Attachment A_Agency Specific Terms and Conditions_kb updated.docx

Attachment A Agency Specific Terms and Conditions Exceptions to SECTION 4 are as follows:

4.3: Current paragraph states “For purposes of this Section, subcontractors are those specifically hired to perform all or part of the work covered by the contract.” Please note that definition of “subcontractors” applies to the entirety of the contract.

4.9: In addition to the provisions contained therein, the vendor agrees to sign such documentation that may be reasonably requested by the State to ensure that title is vested in the State.

4.10: The following provision is DELETED from the contract: “Neither Party shall be liable for incidental, special, consequential or punitive damages.”

4.11: In addition to the provisions contained therein, the Vendor agrees to provide: (d) a Professional Liability Insurance Policy with a limit of liability not less than $1,000,000 for each claim, and not less than $1,000,000 in the aggregate on an annual basis, for errors, omissions or negligent acts arising out of the performance of (or the failure to perform) professional services hereunder such as, but not limited to: systems analysis, system design, programming, data processing, consulting, system integration and information services. The Professional Liability coverage shall include contractual liability coverage in support of the Vendor’s indemnification agreements in favor of ISBE, shall be written on a “claims made” basis and must be maintained for a period of not less than three (3) years following the date of final payment to the Vendor for all such Services; (e) a Cyber Liability insurance Policy with limits of liability not less than Two Million and 00/100 Dollars ($2,000,000.00) per claim and Two Million and 00/100 Dollars ($2,000,000.00) in the aggregate covering claims involving privacy violations, information theft, failure of computer security, wrongful release of personal information, damage to or destruction of electronic information, and failure to prevent transmission of malicious code, including expenses for notification as required by local, state or federal guidelines. The Policy will be a claims-made program with any prior acts exclusion predating both the date of this Agreement and any earlier commencement of Services. Such coverage shall either be maintained continuously for a period of 2 years after expiration or termination of this Agreement or secure a 2-year extended reporting provision. The Vendor shall cause all of its subcontractors to purchase and maintain insurance coverages identical to those required of the Vendor hereunder. Insurance shall not limit Vendor’s obligation to indemnify, defend or settle any claims.

Additions to SECTION 4:

4.34.9 Internal Controls. If applicable and upon request, the Vendor shall provide the Agency, at no cost, with a copy of the most recent Annual Report or Form 10-K of itself or its holding company, along with its most recent audited internal control documentation. This shall include, but is not limited to, the most recent Service Organization Control (“SOC”) 2 Type II report, any applicable bridge letters, and other relevant SOC reports, such as SSAE 16 or SSAE 18 reports. These documents must include the attestation of the company’s independent registered public accounting firm regarding the effectiveness of the Vendor’s internal controls over financial reporting.

In the event the Vendor utilizes sub-service organizations and their controls are not included under the Vendor’s SOC 2 report via the inclusive method, the Vendor shall also provide, upon request, the SOC 2 Type II reports, including any applicable bridge letters, of those sub-service organizations to ensure full visibility into the control environment supporting the services provided to the Agency.

4.34 4.35

4.35.2 The Confidential Data are and at all times will remain the sole property of ISBE. ISBE retains all right, title and interest in and to the Confidential Data and all copies thereof (including, without limitation, all copyrights, trade secrets, trademarks, patents, and other similar proprietary rights therein).

4.35.3 The term "personally identifiable information" means information that is identifiable to a particular individual, program, classroom, school, institution or district, including but not limited to the following: (a) a first and last name; (b) a home or other physical address, including street name and name of a city, town, or county; (c) an e-mail address; (d) a telephone number; (e) a social security, employer identification, student identification number, or biometric record; (f) test scores; or (g) clinical information, including any questionnaires, notes, or other documentation. Also includes other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty (34 C.F.R. § 99.3).

