STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to

Contract Number MA220000000121

C O

N

TR

AC

TO

R

Citrin Cooperman Advisors LLC

50 Rockefeller Plaza

New York NY 10020

Joseph Lesovitz

267-479-0060 jlesovitz@citrincooperman.com

VS0206933

ST

AT

E

Pr og ra m

M an ag er

Jordan Sherlock DTMB

SherlockJ@michigan.gov

C on tr ac t Ad m in is tr at or Colleen West DTMB

517-730-8430 westc6@michigan.gov

CONTRACT SUMMARY

SW Financial Auditing and Accounting Prequal Program

INITIAL EFFECTIVE DATE

November 1, 2021

INITIAL EXPIRATION DATE

October 31, 2024

INITIAL AVAILABLE OPTIONS

3 - 1 Year

EXPIRATION DATE BEFORE

October 31, 2027

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

N/A

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$25.00

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$25.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective March 23, 2026, this Contract is amended to reflect updated accessibility requirements. All prior references to ADA, Accessibility, and/or WCAG 2.0 are replaced and superseded with the following language

Accessibility Requirements:

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites, applications, content, and electronic documents. Due to a change in the law, the State is required to comply with specific accessibility standards for websites, applications, content and documents.

Starting 04/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level AA.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

SW Financial Auditing and Accounting Prequal Program

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

November 1, 2021 October 31, 2024 3 - 12 Months October 31, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

50 Rockefeller Plaza

New York NY 10020

Joseph Lesovitz

267-479-0060 jlesovitz@citrincooperman.com

VS0206933

Citrin Cooperman & Company LLP

C O

N

TR

A C

TO

R

Susan Watt-Smith

517-230-0535

DTMB

Various SW wattsmiths@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 1

Contract Number MA220000000121 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

36 Months October 31, 2027

$25.00 $0.00 $25.00

DESCRIPTION

Effective October 14, 2024, the 3 option years available on this contract are hereby exercised. The revised contract expiration date is October 31, 2027.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

NOTICE OF CONTRACT

NOTICE OF CONTRACT NO. 220000000121 .

between

THE STATE OF MICHIGAN

and

C O

N T

R A

C T

O R

Citrin Cooperman Advisors LLC

S T

A T

E P ro g ra m

M a n a g e r

Various SW

50 Rockefeller Plaza

New York, NY 10020

Joseph Lesovitz

C o n tr a c t

A d m in is tr a to r

Marissa Gove DTMB

267-479-0060 517-449-8952 jlesovitz@citrincooperman.com Govem1@michigan.gov

VS0206933

CONTRACT SUMMARY

DESCRIPTION:SW Financial Auditing and Accounting Prequal Program

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE

INITIAL AVAILABLE

OPTIONS

EXPIRATION DATE BEFORE

CHANGE(S) NOTED BELOW

11/1/2021 10/31/2024 3-1 year

PAYMENT TERMS DELIVERY TIMEFRAME

Net 45 N/A

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-card ☐ Payment Request (PRC) ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

N/A

MISCELLANEOUS INFORMATION

THIS IS NOT AN ORDER: This Contract Agreement is awarded on the basis of our inquiry bearing the solicitation 210000002247. Payments will be issued directly by the agency requiring services associated with specific SOWs.

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION $0

STATE OF MICHIGAN PROCUREMENT

Department of Technology, Management, and Budget – Central Procurement Services

525 W Allegan St, Lansing, MI 48933 P.O. Box 30026, Lansing, MI 49809

Version 2021-2 Page 2 of 41

CONTRACT NO. 220000000121

FOR THE CONTRACTOR:

Company Name

Authorized Agent Signature

Authorized Agent (Print or Type)

Date

FOR THE STATE:

Signature

Name & Title

Agency

Date

Mich igan.gov/MiProcure ment

Version 2021-2 Page 3 of 41

STANDARD CONTRACT TERMS

This STANDARD CONTRACT (“Contract”) is agreed to between the State of Michigan (the “State”) and Citrin Cooperman Advisors LLC (“Contractor”), a New York limited liability company. This Contract is effective on November 1, 2021 (“Effective Date”), and unless terminated, expires on October 31, 2024.

This Contract may be renewed for up to two (2) additional one (1) year period(s).

