APPENDIX C.pdf

Office of Procurement 3501 University Boulevard, East, Adelphi, MD 20783 USA / umgc.edu

APPENDIX C-1

UNIVERSITY OF MARYLAND GLOBAL CAMPUS

CONTRACT # 92340

Managed Security Operations Center (SOC) Services

______________ __, 202__

CONTRACTOR:

Federal Employer ID:

Address:

Contact Person:

Contact Phone:

Contact Fax:

Contact Email:

UMGC Ordering Office:

Coordinator Phone:

Coordinator Email:

UMGC Procurement Officer (i.e., Contract Manager):

Phone Number:

E-mail address:

UMGC Professional Services Contract

THIS CONTRACT (“Contract”) is made as of this _____ day of ____, 202_ by and between __________________, a corporation organized under the laws of the State of ________, with offices at ________________________, ______, __ _____, hereinafter referred to as "Contractor," and the UNIVERSITY OF MARYLAND GLOBAL CAMPUS (UMGC), a constituent institution of the University System of Maryland, an agency of the State of Maryland, with offices at 3501 University Boulevard East, Adelphi, MD 20783, hereinafter referred to as the "University.”

RECITALS

The University issued solicitation documents (Request for Proposal/Solicitation #92340) on _________, ______, 202__, as amended from time to time (the “Solicitation”), to solicit a provider of managed security operations center (SOC) and related services. Contractor submitted a technical proposal dated ________ __, 202__ and a price proposal dated ________ _, 202__, and accepted by the University (“collectively Proposal”) in response to the Solicitation, and the University subsequently selected the Contractor as the awardee of this Contract.

THE PARTIES AGREE AS FOLLOWS:

1. SCOPE, CONTRACT DOCUMENTS, AND TERM

1.1. Contractor shall provide managed Security Operations Center (SOC) services and related cybersecurity professional services to the University, as requested by the University from time to time (the "Services"). Services may include, but are not limited to, cybersecurity monitoring, detection, investigation, response, reporting, advisory, assessment, implementation, and other cybersecurity-related services. This Contract is subject to Section 2-901, Md. State Fin and Proc. Code Ann.

1.2. This Contract consists of multiple documents as follows in order of precedence:

o This Contract Form (pages 1 through __);

o The Solicitation, and all amendments to the solicitation; and, o Contractor’s Technical Proposal and Price Proposal.

1.1. This Contract shall be in effect for an initial term of three (3) years, unless otherwise extended, expired, or terminated pursuant to the Contract. There are two (2), one-year renewal options at UMGC’s sole option.

2. PROFESSIONAL SERVICES

2.1. The Contractor shall perform the Services as described in Exhibit A to this Contract.

Services shall be performed in accordance with the schedule included in Exhibit A or, if no such schedule is included, in accordance with a schedule agreed upon in writing by the parties at a future date and adopted as an amendment to Exhibit A. The Contractor shall perform the Services as expeditiously as is consistent with good professional skill and care and the orderly progress of the Contract.

2.2. The UMGC Office of ______________ will designate a staff member to act as coordinator

(“Contract Coordinator”) between UMGC and the Contractor. Throughout the period of the Contract, copies of all correspondence, work products, specifications, estimates and other materials prepared by the Contractor should be directed to the Contract Coordinator and also to any other UMGC personnel designated by the Contract Coordinator. Direct contact or communication by the Contractor with other UMGC offices or any other entity concerning the Contract shall be made only with the prior knowledge and concurrence of the Contract Coordinator.

2.3. The Key Personnel for the Services shall be the same team identified in the Contractor's submittal responding to UMGC's solicitation. Except upon UMGC’s consent, which will not be unreasonably withheld, Contractor will not remove a member of the designated and approved Contractor staff who has been designated as Key Personnel. Notwithstanding the foregoing, Contractor shall have the right to remove or reassign Key Personnel with notice to UMGC if such removal or reassignment is required due to termination of employment, leave of absence, promotion, illness, or inability of the employee to continue to perform the required duties at the required time. Removal from UMGC’s account for an assignment to another Contractor customer account for the convenience of Contractor will generally not be considered good cause. All proposed substitutions of Key Personnel shall have qualifications at least equal or better to that of the person initially proposed by the Contractor and evaluated and accepted by UMGC. The burden of illustrating this comparison shall be the Contractor’s.

2.4. If one or more of the Key Personnel are unavailable for work under this Contract for a continuous period exceeding fifteen (15) calendar days, the Contractor shall immediately notify the Procurement Officer and propose to replace personnel with personnel of equal or better qualifications within fifteen (15) calendar days of notification. All requests for substitutions shall include a detailed explanation of the circumstances necessitating the proposed substitutions, a resume(s) of proposed substitute(s), and any other information requested by the Procurement Officer to make a determination as to the appropriateness of the proposed substitution (“the Selection Process”). As part of the Selection Process, UMGC, at its sole discretion, may interview the proposed substitute(s) as well as check references of other clients where the substitute(s) was (were) assigned.

2.5. The University may, at its sole discretion, request a change of Contractor’s personnel if deemed to be in the best interest of the University. If such a request is made, Contractor is to a) remove the person from the team supporting the University within the time frame specified by the University; b) replace the person with a suitable replacement on a temporary basis within five (5) days; and, c) work diligently in accordance with the Selection Process to find a suitable permanent replacement in a timely manner, but no later than thirty (30) days from the removal date of the original staff person. If not for cause, in the event UMGC elects to request such a change of the Contractor’s team members on-site at UMGC, it is UMGC’s intention to give Contractor thirty (30) days’ notice.

2.6. Major changes in Contractor’s organization, such as changes of control or ownership, shall be reported to UMGC in writing no later than 14 business days following their occurrence.

Changes in Contractor’s organization and/or staffing assigned to or supporting UMGC shall be reported to UMGC in writing no later than 3 business days following their occurrence.

2.7. All terms and conditions of UMGC's solicitation, and any amendments thereto, are made a part of this Contract unless expressly contradicted by a term or condition of this Contract.

Proposals or suggestions of the Contractor for changes in the solicitation or the terms and conditions of the contract are not binding upon UMGC and are not a part of this Contract unless set forth in an amendment of the solicitation or in this Contract and agreed to in writing by UMGC.

3. FEES AND PAYMENT

3.1. As compensation for satisfactory performance of the Services, the University will pay Contractor no later than thirty (30) days after the University’s receipt of a proper invoice from Contractor. Charges for late payment of invoices will be only as prescribed by Title 15, Subtitle 1 of the State Finance and Procurement Article, Annotated Code of Maryland, as from time to time amended. The University shall pay the Contractor in accordance with the terms of this Contract and at the prices referenced in Exhibit A.

3.1.1. Payment requests (invoices) shall be submitted electronically to the Accounts

Payable Department, University of Maryland Global Campus, 3501 University Boulevard East, Adelphi, MD 20783-8002 at accountspayable@umgc.edu.

3.1.2. Contractor may also send the invoices to the UMGC Ordering Department (as noted on the cover page of this Contract). The University’s current Purchase Order number, issued for accounting purposes only, must be noted on all invoices.

3.2. All fees are exclusive of applicable federal, state, local, and foreign sales, use, excise, utility, gross receipts, value added and other taxes, tax-like charges and tax-related surcharges. The University is generally exempt from such taxes, and Contractor agrees not to charge the University for such taxes in accordance with applicable law. The University will provide exemption certificates upon request.

3.3. Electronic funds may be used by the State to pay Contractor for this Contract and any other State payments due Contractor unless the State Comptroller’s Office grants Contractor an exemption. Charges for late payment of invoices, other than as prescribed by Title 15, Subtitle 1, of the State Finance and Procurement Article, Annotated Code of Maryland, or by the Public Service Commission of Maryland with respect to regulated public utilities, as applicable, are prohibited.

4. WORK PRODUCT

4.1. Contractor shall complete all reports and presentations required by the University and other reports set forth in the Contract.

4.2. Contractor agrees that all research, notes, data, computations, estimates, reports or other documents or work product obtained by or produced by Contractor under this Contract (the “Work”) shall be the sole and exclusive property of the University. Upon the University’s request or upon the expiration or termination of this Contract, Contractor shall deliver or return all copies of the Work to the University. The Contractor is permitted, subject to its obligations of confidentiality, to retain one copy of the Work for archival purposes and to defend its work product.

4.3. Notwithstanding the terms of Paragraph 4.2, Contractor is permitted to retain all rights to the intellectual capital (including without limitation, ideas, methodologies, processes, inventions and tools) developed or possessed by the Contractor prior to, or acquired during, the performance of the Services under this Contract.

4.4. Contractor and University intend this Contract to be a contract for services and each considers the Work to be a work made for hire. If for any reasons the Work would not be considered a work made for hire under applicable law, Contractor does hereby sell, assign and transfer to University, its successors, assigns, the entire right, title and interest in and to the copyright and any registrations and copyright applications relating thereto and renewals and extensions thereof, and in and to all works based upon, derived from or incorporating the Work, and in and to all income, royalties damages, claims and payments now or hereafter due or payable with respect thereto, and in and to all causes of action, either in law or equity for past, present, or future infringement based on the copyrights, and in and to all rights corresponding to the foregoing throughout the world.

4.5. Contractor agrees to execute all documents and to perform such other proper acts as

University may deem necessary to secure for University the rights in the Work.

4.6. In the event of loss of any data or records necessary for the performance of this Contract where such loss is due to the error or negligence of the Contractor, the Contractor shall be responsible, irrespective of cost to the Contractor, for recreating such lost data or records.

5. EVALUATION AND ACCEPTANCE PROCEDURE

5.1. General Acceptance Process. Upon completion of each Deliverable, Contractor shall provide UMGC with written notice that the Deliverable is complete and ready for review and acceptance. UMGC shall commence its evaluation and acceptance review upon receipt of the Deliverable and such notice. Payments under this Contract shall be contingent upon UMGC's acceptance of the applicable Deliverable in accordance with this Section.

5.2. Acceptance Standards. Within the period specified in the Contract and/or project plan, or if no period is specified, within thirty (30) business days following receipt of the Deliverable, UMGC shall determine whether the Deliverable satisfies the acceptance criteria set forth in this Contract, Exhibit A, or other written requirements approved by UMGC. A Deliverable shall be accepted if it substantially complies with all applicable requirements, specifications, performance standards, and acceptance criteria and is complete, accurate, and suitable for its intended purpose. If UMGC determines that a Deliverable satisfies the applicable acceptance criteria, UMGC shall provide written notice of acceptance. To the extent applicable to the Deliverable, acceptance criteria may include:

5.2.1. Completion of all tasks, activities, milestones, and Deliverable components identified in the Contract;

5.2.2. Conformance with approved functional, technical, accessibility, security, and operational requirements;

5.2.3. Delivery of all required content, documentation, reports, analyses, training materials, assessments, data, or other required components;

5.2.4. Compliance with applicable federal and state laws, regulations, accreditation standards, accessibility requirements, and UMGC policies;

5.2.5. Successful completion of any required reviews, demonstrations, validations, testing procedures, pilot activities, or acceptance tests identified in the Contract; and,

5.2.6. Absence of material defects, errors, omissions, inaccuracies, or deficiencies that impair the Deliverable's intended use.

5.3. Rejection and Cure Process. If UMGC determines that a Deliverable fails to satisfy one or more acceptance criteria, UMGC shall provide Contractor with written notice describing the deficiencies in reasonable detail and identifying the applicable requirement, specification, performance standard, or acceptance criterion that has not been satisfied.

Contractor shall, at no additional cost to UMGC, correct the identified deficiencies and resubmit the Deliverable within the period specified, or if no period is specified, within ten

(10) business days following receipt of UMGC's rejection notice. Upon resubmission, UMGC shall review the corrected Deliverable. If the Deliverable fails to satisfy the acceptance criteria following the first resubmission, UMGC shall provide written notice of any remaining deficiencies and Contractor shall be afforded one additional opportunity to cure. If the Deliverable fails to satisfy the acceptance criteria following the second resubmission, UMGC may, in its sole discretion:

5.3.1. Require Contractor to continue corrective efforts under a mutually agreed corrective action plan;

5.3.2. Extend the cure period;

5.3.3. Reduce payment for the affected Deliverable where permitted by the Contract;

5.3.4. Require replacement or re-performance of the Deliverable;

5.3.5. Extend any applicable warranty period; or

5.3.6. Pursue termination and any other remedies available under this Contract or applicable law. UMGC's decision not to terminate following any failed cure attempt shall not constitute a waiver of its rights or remedies.

5.4. Deliverable-Specific Acceptance Criteria. The parties acknowledge that Deliverables issued under this Contract may include assessments, research, consulting services, reports, and other professional services Deliverables. Accordingly, the parties may establish Deliverable-specific acceptance criteria within Exhibit A. In the event of a conflict between this Section and a Deliverable-specific acceptance criterion contained in Exhibit A, the Deliverable-specific acceptance criterion shall govern solely for that Deliverable.

5.5. Failure to Meet Review or Cure Periods. If either party fails to comply with the review periods, cure periods, or other material performance obligations established under this Section and fails to remedy such noncompliance within fifteen (15) business days after written notice from the other party, the non-breaching party may exercise any rights and remedies available under this Contract, including the termination provisions set forth in Section 10.1.

6. INTELLECTUAL PROPERTY

6.1. Neither party may use the other party’s name, trademarks or other proprietary identifying symbols without the prior written approval of the other party.

6.2. Contractor agrees to defend upon request and indemnify and hold harmless UMGC, its officers, agents and employees with respect to any claim, action, cost or judgment for patent infringement, or trademark or copyright violation arising out of purchase or use of materials, software, supplies, equipment or services under this Contract.

7. CONFIDENTIAL INFORMATION

7.1. Contractor acknowledges and understands that in connection with this Contract, the performance of the Services and otherwise, Contractor has had or shall have access to, has obtained or shall obtain, or has been or shall be given the University’s Confidential Information (as defined herein). For purposes of this Contract, “Confidential Information” means all information provided by the University to Contractor, including without limitation information concerning the University’s business strategies, political and legislative affairs, students, employees, vendors, contractors, student records, customer lists, finances, properties, methods of operation, computer and telecommunications systems, and software and documentation. Confidential Information includes information in any and all formats and media, including without limitation oral, and includes the originals and any and all copies and derivatives of such information.

7.2. Contractor shall use the Confidential Information only if and when required for the performance of the Services, and for no other purpose whatsoever, and only by Contractor employees engaged in that performance.

7.3. Contractor shall not, in any manner whatsoever, disclose, permit access to, or allow use of Confidential Information to any person or entity except as specifically permitted or required under this Contract.

7.4. Contractor acknowledges and understands that UMGC is required to protect certain

Confidential Information from disclosure under applicable law, including but not limited to, the Family Educational Rights and Privacy Act (“FERPA”), the Gramm Leach Bliley Act (“GLBA”), or the Maryland Public Information Act (“PIA”), including regulations promulgated there under, as the laws and regulations may be amended from time to time (collectively the “Privacy Laws”). The Confidential Information that is protected under FERPA was provided to the Contractor as it is handling an institution service or function that would ordinarily be performed by UMGC’s employees. The Contractor agrees that it shall be obligated to protect the Confidential Information in its possession or control in accordance with the Privacy Laws to the same extent as UMGC would be obligated if the Confidential Information was in the possession or control of UMGC. The Contractor further agrees that it is subject to the requirements governing the use and re-disclosure of personally identifiable information from education records as provided in FERPA.

7.5. Contractor may disclose Confidential Information as required by legal process. If

Contractor is required by legal process to disclose Confidential Information, Contractor shall immediately notify the University, and before disclosing such information shall allow UMGC reasonable time to take appropriate legal action to prevent disclosure of the Confidential Information.

7.6. Contractor’s obligations with respect to Confidential Information shall survive the expiration or the termination of this Contract.

7.7. Contractor acknowledges that Contractor’s failure to comply fully with the restrictions placed upon use, disclosure and access to Confidential Information may cause the University grievous irreparable harm and injury. Therefore, any failure to comply with the requirements of this Article 7 shall be a material breach of this Contract.

7.8. Contractor agrees and acknowledges that it is not the custodian of any Confidential

Information that may be in Contractor’s possession or control. Contractor shall forward any request for disclosure of Confidential Information to:

Office of Legal Affairs University of Maryland Global Campus 3501 University Boulevard East Adelphi, MD 20783

7.9. Except to the extent otherwise required by applicable law or professional standards, the obligations under this section do not apply to information that (a) is or becomes generally known to the public, other than as a result of disclosure by Contractor, (b) had been previously possessed by Contractor without restriction against disclosure at the time of receipt by Contractor, (c) was independently developed by Contractor without violation of this Contract, or (d) Contractor and the University agree in writing to disclose. Contractor shall be deemed to have met its nondisclosure obligations under this section as long as it exercises the same level of care to protect the Confidential Information as it exercises to protect its own confidential information, except to the extent that applicable law or professional standards impose a higher requirement.

7.10. All Confidential Information received by Contractor shall be returned to the

University or destroyed upon completion or termination of this Contract.

8. RELATIONSHIP OF THE PARTIES

8.1. Nothing in this Contract shall be construed to establish a relationship of servant, employee, partnership, association, or joint venture between the parties. Neither party shall bind or attempt to bind the other to any contract, warranty, covenant or undertaking of any nature whatsoever unless previously specifically authorized in writing in each instance. Nothing in this Contract is intended to create a joint employment relationship.

8.2. It is understood and agreed that Contractor is an independent contractor of the University, and not an employee. Except as set forth in this Contract, the University will not withhold income taxes, social security or any other sums from the payments made to Contractor hereunder. All employees or contractors of Contractor shall in no way be considered employees of the University, but rather they shall be employees or contractors of Contractor, and Contractor shall bear full responsibility for compensating those persons and for the performance of the Services by way of them.

8.3. Each party reserves the right to review all press releases or other public communications of the other party that may affect the party’s public image, programs or operations.

9. DISTRIBUTION OF RISK

9.1. Contractor shall maintain in full force and effect adequate insurance coverage to protect against the risks associated with the performance of Services under this Contract. Contractor shall also maintain in full force and effect workers’ compensation insurance as required by the laws of the jurisdiction the Services are performed.

Contractor shall provide to the Procurement Officer a certificate of insurance including evidence of the required limits at the execution hereof, and annually thereafter.

9.2. Contractor shall indemnify and hold harmless the University and the State of Maryland, their officers, employees, and agents, from any and all costs (including without limitation reasonable attorneys’ costs and cost of suit), liabilities, claims, or demands arising out of or related to Contractor’s performance under this Contract. The University agrees to notify Contractor promptly of any known liabilities, claims, or demands against the University for which Contractor is responsible hereunder, and Contractor agrees to at UMGC’s request defend the University or settle any such liabilities, claims, or demands.

9.3. Neither party shall be liable to the other for indirect, consequential, incidental, punitive, exemplary, or special damages, or losses, including without limitation lost profits and opportunity costs.

10. GENERAL TERMS AND CONDITIONS

10.1. Termination for Default. If the Contractor fails to fulfill its obligation under this

Contract properly and on time, or otherwise violates any provision of the Contract, the University may terminate the Contract by written notice to the Contractor. The notice shall specify the acts or omissions relied upon as cause for termination. The University will provide Contractor a reasonable opportunity, not to exceed 10 business days, to cure the act or omission, provided such opportunity to cure does not extend the deadline for any deliverables and does not cause the University further damage. All finished or unfinished work provided by the Contractor, to which the University is entitled pursuant to this Contract shall become the University's property. The University shall pay the Contractor fair and equitable compensation for satisfactory performance prior to receipt of notice of termination, less the amount of damages caused by Contractor's breach. If the damages are more than the compensation payable to the Contractor, the Contractor will remain liable after termination and the University can affirmatively collect damages. Termination hereunder, including the determination of the rights and obligations of the parties, shall be governed by the provisions of USM Procurement Policies And Procedures.

10.2. Termination for Convenience. The performance of work under this Contract may be terminated by the University in accordance with this clause in whole, or from time to time in part, whenever the University shall determine that such termination is in the best interest of the University. The University will pay all reasonable costs associated with this Contract that the Contractor has incurred up to the date of termination and all reasonable costs associated with termination of the Contract. However, the Contractor shall not be reimbursed for any anticipatory profits that have not been earned up to the date of termination. Termination hereunder, including the determination of the rights and obligations of the parties, shall be governed by the provisions of the USM Procurement Policies and Procedures.

10.3. Delays and Extension of Time. The Contractor agrees to prosecute the work continuously and diligently and no charges or claims for damages shall be made by it for any delays or hindrances from any cause whatsoever during the progress of any portion of the work specified in this Contract. Time extensions will be granted only for excusable delays that arise from unforeseeable causes beyond the control and without the fault or negligence of the Contractor, including but not restricted to, acts of God, acts of public enemy, acts of the State in either its sovereign or contractual capacity, acts of another Contractor in the performance of a contract with the State or the University, changes in law or regulation, action by government or other competent authority, fires, earthquakes, floods, epidemics, quarantine restrictions, strikes, freight embargoes, malicious or criminal acts of third parties, or delays of subcontractors or suppliers arising from unforeseeable causes beyond the control and without the fault or negligence of either the Contractor or the subcontractors or suppliers.

10.4. Suspension of Work. The Procurement Officer unilaterally may order the Contractor in writing to suspend, delay, or interrupt all or any part of its performance for such period of time as the Procurement Officer may determine to be appropriate for the convenience of the University.

10.5. Subcontracting and Assignment.

10.5.1. The Contractor may not subcontract any portion of the Services provided under this

Contract without obtaining the prior written approval of the University nor may the Contractor assign this Contract or any of its rights or obligations hereunder, without the prior written approval of UMGC. The University shall not be responsible for the fulfillment of the Contractor’s obligations to subcontractors. Any such subcontract shall be subject to any terms and conditions that UMGC deems necessary to protect its interests. Contractor shall remain responsible for performance of all Services under this Contract, and shall be subject to liability to the University for acts and omissions of subcontractors.

10.5.2. Neither party may assign this Contract without the prior written consent of the other party, which consent shall not be unreasonably withheld, except that Contractor may assign this Contract to any parent, subsidiary, affiliate or purchaser of all or substantially all its assets with notice to the University. Contractor may designate a third party to receive payment without the University’s prior written consent unless in conflict with Maryland or federal law, but shall provide the University with notification thereof.

10.6. Maryland Law Prevails. The laws of the State of Maryland shall govern the interpretation and enforcement of this Contract.

10.7. Contract Integration and Modification. This Contract and the documents incorporated herein form the entire agreement of the parties with respect to the subject matter of this procurement, and supersede all prior negotiations, agreements and understandings with respect thereto. This Contract may be amended with the written consent of both parties. Amendments may not significantly change the scope of the Contract.

10.8. No Third Party Beneficiaries. This Contract is only for the benefit of the undersigned parties and their permitted successors and assigns. No one shall be deemed to be a third party beneficiary of this Contract.

10.9. Notices. Notices under this Contract will be written and will be considered effective upon personal delivery to the person addressed or five (5) calendar days after deposit in any U.S. mailbox, first class (registered or certified) and addressed to the other party as follows:

For the University:

University of Maryland Global Campus Procurement Department Attn: Procurement Officer 3501 University Blvd East Adelphi, MD 20783-8044

For the Contractor:

10.10. Disputes. This Contract shall be subject to the USM Procurement Policies and

Procedures. Pending resolution of a claim, the Contractor shall proceed diligently with the performance of the Contract in accordance with the procurement officer's decision.

