Appendix A - MCPS General Contract Articles 2026 Update.pdf

APPENDIX A

(MCPS General Contract Articles)

ARTICLE 1. DESCRIPTION AND GENERAL INTENT

For the purposes of these MCPS General Contract Articles, “MCPS” refers to the Board of Education of Montgomery County, which operates a system of public schools commonly known as Montgomery County Public Schools, and “Contractor” refers to the entity awarded a Contract pursuant to authorization by MCPS in accordance with applicable laws, Board of Education policies, and MCPS regulations. Together MCPS and the Contractor are collectively referred to as the “Parties” and each individually as a “Party.” The term “Contract” refers to these MCPS General Contract Articles and any other contract documents duly executed by the Parties that expressly incorporate these MCPS General Contract Articles by reference, as well as any request for proposals (RFP) or solicitation by MCPS, the Contractor’s proposal or bid in response, if satisfactory to MCPS in its sole discretion, and any Contract award notification issued by MCPS.

ARTICLE 2. MCPS PROJECT CONTACT

The MCPS Project Contact is responsible for the technical and programmatic aspects of the Contract and is the technical and programmatic liaison with the Contractor. The MCPS Project Contact is responsible for the review and approval of any and all deliverables, products, and/or services, and such other responsibilities as may be specified in the Contract. The MCPS Project Contact is not authorized to make any commitments, otherwise obligate MCPS, or make any changes which affect the Contract price, terms, or conditions. Any Contractor requests for changes to the Contract price, terms, or conditions shall be referred to the Director of the MCPS Department of Procurement or designee. No such changes shall be made without the written authorization of the Procurement Director. The MCPS Project Contact may be changed at any time, provided that notification of the change, including the name and address of the successor MCPS Project Contact, is provided to the Contractor in writing. Any written notice by the Contractor to MCPS required under the Contract shall be provided to the Procurement Director, with a copy to the MCPS Project Contact, using contact information available on the MCPS website.

ARTICLE 3. INDEPENDENT CONTRACTOR

The Parties agree that the Contractor is an independent contractor under the Contract and will in no way be considered to be an agent, partner, or employee of, or joint venture with, MCPS. Neither the Contractor nor its employees, agents, affiliates, or subcontractors will be entitled to any benefits, coverage, or other privileges made available to MCPS employees.

ARTICLE 4. KEY CONTRACTOR PERSONNEL

Any of the Contractor’s key personnel, identified as such in the Contract, are considered to be essential to the work being performed under the Contract. Prior to diverting any such key personnel to other programs, the Contractor shall notify the MCPS Project Contact reasonably well in advance and submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the Contract. No diversion shall be made by the Contractor without the written consent of the MCPS Project Contact. Failure to obtain the approval of the MCPS Project Contact as required or to propose replacement personnel acceptable to the MCPS Project Contact may be cause for termination pursuant to Article 13. MCPS reserves the right to require that the Contractor replace any key personnel or any individual charged to the Contract at any point during the Contract term if MCPS determines that this action is in its best interests.

ARTICLE 5. CONTRACTOR RESPONSIBILITY

A. The Contractor shall furnish all personnel, materials, products, tools, services, and facilities necessary to perform the requirements set forth in the Contract. All deliverables, products, and/or services required by the Contract shall be submitted to the MCPS Project Contact according to the kinds and dates indicated in the Contract. MCPS has relied upon the professional ability and training of the Contractor as a material inducement to enter into the Contract. The Contractor hereby agrees that all of the Contractor’s work shall be performed in a professional and workmanlike manner, through only qualified and appropriately trained personnel, and consistent with the highest industry standards in compliance with applicable federal, state, and county laws and regulations—it being understood that acceptance of the Contractor’s work by MCPS shall not operate as a waiver or release of the Contractor’s obligations.

B. The Contractor acknowledges and agrees that time is of the essence with respect to its obligations under the Contract and that prompt and timely performance of all such obligations, including conformance with all timetables and other requirements of the Contract, is strictly required.

C. The Contractor shall obtain any licenses or permits necessary for performance of the work required under the Contract. In the event the work to be performed by the Contractor must by law or regulation be provided by individuals who are licensed and/or certified to provide certain Professional Services, the Contractor shall only assign individuals to perform work under the Contract who are licensed and/or certified in accordance with applicable law, and all such individuals shall maintain their license and/or certification in good standing (not under review or subject to suspension) during the entire term of the Contract. “Professional Services” for the purpose of the Contract shall mean any service provided by a licensed, certified, or otherwise documented professional. Upon request by MCPS, the Contractor shall promptly submit documentation to the MCPS Project Contact that the individuals assigned to provide Professional Services under the Contract are properly licensed and/or certified.

