190000001531.pdf

��������������������� ��!��"#�$%��&�'()��*+,+��-.�����/%�!��"#�$%��&�'()�)01234503�065278�213908

�A���

�A����C������ D� EF ��G�%���G) � D� EF ��G�%����� H�I�G���-��J" � D� EF ��G�%����/��:�� ������� A�? @��:�� ��������?��� � �B�� A�A���� ����A�? @��:���K� ����

���L� *IM��; �#� <��N-�<J ��O*PMQ ,�J � R " S-

G)�����T ���� �U� .��;�#��NU����G'M������>#"/H�IV�HIV�((<���F;�>#"W$--$� +<-EMN����V/� X--$� %�!!M� ��� HGVI��HI/())Y DD " �"WE#<J#$��+$->!��� ���� ED TOHGVQ��'�I'��( ������ DJ��# �Z DD " � ����

"� ED T�WE#<J#$��+$->

[\]̂_̀]�abc\cd]̂_][̂ �̂[ê_b�_\_ef̂�����

�L��L�

MJ��$ �S-�#< �S�EF ���gM-����<��S�EF ���h5igjjjjjjikli�-

A�� �B�� ��������B��

� ��� ����A����������� ��@�?��G���-��J" G��-��J" � D� EF ��G�%����Vn(%//'%�('+�� n�%G�'%G��+G/ nG�%V((%'GV+'(A�� opp <�#> �(L�VL���H%��J#"�<-����<��J � F=� . <�� "��J ���"��� E�#�#�$�-D�#-��= ���-���J#"�<-����<�%�E�T#�$�J �� q� .D#���#-��;�� �)LG�L���V���;��;;#�#-����=�#�<��; "��J �� � q���-p��J �����$ ;�� p �" � �>#< �r�s#� o= �����$ ;�� p �" �H)%)))�o�;D-#��"�p-����= ��"��"�; "<�#F ;�#����̀tfauvf�C��̂c̀c\e[w�]tcd��_d]f̂��êffbf\]��p-�������������E-����-p�nG%�/�%�//+H(+�n�%G�'%G��+G/�#��p��;"�#"��;; ;��-�J#"�<-����<���-�<-> ��" �>#< "��J�-�$J��J �� q� .D#���#-��;�� �-p�)LG�L���V+U���-�J ��� �E"%�<-�;#�#-�"%�"D <#p#<��#-�"%���;�D�#<#�$�� E�#���J �"�E +�* ��<-����<�-����;��$ �<=�$� E ��%������*�-<�� E ����DD�->��%���;����� �U;E#�#"����#> ��-��;��DD�->���-��(L�/L���H+ stempekl Stamp stempekl Stamp

,'-./�0����� �1.��� ,'-./�0����� �23-.� �'-�4 )�5�� ���������6�����1.��� +-�*�(����0�4.

7�

��������������������� ��!��"#�$%��&�'()��*+,+��-.�����/%�!��"#�$%��&�'()�)01234503�065278�213908

�A���

�A����C������ D� EF ��G�%���G) � D� EF ��G�%����� H�I�G���-��J" � D� EF ��G�%����H��:�� ������� A�? @��:�� ��������?��� � �B�� A�A���� ����A�? @��:���K� ����

���L� *IM��; �#� <��N-�<J ��O*PMQ ,�J � R " S-

G)�����T ���� �U� .��;�#��NU����G'M������>#"/H�IV�HIV�((<���F;�>#"W$--$� +<-EMN����V/� X--$� %�!!M� ��� HGVI��HI/())Y DD " �"WE#<J#$��+$->!��� ���� ED TOHGVQ��'�I'��( ������ DJ��# �Z DD " � ����

"� ED T�WE#<J#$��+$->

[\]̂_̀]�abc\cd]̂_][̂ �̂[ê_b�_\_ef̂�����

�L��L�

MJ��$ �S-�#< �S�EF ���gM-����<��S�EF ���h5ijkkkkkkilmi�-

A�� �B�� ��������B��

� ��� ����A����������� ��@�?��G���-��J" G�R ��" � D� EF ��G�%����/o(%//'%�('+�� o��(%('(+H� o(%()�%G��+(�A�� pqq <�#> �/L��L���H%��J#"�<-����<��J � F=� . <�� "����-D�#-��= ��%�E�T#�$��J �� r� .D#���#-��;�� )LG�L���/���;��;;#�#-����=��;;"��J �����<J ;�s�-� �q-���J �/IE-��J�� � r���-q�" <��#�=�-D ���#-�"��"; "<�#F ;���;��;;"�q��;#�$�#���J ��E-����-q�o��(%('(+H���-�<-> ��-D ���#-�"��J�-�$J��J �� >#" ; .D#���#-��;�� +U���-�J ��� �E"%�<-�;#�#-�"%�"D <#q#<��#-�"���;�D�#<#�$�� E�#���J �"�E +�* ��<-����<�-����;��$ �<=�$� E ��%���;������M ������*�-<�� E ���� �>#< "��DD�->��+��

StempekL Stamp

StempekL Stamp

StempekL Stamp

Michigan.gov/MiProcurement

STATEMENT OF WORK -

IT CHANGE NOTICE

Version 2 (3/2021) 1

Project Title:

Security Operations Renewal Requesting Department:

DTMB

Date:

6/30/2025

DTMB Program Manager:

Stephanie Jeppesen

Phone:

(517) 335-6899

DTMB Project Manager:

Aaron Dupre

Phone:

(517) 243-9091

PAYMENT SCHEDULE:

Payment will be made on a satisfactory acceptance of each deliverable basis. DTMB will pay CONTRACTOR upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment.

