BEN-25-048 Exhibit E Cloud Terms and Conditions .docx

Exhibit E

COMMONWEALTH OF VIRGINIA

CLOUD TERMS AND CONDITIONS

These additional terms and conditions for provision of Software as a Service, as part of the contractual obligations of TBD (“Supplier”), for an overall solution provided by the Supplier are in support of and incorporated herewith under Contract No. BEN-25-048. This Attachment (“Attachment”) sets forth additional terms and conditions under which Supplier shall provide such Cloud Services (as hereinafter defined) to Public Body.

In the event of any conflict or inconsistency between the Commonwealth of Virginia Cloud Terms and Conditions and any other contract provisions or terms, any Supplier policy, or any third-party term or condition, the Commonwealth’s Cloud Terms and Conditions shall be controlling.

1. Definitions As used in the following terms:

a) “Active Oversight” refers to the ongoing monitoring process conducted by the COV Ramp team, which involves reviewing compliance reports regularly submitted by the application vendor.

b) “Approved Application List” means the catalog of applications available on the VITA website that have successfully completed the COV Ramp assessment and met the required standards. To remain on this list, applications must comply with the following conditions:

1. the vendor must agree to the established cloud terms, and

2. the application must achieve Active Oversight status within one year of approval

c) “Cloud Services” means, (insert the name of the Cloud Services), the application(s) and/or services that Public Body subscribes to, licenses, or otherwise obtains from Supplier and that are not hosted in a Commonwealth of Virginia facility.

d) “Content” means any data (including the selection, arrangement, and organization of such data) entered, uploaded, or otherwise provided to Supplier by Users.

e) “Contract” means these Commonwealth of Virginia Cloud Terms and Conditions and all other documents that constitute the public contract between Supplier and Public Body for the procurement of the Cloud Services.

f) “Supplier” means (insert name), the entity with which Virginia Department of Social Services “VDSS” is contracting.

g) “Users” means personnel of Public Body (whether employees or independent contractors) and other persons who are authorized by Public Body to access or use the Cloud Services or who are persons with whom Public Body may find it necessary or desirable to interact through or in connection with the Cloud Services in pursuit of its business.

2. Compliance with Commonwealth Standards:

The Cloud Services shall be provided in compliance with Commonwealth of Virginia (hereinafter “Commonwealth”) information security standards SEC530 (Information Security Standard) and SEC514 (Removal of Commonwealth Data from Electronic Media Standard), current versions of which are located on VITA’s public website (https://www.vita.virginia.gov) under Information Security. In addition, Supplier shall ensure that the Cloud Services are not provided in any way that prevents Public Body from compliance with other Commonwealth security standards

Supplier shall comply with the following contractual requirements:

<insert any contractual requirements resulting from Cloud Service/COV RAMP Assessment>

3. Prohibited Information Technology:

In accordance with Virginia Code § 2.2-5514, Supplier shall not use any hardware, software, or services that have been prohibited for use on Commonwealth systems. Further information on prohibited information technology is available in Commonwealth Information Security Policy SEC 528.

4. Content Privacy and Security:

Supplier shall provide the Cloud Services in a secure environment that protects the privacy and security of the Cloud Services and of the Content.

Supplier understands that Content is intended solely for the business of Public Body and is subject to certain confidentiality and/or privacy protections under Virginia law. Accordingly, Supplier agrees to consider all Content of Public Body private data and not to disclose Content other than as authorized in writing by Public Body or required by applicable law. If required by applicable law to disclose Content, Supplier agrees to provide written notice in advance to Public Body unless Supplier is prohibited by law from providing such notice.

Supplier shall, at all times, remain compliant with privacy and security requirements of applicable federal, state, and local law.

5. Geographic Restriction on Content and Personnel:

All Content shall be stored, processed, and maintained within the United States at all times.

6. Return and Destruction of Content:

Using secure and usable protocols and methods, and in a usable electronic format, Supplier shall enable the export of Content (including associated metadata) to Public Body promptly upon request and at the conclusion of the Contract, without additional financial or contractual requirements.