4.35.4 “De-identified data” means data that does not identify a particular individual, program, classroom, school, institution or district and with respect to which there is no reasonable basis to believe the data can be used to identify a particular individual, program, classroom, school, institution or district. Personally identifiable information (“PII”) has been removed or obscured from the data in a way that minimizes the risk of unintended disclosure of the identity of individuals, programs, classrooms, schools, institutions or districts and information about them. (34 CFR § 99.31(b)(1)).

4.35.5 Vendor must ensure that any third-party Vendor of the Confidential Data working under or in collaboration with Vendor agrees by contractual terms to the provisions of this Agreement for the sharing, disclosure, re-disclosure, use, maintenance, security and destruction of the Confidential Data.

4.35.6 Injunctive Relief. Vendor agrees that an impending or existing violation of any provision of this Agreement would cause ISBE irreparable injury for which it would have no adequate remedy at law and that ISBE shall be entitled to seek immediate injunctive relief prohibiting such violation, in addition to any other rights and remedies available to it.

4.35.7 Prior to the publication of any data or results from research performed under this Agreement, Vendor must provide ISBE with a copy of any proposed publication that is based on Confidential Information specific to the State of Illinois, or any subgroup with the State of Illinois, or any subgroup (whether or not it is identified as including Illinois students) of size less than 30. ISBE shall have the right to review and comment on any portion of the publication prior to public dissemination. ISBE shall have the right to redact any inadvertent disclosures of individually identifiable information or Confidential Information. Any redactions by ISBE shall be final and Vendor agrees that the publication of any material redacted by ISBE shall be considered a material breach of this Agreement. ISBE reserves the right to demand that the Vendor include in any material to be publicly released a disclaimer to the effect that "Such material does not necessarily reflect the views of ISBE or its employees."

4.35.8 Data Access, Use and Security.

4.35.8.1 Restrictions on Vendor. The data access, use, and security restrictions set forth in this Section shall apply to the receipt, use, disclosure, and maintenance of Confidential Data by Vendor. Vendor agrees to the following:

A. Confidential Data may only be used for the purpose or purposes authorized pursuant to this Agreement.

B. Vendor will comply with all applicable laws, materials, regulations and all other State and Federal requirements with respect to the protection of privacy, security and dissemination of the shared data including but not limited to the relevant requirements of: including but not limited to the relevant requirements of: the Social Security Act (42 U.S.C. §§1320d-2 through 1320d-7); U.S.C. section 552(A)(Privacy Act of 1974, Public Law 93-579); Identity Protection Act (5 ILCS 179/1 et. seq.), FOIA (5 ILCS 140/7(1)(c); and PERA (105 ILCS 5/24A-7.1).

C. Vendor will comply with the relevant requirements of FERPA (20 U.S.C. § 1232g) and ISSRA (105 ILCS 10/1 et seq.), regarding the confidentiality of Student Data, and specifically “education records” as defined in FERPA and “school student records” as defined in ISSRA. Any use of information contained in student education records to be released must be approved by ISBE. To protect the confidentiality of student education records, Vendor will limit access to student education records to those employees who reasonably need access to them in order to perform their responsibilities under this Agreement.

D. Vendor shall abide by and be bound by the requirements of the U.S. Department of Education, Family Policy Compliance Office’s Guidance for Reasonable Methods and Written Agreements issued pursuant to the requirements of the Family Educational Rights and Privacy Act (“Guidance”). The Guidance is available at: http://www2.ed.gov/policy/gen/guid/fpco/pdf/reasonablemtd_agreement.pdf E. Vendor will comply with PERA’s confidentiality requirements regarding individual educator information (105 ILCS 5/24A-1 et seq.). The disclosure of educator or public school teacher, principal and superintendent performance evaluations is expressly prohibited under Section 24A-7.1 (105 ILCS 5/24A-7.1). Vendor will ensure that results from any analysis or evaluation of educator data will be published in a manner that protects the privacy and confidentiality of the individuals involved and that no educator, teacher or administrator can be personally identified from publicly reported aggregate data (Section 24A-20(a)(1)).

