Attachment 2 Purchase Order Terms & Conditions.pdf

Version 071625 Documented Quote Page 1 of 32

Attachment 2 – State of Colorado Purchase Order Terms and Conditions

A. Section 1: Offer/Acceptance.

This Purchase Order, together with these terms and conditions (including, if applicable, Addendum 1: Additional Terms and Conditions for Information

Technology, and Addendum 2: Additional Terms and Conditions for Federal

Provisions, below), and any other attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference (collectively the

“PO”) shall represent the entire and exclusive agreement between the State and the Vendor. If this PO refers to Vendor’s bid or proposal, this PO is an ACCEPTANCE of Vendor’s OFFER TO SELL in accordance with the terms and conditions of this

PO. If a bid or proposal is not referenced, this PO is an OFFER TO BUY, subject to

Vendor’s acceptance, demonstrated by Vendor’s performance or written acceptance of this PO. Any COUNTER-OFFER TO SELL automatically CANCELS this

PO, unless a change order accepting the counter-offer is issued in accordance with

§4 accepting a counter-offer. The State shall not be responsible or liable for goods or services delivered or performed prior to issuance of this PO.

B. Section 2: Order of Precedence.

In the event of a conflict or inconsistency within this PO, such conflict or inconsistency shall be resolved by giving preference to the documents in the following order of priority:

A. If applicable, Addendum 2: Additional Terms and Conditions for Federal Provisions, below;

B. the Purchase Order document;

C. these Terms and Conditions (including, if applicable, Addendum 1: Additional Terms and Conditions for Information Technology below); and

D. any attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference.

Version 071625 Documented Quote Page 2 of 32

E. Any terms and conditions included on Vendor’s forms or invoices not included in this

PO are void.

Any terms and conditions included on Vendor's forms or invoices not included in this PO are void.

C. Section 3: Safety Information.

All chemicals, equipment, and materials proposed or used in the performance of this PO shall conform to the requirements of the Occupational Safety and Health

Act of 1970. Vendor shall furnish all Material Safety Data Sheets (MSDS) for any regulated chemicals, equipment, or hazardous materials at the time of delivery.

D.

Section 4: Changes.

Vendor shall furnish goods or services in strict accordance with the specifications and price set forth for each item. This PO shall not be modified, superseded or otherwise altered, except in writing signed by the State and accepted by Vendor.

If this PO is for goods only and Vendor has not delivered the goods prior to the expiration of this PO, but Vendor delivers all of the goods to the State only after expiration of this PO, then the State, in its sole discretion, may accept the goods under this PO by extending this PO and delivering the modification to Vendor;

however, regardless of anything to the contrary, if the State does not extend this

PO for any reason then the goods delivered after expiration of this PO shall be deemed rejected, Vendor shall arrange the return of all delivered goods at

Vendor’s sole expense, and the State shall have no liability for any such goods.

E.

Section 5: Delivery.

Unless otherwise specified in this PO, delivery shall be FOB destination, freight prepaid and allowed. The State is relying on the promised delivery date and any installation or service performance set forth in this PO as material and basic to the

State’s acceptance. If Vendor fails to deliver or perform as and when promised, Version 071625 Documented Quote Page 3 of 32 the State, in its sole discretion, may cancel its order, or any part thereof, without prejudice to its other rights, return all or part of any shipment so made, and charge Vendor with any loss or expense sustained as a result of such failure to deliver or perform as promised. Time is of the essence.

F.

Section 6: Rights to Materials.

[Not Applicable to POs issued either in whole or in part for Information

Technology, as defined in CRS § 24-37.5-102(2); which shall be governed by

Addendum 1 §B.] Unless specifically stated otherwise in this PO, all materials, including without limitation supplies, equipment, documents, content, information, or other material of any type, whether tangible or intangible

(collectively “Materials”), furnished by the State to Vendor or delivered by Vendor to the State in performance of its obligations under this PO shall be the exclusive property of the State. Vendor shall return or deliver all Materials to the State upon completion or termination of this PO.

G.

Section 7: Reporting.

If Vendor is served with a pleading or other document in connection with an action before a court or other administrative decision-making body, and such pleading or document relates to this PO or may affect Vendor’s ability to perform its obligations under this PO, Vendor shall, within 10 days after being served, notify the State of such action and deliver copies of such pleading or document to the

State. Vendor shall disclose, in a timely manner, in writing to the State all violations of federal or state criminal law involving fraud, bribery, or gratuity violations potentially affecting this PO. The State may impose any remedies available, which may include, without limitation, suspension or debarment.