If Supplier does not have a written, publicly accessible, and binding policy concerning destruction of data sufficient to demonstrate destruction of Content after the expiration or termination of the provision of the Cloud Services to Public Body, then within fifteen (15) business days after the expiration or termination of this Contract, Supplier shall confirm in writing to Public Body that all Content has been removed from all systems where the Content resided during provision of the Cloud Services in a manner that complies with and/or exceeds SEC514, the Commonwealth Data Removal standard. The written confirmation shall describe (i) the processes and procedures used in removing the Content, (ii) the locations from which it was removed, and (iii) the date the removals were performed.

7. Incident Reporting and Cooperation:

Supplier agrees to notify Public Body in writing of all incidents related to Public Body’s tenant environment or the Cloud Services that threaten or could potentially threaten the security of Public Body's Content and/or Public Body’s use of the Cloud Services. Notice for each incident shall be provided within 24 hours from when the incident was discovered. This notice is required to allow the Commonwealth to commence any necessary internal actions to address or remediate such incident. Supplier shall fully cooperate with Commonwealth incident response and law enforcement personnel as needed with respect to the handling and reporting of security incidents. If a temporary suspension of use of the Cloud Services by Public Body, as directed by the Chief Information Officer of the Commonwealth (“CIO”), becomes necessary related to a security incident, the Supplier further agrees not to impose any penalty on Public Body.

8. Prior Notifications In order to allow sufficient time to consider and discuss significant changes, Supplier agrees to provide written notification to Public Body and VITA in advance as follows:

a) At least thirty (30) days’ notice prior to replacing or adding a subcontractor or any other third-party that will have Non-public Access to Content.

b) At least 60 days’ notice prior to a material change in the security of the Cloud Services (as measured against the initial COV RAMP security assessment).

9. Required Reporting Supplier agrees to provide the following reporting to Public Body at enterpriseservices@vita.virginia.gov for the COV Ramp Active Oversight of the Cloud Services.

a) Annual Active Oversight reports:

1) For the hosting environment in which Commonwealth Content is stored, a current, unredacted AICPA SOC 2, Type II report covering the Trust Service Principles of Security, Availability, Processing Integrity, Privacy and Confidentiality.

2) For the Cloud Services, a 3rd party audit (SOC 2, Type II, covering the foregoing Trust Service Principles);

b) Active Oversight reports:

By the 5th of each month, Supplier shall provide:

1) On a monthly basis: summaries of:

SLA performance (for the performance standards set forth in this document Table of Service Levels and Remedies for Cloud Services

i. vulnerability scanning results,

ii. patching results (including compliance with patching within 30 days), and

iii. the geographic location of Commonwealth Content (for Content not stored in a Commonwealth facility);

2) On a quarterly basis: summary of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events;

Supplier shall provide such reports by (i) email to enterpriseservices@vita.virginia.gov; (ii) a mutually acceptable secure transfer mechanism; or (iii) maintaining a portal or website where Public Body can obtain such information periodically as needed.

Should Supplier fail to perform in compliance with any provision of this Section, Public Body and Supplier will follow the Cure and Termination process as defined in the Contract. Additionally, if Public Body deems Supplier in breach and/or default of the Contract, the Cloud Services will be removed from the Approved Application List.

11. Truthfulness and Accuracy:

Supplier certifies that the answers provided on the COV RAMP assessment questionnaire and the information Supplier is required to report above are and will be accurate and complete.

12. Data Protection and Publicity:

Supplier may collect and use data specific to Users only as necessary to provide the Cloud Services under the Contract. No information regarding Public Body’s or any User’s use of the Cloud Services, shall be disclosed, provided, rented, or sold by Supplier to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation extends for as long as Supplier possesses such User-specific data, including any period of possession beyond the term of the Contract. Supplier may mention that Public Body is a user of the Cloud Services, or publish a case study, testimonial, or other text regarding use of the Cloud Services by Public Body, so long as Supplier obtains Public Body’s advance review and written approval of the intended mention or published text.

