250000000170.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to Contract Number MA250000000170

C O

N

TR

A C

TO

R

Socure, Inc.

885 Tahoe Boulevard, Suite 1

Incline Village NV 89451

Nate Schneemann

810-523-9013

Nate.Schneemann@socure.com

VS0234387

ST

A

TE

Pr og ra m

M an ag er

Various Various

C on tr ac t A dm in is tr at or Kristine Mills DTMB

517-242-6402 millsk11@michigan.gov

CONTRACT SUMMARY

Fraud Analytics and ID Proofing

INITIAL EFFECTIVE DATE

December 9, 2024

INITIAL EXPIRATION DATE

December 8, 2027

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE

BEFORE

December 8, 2027

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

N/A

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$7,296,552.00

VALUE OF CHANGE NOTICE

$148,784.31

ESTIMATED AGGREGATE CONTRACT VALUE

$7,445,336.31

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 3/13/2026, the parties agree to incorporate the Selfie Reverification Module and the Bundle 2 A La Carte Rate Table, as outlined in the attached Statement of Work. An additional $148,784.31 in funding is added for the Selfie Reverification Module. All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 2 TO CONTRACT NO. MA250000000170

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

DTMB Nathan Ebig 517-282-1917 EbigN@michigan.gov

DTMB Koppsch-WoodsK 517-243-8786 Koppsch- WoodsK@michigan.gov

TREA Katina Litterini 517-899-9048 LitteriniK@michigan.gov

Michigan.gov/MiProcurement

Version 2021-1 1 of 7

STATEMENT OF WORK -

IT CHANGE NOTICE

Project Title: Add Selfie Reverification and Rate Table for a la carte services.

Period of Coverage:

2/17/26-12/9/33

Requesting Department:

Department of Technology, Management, and Budget

Date:

2/17/26

Agency Project Manager:

Dane Spencer

Phone:

517-898-3621

DTMB Project Manager:

Amy Chase

Phone:

517-855-1066

Brief description of services to be provided: Add Selfie Verification Module and Rate Table for a la carte services.

BACKGROUND:

The purpose of this “Change Notice 2” is to add a Statement of Work to Contract #MA250000000170 (“the Contract”) executed by and between the State of Michigan(“State”) and Socure, Inc (“Contractor” or “Socure”). This Statement of Work is for the provision of services to the Department of Technology, Management, and Budget, as described herein and is governed by the terms and conditions of the Contract, dated December 9, 2024, as subsequently modified or amended.

Without limitation, this Change Notice 2 adds, and incorporates by reference, the following to the Contract:

- An additional Statement of Work to add Selfie Reverification Module and related pricing to the Contract as described herein;

- The addition of the rate table applicable to the Bundle 2 Services described herein (the specific rates for which are set forth in Schedule B to the Contract); and

Except as expressly provided in this Change Notice 2, all other terms and conditions of this Contract, including all other Statements of Work and any other Schedules, Attachments, and Exhibits, remain unchanged and in full force and effect.

Version 2021-1 2 of 7

PROJECT OBJECTIVE:

1. Add “SOCURE Selfie Reverification” module and pricing to the contract for MiLogin use. Pricing for the “Selfie Reverification” module is included per the attached SOCURE pricing spreadsheet, through the life of the contract.

2. Add a la carte services to allow the State to use Modules already included with our “Bundle 2” in an “a la carte” manner. The rate table and service listing have also been provided in the attached SOCURE Pricing spreadsheet. There is not any additional cost for this, the State is requesting to define what the rates are for those individual services, should MiLogin or other state agencies want to utilize those services individually.

SCOPE OF WORK:

Contractor will implement the Document Verification Selfie Reverification module, expediting account recovery for users who previously completed ID proofing.

Module Name Description

Document Verification Selfie

Reverification

An explicit API call to the Document Verification Selfie Reverification module which returns information on the match result of the submitted selfie against the previously validated ID document headshot and recommendation on how to proceed (accept, reject, or resubmit), reason codes about the transaction, and information on data collected from the consumer device.

The Bundle 2 Subcomponents- A La Carte Rate Table is also added to the Contract. The modules are described as follows:

Module Name Description

Socure Verify A multidimensional, PII verification solution. An explicit API call to the Socure Verify module which returns a match or no match status of various PII elements and associated reason codes.

Version 2021-1 3 of 7

Sigma Identity

A machine-learning model trained on every dimension of a consumer identity to detect third-party fraud. An explicit API call to the Sigma Identity module which returns probabilistic risk scores and associated reason codes and signals regarding the likelihood of identity fraud.

Sigma Synthetic

A machine-learning model trained on hundreds of manipulated and fabricated synthetic ID variables to predict synthetic ID fraud. An explicit API call to the Sigma Synthetic module which returns probabilistic risk scores and associated reason codes and signals regarding the likelihood of synthetic identity fraud.

Address RiskScore

A machine-learning model trained on hundreds of address-specific variables and data sources, correlated to an identity. An explicit API call to the Address RiskScore module which returns probabilistic risk scores and associated reason codes and signals on an address.

Email RiskScore

A machine-learning model trained on hundreds of email-specific variables and data sources, correlated to an identity. An explicit API call to the Email RiskScore module which returns probabilistic risk scores and associated reason codes and signals on an email address.