H.

Section 8: Conflicts of Interest.

Vendor acknowledges that with respect to this PO, even the appearance of a

Version 071625 Documented Quote Page 4 of 32 conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Vendor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Vendor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Vendor is uncertain as to such, Vendor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction with respect to the actual or apparent conflict constitutes a breach of this PO. Vendor acknowledges that all State employees are subject to the ethical principles described in §24-18-105, C.R.S. Vendor further acknowledges that State employees may be subject to the requirements of §24-18-105, C.R.S. with regard to this PO.

I.

Section 9: Warranties.

All provisions and remedies of the Colorado Uniform Commercial Code, CRS, Title

4 (“UCC”), relating to implied or express warranties for goods are incorporated herein, in addition to any warranties contained in this PO.

J. Section 10: Inspection and Acceptance.

The State’s final acceptance of goods or services is contingent upon completion of all applicable inspection procedures. All goods delivered shall be newly manufactured and the current model, unless otherwise specified. The State shall have the right to inspect goods or services provided under this PO at all reasonable times and places. The State shall be the sole judge in determining “equals” with regard to conformance with the specifications outlined in this PO for quality, price, and performance. If any of the goods or services do not conform to this PO, the State, at its sole discretion, may require Vendor to either:

A. replace the goods specified by the State or

B. perform the services again, without additional payment from the State.

Version 071625 Documented Quote Page 5 of 32

When defects in the quality or quantity of goods or services cannot be corrected by replacement or re-performance, the State may:

A. require Vendor to take necessary action to ensure that future performance conforms to this PO and

B. equitably reduce the payment due Vendor to reflect the reduced value of the goods or services performed.

These remedies do not limit the remedies otherwise available in this PO, at law, or in equity.

K. Section 11: Taxes.

The State is exempt from federal excise taxes and from State and local sales and use taxes.

L. Section 12: Payment.

The State shall not pay Vendor any amount for performance under this PO in excess of the Document Total set forth on the Purchase Order document. The

State shall pay Vendor for all amounts due within 45 days after the State’s receipt of goods or services and acceptance of a correct invoice of amount due. Amounts not paid by the State within 45 days of the State’s acceptance of the invoice shall bear interest on the unpaid balance beginning on the 45th day at the rate set forth in CRS §24-30-202(24) until paid in full. Interest shall not accrue if a good faith dispute exists as to the State’s obligation to pay all or a portion of the amount due. Vendor shall invoice the State separately for interest on delinquent amounts due, referencing the delinquent payment, number of day’s interest to be paid, and applicable interest rate. The State may benefit from any early payment discount offered by Vendor by making payment within the timeframes required by Vendor to be eligible for such discount. If Vendor offers an early payment discount, then the discount shall be shown on Vendor’s invoices to the State, and if the State

Version 071625 Documented Quote Page 6 of 32 makes payment on the invoice within the time frame for the discount, Vendor shall either:

A. accept the payment amount less the appropriate discount or

B. refund the discount back to the State.

Except as specifically agreed in this PO, Vendor shall be solely responsible for all costs, expenses, and other charges it incurs in connection with its performance under this PO.

M. Section 13: Assignment.

Vendor’s rights and obligations under this PO shall not be transferred or assigned without the prior, written consent of the State and execution of a new PO. Any attempt at assignment or transfer without such consent and new PO shall be void.

Any new PO approved by the State shall be subject to the same terms and conditions as those set forth in this PO.

N. Section 14: Subcontracts.

Unless otherwise specified in this PO, Vendor shall not enter into any subcontract in connection with its obligations under this PO without the prior, written approval of the State. Vendor shall submit to the State a copy of each such subcontract upon request by the State. All subcontracts entered into by Vendor in connection with this PO shall comply with all applicable federal and state laws and regulations, shall provide that they are governed by the laws of the State of

Colorado, and shall be subject to all provisions of this PO.

O. Section 15: Severability.

The invalidity or unenforceability of any provision of this PO shall not affect the validity or enforceability of any other provision of this PO, which shall remain in

Version 071625 Documented Quote Page 7 of 32 full force and effect, provided, that the parties can continue to perform their obligations in accordance with the intent of this PO.

P. Section 16: Survival of Certain PO Terms.

Any provision of this PO that imposes an obligation on a party after termination or expiration of this PO shall survive the termination or expiration of this PO and shall be enforceable by the other party.

