Attachment I.docx

Attachment I - Proposed Contract Terms Proposed Contract Terms In addition to Sections I.1, Mandatory Terms and Conditions, and I.2, Additional Required Terms, the State proposes to include all the following terms in any contract resulting from this solicitation. You may state an exception to any of the terms in this Attachment. If you do so, you must:

a. Identify the term(s) on an attachment to your proposal;

b. Explain why you take exception to the State’s language;

c. Indicate what change or alternative language you propose;

d. Clearly identify why the acceptance of your change or alternative language would be advantageous to the State.

The State will interpret the absence of an exception to a term as your acceptance of that term.

Contents

Request for Proposals No. 5400030161 Attachment I, page 1 Assignment, Novation, and Change of Name, Identity, or Structure (FEB 2015)

(a) Contractor shall not assign this contract, or its rights, obligations, or any other interest arising from this contract, or delegate any of its performance obligations, without the express written consent of the responsible procurement officer. The foregoing restriction does not apply to a transfer that occurs by operation of law (e.g., bankruptcy; corporate reorganizations and consolidations, but not including partial asset sales). Notwithstanding the foregoing, contractor may assign monies receivable under the contract provided that the state shall have no obligation to make payment to an assignee until thirty days after contractor (not the assignee) has provided the responsible procurement officer with (i) proof of the assignment, (ii) the identity (by contract number) of the specific state contract to which the assignment applies, and (iii) the name of the assignee and the exact address or account information to which assigned payments should be made. (b) If contractor amends, modifies, or otherwise changes its name, its identity (including its trade name), or its corporate, partnership or other structure, or its FEIN, contractor shall provide the procurement officer prompt written notice of such change. (c) Any name change, transfer, assignment, or novation is subject to the conditions and approval required by Regulation 19-445.2180, which does not restrict transfers by operation of law. [07-7A004-2] Bankruptcy - General (FEB 2015)

(a) Notice. In the event the Contractor enters into proceedings relating to bankruptcy, whether voluntary or involuntary, the Contractor agrees to furnish written notification of the bankruptcy to the Using Governmental Unit. This notification shall be furnished within two (2) days of the initiation of the proceedings relating to the bankruptcy filing. This notification shall include the date on which the bankruptcy petition was filed, the identity of the court in which the bankruptcy petition was filed, and a listing of all State contracts against which final payment has not been made. This obligation remains in effect until final payment under this Contract. (b) Termination. This contract is voidable and subject to immediate termination by the State upon the contractor’s insolvency, including the filing of proceedings in bankruptcy. [07-7A005-2] Bankruptcy – Government Information (FEB 2015)

(a) All government information (as defined in the clause herein entitled “Information Security - Definitions”) shall belong exclusively to the State, and Contractor has no legal or equitable interest in, or claim to, such information. Contractor acknowledges and agrees that in the event Contractor enters into proceedings relating to bankruptcy, whether voluntary or involuntary, government information in its possession and/or under its control will not be considered property of its bankruptcy estate.

(b) Contractor agrees to notify the State within forty-eight (48) hours of any determination that it makes to file for bankruptcy protection, and Contractor further agrees to turn over to the State, before such filing, all government information that is in Contractor’s possession in a format that can be readily utilized by the State.

(c) In order to protect the integrity and availability of government information, Contractor shall take reasonable measures to evaluate and monitor the financial circumstances of any subcontractor that will process, store, transmit or access government information. [07-7B007-1] Changes (JAN 2006)

(1) Contract Modification. By a written order, at any time, and without notice to any surety, the Procurement Officer may, subject to all appropriate adjustments, make changes within the general scope of this contract in any one or more of the following:

(a) drawings, designs, or specifications, if the supplies to be furnished are to be specially manufactured for the [State] in accordance therewith;

(b) method of shipment or packing;

(c) place of delivery;

(d) description of services to be performed;

(e) time of performance (i.e., hours of the day, days of the week, etc.); or,

(f) place of performance of the services. Subparagraphs (a) to (c) apply only if supplies are furnished under this contract. Subparagraphs (d) to (f) apply only if services are performed under this contract.

(2) Adjustments of Price or Time for Performance. If any such change increases or decreases the contractor's cost of, or the time required for, performance of any part of the work under this contract, whether or not changed by the order, an adjustment shall be made in the contract price, the delivery schedule, or both, and the contract modified in writing accordingly. Any adjustment in contract price made pursuant to this clause shall be determined in accordance with the Price Adjustment Clause of this contract. Failure of the parties to agree to an adjustment shall not excuse the contractor from proceeding with the contract as changed, provided that the State promptly and duly make such provisional adjustments in payment or time for performance as may be reasonable. By proceeding with the work, the contractor shall not be deemed to have prejudiced any claim for additional compensation, or an extension of time for completion.

