ATTACHMENT 2

SC Boilerplate Clauses

The clauses below are indicative of the State’s expectations. Offerors should endeavor to include terms and conditions substantially similar to these in their proposed Master Services Agreement.

INDEMNIFICATION - THIRD PARTY CLAIMS – DISCLOSURE OF INFORMATION (FEB 2015)

(a) Without limitation, Contractor shall defend and hold harmless Indemnitees from and against any and all suits, claims, investigations, or fines (hereinafter “action”) of any character (and all related damages, settlement payments, attorneys’ fees, costs, expenses, losses or liabilities) by a third party which arise out of or in connection with a disclosure of government information (as defined in the clause titled Information Security - Definitions) caused in whole or in part by any act or omission of contractor, its subcontractors at any tier, their employees, workmen, servants, agents, or anyone directly or indirectly employed by them or anyone for whose acts any of them may be liable, regardless of whether or not caused in part by an Indemnitee, and whether or not such action is brought by a third party or an Indemnitee, but only if the act or omission constituted a failure to perform some obligation imposed by the contract or the law.

(b) Indemnitee must notify contractor in writing within a reasonable period of time after Indemnitee first receives written notice of any action. Indemnitee’s failure to provide or delay in providing such notice will relieve contractor of its obligations under this clause only if and to the extent that such delay or failure materially prejudices contractors ability to defend such action. Indemnitee must reasonably cooperate with contractor’s defense of such actions (such cooperation does not require and is without waiver of an Indemnitees attorney/client, work product, or other privilege) and, subject to Title 1, Chapter 7 of the South Carolina Code of Laws, allow contractor sole control of the defense, so long as the defense is diligently and capably prosecuted. Indemnitee may participate in contractor’s defense of any action at its own expense. Contractor may not, without Indemnitee’s prior written consent, settle, compromise, or consent to the entry of any judgment in any such commenced or threatened action unless such settlement, compromise or consent (i) includes an unconditional release of Indemnitee from all liability related to such commenced or threatened action, and (ii) is solely monetary in nature and does not include a statement as to, or an admission of fault, culpability or failure to act by or on behalf of, an Indemnitee or otherwise adversely affect an Indemnitee. Indemnitee’s consent is necessary for any settlement that requires Indemnitee to part with any right or make any payment or subjects Indemnitee to any injunction.

(c) Notwithstanding any other provision, contractor’s obligations pursuant to this clause are without any limitation whatsoever. Contractor’s obligations under this clause shall survive the termination, cancellation, rejection, or expiration of the contract. This provision shall be construed fairly and reasonably, neither strongly for nor against either party, and without regard to any clause regarding insurance.

(d) “Indemnitee” means the State of South Carolina, its instrumentalities, agencies, departments, boards, political subdivisions and all their respective officers, agents and employees. [07-7B102-1] INDEMNIFICATION - INTELLECTUAL PROPERTY (JAN 2006): (a) Without limitation and notwithstanding any provision in this agreement, Contractor shall, upon receipt of notification, defend and indemnify the State, its instrumentalities, agencies, departments, boards, political subdivisions and all their respective officers, agents and employees against all actions, proceedings or claims of any nature (and all damages, settlement payments, attorneys’ fees (including inside counsel), costs, expenses, losses or liabilities attributable thereto) by any third party asserting or involving an IP right related to an acquired item. State shall allow Contractor to defend such claim so long as the defense is diligently and capably prosecuted.

State shall allow Contractor to settle such claim so long as (i) all settlement payments are made by

Contractor, and (ii) the settlement imposes no non-monetary obligation upon State. State shall reasonably cooperate with Contractor’s defense of such claim. (b) In the event an injunction or order shall be obtained against State’s use of any acquired item, or if in Contractor’s opinion, the acquired item is likely to become the subject of a claim of infringement or violation of an IP right, Contractor shall, without in any way limiting the foregoing, and at its expense, either: (1) procure for State the right to continue to use, or have used, the acquired item, or (2) replace or modify the acquired item so that it becomes non-infringing but only if the modification or replacement does not adversely affect the specifications for the acquired item or its use by State. If neither (1) nor (2), above, is practical, State may require that Contractor remove the acquired item from State, refund to State any charges paid by State therefor, and take all steps necessary to have State released from any further liability. (c) Contractors obligations under this paragraph do not apply to a claim to the extent (i) that the claim is caused by Contractor’s compliance with specifications furnished by the State unless Contractor knew its compliance with the State’s specifications would infringe an IP right, or (ii) that the claim is caused by Contractor’s compliance with specifications furnished by the State if the State knowingly relied on a third party’s IP right to develop the specifications provided to Contractor and failed to identify such product to Contractor. (d) As used in this paragraph, these terms are defined as follows: “IP right(s)” means a patent, copyright, trademark, trade secret, or any other proprietary right. “Acquired item(s)” means the rights, goods, or services furnished under this agreement.