Q. Section 17: Third Party Beneficiaries.

Except for the parties’ respective successors and assigns, this PO does not and is not intended to confer any rights or remedies upon any person or entity other than the parties. Enforcement of this PO and all rights and obligations hereunder is reserved solely to the parties. Any services or benefits which third parties receive as a result of this PO are incidental to this PO, and do not create any rights for such third parties.

R. Section 18: Waiver.

A party’s failure or delay in exercising any right, power, or privilege under this PO, whether explicit or by lack of enforcement, shall not operate as a waiver, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise of such right, power, or privilege.

S. Section 19: Indemnification. [Not Applicable to Inter-governmental POs]

Vendor shall indemnify, save, and hold harmless the State, its employees, agents and assignees (the “Indemnified Parties”), against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the Indemnified Parties in relation to

Version 071625 Documented Quote Page 8 of 32 any act or omission by Vendor, or its employees, agents, subcontractors, or assignees in connection with this PO. This shall include, without limitation, any and all costs, expenses, claims, damages, liabilities, court awards and other amounts incurred by the Indemnified Parties in relation to any claim that any work infringes a patent, copyright, trademark, trade secret, or any other intellectual property right or any claim for loss or improper disclosure of any confidential information or personally identifiable information.

T. Section 20: Notice.

All notices given under this PO shall be in writing, and shall be delivered to the contacts for each party listed on the Purchase Order document. Either party may change its contact or contact information by notice submitted in writing to the other party without a formal modification to this PO.

U. Section 21: Insurance.

Except as otherwise specifically stated in this PO, Vendor shall obtain and maintain insurance as specified in this section at all times during the term of this

PO:

V. workers’ compensation insurance as required by state statute, and employers’ liability insurance covering all Vendor employees acting within the course and scope of their employment;

W. Commercial general liability insurance written on an Insurance Services Office occurrence form, covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: $1,000,000 each occurrence; $1,000,000 general aggregate; $1,000,000 products and completed operations aggregate; and $50,000 any one fire; and

X. Automobile liability insurance covering any auto (including owned, hired and non-

Version 071625 Documented Quote Page 9 of 32 owned autos) with a minimum limit of $1,000,000 each accident combined single limit. If Vendor will or may have access to any protected information, then Vendor shall also obtain and maintain insurance covering loss and disclosure of protected information and claims based on alleged violations of privacy right through improper use and disclosure of protected information with limits of $1,000,000 each occurrence and $1,000,000 general aggregate at all times during the term of this PO.

Y. Additional insurance may be required as provided elsewhere in this PO. All insurance policies required by this PO shall be issued by insurance companies with an AM Best rating of A-VIII or better. This insurance requirement shall not apply if this PO is solely for goods, as determined by the State, unless specifically stated otherwise in this PO or any attachment or exhibit to this PO. If Vendor is a public agency within the meaning of the Colorado Governmental Immunity Act, then this section shall not apply and Vendor shall instead comply with the Colorado Governmental Immunity Act. The

State shall be named as additional insured on all commercial general liability policies required of Vendor. All insurance policies secured or maintained by Vendor in relation to this Purchase Order shall include clauses stating that each carrier shall waive all rights of recovery under subrogation or otherwise against Vendor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers.

Z. Section 22: Termination Prior to Vendor Acceptance.

If Vendor has not begun performance under this PO, the State may cancel this PO by providing written notice to the Vendor.

AA. Section 23: Termination for Cause.

A. If Vendor refuses or fails to timely and properly perform any of its obligations under this PO with such diligence as will ensure its completion within the time specified in this PO, the State may notify Vendor in writing of non-performance and, if not corrected by Vendor within the time specified in the notice, terminate Vendor’s right to proceed with this PO or such part thereof as to which there has been delay or a

Version 071625 Documented Quote Page 10 of 32 failure. Vendor shall continue performance of this PO to the extent not terminated.

B. Vendor shall be liable for excess costs incurred by the State in procuring similar goods or services and the State may withhold such amounts as the State deems necessary.

C. If after rejection, revocation, or other termination of Vendor’s right to proceed under the UCC or this clause, the State determines for any reason that Vendor was not in default or the delay was excusable, the rights and obligations of the State and Vendor shall be the same as if the notice of termination had been issued pursuant to termination under §24.

BB. Section 24: Termination in Public Interest.

The State is entering into this PO for the purpose of carrying out the public interest of the State, as determined by its Governor, General Assembly, or Courts.

