Attachment E Software Services License Requirements Agreement.docx

PA Supplier ID Number:

AGENCY INFORMATION TECHNOLOGY PRODUCTS AND SERVICES AGREEMENT

This agency information technology products and services agreement is between the Commonwealth of Pennsylvania, acting through Pennsylvania Department of Transportation, with its principal offices located at 400 North Street, Harrisburg, Pennsylvania 17120 and __________________, with its principal offices located at __________________.

The parties are entering into this agreement to outline their respective obligations and rights concerning the Commonwealth’s access to and use of the information technology products and services identified in Exhibit 1 of this agreement.

The parties, intending to be legally bound, agree as follows:

1. Definitions.

“AI” means artificial intelligence.

“Commonwealth” means the Commonwealth of Pennsylvania, acting through ________________.

“Commonwealth Confidential Information” means information, regardless of form, and whether tangible or intangible, to which Licensor is given access, or that the Commonwealth makes available to the Licensor, whether directly or through a third-party. This information includes, without limitation, all technology, know-how, processes, software, databases, Trade Secrets (as defined by the Pennsylvania Uniform Trade Secret Act, 12 Pa. C.S. §§ 5301 - 5308), proprietary information, product and business requirements, and information about or from the Commonwealth’s vendors or employees whether received before or after the Effective Date of this agreement. This term also includes, without limitation, information and documentation that is not permitted to be disclosed to third parties under local, Commonwealth, or federal laws and regulations, pursuant to any policy adopted by the Commonwealth, or pursuant to the terms of any third-party agreement where the Commonwealth is a party.

“Commonwealth Data” means any of the following or a combination of the following: i) any data to which the Commonwealth provides or gives access to Licensor; ii) any data collected or processed by Licensor on behalf of the Commonwealth; iii) any data that is the intellectual property of the Commonwealth; or iv) any data so designated by the Commonwealth.

“Computer Security Incident” means an occurrence that: i) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; ii) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or any security requirements set forth in this agreement; or iii) disrupts or threatens to disrupt the normal operation of information systems. This includes, but is not limited to, any Data Security Incident.

“Confidential Information” means Commonwealth Confidential Information and Licensor Confidential Information.

“CONUS” means the continental United States and Hawaii.

“Data Security Incident” means unauthorized access, acquisition, use, release, loss, destruction, or disclosure of data or Confidential Information. This includes, but is not limited to, any “Breach of the security of the system,” as that term is defined by the Breach of Personal Information Notification Act, 73 P.S. §§ 2301 - 2330.

“Digital Content and Services” means the delivery of information and services to end users via data, voice, or video technologies that includes, but is not limited to:

(i) Electronic content: websites and web-based materials (e.g., internet & intranet), Microsoft Office (e.g., Word, Excel, PowerPoint), Adobe InDesign and portable document format (PDF) documents, training materials (e.g., online training materials, tests, online surveys), multimedia (e.g., video, audio, MP4), social media, blogs, digital materials (e.g., documents, templates, forms, reports, surveys), graphics, GIFs, Computer Aided Design and Drafting (CADD) files, email, maps and infographics, electronic emergency notifications, and subscription services (e.g., news feeds, alert services, professional journals);

(ii) Software: web, desktop, server, and mobile client applications, authoring tools, associated infrastructure, and service offerings (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS);

(iii) Hardware: computers, laptops, servers, tablets, printers, copiers, scanners, peripheral equipment (e.g., keyboards, mice), kiosks, and mobile phones;

(iv) Support documentation and services: training, consulting, advisory services, help desk or call center, automated self-service and technical support, and product informational materials.

“Effective Date” means the date of the last Commonwealth signature.

“Hyperlink Content” means any material or information accessible by a clickable link or URL that allows a user to navigate to a different document or electronic resource.

“Infringement Claim” means any suit or proceeding that may be brought by a third-party against the Commonwealth, its departments, officers, or employees for the alleged infringement of any United States patents, copyrights, trademarks or trade dress, or for a misappropriation of any United States patents, copyrights, trademarks or trade dress, or for a misappropriation of a trade secret arising out of performance of this agreement, including all Licensed Products provided by Licensor.

“Licensed Product” means the products listed in Exhibit 1, any future versions of those products, and any maintenance, support, and services for the products identified in Exhibit 1.

“Licensor” means ______________.

“Licensor Confidential Information” means all information marked as or identified in writing by Licensor as confidential or proprietary to Licensor or its subcontractors.

“Malware” means software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of a Commonwealth information system, which includes Viruses, Worms, Trojan Horses, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code.

“OAG” means the Pennsylvania Office of Attorney General.

“Representatives” means a party’s officers, agents, subcontractors, and personnel.

“Reseller Contract” means a statewide contract between the Commonwealth, acting through the Department of General Services, and an authorized distributor through which the Licensed Products and related services are procured by Commonwealth agencies.

