230000001416.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, Ml 48933 P.O. Box 30026, Lansing, Ml 48909

CONTRACT CHANGE NOTICE

Change Notice Number .a, to

Contract Number MA230000001416

Stephanie Jeppesen DTMB

E lii ca Cl ... ca 517-335-6899Cl C e ca

a. :Iii

JeppesenS@Michigan.gov

... Lauren Stempek DTMB

U'!

ca- ._ Vl (517) 243-4008-·-c c o ·-u E

4( stempekL@michigan.gov

Trellix Public Sector LLC

1640 Boro Place, 3rd Fl

McLean VA 22102

Greg Ball

214-687-6823

Gregory.ball@trellix.com

VS0229161

CONTRACT SUMMARY

Security Software Tools & Services

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS

EXPIRATION DATE

BEFORE

September 13, 2023 September 12, 2024

PAYMENT TERMS

net 45

ALTERNATE PAYMENT OPTIONS

D P-Card □ Direct Voucher (PRC)

MINIMUM DELIVERY REQUIREMENTS

n/a

CURRENT VALUE VALUE OF CHANGE NOTICE

$3,143,412.58 $0.00 n/a

D Other

3 - 1 Year September 12, 2026

DELIVERY TIMEFRAME

0 Years

EXTENDED PURCHASING

□ Yes lg] No

ESTIMATED AGGREGATE CONTRACT VALUE

$3,143,412.58

������������������������ !�"���������!���#�$%#���&'(�)*�+���%��)������'�#�,�����-��./��!�"0�123&&4*5*�$56�&(('7�-89)09:!�"0;<0:89�123(3=>?@AB=@�=CB?DE�?>@F=E

��������G)��%�/� �)���H��������.�I�)��J/��.

�M���

�M����O�����)�����P���Q&!�'('& )�����P���Q'!�'('1 &�R�Q'�"����. )�����P���Q'!�'('S��G�� ������� M�K L��G�� ��������K��� ������G�� � �N�� M�M���� ����M�K L��G���T� ���� ���U� 4R;��# �/�����V�%�����W4X;Y 5���� Z�. 9�

Q71(�$����4����!&�#�,�"�-����V8�''Q(':����$���'Q1R72[R72'&:����� *P���\�����/]*���V)(''3Q7Q )�:�"�������8����������-4 ��� SQ[R&&SR7233�̂���.��)\"/��/���*��J-�%����)�����_WSQ[Y�'1&R1((2 ��"$)������/��̂����.�� ��"$

.�����_�\�/��/���*��J ̀abcdeb�fghahibcdb̀c �c̀jcdg�dadjkc�����

�U�����1S

;������9��/���9%�P����l;��������9%�P����mBlnoooooopqpr��

M�� �N�� K� K� ��������N��

��L�K�� L�K������ � ��� ����M����������� ��L�K��Q'�"����. (�Z���. )�����P���Q'!�'('7t&!Q1&!1Q'*S2 t(*(( t&!Q1&!1Q'*S2M�� u�����/J��7U&(U'('S!�����)�����/.��]��%�/�������'�#����&��J�/��P������/��� ���.���_/���������J/.�#����������]�/���/���#����3UQ'U'('7*�u]/.�/����%�#.�/���������%������tQ3&![1(*((�����%.�#������J�����.�.����%���������H��]�/���/���#���!��.�#�.��/P�#�/�������������#�v%���*8�������������.!����#/�/��.!�.���/�/���/��.���#���/�/�������/������.���*�4����������������#������ ���������!���#���"$�;�������4���%�������)��J/��.������J��*��

Michigan.gov/MiProcurement

IT CHANGE NOTICE

Version 2 (3/2021) 1

Line Item

Product Description

Latest Serial # SKU Export Restricted

Start Date End Date Term Length

QTY

Hardware

QTY

Software or Support (Nodes)

Grant #’s MSRP Price

End User Price

Discount

Total End User Price

1 Endpoint Security Power Edition(F)

FM1810QA01K EPPW2WE1E-AA False 9/13/2025 9/12/2026 1.000 0 59,000 17929449-NAI 40.69 2.86 92.97 168,740.00

2 Endpoint Security Power Edition(F)

EPPW2WE1E-AA False 9/13/2025 9/12/2026 1.000 0 10,000 17929449-NAI 55.67 2.50 95.51 25,000.00

3 Thrive Elite THRIVE-ELITE False 9/12/2026 1.953 0 1 0.00 0.00 0.00 0.00

Total: $193,740.00

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Security Software Tools & Services

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

September 13, 2023 September 12, 2024 3 - 12 Months September 12, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

n/a

P-Card Direct Voucher (PRC) Other Yes No

1640 Boro Place, 3rd Fl

McLean VA 22102

Greg Ball

214-687-6823

Gregory.ball@trellix.com

Trellix Public Sector LLC

C O

N

TR

A C

TO

R

517-335-6899

JeppesenS@Michigan.gov

Lauren Stempek

(517) 243-4008

DTMB

Stephanie Jeppesen DTMB

StempekL@Michigan.Gov

C ontract

A dm inistrator Program M anagerSTA

TE

n/anet 45

Change Notice Number 1

Contract Number MA230000001416 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

12 Months September 12, 2025

$2,952,834.02 $190,578.56 $3,143,412.58

DESCRIPTION

Effective 9/10/2024, the State is executing the 1st of 3 available option years making the revised contract expiration date 9/12/2025. Additionally funding in the amount of $190,578.56 is added to cover costs through the new expiration date, as described in the attached Quote.

