3-Addendum 2 - IT Consultant Services Final.pdf

METROPOLITAN AIRPORTS COMMISSION

IT CONTINUING CONSULTANT SERVICES

REQUEST FOR QUALIFICATIONS

ADDENDUM 2

August 22, 2025

This is an addendum to the RFP and shall now become a part of the solicitation documents.

The following are draft terms and conditions for a Professional Services Agreement as well as a template Statement of Work. The MAC provides these draft terms and conditions for the benefit of Proposers in formulating their responses. The MAC reserves the right to adjust these terms and conditions within the context of negotiations with successful proposers. Proposers are encouraged to carefully read the following terms and conditions and provide any requested edits to them as part of their responses

1. The previously omitted Attachment 1: Professional Services Agreement (PSA), is now formally included in the Request for Quotation (RFQ) by the incorporation of the document below.

2. The previously omitted Attachment 3: Statement of Work, is now formally included in the RFQ by the incorporation of the document below.

ADDENDUM

All other provisions of the RFP text remain unchanged.

Vendor hereby acknowledges receipt and understanding of the changes.

Vendors must confirm their receipt and understanding of this addendum and the associated changes by completing the required Addendum Acknowledgment item under Requested Information on the solicitation site.

ATTACHMENT 1

PROFESSIONAL SERVICES AGREEMENT (PSA)

PROFESSIONAL SERVICES AGREEMENT (“PSA”)

Consultant Information

MAC Information

Legal Name: ______________________________ (“Consultant”) Notice Address:

Notice Email:

Metropolitan Airports Commission (“MAC”) Notice Address:

6040 28th Avenue South Minneapolis, Minnesota 55450-2799 Notice Email:

Agreement Term

Effective Date End Date

Agreement Execution

Consultant’s authorized representative must execute this PSA. By executing, Consultant’s authorized representative attests that he or she has authority to bind Consultant with respect to each obligation undertaken by Consultant pursuant to this PSA.

This PSA may be executed in any number of counterparts, each of which is considered an original. Valid execution occurs when the signature page is executed by the Consultant and countersigned by the MAC.

The parties agree that the electronic signatures, whether digital or encrypted, by their respective signatories are intended to authenticate such signatures and to give rise to a valid contract.

IN WITNESS WHEREOF, this Professional Services Agreement has been executed by the METROPOLITAN AIRPORTS COMMISSION and by the Consultant.

METROPOLITAN AIRPORTS COMMISSION

By Title Date

CONSULTANT

By Title Date

IT Continuing Consultant Services – Addendum 2 3

PROFESSIONAL SERVICES AGREEMENT

This Professional Services Agreement is made on the Effective Date between the Metropolitan Airports Commission, a public corporation of the State of Minnesota, and the Consultant. In consideration of the mutual promises and covenants set forth herein, the parties agree as follows:

1. Term. The Term of this Agreement will begin on the Effective Date and expire, unless earlier cancelled, on the End Date. The MAC may, upon written notice to Consultant, extend this Agreement no more than six months beyond the End Date in order to bring to completion work authorized under an executed Statement of Work.

2. Work to be Performed. The MAC retains the Consultant to perform professional services as described in individual Statements of Work issued subordinate to this agreement. Execution of this PSA is not a guarantee that the MAC will authorize work for the Consultant under a Statement of Work.

3. Statements of Work. Consultant may be authorized to perform services related to a project, a role, or defined area of expertise pursuant to a Statement of Work. Consultant may not begin work on any assignment until the applicable Statement of Work is executed between the parties. Prior to the execution of a Statement of Work, the MAC may request Consultant to provide a description of the services to be provided, an estimated timetable for completion of the services, and other, related information. Consultant may be authorized to work prior to the execution of a Statement of Work solely to advise on the development of the Statement of Work.

4. Deliverables.

4.1. Deliverables. The term, “Deliverables,” includes any inventions (whether patentable or not), copyrights and copyrightable works, information, designs, documents, know-how, data, and findings developed by Consultant and delivered to the MAC under this PSA.

4.2. Format of Delivery. The MAC may specify a preferred format for any Deliverable.

4.3. Intellectual Property (Deliverables). Deliverables are works made for hire and are owned by the

MAC upon delivery to the MAC. Consultant assigns all intellectual property rights in the Deliverables to the MAC. To the extent that any work product delivered to the MAC under this PSA includes any invention, design, know how or copyrightable work that Consultant developed prior to this PSA or other than in connection with the services provided under this PSA (“Pre- Existing Works”), Consultant grants to the MAC a non-exclusive, perpetual, world-wide, royalty-free irrevocable right and license to make, use, sell, offer for sale, create derivative works from and otherwise use such Pre-Existing Works in connection with the Deliverables and any derivative of the Deliverables.

4.4. Generative A.I. To ensure that all Deliverables remain eligible for proper intellectual property protections by the MAC, Consultant will prohibit the use of “Generative A.I. Tools” by its employees and independent contractors assigned to work on Deliverables under this PSA. “Generative A.I.