Phone RiskScore

A machine-learning model trained on hundreds of phone-specific variables and data sources, correlated to an identity. An explicit API call to the Phone RiskScore module which returns probabilistic risk scores and associated reason codes and signals on a phone number.

Digital Intelligence (replaces Device)

An explicit API call to the Digital Intelligence module which returns information on behavioral biometrics, entity profiler, device fingerprinting, and geolocation data collected from the consumer device.

TASKS:

Technical support is required to assist with the following tasks:

Contractor will provide the necessary personnel, expertise, and knowledge transfer to allow the State to utilize Contractor’s Selfie Verification Module in accordance with State’s technical and operational requirements. This includes activities related to enablement, configuration, integration, and deployment of the module for the agreed-upon use cases within Contractor’s production environment.

As part of this engagement, the Contractor will:

• Deliver technical support required to assist the State with implementation tasks associated with the State’s integration project.

• Collaborate with the State on project-related activities as needed.

Version 2021-1 4 of 7

Contractor will not be responsible for creating project management documents or plans. However, the Contractor may provide input or contribute content to such documents upon request and in consultation with the State.

DELIVERABLES:

N/A

ACCEPTANCE CRITERIA:

Contract 250000000170 Software Terms and Conditions will apply.

PAYMENT SCHEDULE:

Payment will be made based on the transaction amount and actual quantity used. DTMB will pay Contractor upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly.

DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect the transaction amount and actual quantity used and must be approved by the Agency and DTMB Project Manager prior to payment.

Invoices will be issued in accordance with the terms of the Contract. Consistent within the Contract, Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

Pricing will follow all terms and conditions as found in the Contract under Schedule B – Pricing and shall be supplemented as follows:

Version 2021-1 5 of 7

Selfie Reverification Pricing

Base Contract Option Years

Module Name Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8

Document Verification Selfie

Reverification Annual

Volume N/A 36,000* 36,000* 72,000* 96,000* 96,000* 96,000* 96,000*

Unit Price N/A $0.2600 $0.2600 $0.2678 $0.2758 $0.2841 $0.2926 $0.3014

Cost N/A $9,360.00* $9,360.00* $19,281.60* $26,480.06* $27,274.47* $28,092.70* $28,935.48* *These are projected values only based on estimated quantities. Billed amounts will be based on the transaction amount and actual quantity used.

Bundle 2 Subcomponents- A La Carte Rate Table

Base Contract Option Years

Unit Prices (Aligned to Total Bundle 2 price) Module Name Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8

Socure Verify $ 0.0850 $ 0.0850 $ 0.0850 $ 0.0876 $ 0.0902 $ 0.0929 $ 0.0957 $ 0.0985 Sigma Identity $ 0.0704 $ 0.0704 $ 0.0704 $ 0.0725 $ 0.0747 $ 0.0769 $ 0.0792 $ 0.0816 Sigma Synthetic $ 0.0300 $ 0.0300 $ 0.0300 $ 0.0309 $ 0.0318 $ 0.0328 $ 0.0338 $ 0.0348 Address RiskScore $ 0.0380 $ 0.0380 $ 0.0380 $ 0.0391 $ 0.0403 $ 0.0415 $ 0.0428 $ 0.0441 Email RiskScore $ 0.0380 $ 0.0380 $ 0.0380 $ 0.0391 $ 0.0403 $ 0.0415 $ 0.0428 $ 0.0441 Phone RiskScore $ 0.0380 $ 0.0380 $ 0.0380 $ 0.0391 $ 0.0403 $ 0.0415 $ 0.0428 $ 0.0441 Digital Intelligence (replaces Device) $ 0.0024 $ 0.0024 $ 0.0024 $ 0.0025 $ 0.0026 $ 0.0026 $ 0.0027 $ 0.0028

Sum of Components $ 0.3018 $ 0.3018 $ 0.3018 $ 0.3109 $ 0.3202 $ 0.3298 $ 0.3397 $ 0.3499

Version 2021-1 6 of 7

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated Agency Project Manager is:

Dane Spencer, DTMB

CIP

MSP HQ, 2nd Floor 7150 Harris Drive Dimondale, MI 48821 517-898-3621 spencerd3@michigan.gov

The designated DTMB Project Manager is:

Amy Chase, DTMB

CIP

MSP-HQ, 2nd Floor 7150 Harris Drive Dimondale, MI 48821 517-855-1066 chasea2@michigan.gov

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Consultants will work at:

Contractor will work remotely.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Version 2021-1 7 of 7

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

This purchase order is a release from Contract Number #MA250000000170. This purchase order, statement of work, and the terms and conditions of Contract Number #MA250000000170 constitute the entire agreement between the State and the Contractor.

320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Fraud Analytics and ID Proofing

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

December 9, 2024 December 8, 2027 5 - 1 Year December 8, 2027

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

885 Tahoe Boulevard, Suite 1

Incline Village NV 89451

Nate Schneemann

810-523-9013

Nate.Schneemann@socure.com

VS0234387

Socure, Inc.