D. Any performance or bid bond obligations of the Contractor will be as described in the RFP or solicitation.

E. Whenever the Contractor has knowledge that any actual or potential situation (including, but not limited to, labor disputes) delaying or threatening to delay the timely performance of the work under the Contract or a force majeure event as described in Article 7, the Contractor shall immediately give written notice, including all relevant information, to the Procurement Director.

F. The Contractor shall comply with all applicable federal, state, and county laws and regulations, as well as all applicable safety requirements, Board of Education policies, and MCPS regulations issued by the Superintendent of Schools. Board of Education policies and MCPS regulations are available at this link:

www.montgomeryschoolsmd.org/departments/policy/. This obligation includes but is not limited to Board of Education Policy ACA, Nondiscrimination, Equity, and Cultural Proficiency (“Board Policy ACA”), which prohibits discrimination based on actual or perceived personal characteristics, including race, ethnicity, color, ancestry, national origin, religion, immigration status, sex, gender, gender identity, gender expression, sexual orientation, family/parental status, marital status, age, physical or mental disability, poverty and socioeconomic status, language, or other legally or constitutionally protected attributes or affiliations. Consistent with Board Policy ACA and applicable federal, state, and county laws and regulations, the Contractor will not discriminate against any of its employees or applicants for employment because of the actual or perceived personal characteristics listed above. The Contractor will take affirmative action to ensure that applicants are employed and that employees are treated during employment without regard to these actual or perceived personal characteristics. In addition, the Contractor agrees to provide such accommodations as are required under federal, state, and county laws and regulations, including but not limited to the Individuals with Disabilities Education Act (IDEA), the Americans with Disabilities Act, Section 504 of the Rehabilitation Act of 1973.

G. The Contractor shall provide a drug-free workplace in accordance with the Drug-Free Workplace Act of 1988 and its implementing regulations, Board of Education Policy IGN, Preventing Alcohol, Tobacco, and other Drug Abuse in Montgomery County Public Schools, and MCPS Regulation COF-RA, Alcohol, Tobacco, and other Drugs on Montgomery County Public Schools Property.

H. Violation of this Article constitutes a breach of contract for which MCPS may terminate the Contract pursuant to Article 13 and/or pursue any other appropriate remedy.

http://www.montgomeryschoolsmd.org/departments/policy/

ARTICLE 6. SUBCONTRACTORS

Work performed under the Contract shall not be subcontracted without advance written approval of the Procurement Director; nor shall any substitution of subcontractors be made without such advanced approval in writing. For the purposes of this Section, “subcontracting” includes the use of third-party platforms software-as-a-service (SaaS) providers, or infrastructure hosts used to deliver the Services. The Contractor shall include provisions in its subcontracts and third-party platform agreements requiring its subcontractors and providers to comply with the Contract, to indemnify, defend, and hold harmless MCPS, and to provide insurance coverage for the benefit of MCPS, in a manner consistent with the Contract. Furthermore, the Contractor shall ensure that all terms and conditions related to data security, privacy, and service levels “pass through” to any third-party platform provider. Any costs associated with third-party platform usage shall be treated as pass-through costs only to the extent explicitly authorized in the Pricing Schedule; otherwise, the Contractor remains solely responsible for such expenses. The Contractor also shall cause its employees, agents, affiliates, third-party providers, and subcontractors to comply with the Contract and adopt such review, audit, and inspection procedures as are necessary to assure such compliance.

ARTICLE 7. FORCE MAJEURE

Neither Party shall be deemed to be in default of its obligations hereunder if and so long as it is prevented from performing such obligations by any act of war, hostile foreign action, nuclear explosion, earthquake, hurricane, tornado, or other catastrophic event. Should there be such an occurrence that impacts the ability of either Party to perform its responsibilities under the Contract, the nonperforming Party shall give immediate written notice to the other Party to explain the cause and probable duration of any such nonperformance. If the Procurement Director determines that a failure to perform was occasioned by any one or more of the said causes, the delivery schedule shall be revised accordingly, subject to the rights of MCPS to invoke Articles 12 and 13.

ARTICLE 8. PAYMENT TERMS AND CONDITIONS

A. The Contractor certifies that all information the Contractor has provided or will provide to MCPS is true and correct and can be relied upon by MCPS in awarding, modifying, making payments, or taking any other action with respect to the Contract including resolving disputes. Any false or misleading information is a ground for MCPS to terminate the Contract pursuant to Article 13 and/or pursue any other appropriate remedy. The Contractor certifies that the Contractor’s accounting system conforms to generally accepted accounting principles, is sufficient to comply with the Contract’s obligations, and produces reliable financial information.

B. The prices, rates and other compensation for work performed is as described in the Contract.

C. The Contractor’s invoices shall be approved for payment by the MCPS Project Contact only after the MCPS Project Contact is satisfied that the Contractor is performing the work and has prepared the invoice as required by the Contract. Prior to approving any Contractor invoices for payment, MCPS, through any authorized representative, has the right at all reasonable times to inspect, or otherwise evaluate, the work performed or being performed at the premises on which it is being performed. If any inspection or evaluation is made by MCPS on the premises of the Contractor or any of its subcontractors, the Contractor shall provide and shall require its subcontractors to provide all reasonable facilities and assistance for the safety and convenience of MCPS representatives in the performance of their duties.