Tools” mean those tools that use a database of pre-existing material to artificially generate new combinations of text, images, video, and music, drawing from this pre-existing material. Specific use of a Generative A.I. Tool may be authorized by the MAC within the context of an executed Statement of Work that identifies the tool to be used and defines the tool’s authorized use.

5. Compensation.

5.1. Basis of Payment. The MAC will compensate Consultants on the basis of hours of work expended at rates included upon an approved Rate Card. Other bases of payment (such as lump sum, progress payments, etc.) may be approved within the context of an executed Statement of Work that describes the alternate basis of payment.

5.2. Rate Cards. Consultant must provide to the MAC a document, which identifies the roles or personnel whose time will be billed under this PSA, each individual’s billing rate, and, if requested by the MAC, the method used to develop the billing rate (“Rate Card”). The Rate Card may be approved along with the execution of this PSA, as an addendum to this PSA, or may be approved

IT Continuing Consultant Services – Addendum 2 4 along with the execution of a Statement of Work. The Rate Card may be updated upon agreement by the Parties, no more than once per year, unless updated as part of the execution of a new Statement of Work.

5.3. Work Week & Overtime. The Consultant may not bill for more than the standard forty (40) hour week for any individual without prior, written authorization from the MAC. If the MAC approves overtime work, then the Consultant may bill the MAC at 1.5 times the rate established for the individual under the applicable rate card for any hours worked above forty hours, but only for individuals who are required to be compensated at a higher overtime rate according to federal/state law. Such individuals must be identified as “Non-Exempt” on the Rate Card. If Consultant bills for overtime that was not approved, or for hours worked by an individual not noted as “Non-Exempt” on the Rate Card, the MAC may reject the invoiced overtime billable hours. For the avoidance of doubt, Consultant is still required to pay its employees overtime pursuant to relevant federal or state laws regardless of the MAC’s payment or non-payment of overtime hours.

5.4. MAC Holidays. Consultant may not bill for hours worked on holidays observed by the MAC, unless written pre-approval is obtained from the MAC. A list of MAC Holidays is available from the MAC PSA Purchasing Coordinator. The MAC will not pay an increased rate for work conducted on MAC Holidays.

5.5. Reimbursable Expenses. Reimbursement for travel and subsistence expenses actually and necessarily incurred by Consultant as a result of any work conducted under this PSA will only be reimbursed in the manner and in no greater amount than is provided for in the current “Consultant Expense Guidelines” available from the MAC PSA Purchasing Coordinator.

5.6. Time Reporting. The MAC may require Consultant to enter time using a MAC-provided and hosted time-tracking solution.

5.7. Authorized Amounts. Statements of Work between the MAC and Consultant contain a “Not to Exceed” amount. Consultant may not bill for more than the “Not to Exceed” amount without prior amendment of the Statement of Work.

5.8. Invoicing. Consultant must electronically submit detailed invoices for all services rendered, as well as any reimbursable expenses incurred, under this PSA on a monthly basis. Each invoice must contain the Authorization Number listed on the Statement of Work. All invoices must be submitted to the address identified in the Statement of Work and comply with any further instructions included in the Statement of Work.

5.9. Payment by MAC. [Minn. Stat. § 471.425]. The MAC agrees to pay Consultant within thirty (30) days of the completion of its audit of a properly received, valid invoice. If an invoice is incorrect, defective, or otherwise improper, the MAC will notify Consultant within ten (10) days of discovering the error, and will pay Consultant within thirty (30) days of the completion of its audit of a properly received, corrected invoice from Consultant. Payments not made within thirty (30) days after the date the MAC’s audit of the invoice is completed, unless contested by the MAC, will bear interest at a rate of one and one-half percent (1.5%) per month unless otherwise provided in Minn. Stat. §

471.425. Such interest will begin to accrue thirty (30) days following the MAC’s audit of the invoice, or corrected invoice, is completed.

5.10. Subcontractor Prompt Payment. [Minn. Stat. § 471.425, subd. 4a; Minn. Stat. § 473.142(f)] Consultant must pay to each subcontractor to this PSA within ten (10) calendar days of Consultant’s receipt of payment from the MAC for undisputed services provided by the subcontractor. If Consultant does not make said payment to any subcontractor within the specified time, Consultant must pay interest to the subcontractor in the amount of one and one-half percent (1.5%) per month, or any part of the month, on any undisputed amount not paid on time to the subcontractor. The minimum monthly interest penalty payment for an unpaid balance of one-hundred dollars ($100) or more is ten dollars ($10). For an unpaid balance of less than one-hundred dollars ($100), Consultant must pay the actual penalty due to the subcontractor.

To the extent a subcontractor provides for earlier or larger payments, Consultant shall make payment to the subcontractor as provided for therein irrespective of the date or amount of any

IT Continuing Consultant Services – Addendum 2 5 payment made by the MAC. A subcontractor who prevails in a civil action to collect interest penalties from Consultant must be awarded its costs and disbursements, including attorney fees, incurred in bringing the action. Anything to the contrary in the PSA notwithstanding, this Section 5.10 is for the benefit of any subcontractor to this PSA and confers upon any subcontractor all remedies, claims, reimbursements, causes of action, and other rights granted to it by this Section 5.10.

