190000000099.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 7 to Contract Number MA190000000099

C O

NT

RA

CT

O

R

Trintech Inc.

5600 Granite Parkway Suite 10000

Plano TX 75024

Karen Kozlowski

972-440-5181 karen.kozlowski@trintech.com

VS0326803

CONTRACT SUMMARY

Treasury Fiserv Software, Maintenance & Installation

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

December 1, 2018 December 15, 2021 5 - 1 Year December 14, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

P-Card Direct Voucher (PRC) Other Yes No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$870,159.64 $0.00 $870,159.64

ST

AT

E

Pr og ra m

M an ag er

Various Various

C on tr ac t A dm in is tr at or

Patrick Russell DTMB

(517) 648-7767 russellp2@michigan.gov mailto:karen.kozlowski@trintech.com mailto:russellp2@michigan.gov

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 02/26/2026, the contract is amended to include the following:

Accessibility Requirements

Effective April 24, 2026, and throughout the Term, Contractor will provide the Solution in a manner designed to conform to WCAG 2.1 Level AA. Contractor utilizes an accessibility-aligned shared component library designed and maintained to support WCAG 2.1 Level AA and performs at least annual accessibility audits to identify and address accessibility issues to support continued conformance and usability for individuals with visual impairments.

For clarity, Contractor is not responsible for the compliance of anything that is not provided by Contractor under this Contract. If the State notifies Contractor in writing of any material nonconformance with the standard in this Section, Contractor will use commercially reasonable efforts to remediate such material nonconformance within a reasonable period of time.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 7 TO CONTRACT NO. MA190000000099

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

DTMB Lucy Pline plinel@michigan.gov

TREA Michelle Viaches ViachesM@michigan.gov mailto:plinel@michigan.gov mailto:ViachesM@michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Treasury Fiserv Software, Maintenance & Installati

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

December 1, 2018 December 15, 2021 5 - 12 Months December 14, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

5600 Granite Parkway Suite 10000

Plano TX 75024

Karen Kozlowski

972-440-5181 karen.kozlowski@trintech.com

CV0049962

Trintech Inc.

C O

N

TR

A C

TO

R

Patrick Russell

(517) 648-7767

DTMB

Various Various

RussellP2@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 6

Contract Number MA190000000099 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$870,159.64 $0.00 $870,159.64

Effective 04/10/2024, the parties hereby agree to additional storage needed to maintain current operations from 8/1/2024 - 12/31/2026. The total cost of this project is $23,200 no additional funding is needed at this time; existing funds are adequate for this change.

Please note the Contract Administrator has been changed to Patrick Russell.

Please note the Agency Program Manager has been changed to Michelle Viaches.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency

AGENCY NAME PHONE EMAIL

DTMB Lucy Pline 517-896-5103 plinel@michigan.gov

TREA Michelle Viaches 517-512-0608 ViachesM@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 6 TO CONTRACT NO. MA190000000099

Trintech, Inc.

5600 Granite Parkway, Suite 10000, Plano, TX 75024, USA Phone: (972) 701-9802 Email: Renewals@Trintech.com

Renewal Notice:

Q-69340

Start Date: 8/1/2024

Ship To Melanie Alvord State of Michigan 111 South Capitol Avenue Lansing, MI 48933-1520

USA

5172168538 alvordm1@michigan.gov

Bill To State of Michigan 111 South Capitol Avenue Lansing, MI 48933-1520

USA

Quantity Product Name Start Date End Date Monthly Fee

500.00 Frontier Storage 8/1/2024 USD 800.00

TOTAL: USD 800.00

This is not an invoice. This is a summary of your account that will be renewed

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Joseph Avery

517-636-5350

AveryJ8@michigan.gov

Patrick Russell

(517) 648-7767 russellp2@michigan.gov

STATE CONTACTS

DTMBC

ontract

A dm inistrator

Program anager

TREA

Trintech Inc.