13. Warranties:

a) Cloud Services and Documentation Supplier warrants the following with respect to the Cloud Services:

The Cloud Services are obtained pursuant to a particular Request for Application (RFA), and therefore such Cloud Services shall be fit for the particular purposes specified by Public Body in the RFA and in the Contract. Supplier is possessed of superior knowledge with respect to the Cloud Services and is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services.

i. Supplier warrants that the Cloud Services will conform to the applicable specifications and documentation, not including any modifications or alterations to the documentation that represent a material diminishment of the functionality of the Cloud Services and that are made after the time of contracting. Supplier is possessed of superior knowledge with respect to the Cloud Services, is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services and will provide the Cloud Services in a professional and workmanlike manner.

ii. Any software included in the Cloud Services is at the current release level unless Public Body has specified an older version in the Contract;

iii. Supplier shall not introduce any corrections, work arounds, or future releases that shall degrade the Cloud Services, cause any other warranty to be breached, or require Public Body to acquire additional hardware equipment, software, or services without prior approval from the Public Body. Notifications about such changes will be communicated to the Public Body at least 30 days in advance.;

iv. Supplier warrants that all updates, changes, alterations, or modifications to the Cloud Services after the time of contracting will be compatible with, and will not materially diminish, the features or functionality of the Cloud Services when used in accordance with the documentation and the Contract.

v. Supplier warrants that the documentation and all modifications or amendments thereto which Supplier is required to provide under this Contract shall be sufficient in detail and content to allow a user to understand and utilize fully the Cloud Services without reference to any other materials or information.

b) Privacy and Security Supplier warrants that Supplier and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not include any degradation or known security vulnerabilities. Supplier agrees to notify Public Body of any occurrence of such as soon as possible after discovery and provide Public Body with fixes or upgrades for security vulnerabilities within 90 days of discovery.

c) Operating System and Software Supportability Supplier warrants that Supplier and its employees, subcontractors, partners and third party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not have dependencies on other operating systems or software that are no longer supported by Supplier, or its subcontractors, partners, and third-party providers.

d) Access to Product and Passwords Supplier warrants that the Cloud Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code, which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Cloud Services or the hardware or software of Public Body or its Users. In addition, Supplier warrants that Public Body and its Users will be provided commercially reasonable uninterrupted access to the Cloud Services. Supplier also warrants that it will not cancel or otherwise terminate access to the Cloud Services by disabling passwords, keys, or tokens that enable continuous use of the Cloud Services by Public Body and its Users during the term of this Contract.

14. Rights in Cloud Services:

Supplier has acquired any and all rights in the Cloud Services necessary and appropriate for Supplier to provide the Cloud Services as provided in the Contract, and the Cloud Services do not infringe any third party proprietary rights including (without limitation) any trademark, trade name, trade secret, copyright, moral rights, patents or similar intellectual property rights.

Supplier hereby grants to Public Body and its Users all rights necessary to access and use the Cloud Services during the term of the Contract. The fee for the rights shall be as set forth in the Pricing Schedule of the Contract and shall apply regardless of access mode.

VDSS is an agency, as defined by §2.2-2006 or a legislative, judicial, or independent agency of the Commonwealth, or a board, commission, or other quasi-political entity of the Commonwealth of Virginia or other body referenced in Title 2.2 of the Code of Virginia, and as such, any licenses shall be held by the Commonwealth.

15. Subcontractors:

With respect to any subcontractors, including but not limited to subprocessors, Supplier uses in the provision of the Cloud Services:

a) Supplier is responsible for (i) the performance of such subcontractors, and (ii) such subcontractors’ compliance with the terms and conditions of this Contract.

b) Except for subcontractors named in writing at time of Contract award, Supplier shall not add or replace subcontractors who have Non-public Access during performance of this Contract without providing advance written notification to the public body.