5.11. Payment Audit. [Minn. Stat. § 16C.05, subd. 5.]. Consultants and subcontractors to this PSA must keep, in a system acceptable to the MAC, accurate books, accounts, records, and documents relevant to the work conducted under this PSA for a period of six calendar years.

MAC and the Legislative Auditor may inspect the books, accounts, records, documents, interview current and former employees, accounting procedures and practices relative to the work conducted under this PSA. Contracts entered into with subcontractors must contain this same contract audit clause. Consultants must pay all audit costs when an audit discloses overcharges exceeding one percent (1%) of the total authorized amount under the Statement(s) of Work under consideration in the audit.

6. Cancellation & Termination.

6.1. Cancellation. The MAC may cancel this PSA, or any Statement of Work, with or without cause, upon thirty (30) days’ prior written notice to Consultant.

6.2. Termination. This PSA will terminate upon the End Date, unless extended by the MAC.

6.3. Compensation. If this PSA is cancelled or terminated, Consultant will be owed no compensation except for payment of amounts due and owing for work performed and expenses incurred up to the date Consultant was notified of cancellation or termination.

6.4. Draft Deliverables. If this PSA is cancelled or terminated prior to the completion of any Deliverables described in an executed Statement of Work, the Consultant must deliver to the MAC, at no additional charge, all draft Deliverables, regardless of their state of completion, which material shall become the property of the MAC upon delivery. The Consultant may include a statement that the draft Deliverables are provided "as is," and that the MAC assumes all risks associated with their use. The MAC may share these draft Deliverables with qualified professionals for completion of the project(s) left unfinished. Such qualified professionals shall assume Consultant's professional obligations and liability for work not completed by Consultant.

6.5. Survival. Upon termination at the End Date, or earlier cancellation of the PSA, the terms and conditions in this PSA that by their sense and context are intended to survive the performance hereof by either or both parties hereunder shall so survive the termination, cancellation, or completion of performance of the PSA.

7. Non-Disclosure.

7.1. Confidential Information. “Confidential Information” includes all information disclosed by the

MAC to Consultant in connection with the work conducted under this PSA, whether disclosed orally, visually, or in any tangible or electronic form and whether received before, on the date of, or after the signing of this PSA.

7.2. Non-Disclosure. Confidential Information provided to Consultant will be held by Consultant in strict confidence and will not be disclosed, directly or indirectly, to any third party, except with the prior written consent of the MAC, or as specifically allowed by this PSA.

7.3. Permitted Disclosures. Consultant may disclose Confidential Information to those of its representatives, consultants, and employees who have a need-to-know such information (“Third Parties”), provided that, prior to disclosure, Consultant will inform each Third Party of the confidential nature of the information and each Third Party must be bound as a condition of their employment, or have executed an agreement with Consultant sufficient to enable that Third Party’s compliance with the terms of this Section 7. Third Parties will not make notes of, copy or reproduce any Confidential Information in any form, except as reasonably required for completion of their assigned tasks.

IT Continuing Consultant Services – Addendum 2 6

8. Warranties.

8.1. Industry Standards. Consultant must perform the duties and services under this PSA in accordance with industry standards established by those engaged in a business similar to that of Consultant.

8.2. Service Warranty. Consultant warrants that all duties and services under this PSA will be performed in a safe, good, and workmanlike manner.

8.3. Licenses, Permits, Authorizations, and Notices. Consultant warrants that it has obtained and will maintain at its sole cost and expense all federal, state, and local licenses (including professional licenses), permits, certificates, and authorizations, and shall provide all required notices, necessary for Consultant to perform the duties and services under this PSA.

8.4. Warranty for Infringement. Consultant warrants that it has, or will obtain, all the necessary licenses and authorizations to use any third-party intellectual property necessary to perform the professional services contemplated by this PSA, or any third-party intellectual property that will be incorporated into any product used in connection with these services or report delivered to the MAC. Consultant warrants that no product used in connection with these services; nor report delivered to the MAC; nor the use, sale, disclosure, execution, reproduction, modification, adaptation, distribution, performance, or display thereof; to the extent permitted under this PSA; knowingly infringes or misappropriates any patent, copyright, trade secret, or other intellectual property right of any third party.

8.5. Infringement Indemnity. If any services contemplated by this PSA give rise to an actual or claimed infringement or misappropriation of any patent right, copyright, trade secret, or other intellectual property right, or for any other reason, then Consultant will, at Consultant's option and expense, perform any of, or any combination of, the following: (a) defend or, at its option, settle any claim that Consultant has infringed or misappropriated any patent, copyright, trade secret or other intellectual property right of any third party; (b) procure for itself the right to continue; (c) replace or modify its services so that Consultant is not infringing or misappropriating, provided that the replacement or modified services conform to all requirements of this PSA; or (d) cancel this PSA and reimburse MAC for all reasonable and documented amounts expended procuring alternative services.

9. Compliance with Laws, Regulations, Ordinances, Rules & Policies. Consultant must comply with all laws, regulations, ordinances, and rules of the Federal, State, and local government including those of the MAC, which may be applicable to performance of this PSA. Additionally, Consultant will comply with any MAC Policy given to the Consultant by the MAC.