5600 Granite Parkway Suite 10000 Plano TX 75024

Karen Kozlowski

972-440-5181 karen.kozlowski@trintech.com

VS0326803

N

EW

C O

N

TR

A C

TO

R

CONTRACT SUMMARY

Treasury Fiserv Software, Maintenance & Installati

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE BEFORE December 14, 2018 December 14, 2021 5 - 12 Months December 14, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other NoYes

Contract Number MA190000000099 to

FISERV SOLUTIONS, LLC

2900 Westside Pkwy Alpharetta GA 30004

Channing Monti

443-676-3516 channing.monti@fiserv.com

CV0049962

C U

R R

EN

T C

O N

TR

A

C

TO

R

Change Notice Number 5

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,330,356.38 $0.00 $1,330,356.38

DESCRIPTION

Effective 06/07/24, this contract is transitioned from Contractor Fiserv Inc. to new Contractor Trintech Inc.

Please note the new Contractor Contact Administrator is Karen Kozlowski.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 4 to

Contract Number 171190000000099

CONTRACT SUMMARY

TREASURY FISERV SOFTWARE, MAINTENANCE & INSTALLATION

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

December 14, 2018 December 14, 2021 0 - 0 Year December 14, 2021

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☒ 5 Years December 14, 2026

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$401,785.00 $468,374.64 $870,159.64

DESCRIPTION

Effective 3/15/2022, this contract is extended for 5 years from original contract expiration date of 12/14/2021, with five additional option years added, and is increased by $468,374.64. The revised contract expiration date is 12/14/2026.

Updated Service Level Agreement and Data Security Schedules are attached and hereby added to this Change Notice.

Ad Board approval for this extension was received on 12/14/2021.

All other terms, conditions, and specifications remain the same. Per DTMB contractor (request/proposal) and agency (request) agreement, and DTMB Procurement approval.

S T

A

E

O

N T

R A

C T

R

FISERV INC

2900 Westside Pkwy

Alpharetta, GA 30004

Channing Monti

443-676-3516 channing.monti@fiserv.com

CV0049962

P ro g a n a g e r

Joseph Avery TREA

517-512-0608 averyj8@Michigan.gov C o n tra c t

A d m in is tra to r

Jennifer May DTMB

517-242-4215 mayj7@michigan.gov mailto:channing.monti@fiserv.com mailto:averyj8@Michigan.gov mailto:mayj7@michigan.gov

Michigan.gov/MiProcurement

Revision Date: 4/22/2021

SCHEDULE B - SERVICE LEVEL AGREEMENT

IF THE SOFTWARE IS CONTRACTOR HOSTED, then the following applies:

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract Terms and Conditions.

“Actual Uptime” means the total minutes in the Service Period that the Hosted Services are

Available. “Availability” has the meaning set forth in Section 2.1.

“Availability Requirement” has the meaning set forth in Section 2.1.

“Available” has the meaning set forth in Section 2.1.

“Contact List” means a current list of Contractor contacts and telephone numbers set forth in the attached Schedule D – Attachment 1 to this Schedule to enable the State to escalate its Support Requests, including: (a) the first person to contact; and (b) the persons in successively more qualified or experienced positions to provide the support sought.

“Corrective Action Plan” has the meaning set forth in Section 3.9.

“Critical Service Error” has the meaning set forth in Section 3.5.

“Exceptions” has the meaning set forth in Section 2.2.

“High Service Error” has the meaning set forth in Section 3.5.

“Low Service Error” has the meaning set forth in Section 3.5.

“Medium Service Error” has the meaning set forth in Section 3.5.

“Resolve” has the meaning set forth in Section 3.6.

"RPO" or "Recovery Point Objective" means the maximum amount of potential data loss in the event of a disaster.

"RTO" or "Recovery Time Objective" means the maximum period of time to fully restore the Hosted Services in the case of a disaster.

“Scheduled Downtime” has the meaning set forth in Section 2.3.

“Scheduled Uptime” means the total minutes in the Service Period.

“Service Availability Credits” has the meaning set forth in Section 2.6(a).

“Service Error” means any failure of any Hosted Service to be Available or otherwise perform in accordance with this Schedule.

“Service Level Credits” has the meaning set forth in Section 3.8.

“Service Level Failure” means a failure to perform the Software Support Services fully in compliance with the Support Service Level Requirements.

“Service Period” has the meaning set forth in Section 2.1.

“Software Support Services” has the meaning set forth in Section 3.

“State Systems” means the information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems) and networks, of the State or any of its designees.

“Support Hours” means 8:30 a.m. to 5:30 p.m. Eastern, Monday thru Friday (excluding the following holidays observed by Fiserv:

New Year’s Day; Martin Luther King Day; Memorial Day; Juneteenth; Independence Day; Labor Day; Veterans Day; Thanksgiving Day; and Christmas Day)

“Support Request” has the meaning set forth in Section 3.5.