16. Prohibition on Debarred/Delinquent Subcontractors:

a) Supplier shall not subcontract with any subcontractor which is debarred by the Commonwealth of Virginia or which owes back taxes to the Commonwealth and has not made arrangements with the Commonwealth for payment of such back taxes.

b) If any part of this Contract is supported in whole or in part with federal funds, Supplier shall not subcontract to a party excluded from Federal Procurement and Nonprocurement Programs.

17. Export of Content:

Supplier agrees to provide a secure method of exporting Content when requested. Supplier shall ensure that the Content exported from Supplier’s Services or infrastructure is in an industry standard format that is usable and provides interoperability and portability.

18. Escrow:

a) Cloud Services Escrow Supplier is providing a General Use or COTS Cloud Service, and no custom-built source code is authorized under this Contract. Therefore, Cloud Service Escrow is not required.

b) Content Escrow Should Supplier cease to do business, file bankruptcy, or fail to support Public Body, Supplier shall promptly make all Content available to Public Body as a native database export provided through a Supplier FTP server or other transfer mechanism approved by VITA.

19. Right to Updates:

a) “Update” means any update, modification, or new release of the Cloud Services that Supplier makes generally available to its customers at no additional cost. Updates include patches, fixes, upgrades, enhancements, and improvements, and may include additional capabilities or improvements in the functionality, speed, efficiency, security, or other features or operations of the Cloud Services.

b) At no additional cost to Public Body, Supplier shall provide access to Updates to the Cloud Services. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Supplier website. Nothing in this provision obliges Supplier to undertake any modifications to the Cloud Services or constrains Supplier’s discretion regarding whether to undertake modifications suggested by Public Body or another party.

c) Should Supplier merge or splinter the Cloud Services during the term of Public Body's subscription, license, or use of it, such action on the part of Supplier shall not in any way result in Public Body being charged additional fees to access the Cloud Services, to enable its Users to access the Cloud Services, or to receive Updates to or support for the Cloud Services.

d) Updates or other changes to the Cloud Services that affect the security controls and environment will require an updated Assessment, and Supplier agrees to cooperate with any such updated Assessment.

20. Service Levels and Remedies:

a) Availability The Cloud Services will be made available to Public Body and its Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime.

For the purposes of this Contract, “Excusable Downtime” is defined as that period of time when the Cloud Services are not available to Public Body or its Users due to scheduled network, hardware or service maintenance and/or upgrades. Excusable downtime shall follow the performance standard/service level set forth below. In cases of emergency, Supplier will use its best efforts to notify Public Body of a planned Downtime as soon as practicable.

Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the Supplier’s Cloud Services, (iii) an electric utility failure at Supplier’s facility where the Cloud Services are hosted, or (iv) a network failure up to, but not including, the interconnection point of Supplier’s network to the public switched telephone network.

Supplier’s failure to make the Cloud Services available to Public Body and its Users at the performance standard/service level set forth below excluding scheduled maintenance or excusable downtime, shall be deemed a service level default (“Service Level Default”) and Public Body may obtain the non-exclusive remedies set forth below. For purposes of this Contract, “Available” means that Public Body and its Cloud Services Users are able to access all features and functions of the Cloud Services required by Public Body.

In the event Public Body is eligible for a 100% Service Level Credit under this Section during any given month of the term the Contract, Public Body may terminate the Contract without penalty upon written notice to Supplier and, in addition to the remedies available under this Section, receive any additional remedies set forth in the Contract.

If availability does not meet the required levels in these Cloud Terms, when payment is made on an annual basis, Software Publisher will refund to Public Body the applicable percentage as listed in the table below of the monthly payment amount. Such refund will be issued in the month immediately following the failure. If availability does not meet the required levels in these Cloud Terms, when payment is made on a monthly basis, credits shall be applied against the next invoice. If a credit or refund as applicable is not made by the due date, the amount of such credit or refund may be withheld from future payments by Public Body. In the event a Service Level Default occurs, if Public Body has given notice of termination pursuant to the Term and Termination section of the Contract or due to non-appropriation of funds, or Public Body has made final payment to Supplier for the Cloud Services and no further invoices shall issue as a result, Supplier shall refund to Public Body the amount of the appropriate Service Level Credit due for the period of default within thirty (30) calendar days. Supplier shall measure Availability on a monthly basis and shall provide information regarding the Availability to Public Body on a monthly basis.

