190000001415.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 5 to

Contract Number MA190000001415

C O

N

TR

AC

TO

R

GCR INC

2021 Lakeshore Dr, Suite 500

New Orleans LA 70122

Timothy Walsh

504-304-2500 twalsh@gcrinc.com

CV0062349

ST

AT

E

Pr og ra m

M an ag er

Various Various

C on tr ac t Ad m in is tr at or Corbin Montry DTMB

(517) 599-0012

MontryC@michigan.gov

CONTRACT SUMMARY

Airport System Manager

INITIAL EFFECTIVE DATE

November 5, 2019

INITIAL EXPIRATION DATE

November 4, 2024

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE BEFORE

November 4, 2026

PAYMENT TERMS

NET 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

N/A

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$434,957.00

VALUE OF CHANGE NOTICE

$12,600.00

ESTIMATED AGGREGATE CONTRACT VALUE

$447,557.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 04/24/2026, the parties hereby agree to add the following Statement of Work for modifications to MDOT's Airport System Manager (ASM) API for Aeronautics Geodatabases project. This contract is hereby increased by $12,600.00.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 5 TO CONTRACT NO. MA190000001415

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

MDOT Linn Smith 517-335-9949 SmithL50@michigan.gov

DTMB Jeffrey LaBean 517-243-1743 LabeanJ@michigan.gov

MDOT Michael Soper 517-335-9237 SoperM1@michigan.gov

Michigan.gov/MiProcurement

Version 2021-1 1 of 3

STATEMENT OF WORK -

IT CHANGE NOTICE

Project Title:

Airport System Manager (ASM) API for MDOT Aeronautics Geodatabases

Period of Coverage:

11/5/2025 to 11/4/2026

Requesting Department:

Michigan Department of Transportation (MDOT)

Date:

2/13/2026

Agency Project Manager:

Zach Tecson

Phone:

517-243-3735

DTMB Project Manager:

Jeffrey LaBean

Phone:

517-243-1743

Brief description of services to be provided:

BACKGROUND:

The vendor developed the AirportIQ Aviation System Manager (ASM) as a single application for total aviation system control. The ASM application is a customized COTS application developed by the vendor and hosted for MDOT. The most critical uses of ASM are improved efficiency in managing budgets and grants, tracking aircraft registrations, facilities inspections, and aeronautical studies.

The MDOT Office of Aeronautics has identified the need for an interface from ASM to directly connect Aeronautical facilities geodatabases to the master system data maintained in ASM.

Currently, airport information stored in ASM is being updated by several business areas within MDOT Aeronautics and manual updates to the aeronautical facility geodatabases have produced data inaccuracies. The Aeronautical facility geodatabases are used both internally and externally to spatially analyze airport safety concerns, depict airport assets, and run statewide reports used to dictate aviation decision across the State. Ensuring up-to-date data connections between both databases is critical to ensuring the success of those programs.

PROJECT OBJECTIVE:

The Statement of Work (SOW) requests the vendor to create an interface to allow for programmatic access to specific Airport master data currently available within ASM via UI screens. The SOW requests the vendor to design, develop, secure, and deploy RESTful APIs to expose the requested datasets to approved consuming systems, enabling integration, automation, and downstream analytics. The initial effort targets the six datasets enumerated below in the Scope of Work.

SCOPE OF WORK:

The vendor will create RESTful APIs for the following in-scope datasets:

1. VW_AIR_FACILITY

2. VW_AIRCRAFT_AIR_FACILITY

3. VW_FR_INTERMODAL_FACILITY

4. VW_RUNWAY

5. VW_RUNWAY_END

Version 2021-1 2 of 3

6. GenInfo – General Data

TASKS:

Technical support is required to assist with the following tasks:

1. Conduct necessary requirements and design meetings with MDOT and DTMB

2. Prepare documentation

3. Develop, test, and implement the RESTful APIs

4. Schedule and support User Acceptance Testing (UAT) with the business users and technical

5. Perform production implementation

DELIVERABLES:

Deliverables for this project include:

1. Requirements and design approval

2. UAT Sign-off

3. RESTful APIs deployed to the vendors production environment and final acceptance sign-off

The total fixed price for this Professional Services request is $12,600.00.

ACCEPTANCE CRITERIA:

Deliverables will not be considered complete until the Agency Project Manager has formally accepted them.

PROJECT CONTROL AND REPORTS:

A bi-weekly progress report must be submitted to the Agency and DTMB Project Managers throughout the life of this project. Each bi-weekly progress report must indicate what was worked on and what was completed during the current reporting period, along with what is planned to be worked on during the next reporting period.

SPECIFIC DEPARTMENT STANDARDS:

Agency standards, if any, in addition to DTMB standards.

PAYMENT SCHEDULE:

Payment will be made upon satisfactory acceptance of all deliverables and DTMB will pay CONTRACTOR upon receipt of the final approved and properly completed invoice which shall be submitted to the billing address on the State issued purchase order. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment. The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Version 2021-1 3 of 3

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated Agency Project Manager is:

Zach Tecson MDOT – Office of Aeronautics Aeronautics Building 2700 Port Lansing Rd Lansing, MI 48906 517-243-3735 tecsonz1@michigan.gov

The designated DTMB Project Manager is:

Jeffrey LaBean DTMB – Agency Services supporting MDOT Van Wagoner Building 425 W Ottawa St Lansing, MI 48933 517-243-1743 labeanj@michigan.gov

AGENCY RESPONSIBILITIES:

Complete user acceptance testing, review and approval of the deliverables and submitted invoice(s).

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Consultants will work at their offices. No work is required on site at MDOT.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number MA190000001415. This purchase order, statement of work, and the terms and conditions of Contract Number MA190000001415 constitute the entire agreement between the State and the Contractor.

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Airport System Manager

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

November 5, 2019 November 4, 2024 5 - 12 Months November 4, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

2021 Lakeshore Dr, Suite 500

New Orleans LA 70122

Jeffrey Hamel

985-327-0878 jeffrey.hamel@tadera.com

CV0062349

GCR INC

C O

N

TR

A C

TO

R

Robin Lampert

517-582-2746

DTMB

Various Various

LampertR1@michigan.com

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 4

Contract Number MA190000001415 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$398,807.00 $36,150.00 $434,957.00

DESCRIPTION

Effective January 20, 2025, enhancements to the AirportIQ System Manager software are added to this Contract, per attached SOW with an increase of $36,150.00 for MDOT use.

Please note the Contractor's contact has changed to Jeffrey Hamel, and the Program Managers have changed to Ashley Lucas (MDOT) and Jeff LaBean (DTMB).

agreement, and DTMB Central Procurement Services approval.

AGENCY NAME PHONE EMAIL

MDOT Ashley Lucas LucasA11@michigan.gov

DTMB Jeffrey LaBean LabeanJ@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 4 TO CONTRACT NO. MA190000001415

Version 2023-1 1 of 5

STATEMENT OF WORK -

IT CHANGE NOTICE

Project Title:

MDOT – Aviation System Manager Enhancements

Period of Coverage:

11/1/2024-10/1/2025

Requesting Department:

MDOT Office of Aeronautics

Date:

10/18/2024

Agency Project Manager:

Ashley Lucas

Phone:

517-614-0118

DTMB Project Manager:

Jeff LaBean

Phone:

517-243-1743

Brief description of services to be provided:

MDOT is requesting enhancements to existing functionality within the TADERA Aviation System Manager (ASM) application.

BACKGROUND:

The ASM application is a customized COTS application developed by TADERA and hosted for MDOT. TADERA (previously GCR Inc. and Civix) developed the AirportIQ Aviation System Manager (ASM) as a single application for total aviation system control. The most critical uses of ASM are improved efficiency in managing budgets and grants, tracking aircraft registrations, facilities inspections, and aeronautical studies.

PROJECT OBJECTIVE:

The Statement of Work (SOW) requests TADERA create 2 additional groups of enhancements to ASM for MDOT’s use. Enhancements, which are described in the Scope of Work section, will improve the end user experience, and increase efficiency.

SCOPE OF WORK:

The scope of work includes designing, developing, deploying, and testing the following enhancements to ASM.

1) ASM Facility Directory Modifications v2 - $7,450.00

a. Scripts will be written to import the following data:

i. Displaced Threshold (DTHR)

ii. NAVAIDS (General information > Miscellaneous > Category = “Facility

Directory – Other” > Item = “NAVAIDS”

iii. Frequencies

b. NAVAIDS “Frequency Grouping” Development

i. New Tables and References

ii. NAVAIDS Groups

Version 2023-1 2 of 5

iii. Dropdown Field under Identifier

iv. Comments

2) ASM Enhancements including changes to reporting, navigation, and importing and data management - $28,700.00

Functional Items - Description Details

Development: Security Module - Security Report

Security Report:

- Excel browser will launch from Security module

- Columns: "First Name", "Last Name”, "Last Login"

Development: Aeronautical Studies – No Permit Required (NPR) – Invoice w/ $50.00 Flat Rate

No Permit Required (NPR) Studies: New functionality added to generate an Invoice with a $50.00 flat rate. (7460 Permit Status) (Invoice Module)

- Add Fee to References not necessary - "Aeronautical Studies Fees" - Per client

Development: Aeronautical Studies – Documents – Drag and Drop Functionality

Documents: State System Data > Aeronautical Studies > Documents - Add Drag and Drop functionality (No Categories)

Development: Aeronautical Studies – Documents - Checkbox (Multiselect) – Functionality to Create Multiple Documents

Documents: State System Data > Aeronautical Studies > Documents - Add functionality to select multiple templates for creating documents in Aero Studies (Checkbox - for multiselect) (Add Documents > Generate from Template > Documents Type)

Development: Aircraft Registration

– Report – List of Airport Managers/Fixed Based Operators

(FBO)

Report will be created to populate with the "List of Airport Managers / Fixed Base Operators (FBO) Report will list the following:

- Associated City (Facility Data > Gen Info > Gen Info)

- Airport Name (Facility Data > Gen Info > Gen Info)

- County (Facility Data > Gen Info > Gen Info)

- License Class (State System Data > Statewide Licensing > Class)

- Ownership (Facility Data > Gen Info)

- Mgr. Name (Facility Data > Gen Info > Contacts)

- Mgr. Address (Facility Data > Gen Info > Contacts)

- Mgr. Phone (Facility Data > Gen Info > Contacts)

- Mgr. Email (Facility Data > Gen Info > Contacts)

- FBO Name (Facility Data > Gen Info > Contacts)

- FBO Address (Facility Data > Gen Info > Contacts)

- FBO Phone (Facility Data > Gen Info > Contacts)

- FBO Email (Facility Data > Gen Info > Contacts)

- FBO Remarks (Comment) (Facility Data > Gen Info > Contacts)

- FBO Web Address (Facility Data > Gen Info > Contacts)

Version 2023-1 3 of 5

Development: Aircraft Registration

– Import Functionality – Import File Generated by Payment Processor

Creating an import function to import files generated by the Payment Processor, this will include a report of imported data sent to the document’s library. (Recreation of the Aeronautical Studies Import)

Development: Aircraft Registration

– Archive Old Registration Data

Archiving functionality will be added to the Aircraft registration to archive older registrations and increase the performance of the Aircraft Registration module. Data will be moved to Archive tables in the database. (Unarchive functionality will not be available, can be retrieved upon request.)

Development: Aircraft Registration

– Start New Year – Status:

“Pending FAA Status”

Status: “Pending: FAA Status” will be added to the Aircraft Registration “Start New Year” process. N-Numbers with the “Pending: FAA Status” will roll forward to the new active year, any current Fee will also roll forward, but no fee will be assessed. Status will not change to “Active” or “Inactive” but remain as “Pending: FAA Status”.

TASKS:

Technical support is required to assist with the following tasks:

1. Conduct necessary requirements and design meetings with MDOT users

2. Prepare functional designs

3. Configure, develop, test, and implement the ASM enhancements using the TADERA

Test (QA) and Production (PROD) environments

4. Schedule and support UAT with business users

5. Perform production implementation

DELIVERABLES:

Deliverables for this project include:

Design Acceptance Criteria:

1. Functional Design approval (designs for each requested change, screen or report mock-ups, etc.)

User Acceptance Testing (UAT) Acceptance Criteria

1. Requested enhancements deployed to TADERA Test environment and available to MDOT staff.

2. UAT Defect Tracking Log

3. UAT Acceptance Sign-off

Implementation

1. Requested enhancements deployed to TADERA Production environment

2. Acceptance Sign-off

Version 2023-1 4 of 5

MDOT will conduct testing after the software enhancements are deployed in the TADERA test environment. MDOT considers their testing a success if there are no defects or issues detected.

ACCEPTANCE CRITERIA:

Deliverables will not be considered complete until the Agency and DTMB Project Manager have formally accepted them.

PROJECT CONTROL AND REPORTS:

The vendor must submit a bi-weekly progress report to the Agency and DTMB Project Managers throughout the life of this project. Each bi-weekly progress report must contain the following:

• Progress to complete milestones, comparing forecasted completion dates to planned and actual completion dates.

• Accomplishments during the reporting period, what was worked on and what was completed during the current reporting period.

• Tasks planned for the next reporting period.

• Identify any existing issues which are impacting the project and the steps being taken to address those issues.

• Identify any new risks and describe progress in mitigating high impact/high probability risks previously identified.

PAYMENT SCHEDULE:

Payment will be made based on the satisfactory acceptance of each Milestone. basis. DTMB will pay Contractor upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment. The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

1. Payment Schedule Milestones:

• Production Implementation Milestone Acceptance for each group of enhancements

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated Agency Project Manager is:

Name: Ashley Lucas Department: Transportation

Version 2023-1 5 of 5

Area: Office of Aeronautics, Aviation Services Section Address: 2700 Port Lansing Road City/State/Zip: Lansing, Michigan 48906-2160 Phone Number: 517-614-0118 Email Address: LucasA11@michigan.gov

The designated DTMB Project Manager(s) is:

Name: Jeff LaBean Department: DTMB Area: Agency Services supporting MDOT Building/Floor: Van Wagoner Building 3rd Floor Address: 425 West Ottawa Street City/State/Zip: Lansing, Michigan-48821 Phone Number: 517-243-1743 Email Address: LabeanJ@michigan.gov

AGENCY RESPONSIBILITIES:

Review and approval of the deliverables and submitted invoice(s).

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Consultants will work at: 1001 Highway 190 East Service Road Suite 201, Covington, LA 70433

All work completed by the vendor staff will be at their office physical or remote location(s), or on site when mutually agreed.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Airport System Manager

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

November 5, 2019 November 4, 2024 5 - 12 Months November 4, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

P-Card Direct Voucher (PRC) Other Yes No

2021 Lakeshore Dr, Suite 500

New Orleans LA 70122

Timothy Walsh

504-304-2500 twalsh@gcrinc.com

CV0062349

GCR Inc

C O

N

TR

A C

TO

R

Robin Lampert

(517) 582-2746

DTMB

Various Various

LampertR1@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

Change Notice Number 3

Contract Number MA190000001415 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

24 Months November 4, 2026

$298,645.00 $100,162.00 $398,807.00

DESCRIPTION

Effective October 15, 2024, this Contract is exercising the 1st and 2nd option years and is increased by $100,162.00. The revised contract expiration date is November 4, 2026.

agreement, and DTMB Central Procurement Services approval..

DTMB Dave Work 517-719-2250 WorkD@michigan.gov

MDOT Linn Smith 517-335-9949 SmithL50@michigan.gov

Program Managers for

CHANGE NOTICE NO. 3 TO CONTRACT NO. MA190000001415

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to

Contract Number 190000001415

Various

Robin Lampert twalsh@gcrinc.com

Timothy Walsh

New Orleans, LA 70122

GCR Inc

CV0062349

504-304-2500

2021 Lakeshore Dr, Suite 500

(517) 582-2746

S T

A T

E

P ro g ra m

M a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

lampertr1@michigan.gov

$283,545.00

November 5, 2019 November 4, 2024

AIRPORT SYSTEM MANAGER

November 4, 2024

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ November 4, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$15,100.00 $298,645.00

Effective December 4, 2023 this Contract is increased by $15,000.00 for MDOT use. These funds will cover the annual fees and minor enhancements.

This Change Notice also corrects a typo from Change Notice 1. The amount of increase should have been $6975.00 as noted in the description, but the header only showed $6875.00. The corrected estimated aggregate contract value is $298,645.00.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

MDOT

Program Managers for

CHANGE NOTICE NO. 2 TO CONTRACT NO. 190000001415

Dave Work 517-719-2250 WorkD@michigan.govDTMB

Linn Smith 517-335-9949 SmithL50@michigan.govMDOT

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 1 to

Contract Number 190000001415

Various

Robin Lampert twalsh@gcrinc.com

Timothy Walsh

New Orleans, LA 70122

GCR Inc

CV0062349

504-304-2500

2021 Lakeshore Dr, Suite 500

(517) 582-2746

S T

A T

E

P ro g ra

M a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

lampertr1@michigan.gov

$276,670.00

November 5, 2019 November 4, 2024

AIRPORT SYSTEM MANAGER

November 4, 2024

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ November 4, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$6,875.00 $283,545.00

Effective October 11, 2023, this Contract is increased by $6975.00 for MDOT use and the following amendments are incorporated into this contract per attached SOW. This change includes

* a change in the cloud hosting

* 2 enhancements

* funds for the enhancements

Please note the Contract Administrator has been changed to Robin Lampert.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

MDOT

Program Managers for

CHANGE NOTICE NO. 1 TO CONTRACT NO. 190000001415

Dave Work 517-719-2250 WorkD@michigan.govDTMB

Linn Smith 517-335-9949 SmithL50@michigan.govMDOT

CN 1 - 190000001415 1 of 12

STATEMENT OF WORK -

IT CHANGE NOTICE

Project Title:

MDOT – Aviation System Manager Enhancements

Period of Coverage:

9/1/2023-6/1/2024

Requesting Department:

MDOT Office of Aeronautics

Date:

8/30/2023

Agency Project Manager:

Michael Carnarvon

Phone:

517-242-2936

DTMB Project Manager:

Dave Work

Phone:

517-719-2250

Brief description of services to be provided:

MDOT is requesting enhancements to existing functionality within the Aviation System Manager (ASM) application.

Update to ASM hosting environment: The ASM application for MDOT was hosted in the Microsoft Azure Cloud. The Contractor has migrated hosting of the ASM software from Microsoft Azure Cloud to Amazon Web Services (AWS) Cloud. All other hosting provisions of the contract remain unchanged. All references to “Azure” are replaced with “AWS” going forward.

BACKGROUND:

The existing ASM application is a customized COTS application developed by the Contractor and hosted for MDOT. The Contractor developed the AirportIQ Aviation System Manager (ASM) as a single application for total aviation system control. The most critical uses of ASM are improved efficiency in managing budgets and grants, tracking aircraft registrations, facilities inspections, and aeronautical studies.

PROJECT OBJECTIVE:

The Statement of Work (SOW) requests Contractor create 2 additional enhancements to ASM for MDOT’s use. Enhancements, which are described in the Scope of Work section, will improve the end user experience, and increase efficiency.

SCOPE OF WORK:

The scope of work includes designing, developing, deploying, and testing the following enhancements to ASM.

CN 1 - 190000001415 2 of 12

1) MDOT ASM Client Specific Contact Filters - $3,225.00

a. The following Licenses filters will be added to the Contact filters in the MI

ASM configuration:

i. Licensed

ii. Pending

iii. Provisional

iv. Unlicensed

v. Resp Person

b. Results to be exported in a .csv file

2) MDOT ASM Client Specific Facility Directory - $3,750.00

a. Reformat the Facility Directory to populate on one page. Format, data, and images will be mapped in the functional requirements document.

Calculation for displaced threshold.

b. Results to be exported to both single Facility Directory and Facility Directory batch

TASKS:

Technical support is required to assist with the following tasks:

1. Conduct necessary requirements and design meetings with MDOT users

2. Prepare functional designs

3. Configure, develop, test, and implement the ASM enhancements using the

Contractor’s Test (QA) and Production (PROD) environments

4. Schedule and support UAT with business users

5. Perform production implementation

DELIVERABLES:

Deliverables for this project include:

Design Acceptance Criteria:

1. Functional Design approval (designs for both requested changes)

User Acceptance Testing (UAT) Acceptance Criteria

1. Requested enhancements deployed to Contractor’s Test environment and available to MDOT staff.

2. UAT Defect Tracking Log

3. UAT Acceptance Sign-off

CN 1 - 190000001415 3 of 12

Implementation

1. Requested enhancements deployed to Contractor’s Production environment

2. Acceptance Sign-off

MDOT will conduct testing after the software enhancements are deployed in the Contractor’s test environment. MDOT considers their testing a success if there are no defects or issues detected.

ACCEPTANCE CRITERIA:

Deliverables will not be considered complete until the Agency and DTMB Project Manager have formally accepted them in writing.

PROJECT CONTROL AND REPORTS:

The vendor must submit a progress report every two weeks to the Agency and DTMB Project Managers throughout the life of this project. Each progress report must contain the following:

• Progress to complete milestones, comparing forecasted completion dates to planned and actual completion dates.

• Accomplishments during the reporting period, what was worked on and what was completed during the current reporting period.

• Tasks planned for the next reporting period.

• Identify any existing issues which are impacting the project and the steps being taken to address those issues.

• Identify any new risks and describe progress in mitigating high impact/high probability risks previously identified.

SPECIFIC DEPARTMENT STANDARDS:

Agency standards, if any, in addition to DTMB standards.

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites and software applications. All websites, applications, software, and associated content and documentation provided by the Contractor as part of the Solution must comply with the following:

• SOM Web Application Standards https://www.michigan.gov/som/Footer/Policies/SOM-Applications-and-Site- Standards https://www.michigan.gov/som/Footer/Policies/SOM-Applications-and-Site-Standards https://www.michigan.gov/som/Footer/Policies/SOM-Applications-and-Site-Standards

CN 1 - 190000001415 4 of 12

• State of Michigan Digital Standards https://www.michigan.gov/som/-/media/Project/Websites/SOM/Media/SOM- Policies/State-of-Michigan-Digital- Standards.pdf?rev=64461e589c934452af464841ad5a200c&hash=F9C203A

C31E8BDAECFDC6C11FCB42BFF

• State of Michigan Digital Guidelines https://digitalguidelines.michigan.gov/

• State of Michigan (SOM) Look and Feel Standards https://www.michigan.gov/som/-/media/Project/Websites/SOM/Media/SOM- Policies/Look_and_Feel_Standards_302051_7.pdf?rev=4197528dc68f40b3a 963742a8be53be3&hash=7CC6E7563902B6CDDDBAB3113EDC48B3

• All websites, applications, software, and associated content and documentation provided by the Contractor as part of the Solution must comply with Level AA of the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.0.

Web Content Accessibility Guidelines (WCAG) 2.0:

https://www.w3.org/TR/WCAG20/

SECURITY ACCREDITATION PROCESS

The attached Schedule D – Data Security Requirements replaces the older version in the Contract.

PAYMENT SCHEDULE:

Payment will be made based on the satisfactory acceptance of each Milestone. basis.

DTMB will pay Contractor upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment.

The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

1. Payment Schedule Milestones:

• Production Implementation Milestone Acceptance https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FState-of-Michigan-Digital-Standards.pdf%3Frev%3D64461e589c934452af464841ad5a200c%26hash%3DF9C203AC31E8BDAECFDC6C11FCB42BFF&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GkPVPE1uKMIPyGegYsnMaqEighzh5skCEuXBx73rRjY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FState-of-Michigan-Digital-Standards.pdf%3Frev%3D64461e589c934452af464841ad5a200c%26hash%3DF9C203AC31E8BDAECFDC6C11FCB42BFF&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GkPVPE1uKMIPyGegYsnMaqEighzh5skCEuXBx73rRjY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FState-of-Michigan-Digital-Standards.pdf%3Frev%3D64461e589c934452af464841ad5a200c%26hash%3DF9C203AC31E8BDAECFDC6C11FCB42BFF&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GkPVPE1uKMIPyGegYsnMaqEighzh5skCEuXBx73rRjY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FState-of-Michigan-Digital-Standards.pdf%3Frev%3D64461e589c934452af464841ad5a200c%26hash%3DF9C203AC31E8BDAECFDC6C11FCB42BFF&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GkPVPE1uKMIPyGegYsnMaqEighzh5skCEuXBx73rRjY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdigitalguidelines.michigan.gov%2F&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=UN7L8r90xS62Ru1YJbqJVN4sAeW2THrbbSEoBc8zDIQ%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FLook_and_Feel_Standards_302051_7.pdf%3Frev%3D4197528dc68f40b3a963742a8be53be3%26hash%3D7CC6E7563902B6CDDDBAB3113EDC48B3&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4vBJTpuIYceZYbKH9lbsgA4CZqG6C%2BZBWnbyM74N0Ds%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FLook_and_Feel_Standards_302051_7.pdf%3Frev%3D4197528dc68f40b3a963742a8be53be3%26hash%3D7CC6E7563902B6CDDDBAB3113EDC48B3&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4vBJTpuIYceZYbKH9lbsgA4CZqG6C%2BZBWnbyM74N0Ds%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.michigan.gov%2Fsom%2F-%2Fmedia%2FProject%2FWebsites%2FSOM%2FMedia%2FSOM-Policies%2FLook_and_Feel_Standards_302051_7.pdf%3Frev%3D4197528dc68f40b3a963742a8be53be3%26hash%3D7CC6E7563902B6CDDDBAB3113EDC48B3&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4vBJTpuIYceZYbKH9lbsgA4CZqG6C%2BZBWnbyM74N0Ds%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2FTR%2FWCAG20%2F&data=05%7C01%7CPunniyamoorthyV%40michigan.gov%7Cc64a79614e9a44f50d9708db56273c8f%7Cd5fb7087377742ad966a892ef47225d1%7C0%7C0%7C638198498738067994%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ww3Nm4v8L95YMOG9Yu6vmAGCuoMqLaIwnfefeg0axFs%3D&reserved=0

CN 1 - 190000001415 5 of 12

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated Agency Project Manager is:

Name: Michael Carnarvon Department: Transportation Area: Office of Aeronautics, Aviation Services Section Address: 2700 Port Lansing Road City/State/Zip: Lansing, Michigan 48906-2160 Phone Number: 517-242-2936 Email Address: CarnarvonM@michigan.gov

The designated DTMB Project Manager(s) is:

Name: Dave Work Department: DTMB Area: Agency Services supporting MDOT Building/Floor: Van Wagoner Building 3rd Floor Address: 425 West Ottawa Street City/State/Zip: Lansing, Michigan-48821 Phone Number: 517-719-2250 Email Address: workd@michigan.gov

AGENCY RESPONSIBILITIES:

Review and approval of the deliverables and submitted invoice(s).

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Consultants will work at:

All work completed by the vendor staff will be at their office physical or remote location(s), or on site when mutually agreed.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

CN 1 - 190000001415 6 of 12

SCHEDULE D – DATA SECURITY

REQUIREMENTS

This schedule replaces Schedule D – Data Security Requirements for the Contract.

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L.

No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Hosted Services who has sufficient knowledge of the security of the Hosted Services and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

CN 1 - 190000001415 7 of 12

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the contracted solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT- Policy/13400013002-Acceptable-Use-of-Information-Technology-Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause.

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs.

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, accessed, developed and backed up in the continental United States, and the data center(s) in which State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

https://www.michigan.gov/dtmb/policies/it-policies https://www.michigan.gov/dtmb/policies/it-policies https://www.uptimeinstitute.com/

CN 1 - 190000001415 8 of 12

5.4 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.5 Throughout the Term, Contractor must not provide Hardware or Services from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.6 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

5.7 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the State Data;

5.8 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.9 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.10 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

5.11 Contractor must permanently sanitize or destroy the State’s information, including State Data, from all media both digital and nondigital including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization https://sam.gov/content/home

CN 1 - 190000001415 9 of 12 methods or as otherwise instructed by the State. Contractor must sanitize information system media, both digital and non-digital, prior to disposal, release out of its control, or release for reuse as specified above.

6. Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames and required evidence based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs, perform related remediation activities, and provide evidence of compliance. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

7. Unauthorized Access. Contractor may not access, and must not permit any access to, State systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

8. Security Audits.

8.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

8.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract.

The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, CN 1 - 190000001415 10 of 12 appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

8.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s and Hosting Provider’s FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

8.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

9. Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans as required by the State Web Application Security Standard and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST)…