Attachment A_Sample Contract_S-10700-00010923.pdf

Information Technology Services Contract Page 1 of 62

STATE OF OREGON

INFORMATION TECHNOLOGY SERVICES CONTRACT

This Information Technology Services Contract (Contract) is entered into by and between the State of Oregon (State) acting by and through its Department of Administrative Services, Procurement Services (DAS PS) on behalf of the Enterprise Information Services, Cyber Security Services (Agency or CSS), and ______________, an __________ corporation (Contractor) and is effective as of the Effective Date (defined below).

RECITALS

1. Agency desires to engage a Contractor to provide a Network detection and Response Solution and related Services to enable Agency to achieve specific business and Agency mission objectives defined in this Contract. To that end, DAS PS issued RFP #S-10700- 00010923.

2. Contractor is the successful proposer to the RFP and Agency desires Contractor to perform the Services.

3. Contractor desires to perform the Services for Agency.

AGREEMENT

In consideration of the foregoing recitals and the mutual terms and conditions set forth below, State and Contractor agree as follows:

1. DEFINITIONS.

Agency Data means information created and information stored by Agency through the Services, and information created and collected by Contractor regarding Agency and its clients during the course of providing the Services, including Personal Information.

Agency Intellectual Property means any intellectual property that is owned by Agency, including Agency Data. Agency Intellectual Property includes any derivative works and compilations of any Agency Intellectual Property.

Authorized Representative means a person representing a party to this Contract who is authorized to make commitments and decisions on behalf of the party regarding the performance of this Contract. Contractor’s Authorized Representative is the person so identified in Exhibit D. Agency’s Authorized Representative is the person so identified in Exhibit E.

Business Days means Monday through Friday, 8:00 a.m. to 5:00 p.m., Pacific Time, excluding State of Oregon holidays and business closure days.

Calendar Days means contiguous days.

Contractor Intellectual Property means any intellectual property that is owned by Contractor and contained in or necessary for the use of the Deliverables or Services. Contractor Intellectual Property includes software owned by Contractor, including but not limited to _____________

Information Technology Services Contract Page 2 of 62 as described in Exhibit F, Documentation, and derivative works and compilations of any Contractor Intellectual Property.

Defect means a failure of the Subscription Services to operate in accordance with Requirements, despite the proper use of the Subscription Services. A Defect may be due to a data error, or a problem with the Subscription Services, Documentation, or both.

Deliverables means all items, including Work Product, that Contractor is required to provide to Agency under this Contract.

Documentation means all documents, including documents that are Deliverables described in a Statement of Work, and which may include operator’s and user’s manuals, training materials, guides, commentary, listings, requirements traceability matrices and other materials for use in conjunction with and for the operation of the Services. Documentation includes documents in hard copy or electronic form.

Enhancements means improvements to or additional components of the Services that add functionality.

Go-Live means the date on which the Subscription Services will be available for Agency and its users in a Production Environment for the processing of transactions in accordance with Requirements.

Key Persons means Contractor’s Authorized Representative and all other Contractor personnel designated as Key Persons in Exhibit D.

Production Environment means the hardware, software, including operating system software, and the system architecture and firmware necessary for the Subscription Services to operate.

Requirements are the functions and elements required for the Subscription Services.

Requirements are in Exhibit I, and will be managed via Deliverables identified in the Statement of Work.

Services means all effort to be expended by Contractor under the Contract, including installation, configuration, implementation, maintenance and support of the Subscription Services, completion of Tasks, and development and delivery of Deliverables and Work Product.

Service Level Agreement or SLA defines the level of service expected from Contractor, including the metrics by which service is measured, as well as remedies should service levels not be met. SLAs are set forth in Exhibit B.

Subscription Services means the integrated package of software, applications, platform, technical framework, security infrastructure, and related services delivered by Contractor under this Contract as a subscription.

State means the State of Oregon.

Statement of Work or SOW means the document that describes the Services to be provided by Contractor, including the Tasks and Deliverables, the attributes (including requirements and specifications) of each Deliverable, identification of the Deliverables and Services that are

Information Technology Services Contract Page 3 of 62 associated with each Task, and a completion date for each Task and Deliverable, and any other items as agreed by the parties, including as amended pursuant to Section 7.

Task means a segment of the Services to be provided by Contractor under this Contract.

Third Party Intellectual Property means any intellectual property owned by parties other than State or Contractor. Third Party Intellectual Property includes software owned by Third Parties, and derivative works and compilations of any Third Party Intellectual Property.

Upgrade means upgrades, improvements or changes to the software or other aspects of the Services that are designed to improve operating performance and to reflect changes in applicable laws without changing the basic functions of the software and that are generally made available by Contractor in its sole discretion at no additional charge to Contractor’s other licensees of the software. A new Upgrade typically will be indicated by the addition of one to the second digit of the upgrade number (e.g. v.X.2 would be the next Upgrade after v.X.1).