Please note that the Contract Administrator for the State has been updated to Lauren Stempek.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

Michigan.gov/MiProcurement

IT CHANGE NOTICE

Version 2 (3/2021) 1

Line Item

Product Description

Latest Serial # SKU Export Restricted

Start Date End Date Term Length

QTY

Hardware

QTY

Software or Support (Nodes)

Grant #’s MSRP Price

End User Price

Discount

Total End User Price

1 Endpoint Security Power Edition (F)

FM1810QA01K EPPW2WE1E-AA False 10/03/2024 9/12/2025 0.945 0 59,000 17890678-NAI 39.50 2.94 93 164,020.00

2 Endpoint Security Power Edition (F)

EPPW2WE1E-AA False 9/22/2024 9/12/2025 0.975 0 10,000 17890678-NAI 54.05 2.56 95 25,000.00

3 2500 CM

Virtual Appliance (F)

VCM2500CAE-AT False 1.000 0 1 15,523.20 0.00 100 0.00

3 Thrive Essential

VCM2500PTM-AT False 9/12/2025 0.953 0 1 2,869.02 1,635.8

43 1,558.56

4 2500 CM

Virtual Appliance – Dynamic Threat Intelligence (F)

VCM2500D2WGAEAT False 9/12/2025 0.953 0 1 0.00 0.00 0 0.00

5 Security Orchestration (F)

FSOE1E-AA False 10/03/2024 9/12/2025 0.945 0 1 17890678-NAI 0.00 0.00 0 0.00

6 Thrive Elite THRIVE-ELITE False 9/12/2025 1.135 0 1 0.00 0.00 0 0.00

6 Thrive Flex Credits

THRIVE-FLEX False 9/12/2025 1.135 0 1 0.00 0.00 0 0.00

Total: $190,578.56

CO

NT

RA

CT

O R

ST

AT

E

NOTICE OF CONTRACT

NOTICE OF CONTRACT NO. 230000001416

between

THE STATE OF MICHIGAN

and

CONTRACT SUMMARY

DESCRIPTION: Security Software Tools & Services

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE

OPTIONS

EXPIRATION DATE BEFORE

CHANGE(S) NOTED BELOW

September 13, 2023 September 12, 2024 (3) 1-Year N/A

PAYMENT TERMS DELIVERY TIMEFRAME

Net 45 N/A

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-card ☐ Payment Request (PRC) ☐ Other ☐ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS

N/A

MISCELLANEOUS INFORMATION

This contract is established by assigning a portion of the MA 171-190000001531 scope from Mandiant, Inc. to Trellix Public Sector, LLC. Per contractor, Agency, DTMB Procurement, and State Administrative Board approval on 8/8/2023.

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION $ 2,952,834.02

STATE OF MICHIGAN PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut St, Lansing, MI 48933

Trellix Public Sector LLC

1640 Boro Place, 3rd Floor

McLean, VA 22102

Greg Ball

214-687-6823

Gregory.ball@trellix.com

VS0229161

Pr og ra m

M an ag er Stephanie Jeppesen DTMB

517-335-6899

JeppesenS@michigan.gov

C on tra ct

Ad m in is tra to r Jarrod Barron DTMB

517-249-0406

BarronJ1@michigan.gov mailto:BarronJ1@michigan.gov

CONTRACT NO. 171-2300000001416

FOR THE CONTRACTOR:

Company Name

Authorized Agent Signature

Authorized Agent (Print or Type)

Date

FOR THE STATE:

Signature

Jarrod Barron – IT Category Specialist Name & Title

DTMB – Central Procurement Services Agency

Date

STATE OF MICHIGAN

CONTRACT TERMS

Managed Security Services Contract

This Managed Security Services Contract (this “Contract”) is agreed to between the State of Michigan (the “State”) and Trellix Public Sector LLC (“Trellix” or “Contractor”), a Delaware Corporation. This Contract is effective on September 13, 2023 (“Effective Date”), and unless earlier terminated, will expire on September 12, 2024 (the “Term”).

This Contract may be renewed for up to 3 additional one-year periods. Renewal must be by written notice from the State and will automatically extend the Term of this Contract.

1. Definitions. For the purposes of this Contract, the following terms have the following meanings:

“Acceptance” has the meaning set forth in Section 12.1.

“Acceptance Tests” means such tests as may be conducted in accordance with Section 12 and the Statement of Work to determine whether the Solution meets the requirements of this Contract and the Documentation.

“Affiliate” of a Person means any other Person that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, such Person. For purposes of this definition, the term “control” (including the terms “controlled by” and “under common control with”) means the direct or indirect ownership of more than fifty percent (50%) of the voting securities of a Person.

“Allegedly Infringing Materials” has the meaning set forth in Section 27.3(b)(ii).

“API” means all Application Programming Interfaces and associated API Documentation provided by

Contractor, and as updated from time to time, to allow the Software to integrate with various State and Third Party Software.

