Attachment Two - Information Security Terms and Conditions.pdf

Attachment Two

Information Security Terms and Conditions

These additional terms and conditions are part of Contractor’s contractual obligations for an overall solution provided by the Contractor are in support of and incorporated herewith under Contract No. #. This

Attachment sets forth additional terms and conditions under which Contractor shall provide such Licensed

Services (“Licensed Services”) to the Virginia Lottery (Lottery).

I. DEFINITIONS

A. Acceptance: Successful delivery and performance by the Contractor of its contractual commitments at the location(s) designated in the Contract, including completed and successful Acceptance testing in conformance with the requirements of the Contract.

B. Application: The software programs in object code and other related data, including intellectual data, proprietary information and Documentation contained and applicable to Licensed Services hosted and supported by Contractor under the Contract, as described in Section III of the RFP, including any Updates, enhancements, and replacements to the Application.

C. Application users: Application Users shall include employees of the Lottery, independent contractors engaged by the Lottery, or entities contracting with the Lottery for services, as well as

Contractors, members of the general public, and other entities with whom the Lottery may find it necessary or desirable to process or communicate electronically in pursuit of its business.

D. Content: Any data, including the selection, arrangement and organization of such data, entered, uploaded to the Application, or otherwise provided to Contractor by the Lottery or by any Application

User, and any software and related documentation, from whatever source, provided by the Lottery or Application User to Contractor in connection with this Contract.

E. Licensed Services: The operation of the Application and the necessary operating system software, hardware and utilities on Contractor’s host computer system or third party cloud system, furnishing

Contractor Product to Application Users, storing Content and making the Application, Content, and

Contractor Product available to Application User(s) via the Web Site.

F. Contractor Product: Contractor’s proprietary reports, information and data made available to the

Lottery and its Application Users as part of the Licensed Services.

G. Update: As applicable, any update, modification or new release of the Application, documentation or Contractor Product that Contractor makes generally available to its customers at no additional cost. Software Updates include patches, fixes, upgrades, enhancements, improvements, or access mode, including without limitation additional capabilities to or otherwise improve the functionality, increase the speed, efficiency, or base operation of the Application and Licensed Services.

H. VITA: Virginia Information Technologies Agency

I. Web Site: The Internet site operated by Contractor to provide access to the Application, with the

Uniform Resource Locator (URL) specified in final requirements (or any successor URL(s)).

J. Documentation: Those materials (including user manuals, training materials, guides, product descriptions, technical manuals, product specifications, supporting materials and Updates) detailing the information and instructions needed in order to allow the Lottery and its users to make productive use of the Application and Licensed Services or deliverable, including any and all components, and to implement and develop self-sufficiency with regard to the Application and Licensed Services or deliverable, including any and all components, provided by Contractor in fulfilling its obligations under the Contract.

II. TERM AND TERMINATION

A. Scalability: The Lottery may make a written request to increase or decrease the scope (e.g., number of USERIDs) of Licensed Services (“revised usage”) under a change order to the Contract. The revised usage shall be effective not more than one (1) business hour following the request. Pricing for the revised usage of Licensed Services shall be calculated as provided in the Pricing Schedule of the Contract and shall be prorated on a daily basis for remaining portion of the current monthly billing period. For purposes of this provision, a written notice may include an e-mail or the use of a

Contractor-provided provisioning website by the Lottery’s designated administrator.

III. DESCRIPTION OF LICENSED SERVICES

During the term of this Contract, the Contractor hereby agrees to host the Application(s) listed and described and specified in the Contract on servers owned, operated, housed, and maintained by the

Contractor or approved third-party and shall make such Application(s) available to the Lottery’s designated Application Users through the Internet. Contractor has acquired any and all license rights in the Application(s) necessary and appropriate for Contractor to provide the Licensed Services as obligated by the Contract.

Contractor hereby grants to the Lottery and its Application Users a non-exclusive, transferable, worldwide license to access and use by any method the Application during the term of the Contract. The license fee for the rights shall be as set forth in the Pricing Schedule of the Contract and shall apply regardless of access mode.

Notwithstanding any other provision or other unilateral license terms which may be issued by Contractor after the Effective Date of the Contract, and irrespective of whether any such provisions have been proposed prior to or after the issuance of this Contract for Licensed Services, including access to the

Application(s), or the fact that such other agreement may be presented to the Lottery or its Application

Users at the time of accessing the Application(s) (“click wrap”), the terms and conditions set forth in this

Contract and any amendments or modifications thereto shall supersede and govern licensing and use of all products and services hereunder.

