STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 10 to Contract Number MA180000000572

C O

N

TR

A C

TO

R

SAS INSTITUTE INC

100 SAS Campus Drive

Cary NC 27513

Missi Poynter

919-455-3770 missi.poynter@sas.com

CV0059747

ST

A

TE

Pr og ra m

M an ag er

Various Various

C on tr ac t A dm in is tr at or Angela Wright DTMB

517-899-4646

WrightA33@michigan.gov

CONTRACT SUMMARY

Education Value-Added Assessment System (EVAAS)

INITIAL EFFECTIVE DATE

March 31, 2018

INITIAL EXPIRATION DATE

March 30, 2019

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE

BEFORE

March 30, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION

1 Year

EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

March 30, 2027

CURRENT VALUE

$12,900,000.00

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$12,900,000.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective March 30, 2026, the State exercises an option year for purposes of keeping the contract vehicle open for optional future use. No scope or funding is added to the contract at this time.

The parties agree to the following: All State Data (as defined in Section 5 of the Contract) will continue to be treated as Confidential Information and will be taken offline, encrypted, and maintained in accordance with the terms of the Contract as amended.

Per contractor, agency, and DTMB Procurement approval.

CHANGE NOTICE NO. 10 TO CONTRACT NO. MA180000000572

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

MDE Joe Priest 517-241-1886 PriestJ4@michigan.gov

DTMB Kimberly Crawford 517-243-1483 CrawfordK5@michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Education Value-Added Assessment System (EVAAS)

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

March 31, 2018 March 30, 2019 5 - 12 Months March 30, 2025

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

100 SAS Campus Drive

Cary NC 27513

Dylan Wernholm

248-881-9986

Dylan.Wernholm@sas.com

CV0059747

SAS INSTITUTE INC

C O

N

TR

A C

TO

R

Jarrod Barron

517-249-0406

DTMB

Various Various

BarronJ1@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 9

Contract Number MA180000000572 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

12 Months March 30, 2026

$12,900,000.00 $0.00 $12,900,000.00

DESCRIPTION

Effective 2/6/2025, the State exercises an option year for purposes of keeping the contract vehicle open for optional future use. No scope or funding is added to the contract at this time. Per contractor, agency, and DTMB Procurement approval.

Internal State Note: Remaining Ad Board funds after this CN: $249,999.99

AGENCY NAME PHONE EMAIL

MDE Joe Priest 517-241-1886 PriestJ4@michigan.gov

DTMB Kimberly Crawford 517-243-1483 CrawfordK5@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 9 TO CONTRACT NO. MA180000000572

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 8 to

Contract Number 180000000572

Various

Jarrod Barron missi.poynter@sas.com

Missi Poynter

Cary, NC 27513

SAS INSTITUTE INC

CV0059747

919-455-3770

100 SAS Campus Drive

(517) 249-0406 S

T A

T E

P ro g ra m

M a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

barronj1@michigan.gov

$11,000,000.00

March 31, 2018 March 30, 2024

EDUCATION VALUE-ADDED ASSESSMENT SYSTEM (EVAAS)

March 30, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☒ 1 year March 30, 2025

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,900,000.00 $12,900,000.00

Effective 2/26/2024, the parties extend the contract to 3/30/2025, add option years through 3/30/2034, update legal and security provisions per the attached documentation, and add $1,900,000.00 for the services detailed in the attached statement of work.

All other terms, conditions, specifications, and pricing remain the same. Per contractor, agency, DTMB Central Procurement and State Administrative Board approval on 9/28/2023.

Remaining Ad Board funds after this contract change notice: $349,999.99

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

MDE

Program Managers for

CHANGE NOTICE NO. 8 TO CONTRACT NO. 180000000572

Joe Priest 517-241-1886 PriestJ4@michigan.govMDE

Kimberly Crawford 517-243-1483 CrawfordK5@michigan.govDTMB

CONTRACT TERMS REVISIONS

The purpose of this Change Notice is to extend the existing Contract #180000000572, and update applicable contract terms and conditions, security language, and other language as required.