F. Vendor will follow ISBE’s confidentiality requirements for all ISBE data, pursuant to the Data Processing Confidentiality Act (30 ILCS 585/0.01 et seq.). Information obtained from any individual shall comply with the following terms and conditions, which include, but are not limited to:

All records and other information maintained by ISBE regarding any person are confidential and shall be protected from unauthorized use and/or disclosure under this Agreement. Any dissemination or use of the Confidential Data for other than the primary purpose of this Agreement without the express written authority of ISBE is specifically prohibited. Confidential Data released under this Agreement are solely for the use of Vendor and are to be used only for the specific purposes as described in the Specifications.

G. In the event that any Confidential Data is required to be disclosed in response to a valid order of a court of competent jurisdiction or other governmental body of the United States or any political subdivisions thereof, Vendor shall first (a) notify ISBE of the order and provide a complete copy of such order to ISBE and (b) permit ISBE to seek an appropriate protective order. Vendor shall fully cooperate with ISBE if ISBE wishes to apply to such court for a protective order. Vendor shall only disclose the Confidential Data to the extent necessary and for the purposes of the court or other governmental body. Furthermore, Vendor must comply with the notice requirements of FERPA (34 C.F.R. § 99.31(a)(9)(ii) when and if it is required to disclose any Student Data in accordance with a lawfully issued subpoena or court order. 34 C.F.R. § 99.33(b)(2).

H. Vendor must create and maintain a record of any disclosure of Confidential Data made to any other person or entity pursuant to this Agreement. The record of disclosure must record the name of any additional person or organization receiving the Confidential Data and their legitimate interest under 34 C.F.R. § 99.31 in requesting or obtaining the Confidential Data. The record must also describe the Confidential Data included within the disclosure by class, school, district, or other appropriate grouping. Upon ISBE’s request, Vendor must provide a copy of the record of further disclosures to ISBE. 34 C.F.R. § 99.32(b)(2)(i) and (ii).

I. Nothing in this Agreement may be construed to allow Vendor to maintain, use, disclose, or share the Confidential Data in a manner not allowed by State or federal law or regulation, including but not limited to FERPA (20 U.S.C. § 1232g) and ISSRA (105 ILCS 10/1, et seq.).

J. Vendor will not share Confidential Data with anyone, except those employees, contractors, subcontractors and agents of Vendor with a legitimate interest in the Confidential Data for Audit, Evaluation, or Research and the relevant requirements of 34 C.F.R. § 99.32(a) applicable to the Confidential Data.

K. Vendor will instruct all persons having access to Confidential Data on the use and confidentiality restrictions set forth in this Agreement and sanctions for unauthorized disclosure and shall require all employees, contractors, subcontractors, or agents of any kind to undertake the same obligations as Vendor hereunder and comply with all applicable provisions of FERPA and other State and federal laws with respect to the Confidential Data. Vendor shall produce a written acknowledgement from all such persons verifying that the instruction required under this Section has occurred.

L. Vendor will not disclose any individually identifiable information or Confidential Data under this Agreement in a manner which could identify an individual student, person, program, school, institution, or district except as authorized by ISBE and applicable law. Disclosure includes, without limitation, disclosure of information, research, or analysis in a manner that permits the personal identification of parents and students, as such terms are defined in the FERPA regulations (34 C.F.R Part 99), or individual identification of a person, program, school, institution, or district; and includes, de-identified or aggregate data in cell sizes of less than ten (10) for each category or subcategory of data, and de-identified or aggregate data in cell sizes of more than ten (10) for each category or subcategory that, when disaggregated could lead to indirect disclosure through the disclosure, through the cumulative effects of disclosures, or when combined with other data element(s) in the public domain.