The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

Services Order Type

Billing Frequency

Services Start Date

Services End Date

Order Term (Months)

Units List Price (Annual)

Discount

Total Fees

Validation Cloud Director Base Platform

V-CS-BASE-05-MA

Validation Cloud Director Base Platform with Continuous Validation

Renewal Annual in Advance

Upon Provisioning (Estimated

July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 1 196,100.00 15.00% (Additional Discount)

83,342.50

VAL Cloud FlexActors Incl.

with Base PLT

V-CS-ACT-B-01-MA

Validation Cloud Flex Actors - Included with Base Platform

Renewal Annual in Advance

Upon Provisioning (Estimated

July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 5 10,600.00 15.00% (Additional Discount)

22,525.00

Validation Cloud Flex Actors

V-CS-ACTOR-MA

Validation Cloud Flex Actors

Renewal Annual in Advance

Upon Provisioning (Estimated

July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 10 10,600.00 15.00% (Additional Discount)

45,050.00

Validation Cloud Email Theater

V-CS-EMT-TH-MA

Validation Cloud Email Theater

Renewal Annual in Advance

Upon Provisioning (Estimated July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 1 26,500.00 15.00% (Additional Discount)

11,262.50

Michigan.gov/MiProcurement

STATEMENT OF WORK -

IT CHANGE NOTICE

Version 2 (3/2021) 2

Validation Cloud Protected Theater

V-CS-END-TH-MA

Validation Cloud Protected Theater

Renewal Annual in Advance

Upon Provisioning (Estimated July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 1 26,500.00 15.00% (Additional Discount)

11,262.50

Validation Cloud Service Theater (E)

V-CS-TH-E-01-MA

Validation Cloud Service Theater (Enterprise)

Renewal Annual in Advance

Upon Provisioning (Estimated July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 1 12,720.00 15.00% (Additional Discount)

5,406.00

Security Customer Success Plan - Expert

EXPERT-

CUSTOMER-

SUCCESS

Security Customer Success Plan - Expert

Renewal Monthly in Advance

Upon Provisioning (Estimated July 01, 2025)

Upon Provisioning (Estimated December 31,2025)

6M 0D 1 100,000.00 50,000.00

Total: $228,848.50

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated DTMB Program Manager is:

Stephanie Jeppesen DTMB Cybersecurity and Infrastructure Protection Phone: (517) 245-5693 Email: JeppesenS@Michigan.gov

The designated DTMB Project Manager is:

Aaron Dupre DTMB Security Operations Center Phone: (517) 243-9091 Email: DupreA@Michigan.gov mailto:JeppesenS@Michigan.gov mailto:DupreA@Michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Managed Security Services

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

September 13, 2019 September 12, 2022 5 - 12 Months September 12, 2025

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1900 Duke Street

Alexandria VA 22314

Carl Davis

650-705-7088 carlbdavis@google.com

VC0001158

Mandiant, Inc.

C O

N

TR

A C

TO

R

517-335-6899 jeppesens@michigan.gov

Lauren Stempek

(517) 243-4008

DTMB

Stephanie Jeppesen DTMB

StempekL@Michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/an/a

Change Notice Number 7

Contract Number MA190000001531 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$8,418,777.90 $245,506.42 $8,664,284.32

DESCRIPTION

Effective 12/20/2024, the Mandiant MSV for MiSOC is hereby renewed for a new expiration date of 6/30/2025 as described in the attached Statement of Work and $245,506.42 in funding is added to this contract to cover this renewal.

All other terms, conditions, specifications and pricing remain the same. Per Contractor and agency agreement, and DTMB Central Procurement Services approval.

Revised 6/2018

CONTRACT CHANGE NOTICE

Change Notice Number 6 .

to Contract Number 190000001531.

C U

R R

EN

T

C O

N

TR

A C

TO

R Mandiant, Inc.

1900 Duke Street

Alexandria, VA 22314

Alyssa Lokie

703-403-8364

Alyssa.lokie@mandiant.com

CV0003763

STATE CONTACTS

Pr og ra m

M an ag er Stephanie Jeppesen DTMB

C on tra ct

Ad in is tra to r Lauren Stempek DTMB

(517) 335-6899 (517) 243-4008

JeppesenS@Michigan.gov StempekL@Michigan.gov

CONTRACT SUMMARY

DESCRIPTION: Managed Security Services

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE

OPTIONS

EXPIRATION DATE BEFORE

CHANGE(S) NOTED BELOW

September 13, 2019 September 12, 2022 5 – 12 Months September 12, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-card ☐ Direct Voucher (DV) ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF

EXTENSION REVISED EXP. DATE

☒ 12 Months ☐ September 12, 2025

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$7,387,645.30 $1,031,132.60 $8,418,777.90 DESCRIPTION: Effective 8/21/2024, the State is executing the 3rd available option year, and adding funds in the amount of $1,031,132.60 to cover this option year. The revised contract expiration date is 9/12/2025. The parties also assign this contract from Mandiant, Inc., to Google, LLC as of 10/1/2024.

Please note that the Contract Administrator has been changed to Lauren Stempek.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Procurement approval, and State Administrative Board approval on 8/20/2024.

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

N

EW

C O

N

TR

A C

TO

R

Google, LLC

1600 Amphitheater Pkwy

Mountain View, CA 94043-1351

Carl Davis

650-705-7088

Carlbdavis@google.com

CV0001158

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 5 to Contract Number 190000001531 jeppesens@michigan.gov

Stephanie Jeppesen

Jarrod Barron alyssa.lokie@mandiant.com

Alyssa Lokie

Alexandria, VA 22314

Mandiant, Inc.