Now, therefore, the parties agree to incorporate the following changes to the Contract:

1) The following definitions are incorporated into this Contract –

“PAT” means a document or product accessibility template, including any Information Technology Industry Council Voluntary Product Accessibility Template or VPAT®, that specifies how information and software products, such as websites, applications, software and associated content, conform to WCAG 2.1 Level A.

“WCAG 2.1 Level AA” means level AA of the World Wide Web Consortium Web Content Accessibility Guidelines version 2.1.

2) The second paragraph of page one of the agreement is deleted and replaced with the following: “This Contract may be renewed for up to ten (10) one (1) year periods beyond March 30, 2024 (potentially through March 30, 2034). Renewal must be accomplished by mutual agreement of the parties.”

3) Section 3 is hereby deleted and replaced in its entirety with the following –

License Grant. Contractor grants the State a limited, nontransferable, nonexclusive, royalty-free license to (i) use the Software System to access the Results, (ii) receive the benefits of the Software System, via the Results, used by Contractor to produce the Results, and (iii) use any Results delivered to the State in connection in furtherance of the Educational Purpose. The state may use and copy the Results in connection with work involving third parties in furtherance of the Educational Purpose. Contractor will only release the Reports to Authorized Users designated in writing by Customer. The license granted under subsection (i) above shall terminate one year after Contractor has initially made the Results on the Software System, unless otherwise extended by Customer’s purchase of additional Services. The licenses granted under subsections (ii) and (iii) above are perpetual.

Contractor owns the “Software System” to generate reports, including all underlying calculations and algorithms to evaluate data, documentation, related materials, derivatives and all intellectual property rights therein (collectively, the “Contractor Materials”). State does not acquire any right, title, or interest in or to the Contractor Materials. State shall not copy, modify, enhance, reverse engineer, or make any addition to the Contractor Materials. Notwithstanding anything in this Contract to the contrary, Contractor shall retain all right, title, and interest in and to all Contractor Materials which shall not be considered “Services.”

4) Section 5.4 is hereby deleted and replaced in its entirety with the following –

Loss or Compromise of Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable: (a) notify the State as soon as practicable but no later than seventy-two

(72) hours of becoming aware of such occurrence; (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State; (c) perform or take any other actions required to comply with applicable law as a result of the occurrence; (d) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution; and (e) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all third-party claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that, after reasonable investigation, is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must notify the State, as soon as practicable but no later than five (5) business days of becoming aware of such occurrence, and proceed, as applicable, with steps (b) through (e), above. This Section survives termination or expiration of this Contract.

5) Section 6.10 is hereby deleted and replaced in its entirety with the following –

6.10 Availability and Support Service Level Credits. Contractor acknowledges and agrees that any credits assessed as a result of the Service Level Warranty specified in Section 13: (a) is a reasonable estimate of and compensation for the anticipated or actual harm to the State that may arise from not meeting the Service Level Warranty, which would be impossible or very difficult to accurately estimate; and

(b) may, at the State’s option, be credited or set off against any Fees or other charges payable to Contractor under this Contract or be payable to the State upon demand. Credits may not exceed the total amount of Fees that would be payable for the relevant service period in which the credits are assessed.

