3-Attachment A IT Terms and Conditions.docx

ATTACHMENT A: STATE OF UTAH COOPERATIVE STANDARD INFORMATION TECHNOLOGY TERMS AND CONDITIONS This is a State Cooperative Contract for information technology products and services. DTS policies referenced by number in this Attachment are only applicable to the Executive Branch and are available at https://dts.utah.gov/policies. All other policies and codes of conduct are available upon request.

1. DEFINITIONS:

a) “Access to Secure State Facilities, Data, or Technology” means Contractor will (a) enter upon secure premises controlled, held, leased, or occupied by State of Utah or Eligible User; (b) maintain, develop, or have access to any deployed hardware, software, firmware, or any other technology, that is in use by State of Utah or Eligible User; or (c) have access to or receive any State Data or Confidential Information.

b) “Authorized Persons” means the Contractor’s employees, officers, partners, Subcontractors, or agents of Contractor who need Access to Secure State Facilities, Data, or Technology to enable the Contractor to perform its responsibilities under this Contract.

c) “Background IP” means intellectual property (IP) owned or controlled prior to the effective date of this Contract or that IP developed or acquired from activities independent of the services performed under this Contract, including but not limited to (a) methodologies, processes, technologies, algorithms, software, or development tools used in performing the Services, and (b) processes and reusable reports, designs, charts, plans, specifications, documentation, forms, templates, or output which are supplied or otherwise used by or on behalf of Contractor in the course of performing the Services or creating the Custom Deliverables, other than portions that specifically incorporate proprietary or Confidential Information or Custom Deliverables of Eligible User.

d) “Contract” means the Contract Signature Page(s), including all referenced attachments and documents incorporated by reference.

e) “Contract Period” means the term of this Contract, as set forth in the Contract Signature Page(s).

f) “Contract Signature Page(s)” means the cover page that the Division and Contractor sign.

g) “Contractor” means the individual or entity identified on the Contract Signature Page(s). “Contractor” includes Contractor’s agents, officers, employees, partners, contractors, and Subcontractors at any level.

h) “Custom Deliverables” means the product that Contractor is required to design, develop, or customize and deliver to the Eligible User as specifically described under this Contract or an associated statement of work for which all interest and title shall be transferred to and owned by the Eligible User. This includes every invention, design, development, customization, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registrable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor pursuant to this Contract.

i) “Data Breach” means the unauthorized access, acquisition, disclosure, loss of access, or destruction of State Data that compromises the security, confidentiality, or integrity of State Data.

j) “Division” means the State of Utah Division of Purchasing.

k) “DTS” means the Utah Department of Government Operations Division of Technology Services.

l) “Eligible User(s)” means the State of Utah’s government departments, institutions, agencies, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), and, as applicable, nonprofit organizations, agencies of the federal government, or any other entity authorized by the laws of the State of Utah to participate in State Cooperative Contracts.

m) “Federal Criminal Background Check” means a fingerprint-based, nationwide background check conducted and processed by the FBI.

n) “Federal Data” means all information that originated with a federal entity, including tax information.

o) “Good” means any deliverable not classified as a Custom Deliverable or Service.

p) “Intellectual Property Rights” means all rights to patents, utility models, mask works, copyrights, trademarks, trade secrets, and other protection afforded by law to inventions, models, designs, technical information, and applications.

q) “Non-Public Data” means records or data that are not subject to distribution to the public. Access is restricted because it includes information that is protected by state or federal law. Non-Public Data includes, but is not limited to, a person’s name; government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information; or Protected Health Information.

r) “Personal Data” means information, whether by itself or combined with other data elements, that can identify an individual with reasonable specificity or that is linked or can be reasonably linked to an identified individual.

s) “Procurement Item” means a Good, a supply, Services, Custom Deliverable, construction, or technology that Contractor is required to deliver to the State of Utah under this Contract, including software and Software as a Service.

t) “Protected Health Information” (PHI) is as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and its implementing regulations.

u) “Response” means the Contractor’s bid, proposals, quote, or any other document used by the Contractor to respond to the State Entity’s Solicitation.

v) “Security Incident” means the attempted unauthorized access to State Data or Personal Data that may result in the use, disclosure, or theft of State Data or Personal Data. Consistent with the GDPA at Subsection 63A-19-405(1)(b), a governmental entity must report “the unauthorized access, acquisition, disclosure, loss of access, or destruction of data that compromises the security, confidentiality, availability, or integrity of the computer systems used or information maintained by the governmental entity”. An incident does not include unsuccessful pings and port scans.

w) “Services” means the furnishing of labor, time, or effort by Contractor, and may include installation, configuration, implementation, technical support, warranty maintenance, and other support services.

x) “Solicitation” means an invitation for bids, request for proposals, notice of sole source procurement, request for statement of qualifications, request for information, or any document used to obtain bids, proposals, pricing, qualifications, or information for the purpose of entering into this Contract.

y) “Single Sign On” means the authentication and authorization system operated by the State of Utah for accessing resources operated either by the State or a third party on behalf of the State.