(3) Time Period for Claim. Within 30 days after receipt of a written contract modification under Paragraph (1) of this clause, unless such period is extended by the Procurement Officer in writing, the contractor shall file notice of intent to assert a claim for an adjustment. Later notification shall not bar the contractor's claim unless the State is prejudiced by the delay in notification.

(4) Claim Barred After Final Payment. No claim by the contractor for an adjustment hereunder shall be allowed if notice is not given prior to final payment under this contract.

[07-7B025-1] Compliance With Laws (JAN 2006) During the term of the contract, contractor shall comply with all applicable provisions of laws, codes, ordinances, rules, regulations, and tariffs. [07-7B035-1] Contract Limitations (JAN 2006) No sales may be made pursuant to this contract for any item or service that is not expressly listed. No sales may be made pursuant to this contract after expiration of this contract. Violation of this provision may result in termination of this contract and may subject contractor to suspension or debarment. [07-7B045-1] Contractor Personnel (JAN 2006) The Contractor shall enforce strict discipline and good order among the Contractor's employees and other persons carrying out the Contract. The Contractor shall not permit employment of unfit persons or persons not skilled in tasks assigned to them. [07-7B060-1] Contractor's Liability Insurance - General (FEB 2015)

(a) Without limiting any of the obligations or liabilities of Contractor, Contractor shall procure from a company or companies lawfully authorized to do business in South Carolina and with a current A.M. Best rating of no less than A: VII, and maintain for the duration of the contract, insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work and the results of that work by the contractor, his agents, representatives, employees or subcontractors.

(b) Coverage shall be at least as broad as:

(1) Commercial General Liability (CGL): Insurance Services Office (ISO) Form CG 00 01 12 07 covering CGL on an "occurrence" basis, including products-completed operations, personal and advertising injury, with limits no less than $1,000,000 per occurrence. If a general aggregate limit applies, the general aggregate limit shall be twice the required occurrence limit. This contract shall be considered to be an "insured contract" as defined in the policy.

(2) Auto Liability: ISO Form Number CA 00 01 covering any auto (Code 1), or if Contractor has no owned autos, hired, (Code 8) and non-owned autos (Code 9), with limits no less than $1,000,000 per accident for bodily injury and property damage.

(3) Worker's Compensation: As required by the State of South Carolina, with Statutory Limits, and Employer's Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease.

(c) Every applicable Using Governmental Unit, and the officers, officials, employees and volunteers of any of them, must be covered as additional insureds on the CGL policy with respect to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts or equipment furnished in connection with such work or operations. General liability coverage can be provided in the form of an endorsement to the Contractor's insurance at least as broad as ISO Form CG 20 10 11 85 or if not available, through the addition of both CG 20 10 and CG 20 37 if a later edition is used.

(d) For any claims related to this contract, the Contractor's insurance coverage shall be primary insurance as respects the State, every applicable Using Governmental Unit, and the officers, officials, employees and volunteers of any of them. Any insurance or self-insurance maintained by the State, every applicable Using Governmental Unit, or the officers, officials, employees and volunteers of any of them, shall be excess of the Contractor's insurance and shall not contribute with it.

(e) Prior to commencement of the work, the Contractor shall furnish the State with original certificates and amendatory endorsements or copies of the applicable policy language effecting coverage required by this section. All certificates are to be received and approved by the State before work commences. However, failure to obtain the required documents prior to the work beginning shall not waive the Contractor's obligation to provide them. The State reserves the right to require complete, certified copies of all required insurance policies, including endorsements required by this section, at any time.

(f) Should any of the above described policies be cancelled before the expiration date thereof, notice will be delivered in accordance with the policy provisions. In addition, the Contractor shall notify the State immediately upon receiving any information that any of the coverages required by this section are or will be changed, cancelled, or replaced.

(g) Contractor hereby grants to the State and every applicable Using Governmental Unit a waiver of any right to subrogation which any insurer of said Contractor may acquire against the State or applicable Using Governmental Unit by virtue of the payment of any loss under such insurance. Contractor agrees to obtain any endorsement that may be necessary to effect this waiver of subrogation, but this provision applies regardless of whether or not the State or Using Governmental Unit has received a waiver of subrogation endorsement from the insurer.

(h) Any deductibles or self-insured retentions must be declared to and approved by the State. The State may require the Contractor to purchase coverage with a lower deductible or retention or provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention.

(i) The State reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.

[07-7B056-2] Contractor's Liability Insurance - Information Security and Privacy (FEB 2015) [ASK QUESTIONS NOW: For products providing the coverages required by this clause, the insurance market is evolving. Our research indicates that the requirements stated herein reflect commercially-available insurance products. Any offeror having concerns with any specific requirements of this clause should communicate those concerns to the procurement officer well in advance of opening.]

(a) Without limiting any other obligations or liabilities of Contractor, Contractor shall procure from a company or companies lawfully authorized to do business in South Carolina and with a current A.M. Best rating of no less than A: VII, and maintain for the duration of the contract, a policy or policies of insurance against claims which may arise from or in connection with the performance of the work and the results of that work by the contractor, his agents, representatives, employees, subcontractors or any other entity for which the contractor is legally responsible.

(b) Coverage must include claims for:

(i) information security risks, including without limitation, failure to prevent unauthorized access to, tampering with or unauthorized use of a computer system; introduction of malicious codes, computer viruses, worms, logic bombs, etc., into data or systems; or theft, damage, unauthorized disclosure, destruction, or corruption of information in whatever form;

(ii) privacy risks, including (A) failure to properly handle, manage, store, dispose of, destroy, or otherwise control non-public personally identifiable information in any format; (B) loss of, unauthorized access to, or disclosure of confidential information; and (C) any form of invasion, infringement or interference with rights of privacy, including breach of security/privacy laws or regulations;

(iii) contractual liability for the contractor’s obligations described in the clauses titled “Indemnification - Third Party Claims – Disclosure Of Information” and “Information Use And Disclosure;” and

(iv) errors, omissions, or negligent acts in the performance, by the contractor or by any entity for which the contractor is legally responsible, of professional services included in the work.

(c) If the work includes content for internet web sites or any publications or media advertisements, coverage must also include claims for actual or alleged infringement of intellectual property rights, invasion of privacy, as well as advertising, media and content offenses.

(d) If the work includes software, coverage must also include claims for intellectual property infringement arising out of software and/or content (with the exception of patent infringement and misappropriation of trade secrets)

(e) Coverage shall have limits no less than ten million ($10,000,000.00) dollars per occurrence and ten million ($10,000,000.00) dollars aggregate.

(f) If the insurance required by this clause is procured on a form affording “claims-made” coverage, then (i) all limits stated above as “per occurrence” shall be understood to mean “per claim” or “per occurrence,” as is consistent with the terms of the “claims-made” policy; and (ii) such claims-made insurance shall provide for a retroactive date no later than the date the contract is awarded.

(g) All terms of this clause shall survive termination of the contract and shall continue until thirty (30) days past the final completion of the work, including the performance of any warranty work. In addition, contractor shall maintain in force and effect any “claims-made” coverage for a minimum of two (2) years after final completion of all work or services to be provided hereunder. Contractor shall purchase an extended reporting period, or “tail coverage,” if necessary to comply with the latter requirement.

(h) Every applicable Using Governmental Unit, and the officers, officials, employees and volunteers of any of them, must be covered as additional insureds on the policy or policies of insurance required by this clause.

(i) For any claims related to this contract, the insurance coverage required by this clause shall be primary insurance as respects the State, every applicable Using Governmental Unit, and the officers, officials, employees and volunteers of any of them. Any insurance or self-insurance maintained by the State, every applicable Using Governmental Unit, or the officers, officials, employees and volunteers of any of them, shall be excess of the Contractor’s insurance and shall not contribute with it.

(j) Prior to commencement of the work, the Contractor shall furnish the State with original certificates of insurance for every applicable policy effecting the coverage required by this clause. All certificates are to be received and approved by the Procurement Officer before work commences. However, failure to obtain the required documents prior to the work beginning shall not waive the Contractor’s obligation to provide them. The State reserves the right to require complete, certified copies of all required insurance policies, including policy declarations and any endorsements required by this section, at any time.

(k) Should any of the above described policies be cancelled before the expiration date thereof, notice will be delivered in accordance with the policy provisions. In addition, the Contractor shall notify the State immediately upon receiving any information that any of the coverages required by this clause are or will be changed, cancelled, or replaced.