6) Section 10(c) is hereby deleted and replaced in its entirety with the following –

Contractor’s Limitation of Liability. (i) IN NO EVENT WILL CONTRACTOR’S

AGGREGATE LIABILITY TO THE STATE UNDER THIS CONTRACT,

REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT,

NEGLIGENCE, STRICT LIABILITY OR BY STATUTE OR OTHERWISE, FOR

ALL CLAIMS RELATED TO OR ARISING UNDER THIS CONTRACT, EXCEED

FIVE MILLION DOLLARS ($5,000,000). (ii) Exception: Contractor’s Limitation of Liability shall not apply to Contractor’s obligations with respect to damages arising from Contractor’s recklessness, bad faith, or intentional misconduct. (iii) Exception:

Contractor’s Limitation of Liability shall not apply to Contractor’s indemnification obligations set forth in Section 9.1(b). (iv) Solely with respect to a breach of Contractor’s obligations with respect to the loss of State Data contemplated by Section 5.4, Contractor’s aggregate liability to the State, regardless of the form of action, whether in contract, tort, negligence, strict liability, or by statute or otherwise, for all claims shall not exceed Seven Million Five Hundred Thousand Dollars ($7,500,000).

7) Section 18.11 is hereby deleted and replaced in its entirety with the following –

Nondiscrimination. Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., and Executive Directive 2019-09, Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex (as defined in Executive Directive 2019-09), height, weight, marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position. Breach of this covenant is a material breach of the Contract.

8) Section 17 is hereby deleted and replaced in its entirety with the following –

Accessibility Requirements.

(a) All Software Systems provided by Contractor under this Contract, including associated content and documentation, must be benchmarked against WCAG 2.1 Level AA. Contractor must provide a description of conformance with WCAG 2.1 Level AA specifications by providing a completed PAT for each product provided under the Contract. At a minimum, Contractor must comply with the WCAG 2.1

Level A conformance claims it made to the State regarding the level of conformance provided in any PAT. Contractor and State agree to a plan to reach WCAG 2.1 Level AA conformance and to remediate identified barriers to accessibility to provide a comparable level of access to the data. As a preliminary matter, the plan is to take steps to improve accessibility to the Restricted Site prior to the next report release and then to prioritize the accessibility of the analytic reports made available to the public through the EVAAS website application prior to the next report release.

Analytic reports available through the Restricted Site are a secondary priority. The anticipated timeline of the plan is:

1) for the 2022 – 2023 Reporting Year Restricted Site Release targeted in December 2023 Contractor will remove reports that were already nearing the end of their life, including Decision Dashboard, Projection Summaries, Student Search, School Value Added Summary, School Diagnostic Summary, School Perf Diagnostic Summary, and School Search, update Custom Student Reports to suppress pie graphic, and add accessibility statement around requesting data and/ or alternate means to request data;

2) for the 2022 – 2023 Reporting Year Public Site Release in March 2024 provide the State with a PAT showing the public site is WCAG 2.1A compliant while striving for AA compliance for most items, converting Scatterplot, and adding an accessibility statement around requesting data and/ or alternate means to request data;

3) for the 2023 – 2024 Reporting Year Restricted Site Release a PAT showing the site is WCAG 2.1A compliant while striving for AA compliance for most items, including a simplified reports menu, value added, teacher reports, diagnostics, student reporting and scatterplots;

4) for the 2023 – 2024 Reporting Year March 2025 Public Site Release a PAT showing the Public Site is WCAG 2.1AA compliant; and 5). For the 2024 – 2025 Reporting Year Restricted Site Release a PAT showing the Restricted Site is WCAG 2.1AA compliant.

If the State receives a complaint regarding the accessibility, or conducts an assessment on the accessibility and identifies barriers, of the Software System Contractor will work within the plan and with the State to address the complaints or assessment and provide a comparable level of access. Throughout the term of the Contract, Contractor will:

(i) maintain compliance with the level of conformance provided in its PAT, including the level of conformance provided in each PAT;

(ii) comply with the plan and timeline set forth in paragraph (a) above;

(iii) ensure that no Maintenance Release, New Version, update or patch, when properly installed in accordance with this Contract, will have any adverse effect on the conformance of Contractor’s Software System to the PAT;

(iv) ;

(v) upon the State’s written request, provide evidence of compliance with this Section by delivering to the State Contractor’s most current PAT for each product provided under the Contract; and

(vi)

(b) State of Michigan Digital Standards Review. Contractor must assist the State, at no additional cost, with development, completion, and on-going maintenance of an accessibility plan, which requires Contractor, upon request from the State, to submit evidence to the State to validate Contractor’s accessibility and compliance with the standards set forth herein. Prior to the solution going-live and thereafter on an annual basis, or as otherwise required by the State, re-assessment of accessibility may be required. At no additional cost, Contractor must remediate all issues identified from any assessment of accessibility pursuant to plans and timelines that are approved in writing by the State.

