BPM007077 Special and Uniform Terms and Conditions.docx

Uniform Terms and Conditions Arizona Department of Public Safety

Request for Proposals

BPM007077

Description:

Specialized Rescue and Technical Equipment for AZDPS Air Rescue Operations

Special Terms and Conditions

1. Definitions of Terms: As used in the Contract, the terms listed below are defined as follows:

1.1. Acceptance: The document titled “Offer and Acceptance Form” bearing the state contract number once Procurement Officer has signed it to signify (1) State’s formal acceptance of the Accepted Offer and (2) the formation of the Contract. For clarity of intent, the foregoing is not to be confused with the term “acceptance” used throughout the Contract in the context of delivery, inspection, etc., with respect to Materials or Services.

1.2. Accepted Offer:

1.2.1. If State did not request a Revised Offer, then “Accepted Offer” means the Initial Offer.

1.2.2. If State requested a Revised Offer but not a Best and Final Offer, then “Accepted Offer” means the latest Revised Offer.

1.2.3. If State requested a Best and Final Offer, then “Accepted Offer” means the Best and Final Offer.

1.3. Arizona Procurement Code: The Arizona Procurement Code consists of Arizona Revised Statutes (A.R.S.) §§ 41-2501 et seq. and Arizona Administrative Code (A.A.C.) R2-7-101 et seq. There is additional information in the Solicitation Instructions regarding how to access these state statutes and rules.

1.4. Arizona Risk and Authorization Management Program (AZRAMP): is used by the Arizona Department of Homeland Security to evaluate Cloud services and Contractors that will transfer, process, or store state data outside of state-managed or controlled networks, and has three levels of control review:

1.4.1. AZ Mandatory Control Baseline: 35 Controls

1.4.2. NIST Low Impact Control Baseline: Public Data Classification

1.4.3. NIST Moderate Impact Control Baseline: Confidential Data Classification

1.5. Arizona Transaction Privilege Tax (TPT): For information, refer to the Arizona Department of Revenue (DOR) website at: https://azdor.gov/transaction-privilege-tax-tpt

1.6. Attachment. Any item that:

1.6.1. The Solicitation required Offeror to submit as part of the Offer (e.g., Initial Offer, Revised Offer, or Best and Final Offer);

1.6.2. Was attached to an Offer when submitted; and

1.6.3. Was included in the Accepted Offer.

1.7. Cloud Services: Cloud or Cloud Services means any Software as a Service (SaaS), Infrastructure as a Service (IaaS), or Platform as a Service (Paas) involving the transfer, processing, or storage of state Data outside the control of state-managed and controlled networks.

1.8. Contract Terms and Conditions: The Special Terms and Conditions and the Uniform Terms and Conditions taken collectively.

1.9. Contractor: The Person identified on the Accepted Offer who has entered into the Contract with the State.

1.10. Contractor Indemnitor: Contractor or any of its owners, officers, directors, agents, employees, or Subcontractors.

1.11. Co-Op Buyer: A member of the State Purchasing Cooperative that has entered into a “Cooperative Purchasing Agreement” with the Arizona Department of Administration State Procurement Office under A.R.S. § 41-2632. Unless there is an applicable Cooperative Purchasing Agreement in effect at the time, a State Purchasing Cooperative member cannot be a Co-Op Buyer. For reference, “Co-Op Buyer” is to be construed as encompassing an “eligible procurement unit” under A.A.C. R2-7-101(23).

NOTE: Membership in the State Purchasing Cooperative is open to all Arizona political subdivisions, including cities, counties, school districts, and special districts. Membership is also available to non-profit organizations, other state governments, the federal government and tribal nations. For reference, “non-profit organizations” are defined in A.R.S. § 41-2631(4) as any nonprofit corporation as designated by the I.R.S. under Section 501(c)(3) through 501(c)(6) of the tax code.

1.12. Data Breach: Data Breach is used herein as defined as stated in A.R.S. Title 18, chapter 5, article 4 (Data Security Breaches), or in any relevant state or federal standard, to indicate an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

1.13. Eligible Agency:

1.13.1. If the Special Terms and Conditions indicate that the Contract is a “single-agency” contract, then “Eligible Agency” means the particular State of Arizona agency, university, commission, or board identified therein.

1.13.2. If the Special Terms and Conditions indicate that the Contract is a mandatory statewide contract, then “Eligible Agency” means any State of Arizona department, agency, university, commission, or board.

1.13.3. If the Special Terms and Conditions indicate that the Contract is a “cooperative” contract available for use by Co-Op Buyers, then “Eligible Agency” means any State of Arizona department, agency, university, commission, board, or any Co-Op Buyer.

1.14. Federal Risk and Authorization Management Program (FedRAMP): A federal government program that provides a standardized approach to security assessment, authorization, and continuous monitoring specifically for Cloud products and services relied upon by federal entities that store, process and transmit federal information.

1.15. Instructions to Offerors: The Solicitation Instructions document of the Solicitation.

1.16. NIST: NIST is the National Institute of Standards and Technology. For more information, see https://www.nist.gov/.

1.16.1. NIST Low Impact: If a Contractor may process, transmit, or store non-sensitive State Data, metadata, and/or Data that may be released to the public that requires no additional levels of protection during its work under the Contract, then the Contractor shall follow the NIST Low Impact security controls as directed by the State Chief Privacy Officer (Enterprise Security, Privacy & Risk Compliance team).

1.16.2. NIST Moderate Impact: If a Contractor may process, transmit, or store one or more of the following types of Data during its work under the Contract, then the Contractor shall complete NIST Moderate Impact security controls (authorized or provisional) status:

1. Personal identifiable information (PII) as defined by U.S Dept. of Labor (DOL);

2. Protective health information (PHI) as defined by HIPAA;

3. Payment card industry (PCI) Data as defined by PCI Security Std. Council (PCI SSC);

4. Criminal justice information (CJI) Data;

5. Federal tax information (FTI) Data defined by IRS 1075;

6. Data that if lost or unavailable would either be disruptive to government operations or cause a loss of confidence of trust in the government;

7. Directed by the State Chief Privacy Officer (Enterprise Security, Privacy & Risk Compliance team).

1.17. Order: The instrument by which the Eligible Agency or Co-Op Buyer authorizes a Contractor to perform some or all of the Work. Whether the Contract will have one Order or many Orders depends on the scope of the Contract and how the State will use it. The Special Terms and Conditions provide that information. Any of the following are construed as an “Order”: “Purchase order,” “task order,” “service order,” or “job order”.

1.18. State’s eProcurement System: The State’s official electronic procurement system, established pursuant to A.A.C. R2-7-201 as set forth in the Arizona Department of Administration State Procurement Office policy document Technical Bulletin No. 020, The State’s eProcurement System–The Official State eProcurement System. Technical Bulletin No. 020 is available online at:

https://spo.az.gov/sites/default/files/documents/files/TB_020_APP_20181024.pdf

1.19. State: With respect to the Contract generally, “State” means the State of Arizona and its department, agency, university, commission, or board that has executed the Contract. With respect to administration or rights, remedies, obligations and duties under the Contract for a given Order, “State” means each Eligible Agency or Co-Op Buyer who has issued the Order.

1.20. State Indemnitees: Collectively, the State of Arizona, its departments, agencies, universities, commissions, and boards and, and their respective officers, agents, and employees.

1.21. StateRAMP: A non-profit organization that provides a uniform approach to verifying that the cybersecurity of Cloud service providers (CSPs) meets the standards and regulations needed to do business with state and local governments.

1.22. Work: The totality of the Materials and the Services and all the acts of administration, creation, production, and performance necessary to fulfill and incidental to fulfilling all of Contractor's obligations and duties under the Contract in conformance with the Contract and applicable laws.

1.0 Contract Interpretations

1.1. Usage. Where the Contract:

1.1.1. assigns obligations to Contractor, any reference to “Contractor” is to be construed to be a reference to the Contractor and all Subcontractors, whether they are first-tier Subcontractors, sub-subcontractors, suppliers, sub-suppliers, consultants, or sub-consultants, as well as all of Contractor’s and the Subcontractor’s respective agents, representatives, and employees in every instance unless the context plainly requires that it is a reference only to Contractor as apart from Subcontractors.

1.1.2. uses the permissive “may” with respect to a party’s actions, determinations, etc., the terms is to be interpreted as in A.A.C. R2-7-101(32) [Definitions]. For clarity of intent, any right given to State using “State may” or a like construction denotes discretion and freedom to act so far as any regulatory or operative constraints permit in the relevant circumstances, provided that: (a) where written “may, at its discretion,” the discretion extends to whatever is most advantageous to State; and (b) where written only as “may,” the discretion is constrained by what is fair, reasonable, and as accommodating of the respective best interests of both parties as practicable under the circumstances;

1.1.3. uses the imperative “shall” with respect to a party’s actions, duties, etc., the term is to be interpreted as in A.A.C. R2-7-101(44) [Definitions]. Conversely, the phrase “shall not” is to be interpreted as an imperative prohibition.

1.1.4. uses the term “must” with respect to a requirement, criterion, etc., the term is to be interpreted as conveying compulsion or strict necessity;

1.1.5. uses the term “might” with respect to an event, outcome, action, etc., the term is to be interpreted as conveying contingency or non-discretionary conditionality; and

1.1.6. uses the term “will” or the phrases “is to be” or “are to be” with respect to an event, outcome, action, etc., the term or phrase is to be interpreted as conveying such certainty or imperativeness that “shall” is either unnecessary or irrelevant in that instance.

1.2. Contract Order of Precedence

1.2.1. Complementary Documents. All of the documents forming the Contract are complementary. If certain work, requirements, obligations, or duties are set out only in one but not in another, Contractor shall carry out the Work as though the relevant Work, requirements, obligations, or duties had been fully described in all, consistent with the other documents forming the Contract and as is reasonably inferable from them as being necessary to produce complete results.

1.2.2. Conflicts. In case of any inconsistency, conflict, or ambiguity among the documents forming the Contract and their provisions, they are to prevail in the following order, descending from most dominate to most subordinate, provided that, among categories of documents or provisions having the same rank, the document or provision with the latest date prevails. Information being identified in one document, but not in another, is not to be considered a conflict or inconsistency.

1.2.2.1. Contract Amendments;

1.2.2.2. The final Solicitation Documents, in the following order:

(1) Special Terms and Conditions;

(2) Exhibits to the Special Terms and Conditions;

(3) Uniform Terms and Conditions;

(4) Scope of Work;

(5) Exhibits to the Scope of Work;

(6) Specifications; and

(7) Any other documents referenced or included in the Solicitation;

1.2.2.3. Orders, in reverse chronological order; and

1.2.2.4. Accepted Offer.

1.2.3. Attachments and Exhibits. For clarity of intent, if an item was an Attachment in the Solicitation Documents or an Offer (either Initial, Revised, Best and Final, or Accepted) and was subsequently made into an Exhibit, or its content was incorporated into one of the other Contract documents, then that Attachment no longer exists contractually as an “Attachment” since it has at that point been made into some other Contract document. In every other case, an Attachment and the Offeror Data therein remain part of the Accepted Offer for purposes of precedence and contractual effect.

2.0 Contract Administration and Operation

2.1 Term of Contract. The term of the Contract will commence on the date indicated on the Offer and Acceptance and continue for twelve (12) months unless canceled, terminated, or permissibly extended.

2.2 Contract Extensions. This Contract may be extended for supplemental periods up to a maximum of 48 months for a total contract term not to exceed five (5) years.

2.3 Eligible Agency. This contract is a single-agency contract for the sole use of the Department of Public Safety.

3.0 Costs and Payments

3.1 Pricing. Price for products available on this contract as needed shall be obtained prior to services being rendered via a quote in writing with all expenses listed, subject to approval by DPS.

3.2 Contractor’s Best Pricing. Contractor warrants that, for the term of the Contract, the prices and discounts set out in the Attachments titled Pricing, including any subsequent agreed amendment to it (the “Contract Pricing”), shall be equal to or better than the lowest prices and largest discounts, both separately and in combination, at which Contractor sells equivalent services, items of equipment, and materials.

3.2.1 That price-plus-discount equivalence (“Contractor’s Best Pricing”) is intended to be irrespective of whether or not those other sales have special purchase terms, conditions, rebates, or allowances.

3.2.2 If Contractor’s Best Pricing for equivalent services, items of equipment, and materials is better than the Contract Pricing, then Contractor agrees to adjust the Contract Pricing to match the Contractor’s Best Pricing for all sales related to the Contractor made after the date when the Contractor’s Best Pricing was first better than the Contract Pricing.

3.2.3 For clarification of intent, that date is intended to be the date when the difference first occurred, which might have been before the difference was first identified. If the difference occurred before it was identified, then Supplier agrees to charge less than the Contract Pricing until the extended difference that would have been realized (i.e. if the Contractor’s Best Pricing had been applied when it should have been) has been settled.

3.3 Taxes Not Included in Price. Contract prices shall not include applicable state and local taxes. The state shall pay all applicable taxes. Taxes must be listed as a separate item on all invoices.

3.4 Fixed catalog discount pricing for the first twelve (12) month period cannot be modified.

4.0 Contract Changes

4.1 Signing of Contract Amendments. The contractor’s counter-signature (or “approval” in the State’s eProcurement system, in the case of an amendment) is not required to give effect if the Contract Amendment only covers:

4.1.1 extension of the term of the Contract within the maximum aggregate term; or

4.1.2 modifications of a clerical nature that have no effect on terms, conditions, price, scope, or other material aspect of the Contract.

In every case other than those listed in 5.1.1 and 5.1.2 above, both parties’ signatures (or “approval” in the State’s eProcurement system in the case of an amendment) are required to give it effect.

5.0 Ordering Process

5.1 DPS may purchase the specific materials contractually covered through contract direct release purchase orders issued by DPS to the Contractor. No work shall be performed without a duly authorized/issued purchase order(s). Any attempt to represent any material and/or service not specifically awarded under the contract is a violation of the contract and the Arizona Procurement Code. Any such action shall be subject to all legal and contractual remedies available to the state inclusive of, but not limited to, contract termination, cancellation, suspension and/or debarment of the Contractor.

6.0 Billing

6.1 All billing notices shall reference the Contract Number on which the order is based, the Department’s request reference number (see document header information), an itemized list of products or services supplied. Products are to be identified by the name, model number, contract number, line item number, and serial number if applicable.

7.0 Payment

7.1 Payments shall be made in accordance with A.R.S. Titles 35 and 41.

7.2 Contractor shall accept electronic payment from the State principally through, but not limited to, electronic transfer via Automated Clearing House remittance. The State also may make payment, at its discretion, by payment card, credit card, debit card, warrant, federal wire, etc. Contractor shall cooperate with the State by providing the State information – including, but not limited to Contractor’s bank information – to support the State’s selected means of payment. The Contractor shall not charge the State an amount to recover any convenience fee, discount fee or service fee related to the acceptance of the State’s payment.

7.3 Unless otherwise specified in the Contract, the Contractor shall offer as standard payment terms a discount of 2% for payments made within 10 days and full payment due in 30 days (generally referred to as “2/10, net 30”).

8.0 Licensing

8.1 Contractor(s) performing work within the State of Arizona shall, as applicable be properly licensed for the Scope of Work in which they are contracting.

9.0 I. T. 508 Compliance

9.1 Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this contract shall comply with A.R.S. §41-2531 and §41-2532 and Section 508 of the Rehabilitation Act of 1973, which required that employees and members of the public shall have access to and use information technology that is comparable to the access and use by employees and members of the public who are not individuals with disabilities.

10.0 Risk and Liability

10.1 Risk of Loss. Contractor shall bear all risk of loss to Materials while in pre-production, production, storage, transit, staging, assembly, installation, testing, and commissioning, if and as those duties are within the scope of the Work, until they have been accepted as conforming by State in the particular location and situation specified in the Order, or as specified generally elsewhere in the Contract if the Order does not provide particulars, provided that, risk of loss for nonconforming Materials will remain with Contractor notwithstanding acceptance to the extent the loss stems from the nonconformance.

10.2 General Contractor Indemnification and Insurance Requirements

10.2.1 Contractor Indemnification (Not Public Agency). To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona.

10.2.2 Public Agency Language Only. Each party (as 'indemnitor') agrees to indemnify, defend, and hold harmless the other party (as 'indemnitee') from and against any and all claims, losses, liability, costs, or expenses (including reasonable attorney's fees) (hereinafter collectively referred to as 'claims') arising out of bodily injury of any person (including death) or property damage but only to the extent that such claims which result in vicarious/derivative liability to the indemnitee, are caused by the act, omission, negligence, misconduct, or other fault of the indemnitor, its officers, officials, agents, employees, or volunteers."

10.2.3 Insurance Requirements: Addendum A to the Special Terms and Conditions: Contractor Insurance Requirements is incorporated herein as part of the Special Terms and Conditions.

11.0 Warranties

11.1 Warranties and Requirements Related to Information Technology. Addendum B: Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures is incorporated herein as part of the Special Terms and Conditions.

Request for Proposals

Description:

Specialized Rescue and Technical Equipment for AZDPS Air Rescue Operations Arizona Department of Public Safety 2102 W. Encanto Blvd., Phoenix, Arizona 85009

Addendum A - Contractor Insurance Requirements

Indemnification Clause

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

Insurance Requirements

Contractor and subcontractors shall procure and maintain, until all of their obligations have been discharged, including any warranty periods under this Contract, insurance against claims for injury to persons or damage to property arising from, or in connection with, the performance of the work hereunder by the Contractor, its agents, representatives, employees or subcontractors.