Any dispute between the Supplier and any provider/subcontractor regarding responsibility for any events giving rise to the imposition of the remedies shall not relieve the Supplier of their liability for said remedies.

In addition to the remedies outlined in the table below, Public Body may exercise all available rights and remedies under law and equity.

TABLE OF SERVICE LEVELS AND REMEDIES FOR CLOUD SERVICES

Public Body to update all areas highlighted in aqua before sending to the Supplier. The percentages contained in the SLA table below can be increased or decreased depending on the Public Body’s business needs. Do not delete any of the performance standards set forth in the table below without consulting your assigned Cloud Sourcing Specialist in advance.

99% or above=0 98.99-97%=10% 96.99-95%=25% 94.99-93%=50% Below 93%=100% and, at PUBLIC BODY’s sole discretion, termination of the Contract

Incident resolution time – Cloud Services: Severity 1 (within 6 hours)

% of incidents resolved within the 6-hour timeframe Severity 1 incidents Severity 1 incident = Critical production issue that severely impacts the service or the system is down, including production issues caused by misconfiguration of components by Supplier on Public Body systems

Incident resolution time: Severity 2 (within 24 hours)

% of incidents resolved within the 24-hour timeframe.

Severity 2 incident = Critical situation where functionality is impacted, or customer experience is seriously degraded, including production issues caused by misconfiguration of Components by Supplier on Public Body systems.

Note: If an incident is escalated to Severity 2, then the resolution time measurement restarts upon escalation to Severity 2 Total Severity 2 incidents resolved within 24 hours divided by total resolved Severity 2 incidents

Incident resolution time: Severity 3 (within 3 calendar days)

% of incidents resolved within the 3-calendar day timeframe.

Severity 3 incident = A partial loss of service with a medium to low impact on the Public Body. Public Body is still able to function, including production issues caused by misconfiguration of Components by Supplier on Public Body systems Note: If an incident is escalated to Severity 3, then the resolution time measurement restarts upon escalation to Severity 3 Total Severity 3 incidents resolved within 3 calendar days divided by total resolved Severity 3 incidents

Excusable Downtime: Advanced Notice to Public Body of Scheduled Maintenance and/or Upgrades Advanced Notice = two (2) business days NOTE: This performance measure does not apply to notification of downtime for emergency maintenance.

Supplier’s notice to Public Body of scheduled maintenance and/or upgrades requiring Excusable Downtime is equal to or exceeds two (2) business days

For the avoidance of doubt, Excusable Downtime means the same as Section 20.A in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to notify Public Body of maintenance requiring Downtime

Excusable Downtime: Acceptable Duration of maintenance and/or upgrades

Acceptable Duration = Thirty-six (36) hours in a single month Maintenance and/or upgrades requiring Excusable Downtime shall not exceed thirty-six (36) hours in duration in a single month

For the avoidance of doubt, Excusable Downtime has the same meaning as Section 20.A in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to conduct maintenance and/or upgrade(s) requiring Downtime within the allowable 36 hours in a single month

Excusable Downtime: Acceptable timeframe for execution of maintenance and/or upgrades requiring Downtime

Acceptable timeframe = maintenance and/or upgrades must occur outside of the hours of 6:00AM-8:00PM Eastern Time (ET) Monday-Friday Maintenance and/or upgrades requiring Downtime cannot occur between the hours of 6:00AM-8:00PM ET Monday-Friday For the avoidance of doubt, Excusable Downtime has the same meaning as Section 20.A of this Exhibit of Cloud Terms and Conditions.