(c) Warranty. Contractor warrants that all conformance claims made by Contractor pursuant to this Contract, including all information provided in any PAT Contractor provides to the State, are true and correct. If the State determines that the information in the PAT is inconsistent with what is actually provided to the State, Contractor willat its sole cost and expense, promptly remediate its Software System to align with Contractor’s stated PAT. If Contractor is unable to remediate to align with its stated PAT , the State may terminate this Contract for cause.

(d) Contractor must, without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State arising out of its failure to comply with the Contractor’s most recently provided PAT.

(e) Failure to comply with the requirements in this Section  shall constitute a material breach of this Contract.

9) Section 18.15 is hereby deleted and replaced in its entirety with the following –

Entire Agreement. This Contract, including all Statements of Work and other Schedules and Exhibits, constitutes the sole and entire agreement of the parties to this Contract with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter. In the event of any conflict between the terms of this Contract and those of any Schedule, Exhibit or other document, the following order of precedence governs: (a) first, this Contract, excluding its Exhibits and Schedules; (b) second, Schedule B – Data Security Requirements; and (c) the remaining Exhibits and Schedules to this Contract. NO TERMS ON

CONTRACTORS INVOICES, WEBSITE, BROWSE-WRAP, SHRINK-WRAP,

CLICK-WRAP, CLICK-THROUGH OR OTHER NON-NEGOTIATED TERMS AND

CONDITIONS PROVIDED WITH ANY OF THE SERVICES, OR

DOCUMENTATION HEREUNDER WILL CONSTITUTE A PART OR

AMENDMENT OF THIS CONTRACT OR IS BINDING ON THE STATE OR ANY

AUTHORIZED USER FOR ANY PURPOSE. ALL SUCH OTHER TERMS AND

CONDITIONS HAVE NO FORCE AND EFFECT AND ARE DEEMED REJECTED

BY THE STATE AND THE AUTHORIZED USER, EVEN IF ACCESS TO OR USE

OF SUCH SERVICE OR DOCUMENTATION REQUIRES AFFIRMATIVE

ACCEPTANCE OF SUCH TERMS AND CONDITIONS.

10) Schedule B is hereby deleted and replaced with the Schedule B – Data Security Requirements as appended to this Change Notice.

SCHEDULE B – DATA SECURITY

REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below.

All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec.

18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing the Hosted Services under this Contract. As used in Schedule B, staff augmentation for support services does not constitute subcontracting.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule.

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Hosted Services who has sufficient knowledge of the security of the Hosted Services and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Beginning in 2024, SAS will work to move the Hosted Services to an environment that complies with the standards set forth in this Schedule B. SAS will complete the transition in milestones in accordance with the timeline detailed in the Statement of Work. If this date is not met, the parties will agree to consider a Contract Change Notice. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) protects the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal, in accordance with the Contract, of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times remain materially consistent with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the contracted solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/- /media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400013002-Acceptable-Use-of-Information- Technology-Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP IaaS authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP IaaS authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 or Hosted Services provided by the Contractor, maintain either a third-party FISMA assessment report or an annual SSAE 18 SOC 2 Type II audit based on NIST Special Publication 800-53 MOD Controls;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, and backed up in the continental United States, and the data center(s) in which the data resides minimally meet Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.4 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and https://www.michigan.gov/dtmb/policies/it-policies https://www.uptimeinstitute.com/ must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls;