All inspections and evaluations shall be performed so that they will not unduly delay the work.

D. Within thirty (30) days after receipt of each invoice and accepting the work, MCPS shall, except as provided in the Contract, pay for the work performed when approved by the MCPS Project Contact. A payment schedule will be jointly developed between MCPS and the Contractor. MCPS reserves the right to submit payment using an electronic payment method, such as credit card, Single Use Account, or Automated Clearing House. The Contractor shall not assess MCPS with any additional charge, fee, or price for the use of these electronic payment methods.

E. Regardless of any other provisions of the Contract, failure of the Contractor to submit required reports when due or failure to perform or deliver acceptable work, deliverables, products, or services will result in MCPS withholding payments under the Contract unless such failure arises pursuant to Article 7 and without the fault or negligence of the Contractor. MCPS shall promptly notify the Contractor of its intention to withhold payment of any invoice submitted.

F. MCPS is tax exempt as a governmental entity. The Contractor shall be responsible for all federal and/or state tax, and Social Security liability that may result from the performance of and compensation for its work. MCPS assumes no responsibility for the payment of any compensation, wages, benefits, or taxes by, or on behalf of the Contractor, its employees, agents, affiliates, and/or subcontractors by reason of the Contract.

G. If at any time MCPS determines that a cost for which payment has been made is a disallowed cost, such as overpayment, MCPS shall notify the Contractor in writing of the disallowance or claim for unallowable costs. MCPS shall also state the means of correction, which may be, but shall not be limited to, adjustment of any future claim submitted by the Contractor by the amount of the disallowance, or to require repayment of the disallowed amount by the Contractor.

ARTICLE 9. CHANGES

The Procurement Director may, at any time, make non-material changes that are within the original general scope of the Contract and the RFP or solicitation in any one or more of the following: (i) specifications or statement of work, and (ii) place of performance or delivery. If any such changes cause an increase or decrease in the cost of or the time required for the performance of the Contract, whether changed or not changed by any such order, an equitable adjustment shall be made: (i) in the Contract price or time of performance or both; and/or (ii) in such other provisions of the Contract as may be so affected; and the Contract shall be modified in writing accordingly.

Any claim by the Contractor for adjustment under this Article must be asserted within thirty (30) days from the date of receipt by the Contractor of the notification of change, however, if the Procurement Director decides that the facts justify such action, the Procurement Director may receive and act upon any such claim asserted at any time prior to final payment under the Contract. Failure to agree to any adjustment shall be a dispute concerning a question of fact within the meaning of Article 15.

ARTICLE 10. AUDIT AND DOCUMENT RETENTION

During the term and for three (3) years thereafter, the Contractor shall: (i) maintain complete and accurate books and records regarding its business operations relevant to the calculation of amounts payable under the Contract and any other information relevant to the Contractor’s compliance with the terms and conditions of the Contract;

and (ii) upon MCPS’ request, make such books and records, as well as any of its employees, agents, affiliates, or subcontractors who might reasonably have information related to such records, available during normal business hours for inspection and audit by MCPS or its authorized representative, provided that MCPS shall: (a) provide the Contractor with reasonable prior notice of any audit; (b) undertake an audit no more than once per calendar year, except for good cause shown; and (c) conduct or cause to be conducted such audit in a manner designed to minimize disruption of the Contractor’s normal business operations.

ARTICLE 11. TERM OF CONTRACT

Unless otherwise specified in the Contract, the term of Contract shall be for one year, provided that the Contract is not terminated pursuant to Article 12, 13, or 14. After the initial term, MCPS, in its sole discretion, reserves the right to extend the Contract if agreed to by both Parties.

ARTICLE 12. TERMINATION FOR CONVENIENCE

The Contract may be terminated in whole or in part by MCPS whenever the Superintendent of Schools, or an authorized designee, determines that such a termination is in MCPS’ best interest. Any such termination shall be affected by delivery of a notice of termination to the Contractor, at least ten (10) business days prior to the termination date. The notice of termination shall specify the extent to which performance shall be terminated and the date upon which such termination becomes effective. The Contractor shall be entitled to receive just and equitable compensation for any work completed, as determined by MCPS, but no amount shall be allowed for anticipated profit on unperformed work. In the event of such termination, all finished and unfinished deliverables, documents, data, studies, surveys, drawings, maps, models, and reports prepared by the Contractor under the Contract shall become the property of MCPS.

ARTICLE 13. TERMINATION FOR CAUSE

A. Termination for Cause by MCPS

1. If, through any cause (other than as set forth in Article 7), the Contractor fails to fulfill in a timely manner its obligations under the Contract, or if the Contractor violates any of the covenants, agreements or stipulations of a Contract (hereinafter a “Default”), MCPS shall have the right to terminate the Contract, in addition to MCPS’ remedies in the Contract and all other rights available at law or in equity. Such termination shall be effected by MCPS delivering a written notice of termination to the Contractor, which notice may, in the sole discretion of MCPS, provide for a period of up to thirty (30) days for the Contractor to cure the Default. If MCPS provides for an opportunity to cure the Default and the Default is not remediated within the specified period, as determined by MCPS, MCPS shall issue a final notice of termination specifying the effective date of such termination.

2. A Contractor bankruptcy or bankruptcy event shall be deemed grounds for a termination for cause.

3. MCPS shall have the right to terminate Contract in the event of a Data Security Event.

4. In the event of such termination for cause, all finished and unfinished deliverables, documents, data, studies, surveys, drawings, maps, models, and reports prepared by the Contractor under the Contract shall become the property of MCPS.

5. A termination for cause is a termination for convenience if the termination for cause is later found to be without justification.

6. The Contractor shall be entitled to receive just and equitable compensation for any work completed prior to termination, as determined by MCPS, but no amount shall be allowed for anticipated profit on unperformed work.

7. Notwithstanding the foregoing provisions, the Contractor shall not be relieved of liability to MCPS for damages sustained by MCPS by virtue of any breach of Contract by the Contractor for the purposes of set off, until the exact amount of said damages is ascertained.

B. Termination for Cause by the Contractor

1. If, through any cause (other than as set forth in Article 7), MCPS is in breach of the Contract and has not cured such breach within thirty (30) days of written notice from the Contractor specifying the same, the Contractor shall have the right to immediately terminate the Contract. Such termination shall be effected by delivering a notice of termination to the Procurement Director specifying the effective date of such termination.

ARTICLE 14. NON-APPROPRIATION

If the term of the Contract, or any Contract extension, extends beyond the end of the MCPS fiscal year (July 1 to June 30) in which the Contract was awarded or extended, and the approved MCPS budget for the subsequent fiscal year does not appropriate sufficient funds that may be utilized for the Contract, the Contract shall no longer be in force and effect upon the expiration of the current fiscal year funding. In this event, upon expiration of the current fiscal year funding, MCPS shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other consideration under the Contract, and the Contractor shall not be obligated to perform any further work under the Contract. If the approved MCPS budget for the subsequent fiscal year reduces funding available for the Contract, MCPS shall have the option, in its sole discretion, to cancel the Contract with no liability occurring to MCPS, or offer a Contract amendment to the Contractor reflecting the reduced amount, which the Contractor may accept in lieu of termination.

ARTICLE 15. DISPUTES

The Parties shall collaborate to resolve any disputes arising under the Contract. In the event that the Parties are not able to resolve a dispute concerning a question of fact arising under the Contract, the dispute shall be submitted in writing to the Procurement Director for a determination. The Contractor may appeal the decision of the Procurement Director in writing to the Superintendent of Schools, whose decision shall be final. This Article does not preclude consideration of questions of law arising under the Contract, provided that nothing in the Contract shall be construed as making final the decision of any MCPS official, representative, or the Board of Education on a question of law. THE PARTIES SPECIFICALLY AGREE THAT NO DISPUTE OR CAUSE

OF ACTION ARISING OUT OF THE CONTRACT SHALL BE SUBMITTED TO ARBITRATION OR

MEDIATION, AND THE PARTIES WAIVE ANY RIGHT TO A JURY TRIAL IN ANY COURT OF

COMPETENT JURISDICTION OR ANY ACTION, PROCEEDING, OR COUNTERCLAIM BROUGHT BY

ONE AGAINST THE OTHER WITH RESPECT TO ANY MATTER WHATSOEVER ARISING OUT OF OR

IN ANY WAY CONNECTED WITH THE CONTRACT, OR ANY RELATIONSHIP OF MCPS AND THE

CONTRACTOR HEREUNDER.

ARTICLE 16. CONTRACTOR INTEGRITY, ETHICS, AND CONFLICTS OF INTEREST

A. The Contractor is prohibited from using the services of MCPS employees or officials (including Board of Education members) in performing the Contract. Former employees or officials may be used, provided that a 12-month period has elapsed since their last employment at MCPS. A former MCPS employee or official, may not assist or represent the Contractor for compensation in any case, controversy, dispute, contract, or other specific matter involving MCPS, if that case, controversy, dispute, contract, or other specific matter is one in which the former employee or official significantly participated as an employee or official.

B. No official or employee of Maryland, Montgomery County, or MCPS shall benefit from or receive any money as a result of the Contract. This prohibition does not apply to contracts with MCPS employees or officials who contracted in their own name.

