8-Attachment B - USBE IT Terms and Conditions.pdf

Revised 11-9-21

ATTACHMENT B:

UTAH STATE BOARD OF EDUCATION

SUPPLEMENTAL INFORMATION TECHNOLOGY TERMS AND CONDITIONS

These supplemental terms and conditions are to be incorporated in a Contract of Information Technology Procurement Items and must be accompanied by the Utah State Board of Education (USBE) Standard Terms and Conditions. With the exception of the definitions in this Attachment B, the definitions in Attachment A apply to this attachment.

1. DEFINITIONS:

1.1. “Access to Secure USBE or LEA Facilities, Data, or Technology” means Contractor will

(a) enter upon secure premises controlled, held, leased, or occupied by USBE or LEA; (b) maintain, develop, or have access to any deployed hardware, software, firmware, or any other technology, that is in use by USBE or LEA; or (c) have access to or receive any Data or confidential information.

1.2. “Background IP” means intellectual property (IP) owned or controlled prior to the effective date of this Contract or that IP developed or acquired from activities independent of the services performed under this Contract, including but not limited to (a) methodologies, processes, technologies, algorithms, software, or development tools used in performing the Services, and (b) processes and reusable reports, designs, charts, plans, specifications, documentation, forms, templates, or output which are supplied or otherwise used by or on behalf of Contractor in the course of performing the Services or creating the Custom Deliverables, other than portions that specifically incorporate proprietary or confidential information or Custom Deliverables of USBE

1.3. “Contract Period” means the term of this Contract, as set forth on the Contract Signature Page(s).

1.4. “Custom Deliverables” means the product that Contractor is required to design, develop, or customize and deliver to USBE as specifically described under this Contract or an associated statement of work for which all interest and title shall be transferred to and owned by USBE.

This includes every invention, design, development, customization, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor pursuant to this Contract.

1.5. “Federal Criminal Background Check” means a fingerprint-based, nationwide background check conducted and processed by the FBI.

1.6. “Good” means any deliverable not classified as a Custom Deliverable or Service.

1.7. “Intellectual Property Rights” means all rights to patents, utility models, mask works, copyrights, trademarks, trade secrets, and other protection afforded by law to inventions, models, designs, technical information, and applications.

1.8. “Services” means the furnishing of labor, time, or effort by Contractor, and may include installation, configuration, implementation, technical support, warranty maintenance, and other support services.

2. CRIMINAL BACKGROUND SCREENING: Each employee of Contractor and Subcontractor must successfully complete a Federal Criminal Background Check prior to being granted Access to Secure USBE Facilities, USBE Data, or Technology.

2.1. USBE will provide Contractor with forms which must be filled out by Contractor and returned to USBE. Contractor or the applicable employee shall provide USBE with sufficient personal information (at Contractor’s expense) so that a Federal Criminal Background Check may be completed by USBE, at USBE’s expense.

2.2. Each employee of Contractor or a Subcontractor who will have Access to Secure USBE or

LEA Facilities, Data, or Technology must be fingerprinted by USBE or local law enforcement a minimum of one week prior to needing access. At the time of fingerprinting, said employee shall disclose all felony or misdemeanor convictions. USBE will conduct a Federal Criminal Background Check based upon the fingerprints and personal information provided and use this same information to complete a name check in the Utah Criminal Justice Information System (UCJIS) at least every two years.

2.3. USBE may revoke Access to Secure USBE or LEA Facilities, Data, or Technology granted in the event of any negative results.

2.4. Contractor and the employee or subcontractor shall immediately notify USBE if an arrest or conviction for a felony or misdemeanor of any person that has Access to Secure USBE or LEA Facilities, Data or Technology occurs during the Contract Period. USBE will determine in its discretion if such person’s Access to Secure USBE or LEA Facilities, Data, or Technology shall remain in effect. Felony and misdemeanor are defined by the laws of the State of Utah, regardless of where the conviction occurred.

3. ADDITIONAL INTELLECTUAL PROPERTY INDEMNIFICATION: Contractor warrants and represents it has full ownership and clear title free of all liens and encumbrances to any Good or Custom Deliverable delivered under this contract. Contractor also warrants that any Good, Custom Deliverable, or Service furnished by Contractor under this Contract, including its use by USBE in unaltered form, will not infringe any copyrights, patents, trade secrets, or other proprietary rights. Contractor will release, indemnify, and hold USBE harmless from liability or damages of any kind or nature, including Contractor's use of any copyrighted or un-copyrighted composition, secret process, patented or un-patented invention, article, or appliance furnished or used in Contractor’s performance of this Contract. Additionally, if such a claim or liability is based upon an allegation that a Good, Custom Deliverable, or Service furnished by Contractor infringes on any right protected by any patent, copyright, trademark, trade secret, and/or proprietary right, Contractor shall indemnify and hold harmless USBE for any judgments, settlements, costs, and reasonable attorneys’ fees resulting from such a claim or liability. Contractor shall defend all actions brought upon such matters to be indemnified hereunder and pay all costs and expenses incidental thereto; however, USBE shall have the right, at its option, to participate in the defense of any such action at its own expense without relieving Contractor of any obligation hereunder. If there are any limitations of liability in this Contract, such limitations will not apply to this section.