5.5 throughout the Term, Contractor must not provide Hardware or Services from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services;

5.6 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with industry practice and applicable standards (including, compliance with FISMA, NIST, SSA, HIPAA, and FERPA requirements as applicable);

5.7 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) keep State data segregated from access by other Contractor customers or third-party users; and (iii) unauthorized access to any of the State Data;

5.8 ensure that State Data is encrypted in transit and at rest using FIPS compliant AES encryption modules and a key size of 128 bits or higher;

5.9 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.10 ensure the Hosted Services implements NIST compliant multi-factor authentication for Contractor privileged/administrative access.

5.11 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) for the new environment referenced in Section 3 above that will be deployed beginning in 2024 that will be managed in the State’s automated governance, risk and compliance (GRC) platform by the State. This accreditation process requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security https://sam.gov/content/home controls within two weeks of the State’s request or as mutually agreed. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance.

The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract. For the current environment, Contractor will continue to provide third-party audit documentation to the State as updated and contractor will remediate mutually agreed upon vulnerabilities identified by the State until it no longer hosts department data.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, business continuity or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right, upon request to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least thirty (30) days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits. Contractor agrees to commit up to 40 hours toward any such audit. Any effort beyond 40 hours would require a contract change notice.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s currently available NIST 800-53 MOD System Security Plan(s) or

SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as set forth in the Contract or a mutually agreeable amendment.

8.5 RESERVED.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans consistent with the State Secure Web Application and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Scanning interactive application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor will provide a letter of attestation that it has dynamically scanned a deployed version of the Software using an industry standard application scanning tool. These scans and assessments i) must be completed quarterly and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans. These scans must be completed for source code initially, for application updated source code, and for source code for each major release and Contractor must provide the State with a vulnerability scan summary upon request after Contractor has completed the required scans and remediations.

9.3 Software Composition Analysis (SCA) – Third Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third party and open source software, all included third party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third party and open source software initially, for all updated third party and open source software, and for all third party and open source software in each major release and Contractor must provide the State with an assessment summary after Contractor has completed the required scans if not provided as part of SAST and/or DAST reporting.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 For Hosted Services, Contractor must ensure the infrastructure and applications are scanned using an industry standard scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly and provide the scan’s assessments to the State, upon request Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements documented in the State’s PSPs.

Contractor will remediate identified vulnerabilities as soon as possible when updates are made available but will not exceed the time frames below. Vulnerabilities can be remediated in a number of different ways: applying security patches when available, as well as implementing configuration changes, or other risk mitigation options. Patch remediation time frames apply as soon as a patch has been made available by the vendor.

Criticals (CVSS 9 -10) Public facing systems & infrastructure only within 15 days Criticals (CVSS 9 -10) All other O/S & software within 15 days Highs (CVSS 7.0 - 8.9) O/S and Infrastructure within 30 days Highs (CVSS 7.0 - 8.9) All other application software within 60 days Moderates (CVS 4.0 - 6.9) O/S and Infrastructure within 60 days Moderates (CVS 4.0 - 6.9) All other application software within 90 days All other (CVS 0.0 – 3.9) O/S and Infrastructure only within 90 days

If Contractor is unable to remediate identified vulnerabilities within the above timeframes, Contractor will provide a plan to the State of such vulnerabilities and the anticipated timeframe by which each will be remediated. Such timeframes will be as close to the above timeframes as possible. Contractor may apply mitigating controls to reduce the risk of an identified vulnerability. Contractor will track the identified vulnerabilities and update the State on progress until remediated. Nothing in this section shall diminish or impact any other rights the State has under this Contract.

If requested by the State, the contractor must provide the State with a vulnerability assessment summary, which includes number of vulnerabilities by severity and monthly age, from the most recent scan.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, business continuity or other applicable policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

Statement of Work Attachment to Change Notice 8

The following shall be added as a new Schedule D to the Contract:

Contract period Six:

The following additional services will be provided for the period October 1, 2023, through September 30, 2024 “Contract Services Period”.