“Specification(s)” means a detailed, exact statement of particulars such as a statement prescribing materials, dimensions, and quality of work. (e) Contractor’s obligations under this clause shall survive the termination, cancellation, rejection, or expiration of this Agreement. [07-7B103-1]

INFORMATION SECURITY - DEFINITIONS (FEB 2015)

The following definitions are used in those clauses that cross reference this clause.

Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred. Without limitation, the term “compromise” includes copying the data through covert network channels, or copying the data to unauthorized media, or disclosure of information in violation of any obligation imposed by this contract.

Data means a subset of information in an electronic format that allows it to be retrieved or transmitted.

Government information means information (i) provided to Contractor by, or generated by Contractor for, the using governmental unit, or (ii) acquired or accessed by Contractor as a result of performing the Work. Without limiting the foregoing, government information includes any information that Contractor acquires or accesses by software or web-based services, which includes, without limitation, any metadata or location data. Government information excludes unrestricted information.

Information means any communication or representation of knowledge such as facts, statistics, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Public information means any specific information, regardless of form or format, that the State has actively and intentionally disclosed, disseminated, or made available to the public. Information is not public information solely because it may be subject to inspection pursuant to an unfulfilled public records request.

Software means any computer program accessed or used by the Using Governmental Unit or a third party pursuant to or as a result of this contract.

Third party means any person or entity other than the Using Governmental Unit, the Contractor, or any subcontractors at any tier.

Unrestricted information means (1) public information acquired other than through performance of the work, (2) information acquired by Contractor prior to contract formation, (3) information incidental to your contract administration, such as financial, administrative, cost or pricing, or management information, and (4) any ideas, concepts, know-how, methodologies, processes, technologies, techniques which Contractor develops or learns in connection with Contractor’s performance of the work.

Web-based service means a service accessed over the Internet and acquired, accessed, or used by the using governmental unit or a third party pursuant to or as a result of this contract, including without limitation, cloud services, software-as-a-service, and hosted computer services.

[07-7B104-1]

INFORMATION SECURITY – SAFEGUARDING REQUIREMENTS (FEB 2015)

(a) Definitions. The terms used in this clause shall have the same meaning as the terms defined in the clause titled Information Security – Definitions. In addition, as used in this clause— Clearing means removal of data from an information system, its storage devices, and other peripheral devices with storage capacity, in such a way that the data may not be reconstructed using common system capabilities (i.e., through the keyboard); however, the data may be reconstructed using laboratory methods.

Intrusion means an unauthorized act of bypassing the security mechanisms of a system.

Media means physical devices or writing surfaces including but not limited to magnetic tapes, optical disks, magnetic disks, portable hard drives, “thumb” drives, large scale integration memory chips, and printouts (but not including display media, e.g., a computer monitor, cathode ray tube (CRT) or other (transient) visual output) onto which information is recorded, stored, or printed within an information system.

Safeguarding means measures or controls that are prescribed to protect information.

Voice means all oral information regardless of transmission protocol.

(b) Safeguarding Information. Without limiting any other legal or contractual obligations, contractor shall implement and maintain reasonable and appropriate administrative, physical, and technical safeguards (including without limitation written policies and procedures) for protection of the security, confidentiality and integrity of the government information in its possession. In addition, contractor stall apply security controls when the contractor reasonably determines that safeguarding requirements, in addition to those identified in paragraph (c) of this clause, may be required to provide adequate security, confidentiality and integrity in a dynamic environment based on an assessed risk or vulnerability.

(c) Safeguarding requirements and procedures. Contractor shall apply the following basic safeguarding requirements to protect government information from unauthorized access and disclosure:

(1) Protecting information on public computers or Web sites: Do not process government information on public computers (e.g., those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control. Government information shall not be posted on Web sites that are publicly available or have access limited only by domain/Internet Protocol restriction. Such information may be posted to web pages that control access by user ID/password, user certificates, or other technical means, and that provide protection via use of security technologies. Access control may be provided by the intranet (versus the Web site itself or the application it hosts).

(2) Transmitting electronic information. Transmit email, text messages, blogs, and similar communications that contain government information using technology and processes that provide the best level of security and privacy available, given facilities, conditions, and environment.

(3) Transmitting voice and fax information. Transmit government information via voice and fax only when the sender has a reasonable assurance that access is limited to authorized recipients.

(4) Physical and electronic barriers. Protect government information by at least one physical and one electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(5) Sanitization. At a minimum, clear information on media that have been used to process government information before external release or disposal. Overwriting is an acceptable means of clearing media in accordance with National Institute of Standards and Technology 800–88, Guidelines for Media Sanitization, at http://csrc.nist.gov/ publications/nistpubs/800-88/NISTSP800-88_with-errata.pdf.