z) “X [Software, Platform, Infrastructure, Network, etc.] as a Service (SaaS)” means an application running on a Contractor’s or State’s cloud infrastructure which is accessible from various client devices through a thin client interface (such as a Web browser, Web-based email, or a program interface) For clarity, the State does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

aa) “State Data” means all Confidential Information, Non-Public Data, and Personal Data that is created, controlled, maintained, owned, or in any way originating from or on behalf of the State of Utah, and all State-controlled data that is the output of computer processing or other electronic manipulation of any data the State created, controlled, maintained, or in any way originated from the State of Utah, regardless of where such data or output is stored or maintained

ab) “State of Utah” or “State Entity” or “State” means the State of Utah, in its entirety, including its institutions, agencies, departments, divisions, authorities and instrumentalities, boards, commissions, elected or appointed officers, employees, agents, authorized volunteers, and where applicable, Eligible Users.

ac) “StateRAMP dba GovRamp” means a Risk and Authorization Management Program, which provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by state and local governments, public education institutions, and special districts enabling these organizations to validate the security of their third-party IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and/or SaaS (Software as a Service) solutions which process, transmit, store the organization’s data or which could impact data security GovRAMP’s security verification model is based on NIST 800-53 Rev. 5 published by the National Institute of Standards and Technology (NIST). Moving forward GovRAMP will be the name used.

ad) “GovRAMP Verified Status” means a status indicating that a service provider has met all GovRAMP security requirements related to that status and has been provided with an authorization established by the GovRAMP governing boards including but not limited to Ready, Core, Authorized or Provisionally Authorized.

ae) “GovRAMP Progressing Snapshot” means a program within the GovRAMP framework that utilizes a predetermined set of NIST 800-53 controls for quarterly evaluations and monthly advisory calls. This program aims to identify and address deficiencies in the security of cloud products, ensuring continuous improvement and compliance with GovRAMP standards.

af) “Subcontractors” includes contractors, manufacturers, distributors, suppliers, or consultants, at any tier, that are under the direct or indirect control or responsibility of Contractor, including a person or entity that is, or will be, providing goods or performing services pursuant to this Contract.

2. ESSENTIAL PROVISIONS:

a. CONTRACT JURISDICTION, CHOICE OF LAW, AND VENUE: This Contract shall be governed solely by the laws of the State of Utah. Any action or proceeding arising from this Contract shall be brought in a court of competent jurisdiction in the State of Utah. Exclusive venue shall be in Salt Lake City, in the Third Judicial District Court for Salt Lake County. (UCA § 63G-6a-1203(4)(f)(ii))

b. LAWS: Contractor and all Goods and Services delivered under this Contract will comply with all applicable federal and state of Utah laws, including applicable licensure and certification requirements.

c. SOVEREIGN IMMUNITY: The Division and the State of Utah do not waive any protection, right, defense or immunity under the Governmental Immunity Act of Utah, Utah Code §§ 63G-7-101 to 904, as amended, the Eleventh Amendment to the Constitution of the United States, or otherwise, from any claim or from the jurisdiction of any court. If a claim must be brought in a federal forum, then the party bringing the claim shall file it and seek to adjudicate it exclusively within the United States District Court for the District of Utah. This paragraph applies only to a claim brought against DTS or the State of Utah to the extent Congress has abrogated the State of Utah’s sovereign immunity. Furthermore, this paragraph is not consent by DTS or the State of Utah to be sued in federal court.

d. PUBLIC INFORMATION: This Contract and any purchase orders, invoices, pricing lists, and the Response are public records available for disclosure in accordance with the State of Utah’s Government Records Access and Management Act (GRAMA, Utah Code 63G-2-101 et seq.), except to the extent classified as protected in accordance with UCA § 63G-2-309. GRAMA takes precedence over any statements of confidentiality or similar notations. Neither the Division, the Eligible User nor the State of Utah will inform Contractor of any request for a copy of this Contract, including any purchase orders, invoices, pricing lists, or the Response.

e. CREDITING THE DIVISION IN PUBLICITY: Any publicity given to this Contract shall identify the Division as the managing agency and shall not be released without prior written approval from the Division.

f. SALES TAX EXEMPTION: Goods, Custom Deliverables, and Services purchased by some Eligible Users are being paid from that Eligible User’s funds and used in the exercise of that Eligible User’s essential functions as a State of Utah governmental entity. Any such Eligible Users will provide Contractor with a copy of its sales tax exemption number upon request.

g. SEVERABILITY: A declaration or order by any court that any provision of this Contract is illegal and void shall not affect the legality and enforceability of any other provision of this Contract, unless the provisions are mutually dependent.

h. AMENDMENTS: This Contract may only be amended by the mutual written agreement of the parties, provided that the amendment is within the Scope of Work of this Contract, is within the scope/purpose of the Solicitation, and is attached and made part of this Contract. Automatic renewals are prohibited and are deemed void even if listed elsewhere in this Contract. (UCA § 63G-6a-1203(4)(h))

i. DEBARMENT: Contractor certifies that it is not presently nor has ever been debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation by any government department or agency, whether international, national, state, or local. Contractor must notify the Division within thirty (30) days if debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from participation in any contract by any governmental entity.