“RTKL” means the Pennsylvania Right-to-Know Law, 65 P.S. §§ 67.101 - 3104.

“Sensitive Information” means the following Commonwealth Confidential Information, regardless of whether marked or identified by the Commonwealth as confidential:

(i) Information related to the design or implementation of the Commonwealth’s technology and security infrastructure and architecture, including, but not limited to, Protected Critical Infrastructure Information (PCII) under the Cybersecurity Information Sharing Act (CISA) of 2015;

(ii) Information identified as Sensitive Security Information, Protected Information or Privileged Information by the Commonwealth;

(iii) Passwords, encryption keys, and other cyber security control design information;

(iv) Consumer and citizen information;

(v) Employee information;

(vi) Information that is either nonpublic personal information or personally identifiable information, including, without limitation, names, addresses, telephone numbers, fax numbers, electronic mail addresses, web universal resource locators (URLs), Internet Protocol (IP) addresses, vehicle identifiers, account numbers, birthdates, social security numbers, individual likeness or images, fingerprint or biometric data, genetic information, demographic, information contained in, relating to or deriving from medical or personal health records, criminal justice information and records, information relating to drivers licenses or other identification cards, financial and transactional information, tax information and any other information that is deemed to be nonpublic or protected under federal and state law, regulation, order or standard including, but not limited to, the Criminal History Record Information Act, the Family Education Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), Confidentiality of HIV-Related Information Act, the Omnibus Reconciliation Act of 1990, Real ID Act of 2005, Tax Reform Act of 1976 the Internal Revenue Code and IRS Publication 1075, the Affordable Care Act, federal and state notification laws, The Driver’s Privacy Protection Act of 1994, Title V of the Gramm-Leach-Bliley Act, Section 628 of the Fair Credit Reporting Act, Section 216 of the Fair and Accurate Credit Transactions Act, the Children's Online Privacy Protection Act, and any implementing regulations, guidelines, and Commonwealth policies adopted under any of these or other related laws; and

(vii) Payment Card Industry Information (PCI).

“Trojan Horse” means a computer program that appears to have a useful function but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program.

“Virus” means a computer program that can copy itself and infect a computer without permission or knowledge of the user. A virus might corrupt or delete data on a computer, use e-mail programs to spread itself to other computers, or even erase everything on a hard disk.

“WCAG” means Web Content Accessibility Guidelines.

“Worm” means a self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself.

2. Procurement Method and Use of Licensed Products.

(a) Procurement Method. Purchase and payment for Licensed Products will be made through a Reseller Contract or another procurement document that will govern any payment terms and provisions including, but not limited to, payment amounts. The Commonwealth shall not be responsible for any fees, costs, or taxes that are not specifically identified in the applicable Reseller Contract or procurement document. The terms and conditions of this agreement will apply to the Commonwealth’s use of Licensed Products, without need for further writing.

(b) Use of Licensed Products. Licensor shall provide Licensed Products identified on a purchase order issued by the Commonwealth through a Reseller Contract or another procurement document, subject, if applicable, to any limitations set forth in this agreement or its exhibits.

3. Adding Licensed Products.

(a) Process for Adding Licensed Products. Licensor may initiate an update of the list of Licensed Products by providing a proposed revised Exhibit 1 to the Commonwealth. If the Commonwealth approves, in its sole discretion, the revised exhibit, the Commonwealth shall provide its written consent to Licensor and provide an updated list of Licensed Products to the Commonwealth’s resellers.

(b) Amendment Required for Additional Terms and Conditions. No amendment is required to add a new product to Exhibit 1. If Licensor desires to add a new product to Exhibit 1 that requires additional licensing terms or other requirements, either an amendment to this agreement or a new agreement is required.

4. Order of Precedence. The terms and conditions of this agreement supersede and take precedence over any terms and conditions in Licensor’s [insert the name of Licensor’s standard end user license or software license agreement], which is attached as Exhibit 2. The terms of this agreement also supersede and take precedence over: any terms included in any quote, purchase order, terms of any shrink-wrap agreement included with the Licensed Products; terms of any click through agreement included with the Licensed Products; or any other terms purported to apply to the Licensed Products. In the event of any inconsistencies between the terms of this agreement and any exhibits or other terms, the terms of this agreement shall prevail. In addition to the provisions in Sections 16 and 36, any conflicting or inconsistent term or condition is unenforceable against the Commonwealth, and any such term or condition is deemed to be stricken from the Licensor’s end user license agreement, terms of service, or similar legal instrument or agreement.

5. Term. The term of this agreement will commence on the Effective Date and will remain in effect until terminated in accordance with section 26.

