435100-O20-0712RWICMIS-01.docx.pdf

Revision: 10/9/2019 (previous versions obsolete)

CONTRACT FOR SERVICES

between

State of Wisconsin Department of Health Services and

Sigma Resources, LLC for

Maintenance and Operations Services for the WIC MIS

This Contract is between the State of Wisconsin Department of Health Services (DHS), at 1 West Wilson Street, Madison, Wisconsin 53703, and Sigma Resources, LLC at 2026 East Carson Street, Pittsburgh, PA 15203.

Contract ID Number: 435100-O20-0712RWICMIS-01

Contract Amount: $5,363,195

Contract Term: 01/01/2022-12/31/2026

Optional Renewal Terms: Five (5) one (1) year

DHS Division: Division of Public Health

DHS Contract Administrator: Dan Cash

DHS Contract Manager: Kari Malone

Contractor Contract Administrator: Sandeepa Kaleida

Contractor Telephone: (724) 575-0640

Contractor Email: skaleida@sigma-resources.com

Contractor FEIN: 25-1829581

This Contract will become effective on the date of mutual execution by the parties’ authorized representatives. By signing below, the parties acknowledge that this Contract is executed with full knowledge of and agreement with the terms and conditions of this Contract. This Contract becomes null and void if the time between the earlier dated signature and the later dated signature exceeds sixty (60) days, unless waived by DHS.

State of Wisconsin Contractor

Department of Health Services Contractor Name:

Authorized Representative Authorized Representative

Name:

Name:

Title: Title:

Signature:

Signature:

Date: Date:

DocuSign Envelope ID: 1952F348-94D8-4E64-BECB-7A7641281CB7

CEO

Sigma Resources LLC

Sandeepa Kaleida

11/28/2021

Anna Benton

Assistant Administrator, Division of Public Health

11/30/2021

TABLE OF CONTENTS

Definitions Order of Precedence Scope

3.1. List of Exhibits

Applicable Law and Venue Invoicing and Payments

5.1. Prompt Payment Law

5.2. State Tax Exemption

5.3. Payment Offsets for Contractor’s Delinquency

5.4. Refund of Credits

Contract Amendment No Quantity Guarantees Contractor Compliance and Responsibility for Actions Independent Contractor and Apparent Agency contractor personnel

10.1. Identification of Contracted Personnel

10.2. Right to Approve Changes of Contracted Personnel

10.3. Removal of Contracted Personnel

Background Checks Performance of Services Cooperation with Other Contractors Specifications Insurance Responsibility Warranty and Liens Conflict of Interest

17.1. Notice of Potential Conflict

Ownership Rights Confidential, Proprietary, and Personally Identifiable Information Security of Premises, Equipment, Data, and Personnel Intellectual Property Infringement and Labor Standards Records Retention Examination of Records Breach not Waiver Severability Survival Sovereign Immunity Indemnification and limited liability State Employees Promotional Advertising and News Releases Assignment Force Majeure Audits

33.1. Requirement to Have an Audit

33.2. Audit Requirements

33.3. Source of Funding

DocuSign Envelope ID: 1952F348-94D8-4E64-BECB-7A7641281CB7

33.4. Audit Reporting Package

33.5. Audit Due Date

33.6. Submitting the Audit Reporting Package

33.7. Access to Contractor Records

33.8. Access to Auditor’s Work Papers

33.9. Failure to Comply with the Audit Requirements

33.10. Sanctions

33.11. Closeout Audits

Default and Remedy Termination/Cancellation

35.1. Non-Appropriation

35.2. Termination for Cause

35.3. Termination for Convenience

35.4. Cancellation

Transition Services Antitrust Assignment Anti-Lobbying Act Affirmative Action Civil Rights Compliance Federal Contract Requirements Drug Free Workplace Contact Information Federal Award Information

DEFINITIONS

Words and terms will be defined by their ordinary and usual meanings. Unless negotiated otherwise by the parties, where capitalized, the following words and terms will be defined by the meanings indicated. The meanings are applicable to the singular, plural, masculine, feminine and neuter of the words and terms.

Acceptance: a manifestation of assent by DHS to the terms, Services, Goods or other items offered by the

Contractor under the Contract. Unless the particular methodology and measure of acceptance of the offered terms, Services, or Goods is set forth herein, acceptance shall occur, in the case of Goods, after delivery is taken and the

Goods are inspected, and payment has been made; or in the case of Services, those Services have been provided to

DHS’ satisfaction and acceptance, and payment has been made.

Agency: an office, department, agency, institution of higher education, association, society or other body in State of

Wisconsin government created or authorized to be created by the Wisconsin State Constitution or any law, which is entitled to expend monies appropriated by law, including the Legislature and the courts.

Business Associate: pursuant to 45 C.F.R. § 160.103, a business associate includes:

(i) A health information organization, e-prescribing gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

Business Day: any day on which the State of Wisconsin is open for business, generally Monday through Friday unless otherwise specified in this Contract.