The Insurance Requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State of Arizona in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that arise out of the performance of the work under this Contract by the Contractor, its agents, representatives, employees or subcontractors, and the Contractor is free to purchase additional insurance.

Minimum Scope and Limits of Insurance

Contractor shall provide coverage with limits of liability not less than those stated below.

Commercial General Liability (CGL) – Occurrence Form

Policy shall include bodily injury, property damage, and broad form contractual liability coverage.

a. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by or on behalf of the Contractor.

b. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

Business Automobile Liability

Bodily Injury and Property Damage for any owned, hired, and/or non- owned automobiles used in the performance of this Contract.

· Combined Single Limit (CSL) $1,000,000

a. Policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by, or on behalf of, the Contractor involving automobiles owned, hired and/or non-owned by the Contractor.

b. Policy shall contain a waiver of subrogation endorsement as required by this written agreement in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

Workers’ Compensation and Employers’ Liability

· Workers' Compensation Statutory

· Employers' Liability

a. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

b. This requirement shall not apply to each Contractor or subcontractor that is exempt under A.R.S. § 23-901, and when such Contractor or subcontractor executes the appropriate waiver form (Sole Proprietor or Independent Contractor).

Additional Insurance Requirements

The policies shall include, or be endorsed to include, as required by this written agreement, the following provisions:

The Contractor's policies, as applicable, shall stipulate that the insurance afforded the Contractor shall be primary and that any insurance carried by the Department, its agents, officials, employees or the State of Arizona shall be excess and not contributory insurance, as provided by A.R.S. § 41-621 (E).

Insurance provided by the Contractor shall not limit the Contractor’s liability assumed under the indemnification provisions of this Contract.

Notice of Cancellation

Applicable to all insurance policies required within the Insurance Requirements of this Contract, Contractor’s insurance shall not be permitted to expire, be suspended, be canceled, or be materially changed for any reason without thirty (30) days prior written notice to the State of Arizona. Within two (2) business days of receipt, Contractor must provide notice to the State of Arizona if they receive notice of a policy that has been or will be suspended, canceled, materially changed for any reason, has expired, or will be expiring. Such notice shall be sent directly to the Department and shall be mailed, emailed, hand delivered or sent by facsimile transmission to (State Representative’s Name, Address & Fax Number).

Acceptability of Insurers

Contractor’s insurance shall be placed with companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers. Insurers shall have an “A.M. Best” rating of not less than A- VII. The State of Arizona in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

Verification of Coverage

Contractor shall furnish the State of Arizona with certificates of insurance (valid ACORD form or equivalent approved by the State of Arizona) evidencing that Contractor has the insurance as required by this Contract. An authorized representative of the insurer shall sign the certificates.

All such certificates of insurance and policy endorsements must be received by the State before work commences. The State’s receipt of any certificates of insurance or policy endorsements that do not comply with this written agreement shall not waive or otherwise affect the requirements of this agreement.

Each insurance policy required by this Contract must be in effect at, or prior to, commencement of work under this Contract. Failure to maintain the insurance policies as required by this Contract, or to provide evidence of renewal, is a material breach of contract.

All certificates required by this Contract shall be sent directly to the Department. The State of Arizona project/contract number and project description shall be noted on the certificate of insurance. The State of Arizona reserves the right to require complete copies of all insurance policies required by this Contract at any time.

Subcontractors

Contractor’s certificate(s) shall include all subcontractors as insureds under its policies or Contractor shall be responsible for ensuring and/or verifying that all subcontractors have valid and collectable insurance as evidenced by the certificates of insurance and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum Insurance Requirements identified above. The Department reserves the right to require, at any time throughout the life of the Contract, proof from the Contractor that its subcontractors have the required coverage.

Approval and Modifications

The Contracting Agency, in consultation with State Risk, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary. Such action will not require a formal Contract amendment but may be made by administrative action.

Exceptions

Request for Proposals

In the event the Contractor or subcontractor(s) is/are a public entity, then the Insurance Requirements shall not apply. Such public entity shall provide a certificate of self-insurance. If the Contractor or subcontractor(s) is/are a State of Arizona agency, board, commission, or university, none of the above shall apply.

Addendum B - Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures

1. Security Standards

1.1. Security of the State’s systems and Data are of utmost importance to the State. In order to assure security from a personnel and operations perspective, Contractor shall comply with all requirements, in their entirety, as described in the statewide enterprise architecture; statewide Information Technology security policies, standards, and procedures; and any applicable agency-specific Information Technology security policies, standards, and procedures.

1.2. Contractor shall follow the correct, current version of these policies, standards, and procedures established by the Arizona Department of Homeland Security (AZDOHS) pursuant to their authority under A.R.S. Title 41, Chapter 41. The current website for these policies, standards, and procedures is: Information Technology Policies, Standards and Procedures. Note that this link is provided for convenience only.

1.3. For security reasons, some state facilities require non-state personnel to have escorts. If required by the state facility, Contractor personnel shall only be allowed inside of a State facility if accompanied by an escort designated by the State. This is applicable in Correctional facilities, Public Safety facilities, State Lottery, and other facilities as designated by the State.

2. Security Framework

2.1. The State of Arizona information security policies and standards follow the National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 Security and Privacy Guidelines may currently be located at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.

2.2. The State has established a process to assess risk associated with storing, processing and/or transmitting State of Arizona Data with external, non-State of Arizona entities. The Arizona Risk and Authorization Management Program (AZRamp) was developed to ensure State and contractors meet these requirements. All contractors responding to State solicitations must successfully complete the AZRamp risk assessment based upon the Data classification involved as determined by the Data owner and AZDOHS Cyber Command. Failure to successfully complete AZRamp assessment will be deemed as breach of contract.

2.3. In the State’s sole discretion, the State may also accept current FedRamp and StateRamp certifications as evidence that the Contractor has met the State's risk assessment requirements.

2.4. Other forms of Cybersecurity Frameworks (CSF), Trust Documents, Self-Attestations, including, but not limited to, ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance, may be reviewed as part of the State’s risk assessment, but are not exclusive or conclusive evidence that the Contractor has met the State’s risk assessment requirements.

3. Additional Security Requirements

3.1. Contractor shall comply with all security requirements requested by the State.

3.2. If an Arizona Risk and Authorization Management Program (AZRamp) is required, it will generally follow these steps, each of which shall be completed by the Contractor upon request by the State:

3.2.1. Contractor shall submit a completed Arizona Baseline Infrastructure Security Controls Prerequisite assessment spreadsheet with its Offer. The Arizona Baseline Infrastructure Security Controls Prerequisite assessment spreadsheet as found at: https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_pre-requisite__0_0.xls, and mitigate gaps or install compensating controls for any issues of concern identified by State.

3.2.2. Contractor shall provide Information Security documentation for the AZRamp assessment to include System Security Plan (SSP), Written Information Security Programs (WISP), or supporting written IT policies for review of the assessment.

3.2.3. Note regarding the confidential treatment of Contractor information:

3.2.3.1. The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDA) for release to review submitted SSPs, WISPs, or written IT policies will not be considered.

3.2.3.2. Submitted SSPs, WISPs, or written IT policies are deleted and not retained after AZRamp Authorization is granted.

3.2.3.3. Procedures for submission of documents considered confidential or proprietary are identified within this RFP.

3.2.3.4. Special secure transfer of documents related to this AZRamp review process may be made by contacting: GRC@AZDOHS.gov to make special arrangements for the transfer of these documents.

3.2.4. If applicable to this Solicitation, Contractor shall complete and submit with the Offer an unedited and signed State of Arizona Health Insurance Portability and Accountability Act (HIPAA) Business Associate Addendum (BAA).

3.2.5. All contract awards are contingent on the successful completion of the AZRamp 125 Low Impact (public information) or the AZRamp 325 Moderate (Confidential, PII, or PHI) Impact Control spreadsheet titled “Arizona Infrastructure Security Controls 2017 (Excel),” to be determined by the Enterprise Security, Privacy & Risk Compliance team. Low (Column E) and Moderate (Column F) Impact controls spreadsheet can be located here: https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_2017_v2_0_0.xls.

3.3. The State reserves the right to conduct risk assessments, vulnerability assessments, black-box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s).