“Approved Open-Source Components” means Open-Source Components that may be included in or used in connection with the Software delivered to the State and are specifically identified in an exhibit to the Statement of Work and approved by the State.

“Authorized Users” means all Persons authorized by the State to access and use the Solution under this Contract, subject to the maximum number of users specified in the applicable Statement of Work.

“Business Day” means a day other than a Saturday, Sunday or other day on which the State is authorized or required by Law to be closed for business.

“Business Owner” is the individual appointed by the agency buyer to (a) act as the agency’s representative in all matters relating to the Contract, and (b) co-sign off on notice of Acceptance for the Solution. The Business Owner will be identified in the Statement of Work.

“Business Requirements Specification” means the initial specification setting forth the State’s business requirements regarding the features and functionality of the Solution, as set forth in the Statement of Work.

“Change” has the meaning set forth in Section 2.2.

“Change Notice” has the meaning set forth in Section 2.2(b).

“Change Proposal” has the meaning set forth in Section 2.2(a).

“Change Request” has the meaning set forth in Section 2.2.

“Confidential Information” has the meaning set forth in Section 21.1.

“Configuration” means State-specific changes made to the Software without Source Code or structural data model changes occurring.

“Contract” has the meaning set forth in the preamble.

“Contract Administrator” is the individual appointed by each party to (a) administer the terms of this

Contract, and (b) approve any Change Notices under this Contract. Each party’s Contract Administrator will be identified in the Statement of Work.

“Contractor” has the meaning set forth in the preamble.

“Contractor’s Bid Response” means the Contractor’s proposal submitted in response to the RFP.

“Contractor Personnel” means all employees of Contractor or any Permitted Subcontractors involved in the performance of Services hereunder.

“Deliverables” means the documents and other materials that Contractor is required to or otherwise does provide to the State under this Contract and otherwise in connection with any Services that are specifically identified as Deliverables in the Statement of Work.

“Dispute Resolution Procedure” has the meaning set forth in Section 32.1.

“Documentation” means all user manuals, operating manuals, technical manuals in any form or media, that describe the functionality, installation, testing, operation, use, maintenance, support, technical or other components, features or requirements of the Software or Solution.

“DTMB” means the Michigan Department of Technology, Management and Budget.

“Effective Date” has the meaning set forth in the preamble.

“Fees” means collectively, the License Fees, Implementation Fees, and Support Services Fees.

“Financial Audit Period” has the meaning set forth in Section 30.1.

“Force Majeure” has the meaning set forth in Section 33.1.

“Harmful Code” means any: (a) virus, trojan horse, worm, backdoor or other software or hardware devices the effect of which is to permit unauthorized access to, or to disable, erase, or otherwise harm, any computer, systems or software; or (b) time bomb, drop dead device, or other software or hardware device designed to disable a computer program automatically with the passage of time or under the positive control of any Person, or otherwise prevent, restrict or impede the State's or any Authorized User's use of such software.

“HIPAA” has the meaning set forth in Section 20.1.

“Implementation Fees” has the meaning set forth in Section 17.2.

“Implementation Plan” means the schedule included in the Statement of Work setting forth the sequence of events for the performance of Services under the Statement of Work, including the Milestones and Milestone Dates.

“Integration Testing” has the meaning set forth in Section 1.1(a).

“Intellectual Property Rights” means all or any of the following: (a) patents, patent disclosures, and inventions (whether patentable or not); (b) trademarks, service marks, trade dress, trade names, logos, corporate names, and domain names, together with all of the associated goodwill; (c) copyrights and copyrightable works (including computer programs), mask works and rights in data and databases; (d) trade secrets, know-how and other confidential information; and (e) all other intellectual property rights, in each case whether registered or unregistered and including all applications for, and renewals or extensions of, such rights, and all similar or equivalent rights or forms of protection provided by applicable Law in any jurisdiction throughout the world.

“Key Personnel” means any Contractor Personnel identified as key personnel in the Statement of

Work.

“Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction.

“License Agreement” has the meaning set forth in Section 3.

“License Fee” has the meaning set forth in Section 17.1.

“Loss or Losses” means all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys' fees and the costs of enforcing any right to indemnification hereunder.

“Maintenance Release” means any update, upgrade, release or other adaptation or modification of the Solution, including any updated Documentation, that Contractor may generally provide to its licensees from time to time during the Term, which may contain, among other things, error corrections, enhancements, improvements or other changes to the user interface, functionality, compatibility, capabilities, performance, efficiency or quality of the Solution, as further described in the Support Schedule.

“Milestone” means an event or task described in the Implementation Plan under the Statement of

Work that must be completed by the corresponding Milestone Date.

“Milestone Date” means the date by which a particular Milestone must be completed as set forth in the Implementation Plan under the Statement of Work.

“Nonconformity” or “Nonconformities” means any failure or failures of the Software to conform to the requirements of any applicable Documentation.

“Open-Source Components” means any software component that is subject to any open-source copyright license agreement, including any GNU General Public License or GNU Library or Lesser Public License, or other obligation, restriction or license agreement that substantially conforms to the Open Source Definition as prescribed by the Open Source Initiative or otherwise may require disclosure or licensing to any third party of any source code with which such software component is used or compiled.

