CSP034517_DAS020_-_Contract.pdf

A CONTRACT BETWEEN

THE OHIO DEPARTMENT OF ADMINISTRATIVE SERVICES

ON BEHALF OF THE

DEPARTMENT OF ADMINISTRATIVE SERVICES

AND

WILLIS TOWERS WATSON US LLC

This Contract (#CSP034517), which results from Request for Proposals #SRC0000022123 titled Independent Benefits Auditing Services RFP (the “RFP”), is between the State of Ohio, through the Department of Administrative Services, on behalf of the Department of Administrative Services, and WILLIS TOWERS WATSON US LLC (the "Contractor").

This Contract is the result of agreed upon changes to the RFP including all exhibits and written amendments to this RFP and the Contractor's negotiated and accepted Proposal. It will also include any materials incorporated by reference in the above documents. The terms and conditions for this Contract are contained in Parts 2-4 of the RFP. If there are conflicting provisions between the documents that make up the Contract, the order of precedence for the documents is as follows:

This Contract consists of the following in this order of precedence:

1. This one-page Contract;

2. Part 6 - Mutually Agreed Upon Changes;

3. This RFP, as amended; and

4. The Proposal dated December 06, 2024.

Once awarded, the term of the Contract will be from the date of the State’s signature through December 31, 2027. The State may solely renew this Contract at its discretion for a period of one month. Any further renewals will be by mutual agreement between the Contractor and the State. The parties may renew this Contract for up to 48 months. Any such renewal of all or part of the Contract is also subject to the satisfactory performance of the Contractor and the needs of the State of Ohio.

This Contract has an effective date of the later of November 17, 2025 or the occurrence of all conditions precedent specified in the terms and conditions of Parts 2-4.

To show their agreement, the parties have executed this Contract as of the dates below.

WILLIS TOWERS WATSON US LLC STATE OF OHIO,

DEPARTMENT OF ADMINISTRATIVE SERVICES

By: _________________________________ By: ____________________________________

Name: Phillip E. Fritts ___________________ Name: Kathleen C. Madden _________________

Title: WTW East Central Health & Benefits___ Title: Director_____________________________ Market Leader

Date: ________________________________ Date: ___________________________________

Part 6 – Mutually Agreed Upon Changes

A. The Contractor has agreed to retract section f. Assumptions beginning on page 117 of its Technical Proposal.

B. The Contractor has agreed to retract the additional insurance redlines, found on pages 162-164 of the Technical Proposal, and all references made throughout the Technical Proposal.

C. The Contractor has agreed to retract the following language regarding payment found at the bottom of page 165 of the Technical Proposal: “Our invoices for services rendered and expenses incurred are payable 30 days after receipt. A late payment charge is payable on balances outstanding more than 30 days. The State is responsible for any sales, gross receipts or similar taxes applicable to the services but not taxes based on WTW’s net income.”

D. The State rejects the Contractor’s included Data Security and Privacy terms redlines in the

Contractor’s Technical Proposal. Exhibit 4, the Negotiated Data Security and Privacy Terms hereby becomes a part of the Contract and takes precedence over any conflict with Exhibit 1 Data Security and Privacy Terms.

E. Exhibit 5, the Negotiated Contract-Specific Terms and Conditions hereby becomes a part of the

Contract and takes precedence over any conflict with Part 2 – Contract-Specific Terms and

Conditions.

F. Exhibit 6, the Negotiated RFP-Specific Terms and Conditions hereby becomes a part of the Contract and takes precedence over any conflict with Part 3 – RFP-Specific Terms and Conditions.

G. Exhibit 7, the Negotiated Standard Terms and Conditions hereby becomes a part of the Contract and takes precedence over any conflict with Part 4 - Standard Terms and Conditions.