(l) Contractor hereby grants to the State and every applicable Using Governmental Unit a waiver of any right to subrogation which any insurer of said Contractor may acquire against the State or applicable Using Governmental Unit by virtue of the payment of any loss under such insurance as is required by this clause. Contractor agrees to obtain any endorsement that may be necessary to effect this waiver of subrogation, but this provision applies regardless of whether or not the State or Using Governmental Unit has received a waiver of subrogation endorsement from the insurer.

(m) Any deductibles or self-insured retentions must be declared to and approved by the State. The State may require the Contractor to purchase coverage with a lower deductible or retention or provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention. [07-7B058-1] Contractor's Obligation -- General (JAN 2006) The contractor shall provide and pay for all materials, tools, equipment, labor and professional and non-professional services, and shall perform all other acts and supply all other things necessary, to fully and properly perform and complete the work. The contractor must act as the prime contractor and assume full responsibility for any subcontractor's performance. The contractor will be considered the sole point of contact with regard to all situations, including payment of all charges and the meeting of all other requirements. [07-7B065-1] Contractor's Use of State Property (JAN 2006) Upon termination of the contract for any reason, the State shall have the right, upon demand, to obtain access to, and possession of, all State properties, including, but not limited to, current copies of all State application programs and necessary documentation, all data, files, intermediate materials and supplies held by the contractor. Contractor shall not use, reproduce, distribute, display, or sell any data, material, or documentation owned exclusively by the State without the State's written consent, except to the extent necessary to carry out the work. [07-7B067-1] Default (JAN 2006)

(a) (1) The State may, subject to paragraphs (c) and (d) of this clause, by written notice of default to the Contractor, terminate this contract in whole or in part if the Contractor fails to:

(i) Deliver the supplies or to perform the services within the time specified in this contract or any extension;

(ii) Make progress, so as to endanger performance of this contract (but see paragraph (a)(2) of this clause); or

(iii) Perform any of the other material provisions of this contract (but see paragraph (a)(2) of this clause).

(2) The State's right to terminate this contract under subdivisions (a)(1)(ii) and (1)(iii) of this clause, may be exercised if the Contractor does not cure such failure within 10 days (or more if authorized in writing by the Procurement Officer) after receipt of the notice from the Procurement Officer specifying the failure.

(b) If the State terminates this contract in whole or in part, it may acquire, under the terms and in the manner the Procurement Officer considers appropriate, supplies or services similar to those terminated, and the Contractor will be liable to the State for any excess costs for those supplies or services. However, the Contractor shall continue the work not terminated.

(c) Except for defaults of subcontractors at any tier, the Contractor shall not be liable for any excess costs if the failure to perform the contract arises from causes beyond the control and without the fault or negligence of the Contractor. Examples of such causes include (1) acts of God or of the public enemy, (2) acts of the State in either its sovereign or contractual capacity, (3) fires, (4) floods, (5) epidemics, (6) quarantine restrictions, (7) strikes, (8) freight embargoes, and (9) unusually severe weather. In each instance the failure to perform must be beyond the control and without the fault or negligence of the Contractor.

(d) If the failure to perform is caused by the default of a subcontractor at any tier, and if the cause of the default is beyond the control of both the Contractor and subcontractor, and without the fault or negligence of either, the Contractor shall not be liable for any excess costs for failure to perform, unless the subcontracted supplies or services were obtainable from other sources in sufficient time for the Contractor to meet the required delivery schedule.

(e) If this contract is terminated for default, the State may require the Contractor to transfer title and deliver to the State, as directed by the Procurement Officer, any (1) completed supplies, and (2) partially completed supplies and materials, parts, tools, dies, jigs, fixtures, plans, drawings, information, and contract rights (collectively referred to as "manufacturing materials" in this clause) that the Contractor has specifically produced or acquired for the terminated portion of this contract. Upon direction of the Procurement Officer, the Contractor shall also protect and preserve property in its possession in which the State has an interest.

(f) The State shall pay contract price for completed supplies delivered and accepted. The Contractor and Procurement Officer shall agree on the amount of payment for manufacturing materials delivered and accepted and for the protection and preservation of the property; if the parties fail to agree, the Procurement Officer shall set an amount subject to the Contractor's rights under the Disputes clause. Failure to agree will be a dispute under the Disputes clause. The State may withhold from these amounts any sum the Procurement Officer determines to be necessary to protect the State against loss because of outstanding liens or claims of former lien holders.