j. NONAPPROPRIATION OF FUNDS, REDUCTION OF FUNDS, OR CHANGES IN LAW: This Contract may be terminated in whole or in part at the sole discretion of the Division or Eligible User upon thirty days written notice, if the Division or Eligible User determines that (a) a change in Federal or State legislation or applicable laws materially affects the ability of either party to perform under the terms of this Contract; or (b) that a change in available funds affects the Division or Eligible User’s ability to pay under this Contract. A change of available funds includes, but is not limited to, a change in Federal or State funding, whether as a result of a legislative act or an order of the President, the Governor, or Executive Director.

k. The Division or Eligible User, as applicable, will reimburse Contractor for the Goods or Services properly ordered and delivered until the effective date of said notice. The Division and Eligible User are not liable for any performance, commitments, penalties, or liquidated damages that accrue after the effective date of the notice.

l. ENTIRE AGREEMENT: This Contract is the entire agreement between the parties, and supersedes any prior and contemporaneous agreements and understandings between the parties, whether oral or written.

m. WAIVER: The waiver by either party of any provision, term, covenant, or condition of this Contract shall not be deemed to be a waiver of any other provision, term, covenant, or condition of this Contract nor any subsequent breach of the same or any other provision, term, covenant, or condition of this Contract. The Eligible User’s approval, acceptance, or payment for any Goods or Services required under this Contract shall not be construed to operate as a waiver by the Eligible User of any right under this Contract or of any cause of action arising out of the performance or nonperformance of this Contract.

n. CHANGES IN SCOPE: Any changes in the scope of work to be performed under this Contract shall be in the form of a written amendment to this Contract, mutually agreed to and signed by both parties, specifying any such changes, fee adjustments, any adjustment in time of performance, or any other significant factors arising from the changes in the scope of work.

o. TRAVEL COSTS: Unless otherwise agreed to in the contract, all travel costs associated with the delivery of Services will be paid in accordance with the Utah Administrative Code R25-7. Invoices containing travel costs outside of these rates will be returned to the Contractor for correction.

3. RECORDS ADMINISTRATION: Contractor shall maintain or supervise the maintenance of all records necessary to properly account for Contractor’s performance and the payments made by an Eligible User to Contractor. These records shall be retained by Contractor for at least six (6) years after final payment (per Utah Administrative Code R33-12-605 and UCA § 78B-2-309), or until all audits initiated within the six (6) years have been completed, whichever is later. Contractor shall allow, at no additional cost, State of Utah auditors, federal auditors, Eligible Users or any firm identified by the Division, access to all such records. Contractor must refund to the Division any overcharges brought to Contractor’s attention by the Division or the Division’s auditor and Contractor is not permitted to offset identified overcharges by alleged undercharges to Eligible Users.

4. CERTIFY REGISTRATION AND USE OF EMPLOYMENT "STATUS VERIFICATION SYSTEM”: This Status Verification System, also referred to as “E-verify”, requirement only applies to contracts issued through a request for proposal process and to sole sources that are included within a request for proposal.

1) Contractor certifies as to its own entity, under penalty of perjury, that Contractor has registered and is participating in the Status Verification System to verify the work eligibility status of Contractor’s new employees that are employed in the State of Utah in accordance with applicable immigration laws including UCA § 63G-12-302, Utah Code, as amended.

2) Contractor shall require that the following provision be placed in each subcontract at every tier: “The subcontractor shall certify to the main (prime or general) Contractor by affidavit that the subcontractor has verified through the Status Verification System the employment status of each new employee of the respective subcontractor, all in accordance with applicable immigration laws including UCA § 63G-12-302, Utah Code, as amended, and to comply with all applicable employee status verification laws. Such affidavit must be provided prior to the notice to proceed for the subcontractor to perform the work.”

3) Contractor’s failure to comply with this section will be considered a material breach of this Contract.

4) Contractor shall protect, indemnify, and hold harmless the Division, the Eligible Users, and the State of Utah, and anyone that the State of Utah may be liable for, against any claim, damages, or liability arising out of or resulting from violations of the above Status Verification System Section whether violated by employees, agents, or contractors of the following: (a) Contractor; (b) Subcontractor at any tier; and/or (c) any entity or person for whom the Contractor or Subcontractor may be liable.

5. CONFLICT OF INTEREST: Contractor represents that none of its officers or employees are officers or employees of the State of Utah, unless written disclosure has been made to the Division.

6. INDEPENDENT CONTRACTOR: Contractor is an independent contractor, and not an employee or agent of the Division, the Eligible Users, or the State of Utah, and therefore is not entitled to any of the benefits associated with such employment. Contractor has no authorization, express or implied, to bind the Division, the Eligible Users, or the State of Utah to any agreements, settlements, liabilities, or understandings, and shall not perform any acts as an agent for the Division, the Eligible users, or the State of Utah. Contractor is responsible for all applicable federal, state, and local taxes and FICA contributions.