H. The below defined Additional Innovation or Value-Added Services are incorporated and will be paid in accordance with the following Rate Card:

Item 1: Operations Review

Item 2: Appeals Audit

Item 3: Customer Service Audit

Item 4: Optional Pharmacy Audits

Item 5: Compliance Related Auditing/Testing

Position Hourly Rate

Analyst $275 – $300

Associate $325 – $375

Project Manager $450 – $500

Senior Consultant/Subject Matter Expert $575 – $650

The Contractor will consult with the State to determine estimated fees before beginning any other project.

I. Offeror Best Practices are included as proposed in the Contractor’s Technical Proposal.

J. The Contractor’s Best and Final Offer (BAFO) is incorporated as shown below:

DESCRIPTION HOURLY RATE

Audits and Operational Assessments (Non MHPAEA):

Medical, Population Health Management/Wellness, Behavioral Health, Exempt Dental, Exempt Vision, Exempt Life Insurance, COBRA, Flexible Spending Accounts and Commuter, Data Aggregation, Disability, and Employee Assistance (EAP). $405

Pharmacy (Claim and Rebate Audits):

Amount billed for this Work is subject to 1, 2, and 3 defined below. $405

MHPAEA Audit:

Includes Analysis of Non-Quantitative Treatment Limitations (NQTLs) and Quantitative Treatment Limitations (QTLs). $620

1. For pharmacy audits involving the subcontractor Caribou, the Contractor must provide the

Agency with the total amount that will be charged to the State for the Work completed by Caribou and obtain Agency approval before beginning the Work.

2. All costs associated with the Work completed by Caribou must be passed on to the State on an

“at-cost” basis.

3. The Contractor will bill either the Agency or the State’s contracted PBM for Work related to

Pharmacy audits, as directed by the Agency.

Exhibit 4

Negotiated Data Security and Privacy Terms

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms applies to all work and services across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with the State IT Security Policies and Standards and these Terms and must accept the security and privacy requirements outlined in these Terms in their entirety, as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management in accordance with State IT Security Policies and Standards.

These Terms apply to the following:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the Contract.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State Data directly or indirectly.

E. Any Contractor personnel that have access to State Data.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contractor for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

2. Personally Identifiable Information means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics, E. The definitions of “personal information” in Revised Code chapters 1347.01, 1347.04 through

1347.99, and F. The various other definitions of “personal information” throughout the Ohio Revised Code.

3. Security Event has the meaning set forth in Section 7 of these Terms.

4. Security Incident has the meaning set forth in Section 7 of these Terms.

5. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Sensitive Data.

6. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45

CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R.

431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards;

G. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

7. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with the applicable security baseline of the current published version of the International Organization for Standardization 27001 with additional security controls implemented to achieve compliance with the current published version of the National Institute of Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (NIST 800-53) (collectively ISO27001)commensurate with the type of State Data involved in the Contract as communicated by the State. If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. In either scenario, the Contractor must implement information security policies, standards, and capabilities as set forth in the Contract, support the State’s adherence to the State IT Security Policies and Standards and use procedures in a manner that does not diminish established State capabilities and standards. All work performed by the Contractor, all deliverables provided by the Contractor, and all environments utilized to perform the Contractor’s work must support State IT Security Policies and Standards. The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Support State IT security policies, standards and procedures development and maintenance activities. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

Support implementation and compliance monitoring as per State IT Security Policies and Standards.

B. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of State Data

Contractor shall maintain an Information Security Program (“ISP”) made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction.

To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations and be handled in accordance with the requirements of these Terms at all Contractor locations.

If the Contractor will be handling Sensitive Data, the State may require additional documentation such as the Contractor’s information security policies and procedures, contingency plans, or incident response plans, a Privacy Impact Assessment (PIA), FIPS-199 compliance documentation, a NIST-compliant System Security Plan (SSP), and Plans of Action and Milestones (POA&M) documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of ISO27001 be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq. (“FISMA 2014”) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications, if applicable.

Contractor’s information security program protects State Data by aligning with ISO27001 to implement an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against the unauthorized access to, disclosure of, or use of State Data.

D. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroy or return to the State, in a format designated by the State, all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

G. Maintain appropriate and effective business continuity and disaster recovery plans to ensure resiliency of State Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered State Data and Confidential Information under this Contract.

Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, and must promptly remediate any and all vulnerabilities and provide the State with patches to address the vulnerabilities at no cost to the State. Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), Contractor warrants that its software and/or service are free from any and all defects in materials, workmanship, and design. Contractor warrants that the software is free from any and all viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of State Data is permitted as set forth in the Contract. Additionally, disclosure of State Data is also permitted when required by applicable law, regulation, court order or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Sensitive Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State within 72 hours of receipt of the order or request in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also cooperate in the State’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the State.

If, in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Contractor may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. The Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 Type 2 or other similar independent third party audit such as ISO27001. The audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

B. The State may, at any time in its sole discretion, elect to perform a Security and Data Protection Audit.

This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will provide its request in writing and will work with the Contractor to schedule time to conduct the audit.

C. At no cost to the State, the Contractor must immediately remedy any material findings, weaknesses or other items identified in each audit as they pertain to the services provided under this Contract.

6. Background Investigations of Contractor Personnel

The Contractor requires its employees, upon hire, to satisfy a commercially reasonable background investigation which is consistent with the Contractor’s policies and guidelines. The Contractor’s current policy consists of the following: (i) confirmation of identity and personal information; (ii) verification of all education beyond high school; (iii) employment verification for five (5) years; and (iv) felony and misdemeanour and national criminal follow up searches. In the event that any employee does not meet the Contractor’s background check requirements in effect at such employee’s time of hire, the Contractor shall not assign such employee to the State’s account or allow such employee access to State Data. the Contractor shall also comply with any country-specific laws with respect to employee screening requirements.

Any person who (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform certain services under the Contract. Contractor personnel who will have access to FTI or CJI must complete required background investigations that are favorably determined prior to being permitted to access the information. In addition, existing Contractors whose personnel already have access to FTI or CJI that have not completed the required background investigations within the last five years must complete the required background investigations that are favorably adjudicated prior to being permitted continued access to the information. If any Contractor personnel with existing access to the information have an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the information.

7. Security Incidents

A. Definitions. A security incident threatens the confidentiality, integrity, or availability of State information resources. A “Security Incident” means there is a successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. A “Security Event” is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds.

Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of, but are not limited to, the following:

i. unsuccessful log-on attempts,

ii. unsuccessful denial of service attacks,

iii. unsuccessful phishing attacks, and

iv. unsuccessful network attacks such as pings, probes of firewalls, and port scans.

B. Security Incident Response and Reporting

The Contractor is responsible for Security Incident response, including containment, eradication, and recovery, to minimize the impact to the State and State Data. In addition to the requirements in the Contract, the Contractor must perform the following in response to a Security Incident involving State Data.

The Contractor is not required to report Security Events which do not adversely impact or potentially impact State Data or information systems unless a pattern of attacks significantly increases the risk of impact. Contractor must report in writing to the State within 48 hours of the Contractor becoming aware of a successful Security Incident involving State Data and/or use or disclosure of State Data not authorized by the Contract, including any reasonable belief that unauthorized access to or acquisition of the State Data has occurred, and fully cooperate with the State to mitigate the consequences of the Security Incident. Within five business days of the initial Security Incident report to the State, the Contractor must document and begin providing follow-up reports for all Security Incidents to the State. The Contractor must provide updates to the follow-up reports until the investigation is complete. At a minimum, the Security Incident reports will include:

i. Data elements involved, the extent of the State Data involved in the Security Incident, and the identification of affected individuals, if applicable.

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed State Data, or to have been responsible for the Security Incident.

iii. A description of where the State Data is believed to have been improperly transmitted, sent, or utilized, if applicable.

iv. A description of the probable causes of the Security Incident and, in the final report, the root cause.

v. A description of the proposed plan for preventing similar future Security Incidents, including a recommended risk remediation plan.

vi. A description of the corrective actions taken, including repair (elimination of a defect or incident and/or restoration of system functionality requirements according to the Contract) and resolution (a temporary workaround to enable system function).

vii. Whether the Contractor believes any federal or state laws requiring notifications to individuals are triggered.

