CTR049738_-_Amendment_1_-_Add_Sub.pdf

Contract Amendment Arizona Department of

Administration State Procurement Office

100 N. 15th Avenue, Suite 402 Phoenix, AZ 85007

CTR049738 HR Job Board and Applicant Tracking System

Amendment One (1)

ACKNOWLEDGEMENT AND AUTHORIZATION

This amendment shall be fully executed upon the electronic approval in the State e-Procurement system by an authorized representative of the Contractor and applied to the contract in the State e-Procurement system by the Procurement Officer or delegate.

Available online at app.az.gov

CONTRACTOR: STATE AGENCY:

PageUp People Limited 260 Madison Avenue, 8th Floor New York, NY 10016

AZ Department of Administration (ADOA) State Procurement Office 100 N. 15th Ave., Ste. 402

Phoenix, AZ 85007

CONTACT: Sarah Forbes CONTACT: Jim Atkins

PHONE: (347) 417-2232 PHONE: (602) 542-8990

EMAIL: sarahf@pageuppeople.com EMAIL: james.atkins@azdoa.gov

Job Announcement System (Job Board) and Applicant Tracking System (ATS)

Pursuant to Uniform Terms and Conditions, Section 5, Contract Changes, 5.1 Amendments, of the above referenced contract, the Contract is amended as follows:

1. Contract Document - BPM001744 HR Job Board ATS Part 2 Scope Pricing Terms and Conditions

• Attachment 5-B Supplement No. 1: Exceptions to Instructions is deleted and replaced with Attachment 5-B Supplement No. 1: Exceptions to Instructions attached to this Contract Amendment at Schedule 1.

2. Contract Document - BPM001744 HR Job Board ATS Part 2 Scope Pricing Terms and Conditions

• Attachment 3-C Proposed Subcontractors is deleted and replaced with Attachment 3-C attached to this Contract Amendment at Schedule 2.

ALL OTHER REQUIREMENTS, SPECIFICATIONS, TERMS AND CONDITIONS REMAIN UNCHANGED

https://app.az.gov/ tel:+1+(347)+417-2232 tel:+1+(347)+417-2232 mailto:sarahf@pageuppeople.com file:///C:/Users/186124/Documents/2%20-%20Contracts/MSSP%20-%20ASU%20-%20ISA/%20james.atkins@azdoa.gov

Administration State Procurement Office

100 N. 15th Avenue, Suite 402 Phoenix, AZ 85007

This amendment shall be fully executed upon the electronic approval in the State e-Procurement system by an authorized representative of the Contractor and applied to the contract in the State e-Procurement system by the

This Contract Amendment is not binding against the State of Arizona unless signed by an authorized representative of the Contractor and then accepted in writing by an authorized representative of the State.

Contractor hereby acknowledges receipt and understanding of the above amendment.

The above referenced contract amendment is hereby executed this date by the State.

Signature Date Signature Date

Mark Rice, Chief Executive Officer

James Atkins, Statewide Procurement Manager

Schedule 1 - Attachment 5-B Supplement No. 1: Exceptions to Instructions

BAFO 2_Exceptions Tracker - BPM001744_HR_Job_Board-ATS - PageUp 2-18-2020_PageUp 4-6-

2020_v2.4_Final

Mark Rice (Jul 28, 2021 14:07 GMT+10) Jul 28, 2021 Jul 28, 2021 https://salesforceintegration.na1.echosign.com/verifier?tx=CBJCHBCAABAAJauvYtyNIZBLyu9iIRUleU4Lm2MRQA7m https://azadoagov.na1.echosign.com/verifier?tx=CBJCHBCAABAAO-W0dViVOrXgUYFPhakPgOdT9Y1PkEIb

PageUp People Limited

ATTACHMENT 5-B Supplement No. 1: Vendor Accepted

Exceptions to Instructions

Article / Paragraph or Exhibit Reference

Proposed Changes / Alternate Language Rationale for Proposed Change State Response

Vendor Response PARTIES FINAL AGREED POSITION Status April 6, 2020 x None x x x x

ATTACHMENT 5-B Supplement No. 2:

Exceptions to Technical and Commercial

Article / Paragraph or Exhibit Reference

Proposed Changes / Alternate Language Rationale for Proposed Change State Response

3.1.1 (u) Accessibility Please refer to comments in row 53 2/13/20202 Correct line should 53 (14.10). The State accept as a clarification

2/13/2020 Vendor accepted In accordance with the State's accepted change to section 14.10, the parties agree s3.3.1(u) is deleted and replaced with: “Solution meets industry standard accessibility requirements (WCAG 2.1 compliant) to the degree of conformance indicated in the Vendor’s Voluntary Product Accessibility Template (VPAT).”

3.3.1

Section 2 3.3.1 PageUp utilizes a multi-tenant user interface, with dedicated tenant storage. The user interface and HR process are configured, and your configurations are stored in your dedicated tenant storage. The PageUp system is a multi-tenanted solution running in a virtualized environment, with all data segregated to dedicated tenant storage. All servers holding data client data (Database tier, storage tier, SFTP) utilize volume based encryption meaning data is stored with 256-bit AES encryption at rest. PageUp also ensures its development and test information systems are on separate physical hardware or separate IaaS accounts from production information system.

x

Clarification - The State will consider a Multi-tenant solutions. However, the State requires 3rd Party penitration testing by a vendor acceptable to State

(ADOA-ASET).

2/18/2020 Contractor accepts the State's requirement for 3rd Party penetration testing by a vendor acceptable to State (ADOA-ASET).

In the event that the State accepts a multi-tenant solutions, the Contractor requests the following amendment to Section 3.3.1 :

3.3.1 Contractor shall keep the State of Arizona’s data logically separate from all other customer data. The State will be housed in a multi-tenant solution.

Based on the State's acceptance of a multi-tenant solution, the parties agreee 3.3.1 is deleted and replaced with "Contractor shall keep the State of Arizona’s data logically separate from all other customer data. The State will be housed in a multi-tenant solution."

State accepts a multi-tenant solution.

3.3 Section A 3.3 Contractor's standard SLA will apply to this contract.

PageUp is providing a SaaS model offering to the State of Arizona - as a subscription service, SLA's are standardized across all clients and cannot be customized or made bespoke on an individual client basis.

Added during negotiations

2/13/2020 The State rejects exception and offers the following clarifications - The State's preference is 99.999% uptime, RPO 2 Hrs or less, RTO 2 Hrs or less.

2/18/2020 Contractor has responded to uptime percentages as a part of BAFO response. In addition, Contractor has updated its standard uptime in 3.3.12 to 99.9% at no additional charge.

In addition, the RPO and RTO are as listed in 3.3.9 below:

3.3.9 Contractor shall provide Recovery Point Objective (RPO) : 1hr, Recovery Time Objective (RTO) : 24hr

3.3.12 Contractor shall provide 99.9% uptime.

Based on the State's acceptance of the Contractor's BAFO, Section 3.3.9 is deleted and replaced with "Contractor shall provide Recovery Point Objective (RPO) : 1hr, Recovery Time Objective (RTO) : 24hr"

Section 3.3.12 is deleted and replaced with "Contractor shall provide 99.5% uptime."

State accepts 99.5% uptime.

Contractor shall provide Recovery Point Objective (RPO) : 1hr, Recovery Time Objective (RTO) : 24hr

3.4 Section 2 3.4 PageUp is unable to provide legal advice to the State on any federal or state legislative changes.

x 2/13/20202 -State reject requested change

02/18/2020 Contractor accepts provision 3.4.2.

Contractor submits its SLA's for the State's consideration subject to the State's consideration of a multi-tenant solution.

2-5-2020

3.4.5 Upon identification and determination of system problems, programming problems, or transfer problems, Contractor shall notify the State of Arizona of the issue in accordance with the prescribed service levels. Contractor shall make every effort necessary to correct such problems in accordance with the prescribed service level resolution commitments, to minimize any negative impact to the State of Arizona.

The parties agree s3.4.2 will remain unchanged.

Based on the State's acceptance of the Contractor's SLA's for a multi-tenant solution, the parties agree 3.4.5 is deleted and replaced with "Upon identification and determination of system problems, programming problems, or transfer problems, Contractor shall notify the State of Arizona of the issue in accordance with the prescribed service levels. Contractor shall make every effort necessary to correct such problems in accordance with the prescribed service level resolution commitments, to minimize any negative impact to the State of Arizona."

3.6

Section 2 3.6 PageUp is certified to ISO/IEC 27001:2013. PageUp recommends that you review our controls document in order to evaluate it against your specific requirements.

PageUp's position is that where a client's IS policies differ from PageUp's IS policies, PageUp's ISO 27001 policies will prevail as they are service specific.

2/13/20202 -State rejects requested change

2/18/2020 The Contractor will undertake the AZRamp assessment and validation to address the State's requirements.

2-5-2020

3.6.1 Security of the State’s WAN and LANs are of utmost importance to the State. In order to assure security from a personnel and operations perspective, Contractor shall, to the extent applicable to the Services, comply with:

Refer to Vendor's AZ Ramp responses.

