210000000301.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 11 to

Contract Number MA210000000301

C O

N

TR

AC

TO

R

DEWPOINT INC

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

ST

AT

E

Pr og ra m

M an ag er

Various Various

C on tr ac t Ad m in is tr at or Emily Massa DTMB

517-897-7321 massae@michigan.gov

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE

January 25, 2021

INITIAL EXPIRATION DATE

January 24, 2026

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE BEFORE

January 10, 2031

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

N/A

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$3,296,695.99

VALUE OF CHANGE NOTICE

$1,362,653.00

ESTIMATED AGGREGATE CONTRACT VALUE

$4,659,348.99

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective August 4th, 2026 the following changes are hereby incorporated into this contract:

1. Schedule A - SOW - DHHS - Independent Information Technology Security Assessments, for county-managed Friend of the Court and Prosecuting Attorney offices and associated attachments are added to this Contract and associated pricing $426,884.00. The State PM on this project is Pratin Trivedi, 517-334-6560, TrivediP@michigan.gov.

2. Schedule A -SOW - EGLE - Remediation Advisory Services and associated pricing is $720,000.00 is added to this contract.

3. $215,769.00 added to the cumulative value of the contract due to error on CN 9.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement approval, and State Administrative Board approval on August 4th, 2026.

CHANGE NOTICE NO. 11 TO CONTRACT NO. MA210000000301

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

MDHHS PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

MA 21-301 MDHHS OCS County Office Cyber Security Assessments

Schedule A – Statement of Work Contract MA 210000000301

Independent Information Technology Security Assessments, for county-managed Friend of the Court and Prosecuting Attorney offices

1. Background

Original Contract requirements apply for this Section, in addition to the following:

The Michigan Department of Health and Human Services (MDHHS), Office of Child Support (OCS) is required by the federal Office of Child Support Enforcement (OCSE) to certify the safeguard and security of Title IV-D child support confidential data including Federal Parent Locator Service data as attested to in the Annual Security Agreement between OCSE and OCS. Every three years, an independent security assessment is to be conducted involving child support program information and the computer systems storing and processing that information. In 2025, an independent assessment was performed for the county managed offices using the Center for Internet Security (CIS) Controls. OCS received the audit results in a statewide summary and corrective action plans or Plan of Action and Milestones (POAM), when necessary, from the county-managed offices.

Starting in 2026, OCS is requiring county-managed Friend of the Court (FOC) and Prosecuting Attorney (PA) offices to participate in vulnerability scans and penetration testing conducted by an independent third-party assessment in compliance with the OCSE Security Agreement.

2. Scope

Original Contract requirements apply for this Section, in addition to the following:

OCS, in partnership with Michigan Department of Technology, Management, and Budget (DTMB), Agency Services (AS) and Michigan Cybersecurity Infrastructure & Protection (CIP), will engage a pre-qualified Contractor from the Michigan Cyber Partners Independent Cyber Assessment and Advisory Services contract to assess each county managed office’s technical security controls that are required for OCS to maintain OCSE Annual Security Certification.

56 County-managed FOC and PA offices will participate in four vulnerability scans (if timing permits to conduct the scans quarterly) and one penetration test over a 12-month period.

See Schedule A- Attachment 1 for a list of the county managed offices. Findings from each scan and test will be presented to the county office in a report. A statewide summary of the findings will be presented to OCS within 30 days of the 12-month period. Counties can use available funding to remediate findings.

3. General Requirements

Original Contract requirements apply for this Section, in addition to the following:

3.1. OCS, in partnership with DTMB and CIP will coordinate Contractor acquisition through the Michigan Cyber Partners independent cyber assessment and advisory service contract to assess the information technology (IT) environment and controls at each of the county-managed offices that impacts the safeguard of Title IV-D child support data. Learn more about Michigan Cyber Partners at www.michgan.gov/cyberpartners. OCS is seeking one (1) Contractor (or a prime with sub- contractors) to provide services outlined and required for this project who will provide:

3.1.1. Consistent county level reports on the findings of their county managed IT systems and environment.

3.1.2. Comprehensive statewide summary report.

3.1.3. All county infrastructure vulnerability scans and penetration testing and county reporting MUST be completed within 12 months from start date. A statewide summary report must be completed within 30 days of the completed assessments.

All work must be completed by August 1, 2027.

3.1.4. The Center for Internet Security (CIS v8.1) Controls are to be used for the county assessment and reporting. OCS has identified specific CIS controls and sub-controls that map to the OCSE security certification requirements.

3.1.5. The Contractor is responsible for the overall project management and on-going scheduling and communications with the county offices. Work closely with county FOC, PA, and IT staff to ensure a smooth process that focuses on assessing, reporting on, and improving the information security processes of individual offices and the statewide system by identifying risks and monitoring remediation with follow-up reporting on remediation activities to OCS.

3.1.6. The Contractor must deliver the quarterly scans through a proven assessment and vulnerability management approach that has been successfully executed across the 56 Friend of the Court (FOC) and Prosecuting Attorney (PA) offices in scope for this project.