Work Product means everything that is specifically made, conceived, discovered, or reduced to practice by Contractor or Contractor’s subcontractors or agents (either alone or with others) pursuant to the Contract, including every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection).

Notwithstanding anything in the immediately preceding sentence to the contrary, Work Product is not Agency Intellectual Property, Contractor Intellectual Property, or Third Party Intellectual Property.

2. TERM.

This Contract is effective on _________, or the date on which this Contract is fully executed and approved according to applicable laws, rules and regulations, whichever is later (“Effective Date”). This Contract terminates on ________________ unless otherwise terminated or extended in accordance with its terms. The parties may extend the term of this Contract upon written agreement.

3. SCOPE OF SERVICES.

3.1. Responsibilities of Contractor. Contractor shall deliver the Subscription Services and perform the Services as set forth in the applicable Statement of Work and Service Level Agreements, and in accordance with the current, accepted Project Implementation Plan and Schedule, and the standards and methodologies set forth in this Contract. Contractor shall provide the Subscription Services and perform the Services:

3.1.1. Employing a methodology that conforms to the standards established by the Project Management Institute (PMI) as described in the current Project Management Body of Knowledge (PMBOK), supplemented by standards set forth in ISO 12207; and

3.1.2. In compliance with information technology standards established by Enterprise Information Services (EIS), found at:

Information Technology Services Contract Page 4 of 62 https://www.oregon.gov/das/Pages/policies.aspx#IT , as may be updated from time to time.

3.1.3. Contractor shall cooperate with Agency and its designated third parties, including its Quality Assurance contractor, by providing access and information on the Subscription Services’ architecture, design, operating environment, security, interfaces, and operating parameters as required for all oversight activities and Agency-identified third-party services.

3.2. Responsibilities of Agency. If a Statement of Work requires Agency to provide any resources, and Agency fails to provide the resources for a period that does not exceed fourteen (14) Calendar Days or such other agreed upon time, Contractor’s sole remedy is an extension of the applicable delivery dates corresponding to the delay. If Agency’s failure to provide the resources exceeds fourteen (14) Calendar Days or other agreed upon time, Contractor may be entitled to recover from Agency the reasonable increased costs incurred or to be incurred due to the delay. Contractor must send Agency written notice of Agency's failure, plus detailed information on the cost increases incurred or to be incurred, and Contractor must use commercially reasonable efforts to perform notwithstanding Agency's failure to perform.

3.3. Delivery and Review of Deliverables. Contractor shall deliver Deliverables and complete Tasks as set forth in the applicable Statement of Work by no later than the date or dates set for delivery in the Statement of Work, Exhibit A or the current, accepted Project Implementation Plan and Schedule.

3.4. Service Levels and Performance Reporting. Contractor shall, at all times, comply with all performance requirements and expectations specified in the Contract, including all Services Requirements. Contractor warrants that the Subscription Services will meet all Requirements, and all federal agency requirements.

3.4.1. Failure to Perform. If Contractor fails to meet a performance standard, Contractor shall (i) investigate, assemble and preserve pertinent information with respect to, and report on the causes of, the failure, including performing a root cause analysis of the failure; (ii) advise Agency of the status of remedial efforts being undertaken with respect to such failure; (iii) minimize the impact of and correct the problem and begin meeting the performance standard; and (iv) take appropriate preventive measures so that the failure does not recur.

3.4.2. Assessment of Damages. The parties agree that Contractor’s failure to meet the Service Level Agreements stated in Exhibit B will result in damage to Agency. Where actual damage will be difficult to determine, Contractor shall provide service credits to State in the amounts specified in Exhibit B. The remedies stated in Exhibit B are in addition to any other remedy for damages provided in the Contract. If Agency recovers actual damages in addition to the service credits, Agency will reduce such actual damages by the amounts received as service credits for the same events causing the actual damages.

https://www.oregon.gov/das/Pages/policies.aspx#IT

Information Technology Services Contract Page 5 of 62

3.4.2.1. In the event of Contractor’s failure to meet a Service Level Agreement in Exhibit B, Agency may at its option:

• Assess and withhold from payments due Contractor the amounts due for any damages or liquidated damages specified in Exhibit B; or

• Make immediate demand on Contractor for payment of the damages and liquidated damages specified in Exhibit B; or

• After Go-Live, accept a credit for change order services in lieu of assessing liquidated damages or damages. Unless otherwise specified, the credit will be equal to the value of the liquidated damages.

3.4.2.2. Notice. Agency will provide written notice of Agency’s intent to assess damages or offset service credits ten (10) Calendar Days prior to assessment or the date Agency deducts such sums from money payable to Contractor.

3.4.3. Measurement and Monitoring Tools. Contractor shall measure and monitor the performance of the Subscription Services against the applicable Service Level Agreements. Such measurement and monitoring must permit reporting at a level of detail sufficient to verify compliance with the Service Level Agreements and is subject to audit by Agency. Contractor shall provide Agency with information and access to all tools and procedures, for purposes of auditing and verification. Agency must be able to access the information online and in real-time, where feasible, at any time during the term of this Contract and may monitor or audit the records at any time, at its discretion, without notice.