4. HARDWARE WARRANTY: IN ADDITION TO THE WARRANTY PROVISIONS OF THE USBE

STANDARD TERMS AND CONDITIONS, WITH RESPECT TO ANY HARDWARE DELIVERED

PURSUANT TO THIS CONTRACT, PRODUCT LIABILITY DISCLAIMERS AND/OR WARRANTY

DISCLAIMERS FROM CONTRACTOR OR ITS SUPPLIERS ARE REJECTED.

5. SOFTWARE WARRANTY: CONTRACTOR WARRANTS FOR A PERIOD OF 90 DAYS FROM

THE DATE OF ACCEPTANCE THAT THE SOFTWARE PORTIONS OF THE GOODS AND

CUSTOM DELIVERABLES THAT CONTRACTOR DIRECTLY OR INDIRECTLY PROVIDES

WILL MEET THE TERMS OF THE WARRANTY PROVISIONS OF THE USBE STANDARD

TERMS AND CONDITIONS. IN ADDITION TO THE WARRANTY PROVISIONS OF THE USBE

STANDARD TERMS AND CONDITIONS, CONTRACTOR SHALL PROVIDE USBE WITH BUG

FIXES, INCLUDING INFORMING USBE OF ANY KNOWN SOFTWARE BUGS OR SOFTWARE

DEFECTS THAT MAY AFFECT USBE’S USE OF THE SOFTWARE.

6. SOFTWARE AND HARDWARE WARRANTY REMEDIES: Upon breach of warranty, Contractor will repair or replace (at no charge to USBE) the nonconforming Goods or Custom Deliverables. If the repaired and/or replaced products are inadequate, Contractor will refund the full amount of any payments that have been made for the failed products. These remedies are in addition to any other remedies provided by USBE Standard Terms and Conditions or by law or equity.

7. UPDATES AND UPGRADES: Contractor grants to USBE a non-exclusive, non-transferable license to use upgrades and updates provided by Contractor during the Contract Period.

Upgrades and updates are subject to the terms of this Contract. USBE reserves the right to accept updates and upgrades at its discretion and to determine if such updates comply with the requirements in the Contract scope of work.

8. BUG FIXING AND REMOTE DIAGNOSTICS: Contractor shall use commercially reasonable efforts to provide work-around solutions or patches to reported software problems. With USBE’s prior written authorization, Contractor may perform remote diagnostics to work on reported problems. If USBE declines remote diagnostics, Contractor and USBE may agree to on-site technical support, subject to the terms of the Contract.

9. TECHNICAL SUPPORT AND MAINTENANCE: If technical support and maintenance is required by the Contract, Contractor will use commercially reasonable efforts to respond to USBE in a reasonable time, and in all events, in accordance with the specific timeframes detailed in the Contract, when USBE makes technical support or maintenance requests.

10. ELECTRONIC DELIVERY: Contractor may electronically deliver any Good or Custom Deliverable to USBE or provide any Good and Custom Deliverable for download from the Internet if pre-approved in writing by USBE. Contractor shall ensure the confidentiality of electronic deliveries in transit. Contractor warrants that all electronic deliveries will be free of known malware, bugs, Trojan horses, etc.

11. SECURE PROTECTION AND HANDLING OF STATE DATA: If Contractor is given access to Data, the protection of Data shall be an integral part of the business activities of Contractor, and Contractor shall ensure that there is no inappropriate or unauthorized use of Data. Contractor shall safeguard the confidentiality, integrity, and availability of the Data and comply with the conditions outlined below. USBE reserves the right to verify Contractor’s adherence to the following conditions to ensure they are met.

11.1. Change of Circumstances: Contractor shall notify USBE of material changes to

Contractor’s organization (e.g., management, sale, merger, etc.), infrastructure, system, software licensing, security or privacy controls, IT security organization, or loss prevention controls that may impact the security of Data. Contractor shall notify USBE prior to such changes being implemented.

11.2. Network Security: Contractor shall maintain network security that, at a minimum, includes network firewall provisioning, intrusion detection, and regular third-party penetration testing. Contractor shall maintain network security using methods that are at least as good as or better than that established in the latest version of the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity,” also referred to as NIST Cybersecurity Framework (https://www.nist.gov/cyberframework).