C. The Contractor hereby declares and affirms that, to its best knowledge, none of its officers, directors, partners, employees, agents, affiliates, or subcontractors directly involved in obtaining contracts has been convicted of bribery, attempted bribery, or conspiracy to bribe under any federal, state, and county laws and regulations.

D. The Contractor agrees to review and at all times abide by the Board of Education Policy BBB, Ethics (“Board Policy BBB”). In addition, the Contractor shall have an affirmative obligation to disclose in writing to the Procurement Director any actual or potential conflicts of interest as identified in Board Policy BBB, and neither the Contractor nor any of its officers, directors, partners, employees, agents, affiliates, or subcontractors shall take any action that they know or should have reason to know would result in any MCPS official or employee violating Board Policy BBB.

E. The Contractor warrants that no person or selling agency has been employed or retained to solicit or secure the Contract upon an agreement or understanding for a commission, percentage, brokerage, or contingent fee.

F. Violation of this Article constitutes a breach of contract for which MCPS may terminate the Contract

ARTICLE 17. PUBLICATION AND PUBLICITY

MCPS may, in its sole discretion, make the Contract publicly available on the MCPS website or otherwise. The Contractor shall not, without consultation and consent by MCPS, (i) originate any report, publication, presentation, publicity, news release, or other announcement, written or oral, relating to the Contract or any results achieved pursuant to the Contract (hereinafter “Publication”); or (ii) use any names, trademarks, or logos of MCPS, except as necessary to perform the work of the Contract. To the extent that MCPS agrees to any such Publication regarding the Contract, the Contractor shall abide by the following terms:

A. The primary purpose shall be to disseminate information about the work rather than to promote the Contractor’s accomplishments or knowledge.

B. Such Publication shall prominently display or acknowledge MCPS support and include the following disclaimers: (i) the contents of this publication do not necessarily reflect the views or policies of MCPS;

and (ii) the mention of trade names, commercial products, or organizations does not imply endorsement by MCPS.

C. The Contractor shall abide by the provisions of Article 18 and any other data-sharing agreement between the Parties.

ARTICLE 18. DATA PRIVACY, AI GOVERNANCE, AND CONFIDENTIALITY

A. The Contractor shall comply with all federal, state, and county laws and regulations applicable to the Contract regarding data collection, privacy, and security, including but not limited to the requirements of the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations (34 C.F.R. part 99), the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501-6505, and its implementing regulations (16 C.F.R. § 312, et seq.), the Protection of Pupil Rights Amendment, (PPRA) 20 U.S.C, § 1232(h) and its implementing regulations (34 C.F.R. § 98.1 et seq.), the Children's Internet Protection Act (CIPA), 20 U.S.C. § 9134, 47 U.S.C. § 254, and its implementing regulations (47 C.F.R. § 54), the Maryland Online Data Privacy Act of 2024 (MODPA), Md. Code Ann., Com. Law §§ 14-4601 through 14-4607, the Maryland Student Privacy Act of 2015, Md. Ed. Code Ann., §4-131, Code of Maryland Regulations (COMAR) 13A.08, as well as applicable Board of Education policies and MCPS regulations, including but not limited to MCPS Regulation AFA-RA, Research and Other Data Collection Activities in Montgomery County Public Schools, MCPS Regulation JOA-RA, Student Records, and MCPS Regulation JFF-RA, Federal Requirements for Use of Protected Student Information.

B. Questionnaires, survey instruments, or any other form of data collection from MCPS students, staff, parents/guardians or others pursuant to the Contract or otherwise must be reviewed and approved by the MCPS Office of Shared Accountability prior to use as required by MCPS Regulation AFA-RA, Research and Other Data Collection Activities in Montgomery County Public Schools.

C. Definitions

1. "Confidential Information" shall include all information, including but not limited to Personally

Identifiable Information (PII), as defined in Article 18.D, that is protected by law or MCPS policy.

2. “Personal Data”, is a subset of Confidential Information, and includes prompts and outputs, or any information that is linked or reasonably linkable to an identified or identifiable MCPS User. This terms shall have the meaning set forth in MODPA,

3. “Sensitive Data”, refers to categories of Personal Data that require enhanced protection, including:

biometric data, precise geolocation data, and any Personal Data of a user known (or who should be known) to be under the age of 18.

4. “Artificial Intelligence” means a machine–based system that:

(1) can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments;

(2) uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and

(3) uses model inference to formulate options for information or action.

5. “AI System”, refers to any machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

6. “Student” means any MCPS student under the age of 18.

7. “Data Security Breach” refers to the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

8. “Data Security Incident” refers to an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

9. “Data Security Event” refers to any observable occurrence that involves computing assets, including physical and virtual platforms, networks, services, and cloud environments..