IV. CONTRACTOR RESPONSIBILITIES

A. Standard Application Responsibilities

Unless otherwise indicated in the requirements section of the Contract, Contractor shall acquire and maintain, at no charge to Lottery, the hardware and software required to host the Application(s). The hardware and software on which the Application(s) is hosted will be maintained in good operating condition, consistent with or exceeding generally accepted industry practices and procedures. In addition:

i. Contractor shall maintain sufficient hardware capacity to satisfy the technical requirements and the bandwidth and required storage capacity indicated in the requirements section of the

Contract.

ii. Contractor shall be responsible for all telecommunication connections from the server hosting the Application to the Internet.

iii. The Application will be made available to the Lottery and its designated Application Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime. For the purposes of this Contract, “Excusable Downtime” is defined as that period of time when the

Licensed Services are not available to the Lottery or its Application Users due to scheduled network, hardware or service maintenance and/or upgrades. Except in cases of emergency, the

Lottery shall be provided a two (2) business day advance notification of such maintenance and/or upgrade. In cases of emergency, Contractor will use its best efforts to notify the Lottery of a planned Downtime as soon as practicable. Maintenance or upgrades are not to exceed thirty-six

(36) hours in duration in a single month and cannot occur Monday through Friday, between the hours of 6:00 a.m. and 8:00 p.m. Eastern Time.

iv. Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the

Contractor’s Application, (iii) an electric utility failure at Contractor’s facility where the

Application is hosted, or (iv) a network failure up to, but not including, the interconnection point of Contractor’s network to the public switched telephone network.

v. Contractor shall be required to notify the Lottery in writing at least sixty (60) days prior to any planned change(s) or Update(s) to the Application; its functionality; Content storage/ backup/disaster recovery, including physical location; security architecture, features or settings;

terminations and/or replacement of any Contractor subcontractor. The planned changes or

Updates include any change(s) that would potentially impact the secure and efficient use of the

Application, as understood and agreed to between Contractor and the Lottery at Contract award.

The purpose of this notice is to allow sufficient time for Contractor and the Lottery to discuss any technical/functional considerations and/or changes that would require action by the Lottery.

vi. Contractor is responsible for documenting and maintaining any customizations made for operational use of the Application and/or for interoperability use with other systems or applications used by the Lottery and paid for solely by the Lottery. The associated technical data, code, documentation and other necessary information about such customizations shall be provided by Contractor to the Lottery within ten (10) business days of the customizations’ operational use. The Contractor shall be required to routinely transfer knowledge regarding the

Application and Licensed Services, including Updates and all material changes, to the Lottery in a reasonable manner to ensure proper and efficient use of Application and Licensed Services without degrading performance thereof. Contractor agrees to work with the Lottery to ensure compliance with any approved security exceptions or other identified gaps or requirements provided to the Lottery in writing by VITA or other agency of the Commonwealth of Virginia.

vii. Contractor shall not use any software, hardware or services which have been prohibited pursuant to § 2.2- 5514 of the Code of Virginia.

In addition, and at no additional cost to the Lottery, Contractor shall provide access to additional

Updates, features, and functionalities of the Application as are provided by Contractor to other customers of Contractor who require functionality similar to that of the Application provided to the Lottery. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Contractor website. Notwithstanding the provisions of this Section and except as agreed to in writing by the Lottery and Contractor, nothing in the Contract shall oblige Contractor to undertake any modifications to the Application, and all such modifications are at Contractor’s sole discretion whether suggested by the Lottery or another party.

B. Ancillary Responsibilities

Contractor shall, throughout the term of this Contract, make available such resources, including

Contractor personnel, as are reasonably required to: (i) train designated Lottery personnel in the use of the Application;

(ii) develop modifications to the Application as agreed to by the Lottery and Contractor in the

Contract or any exhibit hereto or as agreed to by Contractor and the Lottery; and (iii) otherwise support the Application as provided under this Contract and any exhibits hereto or as agreed to between Contractor and the Lottery.

V. LOTTERY RESPONSIBILITIES

Unless otherwise agreed and as applicable, the Lottery or its agent, or an Application User, will be responsible for input of Content into Contractor’s Application and the Lottery or its agent will be responsible for keeping said Content current and accurate. Contractor will have no responsibility for assisting the Lottery in creating, modifying or inputting the Content, unless specified by the Lottery.

