BEN-25-048- Exhibit M-2 Cloud Oversight Services (COV RAMP) Nondisclosure Agreement.docx

VIRGINIA INFORMATION TECHNOLOGIES AGENCY

ENTERPRISE CLOUD OVERSIGHT SERVICES (COV RAMP)

NON-DISCLOSURE AGREEMENT

This AGREEMENT is made effective as of the ________ day of _____________, _____, by and between the Virginia Information Technologies Agency, an agency of the Commonwealth of Virginia (“VITA” or “Commonwealth”), and _______________________ (“the Contractor”).

The Contractor desires to provide a solution for cloud services to the Commonwealth using its proprietary software/services solution named _______________________ (“the Solution”). The Commonwealth requires that a security assessment/audit of the Solution be conducted by VITA ECOS and/or Commonwealth Security and Risk Management personnel to validate that the Solution fulfills and complies with certain security requirements (the “Purpose”). During the assessment, the Contractor will be exchanging, compiling and/or providing to the Commonwealth information that the Contractor considers confidential and proprietary information.

The parties to this Agreement consider such confidential and proprietary information to be necessary and desirable for the Purpose.

This Agreement is being entered into by and between the parties in order to protect the confidentiality and non-disclosure of Confidential Information by all employees and/or contractors assigned to this effort.

NOW, THEREFORE, the parties agree as follows:

I. For the purposes of this Agreement, “Confidential Information” may include, but shall not be limited to, sales data and plans, marketing materials, products, operating procedures, correspondence, roadmaps, drawings, participant requirements or preferences specifications, technical information, services, and drawings. The receiving party’s obligations extend to Confidential Information that is (i) disclosed or submitted and (ii) labeled or otherwise identified at the time of disclosure as or asserted to be Confidential Information, or (iii) due to the circumstances of disclosure or the nature of the information, should reasonably be considered Confidential Information. In order to make an effective assertion of confidentiality, the disclosing party shall, at the time of disclosure, invoke an applicable Virginia Freedom of Information Act exemption or other provision of law requiring or authorizing confidentiality, specifically identify the information/items requiring protection, and state the reasons why protection is necessary.

A party that discloses Confidential Information is referred to in this Agreement as a “disclosing party” and a party that receives Confidential Information is a “receiving party.” Disclosing party and receiving party will collectively be known as the “parties”.

II. The Confidential Information is confidential and proprietary to the disclosing party, and the receiving party shall: (i) hold the Confidential Information in confidence; (ii) protect Confidential Information by using the same degree of care receiving party uses to protect its own information of a like nature, but no less than a reasonable degree of care, to prevent the unauthorized use, disclosure, dissemination, or publication of the Confidential Information; (iii) not use the Confidential Information other than for the Purpose; and (iv) disclose it only to other employees or contractors with a need to know. Except as required by law or judicial action, a party that has received Confidential Information shall not disclose, publish or otherwise reveal such Confidential Information without prior notification to and/or written authorization by the disclosing party.

A party that is required by law or judicial action to disclose Confidential Information, unless prohibited by applicable law, shall promptly notify the disclosing party of the requirement for disclosure, and reasonably assist the disclosing party if the disclosing party elects to seek a protective order to prevent or limit the requested disclosure.

III. Confidential Information shall not be duplicated by the receiving party except for the Purpose.

Upon the request of the disclosing party, the receiving party shall certify destruction of all Confidential Information received, including copies, within five business (5) days of such request. If retention of a copy of the Confidential Information is required by applicable law, the receiving party may do so, and such copy shall continue to be kept in accordance with this Agreement. Upon request, the receiving party shall advise the disclosing party in writing as to whether the receiving party is required to retain the Confidential Information.

The receiving party shall not, without prior written authorization of the disclosing party, remove any Confidential Information in tangible form from the location where the Confidential Information is received and is used for the Purpose.

IV. The obligations of the parties under this Confidentiality Agreement shall be effective from the date of this Agreement or the date the contractor is assigned to the Project, whichever is earlier, until two (2) years from the date first entered herein below.

V. Any obligation with respect to Confidential Information under this Agreement shall not apply to any information that is:

a) Rightfully in receiving party’s possession prior to receipt from disclosing party and was not acquired, directly or indirectly, from the other party or from a third party under a continuing obligation of confidentiality.

b) Publicly known without the wrongful act or breach of this Agreement by the receiving party;

c) Rightfully received by receiving party from a third party without breach of a duty of confidentiality;

d) Independently developed by the receiving party without use of the disclosing party’s Confidential Information;

e) Approved for release in writing by the disclosing party;

f) In the public domain through no fault of the receiving party;

VI. NO LICENSE: As between the parties, all Confidential Information will remain the exclusive property of disclosing party. Except to the extent necessary for disclosure, retention, and use expressly permitted herein, no licenses or rights in any Confidential Information are granted or conferred.

VII. GOVERNING LAW AND EQUITABLE RELIEF: This Agreement shall be governed and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its choice of law provisions. Contractor consents to the exclusive jurisdiction of the courts of the Commonwealth of Virginia for any dispute arising out of or in connection with this Agreement. The parties further agree that disclosure or use of Confidential Information in violation of this Agreement may cause irreparable harm to disclosing party for which monetary damages alone would be inadequate and that the disclosing party may seek injunctive relief and specific performance, in addition to any other rights and legal remedies which may be available.

VIII. BREACH OF AGREEMENT MAY RESULT IN DISMISSAL OR

PERSONNEL ACTION: Any third-party contractor of the Commonwealth who is assigned to participate in the assessment/audit and is a party to this Agreement will be immediately dismissed in the event of any breach or threatened breach of this Agreement by the third-party contractor.

IX. FINAL AGREEMENT: This Agreement terminates and supersedes all prior understandings or agreements on the subject matter hereof. This Agreement may be modified only by a further writing that is duly executed by authorized representatives of both parties.

X. SEVERABILITY: If any term of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, then this Agreement, including all of the remaining terms will remain in full force and effect as if such invalid or unenforceable term had never been included.

XI. WAIVER: Any failure to enforce any provision of this Agreement shall not constitute or be interpreted as a waiver thereof or of any other provision. Any waiver to be effective must be in writing signed by an authorized officer of the waiving party.

XII. PUBLICITY: Except as required by law, the parties agree not to discuss their participation in this undertaking. Should a FOIA request be received that seeks disclosure of this Agreement, the parties acknowledge that this Agreement may not be withheld longer than is necessary to complete a pending contract and avoid jeopardizing the Commonwealth’s bargaining position. See Va. Code §§ 2.2-3705.1(12) & 2.2-4342.

XIII. NOTICES: Any notice required by this Agreement or given in connection with it or required by law, shall be in writing and shall be given to the appropriate party by (i) personal delivery; (ii) certified mail, postage prepaid; (iii) recognized overnight delivery services; or (iv) email to the party email addresses listed below. A copy of any notice sent by a method other than email must also be sent by email. A notice is effective upon delivery.

If to the Commonwealth:

Debi Smith, Security Architect Manager Commonwealth Security & Risk Management Virginia Information Technologies Agency 7325 Beaufont Springs Drive Richmond, VA 23225 EnterpriseServices@vita.virginia.gov with a copy to LegalNotices@vita.virginia.gov

If to the Contractor:

with a copy to

IN WITNESS WHEREOF, the parties have executed this Agreement effective as of the date above.

Printed Name of Authorized

Printed Name of Authorized

Signature of Authorized Signature of Authorized

Date:

Date: