2-RFP 3613-10 Proctoring.docx

RFP# 3613-10

Section Eleven: ATTACHMENT B Rev 090817

MARICOPA COUNTY COMMUNITY COLLEGE DISTRICT

REQUEST FOR PROPOSAL #3613-10

Online Proctoring Services

Proposal Due Date April 14, 2026 3 PM (local time)

MARICOPA COUNTY COMMUNITY COLLEGE DISTRICT

RFP # 3613-10

Online Proctoring Services

SCHEDULE OF EVENTS

Table of Contents

GENERAL

1.1 INTRODUCTION

The Maricopa County Community College District (MCCCD) intends to acquire or license a software system for the purpose of providing remote online assessment proctoring primarily for the colleges and skill centers using the Instructure Canvas Learning Management System (LMS)

1.2 MCCCD DISTRICT MAKE-UP

MCCCD comprised of ten colleges, and numerous education centers dedicated to educational excellence by meeting the needs of the businesses and the citizens of Maricopa County. Each college is individually accredited, yet part of a larger system, the Maricopa County Community College District (MCCCD or District). The MCCCD is one of the largest higher education systems in the nation. As the largest provider of health care workers and job training in Arizona, it is a major resource for business and industry and for individuals seeking education and job training. More than 200,000 students attend the Maricopa Community Colleges each year taking credit and non-credit courses. MCCCD employs nearly 4,800 full-time faculty and staff and more than 6,800 part-time faculty and staff.

1.3 HISTORY

MCCCD ranks as one of the nation’s largest systems of its kind and is the largest single provider of higher education in Arizona. MCCCD educates and trains thousands of students year-round. What’s more, thousands of employees from both local and relocating businesses and industries are enrolled in customized workforce training programs with the MCCCD system. MCCCD’s administration, faculty and staff are committed to working collectively and responsibly to meet the life-long learning needs of our diverse students and communities.

A seven-member governing board governs MCCCD. Five members are elected from geographical districts within Maricopa County, while two are elected on a countywide basis. The chief executive officer of MCCCD is the Chancellor; and a president heads each of the colleges. MCCCD is a political subdivision of the State, and the elected governing board has the power to levy taxes. Funding comes from property taxes, student tuition, and federal, state and private grants.

1.4 CURRENT ENVIRONMENT

The Maricopa County Community College District, along with most educational entities in the State of Arizona, has been dealing with decreased funding support from the State for many years. In 2015, the State of Arizona eliminated all of the funding it was providing to help support MCCCD’s operations. In addition to the loss of all funding from the State, MCCCD has experienced a decrease in student enrollment, which is a typical trend for all community colleges during strong economic times.

It is the philosophy of MCCCD that this loss of funding and decreased enrollment should not be bridged by raising student tuitions or by burdening the public with increases in their taxes. The result of these funding reductions has created a need to rethink the traditional model of customer and vendor so that MCCCD can continue to provide the best learning environment for our student population as well as practice good stewardship of the public support we receive.

It is the District’s desire to move towards a model that is being utilized by many other higher learning institutions throughout the country which is to evolve the previous customer/supplier relationships associated with our contractors to that of becoming our Strategic Partners. By cultivating strategic partnerships, it will enable MCCCD and the awarded contractor to help identify potential cost reductions, maximize efficiencies, and tap unexplored value-added opportunities to maximize resources and support to the benefit of both parties. Any potential strategic initiatives can be established during negotiations.

1.5 STRATEGIC PARTNERSHIPS

In addition to providing the services listed in this Request for Proposal, MCCCD is continually seeking to expand its relationships with contractors who can evolve into a strategic partner. We are seeking companies that can help expand the boundaries of what has been thought of as traditional consulting contracts by infusing the program with new concepts, out-of-the box thinking, and value-added offerings that may not have existed before.

1.6 VALUE-ADDED OFFERINGS:

MCCCD would be interested in receiving any suggestions that would bring added value to this contract. As stated in section 1.4, the previous sources of State revenue support have been cut and in order to continue to provide the quality of education our students deserve MCCCD is open to considering new resources and ideas to help alleviate these short-falls. These proposals may be a one-time occurrence or recurring in nature, revenue producing (such as incentives or rebates) or other offerings that would bring added value to our organization. Provide details how leveraging a strategic partnership with your company can assist MCCCD in achieving our goals. Creative solutions are encouraged and should be clearly labeled in the proposal as an attachment.

Potential value-added offerings may be proposed in general in the attachment but will not be reviewed and considered until after the competitive evaluation process has been completed. Once a susceptibility of award is determined by the evaluation team further negotiations regarding these added value offerings may occur and must be completed prior to a final contract award.

The negotiation of any of these offerings is separate from the evaluation process. Changes / additions to these offerings may be made if agreed upon in writing by both parties and included as a signed contract amendment.

MCCCD reserves the right to exclude items offered under this section from co-operative use unless also agreed upon by the awardee.

Section One: GENERAL Rev 090817

PROPOSAL INSTRUCTIONS

2.1 PROPOSAL QUESTIONS

All questions regarding this Request for Proposal should be submitted online via the MCCCD Procurement Portal. The deadline to submit questions is: March 26, 2026, 5:00 PM (local time).

We will not respond directly to the company asking the question. All questions received within the question period will be acknowledged even if an answer cannot be provided. Responses to the questions received by the deadline will be answered in the form of an addendum. The addendum will be posted on the MCCCD Procurement Portal, and an email notification sent to all known potential respondents who have answered “Yes” to the Intent to Bid question or anyone who has downloaded documents from the portal. The addendum will be made available on/about April 1, 2026.

2.2 PROPOSAL SUBMISSION

MCCCD uses a portal hosted by Euna Procurement (formerly Bonfire) for accepting and evaluating proposals. Registration for a Euna Procurement account will be necessary to view and respond to the RFP. It shall be the responsibility of the Proposer to confirm that proposals contain all required documents and are submitted electronically through the MCCCD Procurement Portal located here:

https://maricopa.bonfirehub.com/portal/?tab=openOpportunities Upon upload, proposals are automatically timestamped and will remain secure and sealed until after the submission deadline has passed. Your proposal should include all items listed in Section 4.6: Format and Submittal Requirements. Your proposal is available for you to edit or change any time up to the RFP submission deadline.

Please contact Euna Procurement at support.bonfire@eunasolutions.com for technical questions related to your submission or difficulties in accessing the RFP documents. You can also visit their help forum at:

https://maricopa.bonfirehub.com/portal/support

Your proposal must be completed and uploaded to our site no later than 3:00 P.M. (local time), April 14, 2026. Submissions after this date and time will automatically be rejected by the system. The time on the MCCCD Procurement Portal shall be the official submittal time of record.

It is the proposer’s responsibility to be aware of the submission deadline and allow sufficient time to complete any uploads needed to finalize your submission. Any technical or internet-related issues that may arise during your submission are not grounds to extend the deadline. It is strongly recommended you begin your submission upload process at least one (1) day prior to the deadline.

2.3 AWARD DETERMINATION

This Request for Proposal does not constitute a commitment by the District to award a contract. The District reserves the right to waive any informalities and to reject any or all proposals and/or to cancel the Request For Proposal. The award shall be made on the proposal(s) that serves the best interest of the District and will not be evaluated solely on a monetary basis. The District reserves the right to negotiate a contract with the selected awardee. Even after the execution of a contract document or Notice of Award, the selected vendor may not initiate contract performance or incur any contract costs until it receives a District-issued purchase order or Procurement card.

2.4 PROPRIETARY INFORMATION

All materials submitted as part of a response to a solicitation are subject to Arizona public records law and will be disclosed if there is an appropriate public records request at the time of or after the award of the contract.

In the event any Proposer shall include in the Proposal any information deemed "proprietary" or "protected", such information shall be separately packaged from the balance of the proposal and clearly marked as to any proprietary claim. A “Confidential Information” section is included in the solicitation’s Requested Information. See section 4.6.

If a Proposer wants to assert that a proposal contains a trade secret or other proprietary information, a Proposer shall include with the submission a statement supporting this assertion. A Proposer shall clearly designate any trade secret and other proprietary information, using the term “confidential” and include it in the “Confidential Information” submittal section. Contract terms and conditions, pricing, and information generally available to the public are not considered confidential information.

The District discourages the submission of such information and undertakes to provide no more than reasonable efforts to protect the proprietary nature of such information. The District, as a public entity, cannot and does not warrant that proprietary information will not be disclosed. The District shall have the right to use any or all information included in the proposals submitted unless the information is expressly restricted by the Proposer. The District reserves the right to make its own determination of Proposer’s proprietary materials.

Requests to deem the entire proposal or price as confidential will not be considered.

When submitting a response containing “Confidential” information, Proposer agrees to defend, indemnify and hold harmless the District, its officers and employees, from every claim, demand, loss, expense, cost, damage or injury, including attorney’s fees, arising out of or resulting from the District withholding information that offeror marked as “Confidential”.

2.5 PROPOSAL FORM

All proposals must be submitted in writing, using the accepted file formats listed. Each proposal shall be prepared simply, providing the straightforward, concise description of the proposer's ability to meet the requirements of the RFP. Emphasis should be on completeness and clarity of contents. No proposal shall exceed forty (40) typewritten pages in length plus any pricing schedule(s), exhibits, resumes, proposed draft revenue sharing agreement, or attachments. Please refer to Section 4.6 Format and Submittal Requirements. Proposals that do not follow the Format and Submittal Requirements outlined in Section 4.6 may be disqualified.