If Contractor issues unique USERIDs and passwords to an Application User:

i. The Lottery is responsible for protecting said passwords and for any authorized and unauthorized use made of the passwords. The Lottery will fully cooperate with law enforcement authorities in the detection and prosecution of illegal activity related to unauthorized use of the Licensed

Services.

ii. The Lottery shall have the right to add, activate, change access for, or disable USERIDs at its sole discretion. The Lottery shall designate administrators who will be authorized to add, activate, change access for or disable USERIDs.

iii. Upon notification by the Lottery of an Application User’s disabled access, Contractor shall remove access authorization by said Application User from its server within one (1) hour of receipt of such notification, ensuring that historical access audit details of such Application User shall not be deleted or lost. If Contractor fails to make such a removal of access, the Lottery shall not be held liable for any charges or damages incurred due to use of the unauthorized USERID.

iv. The Lottery and Application Users of this Contract agree to notify Contractor of any degradation, potential breach, or breach of the Content and Application privacy or security as soon as possible after discovery. The Lottery further agrees to provide Contractor the opportunity to participate in the investigation of the reported situation.

VI. CONTENT PRIVACY AND SECURITY

Contractor shall provide a secure environment for Content and any hardware and software, including servers, network and data components provided by Contractor as part of its performance under this

Contract. Contractor shall provide a secure environment for Content and any hardware and software in accordance with Commonwealth’s security policies and standards in order to prevent unauthorized access to and use or modification of, and to protect, the Application and Content. Contractor agrees that all Content of the Lottery is intended solely for the business of the Lottery and is considered private data. Therefore, Contractor shall, at a minimum, implement the following procedures designed to protect the privacy and security of Content:

A. User identification and access controls designed to limit access to Content to Application Users in accordance with the principles of least privilege.

B. Contractor shall ensure that all personnel with physical or logical access to Content will receive industry standard annual security awareness training and all other training as required by Content owner, Commonwealth security standards, regulation, or law.

C. Contractor shall ensure that the Application and/or Licensed Services are capable of auditing the following events: Successful and unsuccessful account logon events; account management events;

object access; policy change; privilege functions; process tracking; and system events.

D. Contractor shall ensure that the Application and/or Licensed Services are capable of auditing the following events, for Web applications: All administrator activity; authentication checks;

authorization checks; data deletions; data access; data changes; and permission changes.

E. Contractor shall ensure that the Application and/or Licensed Services employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the Application and/or Licensed Services to support organizational processes for investigation, alerting and response to suspicious activities.

F. Contractor shall ensure that the Application and/or Licensed Services support exporting of log files to the Lottery for review and analysis.

G. Contractor shall ensure that the Application and/or Licensed Services are capable of maintaining all audit records in accordance with Commonwealth of Virginia record retention policies.

H. Provide evidence of a comprehensive continuous monitoring program encompassing all systems with access to Content.

I. Provide evidence that the Application and/or Licensed Services adhere to a security baseline, which is based on least functionality.

J. Contractor shall ensure that all changes to proposed Application and/or Licensed Services are authorized according to change management policies.

K. Contractor agrees to maintain all metadata associated with any original Content submitted into the

Application and/or Licensed Services by the Lottery for easy retrieval and access, using secure industry standard protocols, within a predefined period as specified in the Contract.

L. Contractor agrees to provide a secure method of exporting Content when requested.

M. Contractor shall ensure that the Content exported from the Contractor’s Application or infrastructure is in an industry standard format that provides for interoperability and portability.

N. Contractor shall ensure that the Application and/or Licensed Services provides and maintains a backup of Content that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives, as specified in the Contract.

O. Contractor shall ensure that the Application and/or Licensed Services can store a backup of Content, at least daily, in an off-site “hardened” facility, located within the continental United States, maintaining the security of the Content.

P. Implement a contingency plan designed to maintain the access to the Application and/or Licensed

Services and to prevent the unintended destruction or loss of Content. This plan should provide a predefined frequency, consistent with recovery time and recovery point objectives, as specified in the

Contract, for disaster recovery and archival purposes of Content at a secure facility located within the continental United States.

Q. Contractor shall partition, in aggregate for this contract, all Content submitted into the Application and/or Licensed Services by the Lottery in such a manner that it will not be impacted or forfeited due to E-discovery, search and seizure or other actions by third parties obtaining or attempting to obtain records, information or Content for reasons or activities that are not directly related to the business of the Lottery.

R. Service must support multi-factor authentication for access to any administrative portal and/or any remote administrative interface.

S. Contractor shall fully cooperate with Lottery and all required law enforcement personnel and/or the

Lottery’s insurer, Lottery counsel, outside counsel, or cybersecurity firm(s), for assistance in the handling and reporting of security incidents.