Renewal is at the sole discretion of the State and will automatically extend the Term of this Contract. The State will document its exercise of renewal options via Contract Change Notice.

The parties agree as follows:

Duties of Contractor. Contractor must perform the services and provide the deliverables described in Schedule A – Statement of Work (the “Contract Activities”). An obligation to provide delivery of any commodity is considered a service and is a Contract Activity.

Contractor must furnish all labor, equipment, materials, and supplies necessary for the performance of the Contract Activities, and meet operational standards, unless otherwise specified in Schedule A.

Contractor must: (a) perform the Contract Activities in a timely, professional, safe, and workmanlike manner consistent with standards in the trade, profession, or industry; (b) meet or exceed the performance and operational standards, and specifications of the Contract; (c) provide all Contract Activities in good quality, with no material defects; (d) not interfere with the State’s operations; (e) obtain and maintain all necessary licenses, permits or other authorizations necessary for the performance of the Contract; (f) cooperate with the State, including the State’s quality assurance personnel, and any third party to achieve the objectives of the Contract;

(g) return to the State any State-furnished equipment or other resources in the same condition as when provided when no longer required for the Contract; (h) not make any media releases without prior written authorization from the State; (i) assign to the State any claims resulting from state or federal antitrust violations to the extent that those violations concern materials or services supplied by third parties toward fulfillment of the Contract; (j) comply with all State physical and IT security policies and standards which will be made available upon request; and (k) provide the State priority in performance of the Contract except as mandated by federal disaster response requirements. Any breach under this paragraph is considered a material breach.

Contractor must also be clearly identifiable while on State property by wearing identification issued by the State, and clearly identify themselves whenever making contact with the State.

Notices. All notices and other communications required or permitted under this Contract must be in writing and will be considered given and received: (a) when verified by written receipt if sent by courier; (b) when actually received if sent by mail without verification of receipt; or (c) when verified by automated receipt or electronic logs if sent by facsimile or email.

Version 2021-2 Page 4 of 41

If to State: If to Contractor:

Marissa Gove 525 W Allegan St Lansing, MI 48933 Govem1@michigan.gov 517-449-8952

Joseph W. Lesovitz 1800 John F. Kennedy Blvd Philadelphia, PA 19103 jlesovitz@citrincooperman.com 267-479-0060

Contract Administrator. The Contract Administrator for each party is the only person authorized to modify any terms of this Contract, and approve and execute any change under this Contract (each a “Contract Administrator”):

State: Contractor:

Marissa Gove 525 W Allegan St Lansing, MI 48933 Govem1@michigan.gov 517-449-8952

Joseph W. Lesovitz 1800 John F. Kennedy Blvd Philadelphia, PA 19103 jlesovitz@citrincooperman.com 267-479-0060

Program Manager. The Program Manager for each party will monitor and coordinate the day-to-day activities of the Contract (each a “Program Manager”):

State: Contractor:

Various by Tier 2 requirements. List will be provided as needs arise.

Joseph W. Lesovitz 1800 John F. Kennedy Blvd Philadelphia, PA 19103 jlesovitz@citrincooperman.com 267-479-0060

Performance Guarantee. Contractor must at all times have financial resources sufficient, in the opinion of the State, to ensure performance of the Contract and must provide proof upon request. The State may require a performance bond (as specified in Schedule A – Statement of Work) if, in the opinion of the State, it will ensure performance of the Contract.

Insurance Requirements. Contractor, at its sole expense, must maintain the insurance coverage identified below. All required insurance must: (a) protect the State from claims that may arise out of, are alleged to arise out of, or otherwise result from Contractor's or a subcontractor's performance; (b) be primary and non-contributing to any comparable liability insurance (including self-insurance) carried by the State; and (c) be provided by a company with an A.M. Best rating of "A-" or better, and a financial size of VII or better.

Required Limits Additional Requirements

Commercial General Liability Insurance

Minimum Limits:

$1,000,000 Each Occurrence $1,000,000 Personal & Advertising Injury $2,000,000 Products/Completed Operations $2,000,000 General Aggregate

Contractor must have their policy endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds using endorsement CG 20 10 11 85, or both CG 20 10 12 19 and CG 20 37 12 19

Version 2021-2 Page 5 of 41

Required Limits Additional Requirements

Automobile Liability Insurance

If a motor vehicle is used in relation to the Contractor's performance, the Contractor must have vehicle liability insurance on the motor vehicle for bodily injury and property damage as required by law.

Workers' Compensation Insurance

Minimum Limits:

Coverage according to applicable laws governing work activities.

Waiver of subrogation, except where waiver is prohibited by law.

Employers Liability Insurance

Minimum Limits:

$500,000 Each Accident $500,000 Each Employee by Disease $500,000 Aggregate Disease

Privacy and Security Liability (Cyber Liability) Insurance

Minimum Limits:

$1,000,000 Each Occurrence $1,000,000 Annual Aggregate

Contractor must have their policy cover information security and privacy liability, privacy notification costs, regulatory defense and penalties, and website media content liability.

Crime (Fidelity) Insurance

Minimum Limits:

$1,000,000 Employee Theft Per Loss

Contractor must have their policy: (1) cover forgery and alteration, theft of money and securities, robbery and safe burglary, computer fraud, funds transfer fraud, money order and counterfeit currency, and (2) endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as Loss Payees.

Professional Liability (Errors and Omissions) Insurance

Minimum Limits:

$3,000,000 Each Occurrence $3,000,000 Annual Aggregate

If any of the required policies provide claims-made coverage, the Contractor must:

(a) provide coverage with a retroactive date before the Effective Date of the Contract or the beginning of Contract Activities; (b) maintain coverage and provide evidence of coverage for at least three (3) years after completion of the Contract Activities; and

(c) if coverage is cancelled or not renewed, and not replaced with another claims-made policy form with a retroactive date prior to the Contract Effective Date, Contractor must purchase extended reporting coverage for a minimum of three (3) years after completion of work.

Contractor must: (a) provide insurance certificates to the Contract Administrator, containing the agreement or delivery order number, at Contract formation and within twenty (20) calendar days of the expiration date of the applicable policies; (b) require that subcontractors maintain the required insurance contained in this Section; (c)

Version 2021-2 Page 6 of 41 notify the Contract Administrator within five (5) business days if any insurance is cancelled; and (d) waive all rights against the State for damages covered by insurance. Failure to maintain the required insurance does not limit this waiver.

This Section is not intended to and is not to be construed in any manner as waiving, restricting or limiting the liability of either party for any obligations under this Contract (including any provisions hereof requiring Contractor to indemnify, defend and hold harmless the State).

Administrative Fee and Reporting. Contractor must pay an administrative fee of 0.75% on all payments made to Contractor under the Contract including transactions with the State (including its departments, divisions, agencies, offices, and commissions), MiDEAL members, and other states (including governmental subdivisions and authorized entities). Administrative fee payments must be made online by check or credit card at: https://www.thepayplace.com/mi/dtmb/adminfee

Contractor must submit an itemized purchasing activity report, which includes at a minimum, the name of the purchasing entity and the total dollar volume in sales.

Reports should be mailed to MiDeal@michigan.gov.

The administrative fee and purchasing activity report are due within 30 calendar days from the last day of each calendar quarter.

Extended Purchasing Program. This contract is extended to MiDEAL members.

MiDEAL members include local units of government, school districts, universities, community colleges, and nonprofit hospitals. A current list of MiDEAL members is available at www.michigan.gov/mideal.

Upon written agreement between the State and Contractor, this contract may also be extended to: (a) other states (including governmental subdivisions and authorized entities) and (b) State of Michigan employees.

If extended, Contractor must supply all Contract Activities at the established Contract prices and terms. The State reserves the right to impose an administrative fee and negotiate additional discounts based on any increased volume generated by such extensions.

Contractor must submit invoices to, and receive payment from, extended purchasing program members on a direct and individual basis.

Independent Contractor. Contractor is an independent contractor and assumes all rights, obligations and liabilities set forth in this Contract. Contractor, its employees, and agents will not be considered employees of the State. No partnership or joint venture relationship is created by virtue of this Contract. Contractor, and not the State, is responsible for the payment of wages, benefits and taxes of Contractor’s employees and any subcontractors. Prior performance does not modify Contractor’s status as an independent contractor.

Subcontracting. Contractor may not delegate any of its obligations under the Contract without the prior written approval of the State. Contractor must notify the State at least 90 calendar days before the proposed delegation and provide the State any information it requests to determine whether the delegation is in its best interest.