CV0003763

703-403-8364

1900 Duke Street

(517) 249-0406

STA

TE

P ro g a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-335-6899

DTMB

barronj1@michigan.gov

$6,982,089.30

September 13, 2019 September 12, 2024

MANAGED SECURITY SERVICES

September 12, 2022

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ September 12, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$405,556.00 $7,387,645.30

Effective 12/19/2023, the parties add $405,556.00 to cover the first year cost of adding the Mandiant Security Validation Solution to this Contract per the attached license agreement, which is added as Attachment 6 to Schedule C of the Contract, and the associated cost tables. The parties also add the attached Statement of Work, which details the no-cost Mandiant Deployment Services Services. All other terms, conditions, specifications, and pricing remain the same. Per Contractor, Agency, DTMB Procurement and State Administrative Board approval on 12/19/2023.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

DTMB

ATTACHMENT 6 to Schedule C

MANDIANT SOLUTIONS

MANDIANT ADVANTAGE - MANDIANT SECURITY VALIDATION

In addition to the Contract, which governs this Attachment 6 to Schedule C, the following terms govern the Mandiant Security Validation Solution, including any software-based and cloud implementations, and including the Validation on Demand Solution (each, “Security Validation” or a “Security Validation Solution”).

1. License and Restrictions. Subject to the terms hereof, payment of all fees, and any applicable user/use limitations, Mandiant grants Customer a personal, non-sublicensable, nonexclusive, right to use the Mandiant Advantage Solutions (excluding Web Services related to the Security Validation Solution, which are licensed pursuant to Section 4), in accordance with the Contract and this Schedule, solely for Customer’s internal governmental purposes. Customer will maintain the copyright notice and any other notices that appear on the Mandiant Advantage Solutions, including any interfaces related to the Mandiant Advantage Solutions. All Mandiant Advantage Solutions, including software, are licensed, not sold, for a fixed term, and are not perpetually licensed.

Customer will operate the Security Validation Solution in accordance with the user Documentation.

a. Mandiant Security Validation Solutions. The Security Validation Solutions shall only be used up to the purchased license entitlement, as set forth on the Order, for which Customer has paid the applicable fees. Customers purchasing the Validation on Demand version of the Security Validation Solution are licensed to use one (1) actor to conduct one (1) assessment, as set forth in the Documentation, and such use must occur within one (1) year from the date of the Order for the Validation on Demand Security Validation Solution. The term of the license shall begin on or shortly after the Order Effective Date (as determined by Mandiant) and will continue in effect for the period of time stated in the Order.

b. Reserved.

c. Reserved.

2. Security Content. The Security Validation Solutions may include access to certain defined files, URLs, IP addresses, file hashes, commands, network traffic samples and other artifacts that can be malicious and/or represent real attacker behavior (“Security Content”). Security Content is obtained from a variety of sources. Mandiant grants to Customer a limited, non-transferable, as-is, non-exclusive license to use the Security Content solely in connection with the Security Validation Solutions and for no other purpose. MANDIANT MAKES NO REPRESENTATIONS OR WARRANTIES WITH REGARD TO THE SECURITY CONTENT AND DOES NOT GUARANTEE OR WARRANT THAT THE SECURITY CONTENT WILL COVER ALL POSSIBLE CONDITIONS, ENVIRONMENTS OR CONTROLS. SECURITY CONTENT IS OBTAINED FROM A VARIETY OF SOURCES, WHICH MAY INCLUDE KNOWN THREAT ACTORS. Any Security Content obtained or licensed from a third party and furnished through Mandiant or which Customer procures on its own will be deemed Third Party Materials under this Contract. Mandiant may make available an exchange (the “Exchange”) through which Customer may obtain, download, or access certain Security Content furnished by third parties, including other Mandiant customers. In addition, Customer, itself, may elect to participate in the Exchange by electing to upload Security Content that it creates or procures. Use of the Exchange is entirely voluntary and subject to the Exchange terms and conditions as well as any specific terms and conditions of the third parties furnishing the Security Content. Any Security Content obtained through the Exchange will be deemed Third Party Materials under this Contract. TO THE MAXIMUM EXTENT ALLOWED BY LAW, MANDIANT AND ITS

LICENSORS WILL NOT BE LIABLE FOR ANY LOSSES, LIABILITIES, DAMAGES, JUDGMENTS, OR OTHER COSTS WITH RESPECT TO THE SECURITY CONTENT, WHETHER ARISING BY CONTRACT, TORT OR OTHERWISE.

CUSTOMER ASSUMES ALL RISK ASSOCIATED WITH USE OF THE SECURITY CONTENT, AND

ACKNOWLEDGES THAT MANDIANT HAS NO OBLIGATION TO ENSURE SECURITY CONTENT WILL OPERATE

AS INTENDED. CUSTOMER UNDERSTANDS THAT SECURITY CONTENT INCLUDES LIVE MALWARE,

INCLUDING RANSOMWARE, AND THAT USE OF THE SECURITY CONTENT IN WAYS NOT STRICTLY

DESCRIBED IN THE DOCUMENTATION MAY CAUSE DAMAGE TO CUSTOMER’S ENVIRONMENT.