T. Contractor shall maintain an incident response program that implements incident handling for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes.

U. Incident response must have the capability to support automated mechanisms for supporting incident handling processes.

V. Contractor shall provide quarterly summary reports of Intrusion Detection System (IDS) and

Intrusion Prevention System (IPS) events to: info_security@valottery.com.

W. Contractor ensures that all Content is removed or destroyed in accordance with and/or exceeding the requirements of the commonwealth Data Removal standard.

X. Contractor shall support physical security measures, including securing all Content on a secure server, in locked data cabinets within a secure facility located within the continental United States.

Y. Contractor shall ensure that access to facilities housing Content or supporting applications are restricted to only allow access to Contractor’s personnel and agents who have a need to know in connection with operation and support of the Application and/or Licensed Services.

Z. Contractor shall ensure that notification is sent to the Lottery in writing thirty (30) days prior to its intention to replace or add any third-party that will be provided access to Content whether that access is provided by Contractor or Contractor’s subcontractors. The Lottery may reject any additional or new third parties who may be provided access to Content.

AA. Contractor shall ensure that the Application and/or Licensed Services operating systems, middleware, applications, and interfaces will be scanned for vulnerabilities every thirty (30) days and scanning reports be provided to the Lottery as required by Commonwealth security standards.

BB. Application and/or Licensed Services must have the capability to set affinity on tiered systems.

Contractor ensures that no one hypervisor can host the application and the data storage.

CC. Contractor shall ensure that all Content is stored, processed and maintained within the continental

United States at all times.

DD. Contractor shall report the exact geographic location of all Lottery data and shall provide a report to the Lottery to confirm the exact geographic location every 30 days.

EE. Contractor shall, at all times, comply with all security requirements defined by the Virginia

Information Technologies Agency Information Technology and Risk Management standards, policies, and guidelines.

FF. Contractor shall ensure performance of an AICPA SOC-2 (Type 2) audit at least once annually of mailto:info_security@valottery.com the Application’s environment. Upon request from the Lottery, Contractor shall provide a non-redacted copy of current AICPA SOC-2 (Type 2) audit. Contractor shall assist the Lottery in obtaining the current AICPA SOC-2 (Type 2) audit report from any third-party providing services to Contractor, if said third-party services involve the processing or storage of any Content. The Trust

Service Principles that should be covered in the SOC -2 Type 2 are: Security, Availability, Processing Integrity, Privacy and Confidentiality.

II. Contractor understands that the Lottery or a third-party audit organization may be responsible for performing a security audit within 90 days after contract award to determine control gaps between the supplied audit and the Information Security Standard (SEC530). If no audit is supplied, a complete security controls audit utilizing SEC530 may be required. Failure to do so may result in termination of the Contract.

JJ. Contractor shall ensure that external connections incorporated into the Application and/or Licensed

Services have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Contractor.

KK. Contractor shall ensure that the Application and/or Licensed Services will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through.

LL. Contractor shall ensure that the Application and/or Licensed Services will use industry standard encryption techniques to protect Content that is transmitted or stored on behalf of the Lottery.

MM. Contractor shall ensure that they will apply all security updates to their systems as required by Commonwealth of Virginia Information Security Standards.

NN. Contractor shall ensure that they will utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to Content.

OO. Contractor shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files from the software vendor.

PP. Within fifteen (15) business days after the expiration or termination of this Contract, Contractor shall confirm in writing to the Lottery that all Content has been removed from all systems where the

Content resided during performance of this Contract in a manner that complies with and/or exceeds the Commonwealth Data Removal standard. The written confirmation shall include (i) sufficient detail describing the processes and procedures used in removing the Content, (ii) information about the locations of where it was removed from within the Application and storage and other locations, and (ii) the date the removals were performed. All metadata, in its original form, shall be returned to the Lottery.

QQ. Contractor agrees to provide written notice within 24 hours to the Lottery of all incidents that threaten or could potentially threaten the security of the Lottery’s Content and/or use of the

Licensed Services. This notice is required to allow the Lottery to commence any necessary internal actions to remediate such incident, which may include a temporary suspension of use of the

Licensed Service. If a suspension of use becomes necessary, the Contractor further agrees not to impose any penalty on the Lottery or the Commonwealth.

RR. Audit controls that record and monitor Application and Licensed Services activity continuously.

SS. Should Contractor fail to perform in compliance with any provision of this Section, the Lottery may provide Contractor with a written notice to cure. Contractor shall have fifteen (15) days to cure its noncompliance, or with agreement from the Lottery, in its governance role, may request a reasonable extension for time to cure providing the Lottery with a written plan of action to cure. If the

Contractor fails to cure, the Lottery may deem Contractor in breach and/or default of the Contract and may immediately terminate the Contract, in whole or in part. Upon such termination, the, Lottery shall not have any future liability except the Lottery will be responsible for deliverables accepted by the Lottery, and Licensed Services rendered to the Lottery by Contractor. In the event of such termination, Contractor shall accept return of any deliverable that was not accepted by the

Lottery, and Contractor shall refund any monies paid by the Lottery for such deliverable and for any unused, remaining term paid for in advance by the Lottery for the Licensed Services up to the date of such termination. Contractor agrees that the Lottery may pursue all remedies provided under law in the event of a breach or threatened breach of this Section, including re-procurement or transition costs or injunctive or other equitable relief.

VII. PROPRIETARY RIGHTS

A. Contractor’s Proprietary Rights

Except as otherwise stated herein, the Licensed Services (including without limitation, the

Application and Updates, and Contractor Product, except to the extent that Contractor Product contains Content) and Documentation are the sole and exclusive property of Contractor and its licensors. All modifications, enhancements, Updates, and translations of the Licensed Services shall be deemed a part thereof.

B. Lottery Requirements and License Restrictions

Except as otherwise provided in this Contract or as provided by law:

i. The Lottery will use commercially reasonable efforts to ensure that Application Users comply with all of the terms and conditions hereof;

ii. The Lottery shall not reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from any of the software comprising or in any way making up a part of the Application;

iii. The Lottery shall not directly or indirectly copy or reproduce all or any part of the Application, whether electronically, mechanically or otherwise, in any form including, but not limited to, the copying of presentation, style or organization, without prior written permission from Contractor;

provided, however, the Lottery may reproduce and distribute any Application output generated from the Lottery’s Content, and an Application User may reproduce and distribute any

Application output generated pursuant to the permissions set forth in the Contract;

iv. The Lottery shall not rent, lease, sublicense, resell for profit, loan, distribute, network or modify the Application or Contractor Product or any component thereof, provided as part of the

Licensed Services, except as otherwise authorized by Contractor. However, the Lottery may reproduce and distribute any Application output (e.g., reports) generated by the Lottery using the

Application, and an Application User may reproduce and distribute any reports or output generated by the Application User using the Application and pursuant to the permissions in the

Contract;

v. The Lottery shall only use the Application and Contractor Product in the normal course of business, in connection with, and as part of, the Licensed Services;

vi. The Lottery shall not attempt to gain unauthorized access to the Application or Licensed Services, other user accounts, computer systems or networks connected to the Licensed Services;

vii. The Lottery shall not remove, obscure or alter Contractor’s proprietary notices, disclaimers, trademarks, or other proprietary rights notices of any kind affixed or contained in the Application or Licensed Services or any written or electronic report, output or result generated in connection with the Licensed Services;

viii. The Lottery shall take reasonable care not to, and shall not intentionally or knowingly, use the

Application to post, transmit, distribute, store or destroy any information: (i) in violation of any applicable law, statute, ordinance or regulation; (ii) in a manner that shall infringe the intellectual property rights of others; (iii) that is defamatory or trade libelous, or (iv) that contains any

Computer Viruses;

ix. The Lottery shall not use the Application or Licensed Services for any illegal, obscene, offensive or immoral purpose.

C. Lottery Proprietary Rights

Except as otherwise stated herein and with the exception of any applicable third-party rights, Content and any customizations made for the Lottery’s operation of the Application or for interoperability with other Lottery systems or applications paid for by the Lottery, are and shall remain the sole and exclusive property of the Lottery, including all applicable rights to patents, copyrights, trademarks, trade secrets or other proprietary property rights thereto. Additionally, all right, title and interest in and to any Content or customizations relating to (Lottery) business shall remain the property of the

Lottery, whether or not supplied to Contractor or uploaded into the Application. Nothing in this

Contract shall be construed as conveying any rights or interest in Content or customizations to

Contractor. Upon termination of the Contract, Contractor agrees to either provide the Content and customizations to the Lottery, or, at (Lottery’s) request, certify in writing that said Content and customizations in all formats, have been destroyed.

