MI DTMB (Attorney General Office)

SOW/Contract Title

Client Residency – Incident Recovery Services

Customer or Vendor Name:

Name: Email: Phone:

Change Initiator:

(prepared by)

Name: Email: Phone:

Fina Coffey Fina_Coffey@dell.com 773-793-2036

SCOPE OF CHANGE

Reason for Change:

The One-time Charge was miscalculated, and Dell is unable to invoice for the final 5 PM hours.

Description of Desired Change:

Requesting permission to invoice the final 5 PM hours at a rate of $375.00, out of the One-Time Charge fee that was miscalculated.

Effect of Change: Funds will be used from the existing approved PO.

In the fields below, identify impact to Budget, Schedule, Quality, Quantity, Resources, and Cost; insert n/a if not applicable

Budget: Schedule: Quality:

$0.00 N/A N/A

Quantity: Resources: Cost:

1 Multiple Resources $0.00

Cost to be paid by:

State of MI DTMB (Attorney General

Office)

SIGNATURE

This Request for Change Form (“RFC”) is governed by and subject to the terms and conditions specified in Customer’s separately signed Statement of Work (the “SOW”) with Dell, dated November 13th, 2024 the “Agreement”. If applicable, the Agreement is incorporated by reference in it’s entirely into this RFC and the parties acknowledge having read and agree to be bound by the Agreement. In the event of a conflict or inconsistency between the provisions of this RFC and the provisions of the SOW are the Agreement, as the case may be, the provisions of this RFC will take precedence. Unless specified otherwise in the Reason for Change section, this RFC shall take effect on the latest signature date.

Signatures below evidence acceptance of the change details above

Dell Marketing L.P. State of MI DTMB (Attorney General Office)

Signature Signature:

Printed Name: Printed Name

Title: Title:

Date: Date:

mailto:Fina_Coffey@dell.com

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

PRE-QUAL PROGRAM STORAGE PLATFORMS AND INFRASTRUCTURE

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 26, 2017 January 25, 2024 5 - 12 Months January 25, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

36555 Corporate Dr.

Suite 200

Farmington Hills MI 48331

Aaron Vogler

(231) 286-7706

Aaron.Vogler@dell.com

CV0000807

EMC CORPORATION

C O

N

TR

A C

TO

R

517-284-8450

MarroquinC@michigan.gov

Shannon Romein

5178988102

DTMB

Chris Marroquin DTMB

RomeinS@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 10

Contract Number MA071B7700099C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$185,727,284.00 $31,800.00 $185,759,084.00

DESCRIPTION

Effective 11/8/2024, this Contract is hereby increased by $31,800.00 and the following amendment incorporated into the Contract for an incident response and recovery engagement for the Attorney General's Office.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

STATEMENT OF WORK (SOW)

Incident Response and Recovery Services

State of MI DTMB (Attorney General Office)

116 W Ottawa St

Lansing, MI 48933

SFDC #28412609

Dell Marketing L.P.

https://www.delltechnologies.com

State of MI DTMB 6 November 2024 SFDC # 28412609 Dell Technologies Confidential © Copyright 2024 Dell Technologies All rights reserved Page 2 of 14

Table of Contents

1 INTRODUCTION

2 SUMMARY OF SERVICE

3 ENGAGEMENT DETAILS

3.1 Incident Response and Recovery Scope of Services

3.1.1 Threat Containment and Eradication

3.1.2 Project Management

3.2 Project Timeline

3.3 Services Out of Scope

3.4 Assumptions

3.5 Customer Responsibilities

3.6 Service Hours

4 PRICING

4.1 Estimate Revisions

4.2 Expenses

4.3 Additional Pricing Terms

5 CHANGE MANAGEMENT PROCESS

6 OTHER PROVISIONS

7 SIGNATURES

Appendix A Supported Sites

SCHEDULE E – DATA SECURITY REQUIREMENTS

SCHEDULE E, ATTACHMENT 1 – CJIS

FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

© Copyright 2024 Dell Technologies All rights reserved Page 3 of 14

1 INTRODUCTION

“DT Services” Dell Marketing L.P.

“DT Services Address” One Dell Way, Round Rock, TX 78682, United States

“Customer” State of MI DTMB (Attorney General Office)

“Customer Address” 116 W Ottawa St

Lansing, MI 48933

“SOW” This Statement of Work.