C O

N

TR

A C

TO

R

Kristine Mills

517-242-6402

DTMB

Various Various millsk11@michigan.gov

C on tr ac t A dm in is tr at or

Pr og ra m

M an ag er

ST

A

TE

Net 45

Change Notice Number 1

Contract Number MA250000000170 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Years

$4,097,472.00 $3,199,080.00 $7,296,552.00

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective 11/18/2025, the parties agree to amend the initial Contract Value to correct a clerical error in the execution of the initial agreement. The correct initial value of the agreement is $4,097,472.00.

Further, the parties agree to add funds in the amount of $3,199,080 to provide fraud prevention services for the Department of Treasury as outlined in the attached Statement of Work.

Please note the State has added Melissa Huisken and Kimberly Koppsch-Woods as Program Managers.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement Services approval, and State Administrative Board approval on 11/18/2025.

AGENCY NAME PHONE EMAIL

DTMB Nathan Ebig 517-282-1917 EbigN@michigan.gov

DTMB Kimberly Koppsch-Woods 517-243-8786 Koppsch- WoodsK@michigan.gov

TREA Katina Litterini 517-899-9048 LitteriniK@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 1 TO CONTRACT NO. MA250000000170

Version 2021-1 1 of 20

STATEMENT OF WORK -

IT CHANGE NOTICE

Project Title:

DWT-324 Socure Fraud Prevention

Period of Coverage:

12/08/2025-12/08/2027

Requesting Department:

Michigan Department of Treasury

Date:

10/29/2025

Agency Project Manager:

Katina Litterini

Phone:

517-899-9048

DTMB Project Manager:

Kimberly Koppsch-Woods

Phone:

517-243-8786

Brief description of services to be provided: Provide enhanced fraud prevention for tax returns. To be effective between 12/08/2025 – 12/08/2027.

BACKGROUND:

The purpose of this “Change Notice 1” is to add a Statement of Work to Contract #MA250000000170 (“the Contract”) executed by and between the State of Michigan (“State”) and Socure, Inc (“Contractor” or “Socure”). This Statement of Work is for the provision of services to the Department of Treasury, as described herein and is governed by the terms and conditions of the Contract, dated December 9, 2024 as subsequently modified or amended.

Without limitation, this Change Notice 1 adds, and incorporates by reference, the following to the Contract:

- An additional Statement of Work to the Contract, as described herein;

- The pricing applicable to the Services described herein (the specific rates for which are set forth in Schedule B to the Contract); and

- SCHEDULE E, Attachment 1 – Michigan Dept of Treasury’s Attachment B, which is hereby incorporated into the Contract’s existing Schedule E – Data Security Requirements

Except as expressly provided in this Change Notice 1, all other terms and conditions of this Contract, including all other Statements of Work and any other Schedules, Attachments, and Exhibits, remain unchanged and in full force and effect

PROJECT OBJECTIVE:

Provide an enhanced fraud prevention integration to Socure’s ID+ fraud prevention platform, providing a risk rating based on key information from filed returns.

1. Setup Treasury Administrative dashboard for Socure (Treasury Only)

2. Create and administer accounts for Treasury

Version 2021-1 2 of 20

3. Create Socure ID+ solution (Treasury instance)

4. API (Application programming interface) setup should exist between Treasury

MiMITS (Michigan Income Tax System) and Socure ID+ Treasury instance

5. Contractor will provide the Socure Admin Dashboard, a portal for the SOM to understand performance and outcomes both at the system and user level.

Access controls are administered by the State within the Admin Dashboard.

6. Load, Volume and end-to-end testing will be conducted as agreed to by both the Contractor and the State

7. Contractor will provide access to Socure Admin Dashboard Review (Access to Transactions, Reports, User Management)

8. Contractor will provide access to DevHub Review (Online User Documentation).

Access controls are administered by the State within the Admin Dashboard.

SCOPE OF WORK:

The scope of this project is for Contractor to implement a Treasury specific instance of ID+ Fraud analytics for the State of Michigan that will be used for risk analysis of tax refund information for verification and fraud prevention purposes.

TASKS:

Contractor will provide the requisite resources and knowledge transfer to support the configuration, integration, and deployment of its SaaS-based identity verification and fraud risk solutions in alignment with the SOM’s technical and operational requirements.

The engagement will focus on enabling the SOM to use Socure’s products within their production environment for the agreed-upon use cases.

In alignment with the above-stated commitment, the Contractor will provide technical support to the State as required to assist with the following tasks which are part of the State’s Integration project. Contractor is not responsible for producing project management documents or plans, though it can contribute to the contents thereof in consultation with the State. The following proposed task list will be finalized during the planning phase.