3.1.7. The Contractor’s approach must leverage the lessons learned, processes, and operational structure established during the previous two statewide assessment initiatives.

3.1.7.1. The Contractor’s team must utilize a centralized project management and communications model to coordinate scheduling, assessment activities, reporting, and follow-up remediation discussions with each county.

3.1.7.2. A dedicated Project Manager must oversee the engagement timeline and maintain ongoing coordination with county FOC, PA, and IT staff to ensure assessments and reporting activities remain on schedule and are completed within the required project timeframe.

3.2. To ensure consistency across all counties, the Contractor must continue utilizing a standardized assessment methodology aligned to CIS Controls v8.1 and the applicable OCSE security certification requirements identified by OCS. Our assessment process includes:

3.2.1. Pre-assessment coordination and scheduling with county stakeholders

3.2.2. Vulnerability scanning activities and analysis of findings

3.2.3. Collaboration with county FOC, PA, IT, and operational personnel

3.2.4. Development of remediation recommendations and improvement priorities http://www.michgan.gov/cyberpartners

3.2.5. County-level reporting and statewide roll-up reporting

3.3. The Contractor must maintain a collaborative approach focused on improving security posture and operational maturity rather than conducting an audit-focused exercise. This approach has proven effective in establishing trusted working relationships with county stakeholders and encouraging open collaboration throughout the assessment process.

3.4. The Contractor must perform quarterly vulnerability scans for each county utilizing a secure scanning portal configured with separate county-level repositories to ensure appropriate segregation of data and reporting. The Contractor’s scanning approach must include:

3.4.1. External Vulnerability Scanning

3.4.2. Unauthenticated scans of county-provided public-facing IP addresses

3.4.3. County attestation confirming ownership and authorization for scanning

3.4.4. Scheduled scanning windows coordinated directly with the counties

3.4.5. Internal Vulnerability Scanning

3.4.6. Authenticated scanning for Windows domain-joined systems

3.4.7. Unauthenticated scanning for applicable non-domain-joined devices

3.4.8. Coordination with counties to configure scanning virtual machines and required network connectivity

3.4.9. Secure management of county-provided service credentials required for authenticated scans

3.5. Following each scan cycle, the Contractor must provide county-level reporting that includes:

3.5.1. Executive summary reporting

3.5.2. Detailed vulnerability findings

3.5.3. Remediation recommendations

3.5.4. Portal-based access to scan results

3.5.5. CSV export capabilities upon request

3.5.6. Reader access to the scanning portal will be made available for up to three county-designated users per county.

3.6. The Contractor, as requested, must conduct final review meetings with each county to:

3.6.1. Review scan results and technical findings

3.6.2. Discuss remediation priorities and recommendations

3.6.3. Answer technical and operational questions

3.6.4. Identify remediation progress over time

3.6.5. Support continuous improvement of county cybersecurity posture

3.7. In addition to county-level reporting, Contractor must develop comprehensive statewide summary reporting designed to provide OCS with visibility into:

3.7.1. Statewide cybersecurity trends

3.7.2. Recurring vulnerabilities and areas of concern

3.7.3. Comparative maturity across counties

3.7.4. Progress toward remediation and security improvement objectives

3.7.5. Overall cybersecurity posture improvements over time

3.8. Deliverable #4 Conduct External and Internal Penetration Testing

3.8.1. Requirement: Penetration testing including internal vulnerability scanning - based on Internal Revenue Service (IRS) SCSEM and County IT Infrastructure Architecture.

Include these findings and remediation steps in assessment results and statewide summary. The IRS Safeguards links can be found at the following IRS sites:

https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics and https://www.irs.gov/privacy-disclosure/nessus-audit-files

3.8.2. Requirement: State Of Michigan best practices for both penetration testing and vulnerability scanning include both internal and external systems.

3.8.3. The Contractor must conduct a Program Kickoff with the OCS and DTMB concerning the overall program and state-wide project plan. Additionally, the Contractor must conduct kick-off meetings with each county that will be assessed to outline the individual assessment.

3.8.4. The Contractor must present the state-wide Project Management Plan (PMP) to the OCS and DTMB within 10 business days of the program start date. The Contractor must use the State Unified Information Technology Environment (SUITE) PMM 102 Template (see Attachment D - Project Management Plan PMM-0102) to document the PMP.

3.8.5. Contractor must adhere to the standard Communication and Change Management processes outlined in the PMP.

3.9. The Contractor must conduct penetration testing and internal vulnerability scanning through a proven statewide delivery model that has already been successfully executed across the 56 Friend of the Court (FOC) and Prosecuting Attorney (PA) offices currently in scope for this initiative.

3.9.1. Over the 12-month assessment period, each of the 56 counties will receive one penetration test along with internal vulnerability scanning activities aligned to IRS SCSEM requirements, applicable IRS Safeguards guidance, and county infrastructure architecture. The Contractor will lead the overall project management, statewide coordination, scheduling, communications, reporting oversight, and county engagement activities associated with this project.