6. Representations, Warranty and Remedies.

(a) Representations and Warranty. The Licensor represents and warrants that:

(v) The Licensed Products are not subject to any third-party encumbrances, royalties, restrictions, or requirements; and

(vi) The use of the Licensed Products in accordance with this agreement will not violate the intellectual property rights, other proprietary or privacy rights, or contractual, regulatory, or statutory rights of any third-party, and will not violate any law or regulation or other governmental, administrative or legal requirement, and Licensor has and will continue to have all licenses, permissions, approvals, documentation, agreements, and certifications required to provide such materials and services to the Commonwealth and users of Licensed Products in accordance with this Agreement.

(b) Remedies for Breach of Warranty.

(i) If there is a breach of a warranty provided under subsection 6(a), the Licensor shall, at the discretion of the Commonwealth:

(1) replace or substitute functional equivalents, if accepted by the Commonwealth, for the Licensed Product;

(2) modify the Licensed Product so that the Licensed Product is no longer in breach;

(3) re-perform the services in a non-breaching manner; or

(4) obtain the rights necessary for Licensor to continue performance under this agreement or obtain the rights for the Commonwealth to continue the use of the Licensed Product.

(ii) If the use of any Licensed Product is enjoined or Licensor is unable to provide any remedy set forth in subsection 6(b)(i), Licensor shall, upon return of the Licensed Product, refund to the Commonwealth:

(1) the fee paid for the Licensed Product, less the amount for the period of usage of the Licensed Product; and

(2) the pro-rated portion of any maintenance fees representing the time remaining in any period of services for which payment was made.

(c) Liability for Damages. Licensor shall be liable to the Commonwealth for any damages, costs, fines, and remedial measures incurred by the Commonwealth caused by any breach of the warranties and representations.

(d) Warranty Exceptions. Notwithstanding the above, Licensor shall have no obligation under this section to the extent an Infringement Claim arises from:

(i) the Commonwealth, or a third-party acting under the direction of the Commonwealth, modifying any Licensed Products provided by Licensor;

(ii) any material provided by the Commonwealth to Licensor being incorporated into, or used to prepare any Licensed Products;

(iii) the Commonwealth using any Licensed Product after Licensor has recommended discontinuation because of possible or actual infringement and has provided one of the remedies under subsection (b);

(iv) the Commonwealth using any Licensed Product in other than the specified operating environment;

(v) the Commonwealth combining, operating, or using the Licensed Products with other products, services, or deliverables not provided by Licensor as a system; or the Commonwealth combining, operating, or using the Licensed Products, service, or deliverable, with any products, data, or apparatus that Licensor did not provide or authorize;

(vi) infringement by a non-Licensed Product alone;

(vii) the Commonwealth using any Licensed Product beyond the scope contemplated by the agreement; or

(viii) the Commonwealth failing to use corrections or enhancements made available to the Commonwealth by Licensor at no charge.

7. Applicable Law and Forum. This agreement is governed by, and will be interpreted and enforced in accordance with, the laws of the Commonwealth of Pennsylvania (without regard to any conflict of laws provisions) and the decisions of the Pennsylvania courts. Licensor consents to the jurisdiction of any court of the Commonwealth of Pennsylvania and any federal courts in Pennsylvania and waives any claim or defense that a forum is not convenient or proper. Any Pennsylvania court or tribunal has in personam jurisdiction over Licensor, and Licensor consents to service of process in any manner authorized by Pennsylvania law. This provision may not be interpreted as a waiver or limitation of the Commonwealth’s rights or defenses.

8. Indemnification.

(a) General Indemnification. The Licensor shall indemnify the Commonwealth against all third-party claims, suits, demands, losses, damages, costs, and expenses, including without limitation, litigation expenses, attorneys' fees, and liabilities, arising out of or in connection with any activities performed by the Licensor or its employees and agents that are related to this agreement, as determined by the Commonwealth in its sole discretion.

(b) Patent, Copyright, Trademark and Trade Secret Indemnification. The Licensor shall, at its expense, indemnify the Commonwealth from any suit or proceeding which may be brought by a third-party against the Commonwealth, its departments, officers or employees for the alleged infringement of any United States patents, copyrights, trademarks or trade dress, or for a misappropriation of a United States trade secret arising out of performance of this Agreement, including all Licensed Products provided by the Licensor. The exceptions set forth in section 6(d) apply to Licensor’s indemnification obligation under this subsection.

(c) Commonwealth Attorneys Act. The Commonwealth shall provide Licensor with prompt notice of any claim or suit of which it learns. Pursuant to the Commonwealth Attorneys Act, 71 P.S. §§ 732-101 - 506, the OAG has the sole authority to represent the Commonwealth in actions brought against the Commonwealth. The OAG may, however, in its sole discretion and under any terms as it deems appropriate, delegate its right of defense. If the OAG delegates the defense to Licensor, the Commonwealth will cooperate with all reasonable requests of Licensor made in the defense of such suits.