“Open-Source License” has the meaning set forth in Section 4.

“Operating Environment” means, collectively, the platform, environment and conditions on, in or under which the Solution is intended to be installed and operate, as set forth in the Statement of Work, including such structural, functional and other features, conditions and components as hardware, operating software and system architecture and configuration.

“Order” means a written purchase order or similar ordering document, signed or submitted to

Contractor by State and approved by Contractor, under which State agrees to purchase the Solution, Software, Support, or other Services provided by Contractor.

“Permitted Subcontractor” has the meaning set forth in Section 9.4.

“Person” means an individual, corporation, partnership, joint venture, limited liability company, governmental authority, unincorporated organization, trust, association or other entity.

“Pricing” means any and all fees, rates and prices payable under this Contract, including pursuant to any Schedule or Exhibit hereto.

“Pricing Schedule” means the schedule attached as Schedule D, setting forth the License Fees, Implementation Fees, Support Services Fees, and any other fees, rates and prices payable under this Contract.

“Project Manager” is the individual appointed by each party to (a) monitor and coordinate the day-to-day activities of this Contract, and (b) for the State, to co-sign off on its notice of Acceptance for the Solution. Each party’s Project Manager will be identified in the Statement of Work.

“Representatives” means a party's employees, officers, directors, partners, shareholders, agents, attorneys, successors and permitted assigns.

“RFP” means the State’s request for proposal designed to solicit responses for Services under this

“Services” means any of the services Contractor is required to or otherwise does provide under this

Contract, the Statement of Work, or the Service Level Agreement (if applicable).

“Service Level Agreement” means, if applicable, the service level agreement attached as Schedule E to this Contract, setting forth Contractor’s obligations with respect to the hosting, management and operation of the Solution.

“Site” means the physical location designated by the State in, or in accordance with, this Contract or the Statement of Work for delivery and installation of the Software, where applicable.

“Software” means Contractor’s software embedded in any applicable hardware and/or set forth in the Order or an applicable Statement of Work, and any Maintenance Releases or New Versions provided to the State and all copies of the foregoing permitted under this Contract and the License Agreement. As used in this Contract, Software does not include Software as a Service which is defined separately.

“Software as a Service” means Contractor’s software applications and any third-party or other software that Contractor provides remote access to and use of as part of the Solution.

“Solution” means the entire service provided by Contractor to the State for a fixed term, under which Contractor provides access to its Software as a Service, certain features, Software, hardware (appliances), functionality, and/or information, Products, Subscriptions, Training, and Support Services, as described in the applicable Statement of Work and Schedule for each offering attached to the License Agreement.

“Source Code” means the human readable source code of the Software to which it relates, in the programming language in which the Software was written, together with all related flow charts and technical documentation, including a description of the procedure for generating object code, all of a level sufficient to enable a programmer reasonably fluent in such programming language to understand, build, operate, support, maintain and develop modifications, upgrades, updates, adaptations, enhancements, new versions and other derivative works and improvements of, and to develop computer programs compatible with, the Software.

“Specifications” means, for the Solution, the specifications collectively set forth in the Documentation if any, for such Solution.

“State” means the State of Michigan.

“State Data” has the meaning set forth in Section 20.1.

“State Materials” means all materials and information, including documents, data, know-how, ideas, methodologies, specifications, software, content and technology, in any form or media, directly or indirectly provided or made available to Contractor by or on behalf of the State in connection with this

“State Resources” has the meaning set forth in Section 10.1(a).

“Statement of Work” means any statement of work entered into by the parties and attached as a schedule to this Contract. The initial Statement of Work is attached as Schedule A, and subsequent Statements of Work shall be sequentially identified and attached as Schedules A-1, A-2, A-3, etc.

“Stop Work Order” has the meaning set forth in Section 25.

“Support Services” means the software and hardware (appliances) maintenance and support services Contractor is required to or otherwise does provide to the State under the Maintenance and Support Schedule (if applicable) or the Service Level Agreement (if applicable).

“Support Services Commencement Date” means, with respect to the Solution, the date on which the Support Services will begin, which is on or shortly after the date of the Order and will continue in effect for the period of time stated in the Order (“Initial Support Term”) or such other date as may be set forth in the Statement of Work.

“Support Services Fees” has the meaning set forth in Section 17.3.

“Technical Specification” means, with respect to any Software or Solution, the document setting forth the technical specifications for such Software or Solution and included in the Statement of Work.

“Term” has the meaning set forth in the preamble.

“Testing Period” has the meaning set forth in Section 1.1(a).

“Third Party” means any Person other than the State or Contractor.

“Transition Period” has the meaning set forth in Section 24.3

“Transition Responsibilities” has the meaning set forth in Section 24.3.

“Unauthorized Removal” has the meaning set forth in Section 9.3(b).

“User Data” means all data, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, processed, by or on behalf of the State.

“Warranty Period” means the timeframe set forth in each separate Warranty provided in Schedule C

– License Agreement.

2. Statements of Work. Contractor shall provide Services and Deliverables pursuant to Statements of Work entered into under this Contract. No Statement of Work shall be effective unless signed by each party’s Contract Administrator. The term of each Statement of Work shall commence on the parties' full execution of the Statement of Work and terminate when the parties have fully performed their obligations.