“Support Service Level Requirements” has the meaning set forth in Section 3.4.

2. Service Availability and Service Availably Credits.

2.1 Availability Requirement. Contractor will make the Hosted Services and Software Available, as measured over the course of each calendar month during the Term and any additional periods during which Contractor does or is required to perform any Hosted Services (each such calendar month, a “Service Period”), at least 99.98% of the time, excluding only the time the Hosted Services are not Available solely as a result of one or more Exceptions (the “Availability Requirement”). “Available” means the Hosted Services and Software are available and operable for access and use by the State and its Authorized Users over the Internet in material conformity with the Contract. “Availability” has a correlative meaning. The Hosted Services and Software are not considered Available in the event of a material performance degradation or inoperability of the Hosted Services and Software, in whole or in part. The Availability Requirement will be calculated for the Service Period as follows: (Actual Uptime – Total Minutes in Service Period Hosted Services or Software are not Available Due to an Exception) ÷ (Scheduled Uptime – Total Minutes in Service Period Hosted Services or Software are not Available Due to an Exception) x 100 = Availability.

2.2 Exceptions. No period of Hosted Services degradation or inoperability will be included in calculating Availability to the extent that such downtime or degradation is due to any of the following (“Exceptions”):

(a) Failures of the State’s or its Authorized Users’ internet connectivity;

(b) Scheduled Downtime as set forth in Section 2.3.

2.3 Scheduled Downtime. Contractor must notify the State at least twenty-four (24) hours in advance of all scheduled outages of the Hosted Services or Software in whole or in part (“Scheduled Downtime”). All such scheduled outages will be done over the weekend during a nightly maintenance window of 9pm-6am Eastern Time.

2.4 Software Response Time. Software response time, defined as the interval from the time the end user sends a transaction to the time a visual confirmation of transaction completion is received, must be less than two (2) seconds for 98% of all transactions. Unacceptable response times shall be considered to make the Software unavailable and will count against the Availability Requirement.

2.5 Service Availability Reports. Within thirty (30) days after the end of each Service Period, Contractor will provide to the State a report describing the Availability and other performance of the Hosted Services and Software during that calendar month as compared to the Availability Requirement. The report must be in electronic or such other form as the State may approve in writing and shall include, at a minimum: (a) the actual performance of the Hosted Services and Software relative to the Availability Requirement; and (b) if Hosted Service performance has failed in any respect to meet or exceed the Availability Requirement during the reporting period, a description in sufficient detail to inform the State of the cause of such failure and the corrective actions the Contractor has taken and will take to ensure that the Availability Requirement are fully met.

2.6 Remedies for Service Availability Failures.

(a) If the actual Availability of the Hosted Services and Software is less than the Availability Requirement for any Service Period, such failure will constitute a Service Error for which Contractor will issue to the State the following credits on the fees payable for Hosted Services and Software provided during the Service Period (“Service Availability Credits”):

Availability Credit of Fees

≥99.98% None

<99.98% but ≥99.0% 15%

<99.0% but ≥95.0% 50%

<95.0% 100%

(b) Any Service Availability Credits due under this Section 2.6 will be applied in accordance with payment terms of the Contract.

(c) If the actual Availability of the Hosted Services and Software is less than the Availability Requirement in any two (2) of four (4) consecutive Service Periods, then, in addition to all other remedies available to the State, the State may terminate the Contract on written notice to Contractor with no liability, obligation or penalty to the State by reason of such termination.

3. Support and Maintenance Services. Contractor will provide IT Environment Service and Software maintenance and support services (collectively, “Software Support Services”) in accordance with the provisions of this Section 3. The Software Support Services are included in the Services, and Contractor may not assess any additional fees, costs or charges for such Software Support Services.

3.1 Support Service Responsibilities. Contractor will:

(a) correct all Service Errors in accordance with the Support Service Level Requirements, including by providing defect repair, programming corrections and remedial programming;

(b) provide unlimited telephone support during the Support Hours,

(c) provide unlimited online support 24 hours a day, seven days a week;

(d) provide online access to technical support bulletins and other user support information and forums, to the full extent Contractor makes such resources available to its other customers; and

(e) respond to and Resolve Support Requests as specified in this Section 3.1.