3.4.4. Modifications to Service Levels. Upon agreement, the parties may add or modify performance metrics and Service Level Agreements, provided that changes to service levels will be established based on current performance (at least three (3) months of service metrics) and business requirements, and additional requirements may be added based on business requirements. Nowithstanding the foregoing, Agency may delete service levels at any time during the Term by sending written notice to Contractor.

4. CONTRACTOR’S PERSONNEL.

4.1. Key Persons. Contractor acknowledges that Agency selected Contractor, and is entering into this Contract, because of the special qualifications of Contractor's Key Persons identified in Exhibit D. Contractor's Key Persons shall not delegate performance of the powers and responsibilities they are required to provide under this Contract to another Contractor employee(s) without first obtaining the written consent of Agency. Further, Contractor shall not re-assign or transfer a Key Persons to other duties or positions such that the Key Person is no longer available to provide Agency with the required expertise, experience, judgment, and personal attention, without first obtaining Agency's written consent to such re-assignment or transfer, which Agency will not unreasonably withhold or delay.

4.1.1. Notwithstanding the foregoing, Contractor may replace Key Persons without Agency’s consent in the event any Key Persons are no longer available due to

Information Technology Services Contract Page 6 of 62 circumstances beyond Contractor’s reasonable control, such as death, illness, or termination of employment with Contractor. In the event Contractor requests that Agency approve a re-assignment or transfer of the Key Persons, or if Contractor must replace Key Persons, Agency may interview, review the qualifications of, and approve or reject the proposed replacement(s) for the Key Persons. Replacement personnel must have substantially equivalent or better qualifications than the Key Person being replaced. Any replacement personnel approved by Agency will thereafter be deemed a Key Person for purposes of this Contract and Exhibit D deemed amended to include such Key Person.

4.1.2. Contractor shall not charge Agency, and Agency will not pay, for a replacement Key Person while such replacement acquires the project knowledge and skills necessary to perform the Services. Such period of non-charge will be agreed upon by the parties, and will last for a minimum of fourteen (14) Calendar Days but not more than twenty-eight (28) Calendar Days, and will be reflected as an adjustment to a fee for a Deliverable associated with the replacement Key Person’s Services.

4.2. Contractor’s Employees and Subcontractors. Contractor shall not use subcontractors to perform the Services without Agency’s prior written consent. Contractor represents that any employees assigned to perform the Services, and any subcontractors performing the Services, will perform the Services in accordance with the warranties set forth in Section 11 of this Contract.

4.3. Anti-Discrimination. Contractor certifies that Contractor has a written policy and practice that meets the requirements described in ORS 279A.212 for preventing sexual harassment, sexual assault, and discrimination against employees who are members of a protected class. Contractor agrees, as a material term of this Contract, to maintain such policy and practice in force during the entire Contract term. Contractor’s failure to maintain such policy and practice constitutes a breach entitling Agency to terminate this Contract for cause.

4.4. Pay Equity. As required by ORS 279B.235, Contractor shall comply with ORS 652.220 and not unlawfully discriminate against any of its employees in the payment of wages or other compensation for work of comparable character on the basis of an employee’s membership in a protected class. “Protected class” means a group of persons distinguished by race, color, religion, sex, sexual orientation, national origin, marital status, veteran status, disability, or age. Contractor’s compliance with this section is a material term of this Contract, and Contractor’s failure to comply constitutes a breach entitling Agency to terminate this Contract for cause.

As required by ORS 279B.235, Contractor may not prohibit any of its employees from discussing the employee’s rate of wage, salary, benefits, or other compensation with another employee or another person. Contractor shall not retaliate against an employee who discusses the employee’s rate of wage, salary, benefits, or other compensation with another employee or another person.

5. INDEPENDENT CONTRACTOR; TAXES AND WITHHOLDING.

Information Technology Services Contract Page 7 of 62

5.1. Independent Contractor. Contractor shall perform all Services as an independent contractor and the person signing this Contract on behalf of Contractor, hereby certifies that Contractor: (i) is an independent contractor; (ii) is registered under ORS chapter 701 or other applicable Oregon statutes to provide labor or services for which such registration is required; (iii) has filed and paid federal and state income taxes in the name of its business or a business Schedule C; (iv) furnishes all tools or equipment necessary for the Services; (v) has authority to hire or fire employees; and (vi) assumes financial responsibility for defective workmanship or for service not provided as evidenced by the ownership of performance bonds, warranties, errors and omission insurance or liability insurance relating to the labor or services to be provided. Although Agency reserves the right to evaluate the quality of the completed performance, Agency cannot and will not control the means or manner of Contractor’s performance. Contractor is responsible for determining the appropriate means and manner of performing the Services. Contractor declares and certifies by execution of this Contract that it is not an “officer,” “employee,” or “agent” of Agency, as those terms are used in ORS 30.265.