3.4. Upon request, Contractor shall submit copies of system logs from Contractor’s environment to the State of AZ security team in the format requested to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3.5. Contractor shall comply with all applicable State and Federal laws and regulations, including, but not limited to, the following (please note that the links are provided for convenience only and may change):

3.5.1. State of Arizona statewide policies, standards and procedures: https://azdohs.gov/information-technology-it-policies-standards-and-procedures;

3.5.2. Federal Information Security Modernization Act of 2014 (FISMA): https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma;

3.5.3. OMB Circular A-130: https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource;

3.5.4. National Cyber Strategy of the United States of America: https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure;

3.5.5. Health Insurance Portability and Accountability Act (HIPAA) including Business Associate Agreement/ Health Information Technology for Economic and Clinical Health Act (HITECH): https://www.hhs.gov/hipaa/index.html;

3.5.6. Tax Information Security Guidelines For Federal, State and Local Agencies: Safeguards for Protecting Federal Tax Returns and Return Information (I.R.S. Publication 1075): https://www.irs.gov/pub/irs-pdf/p1075.pdf;

3.5.7. Criminal Justice Information Services Security Policy (CJIS): https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center;

3.5.8. Centers for Medicare & Medicaid Services (CMS), Minimum Acceptable Risk Standards for Exchanges (MARS-E): https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf;

3.5.9. A.R.S. §18-104 - Arizona Department of Administration, Arizona Strategic Enterprise Technology (ADOA-ASET), Powers and duties of the agency: https://www.azleg.gov/arsDetail/?title=18;

3.5.10. A.R.S. §41-4282 - Statewide Information Security and Privacy Office (SISPO): https://www.azleg.gov/viewdocument/?docName=https://www.azleg.gov/ars/41/04282.htm

3.5.11. A.R.S. §18-551 - Definitions Information Security Including PII: https://www.azleg.gov/ars/18/00551.htm;

3.5.12. A.R.S. §18-552 - Notification of security system breaches; requirements; enforcement; civil penalty; preemption; exceptions: https://www.azleg.gov/ars/18/00552.htm;

3.5.13. Arizona Executive Order 2008-10 – Mitigating Cyber Security Threats: https://aset.az.gov/node/428;

3.5.14. SIPC Memorandum of Understanding (MOU): https://www.sipc.org/about-sipc/;

3.5.15. State Environmental policies: https://azdeq.gov/LawsAndRules;

3.5.16. Family Education Rights Privacy Act (FERPA): https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html?src=rn;

3.5.17. Driver’s Privacy Protection Act (DPPA): https://azdot.gov/motor-vehicles/driver-services/driver-license-information/motor-vehicle-records;

3.5.18. Incident Response Reporting program and system: https://azdohs.gov/sites/default/files/p8240-incident-response-planning_0.pdf;

3.5.19. State of Arizona Library, Archives and Public Records, Records Management Division, General Retention Schedules https://azlibrary.gov/branches/archives-records-management; and

Request for Proposals

3.5.20. Payment Card Industry (PCI) Security Standards including but not limited to Supplemental Documents, Information Supplements and Validation Requirements: https://www.pcisecuritystandards.org.

Uniform Terms and Conditions 10.5

1. Definition of Terms. As used in this Solicitation and any resulting Contract, the terms listed below are defined as follows:

1.1. “AI” means the science and engineering of making machines capable of performing tasks that are typically associated with human intelligence, such as learning and problem-solving, and includes without limitation: AI systems, classic AI, external AI, generative AI, and large language model (LLM) AI.

1.2. “Attachment” means any item the Solicitation which requires the Offeror to submit as part of the Offer.

1.3. “Contract” means the combination of the Solicitation, including the Instructions to Offerors, the Uniform and Special Terms and Conditions, and the Specifications and Statement or Scope of Work; the Offer and any Best and Final Offers; and any Solicitation Amendments or Contract Amendments.

1.4. "Contract Amendment" means a written document signed by the Procurement Officer that is issued for the purpose of making changes in the Contract.

1.5. “Contractor” means any person who has a Contract with the State.

1.6. “Data” means recorded information, regardless of form or the media on which it may be recorded. The term may include technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

1.7. “Days” means calendar days unless otherwise specified.

1.8. “Exhibit” means any item labeled as an Exhibit in the Solicitation or placed in the Exhibits section of the Solicitation generally containing maps, schematics, examples of reports, or other documents that will be used to perform the requirements of the Scope of Work after contract award.

1.9. “Gratuity” means a payment, loan, subscription, advance, deposit of money, services, or anything of more than nominal value, present or promised, unless consideration of substantially equal or greater value is received.

1.10. “Materials” means all property, including equipment, supplies, printing, insurance and leases of property but does not include land, a permanent interest in land or real property or leasing space.