3.2 Service Monitoring and Management. Contractor will continuously monitor and manage the Hosted Services and Software to optimize Availability that meets or exceeds the Availability Requirement. Such monitoring and management includes:

(a) proactively monitoring on a twenty-four (24) hour by seven (7) day basis all Hosted Service functions, servers, firewall and other components of Hosted Service security;

(b) if such monitoring identifies, or Contractor otherwise becomes aware of, any circumstance that is reasonably likely to threaten the Availability of the Hosted Service, taking all necessary and reasonable remedial measures to promptly eliminate such threat and ensure full Availability; and

(c) if Contractor receives knowledge that the Hosted Service or any Hosted Service function or component is not Available (including by written notice from the State pursuant to the procedures set forth herein):

(i) confirming (or disconfirming) the outage by a direct check of the associated facility or facilities;

(ii) If Contractor’s facility check in accordance with clause (i) above confirms a Hosted

Service outage in whole or in part: (A) notifying the State in writing pursuant to the procedures set forth herein that an outage has occurred, providing such details as may be available, including a Contractor trouble ticket number, if appropriate, and time of outage; and (B) working all problems causing and caused by the outage until they are Resolved as Critical Service Errors in accordance with the Support Request Classification set forth in Section 3.5, or, if determined to be an internet provider problem, open a trouble ticket with the internet provider; and

(iii) Notifying the State that Contractor has fully corrected the outage and any related problems, along with any pertinent findings or action taken to close the trouble ticket.

3.3 Service Maintenance. Contractor will continuously maintain the Hosted Services and Software to optimize Availability that meets or exceeds the Availability Requirement. Such maintenance services include providing to the State and its Authorized Users:

(a) all updates, bug fixes, enhancements, Maintenance Releases, New Versions and other improvements to the Hosted Services and Software, including the Software, that Contractor provides at no additional charge to its other similarly situated customers; provided that Contractor agrees, upon at least 30 days’ prior written notice from the State, to delay implementation of a modification or upgrade of Hosted Services and Software, including Maintenance Releases and New Versions of Software, no longer than 3 months; and

(b) all such services and repairs as are required to maintain the Hosted Services and Software or are ancillary, necessary or otherwise related to the State’s or its Authorized Users’ access to or use of the Hosted Services and Software, so that the Hosted Services and Software operate properly in accordance with the Contract and this Schedule.

3.4 Support Service Level Requirements. Contractor will correct all Service Errors and respond to and Resolve all Support Requests in accordance with the required times and other terms and conditions set forth in this Section 3.4 (“Support Service Level Requirements”), and the Contract.

3.5 Support Requests. The State will classify its requests for Service Error corrections in accordance with the descriptions set forth in the chart below (each a “Support Request”). The State will notify Contractor of Support Requests by email, telephone or such other means as the parties may hereafter agree to in writing.

Support Request Classification Description:

Any Service Error Comprising or Causing any of the Following Events or Effects

Critical Service Error • Issue affecting entire system or single critical production function;

• System down or operating in materially degraded state;

• Data integrity at risk;

• Declared a Critical Support Request by the State; or

• Widespread access interruptions.

High Service Error • Primary component failure that materially impairs its performance; or

• Data entry or access is materially impaired on a limited basis.

Support Request Classification Description:

Any Service Error Comprising or Causing any of the Following Events or Effects

Medium Service Error • IT Environment Services and Software is operating with minor issues that can be addressed with an acceptable (as determined by the State) temporary work around.

Low Service Error • Request for assistance, information, or services that are routine in nature.

Point of Contact Service Error • Any issue for which the State requests assistance from the team lead identified by Fiserv via ServicePoint ticket.