(d) Settlement. Notwithstanding the above, neither party may enter into a settlement of any claim or suit without the other party's written consent, which will not be unreasonably withheld. The Commonwealth may, in its sole discretion, allow Licensor to control the defense and any related settlement negotiations.

9. Sovereign Immunity.

No provisions of this agreement will be construed to waive or limit the sovereign immunity of the Commonwealth of Pennsylvania or its governmental sub-units. See, PA CONST. Art. 1 § 11 and 42 Pa. C.S. §§ 8521 – 8258.

10. Superseding Terms.

To the extent any provision of this agreement, including any exhibit, whether drafted by the Commonwealth or Licensor, contains conflicting provisions, the following terms supersede and replace in their entirety those specific provisions, and those provisions are void and non-enforceable against the Commonwealth:

(a) No Terms Contrary to Law. Any provisions that are contrary to Pennsylvania law are void and non-enforceable against the Commonwealth.

(b) No Commonwealth Indemnification. The Commonwealth does not have the legal authority to, and shall not, indemnify any entity. See, PA CONST. Art. 1 § 11 and 42 Pa. C.S. §§ 8521 - 8258.

(c) No Attorneys’ Fees. The Commonwealth is not responsible for any attorneys’ fees incurred by Licensor or third parties.

(d) No Collections Fees. The Commonwealth is not responsible for any collections fees incurred by Licensor or third parties.

(e) No Arbitration. Any disputes or claims arising under this agreement, a purchase order, or any other procurement document must be filed in a court or tribunal with competent jurisdiction as provided for by applicable law. The Commonwealth does not consent to resolution of any dispute or claim through arbitration or any other binding dispute resolution process.

(f) Equitable Remedies. The parties may seek equitable remedies only to the extent permitted by applicable law. Neither party has a right to injunctive relief. All elements required for equitable relief, including irreparable harm, must be proven in a court of competent jurisdiction prior to any party being entitled to injunctive relief.

11. Limitation of Liability.

(a) Limitations of Liability. Except with respect to the remedies for breach of warranties and representations in section 6(b) and (c), Licensor’s liability to the Commonwealth under this agreement for any breach or failure of the Licensor to perform, observe, or comply with any material term, condition, or obligation under this agreement, will be limited to the greater of $500,000 or the total dollar amount of purchase orders issued for Licensed Products covered by this agreement during the 12-month period prior to the event giving rise to the damage claim. This limitation does not apply to damages:

(i) for bodily injury;

(ii) for death;

(iii) for gross negligence, willful misconduct, or unlawful misconduct;

(iv) to real property or tangible personal property for which Licensor is legally liable;

(v) resulting from a Computer Security Incident involving a system maintained or managed by Licensor, including the costs for notification, remediation, mitigation and credit monitoring services required due to a Data Security Incident;

(vi) resulting from a breach of confidentiality;

(vii) for which Licensor is responsible pursuant to any indemnification obligations it has under this agreement; or

(viii) for third-party claims, penalties or fines arising from Licensor’s breach of section 21, Accessibility.

(b) Exclusions from Liability. Except with respect to those damages enumerated in subsections 11(a)(i) through (viii), Licensor shall not be liable for consequential, indirect, or incidental damages unless otherwise specified in this agreement.

12. Background Checks.

(a) Licensor Obligation. Licensor shall, at its expense, complete the background checks required by Exhibit 3 and provide confirmation of compliance as outlined in Exhibit 3.

(b) Ongoing Obligation. If, at any time, it is discovered that an employee has a criminal record that includes a felony or misdemeanor involving terrorist threats, violence, use of a lethal weapon, breach of trust, or breach of fiduciary responsibility; or that raises concerns about building, system, or personal security, or is otherwise job-related, Licensor shall not assign that employee to any Commonwealth facilities, shall remove any access privileges already given to the employee, and shall not permit that employee remote access to Commonwealth facilities, systems or Commonwealth Confidential Information, unless the Commonwealth consents, in writing, prior to the access being provided. The Commonwealth may withhold its consent at its sole discretion. Failure of Licensor to comply with the terms of this subsection may result in the default of Licensor.

(c) Additional Background Checks. The Commonwealth may, to the extent required by federal or state law, regulation, or policy, require Licensor to conduct background checks over and above those described in this agreement.