If approved, Contractor must: (a) be the sole point of contact regarding all contractual https://www.thepayplace.com/mi/dtmb/adminfee http://www.michigan.gov/mideal

Version 2021-2 Page 7 of 41 matters, including payment and charges for all Contract Activities; (b) make all payments to the subcontractor; and (c) incorporate the terms and conditions contained in this Contract in any subcontract with a subcontractor. Contractor remains responsible for the completion of the Contract Activities, compliance with the terms of this Contract, and the acts and omissions of the subcontractor. The State, in its sole discretion, may require the replacement of any subcontractor.

Staffing. The State’s Contract Administrator may require Contractor to remove or reassign personnel by providing a notice to Contractor.

Background Checks. Pursuant to Michigan law, all agencies subject to IRS Pub.

1075 are required to ask the Michigan State Police to perform fingerprint background checks on all employees, including Contractor and Subcontractor employees, who may have access to any database of information maintained by the federal government that contains confidential or personal information, including, but not limited to, federal tax information. Further, pursuant to Michigan law, any agency described above is prohibited from providing Contractors or Subcontractors with the result of such background check. For more information, please see Michigan Public Act 427 of 2018. Upon request, or as may be specified in Schedule A, Contractor must perform background checks on all employees and subcontractors and its employees prior to their assignment. The scope is at the discretion of the State and documentation must be provided as requested. Contractor is responsible for all costs associated with the requested background checks. The State, in its sole discretion, may also perform background checks.

Assignment. Contractor may not assign this Contract to any other party without the prior approval of the State. Upon notice to Contractor, the State, in its sole discretion, may assign in whole or in part, its rights or responsibilities under this Contract to any other party. If the State determines that a novation of the Contract to a third party is necessary, Contractor will agree to the novation and provide all necessary documentation and signatures.

Change of Control. Contractor will notify within 30 days of any public announcement or otherwise once legally permitted to do so, the State of a change in Contractor’s organizational structure or ownership. For purposes of this Contract, a change in control means any of the following: (a) a sale of more than 50% of Contractor’s stock;

(b) a sale of substantially all of Contractor’s assets; (c) a change in a majority of Contractor’s board members; (d) consummation of a merger or consolidation of Contractor with any other entity; (e) a change in ownership through a transaction or series of transactions; (f) or the board (or the stockholders) approves a plan of complete liquidation. A change of control does not include any consolidation or merger effected exclusively to change the domicile of Contractor, or any transaction or series of transactions principally for bona fide equity financing purposes.

In the event of a change of control, Contractor must require the successor to assume this Contract and all of its obligations under this Contract.

Ordering. Contractor is not authorized to begin performance until receipt of authorization as identified in Schedule A.

Version 2021-2 Page 8 of 41

Acceptance. Contract Activities are subject to inspection and testing by the State within 30 calendar days of the State’s receipt of them (“State Review Period”), unless otherwise provided in Schedule A. If the Contract Activities are not fully accepted by the State, the State will notify Contractor by the end of the State Review Period that either: (a) the Contract Activities are accepted but noted deficiencies must be corrected; or (b) the Contract Activities are rejected. If the State finds material deficiencies, it may: (i) reject the Contract Activities without performing any further inspections; (ii) demand performance at no additional cost; or (iii) terminate this Contract in accordance with Section 23, Termination for Cause.

Within 10 business days from the date of Contractor’s receipt of notification of acceptance with deficiencies or rejection of any Contract Activities, Contractor must cure, at no additional cost, the deficiency and deliver unequivocally acceptable Contract Activities to the State. If acceptance with deficiencies or rejection of the Contract Activities impacts the content or delivery of other non-completed Contract Activities, the parties’ respective Program Managers must determine an agreed to number of days for re-submission that minimizes the overall impact to the Contract.

However, nothing herein affects, alters, or relieves Contractor of its obligations to correct deficiencies in accordance with the time response standards set forth in this Contract.

If Contractor is unable or refuses to correct the deficiency within the time response standards set forth in this Contract, the State may cancel the order in whole or in part. The State, or a third party identified by the State, may perform the Contract Activities and recover the difference between the cost to cure and the Contract price plus an additional 10% administrative fee.

Reserve.

Reserve.

Reserve.

Terms of Payment. Invoices must conform to the requirements communicated from time-to-time by the State. All undisputed amounts are payable within 45 days of the State’s receipt. Contractor may only charge for Contract Activities performed as specified in Schedule A. Invoices must include an itemized statement of all charges.