The terms and conditions of this Contract will apply at all times to any Statements of Work entered into by the parties and attached as a schedule to this Contract. The State shall have the right to terminate such Statement of Work as set forth in Section 24. Contractor acknowledges that time is of the essence with respect to Contractor’s obligations under each Statement of Work and agrees that prompt and timely performance of all such obligations in accordance with this Contract and the Statements of Work (including the Implementation Plan and all Milestone Dates) is strictly required.

2.1 Statement of Work Requirements. Each Statement of Work will include the following:

(a) names and contact information for Contractor’s Contract Administrator, Project Manager and Key Personnel;

(b) names and contact information for the State’s Contract Administrator, Project Manager and

Business Owner;

(c) a detailed description of the Services to be provided under this Contract, including any training obligations of Contractor;

(d) a detailed description of the Solution to be provided under this Contract, including the:

(i) version and release number of the Software, if applicable;

(ii) Business Requirements Specification;

(iii) Technical Specification; and

(iv) a description of the Documentation to be provided;

(e) an Implementation Plan, including all Milestones, the corresponding Milestone Dates and the parties’ respective responsibilities under the Implementation Plan;

(f) the due dates for payment of Fees and any invoicing requirements, including any Milestones on which any such Fees are conditioned, and such other information as the parties deem necessary;

(g) disclosure of all Open-Source Components (each identified on a separate exhibit to the

Statement of Work), in each case accompanied by such related documents as may be required by this Contract;

; and

(h) a detailed description of all State Resources required to complete the Implementation Plan.

2.2 Change Control Process. The State may at any time request in writing (each, a “Change Request”) changes to the Statement of Work, including changes to the Services and Implementation Plan (each, a “Change”). Upon the State’s submission of a Change Request, the parties will evaluate and implement all Changes in accordance with this Section 2.2.

(a) As soon as reasonably practicable, and in any case within twenty (20) Business Days following receipt of a Change Request, Contractor will provide the State with a written proposal for implementing the requested Change (“Change Proposal”), setting forth:

(i) a written description of the proposed Changes to any Services or Deliverables;

(ii) an amended Implementation Plan reflecting: (A) the schedule for commencing and completing any additional or modified Services or Deliverables; and (B) the effect of such Changes, if any, on completing any other Services under the Statement of Work;

(iii) any additional State Resources Contractor deems necessary to carry out such Changes; and

(iv) any increase or decrease in Fees resulting from the proposed Changes, which increase or decrease will reflect only the increase or decrease in time and expenses Contractor requires to carry out the Change.

(b) Within thirty (30) Business Days following the State’s receipt of a Change Proposal, the

State will by written notice to Contractor, approve, reject, or propose modifications to such Change Proposal. If the State proposes modifications, Contractor must modify and re-deliver the Change Proposal reflecting such modifications, or notify the State of any disagreement, in which event the parties will negotiate in good faith to resolve their disagreement. Upon the State’s approval of the Change Proposal or the parties’ agreement on all proposed modifications, as the case may be, the parties will execute a written agreement to the Change Proposal (“Change Notice”), which Change Notice will be signed by the State’s Contract Administrator and will constitute an amendment to the Statement of Work to which it relates; and

(c) If the parties fail to enter into a Change Notice within fifteen (15) Business Days following the State’s response to a Change Proposal, the State may, in its discretion:

(i) require Contractor to perform the Services under the Statement of Work without the Change;

(ii) require Contractor to continue to negotiate a Change Notice for a reasonable period of time; or

(iii) initiate a Dispute Resolution Procedure.

(d) No Change will be effective until the parties have executed a Change Notice. Except as the State may request in its Change Request or otherwise in writing, Contractor must continue to perform its obligations in accordance with the Statement of Work pending negotiation and execution of a Change Notice. Contractor will use its best efforts to limit any delays or Fee increases from any Change to those necessary to perform the Change in accordance with the applicable Change Notice. Each party is responsible for its own costs and expenses of preparing, evaluating, negotiating, and otherwise processing any Change Request, Change Proposal, and Change Notice.

(e) The performance of any functions, activities, tasks, obligations, roles and responsibilities comprising the Services as described in this Contract are considered part of the Services and, thus, will not be considered a Change. This includes the delivery of all Deliverables in accordance with their respective Specifications, and the diagnosis and correction of Non-Conformities discovered in Deliverables prior to their Acceptance by the State or, subsequent to their Acceptance by the State, as necessary for Contractor to fulfill its associated warranty requirements and its Support Services under this

(f) Contractor may, on its own initiative and at its own expense, prepare and submit its own

Change Request to the State, which the state will review and respond to in good faith. However, the State will be under no obligation to approve to a Change Request initiated by Contractor.

3. Software License. Contractor hereby grants to the State and its Authorized Users the right and license to use the Software as a Service, Software, Solution, and Documentation in accordance with the terms and conditions of this Contract and the License Agreement set forth in Schedule C (the “License Agreement”) (for avoidance of doubt, the terms “Product” and “Subscription” are used in the License Agreement for the terms “Software” and “Software as a Service” as used herein).

