1-2025 General Legal Services RFQ - FINAL.pdf

REQUEST FOR QUALIFICATIONS

GENERAL LEGAL CONTINUING CONSULTANT SERVICES

Metropolitan Airports Commission 6040 28th Avenue South

Minneapolis Minnesota 55450

Date Issued: August 19, 2025

Questions/Inquiries Due: August 29, 2025

Response Due: September 8, 2025

2025 General Legal Services RFQ

Request for Qualifications for

General Legal Continuing Consultant Services

Contents

I. INTRODUCTION

A. Welcome

B. MAC Reservations

II. BACKGROUND INFORMATION

III. NATURE OF SERVICES REQUIRED

A. Scope of Work

B. Confidentiality

IV. STATEMENT OF QUALIFICATIONS – GENERAL INFORMATION

A. General Instructions

B. Anticipated Schedule/Key Dates

C. Format

V. STATEMENT OF QUALIFICATIONS – CONTENTS

A. Title Page

B. Table of Contents

C. Background Information/Business Profile

D. Personnel & Staffing

E. Relevant Experience

F. Fees & Expenses

G. Insurance

H. Actual or Potential Conflicts of Interest

I. References

J. Certificate of Compliance

VI. SUBMITTAL

A. Questions/Inquiries

B. Due Date for Submissions/Location for Submissions

VII. SELECTION PROCESS

A. Review Team Evaluation/Interview(s) of Firm(s)

B. Completion of Selection Process

C. Length of Engagement

D. Execution of Agreement

VIII. AFFIRMATIVE ACTION/NON-DISCRIMINATION, EQUAL OPPORTUNITY & SMALL BUSINESSES

A. Affirmative Action

B. Non-discrimination and Equal Opportunity

C. Small Businesses

IX. MINNESOTA GOVERNMENT DATA PRACTICES ACT

A. Treatment of SOQ Data

B. Acknowledgement

C. Data on Individuals

Attachment #1

PROFESSIONAL SERVICES AUTHORIZATION - TERMS AND CONDITIONS (“PSA”) (06.2023)

EXHIBIT A: PSA NOTICE ADDRESSES

Attachment #2

MAC CONSULTANT EXPENSE GUIDELINES

Request for Qualifications

General Legal Services

I. INTRODUCTION

A. Welcome

Welcome to the Metropolitan Airports Commission (MAC) consultant selection process! We appreciate you taking the time to download and review this Request for Qualifications RFQ.

The MAC owns and operates seven airports in the Twin Cities, including the Minneapolis-St. Paul International Airport (MSP) and its six diverse Reliever Airports.

We work in an exciting and ever-changing world with high expectations and time demands. Given the limited number of in-house staff members, MAC and its Operations, Finance & Administration Committee highly value our consultant partners and relies upon those teams to deliver a multitude of operational efforts and project types.

The MAC welcomes submittals from all consultants meeting the enclosed RFQ prerequisites. There is no requirement that a consulting firm have previous work experience with the MAC, and the review team will conduct an unbiased evaluation of all submittals.

B. MAC Reservations

Submission of a Statement of Qualifications (SOQ) indicates acceptance by a proposer of the conditions contained in this RFQ.

MAC does not promise to accept the lowest fee structure or any other single factor and specifically reserves the right to reject any or all SOQs, to waive any formal SOQ requirements, to request additional information or clarifications from any proposer, to allow corrections in any SOQ, to investigate the qualifications and experience of any proposer, to reject any provisions in any SOQ, to obtain new SOQs, to select one or more proposer for all or part of the requested services, to negotiate the requested services and contract terms with any proposer or to proceed to do the work otherwise.

Incomplete or insufficient SOQs may be returned for completion or may be rejected by

MAC.

Firms/Consultants responding to this RFQ are not entitled to compensation from MAC for any expenses incurred in preparing their submittal or by participating in this RFQ process.

All services provided by the successful proposer as a result of this RFQ, including information obtained and reports generated regarding airport-related issues, must be treated by the successful proposer as confidential and must not be divulged, in whole or in part, to any person other than to MAC, without prior written approval of MAC.

II. BACKGROUND INFORMATION

MAC was created by the Minnesota State Legislature in 1943 as a public corporation. Its purpose is to promote air navigation and transportation in and through Minnesota, promote the efficient, safe and economical handling of air commerce, assure the inclusion of the state in national and international programs of air transportation and, to those ends, develop the full potentialities of the Twin Cities metropolitan area as an aviation center. It has the responsibility to assure residents minimal environmental impact from air navigation and transportation, promote the overall goals of the state’s environmental policies and minimize the public’s exposure to noise and safety hazards around airports.

MAC owns and operates one of the nation’s largest airport systems. It includes Minneapolis-St. Paul International and six (6) general aviation airports. A 2016 economic impact study found the MAC delivers more than $16.7 billion annually for the local economy and supports more than 90,000 jobs in the region. The MAC’s airports connect the region to the world and showcase Minnesota’s extraordinary culture to millions of passengers from around the globe who arrive or depart through MSP each year. Though a public corporation of the state of Minnesota, the organization is not funded by income or property taxes. Instead, the MAC’s operations are funded by rents and fees generated by users of its airports.