3. Web Services. Mandiant may provide access to certain Web-based or other online content (the "Web Services"), including intelligence offerings, and in some cases such Web Services will be subject to additional fees. Mandiant grants Customer a non-exclusive, non-transferable license to use the Web Services solely in connection with its use of the Security Validation Solutions. Customer grants to Mandiant a perpetual, irrevocable, worldwide, paid-up, non-exclusive license and right to reproduce, modify, create derivative works from, publish, distribute, sell, sub-license, transmit, publicly display and provide access to Aggregated Data, including anonymized telemetry from the Security Validation Solution, submitted by Customer through the Web Services, for the sole purpose of enhancing Mandiant’s products and services, so long as (i) Mandiant ensures that any Customer Confidential Information is removed from such content, and (ii) Mandiant’s use of such content does not in any way identify Customer or its employees or in any other way allow a third party to identify Customer as the source of the content. Mandiant will not capture, maintain, scan, index, share or use State Data stored or transmitted by the Security Validation Solution, or otherwise use any data-mining technology, for any non-authorized activity, and shall not permit its agents or subcontractors to do so. For purposes of this requirement, “non-authorized activity” means data mining or processing of State Data, stored, or transmitted by the Security Validation Solution, for unrelated commercial purposes, advertising, or advertising-related purposes, or for any other purpose other than security analysis, that is not explicitly authorized in this Contract. For clarity, Aggregated Data is not State Data.

For the Mandiant Security Validation Portal (“Portal”), Mandiant will provide the following service levels and service level credits:

Mandiant will use commercially reasonable efforts to make the Portal available for Customer's access and use, as contemplated under this Contract, an average of at least ninety-nine (99.5%) of the time during each month during the term of the applicable Solution license (the "Availability Requirement"), excluding any period of Permitted Unavailability. "Permitted Unavailability" includes Planned Outages (as defined below) and any unavailability due to causes beyond Mandiant's reasonable control, including, without limitation: any software, hardware, or telecommunication failures; interruption or failure of telecommunication or digital transmission links; Internet slow-downs or failures; failures or default of third party software, vendors, or products; and unavailability resulting from Customer's actions or inactions or a failure of Customer's communications link or systems. "Planned Outages" means the period of time during which Mandiant conducts systems maintenance and any instances requiring emergency maintenance. Mandiant will use reasonable efforts to schedule Planned Outages during non-peak hours. “Service Outage” means the Portal is not available due to a failure or a disruption in the Portal, that is not the result of any Permitted Unavailability, a force majeure event or the act or omission of the State.

If the Portal does not meet the monthly service availability defined above, Mandiant will provide a credit to the State in accordance with the table below (“Credit”) for a validated Service Level Claim (defined below). The percent of the Portal availability per calendar month (in the table below) is equal to the result, expressed as a percentage, of the number of minutes of Service Availability in a calendar month divided by the total number of minutes in the calendar month.

Percent of Portal Availability per Calendar Month Service Credit

<99.5% 2%

<99.0% 5%

<98.0% 10%

For determining the Credit, the duration of a Service Outage will be measured as the time starting when State experiences a disruption in availability of the Portal and ending when a successful solution or workaround allowing for full restoration of the Portal is provided by Mandiant to the State. The Service Credit will be calculated by taking the total annual subscription fees divided by 12 to reach a prorated monthly amount to which the Service Credit percentage will be applied.

State must notify Mandiant of any Service Outage and request a Credit in writing no later than fifteen (15) days after the calendar month in which the Service Outage occurred (“Service Level Claim”) to be entitled to a Credit for that Service Outage.

Any Service Credits earned by Customer hereunder will be applied to future renewals of the Solution or purchases of other Security Validation Solutions. Mandiant will apply the amount of the Credit within thirty (30) days after the calendar month in which the Service Level Claim was received.

Notwithstanding the foregoing, if State does not purchase other Security Validation Solutions prior to expiration of the Contract, such Credits shall be null and void.

Customer shall not be entitled to receive a Credit that exceeds 10% of its prorated monthly Subscription Fee for a Service Outage for the applicable calendar month.

4. Support. Subject to Customer’s payment in full of all associated fees for Support Services, Mandiant shall provide Support Services for the Mandiant Advantage Solutions as set forth at the then-current Mandiant Support Programs and Terms page, at https://www.mandiant.com/support/programs, as may be updated by Mandiant in its discretion, provided that such upgrade shall not substantially reduce the level of support available for the Security Validation Solution at the time of the incorporation of this Schedule into the Contract. For reference purposes only, a current copy of the Support terms is attached hereto as Exhibit 1.

COST TABLES

MANDIANT ADVANTAGE - MANDIANT SECURITY VALIDATION

# Product Code Product Name Purchase Term Billing Frequency Prorated/List QTY DISC (%) Net Total Type Price

1 V-CS-BASE-05-MA Validation Cloud Director First Time 12 One-Time $196,100.00 1 20 $156,880.00 Base Platform with

Continuous Validation

2 V-CS-ACT- Validation Cloud Flex First Time 12 One-Time $10,600.00 5 20 $42,400.00 B-01-MA Actors - Included with Base Platform

3 V-CS-ACTOR-MA Validation Cloud First Time 12 One-Time $10,600.00 10 20 $84,800.00 Flex Actors

4 V-CS-AEDAE- Validation Cloud Advanced First Time 12 One-Time $106,000.00 1 20 $84,800.00 02-MA Environmental Drift

Analysis (Enterprise)

5 V-CS-EMT-TH-MA Validation Cloud First Time 12 One-Time $26,500.00 1 0 $26,500.00 Email Theater

6 V-CS-TH-E-01-MA Validation Cloud Service Theater (Enterprise)

First Time 12 One-Time $12,720.00 1 20 $10,176.00

Group1 TOTAL: $405,556.00

Grand Total

Total List Price $500,320.00 Discount % 18.94 Total Price $405,556.00

STATEMENT OF WORK

This Statement of Work (“SOW”) is made and entered into as of the later of the signature dates below (“SOW Effective

Date”), by and between Mandiant and State of Michigan - Department of Technology (“State”). This SOW is governed by the master agreement (Contract No. 190000001531) dated September 25, 2019, by and between the State and Mandiant (“Contract”). Capitalized terms used in this SOW will have the meanings given to them in the Contract.