4. Open-Source Licenses. Any use hereunder of Open-Source Components shall be governed by, and subject to, the terms and conditions of the applicable open-source license (“Open-Source License”).

Contractor shall identify and describe in an exhibit to the Statement of Work each of the Approved Open- Source Components of the Software distributed to the State, and include an exhibit attaching all Open- Source Software Licenses applicable to the Software being delivered to the State or identifying the URL where these licenses are available.

5. Solution Implementation.

5.1 Implementation. Contractor will deliver, install, configure, integrate, and otherwise provide and make fully operational the Solution on or prior to the applicable Milestone Date in accordance with the criteria set forth in the Statement of Work.

5.2 Site Preparation. Unless otherwise set forth in the Statement of Work, Contractor is responsible for ensuring the relevant Operating Environment is set up and in working order to allow Contractor to deliver and install the Solution on or prior to the applicable Milestone Date. Contractor will provide the State with such notice as is specified in the Statement of Work, prior to delivery of the Solution to give the State sufficient time to prepare for Contractor’s delivery and implementation of the Solution. If the State is responsible for Site preparation, Contractor will provide such reasonable assistance as the State requests to complete such preparation on a timely basis.

6. Hosting. Contractor will maintain the Availability Requirement and the Support Service Level Requirement set forth in the Service Level Agreement attached as Schedule E to this Contract.

7. Support Services

7.1 Support Services. Contractor shall provide the State with the Support Services described in the

Service Level Agreement attached as Schedule E to this Contract and as described in the Maintenance and Support Agreement for the HX appliance attached as Schedule H to this Contract. Such Support Services shall be provided:

(a) Free of charge during the Warranty Period, it being acknowledged and agreed that the

License Fee includes full consideration for such Services during such period.

(b) Thereafter, for so long as the State elects to maintain the Solution, in consideration of the State's payment for the Solution in accordance with Section 17 and the rates set forth in the Pricing Schedule.

8. Data Privacy and Information Security.

8.1 Undertaking by Contractor. Without limiting Contractor’s obligation of confidentiality as further described, Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to: (a) ensure the security and confidentiality of the State Data; (b) protect against any anticipated threats or hazards to the security or integrity of the State Data; (c) protect against unauthorized disclosure, access to, or use of the State Data; (d) ensure the proper disposal of State Data;

and (e) ensure that all Contractor Representatives comply with all of the foregoing. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable State IT policies and standards, of which publicly available one are located at http://www.michigan.gov/dtmb/0,4568,7- 150-56355_56579_56755---,00.html.

Note: Not all applicable PSP's are available publicly. Controlled PSP's applicable to the CPC are available after signing and returning to the State the required Nondisclosure Agreement (NDA) agreement. Failure to return a signed NDA may be grounds for disqualification.

8.2 To the extent that Contractor has access to the State’s computer system, Contractor must comply with the State’s Acceptable Use Policy, see https://www.michigan.gov/documents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_St andard_458958_7.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Policy before accessing the State’s system. The State reserves the right to terminate Contractor’s access to the State’s system if a material, uncured or uncurable violation occurs.

8.3 Security Accreditation Process. Security Accreditation Process is governed by Schedule F, please refer there for more information. If requested by the State, Contractor will respond to reasonable inquiries, including for instance SIG Lite questionnaires, to assist the State with its security accreditation process.

8.4 Reserved.

8.5 Right of Audit by the State. Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. In lieu of an on-site audit, upon request by the State, Contractor agrees to complete, within forty-five (45) calendar days of receipt, an audit questionnaire provided by the State regarding Contractor’s data privacy and information security program.

8.6 Audit Findings. With respect to State Data, Contractor will take into consideration reasonably requested safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

8.7 State’s Right to Termination for Deficiencies. The State reserves the right, at its sole election, to immediately terminate this Contract or the Statement of Work without limitation and without liability if the State determines that Contractor materially fails or has materially failed to meet its obligations under this Section 8, and such failure has not been or cannot be cured.

8.8 Security Requirements for Externally Hosted Software. If the Operating Environment for the

Software is externally hosted by Contractor or a subcontractor, Contractor shall comply with the security requirements set forth in Schedule F to this Contract.

9. Performance of Services. Contractor will provide all Services and Deliverables in a timely, professional and workmanlike manner and in accordance with the terms, conditions, and Specifications set forth in this Contract and the Statement of Work.

9.1 Contractor Personnel.

(a) Contractor is solely responsible for all Contractor Personnel and for the payment of their compensation, including, if applicable, withholding of income taxes, and the payment and withholding of mailto:joe.roberts@mandiant.com http://www.michigan.gov/dtmb/0%2C4568%2C7-150-56355_56579_56755---%2C00.html https://www.michigan.gov/whitmer/0,9309,7-387-90499_90704-486781--,00.html social security and other payroll taxes, unemployment insurance, workers’ compensation insurance payments and disability benefits.

(b) Prior to any Contractor Personnel performing any Services, Contractor will:

(i) ensure that such Contractor Personnel have the legal right to work in the United

States;

(ii) upon request, require such Contractor Personnel to execute written agreements, in form and substance acceptable to the State, that bind such Contractor Personnel to confidentiality provisions that are at least as protective of the State’s information (including all Confidential Information) as those contained in this Contract; and

(iii) perform background checks on all Contractor Personnel prior to their assignment.

