190000000393.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 10 to

Contract Number MA190000000393

C O

N

TR

AC

TO

R

AXON ENTERPRISE INC

17800 N 85th St.

Scottsdale AR 85255-6311

Dustin Green

717-752-6354 dgreen@axon.com

CV0065487

ST

AT

E

Pr og ra m

M an ag er

Various Various

C on tr ac t Ad m in is tr at or Nichole Harrell DTMB

517-449-9245

Harrelln@michigan.gov

CONTRACT SUMMARY

TASERS, Public Safety Video Systems and Related Products and Services.

INITIAL EFFECTIVE DATE

September 26, 2019

INITIAL EXPIRATION DATE

September 27, 2024

INITIAL AVAILABLE OPTIONS

0 - 0 Months

EXPIRATION DATE BEFORE

September 27, 2029

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

No Minimum Delivery Requirement.

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$29,986,266.70

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$29,986,266.70

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective June 10, 2026, the parties agree to modify pricing per the attached Schedule F - Pricing - Attachment 1. All other terms, conditions, specifications and pricing shall remain the same. Per Vendor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 10 TO CONTRACT NO. MA190000000393

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

DNR Jennifer Wolf 517-284-6231 WOLFJ1@michigan.gov

DTMB Laura Brancheau 517-335-1334 BrancheauL@michigan.gov

MDOC Wil Alexander 517-643-6501 alexanderw@michigan.gov

MSP Justin Mazur 906-203-9966 mazurj1@michigan.gov

DTMB Jim Coggin 517-243-5265 CogginJ@michigan.gov

DTMB Craig Weaver 517-243-7826 WeaverC1@michigan.gov

Michigan.gov/MiProcurement

SCHEDULE F – PRICING - ATTACHMENT 1

The following price table applies to the Michigan Department of Corrections (MDOC) only.

New line items are highlighted (Effective 6/10/2026 via Change Notice No. 10)

ITEM

NO.

PRODUCT

CODE PRODUCT NAME MDOC

PRICE

MONTHLY

SUBSCRIPTION

1 C00031 TASER 10 CERTIFICATION PRO PLAN $105.32 Yes

2 C00028 BUNDLE - TASER 10 CERTIFICATION

PRO ADD-ON $63.20 Yes

3 V00023 FULL VR PLAN $25.28 Yes

4 102596 TASER CEW + VR INSTRUCTOR CERT &

IMPLEMENTATION (3- DAY) $11,840.00

5 80374 AXON TASER - EXT WARRANTY -

BATTERY PACK T7/T10 $0.53 Yes

6 80396 AXON TASER - EXT WARRANTY - DOCK

SIX BAY T7/T10 $8.11 Yes

7 100704 AXON TASER 10 - EXT WARRANTY -

HANDLE $8.74 Yes

8 100400 AXON TASER 10 - CARTRIDGE - HALT $17.76

9 100399 AXON TASER 10 - CARTRIDGE - LIVE $17.76

10 101695 AXON TASER 10 - EXT WARRANTY -

DEDICATED TRAINING HANDLE $35.50 Yes

11 101696 AXON TASER 10 - EXT WARRANTY -

POOLED HANDLE $17.06 Yes

12 100392 AXON TASER 10 - HANDLE - INERT RED

CLASS 2 $1,480.00

13 100391 AXON TASER 10 - HANDLE - YELLOW

CLASS 2 $1,739.00

14 100390 AXON TASER 10 - HANDLE - YELLOW

CLASS 3R $1,739.00

15 100617 AXON TASER 10 - HOLSTER -

BLACKHAWK - LH $63.64

16 100616 AXON TASER 10 - HOLSTER -

BLACKHAWK - RH $65.55

17 100615 AXON TASER 10 - HOLSTER - BLADE-

TECH LH $66.82

ITEM

NO.

PRODUCT

CODE PRODUCT NAME MDOC

PRICE

MONTHLY

SUBSCRIPTION

18 100614 AXON TASER 10 - HOLSTER - BLADE-

TECH RH $66.82

19 100621 AXON TASER 10 - HOLSTER - S.O. TECH

AMBIDEXTROUS $63.64

20 100394 AXON TASER 10 - MAGAZINE - HALT

TRAINING BLUE $122.10

21 100396 AXON TASER 10 - MAGAZINE - INERT

RED $122.10

22 101755 AXON TASER 10 - MAGAZINE - LIVE

DUTY BLACK V2 $122.10

23 101757 AXON TASER 10 - MAGAZINE - LIVE

TRAINING PURPLE V2 $122.10

24 100751 AXON TASER 10 - REPLACEMENT

ACCESS PROGRAM - DUTY CARTRIDGE $6.69 Yes

25 101456 AXON TASER 10 - REPLACEMENT

INTERPOSER BUCKET $14.80

26 101455 AXON TASER 10 - REPLACEMENT TOOL

KIT - INTERPOSER BUCKET $207.20

27 100613 AXON TASER 10 - SAFARILAND

HOLSTER - LH $67.35

28 100611 AXON TASER 10 - SAFARILAND

HOLSTER - RH $67.35

29 101125 AXON VR - HOLSTER - T10 BLACKHAWK

GRAY - LH $74.00

30 101124 AXON VR - HOLSTER - T10 BLACKHAWK

GRAY - RH $74.00

31 101119 AXON VR - HOLSTER - T10 BLADE-TECH

GRAY - LH $148.00

32 101120 AXON VR - HOLSTER - T10 BLADE-TECH

GRAY - RH $148.00

33 101123 AXON VR - HOLSTER - T10 SAFARILAND

GRAY - LH $74.00

34 101122 AXON VR - HOLSTER - T10 SAFARILAND

GRAY - RH $74.00

35 BWC TAP Bundle

NO.

PRODUCT

CODE PRODUCT NAME MDOC

PRICE

MONTHLY

SUBSCRIPTION

Technology assurance plan: combines warranty service on products and an automatic refresh of body camera and dock units every 2.5 years. The tap program includes on-site spare units to act as backup devices.

1.1 TAP Warranty. Throughout the TAP

Warranty Term, Axon will repair or replace a Device that is not functioning for any reason except for damage related to: (a) failure to follow Axon Device use instructions; (b) Devices used with equipment not manufactured or recommended by Axon (unless Axon provided written permission); (c) abuse, misuse, or intentional damage to Device; (d) force majeure; (e) Devices repaired or modified by persons other than Axon without Axon’s written permission; or (f) Devices with a defaced or removed serial number.

1.2 If Axon receives a warranty claim for

an Axon manufactured Device during the TAP Warranty Term, Axon’s sole responsibility is to repair or replace the Device with the same or like Device, at Axon’s option and expense. Unless the State otherwise agrees in writing, a replacement Axon Device will be new and will be at least the same or equivalent version. Axon will warrant the replacement Axon Device for the TAP Warranty Term. If Agency exchanges a device or part, upon the State’s Acceptance of the replacement Device, the replacement item becomes Agency’s property, and the replaced item becomes Axon’s property. Before delivering an Axon Device for service, Agency must upload Axon Device data to Axon Evidence or download it and

NO.

PRODUCT

CODE PRODUCT NAME MDOC

PRICE

MONTHLY

SUBSCRIPTION

retain a copy. Axon is not responsible for any loss of software, data, or other information contained in storage media or any part of the Axon Device sent to Axon for service.

36 74200 AXON TASER-DOCK SIX BAY PLUS

CORE $1,332.71

37 74201 AXON TASER-DOCK SINGLE BAY PLUS

CORE $512.01

38 80090 AXON TASER TARGET FRAME $91.46

39 80087 AXON TASER TARGET CONNECTIVE

RUGGEDIZED $177.79

40 100623 HALT SUIT HOOK AND LOOP TRAINING $888.00

41 100401 AXON TASER 10 CARTRIDGE-INERT $0.74

42 71104 AXON POWERCORD NORTH AMERICA

TASER $7.40

43 71019 AXON BODY DOCK POWERCORD

NORTH AMERICA $8.71

44 20027 AXON TASER BATTERY PACK

DISCONNECT $116.05

45 20018 AXON TASER BATTERY PACK TACTICAL $86.70

46 22010 AXON TASER X2 BATTERY PACK

STANDARD $64.53

47 22184 AXON TASER X2 CARTRIDGE 15 FT $38.05

48 22185 AXON TASER X2 CARTRIDGE 25 FT $38.05

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 9 to Contract Number MA190000000393

C O

N

TR

A C

TO

R

AXON ENTERPRISE INC

17800 N 85th St.

Scottsdale AR 85255-6311

Dustin Green

717-752-6354 dgreen@axon.com

CV0065487

ST

A

TE

Pr og ra m

M an ag er

Various Various

C on tr ac t A dm in is tr at or Nichole Harrell DTMB

517-449-9245 harrelln@michigan.gov

CONTRACT SUMMARY

TASERS, Public Safety Video Systems and Related Products and Services.

INITIAL EFFECTIVE DATE

September 26, 2019

INITIAL EXPIRATION DATE

September 27, 2024

INITIAL AVAILABLE OPTIONS

0 - 0 Months

EXPIRATION DATE

BEFORE

September 27, 2029

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

No Minimum Delivery Requirement.

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE

$29,986,266.70

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$29,986,266.70

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective February 25, 2025, the parties agree to the Contract revisions included in the attached documentation. The Contractor's Contract Administrator has been updated from Doug Simmons to Dustin Green. The DTMB Business Relationship Manager supporting the Michigan Department of Corrections (MDOC) has been updated from Dave Enslin to Craig Weaver.

All other terms, conditions, specifications and pricing remain the same. Per Contractor and agency agreement and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 9 TO CONTRACT NO. MA190000000393

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

DNR Jennifer Wolf 517-284-6231 WOLFJ1@michigan.gov

DTMB Laura Brancheau 517-335-1334 BrancheauL@michigan.gov

MDOC Wil Alexander 517-643-6501 alexanderw@michigan.gov

DTMB Jim Coggin 517-243-5265 CogginJ@michigan.gov

MSP Justin Mazur 906-203-9966 mazurj1@michigan.gov

DTMB Craig Weaver 517-243-7826 WeaverC1@michigan.gov

Now, therefore, the parties agree to incorporate the following changes to the Contract:

1) The following definitions are incorporated into this Contract –

“Access” means (1) the ability and means to enter a restricted or locked area, room, or physical container containing State Data; or (2) the ability and means to communicate with or otherwise interact with a system, to use system resources to handle information, to gain the information or knowledge of the information the system contains, or to control system components and functions (including physical or technical controls, or having the ability to modify or bypass any or all security controls).

“Operating Environment” means, collectively, the platform, environment and conditions on, in or under which the Software is intended to be installed and operate, as set forth in a Statement of Work, including such structural, functional and other features, conditions and components as hardware, operating software, system architecture, configuration, computing hardware, ancillary equipment, networking, software, firmware, databases, data, and electronic systems (including database management systems).

“Permitted Subcontractor” means any third party hired by Contractor to perform Services for the State under this Contract or that will have Access to or have the ability to control access to State Data or both.

“Solution” means Deliverables and Services singularly or in any combination thereof, as applicable, set forth in a Statement of Work.

2) Section 7.4 Effect of Termination, subsection (b), only, is hereby deleted and replaced with the following –

Upon the conclusion of any applicable Transition Period where Contractor may provide Transition Responsibilities under the Contract, Contractor will not delete State Data for ninety

(90) days following termination. Axon Cloud Services will not be functional during these ninety

(90) days other than the ability to retrieve State Data. The State will not incur additional fees if the State downloads State Data from Axon Cloud Services during this time. Contractor has no obligation to maintain or provide State Data after these ninety (90) days and will thereafter, unless legally prohibited, delete all State Data. Upon request, Contractor will provide written proof that Contractor successfully deleted and fully removed all State Data from Axon Cloud Services. Contractor will provide the State with the same post-termination data retrieval assistance that Contractor generally makes available to all customers. Requests for Contractor to provide additional assistance in downloading or transferring State Data, including requests for Contractor’s data egress service, will result in additional fees and Contractor will not warrant or guarantee data integrity or readability in the external system.

3) Section 7.4 Effect of Termination is hereby amended to add a new Section 7.4 (f) as follows:

Section 7.4(f) – Subject to Section 8 of the Contract, upon terminating this Contract under Section 7.2, the State remains responsible for all fees for services or deliverables accepted by the State on or before the effective date of termination.

Notwithstanding any provisions of this Contract or any Statement of Work to the contrary, if the State purchases any Hardware pursuant to an installment plan, as set forth under the Pricing Schedule, and this Contract terminates, except for termination for Contractor’s default subject to Section 7.1, before the end of the term of the Contract, the State may elect to: (1) pay the remaining installment payments for the Hardware, upon which title to the Hardware will transfer to the State; or (2) in the case of termination for non-appropriation return the Hardware to Contractor within 90 days of termination.

4) Section 9.5. Loss or Compromise of Data, subsection (a), only, is hereby deleted and replaced in its entirety with the following –

9.5. Loss or Compromise of Data.

(a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence;

5) Section 9.7. ADA Compliance is hereby deleted and replaced in its entirety with the following:

9.7. Accessibility Requirements.

(a) Contractor’s Service Software and Deliverables (created or provided by Contractor in a digital format) will comply with level AA of the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.1 to the greatest extent possible.

(b) Throughout the Term, Contractor must, upon request from the State, submit documentation or other information regarding accessibility and Contractor’s compliance with the Digital Accessibility Standards, including without limitation, a completed accessibility conformance report, such as an Information Technology Industry Council (ITAC) Voluntary Product Accessibility Template ( VPAT®), and/or a description of the evaluation methods used to support the Digital Accessibility Standards conformance claims, including, if applicable, any third-party testing.

(c) The State may also conduct its own reviews to assess accessibility and compliance with the State’s Digital Accessibility Standards and Contractor must remediate all issues resulting from any such review in a manner and timeframe agreed upon by the parties in writing.

(d) Failure to comply with the requirements in this Section shall constitute a material breach of this Contract.

6) 14 Limitations of Liability subsection (b) is hereby deleted and replaced in its entirety with the following:

(b) Mutual Limitation of Liability. EXCEPT FOR CONTRACTOR’S OBLIGATIONS

UNDER SECTION 9.5 (LOSS OR COMPROMISE OF DATA) AND SECTION 13

(INDEMNIFICATION), IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY TO THE

OTHER PARTY UNDER THIS CONTRACT, REGARDLESS OF THE FORM OF ACTION,

WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR BY STATUTE OR

OTHERWISE, FOR ANY CLAIM RELATED TO OR ARISING UNDER THIS CONTRACT, EXCEED

$5,000,000.00.

(C) NOTWITHSTANDING ANYTHING TO THE CONTRARY, CONTRACTOR’S CUMULATIVE

LIABILITY FOR DAMAGES SET FORTH UNDER SECTION 9.5 (LOSS OR COMPROMISE OF

DATA) AND SECTION 13.1 (GENERAL INDEMNIFICATION) SHALL NOT EXCEED

$10,000,000,

(D) SUBSECTIONS 14(A),(B), AND (C), ABOVE, WILL NOT APPLY TO CONTRACTOR’S

OBLIGATIONS TO INDEMNIFY THE STATE UNDER SECTIONS 13.2 AND 13.3.

7) Section 20.13 Unfair Labor Practice is hereby deleted and replaced in its entirety with the following –

20.13 Unfair Labor Practice.

Under MCL 423.324, the State may void this Contract if the name of the Contractor, or the name of a subcontractor, manufacturer, or supplier of the Contractor, subsequently appears on the Unfair Labor Practice register compiled under MCL 423.322.

8) Section 20.14 Schedules is hereby deleted and replaced in its entirety with the following:

20.14 Schedules.

Schedule A Statement of Work

Schedule A2 Statement of Work Contract Activities

Schedule A3 Statement of Work

Schedule B Service Level Agreement

Schedule C Data Security Requirements

Schedule D Disaster Recovery Plan

Schedule E Licensing Agreement

Schedule F Pricing

Schedule G Terms for Hardware

Schedule H Product-Specific Appendices

9) Section 20.2 Entire Agreement is hereby deleted and replaced in its entirety with the following –

20.2 Entire Agreement.

This Contract, together with all Schedules, Exhibits, and the Statement of Work constitutes the sole and entire agreement of the parties to this Contract with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Contract, the 37 Schedules, Exhibits, and the Statement of Work, the following order of precedence governs: (a) first, this Contract, excluding its Exhibits and Schedules, and the Statement of Work; (b) second, Schedule C – Data Security Requirements; (c) third, each Statement of Work as of the Effective Date; and (d) fourth, the remaining Exhibits and Schedules to this Contract as of the Effective Date. NO TERMS ON CONTRACTORS

INVOICES, WEBSITE, BROWSE-WRAP, SHRINK-WRAP, CLICK-WRAP, CLICK-THROUGH OR

OTHER NON-NEGOTIATED TERMS AND CONDITIONS PROVIDED WITH ANY OF THE

SERVICES, OR DOCUMENTATION HEREUNDER WILL CONSTITUTE A PART OR

AMENDMENT OF THIS CONTRACT OR IS BINDING ON THE STATE OR ANY AUTHORIZED

USER FOR ANY PURPOSE. ALL SUCH OTHER TERMS AND CONDITIONS HAVE NO FORCE

AND EFFECT AND ARE DEEMED REJECTED BY THE STATE AND THE AUTHORIZED USER,

EVEN IF ACCESS TO OR USE OF SUCH SERVICE OR DOCUMENTATION REQUIRES

AFFIRMATIVE ACCEPTANCE OF SUCH TERMS AND CONDITIONS.

10) Section 20.19 is hereby added as a new section as follows –

20.19 Strategic Partner.

Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606.

11) Section 20.20 is hereby added as a new section as follows:

20.20 State’s Responsibilities. The State will be responsible for (a) the State’s unauthorized or improper use of Axon Devices to the extent such action is not compliant with the terms of this Contract; (b) an end user’s breach of this Contract or violation of applicable law; (c) to the extent required by law or this Contract, the State’s destruction and disposal of Axon Devices at the State’s cost; and (d) any regulatory violations or fines, as a result of improper destruction or disposal of Axon Devices; however, the State will not be responsible for any violation or fine to the extent the State complied with Contractor’s documentation or specifications regarding destruction or disposal of Axon Devices.

12) Schedule C is hereby deleted and replaced with Schedule C – Data Security Requirements for Hybrid Purchases attached to this Change Notice is hereby incorporated into this Contract.

13) Schedule C, Attachment 1 – CJIS Security Addendum attached to this Change Notice is hereby incorporated into this Contract.

14) Schedule D, Attachment 1 – Contact List attached to this Change Notice is hereby incorporated into this Contract.

15) Schedule E Licensing Agreement is hereby deleted and replaced with Schedule E Licensing and Services Agreement below.

16) Schedule F - Pricing is hereby deleted and replaced with Schedule F - Pricing below to cover all products offered by Contractor under this Contract.

17) Schedule G Terms for Hardware is hereby amended to add a new section 9 as follows:

9. Limited Warranty. Axon warrants that Axon-manufactured Devices are free from defects in workmanship and materials for one (1) year from the date of Customer’s receipt, except Signal Sidearm which Axon warrants for thirty (30) months from Customer’s receipt and Axon-manufactured accessories, which Axon warrants for ninety (90) days from Customer’s receipt , respectively, from the date of Customer’s receipt. Used conducted energy weapon ("CEW") cartridges are deemed to have operated properly. Extended warranties run from the expiration of the one (1) year hardware warranty through the extended warranty term purchased.

i) Claims. If Axon receives a valid warranty claim for an Axon-manufactured Device during the warranty term, Axon’s sole responsibility is to repair or replace the Axon-manufactured Device with the same or like Axon-manufactured Device, at Axon’s option. A replacement Axon-manufactured Device will be new or like new. Axon will warrant the replacement Axon-manufactured Device for the longer of (a) the remaining warranty of the original Axon-manufactured Device or (b) ninety (90) days from the date of repair or replacement.

ii) If Customer exchanges an Axon Device or part, the replacement item becomes Customer’s property, and the replaced item becomes Axon’s property. Before delivering an Axon-manufactured Device for service, Customer must upload Axon-manufactured Device data to Axon Evidence or download it and retain a copy. Axon is not responsible for any loss of software, data, or other information contained in storage media or any part of the Axon-manufactured Device sent to Axon for service.

iii) Spare Axon Devices. At Axon's reasonable discretion, Axon may provide Customer a predetermined number of spare Axon Devices as detailed in the Quote ("Spare Axon Devices"). Spare Axon Devices are intended to replace broken or non-functioning units while Customer submits the broken or non-functioning units, through Axon’s warranty return process. Axon will repair or replace the unit with a replacement Axon Device.

Title and risk of loss for all Spare Axon Devices shall pass to Customer in accordance with shipping terms of this Agreement. Axon assumes no liability or obligation in the event Customer does not utilize Spare Axon Devices for the intended purpose.

iv) Limitations. Axon’s warranty excludes damage related to: (a) failure to follow Axon Device use instructions; Axon Devices used with equipment not manufactured or recommended by Axon; (c) abuse, misuse, or intentional damage to Axon Device; (d) force majeure; (e) Axon Devices repaired or modified by persons other than Axon without Axon’s written permission; or (f) Axon Devices with a defaced or removed serial number. Axon’s warranty will be void if Customer resells Axon Devices.

v) To the extent permitted by law, the above warranties and remedies are exclusive. Axon disclaims all other warranties, remedies, and conditions, whether oral, written, statutory, or implied. If statutory or implied warranties cannot be lawfully disclaimed, then such warranties are limited to the duration of the warranty described above and by the provisions in this Agreement. Customer confirms and agrees that in deciding whether to sign this Agreement, Customer has not relied on any statement or representation by Axon or anyone acting on behalf of Axon related to the subject matter of this Agreement that is not in this Agreement. Axon Devices and Services that are not manufactured, published or performed by Axon ("Third-Party Products") are not covered by Axon’s warranty and are only subject to the warranties of the third-party provider or manufacturer.

18) The Appendix to Schedule G, titled 'Technology Assurance Plan Appendix,' is hereby deleted and replaced with the following new Schedule H titled ‘Product-Specific Appendices’:

a) AXON VIRTUAL REALITY CONTENT TERMS OF USE APPENDIX

b) TASER DEVICE APPENDIX

c) AXON AUTO-TAGGING APPENDIX

d) ADD-ON SERVICES APPENDIX

e) AXON EVENT OFFER APPENDIX

SCHEDULE C - DATA SECURITY REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT- Policy/13400013002-Acceptable-Use-of-Information-Technology-Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, backed up in the United States, its territories or Canada;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication https://www.michigan.gov/dtmb/policies/it-policies https://www.uptimeinstitute.com/

800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Solution; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Solution; and (iii) unauthorized access to any of the State Data;

5.10 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.11 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.12 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

5.13 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State.

Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process by providing the state upon written request most recent SOC2 Type II report and other documentation, which will enable the State to , develop and maintain completion and on-going maintenance of a system security plan (SSP) using https://sam.gov/content/home the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All i risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State Systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least 5 Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s (if applicable) FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans. as required by the State Web Application Security Standard and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Authenticated interactive scanning of application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must either a) grant the State the right to dynamically scan a deployed version of the Software; or b) in lieu of the State performing the scan, Contractor must dynamically scan a deployed version of the Software using a State approved application scanning tool, and provide the State with a vulnerabilities assessment after Contractor has completed such scan. These scans and assessments i) must be completed and provided to the State quarterly (dates to be provided by the State) and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning source code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application source code scans.

These scans must be completed for all source code initially, for all updated source code, and for all source code for each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans.

9.3 Software Composition Analysis (SCA) – Third-Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third-party and open source software, all included third-party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation.

SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements. These scans must be completed for all third-party and open source software initially, for all updated third-party and open source software, and for all third party and open source software in each major release and Contractor must provide the State with a vulnerability assessment after Contractor has completed the required scans if not provided as part of SAST and/or DAST reporting.

9.4 In addition, application scanning and remediation may include the following types of scans and activities if required by regulatory or industry requirements, data classification or otherwise identified by the State.

(a) If provided as part of the solution, all native mobile application software must meet these scanning requirements including any interaction with an application programing interface (API).

(b) Penetration Testing – Simulated attack on the application and infrastructure to identify security weaknesses.

10. Infrastructure Scanning.

10.1 Contractor must ensure their infrastructure and applications are scanned using an approved scanning tool (Qualys, Tenable, or other PCI Approved Vulnerability Scanning Tool) at least monthly and provide the scan’s assessments to the State in a format that is specified by the State and used to track the remediation. Contractor will ensure the remediation of issues identified in the scan according to the remediation time requirements documented in the State’s PSPs.

11. Nonexclusive Remedy for Security Breach.

11.1 Any failure of the Solution to meet the applicable requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

SCHEDULE C – ATTACHMENT 1 – CJIS SECURITY

ADDENDUM

FEDERAL BUREAU OF INVESTIGATION

CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

The goal of this document is to augment the CJIS Security Policy to ensure adequate security is provided for criminal justice systems while (1) under the control or management of a private entity or (2) connectivity to FBI CJIS Systems has been provided to a private entity (contractor). Adequate security is defined in Office of Management and Budget Circular A- 130 as “security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.”

The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

This Security Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, and data security, and technical security.

The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency.

1.00 Definitions

1.01 Contracting Government Agency (CGA) - the government agency, whether a Criminal Justice Agency or a Noncriminal Justice Agency, which enters into an agreement with a private contractor subject to this Security Addendum.

1.02 Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.

2.00 Responsibilities of the Contracting Government Agency.

2.01 The CGA will ensure that each Contractor employee receives a copy of the Security Addendum and the CJIS Security Policy and executes an acknowledgment of such receipt and the contents of the Security Addendum. The signed acknowledgments shall remain in the possession of the CGA and available for audit purposes. The acknowledgement may be signed by hand or via digital signature (see glossary for definition of digital signature).

3.00 Responsibilities of the Contractor.

3.01 The Contractor will maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed and all subsequent versions), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

4.00 Security Violations.

4.01 The CGA must report security violations to the CJIS Systems Officer (CSO) and the Director, FBI, along with indications of actions taken by the CGA and Contractor.

4.02 Security violations can justify termination of the appended agreement.

4.03 Upon notification, the FBI reserves the right to:

a. Investigate or decline to investigate any report of unauthorized use;

b. Suspend or terminate access and services, including telecommunications links. The FBI will provide the CSO with timely written notice of the suspension. Access and services will be reinstated only after satisfactory assurances have been provided to the FBI by the CGA and Contractor. Upon termination, the Contractor's records containing CHRI must be deleted or returned to the CGA.

5.00 Audit

5.01 The FBI is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.

6.00 Scope and Authority

6.01 This Security Addendum does not confer, grant, or authorize any rights, privileges, or obligations on any persons other than the Contractor, CGA, CJA (where applicable), CSA, and FBI.

6.02 The following documents are incorporated by reference and made part of this agreement:

(1) the Security Addendum; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20. The parties are also subject to applicable federal and state laws and regulations.

6.03 The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they augment the provisions of the CJIS Security Policy to provide a minimum basis for the security of the system and contained information and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.

6.04 This Security Addendum may only be modified by the FBI, and may not be modified by the parties to the appended Agreement without the consent of the FBI.

6.05 All notices and correspondence shall be forwarded by First Class mail to:

Information Security Officer

Criminal Justice Information Services Division, FBI

1000 Custer Hollow Road

Clarksburg, West Virginia 26306

SCHEDULE D – ATTACHMENT 1 – CONTACT LIST

In accordance with the Schedule B Service Level Agreement, below is a list of the Contractor's support contacts:

Live phone support will be available Monday –Thursday, 9:00AM – 3:00AM EST, Friday; 9:00AM – 3:00AM EST and Sunday, 7:00PM –

3:00AM EST. Critical Incident/Emergency assistance will be available 24/7. For technical or Customer Service assistance, you may contract a customer service representative at 800-978-2737.

SCHEDULE E – LICENSING AND PROFESSIONAL

SERVICES AGREEMENT

For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Customer” means the State.

“Customer Content” means State Data.

“Axon” means the Contractor.

1. Definitions.

a. "Evidence" is media or multimedia uploaded into Axon Evidence as 'evidence' by a Customer. Evidence is a subset of Customer Content.

b. "Non-Content Data" is data, configuration, and usage information about Customer’s Axon Cloud Services tenant, Axon Devices and client software, and users that is transmitted or generated when using Axon Devices. Non-Content Data includes data about users captured during account management and customer support activities. Non-Content Data does not include State Data .

c. “Provided Data” means de-identified, de-personalized, data derived from Customer's TASER energy weapon deployment reports, related TASER energy weapon logs, body-worn camera footage, and incident reports.

2. “Transformed Data” means the Provided Data used for the purpose of quantitative evaluation of the performance and effectiveness of TASER energy weapons in the field across a variety of circumstances. Access. Upon Axon granting Customer a subscription to Axon Cloud Services, Customer may access and use Axon Cloud Services to store and manage Customer Content.

Customer may not exceed more end users than the Quote specifies. For Axon Evidence Lite, Customer may access and use Axon Evidence only to store and manage TASER CEW and TASER CAM data ("TASER Data"). Customer may not upload non-TASER Data to Axon Evidence Lite.

3. Security. Consistent with Schedule C Data Security Requirements, Axon will maintain a comprehensive information security program to protect Axon Cloud Services and State Data including logical, physical access, vulnerability, risk, and configuration management; incident monitoring and response; encryption of uploaded digital evidence; security education; and data protection. Axon agrees to the Federal Bureau of Investigation Criminal Justice Information Services Security Addendum for its digital evidence or records management systems.

4. Customer Responsibilities. Customer will be responsible for (a) ensuring that Customer has the necessary rights to use State Data (b) ensuring no State Data or Customer end user’s use of State Data or Axon Cloud Services violates this Agreement or applicable laws; (c) maintaining necessary computer equipment and Internet connections for use of Axon Cloud Services and (d) verify the accuracy of any auto generated or AI generated reports submitted by the State. If Customer becomes aware of any alleged violation of this Agreement by an end user, Customer will investigate and take prompt action pursuant to Customer’s policies and standards regarding acceptable use of information technology. If a Customer end user is found to have violated its responsibility, that end user’s access to Axon Cloud Services will be terminated.

a. Customer will…