Based on the Contractor's successful AZ Ramp assessment, the parties agree Section 3.6.1 is deleted and replaced with: "In order to assure security from a personnel and operations perspective, Contractor shall, in accordance with Contractor's response to the Arizona Risk and Authorization Management Program (AZRamp) Baseline Security Controls, comply with:"

3.7

Section 2 3.7 Security Framework PageUp is ISO 27001 accredited and conducts penetration testing at a minimum, annually and security scans through an independent third party to ensure adherence and compliance with these standards. This is in alignment with PageUp's ISO 27001:2013 Network Security Policy and Certification. PageUp takes appropriate action to address and implement any findings reported.

Clarification - The State requires 3rd Party penitration testing by a vendor acceptable to State

(ADOA-ASET).

2/13/2020 The State rejects the requested change

2/18/2020 Contractor accepts the State's requirement for 3rd Party penetration testing by a vendor acceptable to State (ADOA-ASET).

The Contractor will undertake the AZRamp assessment and validation to address the State's requirements.

2-5-2020 Vendor Response

3.7.1 The State of Arizona and its contractors are mandated to develop and implement a Cyber Security Framework (CSF) in accordance with National Institute of Standards and Technology (NIST) guidance. To ensure State and contractors meet these mandates, all contractors responding to State solicitations will be evaluated based on NIST Special Publication (SP) 800-53 Rev. 4 Security and Privacy Controls. Contractor understands and agrees no other forms of Security Frameworks, Trust Documents, Self Attestations, to include; ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance are recognized nor accepted by State. NIST SP 800-53 Rev. 4 guidelines can be located at: https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final

3.7.2 Contractor shall comply with all applicable security requirements including but not limited to:

3.7.2 (a) Arizona Risk and Authorization Management Program (AZRamp):

(a) i. The AZRamp assessment shall be re-validated on a minimum annual basis.

3.7.3 State reserves the right to request risk assessments, and the Contractor will undertake or hire a third party to conduct risk assessments, vulnerability assessments, and penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable timeframe. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

3.7.4 Contractor shall provide a standard copy of system logs from Contractor’s environment to State of AZ security team upon request to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3.7.5 This provision to be struck pending outcome of multi-tenant proposal.

The parties agree section 3.7 will remain unchanged other than Section 3.7.5 which the parties agree is deleted based on the State's acceptance of a multi-tenant solution.

The State’s solution will be housed in a Multi-Tenant environment. Third party penetration testing is a must have requirement. The selected vendor must verify the third party penetration testing company is acceptable with the State’s ASET team prior to any testing.

Section 3-A: Instructions to Offerors

Section 2-A: Scope of Services

3.7.6

Section 2 3.7.6 PageUp advises that in respect of any Federal laws and regulations, PageUp will comply to the extent that those laws apply to an Australian incorporated entity providing Services under the terms of the ASP Agreement in that State. PageUp also advises that the Services being provided under this Agreement shall not be used for the storage or processing of Protected Health Information.

Added during negotiations

PageUp can comply with State and Federal laws and regulations to the extent they are applicable to the Services. For example, PageUp does not process financial payments and as such Payment Card Industry (PCI) Security Standards are not applicable to the Services being contemplated by this Agreement.

PageUp also requests that the State confirm the current URL links for following regulations for our review:

3.7.6 (j) State of Arizona statewide policies, standards and practices

3.7.6 (k) SIPC Memorandum of Understanding (MOU)

3.7.6 (l) State Environmental policies

3.7.6 (o) Incident Response Reporting program and system

3.7.6 (p) Privacy Incident Reporting policy and standards

3.7.6 (q) AZNET/SISPO escalation MOU and notification workflow/templates

2/13/20202 -State rejects requested change 02/18/2020 Contractor accepts this provision.

Parties agree s 3.7.6 will remain unchanged

3.8 Single tenancy solution

Refer to comments provided in relation to 3.3.1 (row 18)

2/13/2020 Clarification - The State will consider a Multi-tenant solutions. However, the State requires 3rd Party penitration testing by a vendor acceptable to State (ADOA-ASET).

2/18/2020 Contractor accepts the State's requirement for 3rd Party penetration testing by a vendor acceptable to State (ADOA-ASET), consistent with response to Section 3.3.1 in row 18 (above).

Based on the State's acceptance of a multi-tenant solution, the parties agree s3.8 is deleted and replaced with "The ideal solution will host State of Arizona data in a multi-tenant environment allowing for third party penetration testing by a vendor acceptable to State of Arizona."

The State’s solution will be housed in a Multi-Tenant environment. Third party penetration testing is a must have requirement. The selected vendor must verify the third party penetration testing company is acceptable with the State’s ASET team prior to any testing.

4.5 Submitted Invoices

Invoices are generated automatically and not initially signed to minimize administrative overhead.