“Services” The services as described in this SOW.

“Agreement”

This Statement of Work is subject to the terms within State of Michigan

Contract No. 071B700099 dated on or about January 2017, between

EMC Corporation and The State of Michigan. Capitalized terms used herein but not otherwise defined shall have the meanings ascribed to such terms in the Agreement. If the terms or conditions of this document conflict with the Agreement, the terms or conditions of Contract No.

071B700099 will control (unless otherwise expressly provided herein or in the Agreement) solely with respect to the Services obtained under this document. The purchase and/or licensing of any EMC products shall be governed by the terms of the Master Customer Agreement or other purchase agreement between the parties. EMC products cannot be purchased under the Agreement or this document. This document is entered into as of the date of the last signature below (“Effective Date”) and sets forth the terms under which STATE OF MICHIGAN (referred to as “SOM” or “Customer”) has engaged EMC Corporation (“EMC”) to provide the professional services described hereunder (the “Services”).

“Effective Date” The date of the last signature below.

“Term”

The term of this SOW will begin on the Effective Date and, unless terminated in accordance with this SOW or the Agreement, expires on the date that DT Services completes the provision of Services in accordance with this SOW.

“Deliverables” Any reports, time sheets, analyses, scripts, code, or other work results which have been delivered by DT Services to Customer within the framework of fulfilling obligations under the SOW.

“Primary Work Site” 116 W Ottawa St. Lansing, MI 48933

“Reference Number(s)” SFDC # 28412609

The terms “DT Services,” “DT Services Address,” “Customer,” “Customer Address,” “SOW,” “Services,” “Agreement,” “Effective Date,” and “Term” have the meanings indicated above. Capitalized terms used herein but not otherwise defined will have the meanings ascribed to such terms in the Agreement. To the extent that this SOW conflicts with the Agreement, the terms and conditions of this SOW shall control.

Prevailing terms will be construed as narrowly as possible to resolve the conflict while preserving as much

© Copyright 2024 Dell Technologies All rights reserved Page 4 of 14 of the non-conflicting terms as possible, including preserving non-conflicting provisions within the same paragraph, section, or sub-section.

The following appendices are attached hereto and incorporated by reference:

● Appendix A – Supported Sites

2 SUMMARY OF SERVICE

This SOW outlines the Services provided for a comprehensive incident response and recovery engagement following a suspected cyber security event. DT Services’ goal is to minimize damage by the malicious actor, eradicate the threat where possible, restore affected systems, and recover lost or compromised (encrypted) business-critical data while maintaining security and regulatory compliance.

3 ENGAGEMENT DETAILS

In connection with this SOW, DT Services will perform the Services as specifically described herein.

3.1 Incident Response and Recovery Scope of Services

DT Services will supply an Incident Recovery team to the Customer to function as supplemental resources in Customer’s current organization, working at the sole direction of the Customer, for the Supported sites identified in this SOW. The DT Services resources will facilitate and guide recovery efforts following the failure of drives in support of the Adult Case Tracking (ACT) system. If there is a need for additional skills and manpower beyond the Services in scope of this SOW, DT Services will seek to expand the team upon mutual agreement and via the Change Management process defined herein.

To aid the Customer in responding to the event, DT Services will provide the Customer with remote subject matter experts to facilitate and guide recovery efforts. Incident Recovery team resource roles in scope of this SOW are specified in Section 4 Pricing.

3.1.1 Threat Containment and Eradication

The Incident Recovery team participates in cyber recovery activities on behalf of or for the Customer, providing Customer with responsive expertise. The scenario descriptions below are provided as an example of common and/or frequent activities performed and are not intended to be prescriptive of any or all actions performed by the Incident Recovery team for this particular engagement. The list below is not exhaustive in either scope of a specific role or function, or in roles available as required.

Service activity Key components

EDR Deployment and/or Monitoring

DT Services leverages Endpoint Detection and Response (EDR) tools for continuous monitoring of endpoints for suspicious activity. This may include:

● Real-time analysis of system calls, network traffic, and file behavior.

● Alert generation for potential threats like malware execution, unauthorized access attempts, or data exfiltration.

● Investigation of high-priority alerts to determine the scope and nature of the threat.