3.6 Response and Resolution Time Service Levels. Response and Resolution times will be measured from the time Contractor receives a Support Request until the respective times Contractor has (i) responded to, in the case of response time and (ii) Resolved such Support Request, in the case of Resolution time. “Resolve” (including “Resolved”, “Resolution” and correlative capitalized terms) means that, as to any Service Error, Contractor has provided the State the corresponding Service Error correction and the State has confirmed such correction and its acceptance thereof. Contractor will respond to and Resolve all Service Errors within the following times based on the severity of the Service Error:

Support Request

Classification

Service Level Metric

(Required

Response

Time)

Service Level Metric

Resolution

Time)

Service Level Credits

(For Failure to

Respond to any

Support Request

Within the

Corresponding

Response Time)

Credits

Resolve any

Support Request

Within the

Corresponding

Required Resolution

Critical Service

Error

One (1) hour Three (3) hours Five percent (5%) of the Fees for the month in which the initial

Service Level Failure begins and five percent (5%) of such monthly Fees for each additional hour or portion thereof that the corresponding Service

Error is not responded

Five percent (5%) of the Fees for the month in which the initial Service Level

Failure begins and five percent (5%) of such monthly Fees for the first additional hour or portion thereof that the corresponding

Service Error remains

Support Request

Classification

Response

Time)

Resolutio n Time)

Service Level Credits

Respond to any

Support Request

Within the

Corresponding

Response Time)

Credits

Resolve any

Support Request

Within the

Corresponding

Required Resolution to within the required response time.

un-Resolved, which amount will thereafter double for each additional one-hour increment.

High Service Error One (1) hour Four (4) hours Three percent (3%) of the Fees for the month in which the initial

Service Level Failure begins and three percent (3%) of such monthly Fees for each additional hour or portion thereof that the corresponding Service

Error is not responded to within the required response time.

Three percent (3%) of the Fees for the month in which the initial Service Level

Failure begins and three percent (3%) of such monthly Fees for the first additional hour or portion thereof that the corresponding

Service Error remains un-Resolved, which amount will thereafter double for each additional one-hour increment.

Medium Service

Error

Three (3) hours

Two (2)

Business

Days

N/A N/A

Low Service Error Three (3) hours

Five (5)

Business

Days

N/A N/A

Point of Contact Service Error

Forty-

Eight (48)

Hours

N/A One-time fee of $200 for each month in which Fiserv fails to acknowledge the receipt of a Point of Contact Service Error within the Required Response Time .

N/A

3.7 Escalation. With respect to any Critical Service Error Support Request, until such

Support Request is Resolved, Contractor will escalate that Support Request within sixty (60) minutes of the receipt of such Support Request by the appropriate Contractor support personnel, including, as applicable, the Contractor Project Manager and Contractor’s management or engineering personnel, as appropriate.

3.8 Support Service Level Credits. Failure to achieve any of the Support Service Level Requirements for Critical and High Service Errors will constitute a Service Level Failure for which Contractor will issue to the State the corresponding service credits set forth in Section 3.6 (“Service Level Credits”) in accordance with payment terms set forth in the Contract.

3.9 Corrective Action Plan. If two or more Critical Service Errors occur in any thirty

(30) day period during (a) the Term or (b) any additional periods during which Contractor does or is required to perform any Hosted Services, Contractor will promptly investigate the root causes of these Service Errors and provide to the State within five (5) Business Days of its receipt of notice of the second such Support Request an analysis of such root causes and a proposed written corrective action plan for the State’s review, comment and approval, which, subject to and upon the State’s written approval, shall be a part of, and by this reference is incorporated in, the Contract as the parties’ corrective action plan (the “Corrective Action Plan”). The Corrective Action Plan must include, at a minimum: (a) Contractor’s commitment to the State to devote the appropriate time, skilled personnel, systems support and equipment and other resources necessary to Resolve and prevent any further occurrences of the Service Errors giving rise to such Support Requests; (b) a strategy for developing any programming, software updates, fixes, patches, etc. necessary to remedy, and prevent any further occurrences of, such Service Errors; and (c) time frames for implementing the Corrective Action Plan. There will be no additional charge for Contractor’s preparation or implementation of the Corrective Action Plan in the time frames and manner set forth therein.

4. Data Storage, Backup, Restoration and Disaster Recovery. Contractor must maintain or cause to be maintained backup redundancy and disaster avoidance and recovery procedures designed to safeguard State Data and the State’s other Confidential Information, Contractor’s Processing capability and the availability of the IT Environment Services and Software, in each case throughout the Term and at all times in connection with its actual or required performance of the Services hereunder. All backed up State Data shall be located in the continental United States.

The force majeure provisions of this Contract do not limit Contractor’s obligations under this section.

4.1 Data Storage. Contractor will provide sufficient storage capacity to meet the needs of the State at no additional cost.