2/13/2020 The State will Accept the requested change

1.1 SUBMITTING INVOICES. Contractor shall submit an invoice to the ordering Eligible Agency or Co‑Op Buyer using the form and/or process provided or required by the ordering Eligible Entity/Customer (Eligible Agency or Co-Op Buyer). Every invoice must be signed by Contractor’s authorized representative and accompanied by all supporting information and documentation required by the Contract and applicable laws.

Based on the State accepting the requested change, the parties agree s 4.5 is deleted and replaced with "SUBMITTING INVOICES.

Contractor shall submit an invoice to the ordering Eligible Agency or Co‑Op Buyer using the form and/or process provided or required by the ordering Eligible Entity/Customer (Eligible Agency or Co-Op Buyer). Every invoice must be accompanied by all supporting information and documentation required by the Contract and applicable laws."

5.5 Purchasing Card

2/13/2020 The State will Accept the requested change

5.5 PageUp is unable to accept payments by purchasing card and requests this section be struck. card, credit card, debit card. Based on the State accepting the requested change, the parties agree s 5.5 is deleted.

x x x

ATTACHMENT 5-B Supplement No. 3:

Exceptions to Contract Terms & Conditions

Article / Paragraph or Exhibit Reference

Proposed Changes / Alternate Language Rationale for Proposed Change State Response x

Section 2-C Special Terms and Conditions PageUp proposes that its ASP Agreement apply in relation to the provision of Services under this ASP Agreement. The sample contract does not contemplate a SaaS product and PageUp has set out below the required amendments.

x

Rejected, exception not accepted.

2-5-2020 Revised wording not acceptable, more of a status than an exception

2-5-2020Vendor Repsonse PageUp will work with the State of Arizona to agree the Contract Terms & Conditions as amended in this Exceptions Tracker.

2/12/2020 Vendor agreed to remove exception

The Contractor agrees to remove this objection.

Confidentiality The information submitted by PageUp is to remain confidential and only to be used or disclosed for the purposes of evaluating this RFP. PageUp considers the following provisions to be of a sensitive and confidential nature (proprietary and trade secrets) and not to be shared external to the RFP process:

• Schedule 1 - ASP Services (trade secret and commercially sensitive)

• Schedule 2 - Key Performance Indicators (trade secret and commercially sensitive)

• Schedule 3 - Fees and Payment (commercially sensitive)

• Schedule 4 - Statementof Work (trade secretand commercially sensitive)

• Section 3.1 - Scope Details

• Section 3.2.1 -Implementation Deliverables

• Section 3.3 - Acceptance and Delivery Regime

• Section 4 - Key Performance Indicators

• Appendix A - Functional Module Details

In addition, any PII listed in the ASP Agreement, PageUp financial, security, technical, functional and performance specification responses to be kept confidential.

x Rejected, exception not accepted. Confidential information needs to be documented on Attachemnt 5-A Confidential Information Designation.

PageUp will notify the State of Arizona of its Confidential information in Attachement 5-A Confidential Information Designation.

2-5-2020 - State accepts as a clarification

Based on the State's acceptance of the clarification, the parties agree Pageup will notifiy the State of Arizona of its Confidential information in Attachement 5-A Confidential Information Designation

1.0

Definition of Terms PageUp reserves its rights in relation to the defined terms and proposes that these definitions be agreed during the contract negotiation.

Rejected, exception not accepted. 2/18/2020 Vendor agrees to remove this objection.

The Contractor agrees to remove this objection.

Section 2-B: Pricing Document

Section 2-C: Special Terms & Conditions

2.2

Contract Interpretation 2.2 Order of Precedence PageUp proposes that one contract reflecting the agreement between the parties be implemented.

Referencing the RFP instructions and other documents as set out in 2.2 may lead to confusion around the service being provided. Where there are sections in the proposal that are important to the Client PageUp would propose including those sections into the contract, subject to approval by both parties.

Rejected, exception not accepted. 2/4/2020 Vendor Agrees with Order of Precedence and will remove exception

The Contractor agrees to remove this objection.

3.8

Contract Administration and Operation 3.8 Inspection and testing PageUp seeks to delete section 3.8. PageUp is ISO 27001 accredited and conducts penetration testing at a minimum, annually and security scans through an independent third party to ensure adherence and compliance with these standards. This is in alignment with PageUp's ISO 27001:2013 Network Security Policy and Certification. PageUp takes appropriate action to address and implement any findings reported.

2/13/2020 The State will Accept the requested change

2-05-2020 Vendor Response By A.R.S. § 41-2547, State may at reasonable times inspect the part of Contractor’s or Subcontractors’ plant or places of business related to performance under the

Contract (excluding systems and proprietary and sensitive information). Accordingly, Contractor agrees to permit (for itself) and ensure (for Subcontractors) access for inspection at any reasonable time to its facilities, processes, and services. State may inspect or test, at its own cost, any finished goods, work-in-progress, components, or unfinished materials that are be supplied under the Contract or that will be incorporated into something to be supplied under the Contract. If the inspection or testing shows non-conformance or defects in relation to the Services provided to the State, then Contractor will owe State reimbursement or payment of all costs it incurred in carrying out or contracting for the inspection and testing, as well as for any re-inspection or re-testing that might be necessary. Neither inspection of facilities nor testing of goods, work, components, or unfinished materials will of itself constitute acceptance by State of those things.

Based on the State's acceptance of this requested change, the parties agree 3.8 is deleted and replaced with "By A.R.S § 41-2547 State may at reasonable times inspect the part of Contractor’s or Subcontractors’ plant or places of business related to performance under the Contract (excluding systems and proprietary and sensitive information). Accordingly, Contractor agrees to permit (for itself) and ensure (for Subcontractors) access for inspection at any reasonable time to its facilities, processes, and services. State may inspect or test, at its own cost, any finished goods, work-in-progress, components, or unfinished materials that are be supplied under the Contract or that will be incorporated into something to be supplied under the Contract. If the inspection or testing shows non-conformance or defects in relation to the Services provided to the State, then Contractor will owe State reimbursement or payment of all costs it incurred in carrying out or contracting for the inspection and testing, as well as for any re-inspection or re-testing that might be necessary. Neither inspection of facilities nor testing of goods, work, components, or unfinished materials will of itself constitute acceptance by State of those things."

3.9

3.9. Ownership of Intellectual property

PageUp seeks to delete section 3.9 in its entirety.

PageUp’s application is proprietary and is made available to our clients as a standard SaaS offering. Any modifications made to the application are deployed uniformly to its client base and remain the property of PageUp. PageUp refers to section 6 of the ASP Agreement for a full statement of its intellectual property rights and licenses between the parties.

PageUp can agree to 3.9 but any Government Purpose Rights do need to be limited and used only for the Term.

There is no requirement for the State to have a perputual right for a Term subscription service. Please see our changes below:

(a) "Government Purpose Rights” are:

i. the unlimited, perpetual, irrevocable, royalty free, non-exclusive, worldwide right to use, modify, reproduce, release, perform, display, sublicense, disclose and create derivatives from that work product without restriction for any activity in which State is a party;

ii. the right to release or disclose that work product to third parties for any State government purpose with Contractor's prior written consent; and

iii. the right to authorize those to whom it rightfully releases or discloses that work product to use, modify, release, create derivative works from the work product for any State government purpose; such recipients being understood to include the federal government, the governments of other states, and various local

2/13/2020 The State will Accept the requested changes with a few modifications, unstrike display, dsiclose, sublicense and release.

2/18/2020 Contractor accepts the State's modifications - the provision to read as follows:

(a) "Government Purpose Rights” are:

i. the unlimited, perpetual, irrevocable, royalty free, non-exclusive, worldwide right to use, modify, reproduce, release, perform, display, sublicense, disclose and create derivatives from that work product without restriction for any activity in which State is a party;

ii. the right to release or disclose that work product to third parties for any State government purpose with Contractor's prior written consent; and

iii. the right to authorize those to whom it rightfully releases or discloses that work product to use, modify, release, create derivative works from the work product for any State government purpose; such recipients being understood to include the federal government, the governments of other states, and various local governments.

Based on the State's acceptance of the requested changes with modifications, the parties agree 3.9.1(a) is deleted and replaced with "(a) "Government Purpose Rights” are:

i. the royalty free, non-exclusive, worldwide right to use, release, display, sublicense, disclose for any activity in which State is a party;

ii. the right to release or disclose that work product to third parties for any State government purpose with Contractor's prior written consent; and

iii. the right to authorize those to whom it rightfully releases or discloses that work product to use, such recipients being understood to include the federal government, the governments of other states, and various local governments.

3.10

3.10 Subcontractors

PageUp seeks to delete section 3.10 in its entirety.

PageUp has subcontractors in place as part of its normal business operations and is unable to agree to the use of any other subcontractors. Please note that PageUp assumes responsibility for any acts/defaults of its subcontractors as if they were the acts/defaults of PageUp. PageUp refers to section 17.6 of the ASP Agreement and will provide copies of all relevant subcontractors as requested.

PageUp has equivalent terms in place with subcontractors. PageUp is not able to retrospectively amend existing subcontracts to contain the exact clauses in this State contract, though will ensure equivalent terms are in place.