7. CRIMINAL BACKGROUND SCREENING: Depending on the Eligible User’s policy, each employee of Contractor and Subcontractor may be required to successfully complete a Federal Criminal Background Check, prior to being granted Access to Secure State Facilities, State Data, or Technology. Contractor or the applicable employee shall provide Eligible Users with sufficient personal information (at Contractor’s expense) so that a Federal Criminal Background Check may be completed by the Eligible User, at Eligible User’s expense. The Eligible User will provide Contractor with forms which must be filled out by Contractor and returned to the Eligible User. Each employee of Contractor or a Subcontractor who will have Access to Secure State Facilities, State Data, or Technology must be fingerprinted by the Eligible User or local law enforcement a minimum of one week prior to needing access. At the time of fingerprinting, said employee shall disclose all felony or misdemeanor convictions. Eligible Users may conduct a Federal Criminal Background Check based upon the fingerprints and personal information provided and use this same information to complete a Name Check in the Utah Criminal Justice Information System (UCJIS) at least every two years. Eligible Users may revoke Access to Secure State Facilities, Data, and Technology granted in the event of any negative results. Contractor and the employee or subcontractor shall immediately notify Eligible Users if an arrest or conviction for a felony or misdemeanor of any person that has Access to Secure State Facilities, State Data or Technology occurs during the Contract Period. Eligible Users will determine in its discretion if such person’s Access to Secure State Facilities, State Data, or Technology shall remain in effect. Felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred. (DTS Policy 2000-0014 Background Investigations). Additionally, each employee, consultant of Contractor, and Subcontractor who will be granted unescorted access to Secure State Facilities, State Data, or Technology must successfully complete a 10-panel drug test at Contractor’s expense with the pass/fail results of the drug test provided to the State of Utah’s hiring manager prior to such access being granted. DTS may revoke Access to Secure State Facilities, Data, and Technology in the event the results of a drug test are positive. DTS will determine in its discretion if such person’s Access to Secure State Facilities, State Data, or Technology shall remain in effect. Contractor’s employees and any Subcontractors who have unescorted Access to Secure State Facilities or to State or Federal Data or any Access to Technology will complete at no additional cost any required security training as requested by the State. Felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred.

8. DRUG-FREE WORKPLACE: Contractor shall abide by the Eligible User’s drug-free workplace policies when it is accessing Non-Public Data or while on the Eligible User’s or the State of Utah’s premises.

9. CODE OF CONDUCT: If Contractor is working at facilities controlled or owned by the State of Utah, Contractor shall follow and enforce the agency applicable code of conduct. Contractor will ensure that each employee receives a copy of the policies and applicable codes of conduct. (DTS Policy 2000-0001 Code of Conduct, DTS Policy 1000-0003 Acceptable Use of Information Technology Resources)

10. INDEMNITY AND LIABILITY

a. Indemnity Clause: Contractor shall fully indemnify, defend, and save harmless the Division, Eligible Users, and the State of Utah from all claims, losses, suits, actions, damages, and costs of every name and description arising out of Contractor’s performance of this Contract caused by any intentional act, omission or negligence of Contractor, its agents, employees, officers, partners, and Subcontractors, without limitation; provided, however, that the Contractor shall not indemnify for that portion of any claim, loss, or damage due to the fault of the Division, the Eligible User, or the State of Utah. Any limitations of the Contractor’s liability will not apply to injuries to persons, including death, or to damages to property. (UCA § 63G-6a-1203(4))

b. Governmental Immunity Act: In accordance with the Constitution of the State of Utah and the Governmental Immunity Act of Utah (“the Act”, Utah Code §§ 63G-7-101 to 904, as amended), the Division and the State of Utah have no liability for the operations, acts, or omissions of the Contractor or any third party. Any indemnity obligations of the Division, Eligible Users, or the State of Utah are subject to the Constitution of the State of Utah and the Act and limited to claims that arise from and to the extent caused by the negligent acts or omissions of the Division or the Eligible Users in the performance of the Division’s or the Eligible User’s obligations under this Contract.

c. Intellectual Property Indemnification: Contractor warrants and represents it has full ownership and clear title free of all liens and encumbrances to any Good delivered under this contract. Contractor also warrants that any Good, Custom Deliverable, or Service furnished by Contractor under this Contract, including its use by the Eligible Users in unaltered form, will not infringe any copyrights, patents, trade secrets, or other proprietary rights.

Contractor will release, indemnify, and hold the Division, the Eligible Users, and the State of Utah harmless from liability or damages of any kind or nature, including Contractor's use of any copyrighted or un-copyrighted composition, secret process, patented or un-patented invention, article, or appliance furnished or used in Contractor’s performance of this Contract. Additionally, if such a claim or liability is based upon an allegation that a Good, Custom Deliverable, or Service furnished by Contractor infringes on any right protected by any patent, copyright, trademark, trade secret, and/or proprietary right, Contractor shall indemnify and hold harmless the Division, the Eligible Users, and the State of Utah for any judgments, settlements, costs, and reasonable attorneys’ fees resulting from such a claim or liability. Contractor shall defend all actions brought upon such matters to be indemnified hereunder and pay all costs and expenses incidental thereto; however, the Eligible Users shall have the right, at its option, to participate in the defense of any such action at its own expense without relieving Contractor of any obligation hereunder. If there are any limitations of liability in this Contract, such limitations will not apply to this section. (UCA § 63G-6a-1203(4))

11. HARDWARE WARRANTY: THE STATE OF UTAH DOES NOT ACCEPT ANY PROCUREMENT ITEM “AS-IS”. CONTRACTOR WARRANTS ALL HARDWARE PORTIONS OF ANY GOOD OR CUSTOM DELIVERABLE THAT IT DIRECTLY OR INDIRECTLY PROVIDES FOR A PERIOD OF ONE YEAR. ALL WARRANTIES GRANTED TO THE DIVISION AND ELIGIBLE USERS BY THE UNIFORM COMMERCIAL CODE OF THE STATE OF UTAH APPLY TO THIS CONTRACT. PRODUCT LIABILITY DISCLAIMERS AND/OR WARRANTY DISCLAIMERS FROM CONTRACTOR OR ITS SUPPLIERS ARE REJECTED. CONTRACTOR WARRANTS THAT THE HARDWARE: (A) WILL PERFORM AS SPECIFIED IN THE RESPONSE; (B) WILL LIVE UP TO ALL SPECIFIC CLAIMS LISTED IN THE RESPONSE; (C) WILL BE SUITABLE FOR THE ORDINARY PURPOSES FOR WHICH THE HARDWARE IS USED; (D) WILL BE SUITABLE FOR ANY SPECIAL PURPOSES THAT THE DIVISION HAS RELIED ON CONTRACTOR’S SKILL OR JUDGMENT TO CONSIDER WHEN IT ADVISED THE DIVISION ABOUT THE HARDWARE IN THE RESPONSE; (E) THE HARDWARE HAS BEEN PROPERLY DESIGNED AND MANUFACTURED; AND (F) IS FREE OF SIGNIFICANT DEFECTS.

12. SOFTWARE WARRANTY: THE STATE OF UTAH DOES NOT ACCEPT ANY PROCUREMENT ITEM “AS-IS”. CONTRACTOR WARRANTS FOR A PERIOD OF NINETY DAYS FROM THE DATE OF ACCEPTANCE THAT THE SOFTWARE PORTIONS OF THE GOODS AND CUSTOM DELIVERABLES THAT CONTRACTOR DIRECTLY OR INDIRECTLY PROVIDES WILL: (A) PERFORM IN ACCORDANCE WITH THE SPECIFIC CLAIMS PROVIDED IN THE RESPONSE; (B) BE SUITABLE FOR THE ORDINARY PURPOSES FOR WHICH SUCH GOODS AND CUSTOM DELIVERABLES ARE USED; (C) BE SUITABLE FOR ANY SPECIAL PURPOSES THAT THE ELIGIBLE USER HAS RELIED ON CONTRACTOR’S SKILL OR JUDGMENT TO CONSIDER WHEN IT ADVISED THE STATE ABOUT THE GOODS OR CUSTOM DELIVERABLES; (D) HAVE BEEN PROPERLY DESIGNED AND MANUFACTURED; AND (E) BE FREE OF SIGNIFICANT DEFECTS. CONTRACTOR SHALL PROVIDE THE ELIGIBLE USER WITH BUG FIXES, INCLUDING INFORMING THE ELIGIBLE USERS OF ANY KNOWN SOFTWARE BUGS OR SOFTWARE DEFECTS THAT MAY AFFECT THE STATE’S USE OF THE SOFTWARE. PRODUCT LIABILITYY DISCLAIMERS AND/OR WARRANTY DISCLAIMERS FROM CONTRACTORS OR ITS SUPPLIERS ARE REJECTED

13. WARRANTY REMEDIES: Upon breach of warranty, Contractor will repair or replace (at no charge to the Eligible User) the nonconforming Goods or Custom Deliverables. If the repaired and/or replaced products are inadequate, Contractor will refund the full amount of any payments that have been made for the failed products. These remedies are in addition to any other remedies provided by law or equity.

14. UPDATES AND UPGRADES: Any upgrades and updates provided by Contractor are subject to the terms of this Contract. If Software is on premises, the State Entity reserves the right to accept updates and upgrades at its discretion and to determine if such updates comply with the Security requirements in the Contract. Contractor shall keep any applicable hardware, software, middleware, and application plugins up to date and in a state of good repair. All patches, critical vulnerabilities, and/or hardware issues must be addressed based on response times by criticality as laid out in the SOW. If the State hosts the solution, then Contractor may request such maintenance from the DTS hosting team.

15. BUG FIXING AND REMOTE DIAGNOSTICS: Contractor shall use commercially reasonable efforts to provide work-around solutions or patches to reported software problems. With the Eligible User’s prior written authorization, Contractor may perform remote diagnostics to work on reported problems. If the Eligible User declines remote diagnostics, Contractor and the Eligible User may agree to on-site technical support, subject to the terms of the Contract.

16. TECHNICAL SUPPORT AND MAINTENANCE: If technical support and maintenance is required by the Contract, Contractor will use commercially reasonable efforts to respond to the Eligible User in a reasonable time, and in all events, in accordance with the specific timeframes detailed in the Contract, when the Eligible User makes technical support or maintenance requests.

17. PHYSICAL DELIVERY: All non-electronic deliveries will be F.O.B. Destination Freight Prepaid and Allowed, unless specifically negotiated otherwise and explicitly written in this contract, with all transportation and handling charges paid by Contractor. Contractor is responsible for including any freight charges due by the Eligible User to Contractor when providing quotes to the Eligible User. Invoices listing freight charges that were not identified in the quote will be returned to the Contractor to remove such costs. Responsibility and liability for loss or damage will remain with Contractor until final inspection and acceptance, when responsibility will pass to the Eligible User except as to latent defects, fraud, and Contractor's warranty obligations.

18. ELECTRONIC DELIVERY: Contractor may electronically deliver any Good or Custom Deliverable to the Eligible User or provide any Good and Custom Deliverable for download from the Internet, if pre-approved in writing by the Eligible User. Contractor shall ensure the confidentiality of electronic deliveries in transit. Contractor warrants that all electronic deliveries will be free of known malware, bugs, Trojan horses, etc.

19. ACCEPTANCE PERIOD: A Good, Custom Deliverable, or Service furnished under this Contract shall function in accordance with the specifications identified in this Contract and Solicitation. If the Goods and Custom Deliverables delivered do not conform to the specifications identified in this Contract and Solicitation (“Defects”), the Eligible User shall within thirty (30) calendar days of the delivery date (“Acceptance Period”) notify Contractor in writing of the Defects. Upon receiving notice, Contractor shall use reasonable efforts to correct the Defects within fourteen (14) calendar days (“Cure Period”). The Eligible User’s acceptance of a Good, Custom Deliverable, or Services occurs at the end of the Acceptance Period or Cure Period, whichever is later.

If after the Cure Period, a Good, Custom Deliverable, or Service still has Defects, then the Eligible User may, at its option: (a) declare Contractor to be in breach and terminate this Contract; (b) demand replacement conforming Goods, Custom Deliverables, or Services from Contractor at no additional cost to the Eligible User; or (c) continue the Cure Period for an additional time period agreed upon by the Eligible User and Contractor in writing. Contractor shall pay all costs related to the preparation and shipping of the replacement products. No products shall be deemed accepted and no invoices shall be paid until acceptance. The warranty period will begin upon the end of the Acceptance Period.

20. SECURE PROTECTION AND HANDLING OF STATE DATA: If Contractor is given access to State Data, the protection of State Data shall be an integral part of the business activities of Contractor, and Contractor shall ensure that there is no inappropriate or unauthorized use of State Data. Contractor shall safeguard the confidentiality, integrity, and availability of the State Data and comply with the conditions outlined below. The Eligible User reserves the right to verify Contractor’s adherence to the following conditions to ensure they are met:

a. Network Security: Contractor shall maintain network security that, at a minimum, includes: network firewall provisioning, intrusion detection, and regular third-party penetration testing. Contractor shall maintain network security and ensure that Contractor network security policies conform to one of the following:

1) Current standards set forth and maintained by the National Institute of Standards and Technology, includes those at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf; or

2) Contractor shall comply with all applicable FedRAMP or GovRAMP security requirements, including but not limited to, continuous monitoring, incident response, and data classification as outlined in GovRAMP documentation.

b. State Data Security: Contractor shall protect and maintain the security of State Data with protection that is at least as good as or better than that maintained by the State of Utah which will be provided by an Eligible User upon Contractor’s request (DTS Policy 5000-0002). These security measures included but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification). Data access must incorporate the principles of test privilege and be physically and technologically controlled. The Eligible User reserves the right to determine if Contractor’s level of protection meets the Eligible User’s security requirements.

c. State Data Transmission: Contractor shall ensure all transmission or exchange of system application data with the Eligible User and State of Utah and/or any other parties expressly designated by the State of Utah, shall be encrypted and take place via secure means (ex. HTTPS or FTPS). Transmission of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x).

d. State Data Storage: All State Data will be stored and maintained in data centers in the United States. State Data is required to be encrypted in transit and at rest. State Data may only be processed on or transferred to Contractor-owned portable or laptop computing device or portable storage medium if such device is whole disk encrypted, or used and kept only at Contractor’s United States data centers, including if such medium is part of the Contractor's designated backup and recovery process. IN NO CASE MAY SUCH DEVICES OR STATE DATA LEAVE THE UNITED STATES.

e. Access: Contractor shall permit its employees and Subcontractors to remotely access non-State Data only as required to provide technical support.

f. State Data Encryption: Contractor shall store all data provided to Contractor, including State, as well as any backups made of that data, in encrypted form based on the current TLS standard and include all data as part of a designated backup and recovery process. Encryption of regulatory data must conform with the current regulatory requirement applicable to such data (ex. FIPS 140-x).