If this PO ceases to further the public interest of the State as determined by its

Governor, General Assembly, or Courts, the State, in its sole discretion, may terminate this PO in whole or in part and such termination shall not be deemed to be a breach of the State’s obligations hereunder. This section shall not apply to a termination for cause, which shall be governed by §23. A determination that this

PO should be terminated in the public interest shall not be equivalent to a State right to terminate for convenience. The State shall give written notice of termination to Vendor specifying the part of this PO terminated and when termination becomes effective. Upon receipt of notice of termination, Vendor shall not incur further obligations except as necessary to mitigate costs of performance. For services or specially manufactured goods, the State shall pay:

A. reasonable settlement expenses, B. this PO price or rate for supplies and services delivered and accepted, C. reasonable costs of performance on unaccepted supplies and services, and

D. a reasonable profit for the unaccepted work.

For existing goods, the State shall pay:

Version 071625 Documented Quote Page 11 of 32

A. reasonable settlement expenses, B. the PO price for goods delivered and accepted, C. reasonable costs incurred in preparation for delivery of the undelivered goods, and

D. a reasonable profit for the preparatory work.

The State’s termination liability under this section shall not exceed the total PO price. As a condition for payment under this section, Vendor shall submit a termination proposal and reasonable supporting documentation, and cost and pricing data as requested by the State.

CC. Section 25: Funds Availability.

Financial obligations of the State payable after the State’s current fiscal year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available. If this PO is funded in whole or in part with federal funds, this PO is subject to and contingent upon the continuing availability of federal funds for the purposes hereof. The State represents that it has set aside sufficient funds to make payment for goods delivered in a single installment, in accordance with the terms of this PO.

DD. Section 26: Governmental Immunity.

Liability for claims for injuries to persons or property arising from the negligence of the State, its departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the

Colorado Governmental Immunity Act, CRS §24-10-101, et seq., the Federal Tort

Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C. 1346(b), and the State’s risk management statutes, CRS §§24-30-1501, et seq. No term or condition of this PO shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, contained in these statutes.

Version 071625 Documented Quote Page 12 of 32

EE. Section 27: Independent Contractor.

Vendor shall perform its duties under this PO as an independent contractor and not as an employee. Neither Vendor nor any agent or employee of Vendor shall be deemed to be an agent or employee of the State. Vendor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Vendor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Vendor or any of its agents or employees.

Vendor shall pay when due all applicable employment taxes, income taxes and local head taxes incurred pursuant to this PO. Vendor shall

A. provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law, B. provide proof thereof when requested by the State, and

C. be solely responsible for its acts and those of its employees and agents.

FF. Section 28: Compliance with Law.

Vendor shall comply with all applicable federal and state laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices.

GG. Section 29: Choice of Law, Jurisdiction and Venue. [Not Applicable to Inter-governmental POs]

Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this PO. The UCC shall govern this PO in the case of goods unless otherwise agreed in this PO. Any provision included or incorporated herein by reference, which conflicts with said

Version 071625 Documented Quote Page 13 of 32 laws, rules, and regulations shall be null and void. All suits or actions related to this PO shall be filed and proceedings held in the State of Colorado and exclusive venue shall be in the City and County of Denver. Any provision incorporated herein by reference which purports to negate this or any other provision in this PO in whole or in part shall not be valid or enforceable or available in any action at law, whether by way of complaint, defense, or otherwise. Vendor shall exhaust administrative remedies in CRS §24-109-106, prior to commencing any judicial action against the State.

HH. Section 30: Prohibited Terms.

Nothing in this PO shall be construed as a waiver of any provision of CRS §24-106-

109. Any term included in this PO that requires the State to indemnify or hold

Vendor harmless; requires the State to agree to binding arbitration; limits

Vendor’s liability for damages resulting from death, bodily injury, or damage to tangible property; or that conflicts with that statute in any way shall be void ab initio.

II. Section 31: Vendor Offset and Erroneous Payments. [Not Applicable to Inter-governmental POs or to POs issued solely for goods]

The State Controller may withhold payment under the State’s Vendor offset intercept system for debts owed to State agencies for:

A. unpaid child support debts or child support arrearages;

B. unpaid balances of tax, accrued interest, or other charges specified in CRS §39-21-

101, et seq.;

C. unpaid loans due to the Student Loan Division of the Department of Higher

Education;

D. amounts required to be paid to the Unemployment Compensation Fund; and

E. other unpaid debts owing to the State as a result of final agency determination or

Version 071625 Documented Quote Page 14 of 32 judicial action.