10. Right to Hire. The MAC reserves the right to hire any qualified individual who was solicited for employment through a public solicitation generally available to all qualified applicants, that individual’s current or former employment by Consultant notwithstanding.

11. Subcontracting. Consultant is permitted to subcontract pursuant to this PSA with entities or individuals identified to the MAC within the context of an executed Statement of Work. Consultant agrees that it will have in place with any relevant subcontractor sufficient agreements or proof of compliance to give effect to Consultant's obligations under this PSA. Consultant expressly acknowledges that Consultant is liable to the MAC for its relevant subcontractors’ compliance with this PSA.

12. Minnesota Government Data Practices Act. [Minn. Stat. § 13.05, subd. 11]. Consultant is notified that the Minnesota Government Data Practices Act, Minnesota Statutes, chapter 13. (“the Act”) places obligations upon Consultant. All data shared with the MAC are subject to the requirements of the Act. In no circumstances will this PSA impair the MAC’s ability to comply with the Act. If applicable, Consultant will comply with the requirements of Minnesota Statutes, section 13.05, subdivision 11(a) with respect to all data created, collected, received, stored, used, maintained, or disseminated in the course of performance of this PSA (“MAC Data”). The civil remedies of Minnesota Statute, section 13.08 apply to the release of MAC Data. If Consultant

IT Continuing Consultant Services – Addendum 2 7 receives a request to release MAC Data, Consultant must immediately notify the MAC and Consultant must not release MAC Data until receiving instructions to do so from the MAC.

13. Data Governance.

13.1. Data License. MAC grants to Consultant a limited, non-exclusive, non-transferable, non-sublicensable, royalty-free license during the Term of the PSA to use MAC Data solely for the conducting of work under this PSA and only for the purposes approved in writing by MAC at the time of transfer. Consultant agrees not to use MAC Data except as expressly authorized by the immediately foregoing sentence. Without limiting the generality of the foregoing, Consultant may not: (i) sell, lease, loan, sublicense, distribute, publish, or otherwise transfer MAC Data (even if deidentified and aggregated) or any accompanying documentation to any person, firm, or entity, except as agreed in writing by MAC; (ii) alter, modify, adapt, decompile, or reorganize MAC Data, except as agreed in writing by MAC; nor may Consultant (iii) use MAC Data (even if deidentified and aggregated) for its own promotional, developmental, or analytical purposes. In addition, Consultant may not publish or distribute MAC Data in any form to any third party or place the data onto any server that it is accessible via a public network.

13.2. Intellectual Property Rights (MAC Data). Except for the licenses granted by the MAC to Consultant in Section 13.1 above, MAC retains all right, title, and interest in and to MAC Data and all intellectual property rights associated therewith. For the avoidance of doubt, all embodiments, incidents, and derivatives of MAC Data, including (without limitation) all copies, records, output, reports, compilations, collective or derivative works, presentations, diagrams, summaries and excerpts—to the extent they contain or are adapted from MAC Data--and regardless of whether in electronic or tangible form or represented or communicated in any other manner, are Deliverables subject to Section 4.

13.3. Access to Data. The MAC may at any time suspend the access of Consultant to MAC Data and/or disable its access rights in the event of indications of misuse, unlawful conduct, or violation of this PSA, or other usage policies. The MAC will not be liable to Consultant or any third-party for suspension of access to MAC Data, regardless of the grounds.

13.4. Retention. Consultant will comply with any data retention periods set by the MAC for MAC Data. If no retention period is given for a category of MAC Data, Consultant will retain that category of data for the term of the PSA. Upon termination of this PSA (unless such PSA is renewed), Consultant will: (1) return and deliver to the MAC all MAC Data and any Deliverable containing or derived from MAC Data, and (2) delete and cause to be deleted from all computers and other systems and devices all MAC Data and any Deliverable containing or derived from MAC Data in a manner that the same cannot be retrieved, and (3) verify such deletion and destruction to the MAC under oath in writing.

13.5. Disclaimer of Warranties. Use of MAC Data is at Consultant’s sole risk. The MAC does not warrant that access to MAC Data, or any content, will be uninterrupted. The MAC makes no representations or warranties, express or implied, with respect to the use of, or reliance on, MAC Data, regardless of its format or means of transmission. There are no guarantees or representations to the user as to the accuracy, currency, completeness, suitability, or reliability of MAC Data, for any purpose. MAC Data could contain technical inaccuracies or typographical errors. Consultant accepts MAC Data “as is,” and assumes all risks associated with its use. The MAC assumes no responsibility for any damages resulting from, caused by, or associated with Consultant’s reliance on or use of MAC Data, or for the delay or inability to use MAC Data, even if appraised of the likelihood of such damages occurring.

13.6. Limitations on Processing of MAC Data. Consultant must not use MAC Data in a non-production environment, such as development, testing, or quality assurance environments.

However, MAC Data may be used in non-production environments used solely for recovery purposes, so long as those environments otherwise meet all applicable requirements of Section 15.