The scope is at the discretion of the State and documentation must be provided as requested. Contractor is responsible for all costs associated with the requested background checks.

(c) Contractor and all Contractor Personnel will comply with all applicable rules, regulations, and policies of the State that are communicated to Contractor in writing in advance, including security procedures concerning systems and data and remote access, building security procedures, including the restriction of access by the State to certain areas of its premises or systems, and general health and safety practices and procedures.

(d) The State reserves the right to require the removal of any Contractor Personnel found, in the judgment of the State, to be unacceptable. The State’s request must be written with reasonable detail outlining the reasons for the removal request. Replacement personnel for the removed person must be fully qualified for the position. If the State exercises this right, and Contractor cannot immediately replace the removed personnel, the State agrees to negotiate an equitable adjustment in schedule or other terms that may be affected by the State’s required removal.

9.2 Contractor’s Project Manager. Throughout the Term of this Contract, Contractor must maintain a Contractor employee acceptable to the State to serve as Contractor’s Project Manager, who will be considered Key Personnel of Contractor. Contractor’s Project Manager will be identified in the Statement of Work.

(a) Contractor’s Project Manager must:

(i) have the requisite authority, and necessary skill, experience, and qualifications, to perform in such capacity;

(ii) be responsible for overall management and supervision of Contractor’s performance under this Contract; and

(iii) be the State’s primary point of contact for communications with respect to this

Contract, including with respect to giving and receiving all day-to-day approvals and consents.

(b) Contractor’s Project Manager must attend all regularly scheduled meetings as set forth in the Implementation Plan, and will otherwise be available as set forth in the Statement of Work.

(c) Contractor will maintain the same Project Manager throughout the Term of this Contract, unless:

(i) the State requests in writing the removal of Contractor’s Project Manager;

(ii) the State consents in writing to any removal requested by Contractor in writing;

(iii) Contractor’s Project Manager ceases to be employed by Contractor, whether by resignation, involuntary termination or otherwise.

(d) Contractor will promptly replace its Project Manager on the occurrence of any event set forth in Section 9.2(c). Such replacement will be subject to the State's prior written approval.

9.3 Contractor’s Key Personnel.

(a) The State has the right to recommend and approve in writing the initial assignment, as well as any proposed reassignment or replacement, of any Key Personnel. Before assigning an individual to any Key Personnel position, Contractor will notify the State of the proposed assignment, introduce the individual to the State’s Project Manager, and provide the State with a resume and any other information about the individual reasonably requested by the State. The State reserves the right to interview the individual before granting written approval. In the event the State finds a proposed individual unacceptable, the State will provide a written explanation including reasonable detail outlining the reasons for the rejection.

(b) Contractor will not remove any Key Personnel from their assigned roles on this Contract without the prior written consent of the State. The Contractor’s removal of Key Personnel without the prior written consent of the State is an unauthorized removal (“Unauthorized Removal”). An Unauthorized Removal does not include replacing Key Personnel for reasons beyond the reasonable control of Contractor, including illness, disability, leave of absence, personal emergency circumstances, resignation, or for cause termination of the Key Personnel’s employment. Any Unauthorized Removal may be considered by the State to be a material breach of this Contract, in respect of which the State may elect to terminate this Contract for cause under Section 24.1.

9.4 Subcontractors. If Contractor utilizes Third Parties, (each approved Third Party, a “Permitted

Subcontractor”) that does not relieve Contractor of its representations, warranties or obligations under this Contract. Without limiting the foregoing, Contractor will:

(a) be responsible and liable for the acts and omissions of each such Permitted Subcontractor

(including such Permitted Subcontractor's employees who, to the extent providing Services or Deliverables, shall be deemed Contractor Personnel) to the same extent as if such acts or omissions were by Contractor or its employees;

(b) name the State a third party beneficiary under Contractor’s Contract with each Permitted

Subcontractor with respect to the Services;

(c) be responsible for all fees and expenses payable to, by or on behalf of each Permitted Subcontractor in connection with this Contract, including, if applicable, withholding of income taxes, and the payment and withholding of social security and other payroll taxes, unemployment insurance, workers' compensation insurance payments and disability benefits; and

(d) notify the State of the location of the Permitted Subcontractor and indicate if it is located within the continental United States.

10. State Obligations.

10.1 State Resources and Access. The State is responsible for:

(a) providing the State Materials and such other resources as may be specified in the Statement of Work (collectively, “State Resources”); and

(b) if the Software is internally hosted on State systems, providing Contractor Personnel with such access to the Site(s) and Operating Environment as is necessary for Contractor to perform its obligations on a timely basis as set forth in the Statement of Work.

10.2 State Project Manager. Throughout the Term of this Contract, the State will maintain a State employee to serve as the State’s Project Manager under this Contract. The State’s Project Manager will be identified in the Statement of Work. The State’s Project Manager will be available as set forth in the

11. Reserved.

12. Acceptance Testing.

12.1 Service Preparation and Acceptance Testing.

(a) Service Preparation. Promptly upon parties’ execution of a Statement of Work, Contractor will take steps necessary to make the Solution produced thereunder ready and available for the State’s use in accordance with the Statement of Work and this Contract, including any applicable milestone date or dates set forth in such Statement of Work.