The State may also recover, at the State's discretion, payments made to Vendor in error for any reason, including, but not limited to, overpayments or improper payments, and unexpected or excess funds received by Vendor by deduction from subsequent payments under this PO, deduction from any payment due under any other contracts, grants or agreements between the State and Vendor, or by any other appropriate method for collecting debts owed to the State.

E. ADDENDUM 1:

Additional Terms & Conditions for Information Technology

IF ANY PART OF THE SUBJECT MATTER OF THIS PO IS INFORMATION

TECHNOLOGY, AS DEFINED INCRS § 24-37.5-102 (2), THE FOLLOWING

PROVISIONS ALSO APPLY TO THIS PO.

JJ. Section 1: Definitions.

The following terms shall be construed and interpreted as follows:

A. “Business Day” means any day in which the State is open and conducting business, but shall not include Saturday, Sunday or any day on which the State observes one of the holidays listed in CRS §24-11-101(1);

B. “CJI” means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S.

Department of Justice, Federal Bureau of Investigation, Criminal Justice Information

Services Security Policy, as amended, and all Criminal Justice Records as defined under CRS §24-72-302;

C. “HIPAA” means the federal Health Information Portability and Accountability Act

D. “Incident” means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the

Version 071625 Documented Quote Page 15 of 32

State, pursuant to CRS §§24-37.5-401 et seq.;

E. “PCI” means payment card information including any data related to credit card holders’ names, credit card numbers, or the other credit card information as may be protected by state or federal law;

F. “PHI” means any protected health information, including, without limitation any information whether oral or recorded in any form or medium that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual including, without limitation, any information defined as Individually

Identifiable Health Information by HIPAA;

G. “PII” means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records, including, without limitation, all information defined as personally identifiable information in

CRS §24-72-501. “PII” shall also mean “personal identifying information” as set forth at § 24-74-102, et. seq., C.R.S.;

H. “State Confidential Information” means any and all State Records not subject to disclosure under the Colorado Open Records Act, CRS §§24-72-200.1, et seq.

(“CORA”), and includes, without limitation, PII, PHI, PCI, Tax Information, CJI, and

State personnel records not subject to disclosure under CORA;

I. “State Records” means any and all State data, information, and records, regardless of physical form;

J. “Tax Information” means federal and State of Colorado tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation, including, without limitation all information defined as federal tax information in

Version 071625 Documented Quote Page 16 of 32

Internal Revenue Service Publication 1075; and

K. “Work Product” means the tangible and intangible results of the delivery of goods and performance of services, whether finished or unfinished, including drafts.

KK. Section 2: Intellectual Property.

Except to the extent specifically provided elsewhere in this PO, any State information, including without limitation pre-existing State software, research, reports, studies, data, photographs, negatives or other documents, drawings, models, materials; or Work Product prepared by Vendor in the performance of its obligations under this PO shall be the exclusive property of the State (collectively, “State Materials”). Vendor shall deliver all State Materials to the State upon completion or termination of this PO. The State’s exclusive rights in any Work

Product prepared by Vendor shall include, but not be limited to, the right to copy, publish, display, transfer, and prepare derivative works. Vendor shall not use, willingly allow, cause or permit any State Materials to be used for any purpose other than the performance of Vendor’s obligations hereunder without the prior written consent of the State. The State shall maintain complete and accurate records relating to:

A. its use of all Vendor and third party software licenses and rights to use any Vendor or third party software granted under this PO and its attachments to which the State is a party and

B. all amounts payable to Vendor pursuant to this PO and its attachments and the State’s obligations under this PO or to any amounts payable to Vendor in relation to this PO, which records shall contain sufficient information to permit Vendor to confirm the

State’s compliance with the use restrictions and payment obligations under this PO or to any third-party use restrictions to which the State is a party.

Vendor retains the exclusive rights, title and ownership to any and all pre-existing materials owned by or licensed to Vendor including, but not limited to all pre-existing software, licensed products, associated source code, machine code, text

Version 071625 Documented Quote Page 17 of 32 images, audio, video, and third-party materials, delivered by Vendor under this

PO, whether incorporated in a deliverable or necessary to use a deliverable

(collectively, “Vendor Property”). Vendor Property shall be licensed to the State as set forth in a State-approved license agreement:

A. entered into as exhibits or attachments to this PO, B. obtained by the State from the applicable third-party Vendor, or

C. in the case of open source software, the license terms set forth in the applicable open source license agreement.

Notwithstanding anything to the contrary herein, the State shall not be subject to any provision incorporated in any exhibit or attachment attached hereto, any provision incorporated in any terms and conditions appearing on any website, any provision incorporated into any click through or online agreements, or any provision incorporated into any other document or agreement between the parties that