5.2. No Partnership. This Contract is not intended, and will not be construed, to create a partnership or joint venture between State and Contractor. Nothing in this Contract will be construed to make State and Contractor partners or joint venture participants.

5.3. Declaration and Certification as to Conflict of Interest. Contractor by execution of this Contract declares and certifies that (i) its performance of the Services creates no potential or actual conflict of interest as defined by ORS Chapter 244, for Contractor or any Contractor personnel or Key Persons who will perform Services under this Contract; (ii) in the event that Contractor or its personnel are either employed by or performing services for the federal government, that no rules or regulations of the agency for which Contractor or its personnel work or are employed prohibit Contractor or its personnel from providing the Services under this Contract; and ; and (iii) this Contract and the delivery of Services creates no other violation of ORS Chapter 244 for Contractor, its employees, agents, or contractors.

5.4. Responsible for Taxes. Contractor is responsible for all federal and state taxes applicable to compensation and other payments paid to Contractor under this Contract and, unless Contractor is subject to backup withholding, Agency will not withhold from such compensation and payments any amount to cover Contractor’s federal or state tax obligations. Contractor is not eligible for any social security, unemployment insurance, or workers’ compensation benefits from compensation or payments paid to Contractor under this Contract, except as a self-employed individual.

5.5. Foreign Contractor. If Contractor is not domiciled in or registered to do business in the State of Oregon, Contractor shall promptly provide to the Oregon Department of Revenue and the Secretary of State, Corporation Division, all information required by those agencies relative to this Contract. Contractor shall demonstrate its legal capacity to perform the Services under this Contract in the State of Oregon before entering into this Contract.

5.6. Disclosure of Social Security Number. Contractor shall provide Contractor’s Social Security number unless Contractor provides a federal tax identification number. This number is requested pursuant to ORS 305.385, OAR 125-246-0330(2)(d), and OAR 150-

Information Technology Services Contract Page 8 of 62

305.100. Social Security numbers provided pursuant to this authority will be used for the administration of state, federal, and local tax laws.

6. COMPENSATION.

6.1. Maximum Compensation. Notwithstanding any other provision of this Contract to the contrary, the maximum, not-to-exceed compensation that Agency will pay to Contractor is _____Dollars ($_____) (the “Maximum Not-To-Exceed Compensation”), which includes payment for any allowable expenses for which Contractor may request reimbursement under this Contract.

6.2. Payments. Payments are subject to all provisions of this Section 6.

6.2.1. Payment of Fixed Prices. Agency will pay to Contractor the fixed price listed in Exhibit A for each Deliverable completed, delivered to, and accepted by Agency.

6.2.2. Payment for Subscription Services. Agency will pay to Contractor the fixed price per month/quarter/year for the Subscription Services (“Subscription Services Fee”) set forth in Exhibit A.

6.3. Retention Amount. Agency may retain up to fifteen percent (15%) of any invoice amount that is payable by Agency to Contractor for the implementation Services. Agency will pay the then-accrued Retention Amount to Contractor within thirty (30) Calendar Days following Go-Live.

6.4. Expenses. Agency will not pay or reimburse any expenses incurred by Contractor related to the Subscription Services or during the completion of the Services except as authorized in the applicable Statement Work and Exhibit L. Any such authorized travel expenses must comply with the Oregon Travel Policy, https://www.oregon.gov/das/financial/acctng/pages/travel.aspx, including as updated.

6.5. Invoices. Agency will pay Contractor not more than once each month upon Contractor’s submission of a detailed invoice that sets forth the Subscription Services Fee and the fixed prices due for other Services performed and Deliverables accepted by Agency.

The invoice must identify the Deliverables completed and accepted for which Contractor seeks compensation and itemize and explain all authorized expenses for which reimbursement is claimed. Contractor shall submit invoices to Agency’s Authorized Representative (or delegate). Agency will have the right to review each invoice based upon compliance with the requirements of this section and any other relevant provisions of this Contract and may dispute invoices that do not comply. All payments to Contractor are subject to ORS 293.462.

6.6. Limit on Payments. Contractor shall not submit invoices for, and Agency will not pay, any amount in excess of the Maximum Not-To-Exceed Compensation. If this maximum amount is increased by amendment, the amendment must be fully effective before Contractor performs additional Services or other Services or delivers goods subject to the amendment. No payment will be made for any Services performed or goods delivered before the Effective Date or after termination of this Contract.

https://www.oregon.gov/das/financial/acctng/pages/travel.aspx

Information Technology Services Contract Page 9 of 62

6.7. Funds Available and Authorized. Contractor will not be compensated for Subscription Services or Services performed under this Contract by any other agency or department of the State of Oregon. Agency believes it has sufficient funds currently available and authorized for expenditure to finance the costs of this Contract within Agency’s biennial appropriation or limitation. Contractor understands and agrees that Agency’s payments under this Contract are contingent upon Agency receiving appropriations, limitations, or other expenditure authority sufficient to allow Agency, in the exercise of its reasonable administrative discretion, to continue to make payments under this Contract.