D. Access to Confidential Information

1. To assist the Contractor in its work under the Contract, MCPS may disclose to the Contractor, either in writing or orally, records or information which MCPS deems to be proprietary and/or confidential (hereinafter, “Confidential Information”). For purposes of the Contract, Confidential Information is any information or data labeled or identified as confidential in the Contract or at the time of disclosure. This definition and the obligations of this Article shall not extend to any information that: (i) the Contractor possesses prior to acquiring it from MCPS; (ii) becomes available to the public or trade through no violation by the Contractor; or (iii) is developed by the Contractor independently of and without reliance on confidential or proprietary information provided by MCPS.

2. Confidential Information also includes any and all “Personally Identifiable Information” regarding MCPS students, parents/guardians, employees, or others in any medium, including but not limited to any user-generated content that MCPS students, parents/guardians, employees, or others (“MCPS Users”) input to access or use the Contractor’s deliverables, products, and/or services (e.g., log-in information or responses to assessment questions), as well as “Metadata.” Metadata includes but is not limited to: information about how long a MCPS User took to perform a task; information about how long a MCPS User’s mouse hovered over an item; keystroke data; location data; or other data about the MCPS User’s use of the Contractor’s deliverables, products, and/or services that has not been stripped of all direct and indirect identifiers. With respect to MCPS students, Personally Identifiable Information, as defined under applicable law, includes:

a. A student’s name;

b. The name of the student’s parent/guardian or other family members;

c. The address of the student or student’s family;

d. A personal identifier, such as the student’s social security number, student number, or biometric record;

e. Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;

f. Other information (including but not limited to Metadata) that, alone or in combination, is linked or linkable to a specific student or family that would allow a reasonable person in the MCPS community, who does not have personal knowledge of the relevant circumstances, to identify the student or family with reasonable certainty; or

g. Information requested by a person, who is not an authorized representative of the educational agency and who MCPS and/or the Contractor reasonably believes knows the identity of the student to whom the education record relates.

3. Confidential Information shall be maintained in confidence during the Contract and thereafter, except to the extent that it is required to be either disclosed or protected from disclosure by law, regulation or judicial or administrative process. The Contractor shall use the Confidential Information solely for the purposes of the Contract. The Contractor shall protect the Confidential Information from any Data Security Breach (as defined below), loss, theft, or disclosure using a commercially reasonable care commensurate with the sensitivity of the Confidential Information that in no circumstances is less than the degree of care that the Contractor uses to protect is own confidential information. The Contractor agrees to assist MCPS in maintaining the privacy of Confidential Information as may be required by all federal, state, and county laws and regulations applicable to the Contract including but not limited to the requirements listed above.

4. The Contractor shall not permit unauthorized access to the Confidential Information to any individual or entity at any time or provide Confidential Information to any person, party, or organization ineligible or prohibited from receiving such information pursuant to any federal, state, and county laws and regulations applicable to the Contract including but not limited to the requirements listed above.

5. In the event that the Contractor is required by law, regulation, or judicial or administrative process to disclose any Confidential Information, the Contractor will promptly notify MCPS in writing, if permitted by law, prior to making any such disclosure in order to facilitate MCPS’ seeking of a protective order or other appropriate remedy from the appropriate body. Should the proprietary or confidential status of any such information be disputed, the Parties agree to work in good faith to reach a mutually satisfactory disposition.

6. To the extent that Confidential Information includes Personally Identifiable Information regarding

MCPS Users, MCPS may require additional data sharing protocols, as agreed in writing by the Parties, prior to its disclosure to the Contractor. The Contractor also agrees to comply with the re-disclosure limitations set forth in FERPA, including in 34 C.F.R. § 99.33, and shall not authorize access to Confidential Information to any of its employees, agents, affiliates, and subcontractors, or to any auditor, unless such employee, agent, affiliate, subcontractor, or auditor (i) requires such access in order to allow the Contractor to provide the deliverables, products, and/or services set forth in the Contract or to fulfill the Contractor’s obligations under the Contract; and (ii) has signed a non-disclosure agreement no less restrictive than the terms of the Contract that will (a) prohibit the such individual or entity from using any Confidential Information for any purpose other than providing the contracted service to, or on behalf of the Contractor; (b) prohibit the individual or entity from disclosing any Confidential Information provided by the Contractor to third parties; (c) require the individual or entity to implement and maintain strict security procedures and practices that, at a minimum, comply with industry standards for data security; and (d) require the individual or entity to promptly notify the Contractor if the individual or entity becomes aware of any unlawful access to any Confidential Information stored on its equipment or facilities resulting in loss, disclosure, or alteration of Confidential Information. Such non-disclosure agreements shall be made available for inspection, upon demand, to MCPS. The Contractor agrees to remind (in writing) individuals or entities who cease working with the Contractor of their non-disclosure obligations at the time of departure, and to terminate the network access of such individuals or entities at the time of separation.