13. Confidentiality.

(a) Confidential Information. The receiving party shall hold all Confidential Information of or relating to the disclosing party in confidence, to the same extent and in at least the same manner as the receiving party protects its own confidential or proprietary information, using no less than commercially reasonable standards or higher or more stringent standards required by law, including those laws governing Sensitive Information, and those standards specified in this agreement. The receiving party shall not disclose any Confidential Information of the disclosing party in any form to, or for the use or benefit of, any person or entity without the disclosing party’s consent. Subject to the other provisions of this agreement, the receiving party may disclose relevant aspects of the disclosing party’s Confidential Information to the receiving Representatives and to the Representatives of the receiving party’s corporate affiliates or subsidiaries to the extent that the disclosure is reasonably necessary for the performance of the receiving party’s duties and obligations under this agreement; however, the receiving party shall take all reasonable measures to ensure that Confidential Information of the disclosing party is not disclosed or duplicated in violation of the provisions of this agreement by the Representatives and that Licensor shall be responsible for any unauthorized disclosure of the Confidential Information by the Licensor’s Representatives. If the disclosure is by the Commonwealth to another contractor or sub-contractor, the disclosure must be subject to a suitable non-disclosure agreement imposing equally or more stringent requirements for data privacy and security. Except for Sensitive Information, which must be protected in all circumstances, and except to the extent provided otherwise by any applicable law, the obligations of this subsection (a) do not apply with respect to information that:

(i) is developed by the other party without violating the disclosing party’s proprietary rights, as evidenced by records or documentation of the receiving party;

(ii) is or becomes publicly known through no fault of the receiving party;

(iii) is disclosed by the owner of such information to a third-party free of any obligation of confidentiality;

(iv) is already known by the receiving party without an obligation of confidentiality other than pursuant to this agreement or any confidentiality contract entered into before the Effective Date; or

(v) is rightfully received by the receiving party free of any obligation of confidentiality.

(b) Obligations. Each party shall:

(i) notify the other party promptly of any known unauthorized disclosure of the other party’s Confidential Information by any person or entity;

(ii) promptly furnish to the other party full details known relating to the unauthorized disclosure of Confidential Information;

(iii) assist the other party in investigating or preventing the recurrence of any unauthorized disclosure of the other party’s Confidential Information;

(iv) cooperate with the other party in any litigation and investigation against third parties deemed necessary by the other party to protect its proprietary rights; and

(v) promptly use all reasonable efforts to prevent a recurrence of any such unauthorized disclosure of the other party’s Confidential Information.

(c) Cost of compliance; required disclosure. Each party shall bear the cost it incurs as a result of compliance with this section. The obligations in this section do not restrict any disclosure by either party pursuant to any applicable law or pursuant to the order of any court or other legal process or government agency of competent jurisdiction. Where permitted by law, the receiving party shall give prompt notice to the non-disclosing party of such disclosure or order in a timeframe to allow the disclosing party to resist the disclosure or order.

(d) Submitting Confidential Information to the Commonwealth.

(i) The Commonwealth will only protect Licensor Confidential Information in accordance with the RTKL if the procedures set forth in subsection (ii) are followed by Licensor. Under the RTKL, all Commonwealth records are presumed to be public records unless disclosure is barred by: (1) state or federal law or regulation; (2) judicial order; (3) privilege, i.e. attorney-client or doctor-patient; or (4) one of the exceptions in Section 708 of the RTKL, 65 P.S. § 67.708.

(ii) Licensor shall use the following process when submitting information to the Commonwealth that it believes to be confidential or proprietary information or trade secrets:

(a) prepare an un-redacted version of the appropriate document;

(b) prepare a redacted version of the document that redacts the information that is asserted to be confidential or proprietary information or a trade secret;

(c) prepare a signed written statement that states:

1) the attached document contains confidential or proprietary information or trade secrets;

2) Licensor is submitting the document in both redacted and un-redacted format in accordance with Section 707(b) of the RTKL, 65 P.S. § 67.707(b);

3) Licensor is requesting that the document be considered exempt under Section 708(b)(11) of the RTKL, 65 P.S. § 67.708(b)(11), from public records requests; and

4) submit the two documents with the signed written statement to the Commonwealth.

(e) Confidential Information at termination. Upon expiration or termination of this agreement, or a purchase order or other procurement document for Licensed Products governed by the terms of this agreement, and at any other time at the written request of a party, the receiving party shall promptly return to the disclosing party all of the disclosing party’s Confidential Information and data (and all copies of this information) that is in the receiving party’s possession or control, regardless of form. Where Licensor is the receiving party, this will include any Commonwealth Data.

(f) Not confidential. This agreement, any pricing information related to this agreement, and purchase orders issued pursuant to this agreement, will not be deemed confidential.

14. Sensitive Information.

(a) Confidentiality. Licensor's level of access may allow or require Licensor to view or access Sensitive Information or Confidential Information. Licensor shall hold all Sensitive Information in the strictest of confidence and shall use all protective measures to protect the Sensitive Information as prescribed by law, regulation, or Commonwealth policies and standards.

(b) Access. Licensor shall not permit anyone located outside of CONUS to access Commonwealth Confidential Information, Commonwealth Data and services, and systems providing services to the Commonwealth.