● Threat Isolation – During the coverage hours of the engagement and where appropriate, DT Services may isolate compromised systems and accounts to prevent lateral movement of the attacker within the network.

© Copyright 2024 Dell Technologies All rights reserved Page 5 of 14

Service activity Key components

● Where the Customer does not have an incumbent platform or where a replacement is mutually agreed, DT Services can deploy and configure an interim solution.

Active Directory (AD) Threat Actor Eviction

DT Services may perform the following tasks:

● Account Analysis – Analyze all user accounts for suspicious activity and potential compromise.

● Password Reset – Implement a forced password reset for all user accounts.

● Kerberos Reset – Reset Kerberos tickets to prevent attackers from leveraging stolen credentials.

● Clean Domain Controller builds and replication configuration.

● Overall AD Structure Analysis – Review the AD structure for vulnerabilities and implement security best practices. This includes Group Policy Objects, use of group Managed Service Accounts, Organizational Unit hierarchy and structure, AD sites and Services site topology, and others.

● AD Rebuild – Rebuild the AD Domains and/or Forests if deemed necessary due to severe compromise.

Virtualization Environment Recovery

● Initial Host Analysis – Analyze the compromised Hypervisor hosts to understand the extent of the compromise.

● Host Rebuild – Rebuild compromised Hypervisor hosts with a clean operating system installation and security baselines applied.

● VMware vCenter Rebuild – Rebuild vCenter Server with security baselines applied.

● VMware vCenter Integration – Ensure proper communication between rebuilt vSphere hosts and vCenter for centralized management (if applicable).

● VMware environment security hardening.

● Hyper-V environment security hardening.

● VxRail – If applicable, collaborate with VxRail support for RSAR (Rapid System Assist and Restore) procedures.

● VM Restore/Creation – Support the restoration of virtual machines from backups or creation of new VMs based on Customer requirements.

Storage and Backup Logical Data Recovery

● Initial Assessment and Analysis – Conduct a thorough assessment of storage and backup infrastructure.

● Storage Appliance Rebuild – Rebuild the storage appliance with a clean operating system and security best practices implemented (if necessary).

● Filesystem Level Assessment and Recovery – Including partial file or volume recoveries where feasible.

● Hardening – Apply security hardening procedures to the storage infrastructure.

● Data Recovery Support – Analyze the feasibility of data recovery from various sources including virtual SAN storage, hard drives, and storage appliances.

- Support the recovery process by identifying and restoring lost data from backups, impacted local or virtual SAN storage.

- Implement appropriate data recovery techniques based on the identified storage media and damage level.

Firewall/Network Security

● Initial Assessment – Analyze firewall rules and network configuration to identify configuration gaps.

● Block IOCs – Block identified Indicators of Compromise (IOCs) at the network perimeter.

● Refine Ruleset – Review and refine firewall rules to enhance overall security posture.

● Limit Traffic – Implement controls to limit ingress and egress traffic to the environment.

● Appliance patching and Updates – Bring Network infrastructure to current patch levels to address vulnerabilities.

● Secure VPN / ZTNA deployment.

● Network Segmentation – Create new network segments to isolate critical systems and support the recovery effort if required.

© Copyright 2024 Dell Technologies All rights reserved Page 6 of 14

Service activity Key components

Breach Investigation (Forensics)

● Conduct a forensic investigation to determine the root cause of the attack from available evidence at the time of engagement, including:

- Timeline of events leading to the incident.

- Entry point used by the attacker.

- Data potentially accessed, exfiltrated, or compromised.

- Identification of attacker tools, techniques, and procedures (TTPs).

● Analyze logs and system events for evidence of malicious activity.

● Collect and analyze forensic evidence for potential legal or regulatory purposes, then provide to the customer for retention.

3.1.2 Project Management

DT Services will assign a single point of contact (“SPOC”) to manage the delivery of this engagement.

The following activities focus on managing the initiation, planning, execution, and closure of the project including coordinating delivery resources and communicating with the Customer.

The responsibilities of the SPOC will include:

● Ownership of all formal project-related communications between DT Services and Customer.

● Act as single point of contact for delivery of the Services.

● Maintain focus on time, cost, and scope.

● Facilitate change management as needed.

● Monitor the Services budget and invoices.

● Manage the Customer relationship.