VIII. CLOUD EXIT ASSISTANCE

Upon execution of this Contract, Contractor and the Lottery will develop an exit plan (“Exit Plan”) detailing each party’s respective tasks for the orderly transition and migration of all Content stored by

Contractor pursuant to the Contract to the Lottery’s archive and/or to a system or application maintained by the Lottery.

At a minimum, the Exit Plan must provide that within thirty (30) days of the expiration or termination of this Contract for any reason, Contractor shall return all Content in its possession provided to Contractor by the Lottery and/or its Application Users and stored by the Application on behalf of the Lottery to the

Lottery in a format accessible without the use of Contractor’s Application. Contractor’s failure to do so will constitute a material breach of this Contract and the Lottery may exercise all available rights and remedies under law and equity, in addition to any remedies set forth in this Contract.

In addition, at the Lottery’s option, Contractor shall continue to provide Licensed Services for up to six

(6) months after the date of expiration or termination of the Contract in order to facilitate the Lottery’s transition to another service model or provider. Contractor shall also provide such reasonable assistance as may be requested by the Lottery and agrees such assistance will not be unreasonably withheld.

Contractor shall perform such assistance at the hourly rate or a charge agreed upon by Contractor and the

Lottery. In the event of a termination for breach by Contractor, Contractor shall provide the transition assistance at no charge or fee to the Lottery.

IX. COMMENCEMENT AND ACCEPTANCE LICENSED SERVICES

A. Licensed Services Commencement Date

The Contractor shall begin delivery of Licensed Services on the date requested by the Lottery and agreed to by the Contractor in the Contract, unless otherwise agreed upon.

B. Acceptance

“The Application shall be deemed accepted when the Lottery reasonably determines that such Lottery and its Application Users can successfully access and use all functionalities of the Application which

Contractor is required to provide to such Users. The Lottery agrees to complete Acceptance testing within thirty (30) days after receiving written notice from Contractor of the ability of the Lottery and its Application Users to access the Application, or within such other period as set forth in the applicable order or SOW. Contractor agrees to provide to the Lottery such assistance and advice as the Lottery may reasonably require, at no additional cost, during such Acceptance testing, other than pre-approved travel expenses. The Lottery shall provide to Contractor written notice of Acceptance upon completion of successful Acceptance testing. Should the Lottery fail to provide Contractor written notice of successful or unsuccessful Acceptance testing within five (5) business days following the Acceptance testing period, the Service shall be deemed Accepted.

C. Cure Period

If during the Acceptance test period, the Lottery is unable to access the licensed functionalities of the

Application, Contractor shall provide the Lottery with such access, and the Lottery’s Application

Users with their required access, within seven (7) days of written notice of inability to access, or as otherwise agreed between the Lottery and Contractor in the Contract. Should Contractor fail to provide access to the licensed functionalities of the Application, the Lottery may, in its sole discretion: (i) reject the Application in its entirety and recover amounts previously paid hereunder;

(ii) issue a “partial Acceptance” of the Application access with an equitable adjustment in the price to account for such deficiency; or (iii) conditionally accept the applicable Application access while reserving its right to revoke Acceptance if timely correction is not forthcoming.

If the Lottery and its Application Users are unable to access the licensed functionalities of the

Application after a second set of acceptance tests, Contractor shall be deemed in default of the

Contract. In the event of such default, the Lottery may, at its sole discretion, terminate the Contract, in whole or in part, for the Licensed Services to be provided thereunder by Contractor.

X. RECORDS AND AUDIT

Contractor shall maintain accurate records and other evidence pertaining to the costs and expenses for all Licensed Services performed/delivered under this Contract in support of its charges invoiced to the

Lottery. The records will be to the extent and in such detail as will properly reflect all direct and indirect costs associated with the Contract. In addition, Contractor shall maintain accurate records of the Licensed

Services, including but not limited to, the “Uptime” and “Downtime” as set forth in the Contractor

Responsibilities Section. The Lottery and/or the Commonwealth Auditor and/or or their representatives shall have the right, at any reasonable time during regular business hours after giving reasonable advance notice, to inspect and audit the records applicable to the Contract, at no cost to the Lottery or the

Commonwealth.

XI. APPLICATION AND LICENSED SERVICES SUPPORT

At any time during the term of this Contract, Contractor shall provide the following Application Services

(including unlimited telephonic support and all necessary travel and labor) without additional charge to the Lottery in order to ensure the Lottery and its Application Users are able to access and use the

Application in accordance with the requirements of the Contract.

A. Coverage

During the hours of 8:00am – 5:00pm ET, Contractor will provide to Application Users all reasonably necessary telephone or written consultation in connection with use, problems and operation of the

Application.