4.2 Data Backup. Contractor will conduct, or cause to be conducted, daily back-ups of State Data and perform, or cause to be performed, other periodic offline back-ups of State Data on at least a weekly basis and store and retain such back-ups as specified in Schedule A.

Contractor must, within five (5) Business Days of the State’s request, provide the State, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Contractor), an extract of State Data in the format specified by the State.

4.3 Data Restoration. If the data restoration is required due to the actions or inactions of the Contractor or its subcontractors, Contractor will promptly notify the State and complete actions required to restore service to normal production operation. If requested, Contractor will restore data from a backup upon written notice from the State. Contractor will restore the data within one (1) Business Day of the State’s request. Contractor will provide data restorations at its sole cost and expense.

4.4 Disaster Recovery. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will maintain and operate a backup and disaster recovery plan to achieve a Recovery Point Objective (RPO) of 24 hours, and a Recovery Time Objective (RTO) of 48 hours (the “DR Plan”) and implement such DR Plan in the event of any unplanned interruption of the Hosted Services. Contractor’s current DR Plan, revision history, and any reports or summaries relating to past testing of or pursuant to the DR Plan are attached as Schedule F. Contractor will actively test, review, and update the DR Plan on at least an annual basis using industry best practices as guidance. Contractor will provide the State with copies of all such updates to the Plan within fifteen

(15) days of its adoption by Contractor. All updates to the DR Plan are subject to the requirements of this Section 4.4; and provide the State with copies of all reports resulting from any testing of or pursuant to the DR Plan promptly after Contractor’s receipt or preparation. If Contractor fails to reinstate all material Hosted Services and Software within the periods of time set forth in the DR Plan, the State may, in addition to any other remedies available under this Contract, in its sole discretion, immediately terminate this Contract as a non-curable default.

SCHEDULE C – DATA SECURITY REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosted Services” means the hosting, management and operation of the computing hardware, ancillary equipment, Software, firmware, data, and other services (including support services), and related resources for remote electronic access and use by the State and its Authorized Users, including any services and facilities related to disaster recovery obligations.

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services under this

Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Hosted Services who has sufficient knowledge of the security of the Hosted Services and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Representatives comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be materially consistent with NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in IRS Publication 1075 .

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the contracted solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Policy. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Policy, see https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458

958_7.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Policy before accessing State systems. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any

Contractor Personnel’s access to State systems if the State determines a violation has occurred. Contractor access to State’s IT environment is not anticipated at the time of contracting.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains

FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting

Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the

Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the

State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this

Contract for cause pursuant to Section 15.1 of the Contract;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit. based on State required NIST Special Publication 800-53 MOD

Controls.

5.3 ensure that the Software and State Data is securely hosted, supported, administered, accessed, and backed up in a data center(s) that resides in the continental United States, and meets the Service

Availability set forth in Exhibit [D] – Service Level Agreement;

5.4 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that is materially consistent with

FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in IRS Publication 1075

5.5 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with HIPAA, PCI and applicable law, and materially consistent with FISMA, NIST, CMS, IRS, FBI, SSA, and FERPA requirements as applicable);

5.6 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) State Data from being commingled with or https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458958_7.pdf https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458958_7.pdf https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458958_7.pdf https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458958_7.pdf contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the

State Data;

5.7 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.8 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using

Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.9 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. From time-to-time, State may utilize third party hosted SaaS services platform (Third Party SaaS) to perform vendor oversight and assess the processes, procedures, and systems of

Contractor deliverables provided Third Party SaaS vendor cannot access or use Contractor documentation provided for the Security Accreditation process and uploaded to the third party SaaS solution. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs and perform related remediation activities.

The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and shall not permit any access to, State systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization.

Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the

State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to

Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. State shall be entitled to perform or to have its authorized agent perform audits to verify Contractor's compliance with this contract. Audits shall: a) take place no more than once per calendar year, b) The scope of any such audit shall be agreed to by the parties not less than 60 days in advance and otherwise in accordance with the audit related terms and conditions set forth in this Section, c) take place during normal business hours, d) allow documents pertaining to audit to be reviewed, however no cameras or electronic recording equipment is allowed, e) allow Auditors to conduct inquiry and limited observation based testing. To the extent that Contractor has undergone a SOC1 Type 2 audit, SOC2 Type 2 audit or PCI-DSS certification, State shall reasonably leverage audit reports and certifications to consolidate and condense requisite testing. The Contractor must make available third party Penetration Testing summary results upon request. Scanning of systems is prohibited. Contractor may, in its sole discretion, withhold any confidential or proprietary information where disclosure may directly impact client confidentiality or contractual agreements, or where disclosure would jeopardize the safety and security of Contractor applications or systems.

