Attachment C - SaaS Terms.docx

Software-and-Services Software as a Service (SaaS) additional terms and conditions Data Ownership The Commonwealth of Massachusetts Office of the Child Advocate (“OCA”) will own all right, title and interest in its data. The Vendor shall not access OCA user accounts or data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the RFR, (4) as required by the express terms of an agreement between the OCA and Vendor placed under (a “Contract”), and subject to, the terms of the RFR (5) at OCA’s written request.

Vendor shall not collect, access, or use user-specific OCA Data except as strictly necessary to provide Service to the OCA. No information regarding OCA’s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of the RFR.

Data Protection Protection of personal privacy and data shall be an integral part of the business activities of the Vendor to ensure there is no inappropriate or unauthorized use of OCA information at any time. To this end, the Vendor shall safeguard the confidentiality, integrity and availability of OCA information and comply with the following conditions:

a. The Vendor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non-Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Vendor applies to its own Personal Data and Non-Public Data of similar kind.

b. All data obtained by the Vendor in the performance of the Contract shall become and remain the property of the OCA.

c. All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Vendor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the Contract.

d. Unless otherwise stipulated, the Vendor shall encrypt all Non-Public Data at rest and in transit. The OCA shall identify data it deems as Non-Public Data to the Vendor. The level of protection and encryption for all Non-Public Data shall be identified in the SLA.

e. At no time shall any data or processes — that either belong to or are intended for the use of the OCA or its officers, agents or employees — be copied, disclosed or retained by the Vendor or any party related to the Vendor for subsequent use in any transaction that does not include the OCA.

f. The Vendor shall not use any information collected in connection with the Services issued from a Contract for any purpose other than fulfilling the Services.

Data Location The Vendor shall provide its services to the OCA and its end users solely from data centers in the United States. Storage of OCA data at rest shall be located solely in data centers in the United States. The Vendor shall not allow its personnel or Vendors to store OCA data on portable devices, including personal computers, except for devices that are used and kept only at its United States data centers. The Vendor shall permit its personnel and Vendors to access OCA data remotely only as required to provide technical support. The Vendor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in an RFR Order.

Security Incident or Data Breach Notification Incident Response Vendor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the RFR Order. Discussing security incidents with the OCA should be handled on an urgent as- needed basis, as part of Vendor’s communication and mitigation processes as mutually agreed upon, defined by law or contained in RFR.

Security Incident and Data Breach Reporting Requirements If Vendor knows or has reason to know of a security incident or data breach that may affect the security of OCA data, Vendor shall notify OCA as soon as practicable from the date of the security incident or data breach, and in no event more than three (3) days and shall cooperated with the OCA to meet any requirements under applicable state or Federal law.

In the event of a security incident or data breach, Vendor will take commercially reasonable steps to mitigate the effects, to resolve the security incident or data breach in a timely manner, and to put measures in place to prevent the reoccurrence of similar security incidents or breaches in the future.

Security Incident and Data Breach Notices If requested by the OCA, or if required by applicable Federal or State law (including without limitation M.G.L. c. 93H), Vendor will provide notice as soon as practicable to those individuals who data was affected or may have been affected by a security incident or data breach. If the security incident or data breach is due to the negligence of the Vendor, Vendor shall provide all requested and/or required notices at its sole expense.

Personal Data Breach Responsibilities This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Vendor.

a. The Vendor, unless stipulated otherwise, shall immediately notify the appropriate OCA identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident.

b. The Vendor, unless stipulated otherwise, shall promptly notify the appropriate OCA identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law or the RFR Order, if it has confirmed that there is, or reasonably believes that there has been a Data Breach. The Vendor shall (1) cooperate with OCA as reasonably requested by OCA to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

c. Unless otherwise stipulated, if a data breach is a direct result of Vendor’s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by OCA, the Vendor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Vendor based on root cause.

Notification of Legal Requests The Vendor shall contact the OCA upon receipt of any electronic discovery, litigation holds, discovery searches, public records requests, and expert testimonies related to OCA’s data under RFR, or which in any way might reasonably require access to the data of the OCA. The Vendor shall not respond to subpoenas, service of process and other legal requests related to the OCA without first notifying and obtaining the approval of the OCA, unless prohibited by law from providing such notice.

Termination and Suspension of Service

a. In the event of a termination of RFR or applicable RFR Order, the Vendor shall implement an orderly return of Eligible entity’s data in a CSV or another mutually agreeable format at a time agreed to by the parties or allow EOE to extract it’s data and the subsequent secure disposal of Eligible Entity’s data.

b. During any period of service suspension, the Vendor shall not take any action to intentionally erase or otherwise dispose of any of the OCA’s data.

c. In the event of termination of any services under a Contract in its entirety, the Vendor shall not erase OCA’s data for a period of ninety (90) days after the effective date of termination, unless otherwise agreed to by the OCA in writing. Vendor shall impose no fees for access and retrieval of OCA data during this ninety (90) day period. After such period, the Vendor shall have no obligation to maintain or provide any Eligible entity’s data and shall thereafter, unless legally prohibited, delete all Eligible Entity’s data in its systems or otherwise in its possession or under its control.

d. The OCA shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an SLA.

e. Upon termination of the Services or RFR in its entirety, Vendor shall securely dispose of all Eligible Entity’s data in all of its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by OCA. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the OCA.

Background Checks The Vendor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of RFR who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Vendor shall promote and maintain an awareness of the importance of securing the OCA’s information among the Vendor’s employees and agents. If any of the stated personnel providing services under a Contract is not acceptable to the OCA in its sole opinion as a result of the background or criminal history investigation, OCA, in its’ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Contract and any related service agreement.