B. Application Evolution

Should Contractor merge or splinter the Application previously provided to the Lottery, such action on the part of Contractor shall not in any way result in the Lottery being charged additional license or support fees in order to access the Application, to enable its Application Users to access the

Application, or to receive enhancements, releases, upgrades or support for the Application.

C. Reporting Requirements

i. Monthly Reports:

By the 5th of each calendar month during the term of this Contract, Contractor shall provide the

Lottery with the following written monthly reports:

a) Service Level Performance Report - a report that contains information with respect to the performance of the Application and Licensed Services. Such report, unless otherwise agreed upon by the parties, shall be in conformity with the reporting Contractor provides to its other customers utilizing an application and licensed services identical or similar to the

Application and Licensed Services provided to the Lottery.

b) System/Application Patching Compliance Report – a report that illustrates that the

Contractor has installed security relevant software and firmware updates within thirty (30) days of the release of the updates.

c) Scanning Reports (OS, Middleware, Applications and Interfaces) Report – a report that illustrates vulnerability scanning of Cloud Service Providers Operating

Systems/infrastructure, databases and web applications.

d) Geographic Locations of Data Being Hosted Report – a report that illustrates the location of Lottery data.

ii. Quarterly Reports:

By the 5th day of the first month of a calendar quarter, during the term of this Contract, Contractor shall provide the Lottery with the following written quarterly report

a) Summary Report of Intrusion Detection Scans and Intrusion Prevention Scans – a report that demonstrates that Contractor protects Lottery data with intrusion monitoring tools from unauthorized access, modification and deletion.

Contractor shall submit a copy of each report to the Lottery at:

info_security@valottery.com

Representatives of Contractor and Lottery shall meet as often as may be reasonably requested by either party, but no less often than once each calendar year during the term of this Contract, to review Contractor’s performance of Licensed Services and the performance of the Application and to discuss technical plans, financial matters, system performance, service levels and any other matters related to the above required reports and to this Contract in general that may be reasonably requested by either Contractor or

Lottery. Contractor shall notify the Lottery of such meetings by email to:info_security@valottery.com. The Lottery may independently audit the report at its expense no more than two (2) times annually.

Failure to submit the required reports will place Contractor in breach of Contract and the

Contract may be immediately terminated by the Lottery and the Contractor/Application will be removed from the Approved Application List.

D. Failure to Meet Service Level Commitments

In the event that such Application fails to meet the Service Levels specified herein, Contractor will:

(i) promptly replace the Application with an Application that conforms to this Contract and such specifications; (ii) repair the Application, at Contractor’s expense, so that it conforms to this Contract and such specifications; or (iii) refund to the Lottery all fees paid for the Application and the Licensed

Services after the failure of the Application to meet the Service Levels. In the event Contractor fails to comply with these remedies, the Lottery may exercise all available rights and remedies under law and equity.

XII. CYBER SECURITY LIABILITY INSURANCE

In addition to other insurance coverage requirements in the Contract, Contractor shall carry Cyber

Security Liability insurance coverage in the amount of $5,000,000 per occurrence.

XIII. CUSTOM CODE

If Contractor is not providing custom built source code for the Application, the provision below will be deleted and replaced with this language: “Contractor is providing a General Use or COTS Application and no custom- built source code is authorized under this Contract. Therefore, Application Escrow is not required.”

If the Contractor will provide custom built source code for the Application, the Lottery will become custodian for all custom built source code. Upon termination of the Contract, Lottery will retain ownership of the custom built code and is allowed to continue to use custom built code. Additionally, Contractor shall:

i. Provide all Documentation related thereto as well as all necessary and available information, proprietary information must be in English,

ii. Provide technical documentation which must be in English and shall enable the Lottery, or an agent of the Lottery to create, maintain and/or enhance the software without the aid of the

Contractor or any other person or reference to any other materials, maintenance tools (test programs and program specifications), or proprietary or third-party application utilities

(compiler and assembler descriptions); descriptions of the system/program generation; and descriptions of any Contractor tools required to enable the Lottery to continue to use the software, XIV. CLOUD SERVICES WARRANTY

Contractor warrants and represents to the Lottery that Contractor will fulfill its contractual obligations and meet all needed requirements as described in the Contract as follows:

A. Licensed Services, Application and Documentation

Contractor warrants the following with respect to the Licensed Services and the Application:

i. The Application is pursuant to a particular Request for Proposal (“RFP”), and therefore such

Application shall be fit for the particular purposes specified by the Lottery in the RFP and in the Contract. Contractor is possessed of superior knowledge with respect to the Application and is aware that the Lottery is relying on Contractor's skill and judgment in providing the Licensed

Services, including the Application.

ii. Contractor represents and warrants (i) that it shall perform the Licensed Services in conformity to the specifications set forth in the requirements of this Contract in a professional and workmanlike manner and (ii) that the Licensed Services shall not infringe any third-party proprietary rights including (without limitation) any trademark, trade name, trade secret, copyright, moral rights, patents or similar intellectual property rights.

iii. Contractor warrants that the Application and Licensed Services will conform in all material respects to the requirements set forth in this Contract. Contractor warrants that the Application and Licensed Services will conform to the applicable specifications and documentation, not including any post-Acceptance modifications or alterations to the documentation which represent a material diminishment of the functionality of the Application, Licensed Services or

Contractor Product. Contractor also warrants that such Application and Licensed Services are compatible with and will operate successfully when used on the equipment in accordance with the documentation and all of the terms and conditions hereof.

iv. The Application provided hereunder is at the current release level unless the Lottery has specified an older version in the Contract;

v. No corrections, work-arounds or future Application releases provided by Contractor shall degrade the Application, cause any other warranty to be breached, or require the Lottery to acquire additional hardware equipment, software, or licensed services;

vi. Contractor warrants that all post-Acceptance Updates, changes, alterations or modifications to the Application, Licensed Services and documentation by Contractor will be compatible with, and will not materially diminish the features or functionality of the Application, Licensed

Services and/or Contractor Product when used on the equipment in accordance with the documentation and all of the terms and conditions hereof.

vii. Contractor warrants that the Documentation and all modifications or amendments thereto which

Contractor is required to provide under this Contract shall be sufficient in detail and content to allow a user to understand and utilize fully the Application without reference to any other materials or information.

B. Privacy and Security

Contractor warrants that Contractor and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Application, Licensed

Services, Contractor Product, and any related deliverables do not include any degradation, known security vulnerabilities, or breach of privacy or security. Contractor agrees to notify the Lottery of any occurrence of such as soon as possible after discovery and provide the Lottery with fixes or upgrades for security vulnerabilities within ninety (90) days of discovery.

C. Operating System and Software Supportability

Contractor warrants that Contractor and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Application, Licensed

Services, Contractor Product, and any deliverables do not have dependencies on other operating systems or software that are no longer supported by Contractor, or its Subcontractors, partners and third-party providers.

D. Access to Product and Passwords

Contractor warrants that the Application and Licensed Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Application, Licensed Services or the hardware or software of the Lottery or its Application Users. In addition, Contractor warrants that the Lottery and its

Application Users will be provided commercially reasonable uninterrupted access to the Application.

Contractor also warrants that it will not cancel or otherwise terminate access to the Application by disabling passwords, keys or tokens that enable continuous use of the Application by the Lottery and its Application Users during the term of this Contract. Contractor further warrants that the

Application and Licensed Services are compatible with and will operate successfully on the equipment.

XV. ACCEPTABLE USE POLICY (IF APPLICABLE)

The Lottery agrees to abide by Contractor’s Acceptable Use Policy (AUP), as amended by the parties hereby and incorporated by “Exhibit” in the Contract. Because certain standard clauses that may appear in, or be incorporated by reference into, Contractor’s standard AUP cannot be accepted by the Lottery, and in consideration of the convenience of using that form, and this Contract, without the necessity of specifically negotiating a separate contract document, the parties hereto specifically agree that:

i. In the event of a conflict between this Contract and the AUP, the Contract shall control;

ii. In the event of a material, unilateral revision of the AUP by Contractor that substantially impairs the ability of the Lottery from its lawful use of the Service, the Lottery shall have the option to:

a. request that the revision be rescinded; or

b. request that the revision be waived as to the Lottery receiving Services under this Agreement;

If Contractor fails to a grant request by the Lottery per a. or b. above, within thirty (30) days of receiving the request, then the Lottery may, at its option, terminate this Contract, in whole or in part, without termination liability.

XVI. THIRD-PARTY TERMS AND CONDITIONS

Should Contractor’s provision of the Licensed Services or any performance obligations under the

Contract include third-party terms and conditions, the aforementioned referenced Commonwealth security policies standards and guidelines; i.e., SEC501 and SEC525, shall take precedence over any third-party terms and conditions. For the purposes of statutory law as referenced and incorporated in the

Contract, if there is any conflict with any third- party terms, such statutory law shall govern.