2/13/2020 The state accept requested change

3.10.3 FLOW-DOWN. Contractor shall have equivalent provisions, terms, and conditions of the Contract in every Subcontract. When making any post-execution consent requests, Contractor shall include its warrant that it will do the same for the pending Subcontracts covered by the request. Entering into Subcontracts will not relieve Contractor of any of its obligations or duties under the Contract, including, among other things, the duty to supervise and coordinate the work of Subcontractors. Nothing contained in any Subcontract will create or is to be construed as creating any contractual relationship between State and the Subcontractor.

Based on the State's acceptance of the requested change, the Parties agree 3.10.3 is deleted and replaced with "FLOW-DOWN.

Contractor shall have equivalent provisions, terms, and conditions of the Contract in every Subcontract. When making any post-execution consent requests, Contractor shall include its warrant that it will do the same for the pending Subcontracts covered by the request. Entering into Subcontracts will not relieve Contractor of any of its obligations or duties under the Contract, including, among other things, the duty to supervise and coordinate the work of Subcontractors. Nothing contained in any Subcontract will create or is to be construed as creating any contractual relationship between State and the Subcontractor."

3.11

3.1.1 Offshore performance

PageUp confirms that the State of Arizona’s data is stored and backed-up in the USA. Where the client elects to access PageUp’s 24/7 support to data may need to be accessed outside of the USA solely for the purposes of providing support services.

Rejected, exception not accepted.

Vendor Accepted

2-5-2020 PageUp can agree to this provision

The Contractor agrees to remove this objection.

3.12

3.12 Orders

PageUp seeks to delete this section in its entirety and refers to the Statement of Work and section 3 of the ASP Agreement.

Rejected, exception not accepted.

Vendor Accepted

2-5-2020 PageUp can agree to this provision The Contractor agrees to remove this objection.

4.0 4 Cost and Payments PageUp proposes that this section is deleted in its entirety and section 4 of the ASP Agreement applies

2-5-2020 State accepts exception

4.1.3 PageUp is unable to accept payments by payment card, credit card, debit card.

2-5-2020 State accept exception Basend on the State accepting this exception, the parties agree in relation to 4.1.3 that the State may not make payment by payment card, credit card and debit card.

6.0

6 Risk and Liability PageUp proposes that this section is deleted in its entirety and refers to section 8 of the ASP Agreement for a full statement of PageUp’s insurance provisions.

Rejected, exception not accepted.

Vendor Accepted

2-5-2020 PageUp can agree to this provision The Contractor agrees to remove this objection.

7.0

7.0 Warranties

PageUp proposes that this section is deleted in its entirety and proposes that its standard warranties apply in relation to this Agreement. Our product is provided to you based on these warranties are and as it is a SaaS product these warranties are standardized across our client base globally. Please refer to section 7 of the ASP Agreement for a full statement of PageUp’s warranties.

PageUp seeks the 7.6 Performance in public health emergency to be defined as a Force Majeure event or be addressable via its ISO 27001 Business Continuity Plan.

2/14/2020 The State accept requested modification. PageUp seeks the 7.6 Performance in public health emergency to be defined as a Force Majeure event, addressable via its ISO 27001 Business Continuity Plan.

Based on the State accepting this requested modification, the parties agree that in relation to section 7.6, Performance in public health emergency will be defined as a Force Majeure event, addressable via the Contractor's ISO 27001 Business Continuity Plan.

12.0

12. General Provisions of Service PageUp proposes that this section is deleted in its entirety and that the Statement of Work attached to the ASP Agreement applies as this more closely reflects the Service being offered.

12.3 Additional Services - Contract Amendments

to be made subject to mutual agreement, not unilateral.

12.6 Transitions - the parties shall negotiate in

good faith a fair price for any additional transition services not covered by the Pricing in the Contract.

12.9 Services Acceptance to be subject to a

mutually agreed acceptance and delivery regime, not unilateral.

2/13/2020 The state will accept the requested changes with Parties being replaced with parties.

2/5/2020 Vendor Response

12.3 Additional Services - The parties may modify the scope of the Contract by Contract Amendment to include additional services or service categories that are within the general scope of the ones originally covered by mutual agreement. Once the Contract Amendment is fully executed, Contractor shall then update all applicable price lists and make them available to all affected entities at no additional cost. Either party may make the request to add services to the Contract; regardless of who makes the request, the parties shall negotiate in good faith a fair price for any additional services, but State may elect not to add some or all of the services in question if no agreement is reached on pricing in a timely manner. Contractor’s request or proposal in response to State’s request must include documentation demonstrating that the proposed price for the additional services is both fair and reasonable and comparable to the original ones.