IT Continuing Consultant Services – Addendum 2 8

14. Security Incident Response.

14.1. Security Incident. “Security Incident” means any compromise (actual or suspected) of the confidentiality or integrity of MAC Data or information systems used by Consultant to store, transfer, or otherwise process MAC Data; or any unauthorized access to, disruption or misuse of any Consultant information system used by Consultant to store, transfer, or otherwise process MAC Data or unauthorized access to, disruption or misuse of MAC Data.

14.2. CSIRT. Consultant must establish and maintain a Computer Security Incident Response Team, or—if unable to form a team—an individual must be designated as responsible for computer security (in either case, the “CSIRT”). The CSIRT must be responsible for (i) investigating Security Incidents, (ii) reporting to the MAC any information regarding Security Incidents, (iii) resolving any Security Incidents, and (iv) improving the information security program based on Security Incidents.

14.3. Notice. The CSIRT must notify the MAC of any Security Incident, without unreasonable delay, but in no event later than twenty-four (24) hours after Consultant's confirmation of the Security Incident, or such shorter notice period as required by law.

14.4. Security Incident Responsibility. Consultant must, at no cost to the MAC, repair and/or compensate MAC or third-parties for any damage or loss caused by the Security Incident and assist the MAC in complying with any breach notification requirement to which the MAC is subject. Consultant also agrees to cooperate with the MAC in the resolution of any Security Incident.

15. Cybersecurity Requirements. Consultant must share any information or access necessary for the MAC to meet its regulatory compliance obligations with respect to cybersecurity including, but not limited to, any current or future FAA, TSA, or CISA security directive applicable to the MAC. In addition, Consultant must, at all times, meet or exceed the following cybersecurity requirements:

15.1. Maintenance of WISP. At all times that Consultant has access to MAC Data or MAC information systems, Consultant must maintain a comprehensive Written Information Security Program (the “WISP”) commensurate with the size and complexity of Consultant, nature and scope of the PSA, and the sensitivity of the MAC Data used or maintained. The WISP must dictate information systems security requirements based on a documented risk assessment. The WISP must be in compliance with (i) relevant laws, regulations, orders, and rules. Consultant must maintain data security certifications indicating that the WISP meets or exceeds industry information security standards as required by relevant legal, regulatory, and contractual requirements that otherwise apply to the services performed by Consultant.

15.2. Employee Security Awareness. Prior to being granted access to MAC Data or MAC information systems, and annually thereafter, all Consultant personnel must be provided with security awareness training to ensure their understanding of security policies and standards, and their responsibilities to protect MAC Data and Consultant’s or MAC’s information systems.

15.3. Role-Based Access Controls. Consultant must utilize role-based access controls for all information systems, (i) restricting access privileges to the minimum necessary for a user to perform authorized functions, and (ii) preventing access to MAC Data by non-authorized users.

15.4. Encryption. Consultant must encrypt MAC Data using strong encryption technologies while such information is at rest and during transmission using public networks or leased lines. MAC considers appropriate secured transmission technologies to include: VPN, HTTPS, and SFTP.

15.5. Portable Devices and Mobile Computing. Consultant may allow its personnel to access MAC Data on or from laptops, mobile phones, or other portable storage and/or computing devices (“Devices”) so long as those Devices encrypt the information at rest and in transit, utilize endpoint protection that includes a personal firewall and anti-malware protection, and utilize multi-factor authentication.

IT Continuing Consultant Services – Addendum 2 9

15.6. MAC Data Loss Prevention. Consultant must institute and maintain a data loss prevention (“DLP”) program, which shall include reviewing, detecting, and preventing unauthorized, unnecessary, and/or excessive disclosures, misappropriation, theft, or loss of information.

15.7. Physical Security. Consultant must maintain and apply physical security measures and safeguards for the ongoing protection of MAC Data, whether stored electronically or in another form. Consultant must: (i) maintain a documented facility security plan and conduct periodic reviews of access to Consultant’s facility and secure zones, (ii) maintain written procedures that restrict physical access to MAC Data and specify the manner and location in which such information shall be locked and stored, (iii) restrict secured physical access to all servers and computer production control areas to Consultant personnel responsible for the operation and maintenance of the hardware located in those areas, (iv) maintain cameras (e.g., CCTV) to monitor and record ingress and egress to sensitive areas, and (v) maintain processes for the review and retention of security logs.

15.8. Cloud Computing. To the extent MAC Data is hosted using cloud computing, Consultant must

(i) use at least Database Management System (DBMS) layer encryption for such data when at rest, (ii) employ industry standard cloud security controls for access management, network security, data encryption at rest and in transit, and intrusion prevention, (iii) perform privileged user monitoring for such MAC Data, (iv) employ controls to ensure that MAC Data is logically separated from non-MAC data in all instances, including backup and removable media, (unless otherwise permitted in writing by MAC) (v) allow MAC Data to be deleted in accord with Section 13.4, and (vi) maintain a valid agreement with third parties providing cloud services for Consultant. Consultant must, upon the MAC's request, identify all third parties providing cloud services for Consultant that host MAC Data (“Cloud Vendors”). In connection with any cloud computing, Consultant must require the Cloud Vendor to use US domestic hosting regions for cloud instances that may host MAC Data. Consultant must also use the Cloud Vendor’s cloud computing solution that complies with the current requirements for computing for the U.S.

federal government.