10.11. Retention of Records. Contractor shall retain and maintain all records and documents relating to this Contract for three years after final payment by the State and will make them available for inspection and audit by authorized representatives of the State, including the Procurement Officer or designee, at all reasonable times.

10.12. Non-Hiring of Employees. No employee of the State of Maryland or any unit thereof, whose duties as such employee include matters relating to or affecting the subject matter of this Contract, shall, while so employed, become or be an employee of the party or parties hereby contracting with the State of Maryland or any unit thereof.

10.13. Non-Discrimination in Employment. The Contractor agrees: (a) not to discriminate in any manner against an employee or applicant for employment because of race, color, religion, creed, age, sex, marital status, national origin, ancestry, or physical or mental disability unrelated in nature and extent so as reasonably to preclude the performance of such employment; (b) to include a provision similar to that contained in subsection (a), above, in any subcontract except a subcontract for standard commercial supplies or raw materials; and (c) to post and to cause subcontractors to post in conspicuous places available to employees and applicants for employment, notices setting forth the substance of this clause.

10.14. Contingent Fee Prohibition. The Contractor warrants that it has not employed or retained any person, partnership, corporation, or other entity, other than a bona fide employee or agent working for the Contractor, to solicit or secure this Contract, and that it has not paid or agreed to pay any person, partnership, corporation, or other entity, other than a bona fide employee or agent, any fee or any other consideration contingent on the making of this Contract.

10.15. Financial Disclosure. The Contractor shall comply with the provisions of Section

13-221 of the State Finance and Procurement Article of the Annotated Code of Maryland, which requires that every business that enters into contracts, leases, or other agreements with the State of Maryland or its agencies during a calendar year under which the business is to receive in the aggregate $200,000 or more, shall, within 30 days of the time when the aggregate value of these contracts, leases or other agreements reaches $200,000, file with the Secretary of State of Maryland certain specified information to include disclosure of beneficial ownership of the business.

10.16. Political Contribution Disclosure. Contractor shall comply with Election Law Article

Sections 14-101 through 14-108 of the Annotated Code of Maryland, which requires that every person making contracts with one or more governmental entities during any 12 month period of time involving cumulative consideration in the aggregate of $200,000 or more to file with the State Board of Elections a statement disclosing certain campaign or election contributions.

10.17. Anti-Bribery. The Contractor warrants that neither it nor any of its officers, directors or partners, nor any employees who are directly involved in obtaining or performing contracts with any public body has been convicted of bribery, attempted bribery or conspiracy to bribe under the laws of any state or the federal government.

10.18. Ethics. This Contract is cancelable in the event of a violation of the Maryland Public

Ethics Law by the Contractor or any UMGC employee in connection with this procurement.

10.19. Compliance with Laws. The Contractor hereby represents and warrants that:

10.19.1. It is qualified to do business in the State of Maryland and that it will take such action as, from time to time hereafter, may be necessary to remain so qualified;

10.19.2. It is not in arrears with respect to the payment of any monies due and owing the State of Maryland, or any department or unit thereof, including but not limited to, the payment of taxes and employee benefits, and that it shall not become so in arrears during the term of this Contract;

10.19.3. It shall comply with all international, federal, state, and local laws, regulations, and ordinances applicable to its activities and obligations under this Contract; and

10.19.4. To the extent that personal data is disclosed, it shall comply with all international, federal, state, and local data privacy laws, regulations and ordinances including but not limited to the European Union General Data Protection Regulation 2016/679 (hereinafter referred to as “GDPR”). Compliance with Article 26 of GDPR may require Contractor to agree to the standard contractual clauses adopted by the EU Commission; and

10.19.5. It shall obtain, at its expense, all licenses, permits, insurance, and governmental approvals, if any, necessary to the performance of its obligations under this Contract.

10.20. Indemnification. UMGC shall not assume any obligation to indemnify, hold harmless, or pay attorneys’ fees that may arise from or in any way be associated with the performance or operation of this Contract; and

10.21. Multi-Year Contracts Contingent Upon Appropriations. If the General Assembly fails to appropriate funds or if funds are not otherwise made available for continued performance for any fiscal period of this Contract succeeding the first fiscal period, this Contract shall be canceled automatically as of the beginning of the fiscal year for which funds were not appropriated or otherwise made available; provided, however, that this will not affect either the University's rights or the Contractor's rights under any termination clause in this Contract. The effect of termination of the Contract hereunder will be to discharge both the Contractor and the University from future performance of the Contract, but not from their rights and obligations existing at the time of termination.