● All Project management activities will be conducted remotely.

3.2 Project Timeline

DT Services anticipates the Services will span an initial estimated period of eighty (80) contiguous business hours. The actual schedule will be developed and agreed upon following project initialization.

The actual schedule may change as the project progresses, as the timeframe for incident response and recovery is impacted by the severity and complexity of the attack. Initial estimates will be revised as the nature of the breach and recovery plan is better understood. Any changes will be managed in accordance with the Change Management Process described below.

3.3 Services Out of Scope

For the avoidance of doubt, the parties acknowledge that the following activities are not included in the scope of this SOW.

1) Any services, tasks, or activities other than those specifically noted in this SOW.

2) The development of any intellectual property created solely and specifically for the Customer under this SOW.

3) Onsite delivery of Services; Services will be delivered entirely remotely.

The terms of this SOW do not confer on the Customer any warranties which are in addition to the warranties provided under the terms of the Agreement. The Customer may be able to purchase out of scope services at an additional charge and, upon request by Customer, DT Services will provide a proposal for such out of scope services, pursuant to the Change Management Process described below.

© Copyright 2024 Dell Technologies All rights reserved Page 7 of 14

3.4 Assumptions

DT Services has made the following specific assumptions while specifying the Services detailed in this

SOW:

1) Customer’s environment may include equipment that is out of warranty. Customer understands the risks of servicing affected equipment. There will be no escalation, hardware break/fix, or troubleshooting of any kind for equipment that does not have a valid warranty.

2) DT Services will provide the services at Customer’s request to the extent that resources are available.

3) No penalties included during the delivery of the services.

4) Customer can request additional resource(s) with similar skillset from the SPOC if needed.

Resources with different skillset will need to be requested via the Change Order process.

5) Any data recovery efforts performed by DT Services are best effort only; successful and complete data recovery is not guaranteed.

3.5 Customer Responsibilities

Customer will provide reasonable and timely cooperation to DT Services in its performance of the Services.

If the Customer fails to fulfill one or more of the following responsibilities, DT Services will be relieved of any schedule, milestone, or financial commitments associated with the Services. Customer agrees to the following specific responsibilities:

1) Promptly notifying DT Services in writing of a) any changes Customer makes to its information technology environment that may impact DT Services’ delivery of the Services; or b) business, organizational, security and technical issues that may have an impact on the performance and delivery of the Services. The Change Management Process will control any changes to the SOW following the notice.

2) Provide DT Services with any required consent necessary to perform the Services.

3) Maintain a current version of an anti-virus application continuously running on any system to which DT Services is given access and will scan all Deliverables and the media on which they are delivered. Customer will take reasonable back-up measures and, in particular, will provide for a daily back-up process and back-up the relevant data, software and programs before DT Services performs any work on Customer production systems.

4) Developing or providing documentation, material, and assistance to DT Services.

5) Unless this SOW specifically requires DT Services to provide a software license, Customer is responsible for any and all software licensing requirements. Unless otherwise directed by Customer in writing during the installation process, DT Services will “accept” on Customer’s behalf any and all electronic agreements provided with the installed hardware and/or software, including without limitation licenses, terms of sale, and other terms and conditions. Customer agrees that its purchase, license, and/or use of any hardware or software installed by DT Services under this SOW shall be subject to and governed by such electronic agreements to the same degree as if Customer had itself accepted the electronic agreements.

6) As required for successful delivery of the Services, Customer will provide DT Services personnel (at no cost to DT Services) reasonable and timely access to all required environments for the term of the SOW, including free, safe, and sufficient access to Customer's facilities and environment, including parking, remote access as required, internet access, ample working space, electricity, safety equipment (if applicable) and a local telephone line. A monitor or display, a mouse (or pointing device), and a keyboard must also be provided (at no cost to DT Services), if the system does not already include these items. Facilities and power must meet DT Services’ requirements for the products and Services purchased.

© Copyright 2024 Dell Technologies All rights reserved Page 8 of 14

7) Prior to the start of this SOW, indicate to DT Services in writing a person to be the single point of contact to ensure that all tasks can be completed within the specified time period (the “Customer Contact”). All Services communications will be addressed to the Customer Contact.