(c) Compliance with Laws and Policy. Confidential Information may be subject to and governed by specific state and federal laws, regulations and policies that must be followed. If applicable, prior to deployment of the Licensed Products, the Commonwealth may require Licensor to sign off on particular instructions, restrictions and limitations, as dictated by the Commonwealth, including, but not limited to, executing a business associate agreement.

15. Data Breach or Loss.

(a) Compliance with Laws. Licensor shall comply with all applicable data protection, data security, data privacy, and data breach notification laws, including, but not limited to, the Breach of Personal Information Notification Act, 73 P.S. §§ 2301 - 2330. Further, to the extent Licensor maintains, stores, or manages computerized data on behalf of the Commonwealth that constitutes Personal information, as defined in the Breach of Personal Information Notification Act, Licensor shall comply with the obligations outlined in Exhibit 3 attached to this agreement.

(b) Control of Licensor. For data and Confidential Information in the possession, custody, and control of Licensor or its employees, agents, or subcontractors:

(i) Licensor shall report a Data Security Incident to the Commonwealth within 24 hours of when Licensor knows of or reasonably suspects the Data Security Incident, and Licensor shall immediately take all reasonable steps to mitigate any potential harm or further access, acquisition, use, release, loss, destruction, or disclosure of the data or Confidential Information.

(ii) Licensor shall provide timely notice to all individuals that may require notice under any applicable law or regulation as a result of a Data Security Incident. The notice must be pre-approved by the Commonwealth.

(iii) Licensor shall be solely responsible for any costs, losses, fines, or damages incurred by the Commonwealth due to a Data Security Incident, for which Licensor shall reimburse the Commonwealth upon invoice received from the Commonwealth.

(iv) Licensor shall indemnify the Commonwealth against any third-party claims arising out of a Data Security Incident.

(v) Licensor shall, at Licensor’s sole expense, provide access to credit monitoring services to all affected individuals as required by law, including, but not limited to, the Breach of Personal Information Notification Act, 73 P.S. §§ 2301 - 2330.

(c) Notice of Data Security Incident. Except as required by law, Licensor shall not inform any third-party of any Data Security Incident without first obtaining the Commonwealth’s prior, written consent, other than to inform a complainant that the matter has been forwarded to the Commonwealth’s legal counsel. Further, except as required by law, the Commonwealth shall have the sole right to determine: (i) whether notice of the Data Security Incident is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in the Commonwealth’s discretion; and (ii) the contents of the notice, whether any type or remediation may be offered to affected persons, and the nature and extent of any remediation.

(d) Additional Requirements. The requirements of this section are in addition to and not in lieu of other requirements of this agreement and its exhibits having to do with data privacy and security, including, but not limited to, those in Exhibit 3.

16. Hyperlink Content. Any terms and conditions contained in Hyperlink Content will not apply to the extent the terms and conditions are expressly prohibited by applicable law. In addition, no financial obligation of the Commonwealth to Licensor will be affected by any change to Hyperlink Content, nor will any additional material obligations be placed on the Commonwealth as a result of any changes to Hyperlink Content. Terms and conditions in the Hyperlink Content that are materially inconsistent with the agreement are rejected, unenforceable by Licensor, and are not a part of this agreement unless the terms and conditions are to the benefit of the Commonwealth.

17. Commonwealth Data. In addition to the limitations in Exhibit 3 and except for any aggregate data that has been anonymized, Licensor shall not use any data or information provided by the Commonwealth to develop any AI tools, conduct queries, or train any AI including, but not limited to, generative AI or agentic AI.

18. Publicity or Advertisement. Licensor shall obtain written Commonwealth approval prior to mentioning the Commonwealth in an advertisement, endorsement, or any other type of publicity. This includes the use of any trademark, service mark, or logo.

19. Portability. To the extent applicable, the Commonwealth may move a Licensed Product from machine to machine, whether physical or virtual, and to other locations, where those machines and locations are internal to the Commonwealth or to a Commonwealth contractor, if such relocation and the use being made of the Licensed Product comports with the license grant and restrictions. Notwithstanding the foregoing, the Commonwealth may move the machine or appliance provided by Licensor upon which the Licensed Product is installed.

20. Taxes-Federal, State and Local; Interest.

21. Accessibility. Licensor shall ensure that all Licensed Products comply with all requirements of the Americans with Disabilities Act, 42 U.S.C. §§ 12101 - 12213, and Section 508 of the Rehabilitation Act, 29 U.S.C. § 794(d). For Digital Content and Services, this will include, but not be limited to, compliance with WCAG 2.1, Level AA or higher. Licensor shall ensure that all user interfaces, electronic documents and communications are accessible to individuals with disabilities. Accessibility testing and remediation, including automated and manual testing with assistive technologies, must be incorporated into all development and implementation activities. Upon request, Licensor shall provide accessibility conformance documentation (e.g., VPAT or ACR) to the Commonwealth. Upon request, Licensor shall provide documentation verifying compliance or a remediation plan for any identified deficiencies.