3.9.2. The Contractor must provide a scalable, repeatable, and operationally mature penetration testing approach.

3.10. The Contractor understands successful delivery of this engagement requires more than technical testing activities alone. The project also requires:

3.10.1. Coordinated statewide scheduling and communications

3.10.2. Consistent testing and reporting methodologies

https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/nessus-audit-files

3.10.3. Structured project governance and oversight

3.10.4. Ongoing coordination with county FOC, PA, and IT personnel

3.10.5. Clear remediation guidance and follow-up discussions

3.10.6. Consistent statewide reporting and visibility into cybersecurity trends

3.11. The Contractor team must conduct a statewide program kickoff meeting with OCS and DTMB to review the overall project approach, communication structure, scheduling process, reporting methodology, and statewide project plan.

3.11.1. Contractor will also conduct individual county kickoff meetings to review assessment expectations, testing coordination activities, timelines, and county-specific requirements.

3.12. Within 10 business days of project initiation, Contractor must develop and present the statewide Project Management Plan (PMP) utilizing the State’s SUITE PMM 102 template.

3.12.1. Contractor will adhere to the communication and change management processes defined within the approved PMP throughout the duration of the engagement.

3.13. The Contractor will utilize the secure Frontline Vulnerability Manager™ (Frontline VM) platform. This platform provides centralized management of testing activities, reporting, remediation tracking, and statewide visibility into assessment results while maintaining secure segregation of county-level data.

3.14. External Penetration Testing (EPT)

The Contractor must conduct external penetration testing against approved internet-facing systems and public-facing assets identified by the counties. External penetration testing activities will include:

3.14.1. Identification and validation of exposed vulnerabilities

3.14.2. Controlled exploitation attempts against identified weaknesses

3.14.3. Review of externally exposed services, configurations, and network paths

3.14.4. Assessment of internet-facing systems, software, databases, and network connections

3.14.5. Validation of attack paths and potential exposure scenarios

3.14.6. Documentation of findings and associated remediation recommendations

3.15. Internal Penetration Testing (IPT)

The Contractor must conduct internal penetration testing against approved in-scope internal systems and network environments identified by the counties. Internal penetration testing activities will include:

3.15.1. Identification and validation of internal vulnerabilities and security weaknesses

3.15.2. Controlled exploitation attempts against identified vulnerabilities within the internal environment

3.15.3. Review of internal network segmentation, configurations, and access controls

3.15.4. Assessment of internal systems, services, and connected devices

3.15.5. Validation of potential attack paths and unauthorized access scenarios within the internal network

3.15.6. Documentation of findings and associated remediation recommendations

3.15.7. Sophisticated penetration testing tools, scripts, and methodologies must be utilized to safely evaluate the ability of an attacker to compromise targeted systems and gain unauthorized access to sensitive resources.

3.16. Internal Vulnerability Scanning

The Contractor must conduct authenticated internal vulnerability scanning activities against in-scope county systems and infrastructure components. Internal vulnerability scanning activities will include:

3.16.1. Authenticated vulnerability scanning of Windows domain-joined systems

3.16.2. Unauthenticated scanning of applicable non-domain-joined systems

3.16.3. Identification and validation of vulnerabilities present within internal environments

3.16.4. Review of system configurations and associated security risks

3.16.5. Prioritization of remediation activities based on operational risk and vulnerability severity

3.16.6. Documentation of findings and recommended remediation actions

3.17. Contractor must coordinate directly with county IT personnel to support:

3.17.1. Scanning virtual machine deployment and connectivity

3.17.2. Validation of in-scope assets and IP ranges

3.17.3. Testing schedules and maintenance windows

3.17.4. Communication of scanning activities and findings

3.17.5. Coordination of county-provided credentials and required access

3.18. The Frontline VM platform must provide:

3.18.1. Centralized results management

3.18.2. Secure county-level data segregation

3.18.3. Executive summary and technical detail reporting

3.18.4. PDF and CSV report generation

3.18.5. Remediation tracking and oversight capabilities

3.18.6. Aggregate statewide reporting views

3.18.7. Risk-based vulnerability prioritization

3.18.8. Audit and management documentation support

3.19. Penetration testing and vulnerability scan results must include detailed information regarding:

3.19.1. Devices and systems assessed

3.19.2. Vulnerabilities identified

3.19.3. Risk severity and operational impact

3.19.4. Recommended remediation activities

3.19.5. Third-party reference materials and technical guidance

3.19.6. Summary and detailed technical reporting views

3.20. Contractor must provide both executive-level and technical reporting following testing activities.

3.20.1. Reporting deliverables will include county-specific findings and remediation recommendations, as well as statewide summary reporting designed to help OCS identify recurring trends, systemic risks, and broader cybersecurity improvement opportunities across the FOC and PA environment.