M. Vendor may not re-disclose Student Data to any other person or entity unless permitted or required by law and approved in advance under an amendment to this Agreement. Re-disclosure of Student Data includes, without limitation, disclosure of information, research, or analysis in a manner that permits the personal identification of parents and students, as such terms are defined in the FERPA regulations (34 C.F.R. Part 99); and includes, de-identified or aggregate data in cell sizes of less than ten (10) for each category or subcategory of data, and de-identified or aggregate data in cell sizes of more than ten (10) for each category or subcategory that, when disaggregated could lead to indirect disclosure through the disclosure, through the cumulative effects of disclosures, or when combined with other data element(s) in the public domain.

N. Vendor will apply data disclosure avoidance techniques such as cell suppression, complementary suppression, blurring and perturbation as appropriate, in order to further minimize re-identification risks associated with possible future efforts to compare and link the Confidential Data with other data sets. Care will be taken when utilizing cell suppression alone to employ additional methods to ensure that sensitive student counts cannot be found through the use of available percentages or data in other related tables or sources. Data users will refer to the best practices outlined by the National Center for Education Statistics Statewide Longitudinal Data Systems in Technical Brief 3, “Statistical Methods for Protecting Personally Identifiable Information in Aggregate Reporting” (NCES 2011-603), to minimize, to the greatest extent possible, the risk that individuals could be identified. Furthermore, Vendor agrees not to attempt to re-identify de-identified Confidential Data and not to transfer de-identified Confidential Data to any Authorizer User unless that Authorized User agrees not to attempt re-identification.

O. Vendor certifies that it has the capacity to restrict access to Confidential Data and maintain the security of electronic information, as more fully set forth below. Vendor shall develop, implement, maintain and use appropriate administrative, technical and physical security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted Confidential Data received from, or on behalf of, ISBE. Vendor acknowledges that the use of unsecured telecommunications, including the Internet or email, to transmit individually identifiable or deducible information derived from this Agreement is strictly prohibited.

P. Vendor agrees that all data transferred pursuant to this agreement will be through encrypted transmission mechanisms. These may include but not be limited to SFTP/FTPS or web sites using SSL protocols. These measures will be extended by contract to all employees, contractors, subcontractors, or agents that will receive Confidential Data provided by this Agreement and used by Vendor.

Q. Vendor will not provide any of the Confidential Data obtained pursuant to this Agreement to any party ineligible to receive data protected by FERPA or prohibited from receiving data from any entity by virtue of a finding under subsections 99.67(c), (d) or (e) of Title 34 of the Code of Federal Regulations. 34 C.F.R. § 99.67 (c), (d) and (e).

R. Vendor agrees to fully report to ISBE as reasonably practicable, which in no event shall be longer than 48 hours of discovery of any infraction of the confidentiality provisions and any use or disclosure of Confidential Data not authorized by this Agreement or in writing by ISBE. Vendor’s report shall identify: (i) the nature of the unauthorized use or disclosure; (ii) the Confidential Data used or disclosed; (iii) who made the unauthorized use and/or received the unauthorized disclosure; (iv) what Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and (v) what corrective action Vendor has taken or shall take to prevent future similar unauthorized use and/or disclosure. Vendor shall provide such other information, including a written report, as reasonably requested by ISBE.

S. Vendor agrees that Confidential Data shall not be archived or sent to a records center.

T. Vendor agrees to secure any and all data received pursuant to this Agreement and agrees to establish, secure and retain records of access and use of all Confidential Data received pursuant to this Agreement. Upon reasonable notice and during normal business hours, Vendor agrees to allow ISBE on-site inspection and access to all relevant data files and servers to verify data security and usage, as well as audit access, throughout the Term of this Agreement and for a period of three (3) years following the end of the Term. The three (3) year period shall be extended for the duration of any audit in progress during the Term. No fees shall be assessed for such access, audit, or review, and Vendor agrees to cooperate with ISBE’s reasonable efforts to verify data security and usage.