7. AMENDMENTS. This Contract may be amended, modified, or supplemented only by a written amendment signed by State and Contractor, provided the amendment of the Subscription Services, goods or Services is directly related to the scope of goods and services described in this Contract. No amendment will be effective until all requisite signatures and approvals are obtained. DAS PS, Agency or Contractor may request a change to this Contract, including to any of its exhibits, by submitting a written proposal describing the desired change to the other party(ies).

7.1. Change Control Process. Subject to the conditions above, Agency and Contractor may amend, modify, or supplement the Statement of Work (Exhibit A), the Service Level Agreements (Exhibit B) or the Requirements (Exhibit I) and related costs through an agreed upon change control process. Either Agency or Contractor may request a change by submitting a written proposal to the other party. Agency’s and Contractor’s Authorized Representatives will review the written change request and accept, reject, or revise the request. Upon approval, Agency and Contractor will sign a written “Change Order” that includes: (i) the effective date of the change; (ii) identification of the provision of the Statement of Work, Service Level Agreement, or Requirement to be changed; (iii) a detailed description of the change; (iv) the changes to the Project Schedule, if any; and (v) the increase/decrease of related costs.

7.2. Payments. Subject to the foregoing provisions of this Section 7 and performance of the Services, Agency will pay for Services performed pursuant to a Change Order according to the acceptance and payment procedures set forth in this Contract.

8. OWNERSHIP AND LICENSES.

8.1. Agency Data and Agency Intellectual Property. Agency owns all Agency Data and all Agency Intellectual Property, including Agency Data and Agency Intellectual Property that is Work Product or that is otherwise created by or resulting from the Services. Contractor hereby irrevocably assigns to Agency any and all of its rights, title, and interest in all Agency Data and Agency Intellectual Property, whether arising from copyright, patent, trademark, trade secret, or any other state or federal intellectual property law or doctrine. Upon Agency’s reasonable request, Contractor shall execute such further documents and instruments to fully vest such rights in Agency. Agency grants Contractor a right to use Agency Data and Agency Intellectual Property for the purposes of this Contract only.

Information Technology Services Contract Page 10 of 62

8.2. Contractor Intellectual Property. Contractor retains ownership of all Contractor Intellectual Property that Contractor delivers to Agency pursuant to the Subscription Services and the Services performed under this Contract. Contractor grants Agency a license to use, copy, display, distribute, and transmit Contractor Intellectual Property, including the Subscription Services, as set forth in this Contract and the provisions set forth in Exhibit F.

In the event that Work Product is Contractor Intellectual Property, a derivative work developed by Contractor based on Contractor Intellectual Property, or a compilation that includes Contractor Intellectual Property, and provided Agency has paid any applicable licensing fee, Contractor grants Agency a license to the Work Product during the term of this Contract to use, copy, display, distribute, and transmit Contractor Intellectual Property employed in the Work Product, and to authorize others to do the same on Agency’s behalf.

8.3. Work Product. Except as specified in Section 8.2, Agency owns all Work Product. Such Work Product is subject to the license in Section 8.1.

8.4. Third Party Intellectual Property. Unless otherwise specified in a Statement of Work that Agency, on its own, will acquire and obtain a license to Third Party Intellectual Property, Contractor shall secure on Agency’s behalf, in the name of Agency and subject to Agency’s approval, a license to Third Party Intellectual Property necessary for Agency to access and receive the benefit of the Subscription Services.

8.5. Open Source Elements. Any open source materials in the Subscription Services for which Agency may be subject to a license must be approved in advance and in writing by Agency. If Contractor desires to include any open source elements or materials that may subject Agency to an open source license, Contractor shall: (i) notify Agency in writing that Contractor intends to include materials or elements subject to open source licensing; (ii) identify the specific elements or materials that are subject to open source licensing; and (iii) provide each applicable license to Agency.

8.6. No Rights. Except as expressly set forth in this Contract, nothing in this Contract may be construed as granting to or conferring upon Contractor any right, title, or interest in any intellectual property that is now owned or subsequently owned by Agency. Except as expressly set forth in this Contract, nothing in this Contract may be construed as granting to or conferring upon Agency any right, title, or interest in any Contractor Intellectual Property that is now owned or subsequently owned by Contractor.

8.7. No Rights in Marks. Neither party grants the other the right to use its trademarks, trade names, service marks or other designations in any promotion or publication without prior written consent. Each party grants only the licenses and rights specified in this Contract.

9. CONFIDENTIALITY AND NON-DISCLOSURE.

9.1. Confidential Information. DAS PS, Agency and Contractor acknowledge that it and its employees or agents may, in the course of performing its responsibilities under this Contract, be exposed to or acquire information that is confidential to the other party or the other party’s clients. Any and all information of any form obtained by one party or its

Information Technology Services Contract Page 11 of 62 employees or agents in the performance of this Contract is confidential information of the other party (“Confidential Information”). The parties shall treat any reports or other documents or items (including software) which result from the use of the Confidential Information by the recipient of such information with respect to confidentiality in the same manner as the Confidential Information.