Confidential Information: all tangible and intangible information and materials being disclosed in connection with this Contract, in any form or medium without regard to whether the information is owned by the State of

Wisconsin or by a third party, which satisfies at least one (1) of the following criteria: (i) Personally Identifiable

Information; (ii) Protected Health Information under HIPAA, 45 C.F.R. § 160.103; (ii) non-public information related to DHS’ employees, customers, technology (including databases, data processing and communications networking systems), schematics, specifications, and all information or materials derived therefrom or based thereon; or (iii) information expressly designated as confidential in writing by DHS. Confidential Information includes all information that is restricted or prohibited from disclosure by state or federal law.

Contract Administrator: the DHS staff member responsible for the compliance, action, and evaluation of the

Contract.

Contract Manager: the DHS staff member who will provide oversight on this contract. This individual will support the Contract Administrator with the implementation, administration, and completion of the Contract. This individual will also serve as the contact person to help resolve issues that may arise during the entire Contract lifecycle.

Contractor: an individual, business, or agency that enters into a written Contract to provide Products or Services to the State. A Contractor may be a service provider, a supplier of products, a manufacturer, or a consultant. For this

Contract, the Contractor is Sigma Resources, LLC.

Day: calendar day unless otherwise specified in this Contract.

Default: the omission or failure to perform a contractual duty or provide Goods or Services as contractually required.

DHS: Department of Health Services.

Goods: articles of trade or items of merchandise, supplies, raw materials, or finished products; may also include incidental or related Services.

Hosting Service: a third-party cloud data hosting service selected and engaged by DHS to host certain Confidential

Information under this Contract, as set forth in the Scope. The Hosting Service is not a Subcontractor of

Contractor. The Hosting Service engaged by DHS as of the commencement of the Contract Term is Microsoft

Azure.

Inspection: a careful examination of Goods, commodities, and items produced under this Contract or the site that provides Services or Goods in order to determine their fitness for use.

Municipality: a county, city, village, town, school district, board of school directors, sewer district, drainage district, technical college district or any other public or quasi-public corporation, officer, board or other body having the authority to award public contracts. (§ 16.70(8), Wis. Stats.).

Personally Identifiable Information: an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if that element is not publicly available information and is not encrypted, redacted, or altered in any manner that renders the element unreadable: (a) the individual’s

Social Security number; (b) the individual’s driver’s license number or state identification number; (c) the number of the individual’s financial account, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual’s financial account; (d) the individual’s DNA profile;

or (e) the individual’s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation, and any other information protected by state or federal law.

Protected Health Information (PHI): health information, including demographic information, created, received, maintained, or transmitted in any form or media by the Business Associate, on behalf of the Covered Entity, where such information relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the payment for the provision of health care to an individual, that identifies the individual or provides a reasonable basis to believe that it can be used to identify an individual.

Publicly Available Information: any information that an entity reasonably believes is one of the following: a) lawfully made widely available through any media; b) lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

Scope: the totality of the services that the State of Wisconsin is procuring from Contractor, including any standards or protocols pursuant to which the parties have agreed the services are to be provided.

State Purchase Order: State of Wisconsin’s standard document of purchase.

Services: all actions, recommendations, plans, research, customizations, modifications, documentation and maintenance and support provided by the Contractor necessary to fulfill that which the Contractor is obligated to accomplish under this Contract.

Subcontract: a Contract, written or oral, financial or non-financial, between the Contractor and any other party to fulfill the requirements and performance obligations of this Contract.

Subcontractor: an entity that enters into a Contract with the Contractor for the purpose of delivering Goods or providing Services to DHS.

ORDER OF PRECEDENCE

This Contract and the following documents incorporated by reference into the Contract constitute the entire agreement of the parties and supersedes all prior communications, representations or agreements between the parties, whether oral or written. Any conflict or inconsistency will be resolved by giving precedence in the following descending order:

1. The terms of this Contract.

2. Any and all exhibits or attachments to this Contract.

3. The terms of solicitation # S-0712 DPH-20R, including all attachments, addenda, and revisions.

4. The terms of Contractor’s solicitation response as accepted by DHS of Wisconsin.

5. The official purchase order.

SCOPE

The scope of services as described in this contract relate to the overall support of the ROSIE and Vendor Portal systems, the MyWIC app and all associated components of that make up these systems. It also includes but is not limited to level 1-3 Helpdesk services. DHS will purchase hosting services directly with Microsoft Azure for hosting via an existing State of Wisconsin Contract.

Incorporated by reference to this contract are all requirements as detailed in RFP: S-0712-DPH-20 along with the

RFP response from Sigma Resources LLC. Included in the Statement of Work (SOW) are the following as specified by the RFP:

Sec 4.2 – The project workplan including the project schedule.

Sec 4.3 – The transition plan

Sec 4.4 – The communication and coordination plan (draft), with the final approved plan due three (3) months after contract signing.

Sec 4.5 – The security plan (draft), with the final approved plan due three (3) months after contract signing.