2.6 PROPOSER MODIFICATIONS TO PROPOSALS

Proposals may be modified after submittal to the MCCCD Procurement Portal by accessing your Euna Procurement account. Any modifications must be made and the files re-uploaded to the MCCCD Procurement Portal by the published opening date and time. No modifications to proposals are permitted by the proposer after the published RFP opening date and time.

2.7 WITHDRAWAL OF PROPOSAL

Any Proposer may withdraw their proposal by accessing their Euna Procurement account prior to the deadline set for receipt of proposals. No proposal may be withdrawn or modified after that deadline and shall be binding upon Proposer for a period of ninety (90) days after due date. Withdrawn Proposals may be resubmitted up to the time designated for the receipt of Proposals provided that they are then fully in conformance with the general terms and conditions of the RFP.

2.8 PROPOSAL COSTS

Any and all costs associated with the preparation of responses to this Request for Proposal, including site visits, oral presentations and any other costs shall be entirely the responsibility of the Proposer and shall not be reimbursable in any manner.

2.9 ORAL PRESENTATIONS

Proposers may, after opening and prior to award, be required to make oral and visual presentations at the request of the MCCCD. The MCCCD will schedule the time and location for any presentations as requested. Oral presentations will be evaluated.

2.10 AWARD WITHOUT DISCUSSION

The MCCCD reserves the right to make an award(s) without further discussion of the proposals received. It is therefore critical that all proposals be submitted initially in the most favorable terms possible, both economically and technically.

2.11 CONTRACT COMMENCEMENT/TERM

It is the intent of the District to award a 1-year contract, with 4 optional renewals, for a total potential contract term of five (5) years. However, if a mutually beneficial strategic agreement can be reached that would benefit from a longer term, those terms will also be considered.

A written Notice of Award with a specific contract start date will be made prior to commencement of performance. The contract start date is expected to be approximately July 1, 2026. No billable work is to be done without a signed PO.

2.12 MCCCD MODIFICATIONS TO PROPOSALS

Any interpretation, correction, or change of this RFP will be made by written Addendum. Interpretations, corrections, or changes of this RFP made in any other manner will not be binding, and Proposers shall not rely upon such interpretations, corrections, and changes. Any changes or corrections will be issued by MCCCD Purchasing. Addenda notification will be e-mailed to all known potential respondents who have answered “Yes” to the Intent to Bid question on the portal or anyone who has downloaded documents from the portal. Addenda will also be posted to the proposal documents on the MCCCD Procurement Portal located at:

https://maricopa.bonfirehub.com/portal/?tab=openOpportunities

2.13 NON-COLLUSION

The MCCCD encourages free and open competition. Whenever possible, specifications, proposal invitations and conditions are designed to accomplish this objective, consistent with the necessity to satisfy the MCCCD’s needs and the accomplishment of a sound economical operation. The Proposer's signature on its proposal guarantees that any prices offered have been established without collusion with other eligible Proposers and without effort to preclude the MCCCD from obtaining the most advantageous proposal.

RFP# 3613-10

Section Two: PROPOSAL INSTRUCTIONS Rev 090817

SCOPE OF WORK

3.1 Minimum Requirements

3.1.1 The solution must integrate with the Instructure Canvas LMS (Learning Management System) assessment feature, including the new quizzes feature. If LTI integration is required, must use LTI 1.3 standard.

3.1.2 The solution must have a standalone lockdown browser feature that works in conjunction with our tools and will require any devices used during an assessment to enter a secure “lockdown” mode that restricts access to other applications, browsers, and system functions during an assessment.

3.1.3 The solution must be able to restrict the student being assessed to the LMS (e.g., RioLearn, Perception, Canvas) being used only during the assessment event.

3.1.4 The solution must be able to allow the student to remotely provide visual identity information to the institution, so that the student enrolled in the course is clearly the individual being assessed. Include the ability to conduct liveliness checks, including that the student is in frame at all times, and/or re-verify identification once the assessment has started.

3.1.5 The solution must have the option to automatically create a video log of the assessment-taking process so that the student can be observed during the entire assessment. The video log must be made available to the instructor and institution for review.

3.1.5.1 The video log must be indexable to make it simple to find evidence of potential alleged academic dishonesty.

3.1.5.2 The video log must be able to be preserved for an acceptable time frame to reproduce evidence in case of an official grade dispute. Please detail your retention limits and standards as well as data destruction standards.

3.1.5.3 The system provides automated integrity-risk indicators and allows instructors to sort or prioritize assessment attempts based on flagged behaviors.

3.1.5.4 The system should have a screen view and timestamp of when questions are answered.

3.1.5.5 The system should have a video log from multiple angles to ensure that the student is not accessing notes, other devices, or other aides during the assessment.

3.1.5.6 Video log must allow for a video of the student’s assessment environment (room scan).

3.1.6 The solution must work with off-the-shelf consumer technology available to individual students, including common “BYOD” mobile solutions from Google and Apple, including tablets and iPads, whether wifi or cabled.