15.9. Network Security. All of Consultant's network connections, including wireless connections, must be equipped with intrusion prevention capabilities, and must include firewall protection and intrusion detection in accordance with industry best practices. Consultant must have monitoring capabilities that: (i) detect system weaknesses, (ii) recognize anomalous user activity, and (iii) inform Consultant of newly discovered vulnerabilities. Consultant must perform monthly vulnerability scanning and annual network penetration testing. Consultant must remediate identified vulnerabilities to satisfy accepted industry standards. In addition, Consultants providing or developing customized software applications for the MAC must regularly perform application and source code scanning and remediate identified vulnerabilities with industry standards.

15.10. Logging and Monitoring. Consultant must employ industry standard security controls and tools to monitor its information systems and log key events such as user activities (including root or administrative access), exceptions, successful and unsuccessful logins, access to audit logs, unauthorized information processing activities, suspicious activities and information security events. Consultant must (i) perform regular, routine log reviews and take necessary actions to protect against unauthorized access or misuse, (ii) regularly back up activity logs to secure central location(s), protected against tampering and unauthorized access, (iii) ensure that the clocks of all relevant information processing systems are synchronized using an authoritative national or international time source, (iv) incorporate date and time stamps into log entries, and (v) retain activity logs in accordance with regulatory requirements. In the event of a security incident, Consultant must make log events specific to MAC Data available for review by the MAC within twenty-four (24) hours of request by the MAC.

IT Continuing Consultant Services – Addendum 2 10

15.11. Patch Management. Consultant must operate an effective security patch management program whereby security patches will be applied within a reasonable timeframe, consistent with industry standards and practices and based upon the level of security risk, from the point of discovery. To the extent a given risk is not remediated through patch application within a reasonable timeframe, Consultant must implement compensating controls to mitigate the risk until the security patch(es) are applied.

15.12. Risk Assessments. Consultant must, as required by the WISP and in compliance with all applicable laws, regulations, orders, rules and contractual requirements, perform ongoing risk assessment. On written request by the MAC, for each facility of Consultant that processes MAC Data or has access to MAC Data, Consultant must provide to the MAC (view-only) access to all risk assessments, audits, examination and summaries of test results performed periodically by Consultant, or by their external auditors or security consultants, relating to the information security measures, involving each such facility having such access, including access to the relevant portions of any applicable Service Organization Controls (“SOC”), or similar reports.

15.13. Security Risk Assessments. At request of the MAC, Consultant may be asked to submit to a security risk assessment before either obtaining access to or receiving any MAC Data or MAC information systems, or deploying custom software in a MAC-controlled production environment. Consultant agrees to cooperate in good faith and at Consultant's sole cost and expense during any security risk assessment or investigation initiated by the MAC.

15.14. Duty to Report. If any report, inspection, risk assessment, or security risk assessment identifies material gaps or weaknesses in Consultant's WISP or its ability to secure MAC Data, Consultant must notify the MAC and provide the MAC with a reasonable period of time to correct the gap or weakness, and if such measures are not satisfactory to the MAC, the MAC may suspend Consultant's access to or use of MAC Data until such issues are resolved to the mutual satisfaction of Consultant and the MAC. Any such suspension by the MAC will not be a breach of this PSA.

15.15. Subsequent Assessments. Consultant may be required by the MAC to complete a new security risk assessment, but in no event more than once every twelve (12) months unless a security incident occurs or material gaps in security are identified.

15.16. Assessment Requirements. During any security risk assessment, Consultant must provide the MAC (view-only) access to a SOC 2 Type 2, or in an alternative form agreed to by the MAC, as evidence demonstrating the effectiveness of the WISP.

15.17. Retention. For the greater of six (6) years or until two (2) years after this PSA is terminated, Consultant must maintain, and provide access for the MAC's review upon MAC's request, (i) the WISP (including all versions thereof), in effect during all times during which Consultant had access to MAC Data or any of the MAC's information systems; and (ii) all other material policies, procedures and other documents related to MAC Data and the MAC's information systems of or accessible by Consultant.

15.18. Offshoring. Consultant will not use offshore computing or storage resources, meaning computing or storage resources located in any physical location outside of one of the fifty United States or one of the United States Territories (i.e., American Samoa, Guam, Northern Marianas, Puerto Rico, and Virgin Islands) to store or process MAC Data.

15.19. Continuous Monitoring. During the term of the PSA, Consultant may be requested to respond to, inform and provide updates regarding specific high-risk security gaps or exposures that exist for new or emerging security vulnerabilities that are made publicly known for systems, applications, hardware devices, etc. Consultant will promptly respond to such MAC requests and will provide specific details as to the questions asked to ensure that the MAC can evaluate the risk or exposure to MAC Data.

15.20. Compliance Audit. MAC may, upon reasonable notice, conduct a verification of Consultant’s compliance with the terms of Section 13 and Section 15. Consultant must provide

IT Continuing Consultant Services – Addendum 2 11 to MAC such information as the MAC may reasonably request and give the MAC or its representatives access to Consultant’s records, personnel, and facilities in order to conduct the verification.