g. Authentication: Any portable or laptop computer that has access to the Eligible User’s or State of Utah resources, or stores any Eligible User data shall be equipped with strong and secure password protection. All systems that require authentication must use the Single Sign On solution operated by the State of Utah. This may be accomplished through federation using standard authentication protocols or direct integration into the vendor supplied application. If the Goods or Services, or both, are to be accessed or used by both Internal (state employees, contractors, etc.) and External (public, etc.) users, then the Goods and Services must be able to be integrated with multiple identity providers at the same time.

h. Confidential Information Certification: Contractor may be required to sign a Confidential Information Certification form prior to being given access to confidential computerized records if required by Eligible Users or Federal policies.

i. State Data Re-Use: All data exchanged shall be used expressly and solely for the purpose enumerated in this Contract. No State Data of any kind may be transmitted, exchanged, or provided to other contractors or third parties except on a case-by-case basis as specifically agreed to in writing by the Eligible User.

j. State Data Destruction: No sooner than 60 days but no later than 90 days following the expiration or termination of this Contract, and only after ensuring compliance with Section 32 (Ownership, Protection, and Return of Documents and Data) of this Attachment A, Contractor shall erase, destroy, and render unreadable all State Data from all non-state computer systems and backups, and certify in writing that these actions have been completed within thirty (30) days of the expiration or termination of this Contract or within seven (7) days of the request of the Eligible User, whichever shall come first, unless the Eligible User provides Contractor with a written directive. The Eligible User’s written directive may require that certain data be preserved in accordance with applicable law.

k. Services Shall Be Performed Within the United States: All Non-Public Data, including Criminal Justice Information (CJI), Personally Identifiable Information (PII), and other sensitive data, must be stored, processed, and disposed of within the United States. Contractor is prohibited from transferring, storing, or accessing Non-Public and/or State Data outside the United States without explicit written authorization from the State of Utah via an approved exception request from the Chief Information Security Officer (CISO) and must be documented in the system security plans of such systems, with a description of any compensating controls and a business justification. Offshore support is only permitted for systems not using Non-Public Data. Contractor must provide a list of countries and Subcontractors from which Services will be provided to ensure no undue risk to State Data and systems.

l. Federal Data Protection: Contractor shall store all Federal Data in a manner that, at all times, is physically and electronically secure from access by unauthorized persons. Contractor shall employ both physical and technological barriers to prevent unauthorized retrieval of Federal Data via computer, remote terminal, or other means. Federal Data must be subject to separation-of-duties protocols and provided only to those with a need to know.

1) Contractor shall store each query for Federal Data in Contractor’s system (including read-only and system access events that do not result in a change to data or a new transaction) as a separate record, not overlaid by subsequent records. All viewing of Federal Data must be recorded by a fully-automated audit trail system, which can be via an online query, automated report, batch processing, or any other logical means. Access to the audit file must be restricted to authorized users with a need to know and be maintained for a minimum of three years or the amount of time required by a federal agency, whichever is greater.

2) Contractor shall delete, purge, destroy, or return to the State of Utah all Federal Data upon termination of the Contract with no output retained by Contractor. If immediate purging is not possible, Contractor shall certify that any Federal Data in physical or electronic storage will remain safeguarded to prevent unauthorized disclosure. Contractor agrees to abide by all relevant federal laws, restrictions on access, use, disclosure, and security requirements in the State’s data exchange agreement with the social security administration, including receipt of security awareness training by Contractor’s employees who have access to Federal Data through this Contract. Contractor shall permit the State to conduct, at least once every three years and upon prior notice, a review to verify that the Contract is in compliance with the State’s agreement with the social security administration.

3) Federal Data may be used only for the purpose of carrying out the provisions of the Contract. Federal Data must be treated as confidential and may not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract.

4) All computer systems receiving, processing, storing, or transmitting Federal Data must meet the requirements set forth by the applicable federal agency

21. SECURITY INCIDENT OR DATA BREACH NOTIFICATION: As required by Utah Code 63A-19-405 or any other applicable data breach reporting laws, upon discovery of any Security Incident or Data Breach or privacy breach of Personal Data (including loss of access to Personal Data), Contractor shall provide the notification to the State Entity and DTS in the most expedient time possible without unreasonable delay. Contractor shall adhere to all applicable data breach reporting laws and will, upon the State of Utah’s request, provide Contractor’s incident response plans to the State of Utah. It is within the Eligible User’s discretion to determine whether any attempted unauthorized access is a Security Incident or a Data Breach.

a. Incident Response: Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement and seeking external expertise as mutually agreed upon, defined by law or contained in this Contract. Discussing Security Incidents with the Eligible User should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes, defined by law or contained in this Contract.

b. Security Incident Reporting Requirements: Contractor shall promptly report a Security Incident to the Eligible User. In the event the Eligible User is a State of Utah entity, contact shall be made as follows:

E-mail - DTS-SOC@utah.gov Phone – (801) 538-3011 Web - cybercenter.utah.gov

22. LIABILITY FOR SECURITY INCIDENT OR DATA BREACH. In the event of a Security Incident or Data Breach, liability for notification, remedial costs, and damages shall be the responsibility of the party who controls how the data is processed.