MAC is governed by a board of fifteen commissioners. The Governor of the State of Minnesota appoints eight commissioners from designated districts within the Twin Cities metropolitan area. The Governor also appoints four commissioners from outside the metropolitan area and the board chair. The mayors of St. Paul and Minneapolis have seats on the board with the option to appoint a representative to serve in their place.

More detailed information about MAC can be found at its web site, www.metroairports.org.

III. NATURE OF SERVICES REQUIRED

A. Scope of Work

The MAC is seeking the professional services of qualified consultants to provide general legal services. All consulting services will be performed under the direction of the MAC’s General Counsel.

The selected proposer must be able to provide the MAC with the following services as needed and requested:

All legal services will be performed under the direction of the MAC’s General Counsel and staff. The legal services sought under this RFQ will include:

1. Providing legal advice and counsel, including the drafting and negotiation of contracts, leases, ordinances, policies and other legal documents.

2. Representation in legal proceedings (judicial or administrative) including appellate advocacy.

http://www.metroairports.org/

3. Arranging for the retention of other professional consultants as needed and as approved by MAC's General Counsel.

4. Providing such other legal advice and legal services to the General Counsel and MAC staff as is deemed necessary or appropriate by the General Counsel.

These services are to be performed in accordance with the provisions contained in this RFQ. The MAC retains additional legal counsel in several areas of practice, including specialty areas, which are not a part of this engagement.

B. Confidentiality

All services provided by successful proposer(s) as a result of this RFQ, including reports generated and information obtained regarding airport-related issues, must be treated by successful proposer(s) as confidential and must not be divulged, in whole or in part, to any person other than to authorized representatives of the MAC, without prior written approval from authorized representatives of the MAC except by testimony under oath in a judicial proceeding or as otherwise required by law, including the Minnesota Government Data Practices Act. The successful proposer(s) must take all necessary steps to ensure that no member of its staff or agent of its organization divulges any information concerning such services except as provided above.

If MAC discloses to the successful proposer(s) employees confidential and proprietary information pertaining to the MAC’s past, present or future activities, then the successful proposer(s) must take appropriate measures to ensure that all information gained by each such person as a result of the services to be performed is proprietary to the MAC and is not to be disclosed to any organization or individual without the prior written consent of the

MAC.

The successful proposer agrees to take appropriate action with respect to its employees to ensure that the obligations of non-use and non-disclosure of confidential information concerning the contract can and will be fully satisfied.

IV. STATEMENT OF QUALIFICATIONS – GENERAL INFORMATION

A. General Instructions

MAC expects a concise Statement of Qualifications (SOQ) without unnecessary attachments, enclosures or exhibits. The SOQ shall be organized in the format indicated below. Each section of the SOQ should be clearly identified with appropriate headings in the order indicated below. SOQs that do not follow these instructions may be rejected or received less consideration.

B. Anticipated Schedule/Key Dates

The following are the key dates of the RFQ process. Please note that all dates may be changed as necessary.

August 19, 2025 RFQ Issued August 29, 2025 Questions Due September 8, 2025 Statement of Qualifications (SOQ) Due September/October Interviews of Proposers November 3, 2025 Recommendation to Operations, Finance & Administration

Committee November 17, 2025 Approval by Full Commission

C. Format

1. The contents of the SOQ should include consecutively numbered pages.

2. The SOQ may not exceed 10 pages, excluding Title Page, Table of Contents, cover letter and any attachments.

3. Each proposer must submit one (1) electronic copy, either via email or other means of electronic delivery, of the SOQ as indicated above. All materials should be combined into one PDF.

V. STATEMENT OF QUALIFICATIONS – CONTENTS

To facilitate and expedite the review process, it is recommended the SOQ includes the following information and be organized in the following manner:

A. Title Page

The SOQ should include the request subject, the name of the proposer, address, phone number, name of the contact person and email address of the contact person.

B. Table of Contents

The SOQ should include clear identification of the material by section and page number.

C. Background Information/Business Profile

The SOQ should include the background and experience of the proposer, including type of ownership, length of time operating, and range of professional services offered.

D. Personnel & Staffing

1. Include the name, address, telephone number, fax number, and email address of the proposer’s designated contact person.

2. Include a list of proposed personnel to work on this project, including names, telephone numbers and email addresses. Resumes of key personnel may be included as attachments to the SOQ.

E. Relevant Experience

Outline the proposer’s background and experience with the following, and provide an overview of the proposer's suggested approach, including how the proposer can work with MAC to ensure timely, high quality, cost-effective performance:

A. Background B. Personnel & Staffing C. Relevant Experience

1. Primary Areas

a. Real Estate, Leasing, Property Acquisition

b. Eminent Domain, Zoning and Land Use

c. Intellectual Property

d. Municipal Law/Local Government Law (including Ethics, Open Meeting and Ordinances, but excluding Criminal Prosecution)

e. Public Bidding and Public Construction Law

f. First Amendment

g. Commercial Transactions

2. Other Areas

a. Bankruptcy Law

b. Employment Law

c. Environmental Law

d. Minnesota Government Data Practices Act

3. Litigation

a. State of Minnesota Courts

b. U.S. District Court

4. Representation of Public Sector Clients

F. Fees & Expenses

Provide an itemization of the types of costs MAC may incur in obtaining services, including the specific hourly rates for all staff performing services, minimum billing time and types of reimbursable expenses with proposed charges.