8) Customer Contact will have the authority to act for Customer in all aspects of the Services including bringing issues to the attention of the appropriate persons within Customer’s organization and resolving conflicting requirements. Customer Contact will ensure attendance by key Customer personnel at Customer meetings and Deliverable presentations. Customer Contact will ensure that any communication between Customer and DT Services is made through the SPOC. Customer Contact will obtain and provide project requirements, information, data, decisions, and approvals within one working day of the request, unless both parties agree to a different response time.

9) Providing technical points-of-contact, who have a working knowledge of the information technology components to be considered during the Services and have the authority to make business decisions (“Technical Contacts”). DT Services may request that meetings be scheduled with Technical Contacts.

10) Making appropriate service outage windows available for DT Services as needed.

11) The physical and network security of Customer environment.

12) Providing all documentation on DT Services standard templates unless both parties agree otherwise.

3.6 Service Hours

DT Services will perform the Services during a time mutually agreed upon by DT Services and Customer in writing as part of the operational documentation related to the Services.

4 PRICING

This section describes the methodology for calculating the charges for the Services provided under this SOW. Customer hereby agrees to pay such charges in accordance with the invoicing and payment terms of the Agreement and as further supplemented within this SOW. Except as otherwise mutually agreed to by Customer and DT Services, the total amount to be noted on the purchase order provided to DT Services for this SOW is: USD $31,800.00. If this SOW includes estimates, invoices will be based on actual usage or expenses incurred. Charges shall be as follows:

Program Initiation and Startup Charge

DT Services will invoice Customer upon Customer signature of the SOW the following one-time project initiation and startup charge:

One-Time Charge: USD $3,000.00

*Note: Program Initiation and Startup Charge One-Time Charge calculation based on QTY *13 Project Management resource hours.

Hourly Charges

DT Services will invoice Customer the applicable charges in accordance with this SOW. Charges for Services are based on the rate card detailed below. Customer agrees that this is DT Services’ good faith estimate of the total amount of the Services required and is not a fixed charge. Customer agrees that this does not guarantee the Services will be completed within a specific timeframe or price. The charges will be invoiced on a monthly basis based upon the actual number of hours expended by DT Services in the prior billing period multiplied by the applicable hourly rates as set forth in the table below.

© Copyright 2024 Dell Technologies All rights reserved Page 9 of 14

*Estimated Hours are based on multiple resources working simultaneously Hourly Service Rates Tab

Resource Title Service

Rate Estimated Hours Estimated Charge

Forensics Lead (Data Recovery) $405 60 $24,300

Project Manager $375 12* $4,500

Hourly Charges Estimated Total $28,800

Program Initiation and Startup Charge Total $3,000.00

Estimated Extended Total – PO Amount $31,800.00

4.1 Estimate Revisions

Should DT Services’ price estimate change because of a deviation in any assumption, engagement dependency, scope specification, or other provision of this SOW for which a change order as described in the Change Management Process section of this SOW does not already apply, DT Services will notify Customer and discuss any next steps. This may necessitate invoking the Change Management Process.

4.2 Expenses

Services will be delivered remotely. If Customer request an Engineer to be onsite, Customer will be responsible for any Service-related expenses including actual, reasonable, and necessary travel and living expenses DT Services incurs in connection with delivering the Services. Expenses are estimated at $1,900.00 per week per resource and will be invoiced by DT Services based on actual expenses incurred.

Expenses will be invoiced monthly.

4.3 Additional Pricing Terms

1) DT Services will exclusively use the Primary Work Site address listed in this SOW for any required taxation purposes.

2) The terms of this SOW shall be valid for thirty (30) calendar days following submission of the final version of this SOW to Customer. In the event this SOW is executed by Customer and returned to DT Services after such thirty (30) day period, DT Services may: (i) accept the SOW on the stated terms; or (ii) reject the SOW and provide Customer with a revised SOW setting forth any necessary updates to the terms of the previous SOW.

3) The price for the Services is based on Customer’s environment as disclosed to DT Services and on the basis that the information supplied is accurate and complete. If the assumptions and parameters used to develop the SOW are found to be incorrect or have changed, the Customer will notify DT Services in writing within five (5) business days. The parties agree to pursue resolution through the Change Management Process. If the parties fail to reach an agreement with respect to such incorrect assumptions or parameters, DT Services may terminate this SOW with notice to Customer.