(g) If, after termination, it is determined that the Contractor was not in default, or that the default was excusable, the rights and obligations of the parties shall, if the contract contains a clause providing for termination for convenience of the State, be the same as if the termination had been issued for the convenience of the State. If, in the foregoing circumstances, this contract does not contain a clause providing for termination for convenience of the State, the contract shall be adjusted to compensate for such termination and the contract modified accordingly subject to the contractor's rights under the Disputes clause.

(h) The rights and remedies of the State in this clause are in addition to any other rights and remedies provided by law or under this contract.

[07-7B075-1] Digital Government Services Incorporation The proposed solution shall support integration, through documented interfaces, with State enterprise digital services identified or designated by the State for use in connection with the requirements of this solicitation, including, as applicable, identity management, identity proofing, digital credential or wallet services, and payment services where a payment transaction is otherwise required or authorized by the State. Integration with a State enterprise digital service shall not preclude the FYF Portal from providing or maintaining supplemental or complementary functionality required to satisfy this solicitation, including functionality needed for users, partners, data, credentials, or workflows not fully supported by that service. Unless expressly stated elsewhere in the solicitation or specifically directed by the State for an identified transaction, this requirement does not eliminate the FYF access methods identified in the solicitation, restrict required guest or public access, eliminate or restrict State-approved alternative authentication methods for users who do not use SSO, or require all users to create a my.sc.gov account. CCWD or designated representative will identify the transactions, if any, for which use of a State enterprise identity service or enhanced identity proofing is mandatory.

Any post-award addition of, or migration to, a State enterprise service shall be authorized by the State and implemented in accordance with the Contract's applicable change, CLIN, pricing, integration, and procurement procedures. A written contract modification shall be required to the extent required by the Contract or applicable law for a material change to contract scope, price, schedule, allocation of responsibilities, or other contractual obligations. Any material change beyond the general scope of the Contract shall be addressed in accordance with applicable procurement law.

EFT Information(FEB 2021) The Contractor must furnish to the State Treasurer's Office information necessary for making a payment by electronic funds transfer (EFT). You may do this by completing STO Form 4 and filing it with the STO. Additional information is available at the STO's website at https://treasurer.sc.gov (.) The Contractor is responsible for the currency, accuracy and completeness of the EFT information. Updating EFT information may not be used to accomplish an assignment of the right to payment, does not alter the terms and conditions of this contract, and is not a substitute for a properly executed contractual document. [07-7A027-1] False Claims (JAN 2006) According to the S.C. Code of Laws Section 16-13-240, "a person who by false pretense or representation obtains the signature of a person to a written instrument or obtains from another person any chattel, money, valuable security, or other property, real or personal, with intent to cheat and defraud a person of that property is guilty" of a crime. [07-7A035-1] Indemnification – Intellectual Property (JAN 2006) Without limitation and notwithstanding any provision in this agreement, Contractor shall, upon receipt of notification, defend and indemnify the State, its instrumentalities, agencies, departments, boards, political subdivisions and all their respective officers, agents and employees against all actions, proceedings or claims of any nature (and all damages, settlement payments, attorneys’ fees (including inside counsel), costs, expenses, losses or liabilities attributable thereto) by any third party asserting or involving an IP right related to an acquired item. State shall allow Contractor to defend such claim so long as the defense is diligently and capably prosecuted. State shall allow Contractor to settle such claim so long as (i) all settlement payments are made by Contractor, and (ii) the settlement imposes no non-monetary obligation upon State. State shall reasonably cooperate with Contractor’s defense of such claim. (b) In the event an injunction or order shall be obtained against State’s use of any acquired item, or if in Contractor’s opinion, the acquired item is likely to become the subject of a claim of infringement or violation of an IP right, Contractor shall, without in any way limiting the foregoing, and at its expense, either: (1) procure for State the right to continue to use, or have used, the acquired item, or (2) replace or modify the acquired item so that it becomes non-infringing but only if the modification or replacement does not adversely affect the specifications for the acquired item or its use by State. If neither (1) nor (2), above, is practical, State may require that Contractor remove the acquired item from State, refund to State any charges paid by State therefor, and take all steps necessary to have State released from any further liability. (c) Contractors obligations under this paragraph do not apply to a claim to the extent (i) that the claim is caused by Contractor’s compliance with specifications furnished by the State unless Contractor knew its compliance with the State’s specifications would infringe an IP right, or (ii) that the claim is caused by Contractor’s compliance with specifications furnished by the State if the State knowingly relied on a third party’s IP right to develop the specifications provided to Contractor and failed to identify such product to Contractor. (d) As used in this paragraph, these terms are defined as follows: “IP right(s)” means a patent, copyright, trademark, trade secret, or any other proprietary right. “Acquired item(s)” means the rights, goods, or services furnished under this agreement. “Specification(s)” means a detailed, exact statement of particulars such as a statement prescribing materials, dimensions, and quality of work. (e) Contractor’s obligations under this clause shall survive the termination, cancellation, rejection, or expiration of this Agreement. [07-7B103-1] Indemnification - Third Party Claims – Disclosure of Information (FEB 2015)