TASK TITLE

Contractor is responsible to deliver

Contractor is responsible to support

1 Pre-Requisites

1.1 Register for Admin Dashboard X

1.2 Add additional users X

1.3 Create Subaccounts X

1.4 Set up recurring meetings X

Version 2021-1 3 of 20

1 Project Planning

1.5 Set up database X

1.6 Create project plan X

1.7 Current user flow(s) (i.e., citizen, business, partner, etc.) X

1.8 Technical Specifications / Use Journey Mapping / Logical Diagram

X

1.9 Confirm attribute parameters and Socure Modules X

1.10 Review Baseline Decision Logic Requirements X

1.11 Create external customer support documentation X

2 API Setup

2.1 Initiation & Design

2.1.1

Finalize use cases & required Socure APIs; define pass/fail thresholds

2.1.2 Network/Security design: IPs for allow-list, mTLS yes/no, auth method, webhook URL pattern

2.1.3 Draft API Specifications (request/response schemas, reason codes, versioning, idempotency key)

2.1.4 Privacy & data-retention decisions (e.g., 30/90/365-day logs) X

2.2 Environment Provisioning & Access

2.2.1 Provision Sandbox tenant and credentials X

2.2.2 Exchange IPs and verify TLS/mTLS connectivity X

2.2.3 Configure outbound/inbound firewall rules and webhooks X

2.2.4 Validate connectivity via ping and auth tests X

2.3 Build & Mapping

2.3.1 Implement POST calls to Socure endpoints X

2.3.2 Map request fields and response parsing X

2.3.3 Implement error handling and retries X

2.3.4 Configure webhook handler for async flows X

2.4 Functional & Negative Testing

2.4.1 Create Test Cases X

2.4.2 Run integration and schema validation tests X

2.4.3 Test error handling and field validation X

2.4.4 Verify decision code mappings X

2.4.5 Update support playbook and test report X

2.5 Performance & Resilience

2.5.1 Load testing at expected TPS X

2.5.2 Validate latency SLOs X

2.5.3 Test retry and circuit breaker logic X

3 UAT & Certification

3.1 Set up UAT Test Runs X

Version 2021-1 4 of 20

3.2 Run UAT1 scripts in Sandbox X

3.3 Switch configuration to Certification Endpoint (Key, API URL) X

3.3 Run UAT2 in Certification (Postive/Negative Testing) X

3.4 Validate audit logging and traceability X

3.5 Tune Decision Logic, as appropriate (ongoing) X

4 Go-Live (General)

4.1 Provision production credentials and IPs X

4.2 Finalize runbooks, dashboards, alerts X

4.3 Complete change tickets and approvals X

4.4 Schedule maintenance window X

5 Post Go-Live

5.1 Perform soft launch X

5.2 Gradually ramp up to 100% X

5.3 Monitor success rate and latency X

5.4 Regular hypercare standups and report out X

DELIVERABLES:

Deliverables will not be considered complete until the Agency Project Manager has formally accepted them. Deliverables for this project include:

Deliverable

Description (expected outcome/document)

Phases

Contractor is responsible to deliver

Contractor is responsible to support

Approvers

API Technical Specifications

Provide Technical specifications for use of Socure Fraud Analytics API.

Design

DTMB Project Manager

Agency Project Manager

Baselined Project

Schedule

Contractor will support development of Socure implementation timeline with FAST integration points included.

Planning

Manager

Agency Project Manager

Application

Security Plan

Contractor will support development of this documentation that details process for granting and revoking access to dashboard.

Development

Manager

System Security

Plan

Contractor will support State’s MISAP process prior to go live.

Manager

Training Plan

Contractor will support development of this document describes the types of training, methods of delivery, delivery timing, and tools used to provide training to Treasury staff.

Manager

Version 2021-1 5 of 20

Training Documentation

Contractor will support development of training collateral that aligns with the types and methods of training described within the Training Plan.

Socure will supply how-to training sessions and product usage documentation details (per role defined by the state) for State staff using the application that the State will compile into official training documentation.

User

Documentation

Provide documentation detailing use of available dashboard functions.

Manager

Agency Project Manager

Performance Analytics

Provide dashboard(s) that details system performance and statistics.

Hyper Care (Post Go-Live) X

N/A

Version 2021-1 6 of 20

PROJECT CONTROL AND REPORTS:

The contractor will support the State’s weekly project management reporting through providing the following:

1. Accomplishments: Indicate what was worked on and what was completed during the current reporting period.

2. Outstanding project tasks: Indicate what tasks are remaining on the project.

3. Project risks / issues: Indicate risks or issues for target completion dates or successful delivery of the project.

SPECIFIC DEPARTMENT STANDARDS:

SCHEDULE E, Attachment 1 – Michigan Dept of Treasury’s Attachment B

PAYMENT SCHEDULE:

Payment will be made based on the transaction amount and actual quantity used. DTMB will pay Contractor upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly.

DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect the transaction amount and actual quantity used and must be approved by the Agency and DTMB Project Manager prior to payment.

Invoices will be issued in accordance with the terms of the Contract. Consistent with the Contract, Payment shall be considered timely if made by DTMB within forty-five (45) days after receipt of properly completed invoices.

Pricing will follow all terms and conditions as found in the Contract under Schedule B – Pricing and shall be supplemented as follows:

Socure ID+ Fraud Analytics

● Setup Fee:

o No additional cost to the State

● Support and Maintenance Fee:

o No additional cost to the State

● Decision Module Fee:

o No additional cost to the State

● Bundle 2 (which includes Identity Verification, Sigma Identity Fraud, Sigma Synthetic Fraud, Sigma Synthetic Fraud, Address risk Score, Email risk Score, Phone risk Score, Device Alert List, Reason Codes):