4) Any timescales or plans presented in this document assume that Customer provides any required information and fulfils its other obligations as described in this SOW in a timely manner. If Customer fails to meet its obligations as set forth in this SOW, DT Services may adjust the timeline or costs with notice to Customer to address such delays or failure to meet obligations.

© Copyright 2024 Dell Technologies All rights reserved Page 10 of 14

5) If any of the volumetric assumptions used in this SOW, including, time on task, locations, service consumption, and/or configuration factors, relied upon by DT Services vary by +/- five (5%) percent, DT Services has the right to adjust the pricing to reflect such changes.

6) All prices are in USD and are exclusive of all applicable taxes.

7) During the delivery of the Services, if Customer requires changes to a scheduled DT Services activity, as defined by prior agreement or as documented in the agreed DT Services delivery schedule/plan, with less than five (5) business days’ notice to DT Services in writing, additional charges will apply where DT Services are unable to re-assign people associated with that activity.

The Change Management Process will be used to determine the impact, if any, and any related price adjustments. If the parties don’t reach an agreement on a new schedule within three (3) months, Customer will reimburse DT Services for its reasonable additional costs of providing the Services and out of pocket expenses for such efforts to the extent attributable to the cancellation.

8) For Services performed based on hourly rates, estimates by resource are provided for planning purposes only. Estimated hourly allocations may be redistributed from one resource to another within the confines of the estimated total defined in this section without requiring Customer pre-approval. Resource(s) assigned to this project are full time and as such are expected to work a minimum of eight (8) hours per day, per assigned individual, unless mutually agreed.

9) DT Services will invoice Customer no less than eight (8) billing hours per day, exclusive of scheduled vacation time, sick time, statutory holidays and scheduled partial weeks. A partial week is defined as a mid-week project start/end date.

10) Both parties will mutually agree upon a service commencement date. If Customer requires changes to the service commencement date with less than ten (10) business days’ notice to DT Services, additional charges may apply.

11) Schedule delays outside of DT Service’s control, shall be billed at the current time and material rates plus travel and living expenses as described above. Any additional costs incurred by Customer as a result of delays shall be the sole responsibility of the Customer.

5 CHANGE MANAGEMENT PROCESS

To ensure the success of this engagement, it is critical that Customer and DT Services have a clear understanding of engagement expectations. The parties will utilize the approach outlined below (the “Change Management Process”) for managing changes to the SOW. Customer or DT Services may propose changes to the Services under this SOW, including Deliverables, scope, or any other aspect of the engagement. The Change Management Process for this engagement consists of the following:

● Change Initiation – All proposed changes will be forwarded to, or originated by, the SPOC and documented. A copy of the proposed change request will be forwarded to the Customer Contact.

Change requests will be documented using the Change Request Form.

● Change Validation – DT Services will examine the proposed change and may discuss the change request with the Customer Contact to clarify the details of the request.

● Change Analysis and Impact Analysis – DT Services will analyze the change request and make modifications to the Change Request Form as necessary.

● Change Implementation – If the change request is approved, the change will be noted as “Approved” and will be incorporated into the SOW and managed for progress. If the change is not approved, the change will be noted as “Rejected” and DT Services will continue to perform without regard to the proposed change to the extent practically possible.

The receiving party will review the proposed Change Request Form and will: (i) approve it, (ii) agree to further investigation, or (iii) reject it. Neither Customer nor DT Services will unreasonably withhold or delay

© Copyright 2024 Dell Technologies All rights reserved Page 11 of 14 its agreement to any proposed change. DT Services will define the change in scope, effort, timeline, and additional cost impact within ten (10) business days and provide this to Customer Contact for review and sign off. If more than ten (10) business days are needed, the estimated time to provide the change request will be communicated by the SPOC to the Customer Contact. Changes agreed upon pursuant to the Change Management Process will not be effective until mutually executed by a duly authorized representative of both parties. In addition, DT Services shall be relieved of any performance, schedule, milestone, or financial commitments associated with Services affected by Customer’s non-compliance with Customer responsibilities or other obligations under this SOW or in the event of any deviation from any assumption, constraint, dependency or engagement scope specification contained in this SOW until an appropriate written change order or other amendment to this SOW addressing the foregoing is approved and signed by the Customer and DT Services.