1.11. “Procurement Officer” means the person, or his or her designee, duly authorized by the State to enter into and administer Contracts and make written determinations with respect to the Contract.

1.12. “Services” means the furnishing of labor, time or effort by a Contractor or Subcontractor which does not involve the delivery of a specific end product other than required reports and performance, but does not include employment agreements or collective bargaining agreements.

1.13. “State” means any department, commission, council, board, bureau, committee, institution, agency, government corporation or other establishment or official of the executive branch or corporation commission of the State of Arizona that executes the Contract.

1.14. “State Fiscal Year” means the period beginning with July 1 and ending June 30.

1.15. “Subcontract” means any Contract, express or implied, between the Contractor and another party or between a Subcontractor and another party delegating or assigning, in whole or in part, the making or furnishing of any Materials or any Services required for the performance of the Contract.

1.16. “Subcontractor” means a person who contracts to perform work or render Services to a Contractor or to another Subcontractor as a part of a Contract with the State.

2. Contract Interpretation

2.1. Arizona Law. The Arizona law applies to this Contract including, where applicable, the Uniform Commercial Code as adopted by the State of Arizona and the Arizona Procurement Code, Arizona Revised Statutes (A.R.S.) Title 41, Chapter 23, and its implementing rules, Arizona Administrative Code (A.A.C.) Title 2, Chapter 7.

2.2. Implied Contract Terms. Each provision of law and any terms required by law to be in this Contract are a part of this Contract as if fully stated in it.

2.3. Contract Order of Precedence. In the event of a conflict in the provisions of the Contract, as accepted by the State and as they may be amended, the following shall prevail in the order set forth below:

2.3.1. Special Terms and Conditions;

2.3.2. Uniform Terms and Conditions;

2.3.3. Statement or Scope of Work;

2.3.4. Specifications;

2.3.5. Attachments;

2.3.6. Exhibits; then

2.3.7. Any other documents referenced or included in the Solicitation including, but not limited to, any Bid or Offer documents provided by the Contractor that do not fall into one of the above categories.

2.4. Relationship of Parties. The Contractor under this Contract is an independent Contractor. Neither party to this Contract shall be deemed to be the employee or agent of the other party to the Contract.

2.5. Severability. The provisions of this Contract are severable. Any term or condition deemed illegal or invalid shall not affect any other term or condition of the Contract.

2.6. No Parol Evidence. This Contract is intended by the parties as a final and complete expression of their agreement. No course of prior dealings between the parties and no usage of the trade shall supplement or explain any terms used in this document and no other understanding either oral or in writing shall be binding.

2.7. No Waiver. Either party’s failure to insist on strict performance of any term or condition of the Contract shall not be deemed a waiver of that term or condition even if the party accepting or acquiescing in the nonconforming performance knows of the nature of the performance and fails to object to it.

3. Contract Administration and Operation

3.1. Records. Under A.R.S. § 35-214 and § 35-215, the Contractor shall retain and shall contractually require each Subcontractor to retain any and all Data and other “records” relating to the acquisition and performance of the Contract for a period of five (5) years after the completion of the Contract. All records shall be subject to inspection and audit by the State at reasonable times. Upon request, the Contractor shall produce a legible copy of any or all such records.

3.2. Non-Discrimination. The Contractor shall comply with State Executive Order Nos. 2023-09, 2023-01, 2009-09, and any and all other applicable Federal and State laws, rules and regulations, including the Americans with Disabilities Act.

3.3. Audit. Pursuant to A.R.S. § 35-214, at any time during the term of this Contract and five (5) years thereafter, the Contractor’s or any Subcontractor’s books and records shall be subject to audit by the State and, where applicable, the Federal Government, to the extent that the books and records relate to the performance of the Contract or Subcontract.

3.4. Facilities Inspection and Materials Testing. The Contractor agrees to permit access to its facilities, Subcontractor facilities, and the Contractor’s processes or services, at reasonable times for inspection of the facilities or Materials covered under this Contract as required under A.R.S. § 41-2547. The State shall also have the right to test, at its own cost, the Materials to be supplied under this Contract. Neither inspection of the Contractor’s facilities nor Materials testing shall constitute final acceptance of the Materials or Services. If the State determines non-compliance of the Materials, the Contractor shall be responsible for the payment of all costs incurred by the State for testing and inspection.

3.5. Notices. Notices to the Contractor required by this Contract shall be made by the State to the person indicated on the Offer and Acceptance form submitted by the Contractor unless otherwise stated in the Contract.