The State is exempt from State sales tax for direct purchases and may be exempt from federal excise tax, if Services purchased under this Agreement are for the State’s exclusive use. All prices are exclusive of taxes, and Contractor is responsible for all sales, use and excise taxes, and any other similar taxes, duties and charges of any kind imposed by any federal, state, or local governmental entity on any amounts payable by the State under this Contract.

The State has the right to withhold payment of any disputed amounts until the parties agree as to the validity of the disputed amount. The State will notify Contractor of any dispute within a reasonable time. Payment by the State will not constitute a waiver of any rights as to Contractor’s continuing obligations, including claims for deficiencies or substandard Contract Activities. Contractor’s acceptance of final payment by the State constitutes a waiver of all claims by Contractor against the State for payment

Version 2021-2 Page 9 of 41 under this Contract, other than those claims previously filed in writing on a timely basis and still disputed.

The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT). Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment.

Without prejudice to any other right or remedy it may have, the State reserves the right to set off at any time any amount then due and owing to it by Contractor against any amount payable by the State to Contractor under this Contract.

Liquidated Damages. Liquidated damages, if applicable, will be assessed as described in Schedule A.

Stop Work Order. The State may suspend any or all activities under the Contract at any time. The State will provide Contractor a written stop work order detailing the suspension. Contractor must comply with the stop work order upon receipt. Within 90 calendar days, or any longer period agreed to by Contractor, the State will either: (a) issue a notice authorizing Contractor to resume work, or (b) terminate the Contract or delivery order. The State will not pay for Contract Activities, Contractor’s lost profits, or any additional compensation during a stop work period.

Termination for Cause. The State may terminate this Contract for cause, in whole or in part, if Contractor, as determined by the State: (a) endangers the value, integrity, or security of any location, data, or personnel; (b) becomes insolvent, petitions for bankruptcy court proceedings, or has an involuntary bankruptcy proceeding filed against it by any creditor; (c) engages in any conduct that may expose the State to liability; (d) breaches any of its material duties or obligations; or (e) fails to cure a breach within the time stated in a notice of breach. Any reference to specific breaches being material breaches within this Contract will not be construed to mean that other breaches are not material.

If the State terminates this Contract under this Section, the State will issue a termination notice specifying whether Contractor must: (a) cease performance immediately, or (b) continue to perform for a specified period. If it is later determined that Contractor was not in breach of the Contract, the termination will be deemed to have been a Termination for Convenience, effective as of the same date, and the rights and obligations of the parties will be limited to those provided in Section 24, Termination for Convenience.

The State will only pay for amounts due to Contractor for Contract Activities accepted by the State on or before the date of termination, subject to the State’s right to set off any amounts owed by the Contractor for the State’s reasonable costs in terminating this Contract. The Contractor must pay all reasonable costs incurred by the State in terminating this Contract for cause, including administrative costs, attorneys’ fees, court costs, transition costs, and any costs the State incurs to procure the Contract Activities from other sources.

Termination for Convenience. The State may immediately terminate this Contract in whole or in part without penalty and for any reason, including but not limited to, appropriation or budget shortfalls. The termination notice will specify whether http://www.michigan.gov/SIGMAVSS

Version 2021-2 Page 10 of 41

Contractor must: (a) cease performance of the Contract Activities immediately, or (b) continue to perform the Contract Activities in accordance with Section 25, Transition Responsibilities. If the State terminates this Contract for convenience, the State will pay all reasonable costs, as determined by the State, for State approved Transition Responsibilities.

Transition Responsibilities. Upon termination or expiration of this Contract for any reason, Contractor must, for a period of time specified by the State (not to exceed 90 calendar days), provide all reasonable transition assistance requested by the State, to allow for the expired or terminated portion of the Contract Activities to continue without interruption or adverse effect, and to facilitate the orderly transfer of such Contract Activities to the State or its designees. Such transition assistance may include, but is not limited to: (a) continuing to perform the Contract Activities at the established Contract rates; (b) taking all reasonable and necessary measures to transition performance of the work, including all applicable Contract Activities, training, equipment, software, leases, reports and other documentation, to the State or the State’s designee; (c) taking all necessary and appropriate steps, or such other action as the State may direct, to preserve, maintain, protect, or return to the State all materials, data, property, and confidential information provided directly or indirectly to Contractor by any entity, agent, vendor, or employee of the State; (d) transferring title in and delivering to the State, at the State’s discretion, all completed or partially completed deliverables prepared under this Contract as of the Contract termination date; and (e) preparing an accurate accounting from which the State and Contractor may reconcile all outstanding accounts (collectively, “Transition Responsibilities”).