6 OTHER PROVISIONS

The Services, including any Deliverables, are subject to the following:

1) DT Services may use affiliates and subcontractors to perform the Services.

2) DT Services may perform all or part of the Services off-site at a DT Services location or other location.

3) DT Services shall not be responsible for any delay or failure to provide the Services to the extent caused by: (a) failures by Customer to perform its responsibilities under this SOW; (b) materially inaccurate assumptions; (c) a defect, deficiency, or failure with respect to Customer’s network, systems, software, data, or other equipment; or (d) modifications to Customer’s network, systems, or other equipment made by a party other than DT Services or its representatives. In the event that either party becomes aware of the occurrence of one or more of the foregoing events, they shall notify the other party accordingly. Notwithstanding such occurrence, DT Services may, following discussion with Customer regarding the impact of such incident, continue to provide the Services and shall use commercially reasonable efforts to perform the Services under this SOW. Customer will reimburse DT Services for its reasonable additional costs of providing the Services and out of pocket expenses for such efforts to the extent attributable to the items defined above.

4) Customer, not DT Services, is responsible for the performance of Customer’s employees and agents, including any contribution, alteration, or other modification they make to the Services, including Deliverables, and for the accuracy and completeness of all data, information, and materials provided to DT Services. DT Services is not providing any warranty regarding, and is not liable for, Customer hardware, software, documentation, tools, equipment, or other products, assets, materials, or services. DT Services’ performance is dependent upon timely decisions and approvals of Customer in connection with the Services, and DT Services is entitled to rely on all decisions and approvals of Customer.

5) The Services and resulting Deliverables may include advice and recommendations, but Customer agrees that all decisions in connection with the implementation of such advice and recommendations will be the responsibility of, and made by, Customer. DT Services does not provide legal or regulatory advice.

6) Unless this SOW specifically requires otherwise, DT Services is not providing any third-party hardware, software, documentation, tools, equipment, or other products, materials, or services, including, without limitation, Dell Technologies Select Products and Brokerage Products (collectively, “Third Party Products”) to Customer. Customer is solely responsible for the negotiation of an applicable agreement with the applicable third party from whom Customer wishes to license or acquire Third Party Products, the terms of which, including without limitation, the license, warranty, indemnity, maintenance, and support terms, shall govern such license or acquisition. DT Services does not provide any warranty regarding, and is not liable for, any Third-

© Copyright 2024 Dell Technologies All rights reserved Page 12 of 14

Party Products. Third Party Products are not supported or maintained by DT Services and Customer must contact the applicable third-party manufacturer or supplier directly for support and maintenance services. Any configuration or modification made by DT Services to any Third-Party Products provided by Customer or work product incorporating such items will be subject to the ownership and other rights agreed to by Customer with the applicable third party.

7) DT Services will not be responsible for non-performance due to software failure or software errors including any software failures or functionality limitations of Third-Party Products.

8) To the extent DT Services’ liability is not anyway excluded under the Agreement, DT Services will have no liability for loss or recovery of data, programs, or loss of use of system(s) arising out of or in connection with the Services provided under this SOW.

9) DT Services may rely upon any standard operating procedures or practices of Customer and any direction, regulatory guidance, or other guidance provided by Customer.

10) Customer is responsible for the identification and interpretation of, and ensuring compliance with, any laws, statutes, rules, regulations, and standards applicable to it or its affiliates’ business or operations.

11) No Dell Technologies product is or can be licensed or purchased under this document. Any purchase or licensing of Dell Technologies products is governed by the terms of a separate license or purchase agreement between the parties. DT Services’ fees set forth herein do not include the cost of the purchase or licensing of any Dell Technologies product.

12) The fees and any resource plan set forth in this document represent DT Services’ good faith estimate based upon information known to DT Services prior to signing this document and the assumptions, Customer responsibilities, and other matters set forth in this SOW. However, DT Services’ estimates do not represent a limit or minimum requirement. The actual resources to be deployed and the resulting fees will depend on actual experience and need during the engagement.

13) DT Services may cancel this Service at any time during the Service term for any of the following reasons:

a) Customer fails to pay the total price for this Service in accordance with the invoice terms;

b) Customer refuses to cooperate with the assisting analyst or on-site technician; or

c) Customer fails to abide by all the terms and conditions set forth in this SOW.