The Contractor must comply with all applicable laws that require the notification of individuals, or with other reasonable direction of the State for notification, in the event of a Security Incident involving personally identifiable information, or any other event requiring such notification. The State may, in its sole discretion, choose to provide notice to any or all parties affected by a Security Incident, but the Contractor shall reimburse the State for the cost of providing such notification, Contractor further agrees to provide, or to reimburse the State for its costs in providing, any credit monitoring or similar services that are necessary as a result of Contractor’s Security Incident. Under Ohio law, State Data is State property and any illegal activity involving State property is subject to a criminal investigation.

The Contractor shall preserve sufficient evidence to ensure accurate Security Incident records, facilitate an investigation, and determine the extent of the Security Incident.

The Contractor shall work with the customer State agency to establish a Security Incident reporting communications procedure including Contractor and customer State agency contacts, communication methods and tools. If there is no procedure established, the Contractor must report Security Incidents to the primary contact listed in the Contract or that contact’s successor and Contractor must report the Security Incident to the State via email at Enterprise.SIRT@das.ohio.gov or call 614.728.7448.

The State reserves the right to conduct an independent investigation of the Security Incident, and the Contractor shall cooperate with the investigation. The independent investigation may be conducted by a State agency or a third party acting on behalf of the State.

8. Contractor Access

When the Contractor accesses State network systems and data, including remotely, the Contractor must maintain a robust security capability that incorporates generally recognized system hardening techniques.

The Contractor must use appropriate measures to ensure that State Data is secure before transferring control of any systems or media on which State Data is stored. The method of securing the State Data must be in alignment with the required data classification. The Contractor may permit State Data to be loaded onto portable computing devices or portable storage components or media only if adequate security measures are in place to ensure the integrity and security of State Data. The transfer of any such system or media must be reasonably necessary for the performance of the Contractor’s obligations under the Contract. The Contractor shall use multifactor authentication to limit access to systems that contain Sensitive Data.

State Data must be encrypted when stored on any portable computing or storage device or media or when transmitted across any data network. Contractors must also maintain an accurate inventory of all such devices and the individuals to whom they are assigned. The Contractor must have reporting requirements for lost or stolen portable computing devices authorized for use with State Data and must report any loss or theft of such devices to the State in writing as defined in Section 7.

9. HIPAA Compliance

When the Contractor is handling State Data that includes health or medical data, the Contractor must comply with the data handling and privacy requirements of HIPAA and its associated regulations. Additionally, some or all of the State Data may be client identifying information covered by 42 C.F.R. Part 2. Contractor may only disclose such client identifying information back to the State and is bound in all respects by the regulations of 42 C.F.R. Part 2.

Exhibit 5

Negotiated Contract-Specific Terms and Conditions

A. Contract Construction and Compensation

1. Terminology

For purposes of this Contract, any references to “Offeror” in the documents that make up this Contract will mean “Contractor” as of the effective date of this Contract.

2. Compensation

In consideration of the Contractor's promises and satisfactory performance, the State will pay the Contractor the amount(s) identified in the Contract (the "Fee"), plus any other expenses identified as reimbursable in the Contract. In no event will payments under this Contract exceed the “not-to-exceed” amount in the Contract without the prior, written approval of the State and, when required, the Ohio Controlling Board and any other source of funding. The Contractor's right to the Fee is contingent upon the complete and satisfactory performance of the Work or, in the case of milestone payments or periodic payments of an hourly, daily, weekly, monthly, or annual rate, all relevant parts of the Work tied to the applicable milestone or period. Payment of the Fee is also contingent on the Contractor delivering a proper invoice and any other documents required by the Contract.