7. Notwithstanding any other provision of the Contract, MCPS and/or MCPS Users, as appropriate, retain all right, title, and interest in and to the Confidential Information provided by MCPS and/or MCPS Users. Neither the Contractor, nor any successor or entity to which the Contractor’s assets are sold, acquires rights in the Confidential Information, other than the rights MCPS grants to the Contractor to perform the work contemplated in the Contract. If the Contractor becomes subject to dissolution or insolvency, MCPS’ and MCPS Users’ Confidential Information will not be considered an asset or property of the Contractor. MCPS reserves the right to demand the prompt return of any Confidential Information at any time and for any reason whatsoever. The disclosure of Confidential Information to the Contractor shall not be construed as a grant of any right or license with respect to the information other than for the purposes set forth in the Contract.

E. Use of Confidential Information

1. The Contractor shall collect, use, and store only such Confidential Information that is necessary in connection with the Contractor’s obligations under the Contract.

2. The Contractor may collect and use aggregated de-identified Confidential Information to provide the deliverables, products, and/or services set forth in the Contract, for the Contractor’s lawful quality assurance, and for no other purpose; provided, however, that all direct and indirect personal identifiers are permanently removed and there is no reasonable basis to believe that the remaining information in the records can be used to successfully link the de-identified information to an identifiable individual or to MCPS. Furthermore, the Contractor agrees not to: (i) attempt to re-identify de-identified Confidential Information; and/or (ii) transfer de-identified Confidential Information to any party unless that party agrees not to attempt to re-identify the de-identified Confidential Information and unless MCPS has provided written express consent of the transfer. (iii) use the de-identified Confidential Information to train artificial intelligence systems without the express written consent of MCPS.

3. Contractor is prohibited from re-identifying, or attempting to re-identify, MCPS data. Contractor shall hold any subcontractor to the same standard.

4. Neither the Contractor nor any of its employees, agents, affiliates, and subcontractors shall: (i) engage in targeted advertising to MCPS Users; (ii) engage in targeted advertising when the targeting of the advertising is based on Confidential Information; (iii) use Confidential Information to amass a profile about a MCPS User, except in connection with the Contractor’s performance of its obligations under the Contract; (iv) sell Confidential Information; or (v) share with any individual or entity outside MCPS, without prior review and approval from MCPS, any report, data, or research findings that are based on Confidential Information or the use by MCPS or MCPS Users of the Contractor’s deliverables, products and/or services and that could be linked to an identifiable MCPS User, stakeholder, school, or the district.

5.

6. The Contractor acknowledges that there are no user agreements (whether electronic, click-through, verbal or in writing) in existence or contemplated between the Contractor and any MCPS Users in connection with their access and use of the Contractor’s deliverables, products, or services, and this Contract shall supersede any user agreements that may be adopted during the term of the Contract.

7. The Contractor shall cooperate with MCPS in fulfilling its documentation of Data Protection Impact Assessments, when applicable, and fulfilling obligations related to consumer rights requests, data assessments, and evaluation of data security measures.

F. Security of Confidential Information

1. The Contractor shall implement and maintain a comprehensive data-security program in accordance with commercial best practices for the protection of Confidential Information, whether the

Confidential Information is stored electronically and/or in hard copy. Such data-security program shall include, but is not limited to, the following:

a. Security policies for the Contractor’s employees, agents, affiliates, and subcontractors related to the storage, access, retention, transportation, and disposition of data containing Confidential Information;

b. Reasonable restrictions on access to records containing Confidential Information, including access to any locked storage where such records are kept;

c. Secure access controls to Confidential Information, including but not limited to passwords;

d. Procedures for data recovery, incident response and processes, and business continuity processes and procedures;

e. Encryption of Confidential Information in accordance with industry standard encryption when it is stored or transmitted electronically;

f. Protocols for regular backups that include retention of backup copies for such period of time as may be required by MCPS, or by federal, state, and county laws and regulations;

g. Audit logs of its system on a secured server with restricted access to prevent tampering or altering of audit data; and

h. A process for reviewing policies, procedures, and security measures, as well as training on security policies for employees who have access to Confidential Information, at least annually.

2. The Contractor certifies that it has implemented policies, procedures, and security measures to protect against reasonably foreseeable unauthorized access to, or disclosure of, Confidential Information, and to prevent other reasonably foreseeable events that may result in substantial harm to MCPS. The Contractor certification shall be in the form of a third party assessment of the environment (i.e., SOC2, ISO270001/ISO42001, NIST 800-171 or other 3rd party security assessment tool). In addition, the Contractor shall not maintain, backup or store Confidential Information outside of the United States. To the extent that the Contractor uses cloud computing services, all Confidential Information provided by MCPS or MCPS Users shall be securely stored with a commercially reasonable third-party vendor using physical servers located solely within the United States and subject to network security measures consistent with industry standards. The Contractor will confirm to MCPS that the third-party vendor agrees to the non-disclosure agreement terms described in Article 18.C.6.