G. Insurance

Describe the coverage and limits of insurance including professional liability, worker’s compensation, general liability and auto liability covering the proposer's performance of services for MAC. Documentation of insurance, including the ability to name MAC as an additional insured, will be required if selected and thereafter, as retained, on an ongoing basis.

H. Actual or Potential Conflicts of Interest

The SOQ must identify airports, airlines or other aviation related clients, as well as local units of government, with whom the proposer is currently under contract to provide consulting services and indicate the nature of the services provided.

The proposer must immediately advise MAC in writing of any real or possible conflicts that arise after the submission of the SOQ.

I. References

The SOQ must provide three (3) references that attest to the experience outlined in this RFQ. For each reference, include the name and address of the reference and the name and telephone number of a contact person.

J. Certificate of Compliance

Prior to award of this contract, the proposer or proposer(s) selected must demonstrate compliance with the requirements of the Minnesota Department of Human Rights as outlined in Minn. Stat. §473.144 and Minnesota Rules, parts 5000.3400 to 5000.3600. For more information on how to apply for or renew your Workforce Certificate, please visit the Minnesota Department of Human Rights website at:

https://mn.gov/mdhr/certificates/workforce-certificate/apply.jsp. This form is not included in the page limit outlined above.

Questions regarding the Certificate of Compliance requirements should be directed to the Minnesota Department of Human Rights at compliance.mdhr@state.mn.us or by calling (651) 539-1095.

VI. SUBMITTAL

A. Questions/Inquiries

Questions or inquiries concerning this RFQ must be submitted by August 29, 2025 and emailed to:

https://metroairports.bonfirehub.com/portal/?tab=openOpportunities

Responses to all questions received in writing will be made via email and will be shared with all firms that have obtained this RFQ, unless specific questions are of a confidential or proprietary nature and identified as such by the inquirer.

If any question submitted makes it necessary to change this RFQ, then a written addendum will be furnished to all persons on record as receiving a copy of this RFQ.

The addendum will also be posted on www.metroairports.org. MAC may not respond to questions received after the above referenced date and time.

B. Due Date for Submissions/Location for Submissions

One electronic copy of the SOQ, either via email or other electronic delivery, must be received by 4:00 p.m. central daylight time on Monday, September 8, 2025. Any SOQ submitted after 4:00 p.m. on that date may not be considered.

The SOQ must be sent to:

https://mn.gov/mdhr/certificates/workforce-certificate/apply.jsp mailto:compliance.mdhr@state.mn.us

VII. SELECTION PROCESS

A. Review Team Evaluation/Interview(s) of Firm(s)

The SOQs will be reviewed by a review team of internal and/or external professionals.

The firm(s) identified as the most qualified to perform the requested services may be invited to attend an interview with the review team. The review team will make a recommendation of the most qualified firm(s) to the Operations, Finance & Administration Committee. That Committee will then make a recommendation to the full MAC Board of Commissioners, which makes the final decision.

During the evaluation process, MAC reserves the right, where it may serve MAC’s best interest, to request additional information or clarification from the proposers or to allow corrections of errors or omissions.

B. Completion of Selection Process

It is anticipated that this selection process will be completed on or around

November 17, 2025, and that services could begin as early as January 1, 2026.

C. Length of Engagement

The successful proposer will be designated as a continuing consultant for a period of up to six years. Under current MAC policy, consultants must participate in an RFQ process once every six years.

An annual agreement (“Professional Services Authorization”) between MAC and the successful proposer will be subject to MAC’s Consultant policies. A draft copy of the Terms & Conditions of MAC’s Professional Services Authorization is attached (Attachment #1), along with MAC’s Consultant Expense Guidelines (Attachment #2).

The agreement is subject to cancellation by either party on 30 days advance notice and includes no formal guarantee that any project or projects will be assigned to the proposer(s) chosen in this selection process.

D. Execution of Agreement

If the proposer does not execute an agreement with MAC within a reasonable amount of time after notification of its selection, MAC may select the next most qualified proposer or call for new SOQs, depending on which course of action MAC deems most beneficial.

VIII. AFFIRMATIVE ACTION/NON-DISCRIMINATION, EQUAL OPPORTUNITY &

SMALL BUSINESSES

A. Affirmative Action

The proposer shall not discriminate against any employee or applicant for employment based on race or gender or because of physical or mental disability regarding any position for which the employee or applicant for employment is qualified. The proposer agrees to take affirmative action to employ, advance in employment, and otherwise treat qualified women, minorities, and people with disabilities without discrimination in all employment practices such as the following: employment, upgrading, demotion or transfer, recruitment, advertising, layoff or termination, rates of pay or other forms of compensation, and selection for training including apprenticeship.

The proposer agrees to comply with the rules of the Minnesota Department of Human Rights issued pursuant to Minn. Stat. §363A.37. In the event of the proposer's non-compliance with the requirements of this clause, actions for non-compliance may be taken by MAC in accordance with this contract.