3. Fee Structure

The fee structure under this Contract will be a not-to-exceed fixed unit cost fee structure. Contractor may only invoice the State for actual hours worked pursuant to the rates set forth in this Contract.

4. Economic Price Adjustment

The Contract prices(s) will remain firm for the initial term of the Contract. Thereafter, the Contractor may submit a request to increase its price(s) to be effective 30 calendar days after acceptance by the State. No price adjustment will be permitted prior to the effective date of the increase received by the Contractor from its suppliers; on purchase orders that are already being processed; or on purchase orders that have been filled and are awaiting shipment. If the Contractor receives orders requiring quarterly delivery, the increase will apply to all deliveries made after the effective date of the price increase.

The price increase must be supported by a general price increase in the cost, e.g., increases in the cost of raw materials, labor, freight, workers’ compensation and/or unemployment insurance. Detailed documentation, to include a comparison list of the contract items and proposed price increases, must be submitted to support the requested increase. Supportive documentation includes, but is not limited to:

copies of the old and the current price lists or similar documents which indicate the original base cost of the product to the Contractor and the corresponding increase, and/or copies of correspondence sent by the Contractor's supplier on the supplier's letterhead, which contain the above price information and explains the source of the increase in such areas as raw materials, freight, fuel or labor, etc.

Should there be a decrease in the cost of the finished product due to a general decline in the market or some other factor, the Contractor is responsible to notify the State immediately. The price decrease adjustment will be incorporated into the contract and will be effective on all purchase orders issued after the effective date of the decrease. If the price decrease is a temporary decrease, such should be noted on the invoice. In the event that the temporary decrease is revoked, the contract pricing will be returned to the pricing in effect prior to the temporary decrease. For quarterly deliveries, any decrease will be applied to deliveries made after the effective date of the decrease. Failure to comply with this provision will be considered as a default and will be subject to Part 4 - Standard Terms and Conditions.

Suspension/Termination and the Contract Remedies sections.

B. Contract Administration

1. Documentation

The Contractor will rely on the documentation and information provided by the Agency or the Agency’s representatives and the Contractor is not responsible for verifying the information’s accuracy or completeness.

The Agency may rely only upon the Contractor’s final work product and not on any drafts or oral statements made by the Contractor in the course of performing the Work.

2. Replacement Personnel

The Contract contains the names of specific people who will perform the Work. The quality and professional credentials of those people were material factors in the State’s decision to enter this Contract.

Therefore, the Contractor will use all commercially reasonable efforts to ensure the continued availability of those people. Also, the Contractor will not remove those people from the Work without the prior, written consent of the State, except as provided below.

The Contractor may remove a person listed in the Contract from the Work if doing so is necessary for legal or disciplinary reasons, in the case of the person’s resignation, the ceasing of his or her employment with the Contractor, or in the case of a leave of absence due to medical or personal extenuating circumstances. When the unavailability of a listed person becomes known to the Contractor, the Contractor must give the State immediate written notice of the unavailability or removal of the person.

The Contractor must have candidates with equal or better qualifications available to replace any person listed by name in the Contract when needed. The Contractor must submit two resumes of candidates to replace each person removed or who otherwise becomes unavailable, along with such other information as the State may reasonably request, within five business days after the notice.

The State will select one of the two proposed replacements or will reject both within ten business days after the Contractor has submitted the proposed replacements to the State. The State may reject the proposed replacements for any reason.

The Contractor’s failure to meet the requirements of this section, which include the specified failures below, will constitute a default:

a. Failure to provide replacement candidates with equal or better qualifications than the removed or unavailable person;

b. Failure to provide the notice required under this section; and

c. Failure to provide two qualified replacement candidates for each removed or unavailable person.

In such case, the State may seek the remedies available to it under this section or as provided in this Contract.

The State has the right to require the Contractor to remove any person from performing the Work if the State determines that any the person has interfered or may interfere with the State's interests of ensuing its operations are carried out in an efficient, professional, legal, and secure manner. In such a case, the request for removal from the State will be considered the required notice under this section, the person requested to be removed by the State will be treated as a person who has become unavailable, and the Contractor will follow the procedures identified above for replacing an unavailable person. This provision also applies to any person engaged by the Contractor's subcontractors.