12.6 Transitions- During commencement, Contractor shall attend transition meetings with any outgoing vendors to coordinate and ease the transition so that the effect on State’s operations is kept to a minimum. State may elect to have outgoing vendors complete some or all of their work or orders in progress to ease the transition as is safest and most efficient in each instance, even if that scope is covered under the Contract. Conversely, State anticipates having a continued need for the same materials and services upon expiration or earlier termination of the Contract. Accordingly, Contractor shall work closely with any new (incoming) vendor and State to ensure as smooth and complete a transfer as is practicable. State’s representative shall coordinate all transition activities and facilitate joint development of a comprehensive transition plan by both Contractor and the incoming vendor. As with the incoming transition. State may permit Contractor (outgoing) to complete work or orders in progress to ease the transition as is safest and most efficient in each instance. The parties shall negotiate in good faith a fair price for any additional transition services during commencement and upon expiration or earlier termination, not covered by the Pricing in the Contract.

12.9 Services Acceptance - Acceptance of Services will be subject to mutually agreed acceptance criteria. The parties will apply as acceptance criteria conformity to the Contract, accuracy, completeness, or other indicators of quality or other matter for which the Contract or law states a requirement, whether stated directly or by reference to another document, standard, reference specification, etc. State will not owe Contractor any payment for un-accepted Services; and State may, at its discretion, withhold or make partial payment for any rejected Services if Contractor is still in the process of re-performing or otherwise curing the grounds for State’s rejection based on the acceptance criteria.

Based on the State accepting the requested changes, the parties agree 12.3 is deleted and replaced with "Additional Services - The parties may modify the scope of the Contract by Contract Amendment to include additional services or service categories that are within the general scope of the ones originally covered by mutual agreement. Once the Contract Amendment is fully executed, Contractor shall then update all applicable price lists and make them available to all affected entities at no additional cost. Either party may make the request to add services to the Contract; regardless of who makes the request, the parties shall negotiate in good faith a fair price for any additional services, but State may elect not to add some or all of the services in question if no agreement is reached on pricing in a timely manner. Contractor’s request or proposal in response to State’s request must include documentation demonstrating that the proposed price for the additional services is both fair and reasonable and comparable to the original ones.

The parties agree 12.6 is deleted and replaced with" Transitions- During commencement, Contractor shall attend transition meetings with any outgoing vendors to coordinate and ease the transition so that the effect on State’s operations is kept to a minimum. State may elect to have outgoing vendors complete some or all of their work or orders in progress to ease the transition as is safest and most efficient in each instance, even if that scope is covered under the Contract. Conversely, State anticipates having a continued need for the same materials and services upon expiration or earlier termination of the Contract.

Accordingly, Contractor shall work closely with any new (incoming) vendor and State to ensure as smooth and complete a transfer as is practicable. State’s representative shall coordinate all transition activities and facilitate joint development of a comprehensive transition plan by both Contractor and the incoming vendor. As with the incoming transition. State may permit Contractor (outgoing) to complete work or orders in progress to ease the transition as is safest and most efficient in each instance. The parties shall negotiate in good faith a fair price for any additional transition services during commencement and upon expiration or earlier termination, not covered by the Pricing in the Contract. "

The parties agree 12.9 is deleted and replaced with "Services Acceptance - Acceptance of Services will be subject to mutually agreed acceptance criteria. The parties will apply as acceptance criteria conformity to the Contract, accuracy, completeness, or other indicators of quality or other matter for which the Contract or law states a requirement, whether stated directly or by reference to another document, standard, reference specification, etc. State will not owe Contractor any payment for un-accepted Services; and State may, at its discretion, withhold or make partial payment for any rejected Services if Contractor is still in the process of re-performing or otherwise curing the grounds for State’s rejection based on the acceptance criteria."

13.0

13. Data and Information handling PageUp proposes that this section is deleted in its entirety and that section 10 of the ASP Agreement applies.

13.2 (1) (a) PageUp will notify State promptly and/or as required under applicable law.

2/13/12020 The State accepts the requested changes

2/5/2020 Vendor Response

13.2 (1) Contractor shall: (a) notify State promptly of any unauthorized access or inappropriate disclosures, whether stemming from an external security breach, internal breach, system failure, or procedural lapse; (b) cooperate with State to identify the source or cause of and respond to each unauthorized access or inappropriate disclosure; and (c) notify State promptly of any security threat that could result in unauthorized access or inappropriate disclosures;

The parties agree 13.2(1) is deleted and replaced with "Contractor shall: (a) notify State promptly of any unauthorized access or inappropriate disclosures, whether stemming from an external security breach, internal breach, system failure, or procedural lapse; (b) cooperate with State to identify the source or cause of and respond to each unauthorized access or inappropriate disclosure; and (c) notify State promptly of any security threat that could result in unauthorized access or inappropriate disclosures."