(6) Intrusion protection. Provide at a minimum the following protections against intrusions and compromise:

(i) Current and regularly updated malware protection services, e.g., anti-virus, antispyware.

(ii) Prompt application of security-relevant software upgrades, e.g., patches, service packs, and hot fixes.

(7) Transfer limitations. Transfer government information only to those subcontractors that both require the information for purposes of contract performance and provide at least the same level of security as specified in this clause.

(d) Subcontracts. Any reference in this clause to Contractor also includes any subcontractor at any tier.

Contractor is responsible for, and shall impose by agreement requirements at least as secure as those imposed by this clause on, any other person or entity that contractor authorizes to take action related to government information.

(e) Other contractual requirements regarding the safeguarding of information. This clause addresses basic requirements and is subordinate to any other contract clauses or requirements to the extent that it specifically provides for enhanced safeguarding of information or information systems.

[07-7B105-1]

INFORMATION SECURITY – LOCATION OF DATA (FEB 2015)

Notwithstanding any other provisions, contractor is prohibited from processing, storing, transmitting, or accessing government information, as defined in the clause titled Information Security - Definitions, outside the continental United States. For clarity, this obligation is a material requirement of this contract and applies to subcontractors at any tier. [07-7B106-1]

INFORMATION USE AND DISCLOSURE (FEB 2015)

Except to the extent necessary for performance of the work, citizens should not be required to share information with those engaged by the government in order to access services provided by the government and such information should be used by those engaged by the government only to the extent necessary to perform the work acquired; accordingly, this clause addresses basic requirements for the Contractor’s use and disclosure of government information, which expressly includes, but is not limited to, information provided by or obtained from the citizens. Anonymizing information does not resolve the foregoing concern. This clause should be broadly interpreted to effectuate this intent. Every obligation in this clause is material. Absent express reference to this clause, this clause supersedes any other clause to the extent of any inconsistency unless and to the extent the other clause provides greater protection for government information.

(a) Definitions. The terms used in this clause shall have the same meaning as the terms defined in the clause titled Information Security – Definitions.

(b) Legal mandates. Contractor shall be permitted to use, disclose, or retain government information to the limited extent necessary to comply with any requirement imposed on Contractor by law. If it is necessary for Contractor to use, disclose, or retain government information in order to comply with a law, Contractor shall provide using governmental unit with written notice, including a description of the circumstances and applicable law, in advance of such use, disclosure or retention except to the extent expressly prohibited by law.

(c) Flow down. Any reference in this clause to Contractor also includes any subcontractor at any tier.

Contractor is responsible for, and shall impose by agreement the requirements of this clause on, any other person or entity that contractor authorizes to take action related to government information.

(d) Collecting Information. Contractor must gather and maintain government information only to the minimum extent necessary to accomplish the work.

(e) Rights, Disclosure and Use. Except as otherwise expressly provided in this solicitation, Contractor agrees NOT to either (1) use or disclose government information, or (2) subcontractor or third party, Contractor shall give the using governmental unit detailed written notice of both the reason for disclosure and the identity and location of the recipient. The notice shall be provided no later than fifteen (15) business days in advance of the disclosure.

(f) Return. Notwithstanding the using governmental unit’s failure to perform or the pendency of a dispute, Contractor agrees to promptly deliver to the using governmental unit (or destroy, at the using governmental unit’s option) all government information in its possession as and upon written request of using governmental unit (provided that, if the contract has not expired or been terminated, Contractor shall be excused from the performance of any work reasonably dependent on Contractor’s further access to such government information).

(g) Privacy Policy & Applicable Laws. Without limiting any other legal or contractual obligations imposed by this contract or the law, Contractor shall (a) comply with its own privacy policies and written privacy statements relevant to the work, and (b) comply with (1) all laws applicable to Contractor regarding government information, and (2) all laws and standards retain government information after termination or expiration of this contract. Contractor acquires no rights in any government information except the limited rights to use, disclose and retain the government information in accordance with the terms of this solicitation. To the extent reasonably necessary to perform the work, Contractor may: (i) use (including access, process, transmit, and store) and maintain the government information itself; and (ii) disclose government information to persons having a need-to-know (e.g., subcontractors). Before disclosing government information to a identified in the clause, if included, entitled Information Use and Disclosure

– Standards.