Base Year Start End Unit

Price Estimate Average

Usage Amt Anticipated Invoice Date

Version 2021-1 7 of 20

2 12/8/2025 1/7/2026 $0.3018 ~$133,295.00 Feb-26

2 1/8/2026 2/7/2026 $0.3018 ~$133,295.00 Mar-26

2 2/8/2026 3/7/2026 $0.3018 ~$133,295.00 Apr-26

2 3/8/2026 4/7/2026 $0.3018 ~$133,295.00 May-26

2 4/8/2026 5/7/2026 $0.3018 ~$133,295.00 Jun-26

2 5/8/2026 6/7/2026 $0.3018 ~$133,295.00 Jul-26

2 6/8/2026 7/7/2026 $0.3018 ~$133,295.00 Aug-26

2 7/8/2026 8/7/2026 $0.3018 ~$133,295.00 Sep-26

2 8/8/2026 9/7/2026 $0.3018 ~$133,295.00 Oct-26

2 9/8/2026 10/7/2026 $0.3018 ~$133,295.00 Nov-26

2 10/8/2026 11/7/2026 $0.3018 ~$133,295.00 Dec-26

2 11/8/2026 12/7/2026 $0.3018 ~$133,295.00 Jan-27

Annual Total $1,599,540.00

3 12/8/2026 1/7/2027 $0.3018 ~$133,295.00 Feb-27

3 1/8/2027 2/7/2027 $0.3018 ~$133,295.00 Mar-27

3 2/8/2027 3/7/2027 $0.3018 ~$133,295.00 Apr-27

3 3/8/2027 4/7/2027 $0.3018 ~$133,295.00 May-27

3 4/8/2027 5/7/2027 $0.3018 ~$133,295.00 Jun-27

3 5/8/2027 6/7/2027 $0.3018 ~$133,295.00 Jul-27

3 6/8/2027 7/7/2027 $0.3018 ~$133,295.00 Aug-27

3 7/8/2027 8/7/2027 $0.3018 ~$133,295.00 Sep-27

3 8/8/2027 9/7/2027 $0.3018 ~$133,295.00 Oct-27

3 9/8/2027 10/7/2027 $0.3018 ~$133,295.00 Nov-27

3 10/8/2027 11/7/2027 $0.3018 ~$133,295.00 Dec-27

3 11/8/2027 12/7/2027 $0.3018 ~$133,295.00 Jan-28

Annual Total $1,599,540.00

Usage fees are estimated to average $133,295/month for variable usage costs with services beginning in December 2025. Total value through the term of the Statement of work is $3,199,080.00. Total charges are estimated, and the State is under no obligation to utilize all; the State will pay invoices that reflect the actual usage cost.

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

Version 2021-1 8 of 20

PROJECT CONTACTS:

The designated Agency Project Manager is:

Katina Litterini Michigan Department of Treasury Tax Administration Services Bureau State Operations Center, 2nd Floor 7285 Parsons Drive Dimondale, MI 48821 517-636-4192 LitteriniK@michigan.gov

The designated DTMB Project Manager is:

Kim Koppsch-Woods

DTMB

State of Michigan Operations Center (Treasury & DTMB) 7285 Parsons Dr.

Dimondale, MI 48821

(517) 243-8786 Koppsch-WoodsK@michigan.gov

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Consultants will work remotely.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

Contractor does not perform professional services and fees for this project are based on transaction volume and actual quantity used.

This purchase order is a release from Contract Number #MA250000000170. This purchase order, statement of work, and the terms and conditions of Contract Number #MA250000000170 constitutes the entire agreement between the State and the Contractor.

mailto:LitteriniK@michigan.gov mailto:Koppsch-WoodsK@michigan.gov

Version 2021-1 9 of 20

PROJECT PLAN:

Tentative dates to be confirmed in planning phase of project.

Task Start Date Finish Date Connectivity Test & Planning Phase

11/3/2025 11/14/2025

Design and Development 11/18/2025 12/19/2025 Testing 12/22/2025 1/16/2026 Implementation 1/16/2026 1/18/2026 Go-Live 1/19/2026 1/19/2026

Version 2021-1 10 of 20

SCHEDULE E, Attachment 1 – Michigan Dept of Treasury’s Attachment B

SAFEGUARD REQUIREMENTS OF CONFIDENTIAL TAX DATA

This section sets forth the safeguard requirements for handling, storage, and processing of confidential tax information for a Contractor and their subcontractor(s) and is incorporated as an integral part of the Contract.

It will facilitate administration and enforcement of the laws of the State of Michigan in a manner consistent with the applicable statutes, regulations, published rules and procedures or written communication.

I. Authority

Authority for the Michigan Department of Treasury to require that this section be included in the Contract is contained in l941 PA 122, as amended, MCL 205.28(1)(f), which subjects current or former contractors to the same restrictions and penalties imposed upon department employees regarding the treatment of confidential information. A private contractor or its employees are strictly prohibited from disclosing taxpayer information to a third party. The prohibition against disclosure does not bar an employee of a private contractor with whom the State of Michigan (State) contracts that processes tax returns or payments pursuant to the Contract from having access to confidential information that is reasonably required for the processing or collection of amounts due this State. Private contractors and any subcontractors will follow Treasury guidelines for Authorized representatives.