(a) Without limitation, Contractor shall defend and hold harmless Indemnitees from and against any and all suits, claims, investigations, or fines (hereinafter “action”) of any character (and all related damages, settlement payments, attorneys' fees, costs, expenses, losses or liabilities) by a third party which arise out of or in connection with a disclosure of government information (as defined in the clause titled Information Security - Definitions) caused in whole or in part by any act or omission of contractor, its subcontractors at any tier, their employees, workmen, servants, agents, or anyone directly or indirectly employed by them or anyone for whose acts any of them may be liable, regardless of whether or not caused in part by an Indemnitee, and whether or not such action is brought by a third party or an Indemnitee, but only if the act or omission constituted a failure to perform some obligation imposed by the contract or the law.

(b) Indemnitee must notify contractor in writing within a reasonable period of time after Indemnitee first receives written notice of any action. Indemnitee's failure to provide or delay in providing such notice will relieve contractor of its obligations under this clause only if and to the extent that such delay or failure materially prejudices contractors ability to defend such action. Indemnitee must reasonably cooperate with contractor's defense of such actions (such cooperation does not require and is without waiver of an Indemnitees attorney/client, work product, or other privilege) and, subject to Title 1, Chapter 7 of the South Carolina Code of Laws, allow contractor sole control of the defense, so long as the defense is diligently and capably prosecuted. Indemnitee may participate in contractor’s defense of any action at its own expense. Contractor may not, without Indemnitee’s prior written consent, settle, compromise, or consent to the entry of any judgment in any such commenced or threatened action unless such settlement, compromise or consent (i) includes an unconditional release of Indemnitee from all liability related to such commenced or threatened action, and (ii) is solely monetary in nature and does not include a statement as to, or an admission of fault, culpability or failure to act by or on behalf of, an Indemnitee or otherwise adversely affect an Indemnitee. Indemnitee’s consent is necessary for any settlement that requires Indemnitee to part with any right or make any payment or subjects Indemnitee to any injunction.

(c) Notwithstanding any other provision, contractor’s obligations pursuant to this clause are without any limitation whatsoever. Contractor’s obligations under this clause shall survive the termination, cancellation, rejection, or expiration of the contract. This provision shall be construed fairly and reasonably, neither strongly for nor against either party, and without regard to any clause regarding insurance.

(d) "Indemnitee" means the State of South Carolina, its instrumentalities, agencies, departments, boards, political subdivisions and all their respective officers, agents and employees. [07-7B102-1] Indemnification-Third Party Claims - General (NOV 2011) Notwithstanding any limitation in this agreement, and to the fullest extent permitted by law, Contractor shall defend and hold harmless Indemnitees for and against any and all suits or claims of any character (and all related damages, settlement payments, attorneys' fees, costs, expenses, losses or liabilities) by a third party which are attributable to bodily injury, sickness, disease or death, or to injury to or destruction of tangible property arising out of or in connection with the goods or services acquired hereunder or caused in whole or in part by any act or omission of contractor, its subcontractors, their employees, workmen, servants, agents, or anyone directly or indirectly employed by them or anyone for whose acts any of them may be liable, regardless of whether or not caused in part by an Indemnitee, and whether or not such claims are made by a third party or an Indemnitee; however, if an Indemnitee's negligent act or omission is subsequently determined to be the sole proximate cause of a suit or claim, the Indemnitee shall not be entitled to indemnification hereunder. Contractor shall be given timely written notice of any suit or claim. Contractor's obligations hereunder are in no way limited by any protection afforded under workers' compensation acts, disability benefits acts, or other employee benefit acts. This clause shall not negate, abridge, or reduce any other rights or obligations of indemnity which would otherwise exist. The obligations of this paragraph shall survive termination, cancelation, or expiration of the parties' agreement. This provision shall be construed fairly and reasonably, neither strongly for nor against either party, and without regard to any clause regarding insurance. As used in this clause, "Indemnitees" means the State of South Carolina, its instrumentalities, agencies, departments, boards, political subdivisions and all their respective officers, agents and employees. [07-7B100-2] Information Security - Definitions (FEB 2015) The following definitions are used in those clauses that cross reference this clause.

Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred. Without limitation, the term “compromise” includes copying the data through covert network channels, or copying the data to unauthorized media, or disclosure of information in violation of any obligation imposed by this contract.

Data means a subset of information in an electronic format that allows it to be retrieved or transmitted.

Government information means information (i) provided to Contractor by, or generated by Contractor for, the using governmental unit, or (ii) acquired or accessed by Contractor as a result of performing the Work. Without limiting the foregoing, government information includes any information that Contractor acquires or accesses by software or web-based services, which includes, without limitation, any metadata or location data. Government information excludes unrestricted information.

Information means any communication or representation of knowledge such as facts, statistics, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Public information means any specific information, regardless of form or format, that the State has actively and intentionally disclosed, disseminated, or made available to the public. Information is not public information solely because it may be subject to inspection pursuant to an unfulfilled public records request.

Software means any computer program accessed or used by the Using Governmental Unit or a third party pursuant to or as a result of this contract.

Third party means any person or entity other than the Using Governmental Unit, the Contractor, or any subcontractors at any tier.

Unrestricted information means (1) public information acquired other than through performance of the work, (2) information acquired by Contractor prior to contract formation, (3) information incidental to your contract administration, such as financial, administrative, cost or pricing, or management information, and (4) any ideas, concepts, know-how, methodologies, processes, technologies, techniques which Contractor develops or learns in connection with Contractor’s performance of the work.

Web-based service means a service accessed over the Internet and acquired, accessed, or used by the using governmental unit or a third party pursuant to or as a result of this contract, including without limitation, cloud services, software-as-a-service, and hosted computer services. [07-7B104-1] Information Security – Location of Data (FEB 2015) Notwithstanding any other provisions, contractor is prohibited from processing, storing, transmitting, or accessing government information, as defined in the clause titled Information Security - Definitions, outside the continental United States. For clarity, this obligation is a material requirement of this contract and applies to subcontractors at any tier. [07-7B106-1] Information Security - Safeguarding Requirements (FEB 2015)

(a) Definitions. The terms used in this clause shall have the same meaning as the terms defined in the clause titled Information Security – Definitions. In addition, as used in this clause— Clearing means removal of data from an information system, its storage devices, and other peripheral devices with storage capacity, in such a way that the data may not be reconstructed using common system capabilities (i.e., through the keyboard); however, the data may be reconstructed using laboratory methods.

Intrusion means an unauthorized act of bypassing the security mechanisms of a system.

Media means physical devices or writing surfaces including but not limited to magnetic tapes, optical disks, magnetic disks, portable hard drives, “thumb” drives, large scale integration memory chips, and printouts (but not including display media, e.g., a computer monitor, cathode ray tube (CRT) or other (transient) visual output) onto which information is recorded, stored, or printed within an information system.

Safeguarding means measures or controls that are prescribed to protect information.

Voice means all oral information regardless of transmission protocol.

(b) Safeguarding Information. Without limiting any other legal or contractual obligations, contractor shall implement and maintain reasonable and appropriate administrative, physical, and technical safeguards (including without limitation written policies and procedures) for protection of the security, confidentiality and integrity of the government information in its possession. In addition, contractor shall apply security controls when the contractor reasonably determines that safeguarding requirements, in addition to those identified in paragraph (c) of this clause, may be required to provide adequate security, confidentiality and integrity in a dynamic environment based on an assessed risk or vulnerability.

(c) Safeguarding requirements and procedures. Contractor shall apply the following basic safeguarding requirements to protect government information from unauthorized access and disclosure:

(1) Protecting information on public computers or Web sites: Do not process government information on public computers (e.g., those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control. Government information shall not be posted on Web sites that are publicly available or have access limited only by domain/Internet Protocol restriction. Such information may be posted to web pages that control access by user ID/password, user certificates, or other technical means, and that provide protection via use of security technologies. Access control may be provided by the intranet (versus the Web site itself or the application it hosts).

(2) Transmitting electronic information. Transmit email, text messages, blogs, and similar communications that contain government information using technology and processes that provide the best level of security and privacy available, given facilities, conditions, and environment.