If the Contractor either removes a person listed in the Proposal from the Work for any reason other than those specified above or does not follow the procedures for removal set forth above, the State may assess liquidated damages in the amount of $1,800.00 for every day from the date on which the individual was removed to the date the individual's qualified replacement, selected in accordance with the process identified in this section, starts performing on the Work. Should the State assess liquidated damages or otherwise be entitled to damages under this provision, the State may offset these damages from any fees due the Contractor under this Contract.

C. Ownership of Deliverables and Custom Deliverables

1. Custom Deliverables

The State shall retain ownership of all original data and materials provided to the Contractor by the State or its representatives, and the intellectual property rights in that data and materials. The State will have the right to use, reproduce and adapt the copies of the Work for internal purposes within the State’s organization. The State will also own and/or have the rights to the materials set forth in Section VI(D) of Part 4 of the Contract.

2. Custom Software

Custom Software means custom Deliverables such as software, scripts, or similar computer instructions developed for the State. If Custom Software is a Deliverable, in addition to the rights and requirements described above for custom Deliverables, the State is entitled to the source material for all Custom Software. Scripts and similar functionality may not be locked or otherwise protected from access by the State unless the State has the passwords or other tools necessary to access them. Source material must include annotations or comments according to industry standards. Further, the State is entitled to any working papers the Contractor has developed during the performance of the Work that would reasonably assist the State in using the Custom Software, that would help the State protect its interests in the Custom Software, or update, modify, or otherwise maintain the Custom Software. This includes all design and architectural materials, such as schemas.

3. License in Commercial Material

Commercial Material means anything that has been developed at private expense by the Offeror or a third party, commercially available in the marketplace, subject to intellectual property rights, and readily copied through duplication on magnetic media, paper, or other media. Examples of Commercial Material include written reports, books, pictures, videos, movies, computer programs, software, and computer source code and documentation. Commercial Material includes Commercial Software (defined below).

Use of any Commercial Material will be governed by the applicable license terms negotiated and accepted by the State. In addition to the license agreement(s) provided in Contractor’s Proposal (as negotiated and accepted by the State), if any Commercial Material is added to the Work after Contract award, Contractor must disclose the applicable license agreement(s) or other terms for any additional Commercial Material and assist the State as needed in any negotiation of the license agreement(s) or other terms.

In addition to the license or other terms applicable to the Commercial Material and except for Commercial Material that is software (“Commercial Software” as defined in the next section):

a. If the Commercial Material is copyrighted and published, the State will have the rights permitted under the Federal copyright laws for each copy of the Commercial Material delivered to it by the Contractor;

b. If the Commercial Material is patented, the State will have the rights permitted under the Federal patent laws for each copy of the Commercial Material delivered to it by the Contractor; and

c. If the Commercial Material consists of trade secrets, the State will have the same rights and duties permitted under the Federal copyright laws for each copy of the Commercial Material delivered to it by the Contractor, whether or not the material is copyrighted when delivered to the State, and the State will treat the Commercial Material as confidential. In this regard, the State will assume all obligations with respect to the Commercial Material that the Contractor assumes under the Confidentiality section of this Contract with respect to State Confidential Information.

D. Additional Insurance

Additional Insurance

In addition to the insurance requirements in Part 4, the Contractor shall also procure and maintain for the duration of the Contract, the insurance coverage set forth below.

Professional Liability (Errors and Omissions) Insurance appropriate to the Contractor’s profession, with limits not less than $2,000,000 per claim, $2,000,000 aggregate. Coverage must be sufficiently broad to respond to the duties and obligations as is undertaken by Contractor in this Contract and must cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract.

Cyber liability (first and third party) with limits not less than $3,000,000 per claim, $3,000,000 aggregate.

Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by the Contractor in this agreement and shall include, but not be limited to, claims involving infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage shall provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with limits sufficient to respond to these obligations.

E. Acceptance

1. Submittal of Deliverables

The Contractor must perform its tasks in a timely and professional manner that produces Deliverables that fully meet the Contract’s requirements. The Contractor must complete the Work in steps that will result in Deliverables associated with those steps, and the Contractor must provide the required Deliverables no later than the due dates proposed in the RFP or included in the Contractor’s Work Plan as approved by the State. At the time of delivery of a written Deliverable, the Contractor must submit an original and one copy of each Deliverable, plus an electronic copy. The Contractor must provide the electronic copy in a file format acceptable to the State. Also, with each Deliverable, the Contractor must submit a Deliverable Submittal Form in a mutually agreed to format, signed by the State’s Work Manager.

By submitting a Deliverable, the Contractor represents that, to the best of its knowledge, it has performed the associated tasks in a manner that meets the Contract’s requirements.

The Contractor must provide all Deliverables to the Agency Representative, who will review (or delegate review of) the materials or documents within a reasonable time after receipt, as specified in the Work Plan.

If the State determines that a Deliverable is not in compliance, the State’s project manager assigned to the Work (the “State Work Manager”) will note the reason for non-compliance on the Deliverable Submittal Form and send the form to the Contractor’s Project Manager. At no expense to the State, the Contractor then must bring the Deliverable into conformance and re-submit it to the State Work Manager within 10 business days.

If the State agrees the Deliverable is compliant, the State Work Manager will indicate that by signing the Deliverable Submittal Form and returning a copy of it to the Contractor. In addition, if the State Work Manager or designee determines that the State should make a payment associated with the Deliverable, the State Work Manager will indicate that the payment should be made on the Deliverable Submittal Form.

The Deliverable Submittal Form authorizing payment and the payment itself do not indicate the State has accepted the Deliverables associated with the payment. The State’s acceptance of the Deliverables that are part of developing the Work is conditioned on a successful performance test upon completion of the Work.

Status reports are not subject to a review and approval process.

2. Inconsistencies Between Contract and Deliverables

If any terms and conditions incorporated in a Deliverable, or other work product, are in addition to, inconsistent with, or conflict with the Contract, such terms and conditions are excluded and the Contract will prevail.

F. Termination Assistance Services

1. Overview

The Contractor must provide to the State the Termination Assistance Services set forth herein in connection with the termination or expiration of the Contract.

“Termination Assistance Services” means (a) to the extent requested by the State, the continued performance by Contractor of its obligations under the Contract (including providing the Work which is subject to termination or expiration), and (b) the provisioning of such assistance, cooperation, and information as is reasonably necessary to enable a smooth transition of the applicable Work to the State or its designated third-party provider (“Successor”). As part of the Termination Assistance Services, Contractor must provide such information as the State may reasonably request relating to the number and function of each of the Contractor personnel performing the Work, and Contractor must make such information available to the Successor designated by the State.

The Contractor must cooperate with the State in its attempts at transferring the Work to another provider in a manner that must not adversely affect the provision of ongoing Work.

2. Responsibilities

Commencing no less than six months prior to expiration of this Contract or on such earlier date as the State may request, or commencing upon a notice of termination or of non-renewal of this Contract, and continuing through the effective date of expiration or, if applicable, of termination of this Contract, Contractor must provide to the State, or at the State’s request to the State’s designee, the Termination Assistance Services requested by the State to allow the Work to continue without interruption or adverse effect and to facilitate the orderly transfer of the Work to the State or a Successor (including a competitor of Contractor). Contractor must also provide Termination Assistance Services in the event of any partial termination of this Contract (e.g., termination of an element or other component of the Work) by the State, such assistance to commence upon the State’s notice of termination to Contractor.

Termination Assistance Services include the following:

a. The State or the Successor must be permitted, without interference from Contractor, to hire any

Contractor personnel primarily…