II. Confidentiality

It is agreed that all information exchanged under this section will be kept confidential in accordance with the confidentiality provisions contained in the Revenue Act, MCL 205.28(1)(f) which states in part;

“Except as otherwise provided in this subdivision, an employee, authorized representative, or former employee or authorized representative of the department or anyone connected with the department will not divulge any facts or information obtained in connection with the administration of a tax or information or parameters that would enable a person to ascertain the audit selection or processing criteria of the department for a tax administered by the department.”

Confidential information obtained under this contract will not be disclosed except as required by state law, or in the proper administration of applicable laws, promulgated rules and procedures. In the event, confidentiality statutes are amended, Treasury will notify Contractor of any changes. No employee, agent, authorized representative or legal representative of Contractor will disclose any information obtained by virtue of this section to any other governmental agency, department or unit within such governmental agency whether local, state, federal or foreign, department or unit within such governmental agency, or any unauthorized third party.

No tax returns or tax return information accessed by Contractor will be duplicated or disseminated outside the company without the written approval of the Contract Compliance Inspector. Tax returns and tax return information remain the property of Treasury.

Contractor may use a taxpayer’s name, address and Social Security number or employer identification number to the extent necessary in connection with the processing and mailing of forms for any report or return required in the administration of any tax in the performance of the Contract. The use of the Social Security number must be in accordance with the state Social Security Number Privacy Act 454 of 2004, as amended.

Confidential information obtained under this agreement will not be disclosed in part of a report or document that is subject to FOIA.

The penalties for violating the confidentiality provisions of the Revenue Act are contained in, MCL 205.28(2) and MCL 205.27(4). MCL 205.28(2) states:

“A person who violates subsection (1)(e), (1)(f), (4) or (5) is guilty of a felony, punishable by a

Version 2021-1 11 of 20 fine of not more than $5,000.00, or imprisonment for not more than 5 years, or both, together with the costs of prosecution. In addition, if the offense is committed by an employee of this state, the person will be dismissed from office or discharged from employment upon conviction.”

MCL 205.27(4) states:

A person who is not in violation pursuant to subsection (2), but who knowingly violates any other provision of this act, or of any statute administered under this act, is guilty of a misdemeanor, punishable by a fine of not more than $1,000.00, or imprisonment for not more than 1 year, or both.

Information received by Treasury from the U.S. Internal Revenue Service, pursuant to section 6103(d) of the Internal Revenue Code or any other federal agency will not be subject to the exchange.

III. Procedure for Security

The State shall only submit State tax return information through the Service Platform. Contractor will safeguard any tax return information obtained under the Contract as follows:

A. Access to the tax returns and tax return information will be allowed only to those authorized employees and officials of Contractor who need the information to perform their official duties in connection with the uses of the information authorized in this Contract.

B. Any records created from tax returns and tax return information will be stored in an area that is physically safe from access by unauthorized persons during duty hours and locked in a secure area during non-duty hours, or when not in use.

C. Any records matched and any records created by the match will be processed under the immediate supervision and control of authorized personnel in a manner in which will protect the confidentiality of the records, and in such a way that unauthorized persons cannot retrieve any such records by means of a computer, remote terminal or other means.

D. All personnel who will have access to the tax returns and tax return information and to any records created by the tax return information will be advised annually of the confidential nature of the information, the safeguards required to protect the information and the civil and criminal sanctions for noncompliance contained in MCL

205.28 (2) and MCL 205.27(4) and will sign confidentiality certifications.

E. All confidential information, electronic and paper, will be secured from unauthorized access and with access limited to designated personnel only. State tax return information will be logically separated from other third party confidential information.

F. Treasury, Office of Privacy and Security or Contract Compliance Inspector may make onsite inspections or make other provisions to ensure that adequate safeguards are being maintained by the Contractor.

G. The Treasury Office of Privacy and Security may monitor compliance of systems security requirements during the lifetime of the Contract or any extension.

H. Contractor will also adopt policies and procedures to ensure that information contained in their respective records and obtained from Treasury and taxpayers will be used solely as stipulated in the Contract.

IV. Computer System Security of Tax Data

The identification of confidential tax records and defining security controls are intended to protect Treasury tax return information from unlawful disclosure, modification, destruction of information and unauthorized secondary uses.

Version 2021-1 12 of 20

Computer system security and physical security of tax data stored and processed by Contractor must be in compliance with the following security guidelines and standards established by Treasury. These guidelines apply to any computer system developed by Contractor, either through its own systems staff, or through a contractor, subcontractor or vendor):

A. Controlled Access Protection All computer systems processing, storing and transmitting Michigan tax information must have computer access protection controls These security standards are delineated in the National Institute of Standards and Technology (NIST) Special Publications number 800-53 “Recommended Security Controls for the Federal Information Systems” at http://csrc.nist.gov/publications/PubsSPs.html. To meet these standards, the operating security features of the system must have the following minimum requirements: a security policy, accountability, assurance, and documentation.

1) Security Policy – A security policy is a written document describing the system in terms of categories of data processed, users allowed access and access rules between the users and the data. Additionally, it describes procedures to prevent unauthorized access by clearing all protected information on objects before they are allocated or reallocated out of or into the system. Further protection must be provided where the computer system contains information for more than one program/project, office, or Agency and that personnel do not have authorization to see all information on the system.