(3) Transmitting voice and fax information. Transmit government information via voice and fax only when the sender has a reasonable assurance that access is limited to authorized recipients.

(4) Physical and electronic barriers. Protect government information by at least one physical and one electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(5) Sanitization. At a minimum, clear information on media that have been used to process government information before external release or disposal. Overwriting is an acceptable means of clearing media in accordance with National Institute of Standards and Technology 800–88, Guidelines for Media Sanitization, at http://csrc.nist.gov/ publications/nistpubs/800-88/NISTSP800-88_with-errata.pdf.

(6) Intrusion protection. Provide at a minimum the following protections against intrusions and compromise:

(i) Current and regularly updated malware protection services, e.g., anti-virus, antispyware.

(ii) Prompt application of security-relevant software upgrades, e.g., patches, service packs, and hot fixes.

(7) Transfer limitations. Transfer government information only to those subcontractors that both require the information for purposes of contract performance and provide at least the same level of security as specified in this clause.

(d) Subcontracts. Any reference in this clause to Contractor also includes any subcontractor at any tier. Contractor is responsible for, and shall impose by agreement requirements at least as secure as those imposed by this clause on, any other person or entity that contractor authorizes to take action related to government information.

(e) Other contractual requirements regarding the safeguarding of information. This clause addresses basic requirements and is subordinate to any other contract clauses or requirements to the extent that it specifically provides for enhanced safeguarding of information or information systems.[07-7B105-1] Information Use and Disclosure – Standards (FEB 2015) To the extent applicable:

(a) Breach of security of state agency data; notification; rights and remedies of injured parties; penalties; notification of Consumer Protection Division, S.C. Code Ann. Section 1-11-490.

(b) South Carolina Financial Identity Fraud and Identity Theft Protection Act (FIFITPA), 2008 Act 190, as amended. Solely for purposes of Section 39-1-90 of the South Carolina Code of Laws, as amended, Contractor is deemed to be the owner of government information, as defined herein, and Contractor agrees that the Using Governmental Unit is not a licensee.

(c) The South Carolina Family Privacy Protection Act of 2002, S.C. Code Ann. Sections 30-2-10, et seq.

(d) Personal Identifying Information Privacy Protection, S.C. Code Ann. Sections 30-2-310 et seq.

(e) Data Breach Notification, 2014 Act No. 286, Section 117.117, as revised in any future annual appropriations act. [07-7B110-1] Information Use and Disclosure (FEB 2015) Except to the extent necessary for performance of the work, citizens should not be required to share information with those engaged by the government in order to access services provided by the government and such information should be used by those engaged by the government only to the extent necessary to perform the work acquired; accordingly, this clause addresses basic requirements for the Contractor’s use and disclosure of government information, which expressly includes, but is not limited to, information provided by or obtained from the citizens. Anonymizing information does not resolve the foregoing concern. This clause should be broadly interpreted to effectuate this intent. Every obligation in this clause is material. Absent express reference to this clause, this clause supersedes any other clause to the extent of any inconsistency unless and to the extent the other clause provides greater protection for government information.

(a) Definitions. The terms used in this clause shall have the same meaning as the terms defined in the clause titled Information Security – Definitions.

(b) Legal mandates. Contractor shall be permitted to use, disclose, or retain government information to the limited extent necessary to comply with any requirement imposed on Contractor by law. If it is necessary for Contractor to use, disclose, or retain government information in order to comply with a law, Contractor shall provide using governmental unit with written notice, including a description of the circumstances and applicable law, in advance of such use, disclosure or retention except to the extent expressly prohibited by law.

(c) Flow down. Any reference in this clause to Contractor also includes any subcontractor at any tier. Contractor is responsible for, and shall impose by agreement the requirements of this clause on, any other person or entity that contractor authorizes to take action related to government information.

(d) Collecting Information. Contractor must gather and maintain government information only to the minimum extent necessary to accomplish the work.

(e) Rights, Disclosure and Use. Except as otherwise expressly provided in this solicitation, Contractor agrees NOT to either (1) use or disclose government information, or (2) retain government information after termination or expiration of this contract. Contractor acquires no rights in any government information except the limited rights to use, disclose and retain the government information in accordance with the terms of this solicitation. To the extent reasonably necessary to perform the work, Contractor may: (i) use (including access, process, transmit, and store) and maintain the government information itself; and (ii) disclose government information to persons having a need-to-know (e.g., subcontractors).