U. Any breach of the security of any Confidential Data provided to any person or entity under this Agreement shall be subject to the terms and provisions of the Personal Information Protection Act (815 ILCS 530/1, et seq.).

V. Vendor represents and agrees that any and all approvals for the research to be conducted using the Confidential Data, where required by law, from the Vendor or the Vendor's Institutional Review Board ("IRB") have been obtained. ISBE may request a copy of any review completed by Vendor or the Vendor's IRB related to the Confidential Data; and Vendor shall provide ISBE with a copy of the requested review within ten (10) working days of ISBE's written request.

W. Vendor may not assign its obligations under this Agreement, or any part of its interest in this Agreement, without the prior written consent of ISBE. Any assignment made without said consent shall be null and void.

X. Vendor recognizes and agrees that the Confidential Data it obtains under this Agreement is the property of ISBE and shall be disposed of or returned to ISBE within ten (10) days, upon ISBE’s request. All Confidential Data received pursuant to this Agreement shall be disposed of upon termination, cancellation, expiration, or other conclusion of this Agreement. Disposal means the return of the Confidential Data to ISBE or destruction of the Confidential Data in a means outlined herein below, as directed by ISBE, including purging of all copies from the Vendor’s computer systems. Upon disposal of the Confidential Data, Vendor shall provide ISBE with written certification. Vendor agrees to require all employees, contractors, subcontractors, or agents of any kind to comply with this provision.

Y. Vendor must store all Confidential data in a non-proprietary, readily accessible format. If storing data in a proprietary format is unavoidable, the Vendor shall provide, at no additional cost to ISBE, a fully functional solution or tool that enables ISBE to extract and convert all Confidential data into a non-proprietary, accessible format upon request.

4.35.9 Protection of Data

4.35.9.1 All Confidential Data shall be stored in a secure environment physically located in the continental United States with access limited to the least number of staff needed to complete the purpose of this Agreement. Vendor must maintain a robust and reliable data backup system that, at a minimum, includes protections against ransomware attacks. This shall include the use of secure, immutable, and/or air-gapped backup solutions, or equivalent measures, to ensure the integrity and recoverability of ISBE data. Only one complete copy of the Confidential Data is permitted to be maintained by the Vendor; however, time-delimited temporary data analysis files may be created. Any additional copies must exist solely as part of the Vendor’s backup and disaster recovery processes and must be stored securely in accordance with this Agreement’s data protection requirements. Any temporary data file(s) and subsets of the original data set will be considered Confidential Data and subject to the terms and conditions of this agreement. Vendor agrees to store data on one or more of the following media and protect the data as described:

4.35.10 Data Classification and Segregation

4.35.10.1 The Vendor must classify and handle ISBE data in accordance with modern data protection standards. All Confidential Data, as defined in this Agreement, must be clearly identified and logically or physically segregated or otherwise distinguishable from non- Confidential Data throughout its lifecycle. This classification is critical to ensure proper access controls, data management, and enable efficient return or destruction of Confidential Data upon request or termination of the contract.

4.35.10.2 Segregation and Storage Requirements. Confidential Data shall be stored in one of the following methods:

A. Dedicated Storage Media. Confidential Data is stored on physical or virtual media (e.g., hard drives, optical discs, or backup tapes) which contain no non-confidential data; or

B. Logical Segregation. Confidential Data is stored in dedicated logical containers such as encrypted partitions, folders, or directories specifically designated to confidential data; or

C. Dedicated Database. Confidential Data is stored in a database that does not contain any non-confidential data; or

D. Field-Level Identification. If Confidential Data is stored in shared databases, it must be clearly distinguishable from non-confidential data through reliable classification markers (e.g., flags or tagged fields within records); or

E. Commingled Data Protection. In cases where segregation of Confidential Data is not technically or operationally feasible, all data with which it is commingled must be treated as Confidential Data and protected accordingly under the terms of this Agreement.