The Contractor shall be reimbursed for the reasonable value of any non recurring costs incurred but not amortized in the price of the Contract. The University shall notify the Contractor as soon as it has knowledge that funds may not be available for the continuation of this Contract for each succeeding fiscal period beyond the first.

10.22. Pre-Existing Regulations. In accordance with the provisions of Section 11-206 of the State Finance and Procurement Article, Annotated Code of Maryland, the regulations set forth in USM Procurement Policies and Procedures in effect on the date of execution of this Contract are applicable to this Contract.

10.23. Insurance

10.23.1. The following type(s) of insurance and minimum amount(s) of coverage are required:

Commercial General Liability - One million dollars ($1,000,000) combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and three million dollars ($3,000,000) annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

Cyber Security/Data Breach Insurance – Five million dollars ($5,000,000) per occurrence. The coverage must be valid at all locations where work is performed or data or other information concerning the State’s claimants or employers is processed or stored.

Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

10.23.2. All policies for liability protection, bodily injury or property damage and fiduciary Bonding must specifically name on its face the University as an additional insured as respects to operations under the contract and premises occupied by the Contractor;

provided, however, with respect to the Contractor’s liability for bodily injury or property damages above, such insurance shall cover and not exclude Contractor’s liability for injury to the property of the University and to the persons or property of employees, student, faculty members, agents, officers, regents, invitees or guest of the University.

10.23.3. Each insurance policy shall contain the following endorsements: “It is understood and agreed that the Insurance Company will notify the Procurement Officer, in writing in electronic format, forty-five (45) days in advance of the effective date of any reduction in or cancellation of this policy”. Upon the request of the Procurement Officer, a certified true copy of each policy of insurance including the above endorsement manually countersigned by an authorized representative of the insurance company shall be furnished to the Procurement Officer. Notices of policy changes shall be furnished to the Procurement Officer. All required insurance coverages must be acquired from insurers allowed to do business in the State of Maryland. The insurers must have a policy holder’s rating of “A-“or better.

10.24. Acceptance Testing. The product, and any related services, including all web content, mobile applications, electronic documents, and digital services provided by Contractor to UMGC (collectively, the “Digital Properties”), will be tested by UMGC and/or its agents to determine whether they are fully operable, meet all applicable specifications, and function in accordance with the documentation when properly installed and used for their intended purpose in the operational environment.

10.24.1. Acceptance Testing shall include, without limitation, testing for compliance with accessibility standards set forth in Section 10.25 (Accessibility), including assistive technology testing using screen readers, keyboard-only navigation, and other manual and automated accessibility testing techniques.

10.24.2. If Acceptance Testing demonstrates that the Digital Properties do not conform to the requirements outlined herein, including non compliance with accessibility standards, UMGC will notify Contractor of the defects or areas requiring remediation.

10.24.3. Remediation Following Acceptance Testing. If Acceptance Testing performed by UMGC and/or its agents identifies any nonconformities, including non-compliance with accessibility requirements described in Section 10.25, Contractor, at Contractor’s sole cost and expense, shall:

10.24.3.1. promptly remediate the identified issues;

10.24.3.2. re deliver the Digital Properties for retesting; and

10.24.3.3. ensure continued compliance following remediation.

10.24.4. If Contractor fails to remedy identified nonconformities within a reasonable period of time or repeatedly introduces new accessibility barriers through updates or changes, UMGC may treat such failure as a material breach of this Contract and exercise any rights or remedies available under this Contract or applicable law.

10.25. Accessibility. UMGC is committed to complying with the ADA and to providing accessible course content. When necessary, UMGC will provide academic accommodation to ensure equitable access. If UMGC is in the position to respond to requests for accommodations in relation to students and others’ interactions with the Digital Properties, Contractor will support its efforts and work with UMGC to provide technological or other adaptations to the Digital Properties in response to same.

10.25.1. Compliance with Accessibility Standards. Contractor warrants that all products and/or services provided under this Contract, including but not limited to websites, web applications, mobile applications, electronic documents (e.g., PDFs, presentations, spreadsheets), multimedia, learning tools, and any other information technology made available to students, employees, or members of the public (collectively, the “Digital Properties”), comply with all applicable accessibility laws, regulations, and standards. At a minimum, Contractor warrants compliance with:

10.25.1.1. Title II of the Americans with Disabilities Act (ADA) and its implementing regulations;

10.25.1.2. Section 504 of the Rehabilitation Act of 1973, as amended;

10.25.1.3. Web Content Accessibility Guidelines (WCAG) 2.1, Level AA; and

10.25.1.4. Sections 508 and 255 of the Rehabilitation Act, to the extent applicable.

10.25.2. Ongoing Maintenance of Accessibility. Contractor shall maintain accessibility of the Digital Properties throughout the Term of this Contract, including during updates, upgrades, content additions, and functional changes. Accessibility shall be treated as a non-functional requirement that may not be materially degraded over time.