In the performance of the Contract, Contractor may have possession or access to documents, records or items that contain “Personal Information” of Agency or Agency clients, as that term is used in ORS 646A.602(11), including Social Security numbers.

Personal Information is a type of Confidential Information that is highly sensitive and subject to additional protection. Therefore, prior to the receipt of, and during the period in which Contractor has possession of or access to, any Personal Information, Contractor shall have in place, a formal written information security program that provides safeguards to protect Personal Information from loss, theft, and disclosure to unauthorized persons, as required by the Oregon Consumer Information Protection Act, ORS 646A.600-646A.628.

9.2. Non-Disclosure. The recipient of Confidential Information shall hold Confidential Information in strict confidence, using at least the same degree of care that it uses in maintaining the confidentiality of its own Confidential Information, and not to copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give or disclose Confidential Information to third parties or use Confidential Information for any purposes whatsoever other than as contemplated by this Contract or reasonably related thereto, and to advise each of its employees and contractors of their obligations to keep Confidential Information confidential. The parties shall use commercially reasonable efforts to assist the other in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limitation of the foregoing, each party shall advise the others promptly in the event it learns or has reason to believe that any person who has had access to State’s Confidential Information has violated or intends to violate the terms of this Contract and each party will at its expense reasonably cooperate with the other in seeking injunctive or other equitable relief in the name of the other against any such person.

In addition to and without limiting the generality of the above provisions, Contractor shall not breach or permit breach of the security of any Personal Information that is contained in any document, record, compilation of information or other item to which Contractor receives access, possession, custody or control under this Contract. Contractor shall not disclose, or otherwise permit access of any nature, to any unauthorized person, of any such Personal Information. Contractor shall not use, distribute, or dispose of any Personal Information other than expressly permitted by Agency, required by applicable law, or required by an order of a tribunal having competent jurisdiction.

9.3. Exceptions. The following Confidential Information is not subject to the obligations of non-disclosure: information that (i) is or becomes (other than by disclosure by the party acquiring such information) publicly known or is contained in a publicly available document;

(ii) is furnished by the party disclosing such information to others without restrictions similar to those imposed by this Contract; (iii) is rightfully in the receiving party’s possession

Information Technology Services Contract Page 12 of 62 without the obligation of nondisclosure prior to the time of its disclosure under this Contract; (iv) is obtained from a source other than the discloser without the obligation of confidentiality, (v) is disclosed with the written consent of the disclosing party, or; (vi) is independently developed by employees or agents of the receiving party who can be shown to have had no access to the Confidential Information.

In addition, Agency may disclose Contractor Confidential Information to Agency’s third-party Quality Assurance contractor, and to State and federal oversight authorities to make required reports, to comply with requests for information, or to comply with an audit.

9.4. Confidentiality Policies. Upon Agency’s request, Contractor shall, provide its policies and procedures for safeguarding Confidential Information to Agency for Agency’s review and consent. Such policies must address information conveyed in oral, written, and electronic format and include procedures for how Contractor will respond when a violation or possible violation occurs.

9.5. Non-disclosure Agreements. Upon Agency’s request, Contractor shall obtain nondisclosure agreements from Contractor’s employees and agents who are performing Services and providing copies of such agreements to Agency.

9.6. Security and Hosting. Contractor shall at all times comply with Agency’s access and security policies and procedures as set forth in Exhibit J while on site at State facilities or while accessing State systems.

9.7. Public Records Law and Custody and Maintenance of Records. DAS PS’ and Agency’s obligations under this Section 9 are subject to the Oregon Public Records laws, found at ORS

192.311 through ORS 192.478 and the provisions for the custody and maintenance of public records, ORS 192.005 through 192.170.

9.8. Response to Public Records Requests for Confidential Information. Agency, as an executive department agency of State, must respond to requests for Agency Data and other public records under Oregon’s Public Records laws within set timeframes. Contractor shall support the ability of DAS PS or Agency to respond to public records requests for Agency Data in accordance with applicable law.

If Agency receives a request under the Oregon Public Records Law for the disclosure of Contractor Confidential Information, Agency will notify Contractor within a reasonable period of time of the request. Contractor is exclusively responsible for defending Contractor’s position concerning the confidentiality of the requested information.

Notwithstanding the foregoing, while Agency is not required to actively assist Contractor in opposing disclosure of proprietary information, Agency will cooperate in good faith to the extent reasonably practicable with Contractor’s efforts to protect its proprietary information.

9.9. Injunction. Each party acknowledges that breach of this Section 9, including disclosure of any Confidential Information will give rise to irreparable injury which is inadequately compensable in damages. Accordingly, each party may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any

Information Technology Services Contract Page 13 of 62 other legal remedies that may be available. Each party acknowledges and agrees that the covenants contained herein are necessary for the protection of the legitimate business interests of the other and are reasonable in scope and content.

9.10. Publicity. Contractor agrees that it will not disclose the form, content or existence of this Contract or any Deliverable in any advertising, press releases or other materials distributed to prospective customers, or otherwise attempt to obtain publicity from its association with Agency or the State of Oregon, whether or not such disclosure, publicity or association implies an endorsement by Agency or the State of Oregon of Contractor’s services, without the prior written consent of DAS PS or Agency.

9.11. Return of Confidential Information. Upon termination of this Contract each party will turn over to the other all documents, papers and other matter in its possession which embody Confidential Information.

10. CONTRACTOR’S REPRESENTATIONS AND WARRANTIES.

10.1. Contractor’s General Representations and Warranties. Contractor represents and warrants to DAS PS and Agency that:

10.1.1. Contractor has the power and authority to enter into and perform this Contract.

10.1.2. This Contract, when executed and delivered, will be a valid and binding obligation of Contractor enforceable according to its terms.

10.1.3. Contractor will, at all times during the term of this Contract, be qualified to do business in the State of Oregon, professionally competent and duly licensed to perform the Services.

10.1.4. Contractor is not in violation of, charged with nor, to the best of Contractor’s knowledge, under any investigation with respect to violation of, any provision of any federal, state or local law, ordinance or regulation or any other requirement or order of any governmental or regulatory body or court or arbitrator applicable to provision of the Services, and Contractor’s provision of the Subscription Services or other Services will not violate any such law, ordinance, regulation or order.

10.1.5. Contractor has no undisclosed liquidated and delinquent debt owed to State or any agency, board, commission, department or division of the State.

10.2. Contractor’s Performance Warranties. Contractor represents and warrants to DAS PS and Agency that:

10.2.1. Contractor has the skill and knowledge possessed by well-informed members of its trade or profession and Contractor will apply that skill and knowledge with care and diligence so Contractor and Contractor’s employees and any authorized subcontractors perform the Services described in this Contract in accordance with the highest standards prevalent in the industry or business most closely involved in providing the Services that Contractor is providing to Agency pursuant to this Contract.

Information Technology Services Contract Page 14 of 62

10.2.2. Commencing at Go-Live the Services will materially conform to their acceptance criteria and any Documentation provided by Contractor and are free from error or Defect that materially impairs their use, and be free from material defects in materials, workmanship, or design.

10.2.3. Except as otherwise provided in this Contract, Contractor shall transfer all Deliverables to Agency free and clear of any and all restrictions on or conditions of transfer, modification, licensing, sublicensing, direct or indirect distribution, or assignment, and free and clear of any and all liens, claims, mortgages, security interests, liabilities, and encumbrances of any kind.

10.2.4. Except as otherwise set forth in this Contract, any subcontractors performing work for Contractor under this Contract have assigned all of their rights in the Deliverables to Contractor or Agency and no third party has any right, title or interest in any Deliverables supplied to Agency under this Contract.

10.2.5. Contractor will maintain, operate, and enforce, prior to the receipt of, and during the period in which Contractor has possession of or access to, any Personal Information, an active and effective information security program that at minimum complies with the requirements of the Oregon Consumer Information Protection Act (ORS 646A.600 et. seq.) to preserve the security and confidentiality of all Personal Information that is contained in any document, record, compilation of information or other item to which Contractor receives access, possession, custody, or control.

10.2.6. The Subscription Services are free of what are commonly defined as viruses, backdoors, worms, spyware, malware, and other malicious code that hampers performance of the software, unlawfully collects information on users, or prevent the software from performing as required under the terms and conditions of this Contract.

Notwithstanding the foregoing, this representation and warranty does not include a disabling device that limits, suspends, or ends use of the Subscription Services expressly permitted by the terms and conditions by the license under which it was provided.

10.3. Warranties exclusive; disclaimers. The warranties set forth in this Contract are exclusive and in lieu of all other warranties, whether express or implied, and Contractor expressly disclaims all other warranties, including any implied warranties of merchantability, or fitness for a particular purpose. Contractor does not warrant that Agency’s use of the Subscription Services will be uninterrupted or error free.

10.4. The warranties stated above will not apply to the extent that there has been misuse (including, but not limited to, any use of the Subscription Services capacity or capability, other than that authorized by Contractor in writing), accident, modification, unsuitable physical or operating environment, operation in other than the specified operating environment, improper maintenance by Agency or a third party, or failure or damage caused by a product or a third party for which Contractor is not responsible.