Services performed outside the Americas will be performed and invoiced by Mandiant Ireland Limited, regardless of which Mandiant entity is party to this SOW, and in such cases Mandiant Ireland Limited will be deemed “Mandiant” as set forth in this SOW. Services performed within the Americas will be performed and invoiced by Mandiant, Inc., regardless of which Mandiant entity is party to this SOW, and in such cases Mandiant, Inc. will be deemed “Mandiant” as set forth in this SOW.

1. Description of Services

For a period not to exceed 12 months from SOW Effective Date, Mandiant agrees to provide services (“Services”) as set forth below.

Task 1: Security Validation Consulting Mandiant Security Validation Consulting (“SVC”) is a Mandiant Consulting Service offering which provides access to designated SVC delivery engineers who build, manage, maintain, and deliver semi-automated and continuous testing of the State security controls against relevant Tactics, Techniques, and Procedures (“TTPs”).

SVC engineers combine Mandiant frontline intelligence and MSV Mandiant Security Validation (“MSV”) technology to continuously assess in scope the State security controls against relevant cyber threats using the Mandiant Security Validation (“MSV”) product as the primary assessment and reporting tool. This testing results in actionable metrics and observations detailing how the State’s controls prevent and detect or alert on relevant attacks and where available, SVC engineers provide mitigation guidance to help the State address configuration and capability issues identified during delivery of Services.

All SVC Services include the following major components meant to enable the use cases described herein:

Initial Scoping and Business Alignment Session Initial Scoping and Alignment begins with an overview of the MSV Subscription and planning for your technology deployment. Shortly after the MSV Subscription begins, SVC delivery engineers will:

● Discuss deployment requirements, locations, context, and timeframes for Validation Technology Components to enable the purchased Use Cases.

● Establish a mutually agreed upon timeline for technology deployment and enablement.

● Work with the State to mutually agree on the State provided Operating System builds, and/or network segments and network layer controls, and/or SIEMs in scope for purchased use cases.

● The SVC engineer may request details about your designated architecture to increase the speed and efficiency of the initial deployment.

Onboarding, Deployment and Architecture Updates Onboarding, Deployment and Architecture Updates includes configuring, connecting, and verifying Validation Technology

Components, controls and integrations are correctly deployed and able to communicate to the MSV Director. For this task to be successful, we need the full cooperation of the customer. The State responsibilities for this activity may include provisioning of dedicated “gold standard” workstation or server builds running all endpoint security controls in scope for assessment in a configuration mirroring enterprise deployment configuration, deploying virtual appliances to in scope security zones, and creating credentials on SIEM platforms and security controls which enable integration of the MSV solution. The State will also be responsible for navigating and understanding change control process for their environment and communicating timelines for having these requirements fully declared and understood prior to deployment starting.

The deployment process and requirements heavily depend on the number and type of Use Cases purchased by the customer as detailed herein.

Baseline Activities The baseline activities will cover the initial run through of each Use Case purchased by the customer. This will be a proof positive test for the health of the customer’s validation infrastructure and supporting technologies including integrations into the security controls. This will also allow for any updates or modifications that need to be made to the core baseline set of tests for the Use Cases to ensure the business objectives are met.

Once configuration and integration of the Validation Technology Components, controls and security control integrations have been validated by your SVC engineer, execution of use cases described herein can begin.

Use-Cases SVC services are delivered over a 12-month period by way of customizable service offerings (“Use-Cases”). Services may include one or more Use-Cases based on priority focus areas and desired the State outcomes. The Use-Cases in scope for services delivery covered by this SOW are detailed in the subsections below:

Use Case 1: Endpoint Security Controls Validation

Endpoint security controls validation aims to assess the effectiveness of in-scope endpoint layer security controls.

Mandiant will assess how well an endpoint security control detects and/or prevents relevant attacker TTPs over time and use results to provide guidance to the State on how to improve overall endpoint security control effectiveness for the duration of the contract. Mandiant also provides continuous metrics meant to surface endpoint security control effectiveness improvement or degradation over time.

Endpoint security control effectiveness is measured via a progressing series of assessments conducted during the term of the SOW and via jobs created during each assessment. These assessments use “actions” meant to emulate non-destructive attacker TTPs relevant to host-based security controls and operating system configurations (GPO settings, Privileged Access Management configurations, etc.).

Endpoint control assessments, their actions, and specific attacker TTPs employed to measure control effectiveness primarily focus on known bad malicious binaries, abuse of tools which may be used by the State administrators, abuse of privileged access, and abuse of functionality employed by attackers in pursuit of their mission, and are characterized and defined in the following ways:

- A “Baseline Assessment” utilizing a broad set of TTPs based on Mandiant SVC best practices and utilizing common attacker TTPs, meant to surface broad areas of concern, establish a baseline for normal in the assessed environment, and to ensure that the State’s environment is fully operational and suitable for use during subsequent assessments.

o If issues relating to operational readiness outside of Mandiant’s ability to control are encountered, Baseline Assessment testing may need repeated until issues with the in-scope security controls and the data they produce have been addressed.

- One or more “threat intel lead” assessments, utilizing selected actions containing TTPs specific to a set of threat actors defined and mutually agreed upon by the State and Mandiant prior to beginning each assessment period.

Mandiant will provide reports detailing endpoint security control performance in accordance with the deliverables section of this SOW at the conclusion of each assessment.

Additional Services details:

▪ Endpoint Security Validation includes up to five (5) endpoint security controls.