3.1.6.1 The solution must work with existing personal computing technology already invested in by MCCCD campus labs and computing commons

3.1.7 Must be ADA compliant and meet WCAG 2.1 AA standards.

3.2 Desired Requirements

3.2.1 The solution should be able to support non-institutional LMS (Canvas) online assessment environments, such as officially adopted publisher content and other online systems approved for use at MCCCD (for example, Perception, Pearson, Riolearn, Evolve HESI, and MOER) or as selected by instructors and instructional designers.

3.2.2 The solution should ideally not require additional software; a web browser would be preferred.

3.2.3 The solution should allow instructor-defined exceptions for approved tools (e.g., calculator, digital whiteboard, equation editor) while maintaining lockdown restrictions on all other applications.

3.2.4 The solution should include a “show your work” capability that allows students to submit handwritten, scanned, photographed, or digital work artifacts during or immediately after an assessment.

3.2.5 The solution should include live proctoring or monitoring options so that academic dishonesty can be found in real time, investigated, and put an end to.

3.2.5.1 The solution should offer multiple levels of proctoring, allowing departments or instructors to customize based on need.

3.2.6 The solution should have the ability to use our own live proctors with their product.

3.2.7 The solution should have the ability to immediately notify the instructor (or selected parties) of any misconduct to avoid grading the student out of the course.

3.2.8 The solution and all workflows should be compatible with Disability Resource Services software and screen readers such as Kurzweil.

3.3 Respondent Questionnaire

3.3.1 Provide a description of your firm. Include your firm’s experience, number of years in business providing the requested services.

3.3.2 List specific individuals who would be directly assigned to this account. Provide a brief description of their respective roles and responsibilities and resumes.

3.3.3 Provide the names, addresses, and telephone numbers of your three (3) largest clients to whom you have provided similar services during the past three years. Use Attachment A to list contact details of each of these clients.

3.3.4 Address in detail your knowledge, expertise, and experience in providing the services requested in Section 3.2, Scope of Work, and your understanding and ability to comply with the requirements of this RFP.

3.3.5 Provide any other examples, justification, or experiences that would further demonstrate your ability to provide the services requested in this RFP.

3.3.6 Provide your average response time following significant weather event where multiple trees are down.

3.3.7 Provide a list of any additional goods and/or services that your firm provides that are not addressed in the RFP. The District retains the absolute and sole discretion to examine and consider these additional goods/service options for inclusion in the contract awarded under this RFP.

RFP# 3613-10

Section Three: SCOPE OF WORK/SPECIFICATIONS

PROPOSAL REQUIREMENTS

The following is a listing of general and specific criteria used for the evaluation of this RFP. The areas include, but are not limited to:

4.1. MINIMUM REQUIREMENTS

4.1.1 Must be licensed by the State that the business is in, if services requested require such licensure.

4.1.2 Must have carefully read and understand all parts of the RFP and certified that the Proposal is made in accordance therewith.

4.1.3 Must submit written answers to the Respondent Questionnaire. All answers must be in the order in which the questions were asked and labeled with the specific section number.

4.1.4 The Proposer must submit a signed Signature Page (Section 9). Electronic signatures are acceptable. Failure to submit a signed proposal may result in rejection of the Proposal.

4.1.5 Must provide a completed Pricing Schedule (Section 6) signed by an authorized company signatory confirming its offer and acknowledging its understanding of the requirements of this Request for Proposal.

4.1.6 Must acknowledge your agreement to comply with items listed under the Minimum and Specific Requirements of this Request for Proposal.

4.1.7 Must submit a completed copy of the Higher Education Community Vendor Assessment (HECVAT) Lite security questionnaire assessment form. The HECVAT Lite may be downloaded from here:

https://library.educause.edu/resources/2020/4/higher-education-community-vendor-assessment-toolkit

4.2 DEVIATIONS FROM RFP

Proposers must specifically provide a separate listing of each circumstance in which their proposal differs from any terms or conditions of this Request for Proposal. Failure to list such a deviation will result in the terms of the proposal being disregarded in favor of the corresponding term(s) of the RFP. Material deviations from the requirements of this RFP shall result in rejection of the proposal.

The term “material deviations” includes both deviations from the MCCCD contract terms set forth in this RFP and additional contract terms that the Proposer requests the MCCCD to consider. Be aware that the absence of a term on a subject in the RFP, particularly a general contract term and condition, does not mean that the Proposer should feel free to offer one. The MCCCD considers the General Terms and Conditions of this RFP to be a fair allocation of risk between a contractor and the MCCCD. It will not accept terms – revised or additional ones - that shift those risks or provide the Proposer with additional discretion. The Proposer in choosing the respond to this RFP must demonstrate in its Proposal that it accepts the terms upon which the MCCCD is conducting the competition.

To submit deviations the Proposer must state in the separate listing all deviations, including any additional terms, in the following format:

· Title your listing “REQUESTED DEVIATIONS”.

· Cite the specific page and section number of each term and condition change request. Include the original MCCCD RFP Term and Condition.

· Provide a legal redline version of the original RFP language to include the requested change(s). Or immediately below the original RFP Term and Condition include the specific language you want MCCCD to consider adding or replacing.

MCCCD will consider deviation requests, both the total number and the overall scope, in determining the most advantageous offer. Deviations may affect the possibility of an award and any requests should be considered carefully.

Deviations that a winning Proposer submits after it has been selected for award, such as through a vendor standard template contract, will not be considered. If a Proposer submits a Proposal without specific deviations, and the Proposal is accepted by MCCCD, Proposer will be deemed bound by the terms of the RFP without exception.

4.3 SIGNATURE

The Contractor shall furnish and include all requested information with their proposal. Statements are required to be complete and accurate, and the proposal shall be signed by an authorized signatory of the company (sworn to and notarized, if requested). A proposal submitted by an agent will have a current Power of Attorney attached certifying the agent’s authority to bind the Proposer. Omission, inaccuracy, or misstatement may be sufficient cause for rejection of the proposal.

4.4 AWARD CONSIDERATION

From the total information requested, determination shall be made of the Proposer's ability to serve the MCCCD. Only proposals from responsible organizations or individuals, as determined by the MCCCD, which have the capability of providing the required services under this RFP, shall be considered. Representatives from the MCCCD reserve the right to conduct interviews with the individual proposers for clarification of the proposals presented. The MCCCD reserves the right to negotiate any and all provisions presented in the proposals.

4.5 PROTESTS AND APPEALS OF CONTRACT AWARDS

Bid protests or appeals of contracts and awards shall be submitted per Chapter Nine of the Purchasing Procedures Manual.

4.6 FORMAT & SUBMITTAL REQUIREMENTS

The requested information for your RFP submittal is listed below. The documents must be submitted via the MCCCD Procurement Portal before the due date here:

https://maricopa.bonfirehub.com/portal/?tab=openOpportunities Proposals that do not follow the Format and Submittal Requirements as outlined in the table below may be disqualified.

Important Notes:

· Take note of the type and number of files allowed. The maximum upload file size is 1000 MB.

· Do not embed any documents within your uploaded files. They will not be accessible or evaluated.

· Uploading documents may take significant time, depending on the number and size of the file(s) and your Internet connection speed.

· You will receive an email confirmation receipt with a unique confirmation number once you finalize your submission.

RFP# 3613-10

Section Four: PROPOSAL REQUIREMENTS Rev 022718

· Minimum system requirements: Internet Explorer 11, Microsoft Edge, Google Chrome, or Mozilla Firefox. JavaScript must be enabled. Browser cookies must be enabled.

RFP# 3613-10

Section Five: EVALUATION CRITERIA Rev 090817

EVALUATION CRITERIA

The following is a listing of general and specific criteria used for the evaluation of this RFP. The areas include, but are not limited to:

5.1 General quality of responsiveness of proposer:

A. Ability to meet all terms and conditions B. Completeness and thoroughness of proposal C. Grasp of scope of work to be performed D. Description of approach to be taken E. Evidence of effective organizational and management practices F. Qualifications of personnel G. Experience and past performance

5.2 Specific areas that will be evaluated and scored except as described in STEP THREE below:

A. Past experience in providing comparable services to other clients.

B. Responses to Minimum and Specific Requirements.

C. Respondent Questionnaire responses.

D. Pricing.

Proposals will be evaluated in accordance with the following three-step process:

STEP ONE - Verification of each proposer's compliance with the RFP general terms and conditions as listed in Section 1, 2, 7, and 8 of this RFP.

STEP TWO - Verification of each proposer's compliance that all required written responses/confirmations are thoroughly submitted.

STEP THREE – All proposals meeting the criteria as presented in Steps One and Two will be evaluated with a "points-earned compliance matrix". An evaluation committee will evaluate and score the proposals. The proposals will be ranked on a "points-earned" technical, service and financial compliance matrix. The evaluation committee may continue to evaluate proposals after the initial scoring of them by any means that it deems reasonable. If the evaluation committee schedules oral presentations, the presentations may or may not be scored and that scoring may, but is not required to be added to the previous scoring of the proposals. The evaluation committee reserves the right to use additional advisory committees or subject matter experts at any time during this RFP to assist with the evaluation.

Section Six: EVALUATION CRITERIA Rev 090817

PRICING SCHEDULE

The undersigned has read and understands all conditions and terms of RFP 3613-10, is authorized to submit this proposal on behalf of the company, and hereby offers to perform the services for the pricing indicated below:

6.1 Cost/Fee Proposal

6.2 Other required services/fees, if any, not specifically requested in the RFP (list below)

Costs/Fees listed shall include all overhead and profit. No billing will be accepted that shows any other costs than those listed. This includes, but is not limited to, travel, any out-of-pocket costs, meetings, secretarial, printing, delivery, rent, phone calls, postage, overnight mail service, accounting, fuel charges, office supplies, etc.