11.3. Data Security. Contractor shall comply with and protect and maintain the security of Data using methods that are at least as good as or better than that established in the latest version of NIST “Framework for Improving Critical Infrastructure Cybersecurity”/ NIST Cybersecurity Framework (http://nist.gov/cyberframework). These security measures include but are not limited to maintaining secure environments that are patched and up to date with all appropriate security updates as designated (ex. Microsoft Notification). USBE reserves the right to determine if Contractor’s level of protection meets USBE’s security requirements.

11.4. Data Transmission: Contractor shall ensure all transmission or exchange of Data, including system application data with USBE and/or any other parties expressly designated by USBE, shall take place via secure means (ex. HTTPS or FTPS).

11.5. Data Encryption: Contractor shall store all Data provided to Contractor, as well as any backups made of that data, in encrypted form using industry standard and currently supported cryptographic protocols and include all data as part of a designated backup and recovery process

12. SERVICES SHALL BE PERFORMED WITHIN UNITED STATES: ALL OF THE SERVICES

RELATED TO DATA SHALL BE PERFORMED WITHIN THE BORDERS AND JURISDICTION

OF THE UNITED STATES.

13. INCIDENT RESPONSE: In addition to the Incident Response provisions of USBE’s Standard Terms and Conditions, the following terms apply:

https://www.nist.gov/cyberframework http://nist.gov/cyberframework

13.1. Remediation Plan. Contractor shall produce a written remediation plan that includes information about the cause and extent of the Incident, and the actions Contractor will take to remediate the Incident and reduce the risk of incurring a similar type of Incident in the future.

Contractor shall present its analysis and remediation plan to USBE within 10 calendar days of notifying USBE of an Incident. USBE reserves the right to adjust this plan, in its sole discretion. If Contractor cannot produce its analysis and plan within the allotted time, USBE, in its sole discretion, may perform such analysis and produce a remediation plan, and Contractor shall reimburse USBE for the reasonable costs thereof.

13.2. Breach: In the event of the Breach, Contractor shall promptly implement necessary remedial measures and document responsive actions taken related to the Breach including any post-incident review of events and actions taken to make changes in business practices in relation to the Breach.

Contractor shall provide USBE or its designated representatives with access to records, systems, processes, and locations relevant to the performance of the Contract seven days a week, 24 hours a day, for the purpose of evaluating, mitigating, or resolving the Breach.

In addition to the notification requirements measures required in the General Terms and Conditions, Contractor or Subcontractor shall cooperate with USBE in identifying the individuals whose personally identifiable data has been placed at risk by the Breach and cooperate with and at the direction of USBE in notifying the individuals as required by law.

14. OWNERSHIP IN CUSTOM DELIVERABLES: Contractor warrants, represents and conveys full ownership, clear title free of all liens and encumbrances to any Custom Deliverable to USBE. All intellectual property rights, title and interest in the Custom Deliverables shall transfer to USBE, subject to the following:

14.1. Contractor has received payment for the Custom Deliverables;

14.2. Each party will retain all rights to Background IP, even if embedded in the Custom

Deliverables;

14.3. Custom Deliverables, excluding Contractor’s Background IP may not be marketed or distributed without written approval by USBE; and

14.4. Contractor shall grant to USBE a perpetual, irrevocable, royalty-free license to use

Contractor’s Background IP as defined above, solely for USBE to use with the Custom Deliverables.

15. SURVIVORSHIP: The contractual provisions that will remain in effect after expiration or termination of this Contract are: (a) Secure Protection and Handling of State Data; (b) Data Breach Responsibilities; (c) Ownership in Custom Deliverables; (d) Ownership, Protection, and Use of Records, including Residuals of such records; and (e) Ownership, Protection, and Use of Confidential Federal, Utah, USBE, LEA, or Local Government Internal Business Processes, including residuals of such confidential business processes; (f) Ownership, Protection, and Return of Documents and Data Upon Contract Termination or Completion; and (g) any other terms that by their nature would survive the expiration, completion, or termination of this contract.

16. COMPLIANCE WITH ACCESSIBILITY STANDARDS: Contractor shall comply with the Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973. Contractor shall comply with Utah Administrative Code R895-14-3(3), which states that contractors developing new websites or applications for State agencies are required to meet accessibility guidelines subject to rule R895 and correct any items that do not meet these guidelines at no cost to USBE. Contractor shall comply with Utah Administrative Code R895-14-4(2), which states that contractors proposing IT products and services shall provide Voluntary Product Accessibility Template® (VPAT™) documents.

17. TIME IS OF THE ESSENCE: The Services shall be completed, and Goods and Custom Deliverables delivered by any applicable deadline stated in this Contract. Time is of the essence.

18. STANDARD OF CARE: For Services of Contractor which require licenses and certifications, such Services shall be performed in accordance with the standard of care exercised by licensed members of their respective professions having substantial experience providing similar services which similarities include the type, magnitude, and complexity of the Services that are the subject of this Contract.