3.21. Contractor, as requested, must conduct final review meetings with counties to:

3.21.1. Review penetration testing and vulnerability findings

3.21.2. Discuss remediation priorities and recommended next steps

3.21.3. Clarify technical recommendations

3.21.4. Support counties in improving overall cybersecurity maturity

4. Deliverable Specifications

Original Contract requirements apply for this Section, in addition to the following:

The Contractor must provide the following:

4.1. Four (4) infrastructure vulnerability scans for 56 County-managed FOC and PA offices over 12-month period

4.2. One (1) penetration test for 56 County-managed FOC and PA offices over a 12-month period

5. Project Plan

Original Contract requirements apply for this Section, in addition to the following:

5.1. The Contractor is responsible for complying with all the original Contract Requirements.

5.2. The Contractor must carry out this project under the direction and control of the Program Manager.

5.3. Upon Contract Award: A final project plan must be submitted for final approval within 30 calendar days of the Effective Date.

5.3.1. The plan must also include: (a) the Contractor's organizational chart with names and title of personnel assigned to the project, which must align with the staffing stated in accepted proposals; and (b) the project breakdown showing sub-projects, tasks, and resources required.

5.3.2. Upon contract award, Contractor will provide a final project plan that includes the organizational chart as described above and a project breakdown showing sub-projects, tasks, and resources.

5.3.3. At a high-level Contractor’s project will follow the project plan below.

5.4. Vulnerability Scanning:

5.4.1. Contractor must organize the counties into logical groups based on county size and operational considerations to support efficient project coordination, scheduling, and delivery of vulnerability scanning activities.

5.4.2. The proposed group breakdowns below are preliminary and may be adjusted based on county availability, scheduling needs, and project coordination requirements.

5.4.3. Each county group will undergo vulnerability scanning activities once per quarter throughout the duration of the project.

5.5. Penetration Testing:

The Contractor must perform one external penetration test and one internal penetration test for each of the 56 counties over the course of the 12-month project period.

5.5.1. Testing activities must be scheduled and coordinated based on county availability, project timelines, and resource availability to support efficient statewide delivery and minimize operational disruption.

6. ADA Compliance

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA), including its accessibility standard for websites, applications, content and documents. All Contract Activities created, provided, or made available by Contractor under this Contract in a digital format, including but not limited to, websites, applications, software, mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet) must comply with the accessibility standards provided in the Digital Accessibility Standards, located at SOM Digital Standards.

7. Timeframes

Original Contract requirements apply for this Section, in addition to the following:

https://www.michigan.gov/som/digitalstandards

All Contract Activities must be delivered within thirteen (13) months from receipt of order;

12 months to complete scans, and 1 month to provide statewide report. The receipt of order date is pursuant to the Notices section of the Standard Contract Terms.

8. Delivery

Original Contract requirements apply for this Section, in addition to the following:

Delivery of the required vulnerability scans and penetration tests for the 56 County FOC and PA Offices will be expected within twelve (12) calendar months upon date of order.

Delivery of the one required statewide report will be expected within thirteen (13) months upon the date of order. All deliveries will be made electronically.

9. Training

Original Contract requirements apply for this Section, in addition to the following:

9.1. A benefit of the Contractor’s solution is the established working relationships with stakeholders across each of the participating counties. Most county stakeholders have already utilized the Frontline portal during previous statewide cybersecurity assessment engagements and are familiar with the reporting structure and outputs associated with the scanning services. This existing familiarity supports a more efficient project rollout across the statewide environment.

9.2. Following receipt of the completed Pre-Assessment Questionnaire (PAQ), the Contractor will provide up to one hour of telephone support and training for designated county personnel on the use of the Frontline Cloud suite.

10. Reporting

Original Contract requirements apply for this Section, in addition to the following:

10.1. The Contractor is responsible for complying with all the original Contract Requirements.

10.2. Additionally, the Contractor must submit by email to the Program Manager and/or designee, the following written reports:

10.2.1. One Statewide report summarizing data from the vulnerability scans and the penetration tests.

10.2.2. 56 County-managed vulnerability scan reports categorizing the results as critical, high, moderate and low.

10.2.3. Periodic (weekly or bi-weekly) status reports

10.2.4. Ongoing status reports, and

10.2.5. Quarterly progress reports must be submitted to the OCS and DTMB Project Managers throughout the life of this contract. This report may be submitted with the billing invoice. Each quarterly progress report must contain the following:

10.2.5.1. Overall Program status using the Green/Yellow/Red format including percentage complete, any risks, and issues.

10.2.5.2. Accomplishments: Indicate what was worked on and what was completed during the current reporting period.

10.2.5.3. Next steps and/or activities that are expected to be completed in the next reporting period.

10.3. If this information changes during the contract term, Contractor must provide the updated information within 30 days of the change.

10.4. The Contractor must deliver all reporting requirements through a structured statewide reporting and project governance approach refined through prior cybersecurity assessment engagements supporting the 56 Friend of the Court (FOC) and Prosecuting Attorney (PA) offices currently in scope for this initiative.