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to failure to execute maintenance and/or upgrades requiring Downtime within the allowable timeframe

b) Cloud Services and Cloud Services Support

At any time during the term of this Contract, Supplier shall provide the following Cloud Services support (including unlimited telephonic support and all necessary travel and labor) without additional charge to Public Body in order to ensure Public Body and its Cloud Services Users are able to access and use the Cloud Services in accordance with the requirements of the Contract.

i) Coverage Twenty-four (24) hours per day, seven (7) days a week, Supplier shall provide to Public Body all reasonably necessary telephone or written consultation requested by Public Body in connection with use, problems and operation of the Cloud Services.

ii) Service Levels Supplier will respond to requests for support from a Public Body or VITA, in its governance role, of the Cloud Services in accordance with the procedures identified in the Table of Service Levels. In each case, Public Body may describe the problem by telephone or electronic mail or via a web site provided by Supplier. Supplier shall use commercially reasonable efforts to meet Response Time and Resolution Times.

The level of severity (e.g., 1, 2, 3), shall be defined by Public Body.

21. Click Wrap and Other Supplier Terms Notwithstanding any other provision, term, or policy which may be issued by Supplier or presented to Public Body or Users after the effective date of the Contract, including terms that are posted on Supplier websites or that are presented to Users before or at the time of accessing the Cloud Services (“click wrap”), and irrespective of whether any such provisions have been proposed prior to or after the issuance of the Contract for the Cloud Services, the terms and conditions set forth in this Contract and any amendments or modifications thereto shall supersede and govern licensing and use of the Cloud Services and all products and services under the Contract.

22. Limitation of Liability:

a) Supplier agrees that it is fully responsible for all acts and omissions of all Supplier Personnel, including their negligence, gross negligence, or willful misconduct.

b) To the extent permitted by law, Supplier’s indemnification obligations and liability will not exceed, in aggregate, twice the value of the Contract. For purposes of this Contract, “value of the Contract” means the cumulative obligations under this Contract, including any orders, SOWs, or Change Orders thereto.

c) The limitations on liability set forth in this section will not apply to liability arising from claims for any of the following:

i. intentional or willful misconduct, fraud, or recklessness of Supplier or any Supplier Personnel; or

ii. bodily injury, death, or damage to real property or tangible property resulting from the negligence of a Supplier or any Supplier Personnel.

23.Mandatory Contract Terms The clause below is required and contains mandatory terms required by VA Code. This clause must be included in this exhibit of Commonwealth of Virginia Cloud Terms and Conditions unless it is already included in your Contract. If this clause is already included in your Contract, or a License Agreement Addendum is being used in response to a Supplier’s EULA, you may delete in this exhibit of Cloud terms and conditions.

Note: Public Body’s procurement and/or legal personnel assisting with cloud terms should confirm that the contract documents include agreement to the Mandatory Contract Terms found at https://www.vita.virginia.gov/procurement/contracts/mandatory-contract-terms/. The following is a standard way of adding those terms as a group. With legal review and approval, as appropriate, they can also be added or integrated individually.

Supplier agrees to the VITA “Mandatory Contract Terms” which consist of the:

The terms and conditions set forth in documents posted at the URL above, and any successor URL(s), are subject to change pursuant to action by the legislature of the Commonwealth, change in Public Body policy, or change to IRS Publication 1075. If a change is made to any of the Mandatory Contract Terms documents, a new effective date will be noted in the applicable document title. Supplier is advised to check the URLs, or their successors, periodically.

24. Account Administration / Provisioning:

If Supplier issues unique User accounts (i.e., access provided through userIDs/usernames and passwords or other credentials):

a) Public Body is responsible for protecting such User account information and for any authorized and unauthorized use made of the passwords.

b) Public Body will fully cooperate with law enforcement authorities in the detection and prosecution of illegal activity related to unauthorized use of the Cloud Services.

c) Public Body shall have the right to add, activate, change access for, disable, and deactivate such User accounts, and Public Body shall designate administrators who will be authorized to perform such account administration tasks. If Supplier is unable to provide Public Body with the account control described in the foregoing sentence, then Supplier shall meet the following requirements for account administration and provisioning support:

i. Upon notification by Public Body of a User’s disabled or deactivated access, Supplier shall remove access authorization by said User to the Services within twenty-four (24) hours of receipt of such notification, ensuring that historical access audit details of such User shall not be deleted or lost. If Supplier fails to make such a removal of access, Public Body shall not be held liable for any charges or damages incurred due to use of the unauthorized USERID.