A. requires the State to indemnify Vendor or any other party, B. is in violation of State laws, regulations, rules, fiscal rules, policies, or other State requirements as deemed solely by the State, or

C. is contrary to this PO.

LL. Section 3: License or Use Audit Rights.

If this PO includes any license or other right to use Vendor’s intellectual property, Vendor shall have the right, at any time during and throughout the term of this

PO, but not more than once during any State fiscal year, to request via written notice in accordance with the notice provisions of this PO that the State audit its use of Vendor’s intellectual property and certify as to its compliance with any applicable license or use restrictions and limitations contained in this PO (an

“Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit.

Version 071625 Documented Quote Page 18 of 32

The State shall complete the audit and provide certification of its compliance to

Vendor (“Audit Certification”) within 120 days following the State’s receipt of the

Audit Request. If upon receipt of the State’s Audit Certification, the parties reasonably determine that:

A. the State’s use of licenses, use of software, use of programs, or any other use of intellectual property during the audit period exceeded the use restrictions and limitations contained in this PO (“Overuse”) and

B. the State would have been or is then required to purchase additional rights to use

Vendor’s intellectual property (“Additional Rights”), Vendor shall provide written notice to the State in accordance with the notice provisions of this PO identifying any

Overuse or required Additional Rights and request that the State bring its use into compliance with such use restrictions and limitations.

Notwithstanding anything to the contrary in this PO, or incorporated as a part of

Vendor’s or any subcontractor’s website, click-through or online agreements, third-party agreements, or any other documents or agreements between the parties, the State shall not be liable for the costs associated with any Overuse or

Additional Rights, during the audit period regardless of whether the State may have been notified in advance of such costs.

MM.

Section 4: Vendor Records.

Vendor shall maintain a file of all documents, records, communications, notes, and other materials relating to the work (the “Vendor Records”). Vendor Records shall include all documents, records, communications, notes and other materials maintained by Vendor that relate to any work performed by Subcontractors, and

Vendor shall maintain all records related to the work performed by Subcontractors required to ensure proper performance of that work. Unless a longer period is required in this PO or any attachment or exhibit to this PO, Vendor shall maintain

Vendor Records until the last to occur of:

A. the date 3 years after the date this Purchase Order expires or is terminated, Version 071625 Documented Quote Page 19 of 32

B. final payment under this Purchase Order is made, C. the resolution of any pending Purchase Order matters, or

D. if an audit is occurring, or Vendor has received notice that an audit is pending, the date such audit is completed and its findings have been resolved (the “Record

Retention Period”).

Vendor shall permit the State, the federal government, and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy, and transcribe Vendor Records during the Record Retention Period. Vendor shall make Vendor Records available during normal business hours at Vendor’s office or place of business, or at other mutually agreed upon times or locations, upon no fewer than 2 Business Days’ notice from the State, unless the State determines that a shorter period of notice, or no notice, is necessary to protect the interests of the State. The State, in its discretion, may monitor Vendor’s performance of its obligations under this Purchase Order using procedures as determined by the State. The State shall monitor Vendor’s performance in a manner that does not unduly interfere with Vendor’s performance of the work.

Vendor shall promptly submit to the State a copy of any final audit report of an audit performed on Vendor’s records that relates to or affects this Purchase Order or the work, whether the audit is conducted by Vendor or a third party.

NN.

Section 5: Information Confidentiality.

Vendor shall keep confidential, and cause all subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Vendor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this PO, permitted by law, or approved in writing by the

State. Vendor shall provide for the security of all State Confidential Information in accordance with all applicable laws, rules, policies, publications, and guidelines. If

Vendor or any of its subcontractors will or may have access to any State

Version 071625 Documented Quote Page 20 of 32

Confidential Information or any other protected information, Vendor shall comply with all Colorado Office of Information Security (OIS) policies and procedures which OIS has issued pursuant to CRS §§24-37.5-401 through 406, and 8 CCR §1501-

5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies, all information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to

Vendor’s performance under this PO. Such obligations may arise from HIPAA; IRS

Publication 1075; Payment Card Industry Data Security Standard (PCI-DSS); Federal

Bureau of Investigation Criminal Justice Information Service Security Addendum;

Centers for Medicare & Medicaid Services (CMS) Minimum Acceptable Risk

Standards for Exchanges; and Electronic Information Exchange Security

Requirements and Procedures for State and Local Agencies Exchanging Electronic

Information With The Social Security Administration. Vendor shall immediately forward any request or demand for State Records to the State’s purchasing agent.