10.4.1. The Contractor’s reporting methodology must provide OCS, DTMB, and county stakeholders with visibility into assessment activities, vulnerability findings, remediation priorities, project status, and statewide cybersecurity trends throughout the duration of the contract.

10.5. The Contractor must manage all reporting coordination, communications, and deliverable tracking through a centralized project management approach aligned to the approved Project Management Plan (PMP). This approach is designed to maintain consistent communication across all participating counties while providing OCS and DTMB with ongoing visibility into project progress, risks, issues, and assessment activities.

10.6. Throughout the engagement, Contractor will provide:

10.6.1. Weekly or bi-weekly status reports

10.6.2. Ongoing project and assessment status reporting

10.6.3. Quarterly progress reports submitted to OCS and DTMB Project Managers

10.6.4. Updated reporting information within 30 days should any reporting-related information change during the contract term

10.7. Quarterly progress reports will include:

10.7.1. Overall program status utilizing the Green/Yellow/Red reporting format

10.7.2. Percentage complete for statewide assessment activities

10.7.3. Identification of project risks and issues

10.7.4. Summary of accomplishments completed during the reporting period

10.7.5. Planned next steps and upcoming activities for the following reporting period

10.8. County-Level Reporting

10.8.1. Contractor will provide 56 county-managed vulnerability scan reports categorizing findings by severity level, including:

10.8.1.1. Critical

10.8.1.2. High

10.8.1.3. Moderate

10.8.1.4. Low

10.8.2. County-level reporting will include both executive summary and technical detail reporting designed to provide counties with:

10.8.2.1. Visibility into identified vulnerabilities and associated risk levels

10.8.2.2. Remediation recommendations and supporting technical guidance

10.8.2.3. Detailed findings to support operational remediation planning

10.8.2.4. Ongoing visibility into remediation progress and outstanding risks

10.8.3. Statewide Reporting

The Contractor must develop one statewide summary report consolidating vulnerability scan and penetration testing results across all participating counties. The statewide report must provide OCS and DTMB with visibility into:

10.8.3.1. Statewide cybersecurity trends

10.8.3.2. Common vulnerabilities and recurring findings

10.8.3.3. Overall assessment progress across the counties

10.8.3.4. Remediation progress and areas requiring additional attention

10.8.3.5. Broader cybersecurity improvement opportunities across the FOC and PA environment

10.8.3.6. Because Contractor utilizes consistent assessment and reporting methodology across all counties, the statewide report will provide standardized and comparable data to support statewide oversight, prioritization, and long-term cybersecurity planning.

10.8.4. Reporting Platform and Results Management

Penetration testing and vulnerability scanning activities performed utilizing the secure Frontline Vulnerability Manager™ (Frontline VM) platform to support:

10.8.4.1. Centralized results management

10.8.4.2. Secure county-level data segregation

10.8.4.3. Executive summary and technical detail reporting

10.8.4.4. PDF and CSV report generation

10.8.4.5. Remediation tracking and oversight capabilities

10.8.4.6. Aggregate statewide reporting views

10.8.4.7. Risk-based vulnerability prioritization

10.8.5. The State may request other reports, as it is deemed appropriate.

11. Meetings

Original Contract requirements apply for this Section, in addition to the following:

11.1. The Contractor is responsible for complying with all the original Contract Requirements.

11.2. The Contractor must attend the Kick-off meeting within five (5) business days of the Effective Date.

11.3. Ongoing update meetings will be mutually agreed upon.

11.4. The State may request other meetings, as it deems appropriate.

12. Contractor Program Manager

Original Contract requirements apply for this Section, in addition to the following:

The Contractor must appoint one individual specifically assigned to State of Michigan accounts who will respond to State inquiries regarding the Contract Activities, answer questions related to ordering and delivery, etc. (the “Contractor Program Manager”).

The Contractor must notify the Contract Administrator at least 30 calendar days before removing or assigning a new Contractor Program Manager.

Contractor Program Manager Name: Joe Old

Contractor Program Manager Email: jold@Contractor.com

Contractor Program Manger Phone Number: (810) 625-6873

13. Key Personnel

Original Contract requirements apply for this Section, in addition to the following:

See Attachment C - Contractor Staffing Qualifications and Resumes for requirements related to the key personnel.

14. Non-Key Personnel

Original Contract requirements apply for this Section, in addition to the following:

The Contractor must notify the Contract Administrator at least 15-calendar days before removing or assigning non-key personnel.

15. Disclosure of Subcontractors

15.1. If the Contractor intends to utilize subcontractors, the Contractor must disclose the following:

15.1.1. The legal business name; address; telephone number; a description of subcontractor’s organization and the services it will provide; and information concerning subcontractor’s ability to provide the Contract Activities.

15.1.2. The relationship of the subcontractor to the Contractor.

15.1.3. Of the total bid, the price of the subcontractor’s work.

15.1.4. Whether the Contractor has previous working experience with the subcontractor. If yes, provide the details of that previous relationship.

15.1.5. A complete description of the Contract Activities that will be performed or provided by the subcontractor.

16. Security

The Contractor will be responsible for complying with all the original Contract Requirements.