(h) Actions Following Disclosure. Immediately upon discovery of a compromise or improper use of government information, Contractor shall take such action as may be necessary to preserve forensic evidence and eliminate the cause of the compromise or improper use. As soon as practicable, but no later than twenty-four hours after discovery, Contractor shall notify using governmental unit of the compromise or improper use, including a description of the circumstances of the use or compromise. As soon as practicable after discovery, Contractor shall undertake a thorough forensic investigation of any compromise or improper use and provide the using governmental unit all information necessary to enable the using governmental unit to fully understand the nature and extent of the compromise or improper use. With regard to any compromise or improper use of government information, Contractor shall: (1) provide any notification to third parties legally required to be provided such notice by Contractor, and if not (e.g., if legally required of the using governmental unit), Contractor shall reimburse using governmental unit for the cost of providing such notifications; (2) pay all costs and expenses for at least two years of identity theft monitoring services (including without limitation, credit monitoring) and identity theft restoration services for any such affected individuals receiving notice where such services are appropriate given the circumstances of the incident and the nature of the information compromised;

(3) undertake any other measures that are customary and reasonable for an entity to take when experiencing a similar disclosure, (4) pay any related fines or penalties imposed on the using governmental unit, and (5) reimburse the Using Governmental Unit all costs reasonably incurred for communications and public relations services involved in responding to the compromise or improper us. Notwithstanding any other provision, contractor’s obligations pursuant to this item (h) are without limitation.

(i) Survival & Remedy. All the obligations imposed by this paragraph are material. The obligations of this section shall survive termination or expiration of the contract. Without limiting any rights the using governmental unit may have, and notwithstanding any other term of this contract, Contractor agrees that using governmental unit may have no adequate remedy at law for a breach of Contractor’s obligations under this clause and therefore the using governmental unit shall be entitled to pursue equitable remedies in the event of a breach of this clause. [07-7B108-1]

INFORMATION USE AND DISCLOSURE – STANDARDS (FEB 2015)

To the extent applicable:

(a) Breach of security of state agency data; notification; rights and remedies of injured parties; penalties;

notification of Consumer Protection Division, S.C. Code Ann. Section 1-11-490.

(b) South Carolina Financial Identity Fraud and Identity Theft Protection Act (FIFITPA), 2008 Act 190, as amended. Solely for purposes of Section 39-1-90 of the South Carolina Code of Laws, as amended, Contractor is deemed to be the owner of government information, as defined herein, and Contractor agrees that the Using Governmental Unit is not a licensee.

(c) The South Carolina Family Privacy Protection Act of 2002, S.C. Code Ann. Sections 30-2-10, et seq.

(d) Personal Identifying Information Privacy Protection, S.C. Code Ann. Sections 30-2-310 et seq.

(e) Data Breach Notification, 2014 Act No. 286, Section 117.117, as revised in any future annual appropriations act. [07-7B110-1]

LIMITATION ON LIABILITY – STATEWIDE TERM CONTRACTS

(1) Contractor’s liability for damages to any Using Governmental Unit shall not exceed the greater of five million dollars or an amount equal to three times the Aggregate Contract Price. As used in this clause, the term “Aggregate Contract Price” means the total price for all agreements that both arise out of this Contract and are between Contractor and the Using Governmental Unit making the claim. (2) The foregoing limitation shall apply to each Using Governmental Unit independently. (3) The parties waive claims against each other for (i) exemplary or punitive damages and (ii) special or consequential damages.

(4) The foregoing limitations shall not apply: (a) to claims for physical damage to real or tangible personal property, (b) to claims regarding bodily injury, sickness, disease or death, (c) to claims arising from reckless or intentional misconduct, (d) to amounts due or obligations under a clause (regardless of how named) providing for liquidated damages, or if such a clause is ruled unenforceable as a penalty, (e) to amounts due or obligations under the following clauses, if included: (i) Indemnification-Third Party Claims-General,

(ii) Indemnification-Third Party Claims-Disclosure of Information, (iii) Indemnification-Intellectual Property, (iv) Information Security–Safeguarding Requirements, (v) Information Security-Location of Data,

(vi) Information Use and Disclosure–Standards, or (vii) Service Provider Security Representations, (f) to amounts due or obligations under a clause imposing a duty to defend or indemnify, or (g) to any loss or claim to the extent the loss or claim is covered by a policy of insurance maintained, or required by this contract to be maintained, by contractor. (5) The absence in any subcontract of a similar clause limiting contractor’s liability shall not effectively increase the obligation of the Using Governmental Unit beyond what it would have been had the subcontract contained such a clause. (6) The Using Governmental Unit’s liability for damages, if any, shall in no event exceed an amount equal to the greater of five million dollars or an amount equal to three times the Aggregate Contract Price. Nothing herein shall be construed to waive any law or clause regarding the availability or appropriation of funds, sovereign immunity, or any other immunity, restriction, or limitation on payment or recovery provided by law. (7) The State of South

Carolina’s total liability for any obligation under any clause imposing any duty of confidentiality or non-disclosure shall not exceed an amount equal to fifty thousand dollars.