This Contract will automatically be extended through the end of the transition period.

General Indemnification. Contractor must defend, indemnify and hold the State, its departments, divisions, agencies, offices, commissions, officers, and employees harmless, without limitation, from and against any and all actions, claims, losses, liabilities, damages, costs, attorney fees, and expenses (including those required to establish the right to indemnification), arising out of or relating to: (a) any breach by Contractor (or any of Contractor’s employees, agents, subcontractors, or by anyone else for whose acts any of them may be liable) of any of the promises, agreements, representations, warranties, or insurance requirements contained in this Contract; (b) any infringement, misappropriation, or other violation of any intellectual property right or other right of any third party; (c) any bodily injury, death, or damage to real or tangible personal property occurring wholly or in part due to action or inaction by Contractor (or any of Contractor’s employees, agents, subcontractors, or by anyone else for whose acts any of them may be liable); and (d) any acts or omissions of Contractor (or any of Contractor’s employees, agents, subcontractors, or by anyone else for whose acts any of them may be liable).

The State will notify Contractor in writing if indemnification is sought; however, failure to do so will not relieve Contractor, except to the extent that Contractor is materially prejudiced. Contractor must, to the satisfaction of the State, demonstrate its financial ability to carry out these obligations.

The State is entitled to: (i) regular updates on proceeding status; (ii) participate in the defense of the proceeding; (iii) employ its own counsel; and to (iv) retain control of

Version 2021-2 Page 11 of 41 the defense if the State deems necessary. Contractor will not, without the State’s written consent (not to be unreasonably withheld), settle, compromise, or consent to the entry of any judgment in or otherwise seek to terminate any claim, action, or proceeding. To the extent that any State employee, official, or law may be involved or challenged, the State may, at its own expense, control the defense of that portion of the claim.

Any litigation activity on behalf of the State, or any of its subdivisions under this Section, must be coordinated with the Department of Attorney General. An attorney designated to represent the State may not do so until approved by the Michigan Attorney General and appointed as a Special Assistant Attorney General.

Infringement Remedies. If, in either party’s opinion, any piece of equipment, software, commodity, or service supplied by Contractor or its subcontractors, or its operation, use or reproduction, is likely to become the subject of a copyright, patent, trademark, or trade secret infringement claim, Contractor must, at its expense: (a) procure for the State the right to continue using the equipment, software, commodity, or service, or if this option is not reasonably available to Contractor, (b) replace or modify the same so that it becomes non-infringing; or (c) accept its return by the State with appropriate credits to the State against Contractor’s charges and reimburse the State for any losses or costs incurred as a consequence of the State ceasing its use and returning it.

Limitation of Liability and Disclaimer of Damages. IN NO EVENT WILL THE

STATE’S AGGREGATE LIABILITY TO CONTRACTOR UNDER THIS CONTRACT,

REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT,

NEGLIGENCE, STRICT LIABILITY OR BY STATUTE OR OTHERWISE, FOR ANY

CLAIM RELATED TO OR ARISING UNDER THIS CONTRACT, EXCEED THE

MAXIMUM AMOUNT OF FEES PAYABLE UNDER THIS CONTRACT. The State is not liable for consequential, incidental, indirect, or special damages, regardless of the nature of the action.

Disclosure of Litigation, or Other Proceeding. Contractor must notify the State within 14 calendar days of receiving notice of any litigation, investigation, arbitration, or other proceeding (collectively, “Proceeding”) involving Contractor, a subcontractor, or an officer or director of Contractor or subcontractor, that arises during the term of the Contract, including: (a) a criminal Proceeding; (b) a parole or probation Proceeding; (c) a Proceeding under the Sarbanes-Oxley Act; (d) a civil Proceeding involving: (1) a claim that might reasonably be expected to adversely affect Contractor’s viability or financial stability; or (2) a governmental or public entity’s claim or written allegation of fraud; or (e) a Proceeding involving any license that Contractor is required to possess in order to perform under this Contract.