3. Access to the Contractor’s server(s) hosting Confidential Information shall be limited to the Contractor’s operations employees, agents, affiliates, or subcontractors who: (i) have access to Contractor’s access keys and are specifically trained to manage and secure data; and/or (ii) are involved in providing the Contractor’s deliverables, products and/or services.

4. Any computer, server, or database on which Confidential Information, or any analysis conducted pursuant to the Contract, is maintained shall have anti-virus, configuration control, monitoring/alerting, automated backups, and regular vulnerability testing. Such computer, server, or databases shall be password protected and securely stored at all times with proper authentication and authorization procedures and with access limited to the Contractor’s operations personnel and personnel directly involved in implementing the Contract. The Contractor shall not permit Confidential Information to be maintained or stored on any portable memory device, such as thumb drives or portable hard drives, without the express written consent of MCPS. The Contractor shall not permit Confidential Information to be maintained or stored on mobile computing devices (e.g.

laptops or tablets), unless such device is being used in connection with the Contractor’s backup and recovery procedures. In the event that such a device is being used in connection with the Contractor’s backup and recovery procedures, the Contractor will ensure that such mobile computing devices are encrypted, centrally managed with respect to configuration updates and anti-virus, password protected, and that all such devices will be scanned at the expiration or termination of the Contract to ensure that no Confidential information remains stored on such mobile computing devices.

5. The Contractor will regularly backup or cause to be backed up all Confidential Information under its control and will securely store and retain backups for such period of time as may be required by federal or state law or regulation, or by MCPS. The Contractor will remove Confidential Information from backups in a manner consistent with technology best practices and industry standards for secure data disposal methods. If the Contractor is required to restore any materials from its backups, it will purge all personally identifiable Confidential Information not currently in use in the production systems from the restored backups.

G. Internet Safety

To the extent the Contractor’s services provide internet access or content, the Contractor shall implement technical, administrative, and physical safeguards and technology protection measures that assist MCPS in maintaining compliance with the Maryland Online Data Privacy Act (MODPA) and the Children’s Internet Protection Act (CIPA). Pursuant to CIPA, such measures include filtering or blocking access to visual depictions that are obscene, including child pornography, or otherwise harmful to minors, .

Pursuant to MODPA, the Contractor shall ensure that such filters do not collect or process more personal data than is strictly necessary to perform the filtering function. The Contractor shall provide MCPS with necessary logs or reports required to monitor and audit compliance with these safety and privacy laws.

H. MCPS reserves the right in its sole discretion to perform audits of the Contractor at its sole expense to ensure compliance with this Article. The Contractor shall reasonably cooperate in the performance of such audits. The Contractor also will conduct regular internal monitoring and vulnerability assessments of the computers, computing environment, servers, and physical data centers that the Contractor uses to collect, process, maintain, or store MCPS’ Confidential Information that includes Personally Identifiable Information regarding MCPS Users, and to hire a third party to conduct no less than annual security audits, which includes penetration testing. The Contractor shall review audit findings and will implement recommended security program changes and enhancements where practical and appropriate. The Contractor will provide MCPS, upon request, the above audits, scans, and tests. The Contractor will take reasonable measures, including maintaining audit trails, to protect Confidential Information against deterioration or degradation of data quality and authenticity.

I. Data Security Event

1. A “Data Security Event” is any event that threatens the confidentiality, integrity, or availability of MCPS’s information systems or data. A Data Security Incident may include an instance in which the Contractor has actual knowledge or a reasonable basis of an event, act, omission, or vulnerability on which to suspect or conclude that there has been an unauthorized release or access of Confidential Information, or reasonable likelihood thereof, regardless of whether the Contractor stores and manages data directly or through a contractor such as a third-party cloud computing vendor. A Data Security Incident may take various forms, including but not limited to: hackers gaining access to data through a malicious attack; lost, stolen, destroyed, misappropriated, or temporarily misplaced data or equipment (e.g., mobile computing devices or portable memory devices); employee negligence (e.g., leaving a password list in a publicly-accessible location, technical staff misconfiguring a security service or device); or policy and/or system failure.

2. The Contractor shall notify the MCPS Department of Cybersecurity and Technology Infrastructure immediately of any Data Security Breach or data loss, and inform MCPS (to the extent known) what data has been compromised, but in no event later than twenty-four (24) hours after the Contractor learns of the Data Security Breach or data loss. The Contractor shall provide a detailed report within forty-eight (48) hours of discovery outlining the categories of data impacted, the number of affected MCPS Users, affected versions of Contractor’s product/ service, containment actions, and recommended mitigation. If the Contractor becomes aware of a Data Security Breach or data loss, it shall cooperate with MCPS regarding recovery, remediation, and the necessity to involve law enforcement, if any. The Contractor shall be responsible for performing an analysis to determine the cause of the Data Security Breach or data loss, and for producing a remediation plan in consultation with MCPS.