The proposer agrees to post in conspicuous places, available to employees and applicants for employment, notices in a form to be prescribed by the Commissioner of the Minnesota Department of Human Rights. Such notices shall state the proposer's obligation under the law to take affirmative action to employ and advance in employment qualified disabled employees and applicants for employment, and the rights of applicants and employees.

The proposer shall notify each labor union or representative of workers with which it has a collective bargaining agreement or other contract understanding, that the proposer is bound by the terms of Minn. Stat. §473.144 and Minnesota Rules, parts

5000.3400 to 5000.3600, and is committed to take affirmative action to employ and advance in employment qualified women, minorities, and people with disabilities.

B. Non-discrimination and Equal Opportunity

MAC does not discriminate in the selection of proposers based on race, color, creed, religion, national origin, sex, marital status, status regarding public assistance, disability, sexual orientation, or age. The successful proposer must agree to comply with all applicable federal, state, and local equal opportunity and affirmative action laws, directives, and regulations.

C. Small Businesses

MAC acts affirmatively to promote and enter into contracts with Small Businesses (SBs). The MAC acknowledges the State’s Targeted Group Business (“TGB”) program, Economic Disadvantaged businesses (ED), and Veteran Owned (VO) Small Business Programs pursuant to Minn. Stat. §473.142 and the Central Certification Program (CERT). The successful proposer must agree to ensure that Small Businesses, including TGBs, EVs, VOs, CERT participants, and disadvantaged business enterprises (DBEs), as defined by applicable federal law, will have the maximum opportunity to participate in the performance of this contract whenever possible. The successful proposer will cooperate with MAC in meeting the Commission's commitments and goals with regard to the maximum utilization of small businesses whenever possible in the performance of the services requested under this RFQ.

IX. MINNESOTA GOVERNMENT DATA PRACTICES ACT

A. Treatment of SOQ Data

All data submitted to the MAC by proposers are governed by the Minnesota Government Data Practices Act. Under Minnesota Statutes, section 13.591, at the time and date SOQs are due, the name of the proposer becomes public information. All other information in the SOQ, including any price information, does not become public until MAC has completed negotiating the contract with the selected proposer.

Therefore, most information in the SOQ does not become public information until after the Commission awards the contract and the contract has been negotiated and signed.

When the Commission has negotiated a contract with the successful proposer, and the contract is signed, the evaluative data (data created or maintained by MAC as part of the evaluation process) and information in all the SOQs becomes public, with the exception of trade secret data. To qualify as trade secret data, all the provisions set forth in Minnesota Statutes, section13.37 must be met. Trade secret data are:

government data, including a formula, pattern, compilation, program, devise, method, a technique or process (1) that was supplied by the affected individual or organization, (2) that is the subject of efforts by the individual or organization that are reasonable under the circumstances to maintain its secrecy, and (3) that derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.

An assertion by a proposer that their SOQ is copyrighted or otherwise protected does not prevent public access to the data in the SOQ at such time that the data becomes public data under Minnesota Statutes, section13.591.

During the evaluation process, proposers cannot look at SOQs submitted by other proposers or data created by the MAC as part of the selection or evaluation process.

During that process, MAC staff, outside experts who have signed confidentiality agreements and MAC Commissioners may be informed of the data in the SOQs and may view the SOQs. Proposers may discuss their SOQs with MAC Commissioners, but MAC Commissioners are not able to reveal the contents of the other SOQs. During MAC’s public Committee and Commission meetings, Commissioners can publicly discuss any information submitted in the SOQs to the extent reasonably necessary to conduct the business at hand. The information, however, retains its classification as private or nonpublic until completion of negotiations.

If all responses to an RFQ are rejected by the MAC prior to “completion of the evaluation process,” all SOQ data, other than the names of the responders, remains private or nonpublic until a re-solicitation of the RFQ results in completion of the evaluation process, or a determination is made to abandon the process. If the rejection occurs after “completion of the evaluation process,” the data remain public. If a re-solicitation of SOQs does not occur within one year of the SOQ opening date, the remaining data then becomes public.

Proposers who wish to maintain a classification of trade secret information with respect to any data contained in their SOQs must submit two versions of their SOQ. Each version of the SOQ must be conspicuously marked either “PUBLIC” or “NOT PUBLIC” on the cover page. In the not public version, proposer should redact all data claimed to be trade secret information under Minnesota law. In addition, because the Minnesota Government Data Practices Act requires the MAC to justify each redaction made to a document prior to its release to the public, the MAC requires that proposer provide a redaction-by-redaction justification for the information’s classification as trade secret information. See Minn.

Stat. § 13.03, subd. 3(f).

Trade secrets lose their protected status “if they are [not] the subject of efforts by the individual or organization that are reasonable under the circumstances to maintain [their] secrecy … .” Minn. Stat. § 13.37, subd. 1(b). Thus, each trade secret justification should include a description of the internal controls used by proposer to regulate the possession, use, and dissemination of the alleged trade secret. These controls could include:

employee non-disclosure agreements, “need to know” access policies, data segregation techniques, etc.

In addition, because trade secret information must “derive[] independent economic value” from its secrecy, each justification should include evidence of the financial value of the alleged trade secret. Evidence of this sort could include: development budgets for the secret, performance benchmarks pertaining to the secret, the secret’s place in proposer’s intellectual property management program, expenses incurred protecting the secret, etc.

Further, the MAC requests that redactions of trade secret information be made at the most granular level possible. It will generally not be sufficient for proposers to redact entire pages, paragraphs, or even, in some cases, sentences. The MAC has created several instructions, with examples, for redacting information, which are available upon request.

Finally, because trade secret information must be the subject of reasonable efforts to maintain its secrecy, if the MAC does not receive a not public version of the SOQ with sufficient justifications for the redactions, the MAC may conclude that all data contained in the SOQ are public based upon the proposer's lack of efforts to maintain secrecy.

B. Acknowledgement

By submitting a SOQ, the proposer acknowledges that all information is subject to potential disclosure and agrees that MAC will have no liability for any such disclosure.

In addition, the proposer acknowledges that an executed agreement (including a professional services authorization) with MAC is public data in its entirety, unless otherwise noted in the agreement.

C. Data on Individuals

Persons who supply data about themselves in response to this RFQ are entitled to know the following information under the Minnesota Government Data Practices Act:

1. The information requested will be used to evaluate the SOQs.

2. The proposer is not legally required to supply this information.

3. By supplying information, the proposer or individual may be selected to perform work for MAC.

4. Failure to supply information may result in a determination by MAC that the

SOQ is non-responsive; and

5. The public is authorized by law to receive information that is not classified by law as private, confidential, or nonpublic data.

Attachment #1

PROFESSIONAL SERVICES AUTHORIZATION - TERMS AND CONDITIONS (“PSA”) (06.2023)

These general terms and conditions are made a part of and are incorporated into the agreement between the MAC and Consultant.

1. Minnesota Government Data Practices Act. [Minn. Stat. § 13.05, subd. 11]. Consultant is notified that the

Minnesota Government Data Practices Act, Minnesota Statutes, chapter 13. (“the Act”) places obligations upon Consultant. All data shared with MAC are subject to the requirements of the Act. In no circumstances will this PSA impair MAC’s ability to comply with the Act. If applicable, Consultant will comply with the requirements of Minnesota Statutes, section 13.05, subdivision 11(a) with respect to all data created, collected, received, stored, used, maintained, or disseminated in the course of performance of this PSA (“Data”). The civil remedies of Minnesota Statute, section 13.08 apply to the release of Data. If Consultant receives a request to release Data, Consultant must immediately notify MAC and Consultant must not release the Data until receiving instructions to do so from MAC.

2. Non-Disclosure.

2.1. Confidential Information. “Confidential Information” includes all information disclosed by MAC to

Consultant in connection with the work conducted under this PSA, whether disclosed orally, visually, or in any tangible or electronic form and whether received before, on the date of, or after the signing of this

PSA.

2.2. Non-Disclosure. Confidential Information provided to Consultant will be held by Consultant in strict confidence and will not be disclosed, directly or indirectly, to any third party, except with the prior written consent of MAC or as specifically allowed by this PSA.

2.3. Permitted Disclosures. Consultant may disclose Confidential Information to those of its representatives, consultants, and employees who have a need-to-know such information (“Third Parties”), provided that, prior to disclosure, Consultant will inform each Third Party of the confidential nature of the information and each Third Party must be bound as a condition of their employment, or have executed an agreement with Consultant sufficient to enable that Third Party’s compliance with the terms of this Section 2 and Section 3. Third Parties will not make notes of, copy or reproduce any Confidential Information in any form, except as reasonably required for completion of their assigned tasks.

3. Data Governance. If the work conducted under this PSA requires a transfer of data from MAC to Consultant or access to information systems used by MAC, the following provisions apply. Upon written request from Consultant, MAC may, in its discretion, grant a written waiver of any of the requirements of Section 3.

3.1. Data License. MAC grants to Consultant a limited, non-exclusive, non-transferable, non-sublicenseable, royalty-free license during the Term of the PSA to use data provided by MAC solely for the conducting of work under this PSA (“MAC Data”) and only for the purposes approved in writing by MAC at the time of transfer. Consultant agrees not to use MAC Data except as expressly authorized by the immediately foregoing sentence. Without limiting the generality of the foregoing, Consultant may not: (i) sell, lease, loan, sublicense, distribute, publish, or otherwise transfer MAC Data (even if deidentified and aggregated) or any accompanying documentation to any person, firm, or entity, except as agreed in writing by MAC;

(ii) alter, modify, adapt, decompile, or reorganize MAC Data, except as agreed in writing by MAC; nor may Consultant (iii) use MAC Data (even if deidentified and aggregated) for its own promotional, developmental, or analytical purposes. In addition, Consultant may not publish or distribute MAC Data in any form to any third party or place the data onto any server that it is accessible via a public network.

3.2. Intellectual Property Rights (MAC Data). Except for the licenses granted by MAC to Consultant in Section # above, MAC retains all right, title, and interest in and to MAC Data and all intellectual property rights associated therewith. For the avoidance of doubt, all embodiments, incidents, and derivatives of MAC Data, including (without limitation) all copies, records, output, reports, compilations, collective or derivative works, presentations, diagrams, summaries and excerpts—to the extent they contain or are adapted from MAC Data--and regardless of whether in electronic or tangible form or represented or communicated in any other manner, are Developments subject to Section #..

3.3. Access to Data. MAC may at any time suspend the access of Consultant to MAC Data and/or disable its access rights in the event of indications of misuse, unlawful conduct, or violation of this PSA, or other usage policies. MAC will not be liable to Consultant or any third-party for suspension of access to MAC Data, regardless of the grounds.

3.4. Security Requirements. Consultant must share any information or access necessary for MAC to meet its regulatory compliance obligations with respect to cybersecurity including, but not limited to, any current or future FAA, TSA, or CISA security directive applicable to MAC. In addition, Consultant must, at all times, meet or exceed the following cybersecurity requirements:

3.4.1. Maintenance of WISP. At all times that Consultant has access to MAC Data or MAC information systems, Consultant must maintain a comprehensive Written Information Security Program (the “WISP”) commensurate with the size and complexity of Consultant, nature and scope of the PSA, and the sensitivity of the MAC Data used or maintained. The WISP must dictate information systems security requirements based on a documented risk assessment. The WISP must be in compliance with

(i) relevant laws, regulations, orders, and rules. Consultant must maintain data security certifications indicating that the WISP meets or exceeds industry information security standards as required by relevant legal, regulatory and contractual requirements that otherwise apply to the services performed by Consultant.

3.4.2. Employee Security Awareness. Prior to being granted access to MAC Data or MAC information systems, and annually thereafter, all Consultant personnel must be provided with security awareness training to ensure their understanding of security policies and standards, and their responsibilities to protect MAC Data and Consultant’s or MAC’s information systems.

3.4.3. Role-Based Access Controls. Consultant must utilize role-based access controls for all information systems, (i) restricting access privileges to the minimum necessary for a user to perform authorized functions, and (ii) preventing access to MAC Data by non-authorized users.

3.4.4. Encryption. Consultant must encrypt MAC Data using strong encryption technologies while such information is at rest and during transmission using public networks or leased lines. MAC considers appropriate secured transmission technologies to be VPN, HTTPS, and SFTP. Consultant agrees that any File Transfer Protocol (FTP) activity containing MAC Data under the PSA must be conducted through an encrypted session connection for the duration of the term while files are transmitted.

Consultant must cooperate with MAC in a timely manner and as may be required to de-encrypt such electronic transmission.

3.4.5. Portable Devices and Mobile Computing. Consultant will not allow its personnel to access MAC Data on or from laptops, mobile phones, or other portable storage and/or computing devices (“Devices”) without the express written consent by an authorized MAC representative. Notwithstanding the foregoing, Devices that encrypt the information at rest and in transit, utilize endpoint protection that includes a personal firewall and anti-malware protection, and utilizes multi-factor authentication are considered approved without further written consent required.

3.4.6. MAC Data Loss Prevention. Consultant must institute and maintain a data loss prevention (“DLP”) program, which shall include reviewing, detecting, and preventing unauthorized, unnecessary, and/or excessive disclosures, misappropriation, theft, or loss of information.

3.4.7. Physical Security. Consultant must maintain and apply physical security measures and safeguards for the ongoing protection of MAC Data, whether stored electronically or in another form. Consultant must: (i) maintain a documented facility security plan and conduct periodic reviews of access to Consultant’s facility and secure zones, (ii) maintain written procedures that restrict physical access to MAC Data and specify the manner and location in which such information shall be locked and stored,

(iii) restrict secured physical access to all servers and computer production control areas to Consultant personnel responsible for the operation and maintenance of the hardware located in those areas, (iv) maintain cameras (e.g., CCTV) to monitor and record ingress and egress to sensitive areas, and (v) maintain processes for the review and retention of security logs.

3.4.8. Cloud Computing. To the extent MAC Data is hosted using cloud computing, Consultant must (i) use at least Database Management System (DBMS) layer encryption for such data when at rest, (ii) employ industry standard cloud security controls for access management, network security, data encryption at rest and in transit, and intrusion prevention, (iii) perform privileged user monitoring for such MAC Data, (iv) employ controls to ensure that MAC Data is logically separated from non-MAC data in all instances, including backup and removable media, (unless otherwise permitted in writing by MAC) (v) allow MAC Data to be deleted in accord with Section #, and (vi) maintain a valid agreement with third parties providing cloud services for Consultant. Consultant must, upon MAC's request, identify all third parties providing cloud services for Consultant that host MAC Data (“Cloud Vendors”). In connection with any cloud computing, Consultant must require the Cloud Vendor to use US domestic hosting regions for cloud instances that may host MAC Data. Consultant must also use the Cloud Vendor’s cloud computing solution that complies with the current requirements for computing for the U.S. federal government.

3.4.9. Network Security. All of Consultant's network connections, including wireless connections, must be equipped with intrusion prevention capabilities, and must include firewall protection and intrusion detection in accordance with industry best practices. Consultant must have monitoring capabilities that: (i) detect system weaknesses, (ii) recognize anomalous user activity, and (iii) inform Consultant of newly discovered vulnerabilities. Consultant must perform monthly vulnerability scanning and annual network penetration testing. Consultant must remediate identified vulnerabilities to satisfy accepted industry standards. In addition, Consultants providing or developing customized software applications for MAC must regularly perform application and source code scanning and remediate identified vulnerabilities with industry standards.

3.4.10. Logging and Monitoring. Consultant must employ industry standard security controls and tools to monitor its information systems and log key events such as user activities (including root or administrative access), exceptions, successful and unsuccessful logins, access to audit logs, unauthorized information processing activities, suspicious activities and information security events.

Consultant must (i) perform regular, routine log reviews and take necessary actions to protect against unauthorized access or misuse, (ii) regularly back up activity logs to secure central location(s), protected against tampering and unauthorized access, (iii) ensure that the clocks of all relevant information processing systems are synchronized using an authoritative national or international time source, (iv) incorporate date and time stamps into log entries, and (v) retain activity logs in accordance with regulatory requirements. In the event of a security incident, Consultant must make log events specific to MAC Data available for review by MAC within twenty-four (24) hours of request by MAC.

3.4.11. Patch Management. Consultant must operate an effective security patch management program whereby security patches will be applied within a reasonable timeframe, consistent with industry standards and practices and based upon the level of security risk, from the point of discovery. To the extent a given risk is not remediated through patch application within a reasonable timeframe, Consultant must implement compensating controls to mitigate the risk until the security patch(es) are applied.

3.4.12. Limitations on Processing of MAC Data. Consultant must not use MAC Data in a non-production environment, such as development, testing, or quality assurance environments. However, MAC Data may be used in non-production environments used solely for recovery purposes, so long as those environments otherwise meet all applicable requirements of Section #.

3.4.13. Risk Assessments. Consultant must, as required by the WISP and in compliance with all applicable laws, regulations, orders, rules and contractual requirements, perform ongoing risk assessment. On written request by MAC, for each facility of Consultant that processes MAC Data or has access to MAC Data, Consultant must provide to MAC access to all risk assessments, audits, examination and summaries of test results performed periodically by Consultant, or by their external auditors or security consultants, relating to the information security measures, involving each such facility having such access, including access to the relevant portions of any applicable Service Organization Controls (“SOC”), or similar reports.

3.4.14. Security Risk Assessments. At request of MAC, Consultant may be asked to submit to a security risk assessment before either obtaining access to or receiving any MAC Data or MAC information systems or deploying custom software in a MAC-controlled production environment. Consultant agrees to cooperate in good faith and at Consultant's sole cost and expense during any security risk assessment or investigation initiated by MAC.

3.4.15. Duty to Report. If any report, inspection, risk assessment, or security risk assessment identifies material gaps or weaknesses in Consultant's WISP or its ability to secure MAC Data, Consultant must notify MAC and provide MAC with a reasonable period of time to correct the gap or weakness, and if such measures are not satisfactory to MAC, MAC may suspend Consultant's access to or use of MAC Data until such issues are resolved to the mutual satisfaction of Consultant and MAC. Any such suspension by MAC will not be a breach of this PSA.

3.4.16. Subsequent Assessments. Consultant may be required by MAC to complete a new security risk assessment but in no event more than once every twelve (12) months unless a security incident occurs or material gaps in security are identified.

3.4.17. Assessment Requirements. During any security risk assessment, Consultant must provide MAC access to a SOC 2 Type 2 with HITRUST aligned with NIST CSF report, or in an alternative form agreed to by MAC, as evidence demonstrating the effectiveness of the WISP.

3.4.18. Retention. For the lesser of six (6) years or until two (2) years after this PSA is terminated (unless such PSA is renewed), Consultant must maintain, and provide access for MAC's review upon MAC's request, (i) the WISP (including all versions thereof), in effect during all times during which Consultant had access to MAC Data or any of MAC's information systems; and (ii) all other material policies, procedures and other documents related to MAC Data and MAC's information systems of or accessible by Consultant.

3.4.19. Subcontracting. To the extent Consultant is permitted to subcontract pursuant to the PSA, Consultant agrees to identify all relevant subcontractors (including suppliers and all sub-processors).

Consultant further agrees that it will have in place with any relevant subcontractor sufficient agreements or proof of compliance to give effect to Consultant's obligations under this PSA. Further, Consultant must cooperate with MAC requests for information concerning such relevant subcontractors, including but not limited to, nature of services provided, location, and date of last security assessment. MAC reserves the right to require the performance of a risk assessment on Consultant's relevant subcontractors based on the nature of information to which such relevant subcontractors may have direct or indirect access, at no cost to MAC. Consultant expressly acknowledges that Consultant is liable to MAC for its relevant subcontractors’ compliance with this Section 3.

3.4.20. Offshoring. Consultant will not use offshore computing or storage resources, meaning computing or storage resources located in any physical location outside of one of the fifty United States or one of the United States Territories (i.e., American Samoa, Guam, Northern Marianas, Puerto Rico, and Virgin Islands).

3.4.21. Continuous Monitoring. During the term of the PSA, Consultant may be requested to respond to, inform and provide updates regarding specific high-risk security gaps or exposures that exist for new or emerging security vulnerabilities that are made publicly known for systems, applications, hardware devices, etc. Consultant will promptly respond to such MAC requests and will provide specific details as to the questions asked to ensure that MAC can evaluate the risk or exposure to MAC Data.

3.5. Security Incident Response.

3.5.1. Security Incident. “Security Incident” means any compromise (actual or suspected) of the confidentiality or integrity of MAC Data or information systems used by Consultant to store, transfer, or otherwise process MAC Data; or any unauthorized access to, disruption or misuse of any Consultant information system used by Consultant to store, transfer, or otherwise process MAC Data or unauthorized access to, disruption or misuse of MAC Data.

3.5.2. CSIRT. Consultant must establish and maintain a Computer Security Incident Response Team, or—if unable to form a team—an individual designated as responsible for computer security (in either case, the “CSIRT”). The CSIRT must be responsible for (i) investigating Security Incidents, (ii) reporting to MAC any information regarding Security Incidents, (iii) resolving any Security Incidents, and (iv) improving the information security program based on Security Incidents.

3.5.3. Notice. The CSIRT must notify MAC of any Security Incident, without unreasonable delay, but in no event later than twenty-four (24) hours after Consultant's confirmation of the Security Incident, or such shorter notice period as required by law.

3.5.4. Security Incident Responsibility. Consultant must, at no cost to MAC, repair and/or compensate MAC or third-parties for any damage or loss caused by the Security Incident and assist MAC in complying with any breach notification requirement to which it is subject. Consultant also agrees to cooperate with MAC in the resolution of any Security Incident.

3.6. Retention. Consultant will comply with any data retention periods set by MAC for MAC Data. If no retention period is given for a category of MAC Data, Consultant will retain that category of data for the term of the PSA. Upon termination of this PSA (unless such PSA is renewed), Consultant will: (1) return and deliver to MAC all MAC Data and any Development containing or derived from MAC Data, and (2) delete and cause to be deleted from all computers and other systems and devices all MAC Data and any Development containing or derived from MAC Data in a manner that the same cannot be retrieved, and (3) verify such deletion and destruction to MAC under oath in writing.

3.7. Disclaimer of Warranties. Use of MAC Data is at Consultant’s sole risk. MAC does not warrant that access to MAC Data, or any content, will be uninterrupted. MAC makes no representations or warranties, express or implied, with respect to the use of, or reliance on, MAC Data, regardless of its format or means of transmission. There are no guarantees or representations to the user as to the accuracy, currency, completeness, suitability, or reliability of MAC Data, for any purpose. MAC Data could contain technical inaccuracies or typographical errors. Consultant accepts MAC Data “as is,” and assumes all risks associated with its use. MAC assumes no responsibility for any damages resulting from, caused by, or associated with Consultant’s reliance on or use of MAC Data, or for the delay or inability to use MAC Data, even if appraised of the likelihood of such damages occurring.

3.8. Compliance Audit. MAC may, upon reasonable notice, conduct a verification of Consultant’s compliance with the terms of Section 2. and Section.3. Consultant must provide to MAC such information as MAC may reasonably request and give MAC or its representatives access to Consultant’s records, personnel, and facilities in order to conduct the verification.

4. Intellectual Property Rights (Developments). Any inventions (whether patentable or not), copyrights and copyrightable works, information, designs, construction contract documents, know-how, data, and findings developed by Consultant or delivered to MAC under this PSA (collectively, “Developments”) are owned by MAC, and Consultant assigns all intellectual property rights in the Developments to MAC. To the extent that any work product delivered to MAC under this PSA includes any invention, design, know how or copyrightable work that Consultant developed prior to this PSA or other than in connection with the services provided under this PSA (“Pre-Existing Works”), Consultant grants MAC a non-exclusive, perpetual, world-wide, royalty-free irrevocable right and license to make, use, sell, offer for sale, create derivative works from and otherwise use such Pre- Existing Works in connection with the Developments and any derivative of the Developments.

5. Injunctive Remedies. In addition to any other remedies, MAC may, without posting bond or other security, receive injunctive and other equitable relief to enforce the provisions of Section #., and it will not be a defense to any request for such relief that MAC has an adequate remedy at law. If MAC is successful in any application for injunctive or other equitable relief, Consultant will pay MAC the expenses MAC incurs in obtaining such relief including, without limitation, reasonable legal fees and disbursements, court costs and the cost of appellate proceedings.

6. Payment Audit. [Minn. Stat. § 16C.05, subd. 5.]. Consultants and subcontractors to this PSA must keep, in a system acceptable to MAC, accurate books, accounts, records, and documents relevant to the work conducted under this PSA for a period of six calendar years. MAC and the Legislative Auditor may inspect the books, accounts, records, documents, interview current and former employees, accounting procedures and practices relative to the work conducted under this PSA. Contracts entered into with subcontractors must contain this same contract audit clause. Consultants must pay all audit costs when an audit discloses overcharges exceeding one percent (1%) of the total contract.

7. Reimbursable…