Billing to MCCCD should be in a manner in which all locations and their associated costs can be identified for our accounting processes.

Any contractor that MCCCD is doing business with must agree to e-billing.

Please confirm that the authorized agent preparing this Proposal has read, understands, and will ensure his/her firm’s compliance with the provisions of this section:

Authorized Agent’s Name and Initials: __________________________________ _____

You may submit a more detailed pricing schedule (using the same formatting) in lieu of the above as an attachment to this page, but the pricing schedule must be completed, initialed and included with your proposal.

RFP# 3613-10

Section Seven: PRICING SCHEDULE Rev 090817

SPECIAL TERMS AND CONDITIONS

**Any deviations to the Special Terms and Conditions MAY be considered in this proposal** These General Terms and Conditions, the other provisions of the RFP and amendments to it, the Proposer proposal, and MCCCD’s purchase order terms (“Contract Documents”) along with any engagement letter will constitute the provisions of the contract between MCCCD and successful Proposer (“Contract”). MCCCD reserves the right to negotiate with the successful Proposer and modify any of the provisions of the Contract upon mutual written agreement of the parties. The RFP, amendments to it, and MCCCD’s purchase order terms will take precedence over any inconsistent terms in a proposal or other documents. The term “days” as used in this Contract means business days, unless otherwise specified.

7.1 INSURANCE REQUIREMENTS

The insurance requirements herein are minimum requirements for this contract and in no way limit the indemnity covenants contained in this contract. MCCCD in no way warrants that the minimum limits contained herein are sufficient to protect Contractor from liabilities that arise out of the performance of the work under this contract by the contractor, its agents, representatives, employees, or subcontractors and the contractor is free to purchase additional insurance.

Contractor shall maintain during the term of this Agreement insurance policies described below issued by companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers. Insurers shall have an A.M.

Best rating of A - VII or better. At the signing of this Agreement, Contractor shall furnish the MCCCD with certificates of insurance evidencing the required coverages, conditions, and limits required by this Agreement. Certificate of Insurance shall be sent to:

Representative’s Name (person who is collecting the certificate) College or District Office and address Phone number and email address

The insurance policies, except Worker’s Compensation, must be endorsed as require by this written agreement to name MCCCD and its agents, officers, officials, employees, and volunteers as additional insureds or its equivalent:

The Maricopa County Community College District and its agents, officers, officials, employees, and volunteers are hereby named as additional insureds as their interest may appear.

The insurance policies shall contain a waiver of subrogation endorsement in favor of Maricopa County Community College District, its agents, officers, officials, employees, and volunteers for losses arising from work performed by or on behalf of the contractor.

Contractor and, if applicable, any subcontractors will notify the MCCCD Risk Manager by certified mail promptly if it receives notice or the expiration, cancellation, suspension, or material change in its insurance coverage, but in no case fewer than 30 days before the action specified in the notice. The Contractors insurance must be primary, and any insurance or self-insurance maintained by MCCCD will not contribute to it. If any part of the Agreement is subcontracted, these insurance requirements also apply to all subcontractors.

The contracting College or District Office, with approval from MCCCD Risk Management, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary. Such action between the College or District Office and MCCCD Risk Management will not require a formal Contract amendment but may be made by administrative action.

In the event any professional liability insurance required by this Contract is written on a “claims made” basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract; and that either continuous coverage will be maintained or an extended discovery period will be exercised for a period of three (3) years beginning at the time work under this Contract is completed. Contractor’s work or services and must be evidenced by annual certificates of insurance.

Contractor shall notify the MCCCD Risk Manager by certified mail promptly if it receives notice or the expiration, cancellation, suspension, or material change in its insurance coverage, but in no case fewer than 30 days before the action specified in the notice. The Contractor’s insurance must be primary, and any insurance or self-insurance maintained by MCCCD shall not contribute to it. If any part of the Contract is subcontracted, these insurance requirements also apply to all subcontractors.

Commercial General Liability (CGL) – Occurrence Form Policy shall include bodily injury, property damage, and broad form contractual liability coverage, including but not limited to, the liability assumed under the indemnification provisions of this Contract.

· General Aggregate $2,000,000

· Products – Completed Operations Aggregate $1,000,000

· Personal and Advertising Injury $1,000,000

· Damage to Rented Property $50,000

· Each Occurrence $1,000,000

If applicable, Commercial Automobile Liability insurance with a combined single limit for bodily injury and property damage of not less than $1,000,000.00 each occurrence with respect to the Contractor’s and, if applicable, the sub-contractor’s owned, hired, and non-owned vehicles.

Worker’s Compensation insurance with limits statutorily required by any Federal or State law and Employer’s Liability insurance of not less than $1,000,000 for each accident, $1,000,000 disease for each employee, and $1,000,000 disease policy limit.