The Contractor’s staff may be required to make deliveries to or enter State facilities. The Contractor must: (a) explain how it intends to ensure the security of State facilities, (b) whether it uses uniforms and ID badges, etc., (c) identify the company that will perform background checks, and (d) the scope of the background checks. Contractor ensures the security of State facilities by requiring all assigned personnel to comply with State defined security procedures, including the use of State issued or client issued identification badges where required. Personnel are briefed on facility specific security requirements prior to accessing any State facility, and access is limited only to areas necessary to perform assigned duties.

17. Access to Tax Information

Original Contract requirements apply for this Section, in addition to the following:

The Contractor must comply with the requirements of IRS Publication 1075 (including Exhibit 7 Safeguarding Contract Language) and Michigan Department of Treasury Safeguard Requirements of Confidential Tax Data.

18. Price Term

Original Contract requirements apply for this Section, in addition to the following:

Pricing is firm for the entire length of the Contract.

19. Price Changes

Original Contract requirements apply for this Section, in addition to the following:

Adjustments will be based on changes in actual Contractor costs. Any request must be supported by written evidence documenting the change in costs. The State may consider sources, such as the Consumer Price Index; Producer Price Index; other pricing indices as needed; economic and industry data; manufacturer or supplier letters noting the increase in pricing; and any other data the State deems relevant.

Following the presentation of supporting documentation, both parties will have 30 days to review the information and prepare a written response. If the review reveals no need for modifications, pricing will remain unchanged unless mutually agreed to by the parties. If the review reveals that changes are needed, both parties will negotiate such changes, for no longer than 30 days, unless extended by mutual agreement.

The Contractor remains responsible for Contract Activities at the current price for all orders received before the mutual execution of a Change Notice indicating the start date of the new Pricing Period.

20. Authorizing Document

Original Contract requirements apply for this Section, in addition to the following:

The appropriate authorizing document for the Contract will be a delivery order.

21. Invoice Requirements

All invoices submitted to the State must include: (a) date; (b) delivery order number; (c) quantity; (d) description of the Contract Activities; (e) unit price; (f) shipping cost (if any);

(g) vendor-generated invoice number and (h) total price.

22. Payment Methods

The State will make payment for Contract Activities via electronic funds transfer.

23. Procedure

Original Contract requirements apply for this Section, in addition to the following:

As a general policy, monthly invoices must be submitted by email to the MDHHS Program Manager, and the MDHHS Bureau Accounting at MDHHS-CPU@michigan.gov by the 30th day of the following month.

24. Required Functionality Relating to Data Retention, Disposal, and Retrieval

Original Contract requirements apply for this Section, in addition to the following:

24.1. The State has legal obligations to retain, dispose, and retrieve State Data along with obligations to manage and secure State Data. To meet these obligations, the Solution must allow the State to:

24.1.1. retain all data for the entire length of the Contract.

24.1.2. delete its data or request the deletion of its data, even data that may be stored offline or in backups.

24.1.3. transfer its data back to the State or to a new vendor or new solution.

24.1.4. transfer its data to the Archives of Michigan as may be required by a retention and disposal schedule.

24.1.5. retrieve data, even data that may be stored offline or in backups.

24.2. Except as otherwise stated in the Contract, Contractor will not dispose of, delete, or destroy State Data without the prior written approval of the State.

24.3. The Contractor will be responsible for complying with all the original Contract Requirements.

Contractor treats all client data as confidential and owned exclusively by the client. Upon completion or termination of services, Contractor will return client data in the format requested and, following client confirmation, will securely delete any remaining copies in Contractor’s control. Data deletion is performed using industry-accepted methods to ensure the information cannot be recovered.

25. Liquidated Damages

The Contractor is responsible for complying with all the original Contract Requirements.

Schedule A – Attachment 1 – List of County Managed Offices Included in Scope

Small Medium Large Extra Large

Alcona Alpena Allegan Genesee

Antrim Barry Bay Ingham

Benzie Branch Berrien Kent

Cheboygan Cass Calhoun Macomb

Gladwin Clare Eaton Oakland

Iosco Clinton Jackson Ottawa

Kalkaska Emmet Kalamazoo Washtenaw

Leelanau Grand Traverse Lenawee Wayne

Manistee Gratiot Livingston

Menominee Ionia Monroe

Oscoda Isabella Muskegon

Otsego Lapeer Saginaw

Presque Isle Marquette St. Clair

Mason

Midland

Montcalm

Newaygo

Sanilac

Shiawassee

St. Joseph

Tuscola

Van Buren

Contractor LLC.

DS 26-0022 MDHHS OCS County Office Cyber Security Assessments 16 of 30

Schedule A – Attachment 2 – Contractor Staffing Qualifications and Resumes – Key Personnel

26. Key Personnel -

26.1. The Contractor must appoint a Technical Testing Lead, an Account Executive/Engagement Manager and Cybersecurity Expert individuals who will be directly responsible for the day-to-day operations of the Contract (“Key Personnel”). Key Personnel must be specifically assigned to the State account, be knowledgeable on the contractual requirements, and respond to State inquiries within 48 hours.