25. Records and Audit:

Supplier shall maintain accurate records and other evidence pertaining to the costs and expenses for the Cloud Services including, but not limited to, the uptime and downtime of the Cloud Services in support of its charges invoiced to Public Body. The records will be to the extent and in such detail as will properly reflect all direct and indirect costs associated with the Contract. Public Body shall have the right, at any reasonable time during regular business hours after giving reasonable advance notice, to inspect and audit the records applicable to the Contract. Supplier shall preserve such records for three (3) years after termination/completion of provision of the Cloud Services under this Contract.

26. Indemnification:

a) Indemnification Generally Supplier shall defend, indemnify, and hold harmless the Commonwealth and Public Body, their officers, directors, agents, and employees (collectively, “Commonwealth’s Indemnified Parties”) from and against any and all losses, damages, claims, demands, proceedings, suits, and actions, including any related liabilities, obligations, losses, damages, assessments, fines, penalties (whether criminal or civil), judgments, settlements, expenses (including attorneys’ and accountants’ fees and disbursements), and costs (each, a “Claim” and collectively, “Claims”), to the extent the Claims in any way relate to, arise out of, or result from:

i. any negligent act, negligent omission, or intentional or willful conduct of Supplier or any employee, agent, or subcontractor of Supplier (“Supplier Personnel”);

ii. a breach of any representation, warranty, covenant, or obligation of Supplier contained in this Contract;

iii. any defect in the Cloud Services;

iv. any actual or alleged infringement or misappropriation of any third party’s intellectual property rights by any of the Supplier-provided products or services; or

v. any Claims by any Subcontractor resulting from Supplier’s failure to pay such Subcontractor.

b) Defense Claims Supplier will be solely responsible for all costs and expenses associated with the defense of all third-party Claims against Commonwealth Indemnified Parties. Selection and approval of counsel, and approval of any settlement, shall be accomplished in accordance with all applicable laws, rules, and regulations. For Commonwealth agencies, the applicable laws include §§ 2.2-507, 2.2-510, and 2.2-514 of the Code of Virginia.

c) Duty to Replace or Reimburse In the event of a Claim pursuant to any actual or alleged infringement or misappropriation of any third party’s intellectual property rights by any of the Supplier-provided products or services, or Supplier’s performance, Supplier shall, at its expense and option, either (a) procure the right to continue use of such infringing products or services, or any components thereof; or (b) replace or modify the infringing products or services, or any components thereof, with non-infringing products or services satisfactory to Public Body.

In the event that Public Body cannot use the Cloud Services, including any affected components, then Supplier shall reimburse Public Body for the reasonable costs incurred by Public Body in obtaining an alternative product or service.

d) Supplier Dispute of Obligation to Indemnify If a Claim is commenced against any Commonwealth Indemnified Parties by a third party alleging an infringement of the third party’s intellectual property rights and Supplier is of the opinion that the allegations in the third-party Claim, in whole or in part, are not covered by the indemnification provision in this Contract, then Supplier shall immediately notify Public Body in writing of Supplier’s opinion that it is not obligated to indemnify. Supplier shall, nonetheless, take all reasonable steps to protect the rights, remedies, and interests of the Commonwealth Indemnified Parties in the defense of the Claim, including to secure a continuance to permit Public Body to appear and defend their interests in cooperation with Supplier as is appropriate, including any jurisdictional defenses Public Body may have.

27. Exit / Transition Out Plan and Assistance:

a) Upon execution of this Contract, or at a later time if requested by Public Body, Supplier and Public Body will develop an exit plan (“Exit Plan”) detailing each party’s respective tasks for the orderly transition and migration of all Content stored by Supplier pursuant to the Contract to an archive, system, or application maintained by Public Body.