A. Web-Based Reporting Training, and Research & Development Contractor will provide the following services:

Web-based reporting that includes as specified below, where sufficient data are available:

a. Growth Metrics, which reflectively identify strengths and opportunities for improvement, grade to grade and subject to subject, for districts and schools.

b. Diagnostic Reports, which look beyond individual growth estimates to uncover levels of effectiveness with different types of learners.

c. Individual Student Projections, which proactively predict student success probabilities at numerous academic milestones.

d. Custom Interactive Scatterplots, which allow users to visualize the impact of various growth metrics and the students who are served.

e. Access lists of students to assist with educational planning, which aggregate student information as needed to assist with educational planning.

f. SAS will provide teacher value-added reports for all opt-in districts based on state assessments in grades 4-8 and interim/benchmark assessments, such as NWEA MAP, where adequate data exists.

The web-based reporting has the ability to include the following services:

g. SAS shall continue the standard enrollment update from MDE, which allows for student projections to appear at students’ enrolled school rather than their last tested school. Prior to the state enrollment update, SAS will receive enrollment updates from LEAs through the Datahub for districts that have opted in and submitted their enrollment data.

h. SAS shall continue to maintain ongoing services in hosting, security, documentation, and operations management for the web application.

i. Utilize existing assessments and any future assessments that are suitable for measuring student growth.

j. Report student growth measures at the district, school, teacher, and subgroup levels.

k. Recognize the growth of tested students, including those who may have missing assessment data.

l. Include all available prior standardized assessment data that meet inclusion criteria across grades, subjects, and state and local assessments.

m. Allow student growth results to be disaggregated.

n. Provide individual student projections showing the probability of a student reaching specific performance levels on future assessments.

o. Have a "help/contact us" ticketing system built into the value-added reporting platform.

p. The model must include role-based permissions that allow educators to access information about the performance of the students within their immediate responsibility in accordance with applicable privacy laws.

q. By March 31, 2024, the department shall work with the center to make data publicly available on an external website that provides student growth metrics provided by the value-added reporting platform at the district and school level by grade and subject.

Training allotment (Exact offerings TBD):

The vendor shall provide statewide training for educators to understand the reporting that details the impact to student learning and growth.

Offerings are tailored to each audience and will be mutually agreed upon by the parties. Contractor will not be required to refund any money for training services that are not utilized by the State prior to the end of the Phase Four Services Period.

Research and Development:

SAS provide up to 25 days of service hours for the State which will be directed towards activities to support the EVAAS services described in this Change Notice. Activities will be mutually agreed upon by the parties; Contractor will not be required to refund any money for Research and Development hours not utilized by the State during the Services Period. Upon request by the State, Contractor will provide a summary of Research and Development hours utilized during the Services Period. SAS will not be required to deliver hours beyond those specified herein.

B. Implementation of New Hosted Services Environment Beginning in 2024, SAS will also work to move the Hosted Services to an environment that complies with the standards set forth in the restated Schedule B. SAS will complete the transition in milestones in accordance with the following timeline:

• SAS will complete the transition to the new environment to receive data from MDE by October 1, 2024.

• SAS will complete the transition of the web application reporting with the delivery of the 2023-24 school year’s (FY25) deliverables (“FY 2025 Deliverables”).

For the existing environment, Contractor will:

• maintain an acceptable level of risk in the current environment until it no longer hosts department data.

• continue to provide third-party audit documentation to the State as updated and will remediate vulnerabilities identified by the State until it no longer hosts department data.

For the new environment, Contractor will:

• provide evidence of meeting controls identified by the State. Evidence may be in the form of third-party documentation, provided the documentation addresses the necessary controls, such evidence to be provided prior to delivery of the FY 2025 Deliverables.