16. On-Premises Work. This Section 16 applies to any services provided to the MAC under this PSA that require Consultant, Consultant’s agents, a subcontractor of Consultant’s, or any of that subcontractor’s agents to enter premises owned by the MAC.

16.1. Security. Consultant at its own expense must abide by all Transportation Security

Administration (“TSA”) or MAC security requirements, ordinances or security directives, including but not limited to, security badge qualifications, access, display, and use, restrictions on sale of dangerous items and limited security area access abilities.

16.2. Penalties Assessed by the TSA. Consultant understands and agrees that in the event the TSA assesses a civil penalty or fine against the MAC for any violation of Transportation Security Regulation or other federal statute as a result of any act or failure to act on the part of Consultant, its agents, or its subcontractors or subcontractor’s agents, Consultant will reimburse the MAC in the amount of the civil penalty assessed plus any costs for defending the civil penalty, including reasonable attorneys’ fees. The MAC will provide Consultant notice of the allegation, investigation or proposed or actual civil penalty. Failure of Consultant to reimburse the MAC within one hundred twenty (120) days of receipt of written notice of the assessed civil penalty shall be an event of default under this PSA.

17. Indemnification.

17.1. General. To the fullest extent permitted by law, Consultant agrees to indemnify, hold harmless, and defend the MAC, its commissioners, its officers, employees or agents, and any successor or successors to the MAC’s interest (collectively “Indemnitees”) against all losses and liabilities, or claims thereof, from third-parties arising out of or related to services covered by this PSA, or acts or omissions of Consultant or an agent or subcontractor of Consultant’s in carrying out this PSA (hereinafter, “Loss”). In addition, Consultant agrees to bear all reasonable costs of the investigation of and defense against any Loss, including without limitation, the fees of attorneys, consultants, experts, and investigators. Notwithstanding the foregoing two sentences, Consultant is not obligated to indemnify nor defend an Indemnitee against any Loss to the extent a court of competent jurisdiction decides, or the MAC and Consultant mutually in writing agree, such Loss resulted from an Indemnitee’s sole negligence or intentional acts.

17.2. Notice. MAC will give Consultant reasonable notice of any Loss. In indemnifying or defending an Indemnitee, Consultant must use legal counsel reasonably acceptable to the MAC. The MAC, at its option and expense, may select its own counsel or approve joint counsel, as appropriate, and any experts for the defense against any Loss. Consultant, at its expense, must provide to the MAC electronic or physical data and give access to any persons reasonably necessary to investigate and defend against any Loss.

17.3. Survival. The provisions of this Section 17 survive expiration or earlier termination of this

PSA.

18. Insurance. The Consultant must secure and keep in force during the term of this PSA insurance policies with coverages at the limits described in this Section. The insurance companies must be licensed and admitted in Minnesota and have an A.M. Best rating of A- or better.

18.1. CGL. Commercial General Liability with minimum liability limits of $1 million per occurrence and $2 million general aggregate. The MAC must be named as an additional insured and the policy shall be primary and non-contributory either by endorsement or terms and conditions of the policy.

18.2. WC. Workers’ Compensation coverage meeting all statutory requirements in all the relevant state(s) of operation that applies to the performance of this agreement. Employers Liability with limits of $1,000,000 – Each Accident, $1,000,000 – Disease-Each Employee, IT Continuing Consultant Services – Addendum 2 12

$1,000,000 – Disease-Policy Limit. The policy must contain a waiver of subrogation in favor of the MAC by endorsement or terms and conditions of the policy.

18.3. Tech. E&O. Technology Professional Liability Errors and Omissions Insurance appropriate to the Consultant’s profession and work hereunder with limits not less than $2,000,000 per occurrence. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by Consultant in this PSA and shall include, but not be limited to, claims involving infringement of intellectual property, copyright, trademark, invasion of privacy violations, information theft, release of private information, extortion and network security. The policy shall provide coverage for breach response costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations. The policy must include, or be endorsed to include, property damage liability coverage for damage to, alteration of, loss of, or destruction of electronic data and/or information “property” of the MAC in the care, custody, or control of Consultant. If coverage is on a "claims-made" basis, equivalent coverages must be maintained in force for a minimum of 3 years after the termination of this agreement. The MAC shall be named as an additional insured.

18.4. Cyber. Cyber liability, first and third party liability including information security, notification cost, regulatory defense and penalties, website liability, cyber extortion, and business interruption with minimum limits of $1 million.

18.5. Additional Requirements. The insurance coverages listed above are subject to the following additional requirements: 1) Any deductible or self-insured retention amount or other similar obligation under the policies shall be the sole responsibility of the Consultant. 2) The duty to defend, indemnify, and hold harmless under this agreement shall not be limited by the insurance required in this agreement. 3) Consultant shall be responsible to notify the MAC in writing at least thirty (30) days prior to any policy cancellation or modification of policy terms and conditions. 4) The legal defense provided to the MAC under the policy terms and conditions and any endorsements must be free of any conflicts of interest, even if retention of separate legal counsel for the MAC is necessary. 5) The insolvency or bankruptcy of the insured Consultant shall not release the insurer from payment under the policy, even when such insolvency or bankruptcy prevents the insured Consultant from meeting the retention limit under the policy.