OO.

Section 6: Other Entity Access and Nondisclosure Agreements.

Vendor may provide State Records to its agents, employees, assigns and subcontractors as necessary to perform the work, but shall restrict access to State

Confidential Information to those agents, employees, assigns, and subcontractors who require access to perform their obligations under this PO. Vendor shall ensure all such agents, employees, assigns, and subcontractors sign agreements containing nondisclosure provisions at least as protective as those in this PO, and that the nondisclosure provisions are in force at all times the agent, employee, assign or subcontractor has access to any State Confidential Information. Vendor shall provide copies of those signed nondisclosure provisions to the State upon execution of the nondisclosure provisions if requested by the State.

PP.

Section 7: Use, Security, and Retention.

Vendor shall use, hold, and maintain State Confidential Information in compliance https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

Version 071625 Documented Quote Page 21 of 32 with all applicable laws and regulations only in facilities located within the United

States, and shall maintain a secure environment that ensures confidentiality of all

State Confidential Information. Vendor shall provide the State with access, subject to Vendor’s reasonable security requirements, for purposes of inspecting and monitoring access and use of State Confidential Information and evaluating security control effectiveness. Upon the expiration or termination of this PO, Vendor shall return State Records provided to Vendor or destroy such State

Records and certify to the State that it has done so, as directed by the State. If

Vendor is prevented by law or regulation from returning or destroying State

Confidential Information, Vendor warrants it will guarantee the confidentiality of, and cease to use, such State Confidential Information.

QQ. Section 8: Incident Notice and Remediation.

If Vendor becomes aware of any Incident, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Vendor can establish none of Vendor or any of its agents, employees, assigns, or subcontractors are the cause or source of the Incident, Vendor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an

Incident, Vendor shall take steps to reduce the risk of incurring a similar type of

Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State at no additional cost to the State. The State may adjust or direct modifications to this plan, in its sole discretion and Vendor shall make all modifications as directed by the State. If Vendor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Vendor shall reimburse the State for the reasonable actual costs thereof.

RR. Section 9: Data Protection and Handling.

Version 071625 Documented Quote Page 22 of 32

Vendor shall ensure that all State Records and Work Product in the possession of

Vendor or any subcontractors are protected and handled in accordance with the requirements of this PO at all times. Upon request by the State made any time prior to 60 days following the termination of this PO for any reason, whether or not this PO is expiring or terminating, Vendor shall make available to the State a complete and secure download file of all data that is encrypted and appropriately authenticated. This download file shall be made available to the State within 10

Business Days following the State’s request, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions, and attachments in its native format. Upon the termination of Vendor’s services under this PO, Vendor shall, as directed by the State, return all State Records provided by the State to Vendor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If legal obligations imposed upon Vendor prevent Vendor from returning or destroying all or part of the State Records provided by the State, Vendor shall guarantee the confidentiality of all State Records in Vendor’s possession and will not actively process such data. The State retains the right to use the established operational services to access and retrieve State Records stored on Vendor’s infrastructure at its sole discretion and at any time.

SS. Section 10: Compliance with OIS Policies and Procedure.

Vendor shall review, on a semi-annual basis, all Colorado Office of Information

Security (“OIS”) policies and procedures which OIS has promulgated pursuant to

CRS §§ 24-37.5-401 through 406 and 8 CCR § 1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies, to ensure compliance with the standards and guidelines published therein. Vendor shall cooperate, and shall cause its subcontractors to cooperate, with the performance of security audit and penetration tests by OIS or its designee.

Version 071625 Documented Quote Page 23 of 32

TT. Section 11: Safeguarding PII.

If Vendor or any of its subcontractors will or may receive PII under this PO, Vendor shall provide for the security of such PII, in a manner and form acceptable to the

State, including, without limitation, all State requirements relating to non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Vendor shall be a “Third-Party

Service Provider” as defined in CRS §24-73-103(1)(i) and shall maintain security procedures and practices consistent with CRS §§24-73-101. In addition, as set forth in § 24-74-102, et. seq., C.R.S., Contractor, including, but not limited to, Contractor’s employees, agents and Subcontractors, agrees not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Contractor is given direct access to any State databases containing PII, Contractor shall execute, on behalf of itself and its employees, the certification PII Individual

Certification Form or PII Entity Certification Form [Download form from Hyperlink] on an annual basis and Contractor’s duty and obligation to certify shall continue as long as Contractor has direct access to any State databases containing PII. If

Contractor uses any Subcontractors to perform services requiring direct access to

State databases containing PII, the Contractor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII.