At a minimum, the Exit Plan must provide that within 30 days of the expiration or termination of this Contract for any reason, Supplier shall return to Public Body all Content in its possession and stored by the Cloud Services on behalf of Public Body, in a format accessible without the use of Supplier’s Cloud Services or software. Supplier’s failure to provide an acceptable mechanism of return of Content or to cooperate in development of an Exit Plan will constitute a material breach of this Contract and Public Body may exercise all available rights and remedies under law and equity, in addition to any remedies set forth in this Contract.

b) In addition, at Public Body’s option, Supplier shall continue to provide the Cloud Services for up to six (6) months after the date of expiration or termination of the Contract, at the then current subscription pricing, in order to facilitate Public Body’s transition to another service model or solution provider. Supplier shall also provide such reasonable transition assistance as may be requested by Public Body and agrees such assistance will not be unreasonably withheld. Supplier shall perform such assistance at the hourly rate or charge agreed upon by Supplier and Public Body in the Contract. In the event of a termination for breach by Supplier, Supplier shall provide the transition assistance at no charge or fee to Public Body.

28. Commencement, Acceptance, and Cure

a) Commencement Date The Supplier shall begin provision of the Cloud Services on the date requested by Public Body and agreed to by the Supplier in the Contract. Public Body may delay the Cloud Services commencement date by notifying the Supplier at least ten (10) days before the scheduled commencement date.

b) Acceptance

“Acceptance” means successful delivery and performance by the Supplier of its contractual commitments at the location(s) designated in the Contract, including completed and successful Acceptance testing in conformance with the requirements of the Contract.

The Cloud Services shall be deemed accepted when Public Body reasonably determines that Public Body and its Users can successfully access and use all functionalities of the Application which Supplier is required to provide to such Users. Public Body agrees to complete Acceptance testing within five days after receiving written notice from Supplier of the ability of Public Body and its Users to access the Cloud Services, or within such other period as set forth in the Contract. Supplier agrees to provide to Public Body such assistance and advice as Public Body may reasonably require, at no additional cost, during such Acceptance testing, other than pre-approved travel expenses incurred which will be reimbursable by Public Body at the then current per diem amounts set forth by the Virginia Department of Accounts and published at: http://www.doa.virginia.gov/ or a successor URL(s). Public Body shall provide to Supplier written notice of Acceptance upon completion of successful Acceptance testing. In the event that Public Body fails to provide Supplier written notice of successful or unsuccessful Acceptance testing within five (5) business days following the end of the Acceptance testing period, the Supplier shall provide Public Body with written notice that Supplier has not received a notice of successful or unsuccessful Acceptance testing from Public Body. If Public Body fails to provide Supplier with written notice of successful or unsuccessful Acceptance testing within 5 (five) business days after receiving such notice from Supplier, the Software or Deliverable will be deemed Accepted

c) Cure Period and Remedies If during the Acceptance test period, Public Body is unable to access the functionalities of the Cloud Services, Supplier shall provide Public Body with such access, and Public Body’s Users with their required access, within seven (7) days of written notice of inability to access, or as otherwise agreed between Public Body and Supplier in the Contract. Should Supplier fail to provide access to the functionalities of the Cloud Services, Public Body may, in its sole discretion: (i) reject the Cloud Services in its entirety and recover amounts previously paid hereunder; (ii) issue a “partial Acceptance” of the Cloud Services access with an equitable adjustment in the price to account for such deficiency; or (iii) conditionally accept the applicable Cloud Services access while reserving its right to revoke Acceptance if timely correction is not forthcoming.

If Public Body and its Users are unable to access the licensed functionalities of the Cloud Services after a second set of acceptance tests, Supplier shall be deemed in default of the Contract. In the event of such default, Public Body may, at its sole discretion, terminate the Contract, in whole or in part, for the Cloud Services.

Supplier Legal Name By:

(Signature)

Name:

(Print)

Title:

Date:

Public Body name By:

(Signature)

Name:

(Print)

Title:

Date: