10-RFQ Sec3. Special Conditions.pdf

Agency for Community Transit 403(b) Employee Education Services No. 25-2-13601

SECTION 3. SPECIAL CONDITIONS

3.1 Compensation and Payment Terms

Compensation. Contractor shall be compensated for actual services rendered and/or products delivered in accordance with this Contract and the billable fee structure proposed in the Contractor’s Technical Response, as accepted by the Owner, or as may be modified by subsequent written amendments.

Invoicing. Invoices shall be dated and submitted to the Owner following completion of services, on a quarterly basis, but no later than the 10th of the following month, in accordance with this contract. Invoices should be e-mailed to accountspayable@mct.org or mailed to:

Agency for Community Transit Attn: Accounts Payable 1 Transit Way Pontoon Beach, IL 62040

Payment. Payment of the above compensation shall be made within 30 days of Contractor’s invoice for products and services authorized, accepted and approved by the Owner.

3.2 Resolution of Contract Inconsistencies

All inconsistencies and ambiguities among the documents which constitute this Contract shall be resolved by giving effect to the relevant position in the document which first appears in the following list: (1) Solicitation, Offer and Award Form; (2) Federal Clauses; (3) State of Illinois Provisions; (4) Special Provisions; (5) Scope of Work; (6) Introduction; (7) General Terms and Conditions; (8) Vendor’s technical response.

3.3 Insurance Requirements

Contractor and subcontractors shall maintain the following types of insurance until the expiration or termination of this contract.

a) Comprehensive General Liability with policy limits of not less than $1,000,000 for each occurrence and $2,000,000 in the aggregate for bodily injury and property damage.

b) Automobile Liability covering vehicles owned, and non-owned vehicles used, by the Contractor with policy limits of not less than $1,000,000 per accident for bodily injury, death of any person, and property damage arising out of ownership, maintenance and use of those motor vehicles, along with any other statutorily required automobile coverage.

c) Workers Compensation at statutory limits and Employers Liability with not less than $500,000 each accident, $500,000 each employee, and $500,000 policy limit.

d) Professional Liability (used for architects and engineers and other applicable services) shall not be less than $500,000 covering errors and omissions.

e) Cyber Liability insurance limits shall not be less than $2,000,000 per occurrence.

The Contractor may achieve the required limits and coverage for Commercial General Liability and Automobile Liability through a combination of primary and excess or umbrella liability insurance, provided that such primary and excess or umbrella insurance policies result in the same or greater coverage as those required stated above, and in no event shall any excess or umbrella liability insurance provide narrower coverage than the primary policy. The excess policy shall not require exhaustion of the underlying limits only through actual payment by the underlying insurers.

Prior to beginning work, the Contractor shall provide the Owner with a Certificate of Insurance complying with this section and naming the Owner as an additional insured.

3.4 Owner’s Tax Status

The Owner is organized and operated exclusively for charitable purposes and is therefore exempt from the payment of Retailers’ Occupation Tax, Service Occupation Tax (both state and local), Use Tax, and Service Use Tax. The owner’s Illinois tax exemption identification number is E99922355 (expires 02/01/2029.)

mailto:accountspayable@mct.org

3.5 Notices

Any notice required under this contract shall be in writing, dated and signed by the party giving such notice or by a duly authorized representative of such party. Notices shall not be effective unless transmitted by any method that provides confirmation of transmission and delivery.

3.6 Entire Contract

This Contract constitutes the complete and entire agreement between the Owner and Contractor and supersedes any prior representations, understandings, communications, commitments, agreements or proposals, oral or written, that are not incorporated as a part of the Contract.

3.7 Financial Assistance

This contract may be partially funded by the Illinois Department of Transportation (IDOT) and/or the Federal Transit Administration (FTA), and is therefore subject to applicable state and federal laws, executive orders, regulations, and requirements. The Contractor agrees not to perform any act, fail to perform any act, or refuse to comply with any Owner requests that would cause the Owner and MCT to be in violation of the terms and conditions of the grant agreements MCT has with FTA and IDOT for goods or services.

3.8 Cybersecurity and Data Protection Requirements

The Contractor shall comply with the following cybersecurity and data protection requirements while performing all services under this contract:

1. Governance & Compliance − comply with the NIST Cybersecurity Framework, CIS Controls, and any applicable federal, state, or local regulations (e.g., Illinois Local Records Act, HIPAA, PII, PCI-DSS).

− maintain a written information security program (WISP) and provide documentation upon request.

2. Access & Identity Management

− implement multi-factor authentication (MFA) for all administrative, privileged, and remote access.

− enforce role-based access control (least privilege).

− disable access within 24 hours of employee termination.

− Shared accounts are prohibited.

3. Data Security − Encrypt all sensitive data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).

− Not transfer or store confidential data outside of the United States without the prior written consent of the Owner.

− Maintain data retention and disposal policies in compliance with Illinois law.

4. System and Network Security − Encrypt all sensitive data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).

− Not transfer or store confidential data outside of the United States without the prior written consent of the Owner.

− Maintain data retention and disposal policies in compliance with Illinois law.

5. Incident Response and Breach Notification − Maintain a documented incident response plan, updated and tested annually.

− Notify the Owner of any actual or suspected data breach within 24 hours of discovery.

− Cooperate fully in forensic investigation and remediation efforts.

− Maintain cyber liability insurance with coverage of not less than $5M per occurrence. The

Owner, Madison County Transit, and their officials, employees, and agents shall be named as additional insured.

6. Vendor Risk and Subcontractors − Not use subcontractors without prior written approval from the Owner.

− Ensure subcontractors meet the same cybersecurity requirements.

− Provide, upon request, an annual third-party risk assessment report.

7. Audit and Verification − Permit the Owner to audit Contractor’s security practices and request evidence of controls.

− Provide annual SOC 2 Type II, ISO 27001 certification, or equivalent.

− Undergo annual penetration testing and vulnerability scans, with remediation plans shared upon request

8. Training and Awareness − Ensure all personnel with system or data access complete annual cybersecurity awareness training.

− Provide role-specific training for personnel handling sensitive data.

9. Business Continuity and Disaster Recovery − Maintain a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), tested at least annually.

− Define and meet Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) consistent with Owner requirements.

10. Termination and Data Return

− Upon termination, return or securely destroy all Owner data within 30 days.

− The obligation to report security incidents involving Owner data shall survive contract termination

[Remainder of page left intentionally blank]