(b) Testing. The deployment, testing and integration process will be as outlined in the applicable

13. Acceptance. Final Acceptance (“Acceptance”) of the Solution will occur on the date the State delivers a notice accepting the Solution pursuant to the Statement of Work. If no notice is delivered, then acceptance will be deemed granted thirty (30) business days after Contractor has made the Solution ready and available for the State’s use as stated in Section 12.1(a).

14. Training. Contractor shall provide training on all uses of the Solution permitted hereunder in accordance with the times, locations and other terms set forth in the Statement of Work. Upon the State's request and upon mutual agreement of the parties, Contractor shall timely provide training for additional Authorized Users or other additional training on all uses of the Solution for which the State requests such training, at such reasonable times and locations and pursuant to such rates and other terms as are set forth in the Pricing Schedule.

15. Maintenance Releases; New Versions

15.1 Maintenance Releases. Provided that the State is current on its Support Services Fees, during the Term, Contractor shall provide the State, at no additional charge, with all Maintenance Releases for the Software, each of which will constitute Software and be subject to the terms and conditions of this

15.2 New Versions. Provided that the State is current on its Support Services Fees, during the Term, Contractor shall provide the State, at no additional charge, with all New Versions of the Software, each of which will constitute Software and be subject to the terms and conditions of this Contract.

15.3 Installation. The State has no obligation to install or use any Maintenance Release or New

Versions of the Software. If the State wishes to install any Maintenance Release or New Version, the State shall have the right to have such Maintenance Release or New Version installed, in the State's discretion, by Contractor or other authorized party as set forth in the Statement of Work. Contractor shall provide the State, at no additional charge, adequate Documentation for installation of the Maintenance Release or New Version, which has been developed and tested by Contractor and Acceptance Tested by the State. The State’s decision not to install or implement a Maintenance Release or New Version of the Software will not affect its right to receive Support Services throughout the Term of this Contract.

Notwithstanding the foregoing, if the State decides not to install or implement a Maintenance Release or New Version of the Software that Contractor deems critical to the service upon notice to the State, Contractor will not be liable for any degradation of such service.

16. Source Code Escrow

16.1 Escrow Contract. The parties may enter into a separate intellectual property escrow agreement. Such escrow agreement will govern all aspects of Source Code escrow and release.

17. Fees

17.1 License Fee. In consideration of, and as payment in full for, the rights and license to use the Solution and Documentation as provided in this Contract and the License Agreement, the State shall pay to Contractor the license fees (the “License Fee”) set forth on the Pricing Schedule, subject to and in accordance with the terms and conditions of this Contract and the License Agreement, including the applicable timetable and other provisions of the Statement of Work and this Section 17.

17.2 Implementation Fees. In consideration of, and as payment in full for, Contractor’s provision of implementation services as provided in this Contract and the Statement of Work, the State shall pay to Contractor the implementation fees (the “Implementation Fees”) set forth on the Pricing Schedule, subject to and in accordance with the terms and conditions of this Contract, including the applicable timetable and other provisions of the Statement of Work and this Section 17.

17.3 Support Service Fees. In consideration of Contractor providing the Support Services as required under the Maintenance and Support Schedule (as applicable) or the Service Level Agreement (as applicable), the State shall pay to Contractor the Support Services fees (the “Support Service Fees”) set forth in the Pricing Schedule, subject to and in accordance with the terms and conditions of this Contract, including the applicable provisions of the Maintenance and Support Schedule (as applicable) or the Service Level Agreement (as applicable) and this Section 17.

17.4 Firm Pricing/Fee Changes. All Pricing set forth in this Contract is firm and will not be increased, except as otherwise expressly provided in this Section 17.4.

(a) The License Fee will not be increased at any time except for the addition of additional licenses, the fees for which licenses will also remain firm in accordance with the Pricing set forth in the Pricing Schedule.

18. Invoices and Payment.

18.1 Invoices. Contractor will invoice the State for Fees in accordance with the requirements set forth in the Statement of Work, including any requirements that condition the rendering of invoices and the payment of Fees upon the successful completion of Milestones. Contractor must submit each invoice in both hard copy and electronic format, via such delivery means and to such address as are specified by the State in the Statement of Work. Each separate invoice must:

(a) clearly identify the Contract and purchase order number to which it relates, in such manner as is required by the State;

(b) list each Fee item separately;

(c) include sufficient detail for each line item to enable the State to satisfy its accounting and charge-back requirements;

(d) for Fees determined on a time and materials basis, report details regarding the number of hours performed during the billing period, the skill or labor category for such Contractor Personnel and the applicable hourly billing rates;

(e) include such other information as may be required by the State as set forth in the

Statement of Work; and

(f) Itemized invoices must be submitted to DTMB-Accounts-Payable@michigan.gov.

18.2 Payment. Invoices are due and payable by the State, in accordance with the State’s standard payment procedures as specified in 1984 Public Act no. 279, MCL 17.51, et seq., within forty-five (45) calendar days after receipt, provided the State determines that the invoice was properly rendered.