If applicable, Professional Liability insurance covering acts, errors, mistakes, omissions rising out of the work or services performed by the Contractor, or any person employed by the Contractor, with a limit of not less than:

· Each Claim $2,000,000

· Annual Aggregate $2,000,000

Network Security and Privacy Liability coverage in an amount not less than $5,000,000 per claim and annual aggregate, covering all acts, errors, omissions, negligence, infringement of intellectual property (except patent and trade secret); network security and privacy risks, including but not limited to unauthorized access, failure of security, breach of privacy perils, wrongful disclosure, collection, or other negligence in the handling of confidential information, privacy perils, and including coverage for related regulatory defense and penalties; data breach expenses, in an amount not less than $5,000,000 and payable whether incurred by MCCCD or Contractor including but not limited to consumer notification, whether or not required by law, computer forensic investigations, public relations and crisis management firm fees, credit file or identity monitoring or remediation services in the performance of services for MCCCD or on behalf of MCCCD hereunder. The policy shall include coverage for third party claims. The policy shall contain an affirmative coverage grant for contingent bodily injury and property damage emanating from the failure of the technology services or an error or omission in the content/information provided. Such insurance shall be maintained in force at all times during the term of the agreement and for a period of three years thereafter for services completed during the term of the agreement. MCCCD shall be given at least 30 days’ notice of the cancellation or expiration of the aforementioned insurance for any reason.

Please also refer to Attachment B, Data Confidentiality and Security Addendum, incorporated herein by reference.

7.2 OBLIGATIONS TO PROTECT CONFIDENTIAL INFORMATION

PLEASE ALSO REFER TO ATTACHMENT B, DATA CONFIDENTIALITY AND SECURITY ADDENDUM, INCORPORATED HEREIN BY REFERENCE.

7.3 RECORD AND DATA RETENTION, OWNERSHIP, ACCESS AND DECOMMISSIONING

7.3.1 As a political subdivision of the State of Arizona, MCCCD is subject to applicable laws related to the inspection and production of public records. A public record entails any record, either paper or electronic, made by a public officer (including members of the Governing Board, faculty, staff and administrators) and kept as a memorial of an official transaction. Pursuant to Arizona Revised Statutes §41-151.12, MCCCD must retain records according to established retention periods. Records required for ongoing or foreseeable official proceedings such as audits, lawsuits or investigations must be retained until released from such official proceedings. Thus, if applicable, the Contractor’s hosted system shall have the ability to:

A. Archive records according to variable time periods/life cycles;

B. Search and retrieve records based upon content;

C. Place a litigation hold on records to ensure that they are not deleted;

D. Grant direct access to MCCCD for its own search and production of records;

E. Preserve meta data;

F. Produce electronic records in their native format; and G. Comply with the Americans with Disabilities Act.

7.3.2 MCCCD owns all of the records and data of which Contractor has custody on MCCCD’s behalf. Contractor will not disclose, use, destroy, transfer or otherwise manage those records and data except as provided in this Contract or, if the Contract is silent, without the express written approval of an authorized MCCCD representative. Contractor will work with MCCCD to transfer all of MCCCD’s records and data to MCCCD on the termination or expiration of this Contract.

7.3.3 Contractor agrees to provide MCCCD access to records and Confidential Information that Contractor holds or uses on behalf of MCCCD upon written request of MCCCD with reasonable advance notice. Further, Contractor agrees to make amendments to Confidential Information as directed by MCCCD and will maintain a record of those changes.

7.3.4 Contractor agrees to maintain, and provide to MCCCD if requested, a record of when and to whom Confidential Information is disclosed.

7.3.5 MCCCD agrees to provide Contractor with adequate notice of any further limitations or restrictions on the use of Confidential Information, and modifications to the amendment of records or accounting of disclosures.

7.3.6 Confidential Information of the disclosing party will be returned to the disclosing party or securely destroyed promptly upon request of the disclosing party without retaining any copies thereof, with any destruction confirmed in writing by receiving party, with any destruction confirmed in writing by receiving party, except to the extent copies are required by law to remain with Contractor.

7.4 MCCCD EXTERNAL ENTITY SECURITY AND HOSTING PRACTICES AND STANDARDS

PLEASE REFER TO ATTACHMENT B, DATA CONFIDENTIALITY AND SECURITY ADDENDUM, INCORPORATED HEREIN BY REFERENCE I. Data Management/Protection Deletion of Environments: Upon termination of services or at MCCCD’s request, External Entity will delete the Environments located on External Entity computers in a manner designed to ensure that they cannot reasonably be accessed or read, unless there is a legal obligation imposed on External Entity preventing it from deleting all or part of the Environments. Unless otherwise specified in writing, External Entity will archive Environments on tape for six months following termination of the services. MCCCD shall be entitled to request a recovery of such backed-up Environments within the six months following termination.