6) The Consultant shall furnish a certificate of insurance to the MAC using the most current ACORD form issued by an Insurance Company or Agent licensed in the United States and policies upon request to the MAC prior to commencement of work under this PSA showing compliance with the provisions of this contract. 7) Failure to effect, maintain and provide evidence of the insurance required in the PSA will be a material breach of contract entitling the MAC to terminate the PSA immediately.

18.6. MAC Reservation. The MAC reserves the right to place additional insurance requirements within an Statement of Work, when the MAC determines that the work authorized therein requires additional or different insurance coverages.

18.7. Insurance Indemnification. As a distinct and separate indemnification obligation, Consultant agrees to indemnify, hold harmless, and defend the Indemnitees from any Loss arising out of Consultant’s failure or alleged failure to procure and to keep in force the insurance required as part of this PSA.

18.8. Insurer Instructions. Consultant must comply with all requirements imposed by the insurers for MAC and Consultant.

18.9. Insurer Obligations. The indemnity obligations contained in this PSA are intended for the indemnified parties and their legal representatives. The provided indemnification is not intended to relieve a primary insurer of its coverage obligations.

19. Minnesota Human Rights Act Requirements.

19.1. Requirements for the PSA if in Excess of $100,000 and if Consultant has More than 40 Full-

Time Employees. If the payments made by MAC to Consultant under this PSA exceed, or are

IT Continuing Consultant Services – Addendum 2 13 contemplated to exceed, $100,000 and if Consultant employed more than forty (40) full-time employees on a single working day during the twelve (12) months previous to the PSA’s execution either in Minnesota or in the state where it has its primary place of business, then Consultant must comply with the requirements of Minnesota Statute, section 363A.36 and Minnesota Rules Part

5000.3400 through Part 5000.3600.

19.1.1. Minn. Stat. § 363A.36. Minnesota Statute, section 363A.36 requires Consultant to have an certificate of compliance approved by the Minnesota Commissioner of Human Rights (“Commissioner”). The law addresses suspension or revocation of a certificate of compliance and contract consequences in the event of a revocation. A contract awarded without a certificate of compliance may be voided.

19.1.2. Disabled Workers. [Minn. R. Part 5000.3550]. (a) Consultant must not discriminate against any employee or applicant for employment because of physical or mental disability in regard to any position for which the employee or applicant for employment is qualified. Consultant agrees to take affirmative action to employ, advance in employment, and otherwise treat qualified disabled persons without discrimination based upon their physical or mental disability in all employment practices such as the following: employment, upgrading, demotion or transfer, recruitment, advertising, layoff or termination, rates of pay or other forms of compensation, and selection for training, including apprenticeship. (b) Consultant agrees to comply with the rules and relevant orders of the Minnesota Department of Human Rights issued pursuant to the Minnesota Human Rights Act. (c) In the event of Consultant's noncompliance with the requirements of this Section 19.1.2, actions for noncompliance may be taken in accordance with Minnesota Statutes, section 363A.36, and the rules and relevant orders of the Minnesota Department of Human Rights issued pursuant to the Minnesota Human Rights Act. (d) Consultant agrees to post in conspicuous places, available to employees and applicants for employment, notices in a form to be prescribed by the Commissioner. Such notices must state Consultant's obligation under the law to take affirmative action to employ and advance in employment qualified disabled employees and applicants for employment, and the rights of applicants and employees. (e) Consultant must notify each labor union or representative of workers with which it has a collective bargaining agreement or other contract understanding, that the Consultant is bound by the terms of Minnesota Statutes, section 363A.36, of the Minnesota Human Rights Act and is committed to take affirmative action to employ and advance in employment physically and mentally disabled persons.

19.2. Requirements for the PSA if in Excess of $500,000 and if Consultant has More than 40 Full- Time Employees.

19.2.1. Minn. Stat. § 363A.44. If the payments made by MAC to Consultant under this PSA exceed, or are contemplated to exceed, $500,000 and if Consultant employed more than forty (40) full-time employees on a single working day during the twelve (12) months previous to the PSA’s execution either in Minnesota or in the state where it has its primary place of business, then Consultant must comply with the requirements of Minnesota Statute, section 363A.44.

If applicable, Minnesota Statute, section 363A.44 requires Consultant to have an Equal Pay Certificate. Such Equal Pay Certificate must be obtained prior to the execution of the PSA. If Consultant was required to have an Equal Pay Certificate, but did not obtain one, the Commissioner may void the PSA on behalf of the state. Upon revocation of Consultant’s Equal Pay Certificate, MAC may abridge or terminate this PSA.

19.3. Consequences. The consequences of Consultant’s failure to comply with the terms of this Section 19 may include termination of all or part of this PSA by the Commissioner or the state.

20. General Civil Rights Provisions. In all its activities within the scope of its airport program the Consultant agrees to comply with pertinent statutes, Executive Orders and such rules as are identified in Title VI List of Pertinent Nondiscrimination Acts and Authorities to ensure that no person

IT Continuing Consultant Services – Addendum 2 14 shall, on the grounds of race, color, national origin, (including limited English proficiency),…