▪ Endpoint security validation includes up to two (2) in scope operating systems which may include:

o Windows Server o Windows Workstation o Linux (RHEL, Ubuntu) o MacOS

▪ Assumes that the State will provide Mandiant with expectations for each in scope control during the planning phase for each assessment.

▪ Assumes that the State will provide gold standard images configured to mirror endpoint security control stack implementation across the enterprise for use during the duration of the engagement.

▪ Assumes that the State will provide stable infrastructure for hosting endpoint actors in the form of dedicated physical or virtual machines and that these machines will remain online for the duration of the engagement.

▪ Assumes that the State will provide a designated contact(s) to address cases where endpoint actors become unresponsive or require attention.

▪ Assumes that the State will maintain a stable networking environment to operate within (NTP, DNS, etc.).

▪ For scenarios where direct integration isn’t supported for in scope security controls, assumes that the State will forward event telemetry to a SIEM or other data lake where supported MSV integrations exist.

▪ Assumes that the State will follow best practices for supporting MSV agent installations.

▪ Does not include vulnerability assessment, penetration testing, or red teaming.

▪ Does not include custom content or action creation and utilizes content produced by the Mandiant Threat Intel team on the standard release cycle.

▪ Performed without restrictions on the days and times when testing can occur.

▪ Performed remotely by Mandiant Consultants.

Use Case 2: SOC/SIEM Validation

The SOC/SIEM Security Controls Rationalization (“SOC/SIEM use-case”) focuses on ensuring events from security controls being sent to the State’s Security and Information Event Management system (“SIEM”) are complete, rational, and consistent to ensure Security Operations Center (“SOC”) personnel are optimized for success. The SVC delivery engineer focuses on ensuring event information is well formatted and consistent with the State’s Common Information Model (“CIM”) event narrative and indicators of compromise (“IOCs”), to ensure security operation center (“SOC”) analysts have a consistent data needed to identify assets, controls, behavior disposition and supporting evidence such as time and signatures/messages.

The SOC/SIEM use-case will provide a rationalized view of data produced by in scope security controls being and sent to the SIEM. Recommendations produced while delivering the SOC/SIEM use-case, once implemented, will help to enable the State to:

● Consume data from multiple security control solutions in a consistent manner.

● Ensure security events are present in the SIEM and accurately represented.

● Present SIEM users with consistent data models to work with which:

o Improves quality and consistency of alerting rules.

o Reduces “tribal knowledge” related to field values present in the SIEM

● Provide solid and reliable base events necessary for dependable correlation rules (alerts) which:

o Improves mean time to detection.

o Improves mean time to resolution.

The SOC/SIEM use-case will be delivered on a quarterly basis or as needed when new technologies are introduced to the SIEM. Delivery of results will be completed through both the Director Report Builder and through a shared spreadsheet containing the result details.

Additional Services details:

● Use-case covers one (1) SIEM platform

● Assumes the MSV platform supports an integration to the State’s SIEM platform, per platform requirements

● Assumes the State is consuming security technologies into the SIEM

● Assumes SIEM integration credentials and permissions necessary to query data sources

2. Deliverables Task 1: Security Validation Consulting Deliverables

The Deliverables to be produced for these Services are as follows:

▪ Report Builder (In Product Reporting Engine) o Technical Findings and observations relevant to the SVC Consulting will be communicated to the State on a continuous basis through an in-product reporting engine.

o The reports delivered through the in-product reporting engine include the following elements:

i. Scope; assumptions; limitations; summary of observations; trend lines related to detection and prevention; and technical details related to each evaluation which was conducted as part of an assessment.

▪ Regular Status Updates (In Product Reporting Engine) o Mandiant Consultants will schedule a series of monthly and quarterly reporting analysis meetings to review issues surfaced during delivery of the SVC SOW Term and speak to questions that may be relevant to these results.

▪ Quarterly Reviews (PowerPoint, PDF or equivalent) o An Executive Summary to provide managers with a high-level overview of the engagement highlighting the strategic areas for improvement and providing an overall analysis of the State’s Security Control Effectiveness.

o Strengths and weaknesses related to security controls observed over the last period with focus on improvements and/or regressions since last period.

3. Schedule and Staffing The scheduling of Services under this SOW will be as mutually agreed to by all parties. The Services under this SOW will be provided within the twelve (12) month period from the SOW Effective Date.

4. Services Fees As shown in the table below, Service Fees are not anticipated for this engagement. Adding any products or services requiring the payment of any fees would require the parties to execute a Contract Change Notice.

Service Expected Timing or Quantity Fees

Fixed Fees

Task 1: Security Validation Consulting

Use Case 1: Endpoint Security Controls Validation 12 Month Term $115,000 USD

Use Case 2: SOC/SIEM Validation 12 Month Term $115,000 USD

Discount - Security Validation Consulting $230,000 USD

Total Fixed Services Fees – All Services $0 USD

Estimated Expenses $0 EST USD

Total Fixed Fees Including Estimated Expenses $0 USD

5. Technology Fees Technology Fees are not anticipated for this engagement. Adding any products or services requiring the payment of any fees would require the parties to execute a Contract Change Notice.

6. Expenses Expenses are not anticipated for this engagement. Adding any products or services requiring the reimbursement of any expenses would require the parties to execute a Contract Change Notice prior to the incurrence of such expenses.

7. Assumptions

1. Mandiant will determine when work activities are performed in its discretion, within agreed upon scheduling time frames.

2. Professional fees are $0 for this engagement. Notwithstanding the foregoing, any Mandiant or third-party product or service suggested by Mandiant as we conduct the activities outlined within this SOW, including any hardware, software, licensing, maintenance, or support costs of any Mandiant or other third-party product or service, would come at additional cost and require mutual agreement and a Contract Change Notice.