26.2. The State has the right to recommend and approve in writing the initial assignment, as well as any proposed reassignment or replacement, of any Key Personnel. Before assigning an individual to any Key Personnel position, Contractor will notify the State of the proposed assignment, introduce the individual to the State’s Project Manager, and provide the State with a resume and any other information about the individual reasonably requested by the State. The State reserves the right to interview the individual before granting written approval. In the event the State finds a proposed individual unacceptable, the State will provide a written explanation including reasonable detail outlining the reasons for the rejection. The State may require a 30-calendar day training period for replacement personnel.

26.3. Contractor will not remove any Key Personnel from their assigned roles on this Contract without the prior written consent of the State. The Contractor’s removal of Key Personnel without the prior written consent of the State is an unauthorized removal (“Unauthorized Removal”). An Unauthorized Removal does not include replacing Key Personnel for reasons beyond the reasonable control of Contractor, including illness, disability, leave of absence, personal emergency circumstances, resignation, or for cause termination of the Key Personnel’s employment. Any Unauthorized Removal may be considered by the State to be a material breach of this Contract, in respect of which the State may elect to terminate this Contract for cause under the Termination for Cause section of the Standard Contract Terms. It is further acknowledged that an Unauthorized Removal will interfere with the timely and proper completion of this Contract, to the loss and damage of the State, and that it would be impracticable and extremely difficult to fix the actual damage sustained by the State as a result of any Unauthorized Removal. Therefore, Contractor and the State agree that in the case of any Unauthorized Removal in respect of which the State does not elect to exercise its rights under Termination for Cause, Contractor will issue to the State the corresponding credits set forth below (each, an “Unauthorized Removal Credit”):

26.4. For the Unauthorized Removal of any Key Personnel designated in the applicable Statement of Work, the credit amount will be $25,000 per individual if Contractor identifies a replacement approved by the State and assigns the replacement to shadow the Key Personnel who is leaving for a period of at least 30-calendar days before the Key Personnel’s removal.

26.5. If Contractor fails to assign a replacement to shadow the removed Key Personnel for at least 30-calendar days, in addition to the $25,000.00 credit specified above, Contractor will credit the State $833.33 per calendar day for each day of the 30-calendar day shadow period that the replacement Key Personnel does not shadow the removed Key Personnel, up to

Contractor LLC.

DS 26-0022 MDHHS OCS County Office Cyber Security Assessments 17 of 30

$25,000 maximum per individual. The total Unauthorized Removal Credits that may be assessed per Unauthorized Removal and failure to provide 30-calendar days of shadowing will not exceed $50,000 per individual.

26.6. Contractor acknowledges and agrees that each of the Unauthorized Removal Credits assessed above: (i) is a reasonable estimate of and compensation for the anticipated or actual harm to the State that may arise from the Unauthorized Removal, which would be impossible or very difficult to accurately estimate; and (ii) may, at the State’s option, be credited or set off against any fees or other charges payable to Contractor under this Contract.

26.7. The Contractor must identify the Key Personnel, indicate where they will be physically located, describe the functions they will perform, and provide current chronological résumés.

26.8. Qualifications will be measured by education and experience with particular reference to experience on projects similar to that described in the DS.

210000002458

27. Contractor Staffing Qualifications

27.1. Account Executive / Engagement Manger

27.2. Cybersecurity Expert

27.3. Technical Testing Lead

Proposed Classification: 2.1 Account Executive / Engagement Manager

Proposed Resource Name: Joe Old

Location: Michigan

Key Personnel (YES/NO): YES

Proposed Classification: 2.2 Cybersecurity Expert

Proposed Resource Name: Ernesto Cuevas

Location: Michigan/Indiana

Key Personnel (YES/NO): YES

Proposed Classification: 2.3 Technical Testing Lead

Proposed Resource Name: Kyle Jackson

Location: Michigan

Key Personnel (YES/NO): YES

MA 21-301 MDHHS OCS County Office Cyber Security Assessments 19 of 30

SCHEDULE A - ATTACHMENT 3 – 56 SAFEGUARDS/ SUB-CONTROLS FROM

CONTROLS V8 PLUS 8 CONTROLS ADDED FROM OSCE REQUIREMENTS

Please See Attached PDF

Schedule B – Pricing Contract MA 210000000301

Independent Information Technology Security Assessments, for county-managed Friend of the Court and Prosecuting Attorney offices

Original Contract requirements apply for this Section in addition to the following:

Contractor must not exceed the rates identified in their Original Contract Schedule B – Pricing to provide a lump sum fixed price not-to-exceed amount for this tier-two SOW project.

1. Price includes all costs, including but not limited to, any one-time or set-up charges, fees, and potential costs that Contractor may charge the State (e.g., shipping and handling, per piece pricing, and palletizing).