22. Commonwealth Audit Rights and Responsibilities.

(a) Licensor’s Access to Records. The Commonwealth shall maintain, and promptly provide to Licensor upon request, accurate records regarding use of the Licensed Products by or for the Commonwealth. If the Commonwealth becomes aware of any unauthorized use of all or any part of the Licensed Products, the Commonwealth shall notify Licensor promptly, providing reasonable details.

(b) Commonwealth Self-Audit. The Commonwealth shall perform a self-audit upon the request of Licensor. The request may not occur more often than annually. The audit will report any change in user count. The Commonwealth shall notify Licensor of the change in user count no later than 45 calendar days after the request that the Commonwealth perform a self-audit.

(c) True Ups. If the user count has increased, the Commonwealth shall make a prospective purchase of the Licensed Products through a Reseller Contract or another procurement document, in an amount equivalent to the additional users, including additional licenses and maintenance and support (if applicable) for the Licensed Products.

(d) Sole Right and Remedy. This section sets out the sole software license audit right and remedy under this agreement.

(e) Commonwealth Audit of Licensor Compliance. At the Commonwealth’s discretion and upon 30 days’ advance written notice, the Commonwealth may audit Licensor’s compliance with the requirements set forth in this agreement.

23. Right-to-Know Law. The RTKL applies to this agreement.

24. Third-Party Software. If a Licensed Product utilizes or includes third-party software and other copyrighted material, any additional licensing terms, acknowledgements or disclaimers associated with the third-party software and materials are not applicable to the Commonwealth, except to the extent they are attached to this agreement or the Commonwealth has entered into a separate agreement with the third-party that sets forth the additional licensing terms, acknowledgments or disclaimers. The Commonwealth, by acknowledging third-party software, does not agree to any terms and conditions of the third-party software agreements.

25. Insurance. Licensor shall obtain and maintain for the term of this agreement insurance coverages, including coverage types and amounts, that are sufficient to cover the potential damages under this agreement.

26. Termination. Licensor may not terminate this agreement for non-payment. The Commonwealth may terminate this agreement without cause by giving Licensor 30 days’ prior written notice of termination only to the extent there are no valid purchase orders in place at the time of termination by the Commonwealth.

27. Signatures.

(a) Electronic Signatures. A record or signature will not be denied legal effect or enforceability solely because it is in electronic form. A contract will not be denied legal effect or enforceability solely because an electronic record was used in its formation. If a law requires a record to be in writing, an electronic record satisfies the law. If law requires a signature, an electronic signature satisfies the law.

(b) Ink Signatures Not Required. The fully executed agreement may not contain ink signatures by the Commonwealth. If this agreement does not contain ink signatures by the Commonwealth, Licensor’s receipt of an electronically-printed agreement with the printed name of the Commonwealth purchasing agent constitutes a valid, binding contract with the Commonwealth. The printed name of the purchasing agent represents the signature of that individual who is authorized to bind the Commonwealth to the obligations contained in this agreement. The printed name also indicates that all approvals required by Commonwealth contracting procedures have been obtained.

(c) Warranty of Authority. Licensor represents and warrants that the signatory to the agreement is duly authorized to legally bind Licensor to Licensor’s rights and obligations under this agreement.

28. Independent Contractor. The parties are independent contractors, and this agreement does not create an agency, partnership, or joint venture.

29. Travel. Licensor will not be paid for travel or per diem expenses except as specifically set forth in this agreement or statement of work. If not otherwise specified in the agreement or statement of work, the Commonwealth will reimburse travel and related expenses only in accordance with Management Directive 230.10 Amended, Commonwealth Travel Policy, and Manual 230.1, Commonwealth Travel Procedures Manual.

30. Assignment. Either party may assign this agreement in its entirety, but not in parts, on written notice to the other party to its parent company, affiliate, or subsidiary, in connection with a merger, consolidation, or sale or other disposition of all or substantially all of its assets, or in the case of the Commonwealth to another Commonwealth entity. Any other assignment will be invalid, except with the other party’s prior written consent, which shall not be unreasonably withheld. This agreement and all obligations will be binding upon and inure to the benefit of the parties’ successors and lawful assignees.

31. Notice. Any written notice to either party under this agreement will be deemed sufficient if delivered personally, or by facsimile, telecopy, electronic or digital transmission (if such delivery is confirmed), or by a recognized overnight courier service (e.g., DHL, Federal Express, etc.), with confirmed receipt, or by certified or registered United States mail, postage prepaid, return receipt requested, sent to the address such party may designate by notice given pursuant to this section.

32. Survival. The termination or expiration of this agreement will not affect any provisions of this agreement that by their nature survive termination or expiration, including the provisions that deal with the following subject matters: definitions, confidentiality, term and termination, effect of termination, intellectual property, license compliance, limitation of liability, indemnification, and privacy.