If DT Services cancels this Service, DT Services will send Customer a written notice of cancellation at the address indicated on Customer’s invoice. The notice will include the reason for cancellation and the effective date of cancellation, which will be not less than ten (10) days from the date DT Services sends notice of cancellation to Customer, unless state law requires other cancellation provisions that may not by varied by agreement. If DT Services cancels this Service pursuant to this paragraph, Customer shall not be entitled to any refund of fees paid or due to DT Services.

14) The Service is not transferable by Customer.

15) DT Services will at its sole discretion determine the number of personnel and the appropriate skill sets necessary to complete the Services.

16) DT Services is supplying qualified staff to augment the Customer’s work force for any project the Customer deems necessary. Customer will exclusively determine project objectives, methodologies, and scheduling of the work. Accordingly, notwithstanding anything to the contrary in the Agreement, DT Services (1) does not warrant or guarantee, and Customer shall be solely responsible for, any particular result or solution to Customer’s particular needs, or any work product of DT Services supplied personnel; and (2) shall have no responsibility for any claims that work product of any DT Services supplied personnel under this SOW infringes the intellectual property of any third-party.

17) Notwithstanding anything to the contrary in the Agreement, Customer acknowledges and agrees that the resources and any services provided by such resources shall be provided “as is,” and Customer expressly disclaims the right to seek any damages from DT Services in connection with

© Copyright 2024 Dell Technologies All rights reserved Page 13 of 14 this SOW and to receive the benefit of any warranties or indemnification which may be available under the Agreement.

7 SIGNATURES

Please review this SOW for accuracy. If the terms are acceptable, please sign and return via email to DT Services at Bryan.Babin@dell.com. This SOW may be executed in any number of counterpart copies, each of which will be deemed an original, but which taken together will constitute a single instrument. The parties agree to cooperate in good faith to provide each other with a fully executed original of this SOW within five (5) calendar days of any counterpart execution. This SOW together with the Agreement (i) is the complete and exclusive agreement between DT Services and Customer with regard to its subject matter, and supersedes all prior oral or written proposals, agreements, representations, and other communications between the parties with respect to the Services described in this SOW; and (ii) will apply in lieu of any different, conflicting, or additional terms and conditions which may appear on any order or other document submitted by either party.

IN WITNESS WHEREOF, the parties hereto have caused this SOW to be executed by their duly authorized representatives as of the Effective Date.

State of MI DTMB (Attorney General Office)

Signature:

Printed Name:

Title:

Date:

Dell Marketing L.P., or EMC Corporation, as applicable

Signature:

Printed Name:

Title:

Date:

Please note that for administrative purposes only, Services may not be scheduled or commenced until DT Services receives a purchase order (“PO”) from Customer that references this SOW. To the extent that Customer is unable to deliver the PO(s) required under this SOW directly to the legal entity identified as “DT Services" in Section One of this SOW for any reason, DT Services agrees that Customer may instead deliver such PO(s) to DT Services’ affiliate Dell Marketing L.P. (“DMLP”) or EMC Corporation (“EMC Corp.”). When applicable, Customer agrees that DMLP or EMC Corp.: (i) may invoice and receive payments for all fees due hereunder; and (ii) is an intended third-party beneficiary to this SOW and the Agreement with the right to enforce the terms of the SOW and the Agreement directly against Customer for the purpose of collecting such payments. Upon receipt of this fully executed SOW and Customer’s PO, the SPOC will contact Customer to begin scheduling Services.

mailto:Bryan.Babin@dell.com

© Copyright 2024 Dell Technologies All rights reserved Page 14 of 14

Appendix A Supported Sites

The Services will be provided for the following supported sites during the term of this SOW. Additional supported sites may be included as mutually agreed between the parties using the Change Management Process.

Supported Site Address City State Zip Qty

State of MI DTMB Services will be delivered entirely remotely, with no onsite resource delivery in scope.

Total of 80 resource hours

Michigan.gov/MiProcurement

SCHEDULE E – DATA SECURITY REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession;

and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/- /media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400013002-Acceptable-Use-of-Information-https://www.michigan.gov/dtmb/policies/it-policies

Technology-Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, Accessed, and backed up in the United States or its territories. The use of Offshore Resources is not permitted;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the Processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt,…