Reserved.

State Data.

a. Ownership. The State’s data (“State Data,” which will be treated by Contractor as Confidential Information) includes: (a) the State’s data collected, used, processed, stored, or generated as the result of the Contract Activities; (b) personally identifiable information (“PII“) collected, used, processed, stored, or

Version 2021-2 Page 12 of 41 generated as the result of the Contract Activities, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed; and, (c) personal health information (“PHI”) collected, used, processed, stored, or generated as the result of the Contract Activities, which is defined under the Health Insurance Portability and Accountability Act (HIPAA) and its related rules and regulations. State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State. This Section survives the termination of this Contract.

b. Contractor Use of State Data. Contractor is provided a limited license to State Data for the sole and exclusive purpose of providing the Contract Activities, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Contract Activities. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Contract Activities, such use and disclosure being in accordance with this Contract, any applicable Statement of Work, and applicable law; and (c) not use, sell, rent, transfer, distribute, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent. This Section survives the termination of this Contract.

c. Extraction of State Data. Contractor must, within five (5) business days of the State’s request, provide the State, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Contractor), an extract of the State Data in the format specified by the State.

d. Backup and Recovery of State Data. Unless otherwise specified in Schedule A, Contractor is responsible for maintaining a backup of State Data and for an orderly and timely recovery of such data. Unless otherwise described in Schedule A, Contractor must maintain a contemporaneous backup of State Data that can be recovered within two (2) hours at any point in time.

e. Loss or Compromise of Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable: (a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence; (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the

Version 2021-2 Page 13 of 41

State; (c) in the case of PII or PHI, at the State’s sole election, (i) with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within five (5) calendar days of the occurrence; or (ii) reimburse the State for any costs in notifying the affected individuals; (d) in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twenty-four (24) months following the date of notification to such individuals; (e) perform or take any other actions required to comply with applicable law as a result of the occurrence; (f) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution; (g) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence; (h) be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State; and (i) provide to the State a detailed plan within ten (10) calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum: name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery.

Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination.

The parties agree that any damages relating to a breach of this Section 31 are to be considered direct damages and not consequential damages. This section survives termination or expiration of this Contract.

f. State’s Governance, Risk and Compliance (GRC) platform. Contractor is required to assist the State with its security accreditation process through the development, completion and ongoing updating of a system security plan using the State’s automated GRC platform and implement any required safeguards or remediate any security vulnerabilities as identified by the results of the security accreditation process.

Non-Disclosure of Confidential Information. The parties acknowledge that each party may be exposed to or acquire communication or data of the other party that is

Version 2021-2 Page 14 of 41 confidential, privileged communication not intended to be disclosed to third parties.

The provisions of this Section survive the termination of this Contract.

a. Meaning of Confidential Information. For the purposes of this Contract, the term “Confidential Information” means all information and documentation of a party that: (a) has been marked “confidential” or with words of similar meaning, at the time of disclosure by such party; (b) if disclosed orally or not marked “confidential” or with words of similar meaning, was subsequently summarized in writing by the disclosing party and marked “confidential” or with words of similar meaning; and, (c) should reasonably be recognized as confidential information of the disclosing party. The term “Confidential Information” does not include any information or documentation that was: (a) subject to disclosure under the Michigan Freedom of Information Act (FOIA); (b) already in the possession of the receiving party without an obligation of confidentiality; (c) developed independently by the receiving party, as demonstrated by the receiving party, without violating the disclosing party’s proprietary rights; (d) obtained from a source other than the disclosing party without an obligation of confidentiality; or,

(e) publicly available when received, or thereafter became publicly available (other than through any unauthorized disclosure by, through, or on behalf of, the receiving party). For purposes of this Contract, in all cases and for all matters, State Data is deemed to be Confidential Information.

b. Obligation of Confidentiality. The parties agree to hold all Confidential Information in strict confidence and not to copy, reproduce, sell, transfer, or otherwise dispose of, give or disclose such Confidential Information to third parties other than employees, agents, or subcontractors of a party who have a need to know in connection with this Contract or to use such Confidential Information for any purposes whatsoever other than the performance of this Contract. The parties agree to advise and require their respective employees, agents, and subcontractors of their obligations to keep all Confidential Information confidential. Disclosure to a subcontractor is permissible where: (a) use of a subcontractor is authorized under this Contract; (b) the disclosure is necessary or otherwise naturally occurs in connection with work that is within the subcontractor's responsibilities; and (c) Contractor obligates the subcontractor in a written contract to maintain the State's Confidential Information in confidence. At the State's request, any employee of Contractor or any subcontractor may be required to execute a separate agreement to be bound by the provisions of this Section.