11. INDEMNIFICATION, RESPONSIBILITY, AND INSURANCE.

Information Technology Services Contract Page 15 of 62

11.1. General Indemnity. Contractor shall defend (subject to the provisions of ORS 180), save, hold harmless, and indemnify the State of Oregon, DAS PS, Agency, and their officers, employees and agents from and against all third party claims, suits, actions, losses, damages, liabilities, statutory penalties, costs and expenses of any nature whatsoever, including personal injury, death, damage to real property and damage to tangible or intangible personal property resulting from, arising out of, or relating to the intentional, reckless or negligent acts or omissions of Contractor or its officers, employees, subcontractors, or agents under this Contract, including: (i) any claim that Contractor, a subcontractor, or Contractor’s staff or a subcontractor’s staff are employees of State or Agency for any reason, and (ii) any claim against State, DAS PS, or Agency, which, if true, would constitute a breach by Contractor of any of the representations, warranties, or covenants set forth in this Contract. Without limiting the generality of the foregoing, Contractor will have no obligation to indemnify DAS PS, Agency or the State of Oregon from and against any claims, suits, actions, losses, damages, liabilities, costs, and expenses attributable solely to the acts or omissions of DAS PS, Agency or the State of Oregon, and their officers, employees or agents.

11.2. IP Indemnity. In addition to and without limiting the generality of Section 11.1, Contractor expressly agrees to indemnify, defend and hold the State of Oregon and its agencies, subdivisions, officers, directors, employees and agents harmless from any and all third party claims, suits, actions, losses, damages, liabilities, statutory penalties, costs and expenses of any nature whatsoever resulting from, arising out of or relating to any claims that the Deliverables, Services, or use thereof infringe or violate any patent, copyright, trade secret, trademark, trade dress, mask work, utility design, or other proprietary right (collectively, “Intellectual Property Rights”) of any third party. If Contractor believes at any time that one or more Deliverables or the Services infringe a third party’s Intellectual Property Rights, Contractor may upon receipt of Agency’s prior written consent, which Agency will not unreasonably withhold, (i) replace an infringing item with a non-infringing item that meets or exceeds the performance and functionality of the replaced item; or (ii) obtain for Agency the right to continue to use the infringing item; or (iii) modify the infringing item to be non-infringing, provided that, following any replacement or modification made pursuant to the foregoing, the Deliverable(s) and Services continue to function in material conformance with their specifications and meet their acceptance criteria. Contractor’s failure or inability to accomplish any of the foregoing will be deemed a material breach of this Contract, and State may pursue any rights and remedies available to it under this Contract, including termination. Contractor will not be liable under this Section

11.2 for any claim for infringement based solely on the following:

11.2.1. Agency’s modification of the Deliverables or the Services other than as contemplated by this Contract, a Deliverable, the Requirements or Services specifications, or as otherwise authorized by Contractor in writing;

11.2.2. Use of the Deliverables or the Services in a manner other than as contemplated in this Contract, a Deliverable, Requirements or Services specifications, or as otherwise authorized by Contractor in writing; or

Information Technology Services Contract Page 16 of 62

11.2.3. Use of the Deliverables or the Services in combination, operation, or use of with other products other than as contemplated by this Contract, a Deliverable, the Requirements or Services specifications, or as otherwise authorized by Contractor in writing.

11.3. Damages to State Property and Employees. Contractor shall be liable for all claims, suits, actions, losses, damages, liabilities, costs, and expenses for personal injury, including death, damage to real property and damage to tangible or intangible personal property of State or any of its employees resulting from, arising out of, or relating to the intentional, reckless, or negligent acts or omissions of Contractor or its officers, employees, subcontractors, or agents under this Contract

11.4. Data and Network Services . Except to the extent that a claim or loss results from the negligent, reckless, or intentional acts or omissions of Agency, Contractor shall assume liability for all claims or losses related to Agency Data loss or breach of security caused directly or indirectly by or resulting from the Services or Services provided by Contractor.

11.5. Insurance. Contractor shall provide insurance as required by Exhibit C.

12. LIMITATION OF LIABILITY.

12.1. CONTRACTOR'S LIABILITY FOR DAMAGES RELATED TO CLAIMS FOR BREACH OF

CONTRACT ARE LIMITED TO ONE AND ONE HALF TIMES THE MAXIMUM NOT TO EXCEED

COMPENSATION UNDER THIS CONTRACT.

12.2. NEITHER DAS PS NOR AGENCY NOR CONTRACTOR WILL BE LIABLE TO THE OTHER

FOR ANY LOST PROFITS, LOST SAVINGS, OR PUNITIVE, INDIRECT, EXEMPLARY,

CONSEQUENTIAL, OR INCIDENTAL DAMAGES.

12.3. DAS PS’ OR AGENCY’S LIABILITY TO CONTRACTOR FOR ANY CLAIM IS SUBJECT TO THE

PROVISIONS OF ARTICLE XI, SECTION 7 OF THE OREGON CONSTITUTION AND THE OREGON

TORT CLAIMS ACT, ORS 30.260 THROUGH 30.300.

13. EVENTS OF DEFAULT.

13.1. Default by Contractor. Contractor will be in default under this Contract if:

13.1.1. Contractor institutes or has instituted against it insolvency, receivership or bankruptcy proceedings which are not dismissed within sixty (60) Calendar Days of their commencement, makes an assignment for the benefit of creditors, or ceases doing business on a regular basis; or

13.1.2. Contractor no longer holds a license or…