2) Accountability – Computer systems processing Michigan tax information must be secured from unauthorized access. All security features must be available (audit trails, identification and authentication) and activated to prevent unauthorized users from indiscriminately accessing Michigan tax information. Everyone who accesses computer systems containing Michigan tax information is accountable. Access controls must be maintained to ensure that unauthorized access does not go undetected. Computer programmers and contractors who have a need to access databases, and are authorized under the law, must be held accountable for the work performed on the system. The use of passwords and access control measures must be in place to identify who accessed protected information and limit that access to persons with a need to know.

a) On-line Access –Users will be limited to any Treasury on-line functions, by limiting access through functional processing controls and organization restrictions.

Any employee granted access privileges through the Contractor’s Security Administrator will be approved for access and viewing rights to Treasury on-line systems by the Department of Treasury, Office of Privacy and Security.

b) Operating Features of System Security

Contractor must meet the following levels of protection with respect to tax return information.

Individual user accountability must be ensured through user identification number and password.

i. Access rights to confidential tax information must be secured through appropriate levels of authorization.

ii. An audit trail must be maintained of accesses made to confidential information.

iii. All confidential and protected information must be cleared from a system before it is used for other purposes not related to the enforcement, collection or exchange of data not covered by this section or by an addendum to this Contract.

iv. Hard copies made of confidential tax return information must be labeled as confidential information.

v. Confidential Treasury tax information will be blocked or coded as confidential on system.

vi. Any employee or Permitted Subcontractor of Contractor that can logically access State Tax information through Contractor systems must be notified of the following disclosure penalties for improperly accessing or making an authorized disclosure of Michigan tax return http://csrc.nist.gov/publications/PubsSPs.html

Version 2021-1 13 of 20 information:

NOTICE TO EMPLOYEES AND AUTHORIZED REPRESENTATIVES

This system contains Michigan Department of Treasury tax return information. DO

NOT DISCLOSE OR DISCUSS MICHIGAN RELATED TAX RETURN INFORMATION

with unauthorized individuals. The Revenue Act at MCL 205.28(1)(f) prohibits such disclosure.

MICHIGAN PENALTIES

A person making a willful unauthorized disclosure or inspection (browsing) of tax return information may be charged with the following Michigan penalties:

• Criminal penalties up to $5,000 and/or imprisonment for 5 years, plus costs and dismissal from employment if it is found that a current or former employee or authorized representative has made an unauthorized disclosure of a tax return or tax return information or divulged audit selection or processing parameters. [MCL 205.28(2)]

• A misdemeanor, punishable by a fine of not more than $1,000.00, or imprisonment for not more than 1 year, or both if the person is not in violation pursuant to MCL 205.27(2), but who knowingly violates any other provision of this act, or of any statute administered under this act.

This statement is subject to modification. A confidentiality statement, subject to modification, will be sent as needed by the Security Administrator to all employees, contractors, and legal representatives of Contractor.

3) Assurance – Contractor must ensure that all access controls and other security features are implemented and are working when installed on their computer system. Significant enhancements or other changes to a security system must follow a process of review, independent testing, and installation assurance. The security system must be tested at least annually to assure it is functioning correctly. All anomalies must be corrected immediately.

a. The Contractor must execute corrective action for all non-conformities in conformance with the expressed terms of the Contract.

4) Documentation – Design and test documentation must be readily available to the state. The developer or manufacturer should initially explain the security mechanisms, how they are implemented and their adequacy (limitations). This information should be passed on to the security officer or supervisor. Test documentation should describe how and what mechanisms were tested and the results. If recognized organizations/tests/standards are used, then a document to that effect will suffice. For example, a system that has been tested and certified as meeting certain criteria may have a document stating this fact, without detailed tests/results of information. Contractor, however, must ensure the documentation covers the exact system and that it includes the specific computer system used by Contractor.

Additionally, documentation must include a security administrator’s guide. The security administrator’s guide is addressed to the System’s Administrator and Security Officer and will describe the protection mechanisms provided by the security system, guidelines on their use and how they interact. This document will present cautions about security functions and describe privileges that should be controlled when running a secure system. The document will be secured and locked at all times with access rights only by the Systems Administrator and Security Officer.

Note: When a security system is designed or purchased for a specific computer or computer system, the security mechanisms must be reviewed by the State to ensure that needed security parameters are met. Aan independent test should be implemented on the specific computer or computer system to ensure that the security system meets the security parameters within this contract and developed with the computer system.

The test may be arranged by the developer but must be done by an independent organization. Contractor must

Version 2021-1 14 of 20 assign responsible individuals (Security Officers) with knowledge of information technology and applications to oversee the testing process. These individuals must be familiar with technical controls used to protect the system from unauthorized entry. Submission of an audit report by an independent third party shall be deemed to be compliant with the requirements in this Note, provided that the independent auditor used to perform such FedRAMP Annual Assessment shall be a FedRAMP approved Third Party Audit Organization (3PAO).

Finally, contingency and backup plans must be in place to ensure protection of Michigan tax information.

V. Electronic Transmission of Michigan Tax Information

The two acceptable methods of transmitting Michigan tax information over telecommunications devices are encryption and using guided media. Encryption involves altering data objects in a way that the objects become unreadable until deciphered with the appropriate software at the intended destination. Guided media involves transmission of data over twisted pair cable, coaxial cable or end to end fiber optics which are typically used in secure computer networks like the state’s Local Area Network (LAN), telephone systems, and television distribution.