3. Mandiant will provide Deliverables to the State throughout this engagement. Draft Deliverables are considered final upon confirmation from the State (written or oral) or ten business days after their submission date from Mandiant to the State, whichever is earlier.

4. The State represents that all information provided is true and accurate to the best of its knowledge and the State owns or is authorized to represent the owners of the systems, facilities, and/or devices described in connection with the services. The State represents that it has obtained all permissions necessary for Mandiant to perform the services described herein.

5. The State will make available key individuals that can best help plan operations around security event monitoring, analysis, threat intelligence, and incident response.

6. Any changes to the scope of Services or this SOW must be mutually agreed upon in writing by all parties in a Contract Change Notice.

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 4 to Contract Number 190000001531

JeppesenS@michigan.gov

Stephanie Jeppesen

Jarrod Barron alyssa.lokie@mandiant.com

Alyssa Lokie

Alexandria, VA 22314

Mandiant, Inc.

CV0003763

703-403-8364

1900 Duke Street

(517) 249-0406

STA

TE

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-335-6899

DTMB

barronj1@michigan.gov

$5,950,956.70

September 13, 2019 September 12, 2023

MANAGED SECURITY SERVICES

September 12, 2022

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 1 Year ☐ September 12, 2024

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,031,132.60 $6,982,089.30

Effective 8/8/2023, the parties exercise the second option year and add $1,031,132.60 for the 9/13/2023 - 9/12/2024 services listed in the attached Restated Schedule B Pricing tables. The parties also assign the scope of services associated with HX software, Helix TAP software, PX/HX/NX hardware and associated support from Mandiant, Inc. to Trellix Public Sector, LLC, successor in interest to FireEye Security Holdings US, LLC. All other terms, conditions, specifications, and pricing remain the same. Per Contractor, Agency, DTMB Procurement and State Administrative Board approval on 8/8/2023.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

RESTATED SCHEDULE B – PRICING

Subscription License cost and Recurring Annual Software

Maintenance and Support Costs Comments Cost ($)

9/13/2023 – 9/12/2024 Annual Renewal - Managed Defense Service

FireEye Managed Defense up to 59,999 Endpoints $770,337.00

Training Proposed budget for approx. 15 students refresh and/or new hires

$41,323.60

Annual Renewal EOD Expertise On Demand 200 Units $219,472.00 9/13/2023 – 9/12/2024 Total $1,031,132.60

9/13/2024 – 9/12/2025 Annual Renewal - Managed Defense Service

FireEye Managed Defense up to 59,999 Endpoints $770,337.00

Training Proposed budget for approx. 15 students refresh and/or new hires

$41,323.60

Annual Renewal EOD Expertise on Demand 200 Units $219,472.00 9/13/2024 – 9/12/2025 Total $1,031,132.60

9/13/2025 – 9/12/2026

Defense Service

FireEye Managed Defense up to 59,999 Endpoints $793,447.11

Training Proposed budget for approx. 15 students refresh and/or new hires

$42,563.31

Annual Renewal EOD Expertise on Demand 200 Units $226,056.16 9/13/2025 – 9/12/2026 Total $1,062,066.58

9/13/2026 – 9/12/2027

Defense Service

FireEye Managed Defense up to 59,999 Endpoints $793,447.11

Training Proposed budget for approx. 15 students refresh and/or new hires

$42,563.31

Annual Renewal EOD Expertise on Demand 200 Units $226,056.16 9/13/2026 – 9/12/2027 Total $1,062,066.58

TOTAL COSTS $4,186,398.36

Optional Additional Products and

Services Comments Cost ($)

Optional Upgrade to 1Yr Fusion Intel Subscription

Fusion Intel is an upgrade to the Operational Intel delivered with FireEye Managed Defense Service. Described on page 32 of the response.

$259,368.00

Optional Upgrade to 1Yr Executive Intel Subscription

Executive Intel is an upgrade to the Operational Intel delivered with FireEye Managed Defense Service. Described on page 33 of the response.

$76,082.00

Optional Upgrade to 1Yr Digital Monitoring Alert Intel Subscription

Executive Intel is an upgrade to the Operational Intel delivered with FireEye Managed Defense Service. Described on page 33 of the response.

$85,592.00

Optional Expertise on Demand. 1Yr 200 Unit Package

Proposed 200 Tokens for on-demand to access services and training. See complete program description and token value on

$219,472.00

Optional Expertise on Demand. 1Yr 150 Unit Package

Proposed 150 Tokens for on-demand to access services and training. See complete program description and token value on

$176,220.00

Optional Expertise on Demand. 1Yr 120 Unit Package

Proposed 120 Tokens for on-demand to access services and training. See complete program description and token value on

$144,144.00

Optional Expertise on Demand. 1Yr 90 Unit Package

Proposed 90 Tokens for on-demand to access services and training. See complete program description and token value on

$110,484.00

Optional Expertise on Demand. 1Yr 60 Unit Package

Proposed 60Tokens for on-demand to access services and training. See complete program description and token value on page

$76,016.00

Optional Training Per Course Catalog Online Web Training-Intro Courses $350.00

Optional Training Per Course Catalog

Instructor Led Training: 1 Day, up to 8-10 students, private class, w/T&E $6,600.00

Optional Training Per Course Catalog

Instructor Led Training: 2 Days, up to 8 students, private class, w/T&E $11,900.00

Optional Training Per Course Catalog

Instructor Led Training: 3 Days, up to 8 students, private class, w/T&E $18,100.00

Optional Training Per Course Catalog

Instructor Led Training: 5 Days, up to 8 students, private class, w/T&E $21,700.00

Optional Training Per Course Catalog

Advanced Instructor Led Training: 5 Days, up to 8 students, private class, w/T&E $26,920.00

Upgrade-Managed Defense Continuous Vigilance Full Coverage from 59999 support band to 79999 support band-1Y

1 Year Upgrade Cost up to 20,000 additional Endpoints to Managed Defense Service beyond 59999. This price will be prorated to term with original contract date. 3Yr full payment discount available

$281,325.00

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 3 to 190000001531Contract Number

ReasnerR@michigan.gov

Richard Reasner

Jarrod Barron rebecca.stroder@mandiant.com

Rebecca Stroder

Alexandria, VA 22314

Mandiant, Inc.