Cost and Invoicing:

The total fees for this Statement of Work are $1,900,000.00. On or after February 13, 2024, Contractor may invoice the State $1,900,000.00 after the State formally accepts all reporting deliverables detailed herein.

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 7 to

180000000572Contract Number

Various

Jarrod Barron missi.poynter@sas.com

Missi Poynter

Cary, NC 27513

SAS INSTITUTE INC

CV0059747

919-455-3770

100 SAS Campus Drive

(517) 249-0406 S

T A

T E

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

barronj1@michigan.gov

$9,000,000.00

March 31, 2018 March 30, 2024

EDUCATION VALUE-ADDED ASSESSMENT SYSTEM (EVAAS)

March 30, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ March 30, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$2,000,000.00 $11,000,000.00

Effective 10/11/2022, the parties add $2,000,000 for ongoing services through 9/30/2023 per the attached documentation. All other terms, conditions, specifications, and pricing remain the same. Per contractor, agency, DTMB Central Procurement and State Administrative Board approval on 10/11/2022.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

Program Managers for

CHANGE NOTICE NO. 7 TO CONTRACT NO. 180000000572

Joe Priest 517-241-1886 PriestJ4@michigan.govMDE

Attachment to Change Notice 7

The following shall be added as a new Schedule D to the Contract:

Fiscal Year 2023 (FY23) Contract Services Period:

The following additional services will be provided for this contract extension term. The period of performance for this statement of work is the effective date of this Change Notice and ending September 30, 2023 (FY23 Contract Services Period).

Deliverable Pricing Projected Timeline Web-based reporting that includes as specified below, where sufficient data are available:

a. Growth Metrics, which reflectively identify strengths and opportunities for improvement, grade to grade and subject to subject, for districts and schools

b. Diagnostic Reports, which look beyond individual growth estimates to uncover levels of effectiveness with different types of learners

c. Individual Student Projections, which proactively predict student success probabilities at numerous academic milestones.

d. Custom Interactive Scatterplots, which allow users to visualize the impact of various growth metrics and the students who are served.

e. College Readiness Dashboards and Customized Reports, which aggregate student information as needed to assist with educational planning

The web-based reporting also includes the following services:

f. SAS will provide teacher value-added reports for all opt-in districts based on state assessments in grades 4-8 and interim/benchmark assessments, such as NWEA MAP, where adequate data exists.

g. SAS shall continue the standard enrollment update from MDE, which allows for student projections to appear at students’ enrolled school rather than their last tested school. Prior to the state enrollment update, SAS will receive enrollment updates from LEAs through the Datahub for districts that have opted in and submitted their enrollment data.

h. SAS shall continue to maintain ongoing services in hosting, security, documentation, and operations management for the web application.

i. Recognize the growth of tested students, including those who may have missing assessment data.

j. Include all available prior standardized assessment data that meet inclusion criteria across grades, subjects, and state and local assessments.

k. Have a "help/contact us" ticketing system built into the value-added reporting platform.

$1,853,125 Ongoing through FY23 Contract Services Period

l. The model must include role based permissions that allow educators to access information about the performance of the students in accordance with MDE policy.

m. By March 31, 2023, the department shall work with the center to make data publicly available on an external website that provides student growth metrics provided by the value-added reporting platform at the district and school level by grade and subject.

Training allotment (Exact offerings TBD):

The vendor shall provide statewide training for educators to understand the reporting that details the impact to student learning and growth.

Offerings are tailored to each audience and will be mutually agreed upon by the parties. Contractor will not be required to refund any money for training services that are not utilized by the State prior to the end of the FY23 Contract Services Period.

$100,000 Ongoing through FY23 Contract Services Period

Research and Development:

SAS provide up to 25 days of service hours for the State which will be directed towards activities to support the EVAAS services described in this Change Notice. Activities will be mutually agreed upon by the parties; Contractor will not be required to refund any money for Research and Development hours not utilized by the State during the Phase Four Services Period.