Sec 4.6 – The release management and documentation plan (draft), with the final approved plan due six (6) months after contract signing.

Sec 4.7 - The system testing and implementation plan (draft), with the final approved plan due six (6) months after contract signing.

Sec 4.8 – The hosting and disaster recovery plan (draft), with the final approved plan due three (3) months after contract signing along with a DR test conducted four (4) months after signing. Sigma Resources will install and configure the system components in the DHS/Azure hosting environment as well as coordinate the monthly rollout process to promote changes to the UAT and production hosting environments.

Sigma Resources will administer the system and configure the hosting environment on behalf of the WIC Program and will execute both test and actual disaster recovery plans when a failover situation occurs.

The services in this Section 3 shall be referred to as the “Scope” in this Contract.

3.1. List of Exhibits

Helpdesk Service Level Agreement

WI Change Request Process

APPLICABLE LAW AND VENUE

This Contract shall be governed by the laws of the State of Wisconsin. The venue for any actions brought under this

Contract shall be the Circuit Court of Dane County, Wisconsin or the U.S. District Court for the Western District of

Wisconsin, as applicable.

INVOICING AND PAYMENTS

Invoices presented for payment must be submitted in accordance with instructions contained on the purchase order including reference to purchase order number and submittal to the correct address for processing.

5.1. Prompt Payment Law

DHS shall pay properly submitted Contractor invoices within 30 days of receipt, providing that the services to be provided to DHS have been delivered, rendered, or installed (as the case may be), and accepted as specified in this Contract and all documents incorporated herein by reference. A good faith dispute in regard to an invoice creates an exception to prompt payment pursuant to Wis. Stat. § 16.528.

5.2. State Tax Exemption

DHS is exempt from payment of Wisconsin sales or use tax on all purchases.

5.3. Payment Offsets for Contractor’s Delinquency

The State of Wisconsin may offset payments made to the Contractor under this Contract in an amount necessary to satisfy a certified or verifiable delinquent payment owed to the State or any state or local unit of government. DHS reserves the right to cancel this Contract as provided in Section 35.4, Contract Cancellation, if the delinquency is not satisfied by the offset or other means during the Contract term.

5.4. Refund of Credits

DHS may request a refund of credits owed at any time. Contractor agrees to refund credits owed within 60 days of DHS’ request.

CONTRACT AMENDMENT

This Contract may not be modified or amended except by mutual agreement of both parties in writing.

NO QUANTITY GUARANTEES

DHS may obtain related products and services from other sources during the term of the Contract. Other than as expressly provided herein, DHS makes no express or implied warranties whatsoever that any particular quantity or dollar amount of products or Services will be purchased through this Contract.

CONTRACTOR COMPLIANCE AND RESPONSIBILITY FOR ACTIONS

The Contractor shall at all times comply with and observe all federal, state, and local laws, ordinances, regulations, and DHS work rules that are in effect during the term of this Contract that may affect the Contractor’s work or obligations hereunder. DHS shall notify Contractor as to any changes in such compliance obligations no later than fifteen (15) days prior to the date on which the change is proposed to become effective. The Contractor shall be solely responsible for its actions and those of its agents, employees, or Subcontractors under this Contract, and neither the Contractor nor any of the foregoing parties has authority to act or speak on behalf of DHS.

INDEPENDENT CONTRACTOR AND APPARENT AGENCY

The Contractor, its officers, agents, and employees, in the performance of this Contract, shall act in the capacity of an independent contractor and not as an officer, employee, or agent of DHS. To the extent within its reasonable control, the Contractor agrees to take such steps as may be necessary toward assuring that each Subcontractor under this Contract will be deemed to be an independent contractor and will not be considered or permitted to be an agent, servant, joint venture, or partner of DHS.

The Contractor shall not take any action, or make any omission, that may imply, or cause others to reasonably infer, that the Contractor is acting as a DHS agent in any matter or in any way not expressly authorized by this Contract.

CONTRACTOR PERSONNEL

10.1. Identification of Contracted Personnel

If requested by DHS, the Contractor will provide a list of the names of all Contractor’s employees, contracted personnel, or Subcontractor’s employees who may at any time require admission to the State’s premises in connection with the rendering of Services, specifying each such person’s connection to the Contractor, the role the person is to take in the performance of the Contract, and other information as requested by DHS. DHS reserves the right to refuse to admit to the State’s premises any person employed or contracted by the

Contractor.

The Contractor shall furnish each contracted personnel with a means of identifying themselves as agents, Subcontractors, or employees of the Contractor assigned to perform Services under the Contract, and furnish

DHS with security credentials on these contracted personnel, if requested.

10.2. Right to Approve Changes of Contracted Personnel

DHS shall be apprised of any change of key contracted personnel. Any changes in key personnel must ensure compliance with this Contract. Key positions for the contract are defined as the Project Manager, Technical

Lead, and HelpDesk Supervisor. DHS shall notify Contractor if it determines that any change in key personnel may interfere with performance of this Contract and Contractor shall take appropriate and timely action to cure by making personnel changes as it deems necessary to perform this Contract.