Access to Security Logs and Reports The Vendor shall provide reports on a schedule specified in the Contract to the OCA in a format as specified in the Contract agreed to by both the Vendor and the OCA. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this RFR and applicable RFR Order.

Contract Audit The Vendor shall allow the OCA to audit conformance to the RFR terms. OCA may perform this audit or contract with a third party at its discretion and at OCA’s expense.

Data Center Audit The Vendor shall perform an independent audit of its data centers at least annually at its expense and provide an unredacted version of the audit report upon request to the OCA. The Vendor may remove its proprietary information from the unredacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit.

Change Control and Advance Notice The Vendor shall give a minimum forty-eight (48) hour advance notice (or as determined by the OCA and included in the RFR Order) to OCA of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number.

Vendor will make updates and upgrades available to OCA at no additional costs when Vendor makes such updates and upgrades generally available to its users.

No update, upgrade or other charge to the Service may decrease the Service’s functionality, adversely affect the OCA’s use of or access to the Service or increase the cost of the Service to the OCA.

Vendor will notify OCA at least sixty (60) days in advance prior to any major update or upgrade.

Security As requested by an Eligible Entity, the Vendor shall disclose its non-proprietary system security plans (SSP) or security processes and technical limitations to OCA such that adequate protection and flexibility can be attained between OCA and the Vendor. For example: virus checking and port sniffing — OCA and the Vendor shall understand each other’s roles and responsibilities.

Non-disclosure and Separation of Duties The Vendor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of OCA data to that which is absolutely necessary to perform job duties.

Import and Export of Data OCA shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Vendor at any time during the term of Vendor’s contract with OCA. This includes the ability for OCA to import or export data to/from other Vendors. Vendor shall specify if OCA is required to provide its’ own tools for this purpose, including the optional purchase of Vendors tools if Vendors applications are not able to provide this functionality directly.

Responsibilities and Uptime Guarantee The Vendor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Vendor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime) and provide service to customers as defined in the SLA. Unless specifically agreed to in writing by the Vendor and the OCA, Vendor must provide a SLA that contains the following: (1) a specified guaranteed uptime percentage of at least 95.0%, (2) Vendor’s commitment to provide at least five days’ advance notice of scheduled downtime, (3) notification of unscheduled downtime no later than twenty-four hours after its occurrence, (4) response and resolution times for defects based on industry standards, (5) applicable performance metrics (e.g. latency, transaction time), based on industry standards, (6) remedies for failure to meet the guaranteed uptime percentage and response and resolution times, which will be issued by Vendor with no action required from Eligible Entity, and (7) remedies for repeated consistent failures to meet SLA metrics. Vendor will provide to the OCA credit amounts or refunds in connection with downtime. In the event that OCA’s access to the SaaS falls below an agreed-upon percentage in any given month during the applicable term, in addition to other rights and remedies provided in RFR, OCA may terminate the applicable Contract with no further liability to Vendor and Vendor will provide a pro-rated refund of prepaid fees to OCA.

SubVendor Disclosure Vendor shall identify all of its strategic business partners related to services provided under RFR, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the Vendor, and who shall be involved in any application development and/or operations.

Right to Remove Individuals OCA shall have the right at any time to require that the Vendor remove from interaction with OCA any Vendor representative who OCA believes is detrimental to its working relationship with the Vendor. OCA shall provide the Vendor with notice of its determination, and the reasons it requests the removal. If OCA signifies that a potential security violation exists with respect to the request, the Vendor shall immediately remove such individual. The Vendor shall not assign the person to any aspect of RFR or future work orders without OCA’s consent.

Business Continuity and Disaster Recovery The Vendor shall provide a Disaster Recovery Plan and ensure that OCA’s recovery time objective (“RTO”) of twenty-four hours is met. Vendor and OCA may agree in writing to a different RTO. In the event of a SaaS failure, Vendor must ensure that OCA’s recover point objective (“RPO”) of twenty-four hours is met. Vendor and OCA may agree in writing to a different RPO.

Vendor should perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed by Vendor and Eligible Entity. If Eligible Entity, in its sole discretion, designated the SaaS as mission-critical: (1) Vendor shall review and test the Disaster Recovery plan regularly, at minimum annually, and (2) Vendor shall back up OCA data no less than once daily.

Compliance with Accessibility Standards The Vendor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the OCA. Vendor must comply with Eligible Entity’s established standards for accessibility. Eligible Entities within the Commonwealth of Massachusetts Executive Department are subject to the Enterprise IT Accessibility Standards available via https://www.mass.gov/guides/enterprise-it-accessibility-standards#-contact,-terms-and-document-history- (or a successor link thereto). Additional accessibility terms may be provided by Eligible Entities.

In addition, see Attachment D – Accessibility Requirements

Web Services The Vendor shall use Web services exclusively to interface with OCA’s data in near real time.

Encryption of Data at Rest The Vendor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data, unless OCA approves in writing for the storage of Personal Data on a Vendor portable device in order to accomplish work as defined in the RFR Order.

Subscription Terms Vendor grants to OCA a license to: (i) access and use the Service for its business purposes; (ii) for SaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Vendor’s documentation.

No Vendor terms, including standard click through license or website terms or use of privacy policy, shall apply to OCA unless such terms are included in RFR.

02/28/2020 Exhibit 1: SaaS Additional Terms and Conditions 1