F. Incident Detection and Notification. If the Vendor or its agents detect a compromise or potential compromise in the IT security for this data such that personal information may have been accessed or disclosed without proper authorization, the Vendor must notify ISBE within 24 hours of knowledge. Notice should be sent in accordance with the Agreement along with an email notification to: ISBE.Security@isbe.net.

4.35.11 Disposition of Data.

4.35.11.1 Upon termination of the agreement, the Vendor shall provide the State with a complete copy of all ISBE data in a readable, non-proprietary format at no additional cost, prior to any data disposal activities. Following confirmation of data transfer, the Vendor shall dispose of all data received from the Agency, including any backup copies and temporary or permanent work files that contain confidential data, and provide written notification to the State confirming disposal. Failure to comply with these requirements may render the Vendor ineligible for future data sharing agreements with ISBE.

4.35.11.2 Upon the destruction of the confidential data, the Vendor shall verify the disposition, in writing, and submit it to the ISBE authorized representative within fifteen (15) days of the date of disposal.

4.35.11.3 Acceptable destruction methods for various types of media include:

A. For paper documents containing confidential or sensitive information, a contract with a recycling firm to recycle confidential documents is acceptable, provided the contract ensures that the confidentiality of the data will be protected. Such documents may also be destroyed by on-site shredding, pulping, or incineration.

B. For paper documents containing Confidential Data requiring special handling, recycling is not an option. These documents must be destroyed by on-site shredding, pulping, or incineration.

C. If confidential or sensitive information has been stored on magnetic media (e.g., magnetic tape), the Vendor shall destroy the data using one of the following methods:

· Degaussing, in accordance with applicable data destruction standards;

· Incineration in a secure facility; or

· Crosscut shredding to a particle size small enough to prevent reconstruction, as defined in NIST SP 800-88 Rev. 1 or equivalent.

D. If data has been stored on server or workstation storage devices such as HDDs, SSDs, or M.2/NVMe drives, the Vendor must follow NIST SP 800-88 Rev. 1–compliant data sanitization methods. Acceptable destruction methods include:

· Use of a secure data wiping utility designed for solid-state storage (e.g., NVMe sanitize commands, ATA secure erase), which fully removes data from all sectors;

· Cryptographic erasure, where encryption keys are securely destroyed, rendering the data unrecoverable; or

· Physical destruction, such as crushing, shredding, or disintegration, particularly for SSDs and flash-based media where wiping may be insufficient.

E. For data stored in cloud environments (e.g., AWS, Azure, Google Cloud), the Vendor must ensure that:

· All confidential or sensitive data is securely deleted using the cloud provider’s native deletion and sanitization tools that conform to NIST SP 800-88 Rev. 1 or equivalent standards.

· Object versioning, snapshots, and backups are included in the sanitization process.

· Encryption keys used to protect ISBE data are also destroyed as part of the sanitization process (cryptographic erasure), if applicable.

F. In the event that confidential or sensitive information has been contained on optical discs (e.g. CDs, DVDs, portable USB flash drives), the Vendor shall either destroy by incineration of the disc(s), shredding the discs, or completely deface the readable surface with a coarse abrasive.

G. In the event that data has been stored on removable media (e.g. floppies, USB flash drives, portable hard disks, or similar disks), the Vendor shall destroy the data by using a secure data wiping utility designed for solid-state storage (e.g., NVMe sanitize commands, ATA secure erase), which fully removes data from all sectors to ensure that the data cannot be reconstructed, or physically destroying disk(s).

H. Upon completion of any data destruction activity outlined in this section, the Vendor must provide written and signed confirmation of destruction or a data destruction report. This documentation must describe the method of destruction, the type of media or environment, the date performed, and the individual or entity responsible for executing the process. This evidence shall be provided to ISBE upon request or termination of the contract.

4.35.12. The terms and provisions of this contract shall apply to the use of Confidential Data received by Vendor for so long as Vendor retains the data and shall survive the expiration or earlier termination of this Agreement.