CV0003763

703-683-3141

1900 Duke Street

(517) 249-0406

STA

TE

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-241-7546

DTMB

barronj1@michigan.gov

$5,862,411.10

September 13, 2019 September 12, 2023

MANAGED SECURITY SERVICES

September 12, 2022

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ September 12, 2023

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$88,545.60 $5,950,956.70

Effective 2/4/2022, the State adds $88,545.60 to purchase the additional Expertise on Demand Credits detailed in the attached documentation using funding approved by Ad Board on 9/7/2021. Remaining Ad Board balance after this change notice: $161,454.39. All other terms, conditions, specifications and pricing remain the same. Per contractor, agency and DTMB Procurement agreement.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

Company Address Mandiant, Inc.

601 McCarthy Blvd Milpitas, CA 95035

US

Quote # Q-202382

Quote Status Approved Account ID 146121 Account Name State of Michigan - Department of

Technology Prepared By Alyssa Lokie Email alyssa.lokie@mandiant.com

Creation Date 1/20/2022 Quote Expiration Date 2/15/2022

Bill To Name State of Michigan - Department of Technology

Ship To Name State of Michigan - Department of Technology

Bill To Address 515 Westshire Drive Lansing MI 48917 United States

Ship To Address 515 Westshire Drive Lansing MI 48917 United States

# Product Code Serial # Product Name Purchase Type

Term Billing Frequency

Group

Prorated/ List Price

QTY Disc % Net Price

1 UP-GSI-EOD-UNITS-

ONLY-200UNITPKG

UPG-EOD Units, Per Unit, 200 UNIT

PKG

First Time One-Time 1 $860.00 117 12 $88,545.60

Grand Total

Total List Price $100,620.00 Discount % 12.00 Total Price $88,545.60

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to 190000001531Contract Number

ReasnerR@michigan.gov

Richard Reasner

Jarrod Barron rebecca.stroder@mandiant.com

Rebecca Stroder

Alexandria, VA 22314

Mandiant, Inc.

CV0003763

703-683-3141

1900 Duke Street

(517) 249-0406

STA

TE

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-241-7546

DTMB

barronj1@michigan.gov

$5,862,411.10

September 13, 2019 September 12, 2023

MANAGED SECURITY SERVICES

September 12, 2022

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ September 12, 2023

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $5,862,411.10

Effective 10/7/2021, the parties assign this contract from FireEye, Inc. to Mandiant, Inc. pursuant to a corporate name change.

All other terms, conditions, specifications and pricing remain the same. Per contractor, agency and DTMB Procurement agreement.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 1 to 190000001531Contract Number

ReasnerR@michigan.gov

Rich Reasner

Jarrod Barron sherita.blakely@mandiant.com

Sherita Blakely

Alexandria, VA 22314

FIREEYE, INC.

CV0003763

678-468-3893

2318 Mill Rd., Suite 500

(517) 249-0406

STA

TE

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

517-241-7546

DTMB

barronj1@michigan.gov

$4,027,461.50

September 13, 2019 September 12, 2022

MANAGED SECURITY SERVICES

September 12, 2022

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 1 Year ☐ September 12, 2023

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,834,949.60 $5,862,411.10

Effective 9/7/2021, the parties exercise the first option year and add $1,834,949.60 for ongoing services through 9/12/2023.

All other terms, conditions, specifications, and pricing remain the same. Per Contractor, Agency, DTMB Procurement and State Administrative Board approval on 9/7/2021.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

NOTICE OF CONTRACT

NOTICE OF CONTRACT NO. 190000001531 .

between

THE STATE OF MICHIGAN

and

C O

N

TR

A C

TO

FireEye, Inc.

ST

A

TE

Pr og an ag er Rock Rakowski DTMB

2318 Mill Rd, Suite 500 (517) 898-6028

Alexandria, VA 22314 RakowskiJ@michigan.gov

Joe Roberts

C on tra ct

Ad in is tra to r Garrick Paraskevin DTMB

(480) 559-1449 (517) 256-7516 joe.roberts@mandiant.com ParaskevinG@michigan.gov

CV0003763

DESCRIPTION: Managed Security Services (MSS)

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE

INITIAL AVAILABLE

OPTIONS

EXPIRATION DATE BEFORE

CHANGE(S) NOTED BELOW

September 13, 2019 September 12, 2022 (5) 1-Year September 12, 2022

PAYMENT TERMS DELIVERY TIMEFRAME

Net 45 N/A

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-card ☐ Payment Request (PRC) ☐ Other ☐ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

N/A

MISCELLANEOUS INFORMATION

N/A

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION $4,027,461.50

STATE OF MICHIGAN PROCUREMENT

Department of Technology, Management, and Budget 525 W Allegan St, Lansing, MI 48933

Contract No. 190000001531 Managed Security Services (MSS)

EXHIBIT A

STATEMENT OF WORK

1. PURPOSE

Contractor must provide the following products in accordance with the agreed upon project schedule and in alignment with SUITE methodology.

For this Statement of Work (“SOW”), the following systems will be installed / configured…