10.3. Removal of Contracted Personnel

DHS shall make Contractor aware of any business concerns with Contractor’s/Subcontractor’s personnel and

Contractor shall take necessary action to ensure that its employees do not interfere with the operations of DHS, including removing Contractor’s/Subcontractor’s personnel from the DHS facility or site, if necessary. DHS’ right to do so does not implicate DHS as a party to any of the Contractor’s obligations in the Contract. DHS may request that key personnel or personnel that will perform Services on-site at a DHS facility be replaced within thirty (30) Calendar Days from such removal.

BACKGROUND CHECKS

Prior to the commencement of any Services under this Contract, in order to ensure safety and security at its premises, DHS may request a background or criminal history investigation of contracted personnel at any time during the term of this Contract for any of Contractors’ contracted personnel and Subcontractor’s employees, who will be providing Services to DHS under the Contract. If any contracted personnel, including Subcontractor’s employees, providing Services to DHS under this Contract are not acceptable to DHS to ensure safety and security in its premises, in its sole discretion as a result of the background or criminal history investigation, DHS shall provide notice to the Contractor that the contracted personnel do not meet DHS’ safety and security needs and that the personnel will not be allowed on DHS premises. Contractor shall as soon as practicable replace the contracted personnel with another of its contracted personnel in order to ensure compliance with this Contract.

PERFORMANCE OF SERVICES

Timely provision of Services required under this Contract is of the essence, including the provision of Services within any time frames specified as a part of this Contract. The Contractor shall render Services with all due skill, care, and diligence, in accordance with standard industry practices and legal requirements to the satisfaction of

DHS. DHS may inspect, observe, and examine the performance of the Services rendered on the State’s premises at any time. DHS may inspect, observe, and examine the performance of Contractor’s Services on any other premises at reasonable times, without notice.

If DHS reasonably determines and notifies the Contractor in writing that the Services rendered do not conform in a material manner to the description of the Services agreed to by the parties in the Contract for any reason other than as a result of DHS’ default or negligence, the Contractor shall bring such Services into conformity with the

Contract requirements within a time period mutually agreed upon by the parties. This remedy shall be in addition to any other remedies available to DHS by law or in equity. If requested by DHS, Contractor shall supply a Corrective

Action Plan (CAP) which will outline the Contractor’s solution to the non-complying issue. Acceptance of this

CAP will be at the sole discretion of DHS.

COOPERATION WITH OTHER CONTRACTORS

In the event that DHS enters into a Contract with another contractor for additional services, to the extent reasonably practicable the Contractor will ensure that Contractor’s personnel fully cooperate with said other Contractor.

Contracted personnel shall not commit any act that interferes with the rendering of Services by any other Contractor or by DHS. Contracted personnel shall cooperate with State personnel, hardware manufacture representatives, system software Contractors, and communications systems Contractors in the provision of Services under this

Contract. Notwithstanding the foregoing, in the event that such cooperation would require a material alteration of the Services as originally agreed to by the parties, Contractor and DHS shall amend this Contract and the Services provided for herein to account for such alteration.

SPECIFICATIONS

The apparent silence of the DHS’ specifications as to any detail, or the apparent omission of a detailed description concerning any matter, shall be regarded as meaning that only the best commercial practice shall be followed and only material and workmanship of the first quality may be used. Upon any notice of noncompliance provided by

DHS, Contractor shall supply proof of compliance with the specifications or provide written notice of their intent to deliver alternate or substitute Services or deliverables. Alternate or substitute Services or deliverables may be accepted or rejected in the sole discretion of DHS, and any such alternates or substitutes shall be accompanied by

Contractor’s certification and evidence satisfactory to DHS that the function, characteristics, performance and endurance shall be equal or superior to the original Services or deliverables specified. DHS will not unreasonably withhold the approval of alternates or substitutes under this section. Notwithstanding the foregoing, Contractor shall be permitted to exercise its reasonable discretion in implementing the Services in accordance with the specifications agreed to by the parties in the Scope of this Contract, provided that the Services do not materially deviate from such Scope.

INSURANCE RESPONSIBILITY

The Contractor shall maintain the following insurance coverage:

a) Worker’s compensation insurance, as required by Wis. Stat. ch. 102 or applicable state law where contracted personnel are employed, for Contractor’s contracted personnel engaged in work performed under this Contract;

b) As the employer of the contracted personnel, Contractor shall fund an account with the Wisconsin unemployment reserve fund or, if the Contractor employs contracted personnel to work under this Contract in another state, the reserve fund in the state where the contracted employees are employed, as required by applicable statutes and regulations;

c) Commercial liability, bodily injury and property damage insurance against any claim(s) that may occur in carrying out the terms of this Contract, with a minimum coverage of one million dollars ($1,000,000) liability for bodily injury and property damage including products liability and completed operations; and

d) Motor vehicle insurance for all owned, non-owned and hired vehicles that are used in carrying out the terms of this Contract, with a minimum coverage of one million dollars ($1,000,000) per occurrence combined single limit for automobile liability and property damage.

The Contractor shall maintain a Certificate of Insurance, showing up-to-date coverage, and shall be made available to DHS upon request.

WARRANTY AND LIENS

The Contractor warrants and represents that, to the extent applicable, all deliverables ordered under this Contract are free and clear of all liens, claims or encumbrances of any kind.

Deliverables and Services rendered shall be strictly in accordance with the Scope of this Contract and may not deviate in any way from the terms, conditions or specifications of this Contract, without the prior written approval of DHS. Deliverables delivered under this Contract may be subject to inspection and testing upon receipt.

The Contractor warrants that the deliverables provided shall conform to the specifications in this Contract, are fit and sufficient for the purpose manufactured, of good material and workmanship, and free from defect. To the extent applicable, deliverables offered must be new and unused and of the latest model or manufacture, unless otherwise specified by DHS. Items shall be equal in quality and performance to the standards indicated herein. Deliverables delivered that do not conform to the Contract terms, conditions, and specifications may be rejected and returned to be corrected by the Contractor. Contractor shall assign to DHS its right to recover under any warranties applicable to the deliverables offered.

CONFLICT OF INTEREST

Contractor represents and warrants the following: That Contractor has no business, professional, personal, or other interest, including, but not limited to, the representation of other clients, that would conflict in any manner or degree with the performance of its obligations under this Contract.

17.1. Notice of Potential Conflict

If any such actual or potential conflict of interest arises under this Contract, Contractor shall immediately inform DHS in writing of such conflict. Full written disclosure shall include, but is not limited to, identification of all persons implicated and a complete description of all relevant information.

If any such actual or potential conflict of interest is identified by DHS under this Contract, DHS shall immediately inform the Contractor in writing of such conflict and request a full investigation. A request for investigation must include a written disclosure that contains, but is not limited to, identification of all persons implicated and a complete description of all relevant information.

If any such actual or potential conflict of interest is identified by either DHS or the Contractor, a final determination will be made, at the sole discretion of DHS, as to whether a conflict exists, and, if so, what mitigation activities shall be taken.

Additionally, if either DHS or the Contractor identifies required work functions that present an actual or potential conflict of interest internally to the Contractor and/or externally to DHS, the Contractor shall immediately make full written disclosure of such facts to DHS. Full written disclosure shall include, but will not be limited to, identification of all persons implicated, a complete description of all relevant information and a potential resolution of the conflict describing assurance that the required work functions will not pose additional conflicts on an ongoing basis.

OWNERSHIP RIGHTS

Unless an ownership interest is granted or reserved in this Contract, a State Purchase Order issued under this

Contract shall allow DHS unrestricted authority to reproduce, distribute, and use any submitted report, data, or material, and any software or modifications and any associated documentation that is designed or developed and delivered to DHS as part of the performance of the Contract.

18.1 Royalty-Free Rights to Use Software or Documentation Developed 2 CFR 200.315 Intangible property.

(a) Title to intangible property (see §200.59 Intangible property) acquired under a federal award vests upon acquisition in the non-Federal entity. The non-Federal entity must use that property for the originally-authorized purpose and must not encumber the property without approval of the Federal awarding agency.

When no longer needed for the originally authorized purpose, disposition of the intangible property must occur in accordance with the provisions in §200.313 Equipment paragraph (e).

(b) The non-Federal entity may copyright any work that is subject to copyright and was developed, or for which ownership was acquired, under a federal award. The Federal awarding agency reserves a royalty-free, nonexclusive and irrevocable right to reproduce, publish, or otherwise use the work for federal purposes and to authorize others to do so.

(c) The non-Federal entity is subject to applicable regulations governing patents and inventions, including government wide regulations issued by the Department of Commerce at 37 CFR Part 401, “Rights to

Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Awards, Contracts and Cooperative Agreements.”

(d) The Federal government has the right to:

(1) Obtain, reproduce, publish, or otherwise use the data produced under a federal award; and

(2) Authorize others to receive, reproduce, publish, or otherwise use such data for federal purposes.

CONFIDENTIAL, PROPRIETARY, AND PERSONALLY IDENTIFIABLE INFORMATION

In connection with the performance of the work prescribed in this Contract, it may be necessary for DHS to disclose to Contractor certain information that is considered to be confidential, proprietary, or containing Personally

Identifiable Information (Confidential Information). Confidential Information does not include information that:

(a) is or becomes publicly available through no breach by the Contractor; (b) was previously known to the

Contractor prior to the date of disclosure; (c) was acquired from a third party without any breach of an obligation of confidentiality; (d) was independently developed by a party without reference to Confidential Information of the other party; or (e) is required to be disclosed pursuant to a subpoena or other similar order of any court or government agency, provided, however, that the Contractor shall promptly inform DHS in writing and provide a copy thereof, and shall only disclose that Confidential Information necessary to comply with such subpoena or order. Except as expressly provided herein, the Contractor will not use or disclose any Confidential Information without DHS’ prior written consent, except disclosure to Contractor’s employees or consultants on a need-to-know basis and as outlined in the Scope. The Contractor shall not use such Confidential Information for any purpose other than the limited purposes set forth in this Contract, and all related and necessary actions taken in fulfillment of the obligations herein. The Contractor shall hold all Confidential Information in confidence, and shall not disclose such Confidential Information to any persons other than those directors, officers, employees, and agents who have a business-related need to have access to such Confidential Information in furtherance of the limited purposes of this Contract and who have been apprised of, and agree to maintain, the confidential nature of such information in accordance with the terms of this Contract.

Contractor shall institute and maintain the security procedures provided in the Scope of this Contract or such other commercially reasonable alternatives to such securities procedures as agreed to by the parties to maintain the confidentiality of the Confidential Information while in its possession or control including transportation, whether physically or electronically.

Contractor shall ensure that all indications of confidentiality contained on or included in any item of Confidential

Information shall be reproduced by the Contractor on any reproduction, modification, or translation of such

Confidential Information. If requested by DHS, the Contractor shall make a reasonable effort to add a proprietary notice or indication of confidentiality to any tangible materials within its possession that contain Confidential

Information of DHS, as directed.

Contractor or its employees and Subcontractors will not reuse, sell, make available, or make use in any format the data researched or compiled for this Contract for any venture, profitable or not, outside this Contract. The restrictions herein shall survive the termination of this Contract for any reason and shall continue in full force and effect and shall be binding upon the Contractor or its agents, employees, successors, assigns, Subcontractors, or any party claiming an interest in this Contract on behalf of or under the rights of Contractor following any termination.

Contractor shall advise all of their agents, employees, successors, assigns and Subcontractors which are engaged by the State of the restrictions, present and continuing, set forth herein. Contractor shall defend and incur all costs, if any, for actions that arise as a result of noncompliance by Contractor, its agents, employees, successors, assigns and

Subcontractors regarding the restrictions herein.

Reporting to DHS: Contractor shall immediately report within five (5) business days to DHS any use or disclosure of

Confidential Information not in contravention of this Contract, of which it becomes aware. Contractor shall cooperate with DHS’ investigation, analysis, notification and mitigation activities, and shall be responsible for all costs incurred by DHS for those activities.

Indemnification: In the event of a breach of this Section by Contractor resulting in DHS being required to provide notification of a breach of security in accordance with applicable state or Federal data breach notification laws, Contractor shall indemnify and hold harmless DHS and any of its officers, employees, or agents from any third party claims arising from the acts or omissions of the Contractor, and its Subcontractors, employees and agents, in violation of this Section, including but not limited to, costs of credit monitoring and identity theft restoration coverage for one (1) year of coverage from the date the individual enrolls, of all persons whose Confidential

Information was disclosed, disallowances or penalties from federal oversight agencies, and any court costs, expenses, and reasonable attorney fees, incurred by DHS in the enforcement of this Section.

Equitable Relief: The Contractor acknowledges and agrees that the unauthorized use, disclosure, or loss of

Confidential Information may cause immediate and irreparable injury to the individuals whose information is disclosed and to DHS, which injury will not be compensable by money damages and for which there is not an adequate remedy available by law. Accordingly, the parties specifically agree that DHS, in its own behalf or on behalf of the affected individuals, may seek injunctive or other equitable relief to prevent or curtail any such breach, threatened or actual, without posting security and without prejudice to such other rights as may be available under this Contract or applicable law.

Liquidated Damages The Contractor agrees that an unauthorized use or disclosure of PII may result in damage to the State’s reputation and ability to serve the public interest in its administration of programs affected by this

Contract. Such amounts of damages which will be sustained are not calculable with any degree of certainty and thus shall be set forth herein. DHS shall assess reasonable damages related to the unauthorized disclosure of PII as appropriate and notify the Contractor in writing of the assessment. The Contractor shall automatically deduct any assessed damages from the next appropriate monthly invoice, itemizing the assessment deductions on the invoice.

Liquidated Damages shall not exceed the following:

i. $1,000 for each individual whose PII was used or disclosed;

ii. $2,500 per day for each day that the Contractor fails to substantially comply with the any Corrective

Action Plan delivered to Contractor in writing under this Section.

iii. Overall liquidated damages may not exceed $500,000 for the contract.

DHS may conduct a compliance review of the Contractor’s security procedures to protect PII under Section 33

(Audits) of this Contract.

Limitations on Remedies: Notwithstanding any provision in this Contract to the contrary, the remedies in this

Section 19 shall be the sole remedies of DHS with respect to the acts or omissions of Contractor with respect to

Confidential Information.

DHS acknowledges that a limited scope of the WIC systems maintenance and operations is under the control of the

Contractor. DHS has selected and engaged the Microsoft Azure cloud hosting infrastructure to host certain

Confidential Information (the “Hosting Service”), as set forth in the Scope of this Contract. Contractor shall not be responsible for an unauthorized access to or use, loss, or disclosure of PII (a “Data Compromise”) by the Hosting

Service or any third party outside of Contractor’s direct control, including but not limited to any Data Compromise resulting from the Hosting Service or from personal computers not under the control of the Contractor, such as WIC clinic computers. DHS and the Contractor acknowledge and agree that the Contractor will be transitioning the WIC systems with potential existing security vulnerabilities and Contractor shall not be responsible for Data

Compromise that arises from system vulnerabilities in the WIC systems. The remedies provided under this Section

19 shall be available solely with respect to a willful or negligent act or omission of Contractor resulting in the breach, unauthorized use, disclosure, or loss of PII and shall not be available with respect to any act or omission by any third party outside the Contractor’s direct control.

Indemnification or liquidated damages related to acts or omissions under this Section 19 shall be further subject to the following limitations: (i) any liquidated damages under this Section shall be inclusive of any indemnification by

Contractor under this Section, and (ii) to the extent that the damages to DHS are reasonably calculable, the damages under this Section shall be limited to the lesser of the liquidated damages provided for herein or the actual damages.

HIPAA: The Contractor IS NOT a “business associate” pursuant to the definition under the Health Insurance

Portability and Accountability Act (HIPAA) and the regulations promulgated thereunder specifically 45 C.F.R.

§ 160.103.

This Section 19 shall survive the termination of the Contract.

SECURITY OF PREMISES, EQUIPMENT, DATA, AND PERSONNEL

During the performance of services under this Contract, the Contractor may have access to the personnel, premises, equipment, and other property, including data files, information, or materials (collectively referred to as “data”) belonging to DHS. The Contractor shall preserve the safety, security, and the integrity of the personnel, premises, equipment, data and other property of DHS, in accordance with the instruction of DHS, which shall not materially deviate from the security protocols set forth in the Scope of this Contract. The Contractor shall be responsible for damage to DHS’ equipment, workplace, and its contents, or for the loss of data, when such damage or loss is caused by the Contractor, contracted personnel, or Subcontractors, and shall reimburse DHS accordingly upon demand. This remedy shall be in addition to any other remedies available to the DHS by law or in equity.

INTELLECTUAL PROPERTY INFRINGEMENT AND LABOR STANDARDS

The Contractor guarantees that any items provided to DHS under this Contract were manufactured or produced in accordance with applicable state and federal labor laws, and the sale or use of said items shall not infringe any

United States patent, copyright, or other intellectual property rights of others. The Contractor shall at its own expense indemnify, defend and hold DHS harmless from any claims brought against DHS for any alleged patent, copyright or other intellectual property right infringement due to the sale or use of such items, provided that the

Contractor is promptly notified of such suit, and is given all related documents. The Contractor shall pay all costs, damages, and profits recoverable in any such infringement lawsuit.

RECORDS RETENTION

Pursuant to §19.36 (3) of the Wisconsin Statutes, all records of the Contractor that are produced or collected under this Contract are subject to disclosure pursuant to a public records request. The Contractor shall establish and maintain adequate records of all documentation developed or compiled and expenditures incurred under this

Contract. All expenditure records shall be kept in accordance with Generally Accepted Accounting Procedures

(GAAP). All procedures shall be in accordance with federal, State and local laws or ordinances. The Contractor, following final payment, shall retain all records produced or collected under this Contract for six (6) years after final payment is made. For the purpose of this contract, the records that the Contractor will produce are project deliverables and administrative documents such as project plans and invoices. Any record that is produced from the WIC systems such as participant records or vendor records are not produced by the Contractor. These records are produced by the WIC clinic and State Office staff through the use of the WIC systems. Furthermore, these records and backups will be retained in the DHS cloud hosting environment and will not be retained by the

Contractor. Contractor will not be required to retain records produced by the WIC systems.

EXAMINATION OF RECORDS

DHS shall at any time during normal business hours, upon reasonable notice, have access to and the right to examine, audit, excerpt, transcribe, and copy, on Contractor’s premises, any of the Contractor’s records and computer data storage media involving transactions directly pertinent to this Contract. If the material is on computer data storage media, the Contractor shall provide copies of the data storage media or a computer printout of such if DHS requests. Any charges for copies of books, documents, papers, records, computer data storage media or computer printouts provided by the Contractor shall not exceed the actual cost to the Contractor. This provision shall survive the termination, cancellation, or expiration of this Contract.

In addition, FNS reserves the right to examine any and all records associated with this contract.

BREACH NOT WAIVER

A failure to exercise any right, or a delay in exercising any right, power or remedy hereunder on the part of either party shall not operate as a waiver thereof. Any express waiver shall be in writing and shall not affect any event or default other than the event or default specified in such waiver. A waiver of any covenant, term or condition contained herein shall not be construed as a waiver of any subsequent breach of the same covenant, term or condition. The making of any payment to the Contractor under this Contract shall not constitute a waiver of default, evidence of proper Contractor performance, or acceptance of any defective item or work furnished by the

Contractor.

SEVERABILITY

If any provision of this Contract is found to be invalid, illegal or unenforceable under any applicable statute or law, it is to that extent deemed to be omitted and the remaining provisions of this Contract will not be affected in any way.

SURVIVAL

The provisions regarding Confidential Information, Examination of Records, and Indemnification shall survive the termination, expiration or conclusion of the Contract, along with any other provisions contained in this Contract that by their language, sense and context are intended to survive.

SOVEREIGN IMMUNITY

Nothing in this Contract may be construed to constitute a waiver of the State of Wisconsin’s sovereign immunity under the Eleventh Amendment to the United States Constitution and Article IV, Section 27 of the Wisconsin

Constitution.

INDEMNIFICATION AND LIMITED LIABILITY

28.1. Contractor shall hold DHS harmless and shall defend and indemnify DHS, its Agencies, officers and employees against any and all claims, suits, actions, liabilities and costs of any kind, including attorney’s fees, for personal injury or damage to property arising from the willful or negligent acts or omissions of the

Contractor, its agents, officers, employees or Subcontractors. In addition, the Contractor shall indemnify DHS for any federal funding disallowances or sanctions imposed on DHS for reasons attributable to the Contractor’s failure to perform in compliance with this Contract. Notwithstanding the foregoing, indemnification under

Section 19 shall be governed by the indemnification provisions provided in that section.

28.2. Except for Sections 19, which shall be governed by the provisions provided in that Section, 20, and 28.1, the cumulative liability of Contractor to DHS for actual or alleged damages arising out of, based on, or relating to this agreement, whether based upon breach of Contract, tort (including negligence), warranty or any other legal theory, will not exceed the amount invoiced by the Contractor for services rendered during the twelve (12) calendar months immediately preceding the calendar month in which such losses occurred or, for losses that occur in the first year of the Contract, the amount in the Reimbursement Plan for the first twelve (12) calendar months of the Contract.

28.3 In no event shall either party be liable to the other party or any other person or entity for any special, exemplary, indirect, incidental, consequential or punitive damages of any kind or nature whatsoever (including, without limitation, lost revenues, profits, savings or business) or loss of records or data, whether in an action based on contract, warranty, strict liability, tort (including, without limitation, negligence) or otherwise, even if such party has been informed in advance of the possibility of such damages or such damages could have been reasonably foreseen by such party.

STATE EMPLOYEES

The Contractor may not contract with or employ a state employee or an individual retained as a full-time Contractor by DHS during the term of this Contract. DHS may not contract with or employ a Sigma Resources employee or sub-contractor without Sigma Resource’s consent.

PROMOTIONAL ADVERTISING AND NEWS RELEASES

Reference to, or use of, the Great Seal of Wisconsin, the Wisconsin Coat of Arms, the DHS logo, or the name or likeness of any state official or employee for commercial promotion is strictly prohibited. News releases or release of broadcast e-mails pertaining to this Contract shall not be made without prior written approval of DHS. The

Contractor may identify DHS of Wisconsin as a client when the Contractor provides a list of Contractor’s clients.

ASSIGNMENT

No right or duty in whole or in part of either party under this Contract may be assigned or delegated without the prior written consent of the other party.

FORCE MAJEURE

Neither party shall be in default by reason of any failure in performance of this Contract in accordance with reasonable control and without fault or negligence on their part. Such causes may include, but are not restricted to, acts of nature or the public enemy, acts of the government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, freight embargoes and unusually severe weather, but in every case, the failure to perform such must be beyond the reasonable control and without the fault or negligence of the party.

AUDITS

33.1. Requirement to Have an Audit

Unless waived by DHS, the Contractor shall submit an annual audit to DHS if the total amount of annual funding provided by DHS (from any and all of its Divisions or subunits taken collectively) through this and other Grants is $100,000 or more. In determining the amount of annual funding provided by DHS, the

Contractor shall consider both: (a) funds provided through direct Grants with the DHS; and (b) funds from

DHS passed through another agency which has one or more Grants with the Contractor.

33.2. Audit Requirements

The audit shall be performed in accordance with generally accepted auditing standards, Wis. Stat. § 46.036, Government Auditing Standards as issued by the U.S. Government Accountability Office, and other provisions specified in this Contract. In addition, the Contractor is responsible for ensuring that the audit complies with other standards and guidelines that may be applicable depending on the type of services provided and the amount of dollars received. Please reference the following audit documents for complete audit requirements:

2 Code of Federal Regulations (C.F.R.), Part 200 - Uniform Administrative Requirements, Cost

Principles, and Audit Requirements for Federal Awards, Subpart F - Audits. The guidance also includes an Annual Compliance Supplement that details specific federal agency rules for accepting federal sub-awards.

The State Single Audit Guidelines (SSAG) expand on the…