Disclosure of Data: External Entity will not disclose data located on External Entity systems, including text and images, except in accordance with MCCCD’s contract, MCCCD’s instructions, or to the extent required by law. External Entity will use diligent efforts to inform MCCCD, to the extent permitted by law, of any request for such disclosure before disclosure is made.

Crisis Management and Escalation Management: External Entity policy will provide a detailed plan to address an identified infection or high-risk security breach (high-risk event). Such policy will include the detailed activities that address escalation of the resolution of the high risk event, up to an executive level crisis management.

II. Access Control Account Provisioning and Passwords: External Entity must maintain the following standards for provisioning access to and creating passwords for the Environments that are in the control of External Entity:

· Access is provisioned on a need-to-know basis.

· Passwords conform to the strong password guidelines that include complexity, expiration, duplicity and length. Passwords will not be written down or stored online unencrypted.

· Passwords are treated as External Entity confidential information.

· At MCCCD’s request, External Entity will agree with MCCCD on a schedule for periodic password changes.

· User IDs and passwords to MCCCD’s systems are not communicated to any other person without MCCCD’s prior authorization.

General Access: In the event of employee terminations, deaths or resignations, External Entity will take immediate actions to terminate network, telephony and physical access for such former employees. External Entity security will periodically review accounts of terminated employees to verify that access has been terminated and that stale III. Additional External Entity Practices Computer Virus Controls: External Entity must maintain the following computer virus controls for computers issued to External Entity employees:

· External Entity maintains a mechanism within the External Entity network that scans all email sent both to and from any External Entity recipient for malicious code and deletes email attachments that are infected with known malicious code prior to delivery.

· External Entity requires all External Entity employee laptops or other devices that can access MCCCD’s network to be loaded with virus protection software. External Entity maintains mechanisms to ensure that virus definitions are regularly updated, and that updated definitions are published and communicated to employees and other device users. These mechanisms also give employees and other device users the ability to automatically download new definitions and update virus protection software. From time to time, External Entity security will conduct compliance reviews to ensure employees and other device users have the virus software installed and up-to-date virus definitions on all desktops and laptops.

Information Security Managers: External Entity should have ISMs, who function as advocates within External Entity and carry the accountability to:

1. Ensure information security awareness to External Entity employees and management, and

2. Work collectively with that group to help implement and comply with External Entity’s corporate security practices, policies and initiatives.

IV. Human Resources Security Personnel: All External Entity employees, independent contractors, and temporary employees must be required to abide by the External Entity code of ethics and by MCCCD rules, when visiting MCCCD sites. External Entity must place strong emphasis on reducing risks of human error, theft, fraud, and misuse of facilities. External Entity’s efforts should include screening personnel, making personnel aware of security policies, and training employees to implement security policies. For example, employees are expected to have a clear understanding of password policies and policies concerning the handling of confidential information (in any form or shape).

Employee Security Requirements External Entity employees must be required to take various measures to protect the security of the Environments. Employee obligations include written confidentiality agreements and compliance with company policies concerning protection of confidential information (e.g., External Entity code of conduct, acceptable use and information protection policies). Employees also are required to take the following measures to protect MCCCD’s data:

· Store materials containing data securely and share those materials internally only for the purposes of providing the services.

· Dispose of paper copies of confidential materials and materials containing data in shredding bins designated for confidential information, and not in non-secure recycling bins or trashcans.

Subcontractors

· External Entity will obtain a written confidentiality agreement from each subcontractor before the subcontractor provides services. In addition, subcontractors that require access to MCCCD’s Environments are required to sign a services provider agreement and a network access agreement. Included in the services provider agreement are the External Entity standards, which require the subcontractor to implement physical, technical and administrative safeguards consistent with External Entity’s obligations under MCCCD’s order and this document.

· External Entity is responsible for assuring that its subcontractors access, use, and protect the security of the Environments in a manner consistent with the terms of MCCCD’s order and this document.

Employee Training

· All External Entity employees are required to complete information protection awareness training upon hiring and at least every two years thereafter. The course instructs employees on their obligations under the various central External Entity privacy and security policies. The course also trains employees on data privacy principles as well as data handling practices that may apply to their jobs at External Entity and are required by company policy, including those related to notice, consent, use, access, integrity, sharing, retention, security and disposal of data.

· External Entity performs periodic compliance reviews to determine if employees have completed the online data privacy awareness-training course. If External Entity determines that an employee has not completed this training, the employee will be promptly notified and instructed to complete such training as soon as practicable, and may be subject to disciplinary action.

· External Entity promotes awareness of, and educates employees about, issues relating to security. External Entity prepares and distributes to its employees notices and other written material on security.

Enforcement

· External Entity must conduct security reviews, assessments, and audits periodically to confirm compliance with External Entity information security policies, procedures and practices. Employees who fail to comply with information security policies, procedures and practices may be subject to disciplinary action, up to and including termination.

· MCCCD will be entitled to audit External Entity’s Security Policies every year, once per year.

Secti…