33. Waiver. Failure to enforce any provision will not constitute a waiver.

34. Severability. If any provision is found unenforceable, it and any related provisions will be interpreted to best accomplish the unenforceable provision’s essential purpose.

35. Nonexclusive Remedy. Except as expressly set forth in this agreement, the exercise by either party of any of its remedies under this agreement will be without prejudice to its other remedies under this agreement or otherwise.

36. Integration. The parties intend this statement of their agreement to constitute the complete, exclusive, and fully integrated statement of their agreement. It is the sole expression of their agreement, and they are not bound by any other agreements of whatsoever kind or nature. The parties also intend that this agreement may not be supplemented, explained, or interpreted by any evidence of trade usage or course of dealing. By entering into this agreement, the parties did not rely upon oral or written statements or representations not contained within the document itself. Other terms and conditions or additional terms and conditions included or referenced in Licensor’s quotations, invoices, business forms, purchase order, terms of any shrink-wrap agreement included with the Licensed Products, terms of any click through agreement included with the Licensed Products, terms required for account creation, or any other terms purported to apply to the Licensed Products will not become part of the parties’ agreement and will be disregarded by the parties, unenforceable by Licensor and not binding on the Commonwealth.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.]

The parties, through their respective duly authorized representatives, have signed this agreement as indicated below.

Licensor:

Signature Date

Printed Name

Title

COMMONWEALTH OF PENNSYLVANIA

DEPARTMENT OF TRANSPORTATION

Electronically signed per Section 27 Agency Head or Designee Date

APPROVED AS TO FORM AND LEGALITY:

Electronically signed per Section 27 Office of Chief Counsel Date

Electronically signed per Section 27 Office of General Counsel Date

Electronically signed per Section 27 Office of Attorney General Date

APPROVED:

Electronically signed per Section 27 Comptroller Date

Revised 4.1.2026

EXHIBIT 1

LIST OF LICENSED PRODUCTS

In accordance with section 3 of this agreement, additional Licensed Products may be added to this exhibit.

Licensed Products:

The Licensed Products include (list, in detail, all products covered by this agreement, and then delete this instruction):

EXHIBIT 2

[INSERT LICENSOR’S TERMS]

EXHIBIT 3

VENDOR SECURITY REQUIREMENTS

1. SCOPE; DEFINITIONS

a. Vendor Security Requirements Scope. This exhibit applies to Supplier’s performance under the agreement and all access, collection, use, storage, transmission, disclosure, destruction or deletion of, and security incidents regarding Commonwealth Information. This exhibit does not limit other obligations of Supplier, including under the agreement or laws that apply to Supplier, Supplier’s performance under the agreement, Commonwealth Information or the Permitted Purpose. To the extent this exhibit directly conflicts with the agreement, the Supplier shall promptly notify the Commonwealth of the conflict and shall comply with the requirement that provides the greatest protection of Commonwealth Information.

b. Definitions.

“Aggregate” means to combine or store Commonwealth Information with any data or information of Supplier or any third party.

“AI” means artificial intelligence.

“Anonymize” means to use, collect, store, transmit or transform any data or information (including Commonwealth Information) in a manner or form that does not identify, permit identification of, and is not otherwise attributable to any user, device identifier, source, product, service, context, or brand of the Commonwealth or its governmental entities.

“Commonwealth Information” means, individually and collectively: (a) all Commonwealth Confidential Information (as defined in the agreement or in the non-disclosure agreement between the parties); (b) all other data, records, files, content or information, in any form or format, acquired, accessed, collected, received, stored or maintained by Supplier or its affiliates from or on behalf of the Commonwealth or its governmental entities, or otherwise in connection with the agreement, the services, or the parties’ performance of or exercise of rights under or in connection with the agreement (including Commonwealth data); and (c) derived from (a) or (b), even if Anonymized.

“CONUS” means the continental United States and Hawaii.

“Extranet” means any of the following: a web portal, a non-public website, or extranet services of the Commonwealth’s or a third party’s website or system.

“In Bulk Access” means accessing data by means of database query, report generation, or any other mass transfer of data.

“MFA” means multi-factor authentication.

“Permitted Purpose” means providing products or services to the Commonwealth under the agreement and the licenses (if any) granted under the agreement.

“Security Incident” means actual or suspected unauthorized access, collection, acquisition, use, transmission, disclosure, corruption or loss of Commonwealth Information, or breach of any environment: (i) containing Commonwealth Information, or (ii) managed by Supplier with controls substantially similar to those protecting Commonwealth Information and includes a Computer Security Incident or Data Security Incident as those terms are defined in the agreement.

“Subcontractors” means the Supplier’s subcontractors, vendors, affiliates, or delegates.

“Supplier” means Licensor.

“WAF” means web application…