23. SECURITY INCIDENT OR DATA BREACH RESPONSIBILITIES: Contractor shall comply with all applicable laws that require the notification of individuals in the event of a Security Incident or Data Breach or other events requiring notification (DTS Policy 5000-0002 Enterprise Information Security Policy). In the event of a Security Incident or Data Breach or other event requiring notification under applicable law (UCA § 63a-19-405 and 406), Contractor shall: (a) cooperate with the Eligible User by sharing information relevant to the Security Incident or Data Breach; (b) promptly implement necessary remedial measures, if necessary; and (c) document responsive actions taken related to the Security Incident or Data Breach, including any post-incident review of events and actions taken to make changes in business practices in relation to the Security Incident or Data Breach. If the Data Breach requires public notification, all communication shall be coordinated with the Eligible User. Contractor is responsible for all notification and remedial costs and damages.

24. STATE INFORMATION TECHNOLOGY POLICIES: If Contractor is providing an Executive Branch Agency of the State of Utah with Goods or Custom Deliverables, Contractor shall comply with policies and procedures that meet or exceed those DTS follows for internally developed goods and deliverables to minimize security risk, ensure applicable Utah and Federal laws are followed, address issues with accessibility and mobile device access, and prevent outages and data breaches within the State of Utah’s environment. Contractor shall comply with the following DTS Policies:

a. DTS Policy 4000-0001, Enterprise Application and Database Deployment Policy: A Contractor developing software for the State to develop and establish proper controls that will ensure a clear separation of duties between developing and deploying applications and databases to minimize security risk; to meet due diligence requirements pursuant to applicable Utah and federal regulations; to enforce contractual obligations; and to protect the State's electronic information and information technology assets.

b. DTS policy 4000-0002, Enterprise Password Standards Policy: A Contractor developing software for the State must ensure it complies with the password requirements of the Enterprise Password Standards Policy.

c. DTS Policy 4000-0003, Software Development Life Cycle Policy: A Contractor developing software for the State shall work with DTS in implementing a Software Development Lifecycle (SDLC) that addresses key issues of security, accessibility, mobile device access, and standards compliance.

d. DTS Policy 4000-0004, Change Management Policy: Goods or Custom Deliverables furnished or Services performed by Contractor which have the potential to cause any form of outage or to modify DTS’s or the State of Utah’s infrastructure must be reviewed by the DTS Change Management Committee. Any outages or Data Breaches which are a result of Contractor’s failure to comply with DTS instructions and policies will result in Contractor’s liability for all damages resulting from or associated with the outage or Data Breach.

e. Applicability of DTS Policies: When a new product or service is added by the Contractor or a reseller, that product or service must be subject to, and comply with, the latest version of these DTS policies, which will be provided upon Contractor’s request by the Division of Technology Services.

25. CONFIDENTIALITY: IfContractor has access to or processes Confidential Information, Contractor shall: (i) advise its agents, officers, employees, partners, and Subcontractors of the obligations set forth in this Contract; (ii)keep all Confidential Information strictly confidential; and (iii) comply with any requirements contained in the contract regarding permitted uses and disclosures of personal data, measures designed to safeguard personal data, and the destruction of personal data. Contractor will promptly notify the State Entity of any potential or actual misuse or misappropriation of Confidential Information, including any data breaches, in accordance with UCA 63A-19 Government Data Privacy Act. In Accordance with UCA 63A-19, Contractor must comply with all the same requirements regarding personal data as the State.

Contractor shall be responsible for any breach of this duty of confidentiality, including any required remedies and/or notifications under applicable law. Contractor shall indemnify, hold harmless, and defend the Eligible User, including anyone for whom the Eligible User is liable, from claims related to a breach of this duty of confidentiality, including any notification requirements, by Contractor or anyone for whom the Contractor is liable.

If Contractor’s Subcontractors have access to or process Personal Data, Contractor shall advise the Subcontractor of the obligations required under this Contract to keep all Personal Data strictly confidential and advise the Subcontractor to comply with any requirements contained in the Contract such as permitted uses, disclosures, handling, and destruction of Personal Data. Some privacy and data protection laws may require disclosure of Subcontractors who process State Data that includes Personal Data.

Upon termination or expiration of this Contract, Contractor will return all copies of Confidential Information to the Eligible User or certify, in writing, that the Confidential Information has been destroyed. This duty of confidentiality shall be ongoing and survive the termination or expiration of this Contract.

26. Reserved

27. OWNERSHIP IN INTELLECTUAL PROPERTY: The Parties recognize that each has no right, title, or interest, proprietary or otherwise, in or to the name, logo, or intellectual property owned or licensed by the other. The Parties shall not, without the prior written consent of the other or as authorized in this Contract, use the name, logo, or intellectual property owned or licensed by the other.

28. OWNERSHIP IN CUSTOM DELIVERABLES: Contractor warrants, represents and conveys full ownership, clear title free of…