Cryptography standards have been adopted by the IRS and can be used to provide guidance for encryption, message authentication codes or digital signatures and digital signatures with or without an associated certification infrastructure. For further information, see IRS Publication 1075 at the IRS web site.

Unencrypted cable circuits of fiber optics are an acceptable alternative for transmitting Michigan tax information. Adequate measures must be taken to ensure that circuits are maintained on cable and not converted to unencrypted radio or microwave transmission. Additional precautions should be taken to protect the cable, i.e., burying the cable underground or in walls or floors and providing access controls to cable vaults, rooms and switching centers.

A. Remote Access

Accessing databases containing Michigan tax information from a remote location – that is, a location not directly connected to the Local Area Network (LAN) will require adequate safeguards to prevent unauthorized entry.

For remote access, the contractor is required to use an identification security card that requires both PIN and card in possession. The State identified and approved methods for remote vendor access are as follows:

• SecureID through VPN – State provided SecureID taken and VPN software in order to access State of Michigan resources. Appropriate Acceptable Use policies and signoffs are required

• Follow-the Sun SecureID – Vendor is provided with VPN software and a SOM technical resource coordinates with the DTMB Client Service Center to provide secure ID code access to specific State of Michigan resources. Appropriate Acceptable Use Policies and signoffs are required.

B. Portable Computer Devices

Any entrusted confidential information collected or accessed during this Contract must be encrypted when stored on all storage devices and media. This includes, but not limited to, disk drives for servers and workstations, and portable memory media (PDAs, RAM drives, memory sticks, etc.).

VI. Record Keeping Requirements for Information Received

Each Contractor, requesting and receiving information will keep an accurate accounting of the information received. The audit trail will be required which will include the following information to the extent it is received by the Contractor:

Version 2021-1 15 of 20

a. Taxpayer's name

b. Identification number

c. Information requested

d. Purpose of disclosure request

e. Date information received

f. Name of Division and employee making request

g. Name of other employees who may have had access

h. Date destroyed

i. Method of destruction

The Contractor will adopt and implement formal procedures to:

• Ensure proper handling of tax returns and tax return information;

• Secure and safeguard information from unauthorized use; and

• Ensure appropriate destruction of information and materials retrieved from Treasury.

A. Electronic Media

Contractor will keep an inventory of magnetic and electronic media received under the Contract.

Contractor must ensure that the removal of tapes and disks and paper documents containing Michigan tax return information from any storage area is properly recorded on charge-out records. Contractor is accountable for missing tapes, disks, and paper documents.

B. Recordkeeping Requirements of Disclosure Made to State Auditors

When disclosures are made by Contractor to State Auditors, these requirements pertain only in instances where the Auditor General’s staff extracts Michigan tax returns or tax information for further review and inclusion in their work papers. Contractor must identify the hard copies of tax records or if the tax information is provided by magnetic tape format or through other electronic means, the identification will contain the approximate number of taxpayer’s records, the date of inspection, the best possible description of the records and the name of the Auditor(s) making the inspection.

The Disclosure Officer must be notified, in writing, of any audits done by auditors, internal or otherwise, of Contractor that would involve review of Treasury processing parameters.

VII. Contract Services

To the extent the Contractor employs an independent agency, consultant, or agent to process confidential information which includes Michigan tax return information; the Contractor will notify the Treasury Disclosure Officer before the execution of any such agreement. Each agreement will include in the agreement the following recommended safeguard provisions:

A. The identification of confidential tax records and defining security controls are intended to protect Treasury tax return information from unlawful disclosure, modification, destruction of information and unauthorized secondary uses.

B. Definition of Treasury Tax Return Information as defined in Revenue Administrative Bulletin (RAB) 1989- 39:

Taxpayer’s identity, address, the source or amount of his/her income, payments, receipts, deductions, exemptions, credits, assets, liabilities, net worth, tax liability, tax withheld, deficiencies, over assessments, or tax payments whether the taxpayer’s return was, is being or will be examined or subject to their investigation or processing, or any other data, received by, recorded by, prepared by, furnished to or collected by the agency with respect to a return or with respect to the determination of the existence, or liability (or the amount thereof) of any person under the tax laws administered by the Department, or related statutes of the state for

Version 2021-1 16 of 20 any tax, penalty, interest, fine, forfeiture, or other imposition or offense. The term “tax return information” also includes any and all account numbers assigned for identification purposes.

C. An acknowledgment that a taxpayer has filed a return is known as a “fact of filing” and may not be disclosed. All tax return data made available in any format will be used only for the purpose of carrying out the provisions of the Contract between Contractor and the sub-contractor. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract between Contractor and the subcontractor. In addition, all related output will be given the same level of protection as required for the source material.

D. The subcontractor will certify that the data processed during the performance of the Contract between Contractor and the subcontractor will be completely purged from all data storage components of the subcontractor’s computer facility upon request, and no output will be retained by the subcontractor at the time the work is completed.

E. Destruction of tax data, including any spoilage or any intermediate hard copy printout which may result during the processing of Michigan tax return information, will be documented with a statement containing the date of destruction, description of material destroyed, and the method used.