10.25.3. Documentation – VPAT and HECVAT. Upon request by UMGC, Contractor shall provide, at no additional cost:

10.25.3.1. a current and accurate Accessibility Conformance Report (ACR), completed using the ITI Voluntary Product Accessibility Template (VPAT®) WCAG edition (version 2.4 or later), specific to the version of the product or service provided;

and,

10.25.3.2. responses to the Higher Education Community Vendor Assessment Toolkit (HECVAT) or an equivalent UMGC approved accessibility questionnaire.

Any identified accessibility limitations must be accompanied by a written remediation plan and timeline acceptable to UMGC.

10.25.4. Accessibility Issue Reporting and Remediation. Contractor shall promptly respond to and resolve accessibility barriers reported by UMGC, students, employees, or members of the public. Accessibility issues shall be prioritized and remediated as follows:

10.25.4.1. Blocking or critical accessibility issues: remediation or accessible alternative within ten (10) business days;

10.25.4.2. High impact issues: remediation within twenty (20) business days;

10.25.4.3. Moderate issues: remediation within forty five (45) business days.

If immediate remediation is not feasible, Contractor shall provide a conforming, accessible alternate solution approved by UMGC until permanent remediation is completed.

10.25.5. Audit and Verification Rights. UMGC or its designated third-party accessibility experts may audit or evaluate the accessibility of the Digital Properties upon reasonable notice. Contractor shall cooperate fully with such audits and provide relevant documentation, test results, and access necessary to verify compliance.

10.25.6. Failure to Maintain Accessibility. Failure to comply with this Section 31, failure to remediate accessibility barriers within agreed timelines, or material misrepresentation of accessibility conformance documentation constitutes a material breach of this Contract.

10.25.7. No Limitation on UMGC Obligations. Nothing in this Contract limits UMGC’s responsibility to provide meaningful and equitable access under applicable law.

Contractor acknowledges that accessibility obligations apply regardless of whether content or services are provided directly by UMGC or through Contractor.

11. Security, Data Privacy, and Protection.

11.1. Definitions. In addition to the definitions ascribed elsewhere in the Contract, the terms below will have the following meanings when and if used in the Contract. These definitions are subject to change at the sole discretion of UMGC. Contractor shall be provided notice of any such changes as soon as practicable.

“Information” means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

“Data” means element(s) of Information in the form of facts, such as numbers, words, names, or descriptions of things from which “understandable information” can be derived.

“Personally Identifiable Information (PII)” means an individual’s first name and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more of the following data elements:

A social security number;

A driver's license number, state identification card number, or other individual identification number issued by a state government unit;

A passport number or other identification number issued by the United States government;

An Individual Taxpayer Identification Number; or A financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual's account.

“Personal Information” means any Information relating to an identified or identifiable natural person, including but not limited to Personally Identifiable Information (PII). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Data Subject” means a natural person who is identified, or can be identified, by reference to their Personal Information.

“Processing/Processes/Processed” means any operation or set of operations which is performed on Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means the entity that Processes Personal Information on behalf of the Controller.

“Controller” means the entity that determines the purposes and means of the Processing of Personal Information.

11.2. Data Breach: Contractor shall report any confirmed or suspected breach of any

UMGC Data to UMGC’s Computer Incident Response Team (CIRT) at CIRT@umgc.edu within seventy-two (72) hours of discovery or detection. Contractor shall cooperate with UMGC and take reasonable commercial steps in the investigation, mitigation, and remediation of each confirmed or potential breach.

11.3. Contractor shall comply with the IT Security Policy available at https://www.umgc.edu/administration/policies-and-reporting/policies/info-governance-security-technology/information-security and endorse UMGC’s requirement to adhere to UMGC’s Information Governance, Security and Technology policies (https://www.umgc.edu/administration/policies-and-reporting/policies/info-governance-security-technology). Contractor shall provide answers to questionnaires necessary for UMGC to assess risks, ensure data integrity, and determine the level of accessibility that must be maintained. Specific assessment items to include:

• Identification of security, privacy, legal, and other organizational requirements for recovery of institutional resources such as data, software, hardware, configurations, and licenses at the termination of the contract.

• Assessment of the contractor’s security and privacy controls.

• Including UMGC’s security and privacy requirements in the agreement.

• Periodic reassessment of contractor services provisioned to ensure all contract obligations are being met and to manage and mitigate risk.

11.4. Contractor shall establish and maintain:

• Industry standard technical and organizational measures to help to protect against accidental damage to, or destruction, loss, or alteration of the materials;

• Industry standard technical and organizational measures to help to protect against unauthorized access to the services and materials; and,

• Network and internet security procedures, protocols, security gateways and firewalls with respect to the services.

mailto:CIRT@umgc.edu…