2. The Contractor is encouraged to offer quick payment terms. The number of days must not include processing time for payment to be received by the Contractor's financial institution.

Quick payment terms: As stated on the original Contract

3. By submitting its proposal, the Contractor certifies that the prices were arrived at independently, and without consultation, communication, or agreement with any other Contractor.

Table 1: Pricing for County-Level Infrastructure Vulnerability Scans

Required Services Small Entity Medium Entity Large Entity X-Large Entity

Price per one (1) County-Level Infrastructure Vulnerability Scans

$1,123.00 $1,123.00 $1,123.00 $1,123.00

Number of Entities 13 22 13 8

Number of Scans 4 4 4 4

Total $58,396.00 $98,824.00 $58,396.00 $35,936.00

Grand total of Table 1 $252,092.00

Table 2: Pricing for County-Level Penetration Test

Required Optional Service Offerings from Schedule B in MIDEAL Contract

Small Entity

Medium Entity

Large Entity X-Large Entity

Price per One (1) Penetration Test for each of 56 Counties

$3,120.00 $3,121.00 $3,122.00 $3,123.00

Number of Entities 13 22 13 8

Total IPs (External)* 39 66 39 24

Total IPs (Internal)* 724 1126 724 446

Total $40,560.00 $68,662.00 $40,586.00 $24,984.00

Grand Total of Table 2 $174,792.00

*Contractor has based pricing for penetration testing services on the estimated external and internal IP counts identified above (168 total external IPs and 3,120 total internal IPs). Should the total number of internal or external IP addresses exceed these estimated volumes, Dewpoint will work collaboratively with the State to review the scope and ensure pricing appropriately reflects the increased volume of testing activities.

Final Total (total of Table 1 & 2) $426,884.00

CN 11 – EGLE – REMEDIATION

ADVISORY SERVICES

Following completion of the CIS Controls‑based cybersecurity assessment, the Contractor will provide targeted remediation advisory services and practical technology consulting to assist the EGLE in evaluating, prioritizing, and addressing identified improvement areas.

These services are intended to support EGLE in transitioning from assessment results to actionable remediation planning and, if requested, implementation services.

The advisory and/or implementation services described in this section are not included within the scope of the cybersecurity assessment engagement. Each remediation effort will be scoped, costed, and delivered as a separate project through individually authorized Statements of Work.

The Contractor may provide guidance related to remediation prioritization, sequencing of activities, technical approaches, and implementation considerations. The Client may choose to complete remediation activities using its internal staff, the Contractor, or other qualified third‑party resources.

Typical remediation advisory and implementation areas may include, but are not limited to, the following:

1. Audit Logging and Monitoring – Enhancing audit log collection, retention processes, and centralized monitoring to improve visibility into security events and support timely detection and response.

2. Asset and Software Inventory Management – Establishing and maintaining accurate inventories of authorized hardware and software to support lifecycle management and reduce unmanaged security risk.

3. Incident Response Planning and Testing – Developing, formalizing, and exercising incident response plans to strengthen preparedness and ensure coordinated response to cybersecurity incidents.

4. Identity and Access Management – Strengthening account lifecycle management, password policies, and privileged access controls to reduce unauthorized access risk.

5. Multi‑Factor Authentication (MFA) – Implementing MFA for remote access, administrative accounts, and other high‑risk access points.

6. Data Protection and Recovery – Enhancing backup strategies, retention policies, and recovery testing processes to ensure operational resilience.

7. Security Awareness and Training – Delivering user‑focused security awareness training to address human‑related risks and reinforce secure behaviors.

8. Vulnerability Management and Patching – Establishing processes for identifying, prioritizing, and remediating vulnerabilities, including maintaining current patch levels across systems.

9. Secure Configuration Management – Defining and enforcing baseline configurations across systems and devices to minimize exposure to mis_configurations.

10. Email Security and DNS Filtering – Improving protections against phishing, malware, and other threats through enhanced email filtering and DNS security controls.

The Contractor will provide guidance regarding prioritization and sequencing of remediation activities to ensure alignment with the Client’s risk profile, operational capacity, and technical environment. Specific remediation scopes, timelines, implementation approaches, and pricing will be documented in individual remediation Statements of Work executed at the Client’s request.

320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 1 Year January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

DEWPOINT INC

C O

N

TR

A C

TO

R

Emily Massa

(517) 897-7321

DTMB

Various Various massae@michigan.gov

C on tr ac t A dm in is tr at or

Pr og ra m

M an ag er

ST

A

TE

N/ANet 45

Change Notice Number 10

Contract Number MA210000000301 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

5 Years

$3,296,695.99 $0.00 $3,296,695.99

January 10th, 2031

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective November 24th, 2025, all five option years available on this contract are hereby exercised. The revised contract expiration date is January 24, 2031.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

AGENCY NAME PHONE EMAIL

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

MDHHS PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 10 TO CONTRACT NO. MA210000000301

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 1 Year January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

DEWPOINT INC

C O

N

TR

A C

TO

R

Emily Massa

517-897-7321

DTMB

Va…