c. Cooperation to Prevent Disclosure of Confidential Information. Each party must use its best efforts to assist the other party in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the foregoing, each party must advise the other party immediately in the event either party learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Contract and each party will cooperate with the other party in seeking injunctive or other equitable relief against any such person.

Version 2021-2 Page 15 of 41

d. Remedies for Breach of Obligation of Confidentiality. Each party acknowledges that breach of its obligation of confidentiality may give rise to irreparable injury to the other party, which damage may be inadequately compensable in the form of monetary damages. Accordingly, a party may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any other legal remedies which may be available, to include, in the case of the State, at the sole election of the State, the immediate termination, without liability to the State, of this Contract or any Statement of Work corresponding to the breach or threatened breach.

e. Surrender of Confidential Information upon Termination. Upon termination of this Contract or a Statement of Work, in whole or in part, each party must, within 5 calendar days from the date of termination, return to the other party any and all Confidential Information received from the other party, or created or received by a party on behalf of the other party, which are in such party’s possession, custody, or control; provided, however, that Contractor must return State Data to the State following the timeframe and procedure described further in this Contract. Should Contractor or the State determine that the return of any Confidential Information is not feasible, such party must destroy the Confidential Information and must certify the same in writing within 5 calendar days from the date of termination to the other party. However, the State’s legal ability to destroy Contractor data may be restricted by its retention and disposal schedule, in which case Contractor’s Confidential Information will be destroyed after the retention period expires.

Data Privacy and Information Security.

a. Undertaking by Contractor. Without limiting Contractor’s obligation of confidentiality as further described, Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to: (a) ensure the security and confidentiality of the State Data; (b) protect against any anticipated threats or hazards to the security or integrity of the State Data; (c) protect against unauthorized disclosure, access to, or use of the State Data; (d) ensure the proper disposal of State Data; and (e) ensure that all employees, agents, and subcontractors of Contractor, if any, comply with all of the foregoing.

In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable State IT policies and standards, which are available to Contractor upon request.

b. Audit by Contractor. No less than annually, Contractor must conduct a comprehensive independent third-party audit of its data privacy and information security program and provide such audit findings to the State.

c. Right of Audit by the State. Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Contract Activities and from time to time during the term of this Contract. During the providing of the Contract Activities, on an ongoing basis from time to time and without notice, the State, at its own expense, is entitled to perform, or to have performed, an on-site audit of

Version 2021-2 Page 16 of 41

Contractor’s data privacy and information security program. In lieu of an on-site audit, upon request by the State, Contractor agrees to complete, within 45 calendar days of receipt, an audit questionnaire provided by the State regarding Contractor’s data privacy and information security program.

d. Audit Findings. Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

e. State’s Right to Termination for Deficiencies. The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section.

Reserved.

Reserved.

Records Maintenance, Inspection, Examination, and Audit. The State or its designee may audit Contractor to verify compliance with this Contract. Contractor must retain and provide to the State or its designee and the auditor general upon request, all financial and accounting records related to the Contract through the term of the Contract and for 4 years after the latter of termination, expiration, or final payment under this Contract or any extension (“Audit Period”). If an audit, litigation, or other action involving the records is initiated before the end of the Audit Period, Contractor must retain the records until all issues are resolved.

Within 10 calendar days of providing notice, the State and its authorized representatives or designees have the right to enter and inspect Contractor's premises or any other places where Contract Activities are being performed, and examine, copy, and audit all records related to this Contract. Contractor must cooperate and provide reasonable assistance. If any financial errors are revealed, the amount in error must be reflected as a credit or debit on subsequent invoices until the amount is paid or refunded. Any remaining balance at the end of the Contract must be paid or refunded within 45 calendar days.

This Section applies to Contractor, any parent, affiliate, or subsidiary organization of Contractor, and any subcontractor that performs Contract Activities in connection with this Contract.

Warranties and Representations. Contractor represents and warrants: (a) Contractor is…