UU. Section 12: Software Piracy Prohibition.

State or other public funds payable under this PO shall not be used for the acquisition, operation, or maintenance of computer software in violation of federal copyright laws or applicable licensing restrictions. Vendor hereby certifies and warrants that, during the term of this PO and any extensions, Vendor has and shall maintain in place appropriate systems and controls to prevent such improper https://docs.google.com/document/d/169JJP9YJmpBGNF0VbgrIxJeLDGMeE4Gq/edit https://docs.google.com/document/d/169JJP9YJmpBGNF0VbgrIxJeLDGMeE4Gq/edit https://docs.google.com/document/d/11g8sINO7y_V93-XD39umWASeOslaYMcs/edit

Version 071625 Documented Quote Page 24 of 32 use of public funds. If the State determines that Vendor is in violation of this provision, the State may exercise any remedy available at law or in equity or under this PO, including, without limitation, immediate termination of this PO and any remedy consistent with federal copyright laws or applicable licensing restrictions.

VV. Section 13: Information Technology.

To the extent that Vendor provides physical or logical storage of State Records;

Vendor creates, uses, processes, discloses, transmits, or disposes of State Records;

or Vendor is otherwise given physical or logical access to State Records in order to perform Vendor’s obligations under this PO, Vendor shall, and shall cause its subcontractors, to:

A. provide physical and logical protection for all hardware, software, applications, and data that meets or exceeds industry standards and the requirements of this PO;

B. maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), annual security testing, and improvements or enhancements consistent with evolving industry standards;

C. comply with State and federal rules and regulations related to overall security, privacy, confidentiality, integrity, availability, and auditing;

D. provide that security is not compromised by unauthorized access to workspaces, computers, networks, software, databases, or other physical or electronic environments;

E. promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the OIS; and

F. comply with all rules, policies, procedures, and standards issued by the Governor’s

Office of Information Technology (OIT), including project lifecycle methodology and governance, technical standards, documentation, and other requirements posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies.

Version 071625 Documented Quote Page 25 of 32

Vendor shall not allow remote access to State Records from outside the United

States, including access by Vendor’s employees or agents, without the prior express written consent of OIS. Vendor shall communicate any request regarding non-U.S. access to State Records to the State. The State, acting by and through

OIS, shall have sole discretion to grant or deny any such request.

WW. Section 14: Accessibility.

Vendor shall comply with and the Work Product provided under this PO shall be in compliance with all applicable provisions of §§24-85-101, et seq., C.R.S., and the Accessibility Standards for Individuals with a Disability, as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S. Vendor shall also comply with all

State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the Web Content Accessibility

Guidelines (WCAG), incorporated in the State of Colorado technology standards.

Vendor shall indemnify, save, and hold harmless the Indemnified Parties against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the

Indemnified Parties in relation to Vendor’s failure to comply with §§24-85-101, et seq., C.R.S., or the Accessibility Standards for Individuals with a Disability as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S. The State may require Vendor’s compliance to the State’s Accessibility Standards to be determined by a third party selected by the State to attest to Vendor’s Work

Product and software is in compliance with §§24-85-101, et seq., C.R.S., and the Accessibility Standards for Individuals with a Disability as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S.

F. ADDENDUM 2:

Additional Terms & Conditions for Federal Provisions

IF ANY PART OF THIS PO HAS BEEN FUNDED, IN WHOLE OR IN PART, WITH

Version 071625 Documented Quote Page 26 of 32

FEDERAL FUNDS, THE FOLLOWING PROVISIONS SHALL ALSO APPLY TO THIS PO.

XX. Section 1: Applicability of Provisions.

The Contract or Purchase Order to which these Federal Provisions are attached has been funded, in whole or in part, with an Award of Federal funds. In the event of a conflict between the provisions of these Federal Provisions, the Special Provisions, the body of the Contract or Purchase Order, or any attachments or exhibits incorporated into and made a part of the Contract or Purchase Order, the provisions of these Federal Provisions shall control.

YY.

Section 2: Compliance.

Contractor shall comply with all applicable provisions of the Transparency Act, all applicable provisions of the Uniform Guidance, and the regulations issued pursuant thereto, including but not limited to these federal Provisions. Any revisions to such provisions or regulations shall automatically become a part of these Federal

Provisions, without the necessity of either party executing any further instrument.

The State of Colorado may provide…