During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

With respect to State Data, Contractor must implement any required mutually agreed upon safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program

8.3 The State reserves the right, at its sole election, to immediately terminate this Contract or a

Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans in compliance with Contractor policy and procedures.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Scanning interactive application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must dynamically scan a deployed version of the Software using an industry standard scanning tool and provide the State a summary assessment report upon written request. These scans and assessments i) must be completed quarterly and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans. These scans must be completed for all source code initially, for all updated source code prior to use in a production environment and for all source code for each major release and Contractor shall provide the State a summary SAST report upon written request.

9.3 Software Composition Analysis (SCA) – Third Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third party and open source software, all included third party and open source software must be documented and the source supplier must be monitored by the

Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of

SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third party and open source software initially, for all updated third party and open source software, and for all third party and open source software in each major release and Contractor shall provide the State a summary report upon written request.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 For Hosted Services, Contractor must ensure the infrastructure and applications are scanned using an approved scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly. Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements in compliance with PCI and Contractor’s policies and standards.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other

Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

Frontier Extension Quotation

FRONTIER SERVICES AND FEES

Services Description Year

Recurring Monthly Fees

(for up to 2,000,000 Transactions processed monthly)

FrontierTM Reconciliation with

FrontierTM Reconciliation: Account

Certification and Frontier

ReconciliationTM Transfer Manager

(3/15/2022 – 12/31/2022) $7,715.00

$7,946.45

$8,184.84

$8,430.38

$8,683.30

Department of Technology, Management, and Budget

Change Notice Number 3

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

☐ ☒ 1 month March 14, 2022

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$394,070.00 $7,715.00 $401,785.00

DESCRIPTION

Effective 2/8/2022, this contract is hereby extended for 1 month with a new expiration date of March 14, 2022.

$7,715.00 is being added to cover the cost of this extension.

Ad Board approval for this extension was received on 12/14/2021.

All other terms, conditions, and specifications remain the same. Per DTMB contractor (request/proposal) and agency (request)

STA

TE

C O

N

TR

A

TO

Alpharetta, GA 30004

Channing Monti

443-676-3516

Program anager

Joseph Avery TREA

517-512-0608 averyj8@Michigan.gov C ontract A dm inistrator

Jennifer May DTMB

Alpharetta, GA 30004

Channing Monti

443-676-3516

P ro g n a g e r

Joseph Avery TREA

517-512-0608 averyj8@Michigan.gov C o n tra c t

A d m in is tra to r

Jennifer May DTMB

Department of Technology, Management, and Budget

Change Notice Number 2

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

☐ ☐ February 14, 2022

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$378,640.00 $15,430.00 $394,070.00

DESCRIPTION

Effective 12/15/2021, this contract is hereby extended for 2 months with a new expiration date of February 14, 2022.

$15,430.00 is being added to cover the cost of this extension.

Contract Administrator has been changed to Jennifer May.

Program Manager has been changed to Joseph Avery.

Ad Board approval for this extension was received on 12/14/2021.

All other terms, conditions, and specifications remain the same. Per DTMB contractor (request/proposal) and agency (request)

S

A

E

N T

R A

C T

R

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 1 to

190000000099Contract Number

BoettcherA@Michigan.gov

Andrew Boettcher

James Wilson channing.monti@fiserv.com

Channing Monti

Alpharetta, GA 30004

FISERV SOLUTIONS, LLC

CV0049962

443-676-3516

2900 Westside Pkwy

517-243-0434 S

T A

T E

P ro g n a g e r

C o n tra c t

A d m in is tra to r

C O

N T

R A

C T

O R

TREA

517-636-0631

DTMB

wilsonj40@michigan.gov

$378,640.00

December 14, 2018 December 14, 2021

TREASURY FISERV SOFTWARE, MAINTENANCE & INSTALLATI

December 14, 2021

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

0 - 0 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ December 14, 2021

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $378,640.00

Effective 8/9/2019, the following amendment is incorporated into this Contract per attached Updated State Project Contacts Table.