14.6

14.6.2 Cancellation Option

14.6.2 Cancellation Option

Amend (c) to reflect refund of prepaid Services not yet rendered, in addition to the other remedies available to the State.

2/13/2020 The State rejects the requested change Vendor Accepted

02-18-2020 PageUp can agree to this provision

The Contractor agrees to remove this objection.

14.7

14. Information Technology Work and 1.1 Specific Remedies PageUp proposes that this section is deleted in its entirety.

PageUp maintains a number of internal policies relating to employees and background checks as applicable to those policies. Further PageUp does not agree to any form of unlimited liability and refers to item 16 above.

14.7.2 PageUp can not accept unlimited liability, but can accept the limit in 14.7.1

PageUp is a private equity backed company, and is operating under strict Board direction in terms of its contracting strategy which requires limitation of liability and indemnity, via appropriate financial caps. This is based both on commercial reasonableness and our ongoing investments in risk management and governance procedures such as ISO 27001. The limitation provided under 14.7.1 is in keeping with the pricing, terms and services being offered under this Contract.

PageUp is willing to offer a higher financial cap for the three heads of liability as outlined in Vendor Response.

2-14-2020 - The State's rejects the requested change.

However, the State may or may not consider your request at a Higher Value in your BAFO response.

2/18/2020 Contractor proposes a higher financial value of $5,000,000 for this seciton 14.7.2 as outlined below.

This Paragraph 14.7 limits the State’s and Contractor’s respective first party liability arising from any:

(a) Indemnified Claim against which Contractor has indemnified State Indemnitees under paragraph 6.3;

(b) claim against which Contractor has indemnified State Indemnitees under paragraph 6.4; or

(c) provision of the Contract calling for liquidated damages or specifying amounts or percentages as being at-risk or subject to deduction for performance deficiencies.

to the greater of $5,000,000 (five million dollars) or 3 (three) times the purchase price of the specific Materials or Services giving rise to the claim.

14.7.2 is amended as follows:

This Paragraph 14.7 limits tThe State’s and Contractor’s respective first party liability arising from any: (a) Indemnified Claim against which Contractor has indemnified State Indemnitees under paragraph 6.3; (b) claim against which Contractor has indemnified State Indemnitees under paragraph 6.4; or (c) provision of the Contract calling for liquidated damages or specifying amounts or percentages as being at‐risk or subject to deduction for performance deficiencies.

is limited in aggregate to the greater of $5,000,000 (five million dollars) or 3 (three) times the purchase price of the specific Materials or Services giving rise to the claim.

This covers both direct and indirect/consequential as indirect/consequential losses are not excluded from the contract.

Based on the Contractor's BAFO response, the parties agree 14.7.1 is deleted and replaced with "LIMIT. Subject to the provisos that follow below, States's and Contractor's respective liability arising from or related to the contract is limited to the greater of $1,000,000 (one million dollars) or 3 (three) times the purchase price of the specifc Materials or Services giving rise to the claim."

The parties agree 14.7.2 is deleted and replaced with "The State’s and Contractor’s respective liability arising from any: (a) Indemnified Claim against which Contractor has indemnified State Indemnitees under paragraph 6.3 and under s6.3 in the Uniform Terms and Conditions; (b) claim against which Contractor has indemnified State Indemnitees under paragraph 6.4; or

(c) provision of the Contract calling for liquidated damages or specifying amounts or percentages as being at-risk or subject to deduction for performance deficiencies is limited in aggregate to the greater of $5,000,000 (five million dollars) or 3 (three) times the purchase price of the specific Materials or Services giving rise to the claim."

14.9

14.9 Specific Remedies

14.9 Specific Remedies

Amend to reflect refund of prepaid Services not yet rendered, in addition to the other remedies available to the State.

2/13/2020 The State accepts the requested change

2/5/2020 Vendor added

14.9 Specific Remedies Unless expressly stated otherwise elsewhere in the Contract, State’s remedy for breach of warranty under paragraph 14.8 includes, at

State’s discretion, re performance, repair, replacement, or refund of any prepaid amounts paid by State for the nonconforming Work. For clarification of intent, the foregoing obligations are limited by the limitation of liability in paragraph 14.7. If none of the forgoing options can reasonably be effected, or if the use of the materials by State is made impractical by the nonconformance, then State may seek any remedy available to it under law.

The parties agree 14.9 is deleted and replaced with "Specific Remedies. Unless expressly stated otherwise elsewhere in the Contract, State’s remedy for breach of warranty under paragraph 14.8 includes, at State’s discretion, re performance, repair, replacement, or refund of any prepaid amounts paid by State for the nonconforming Work. For clarification of intent, the foregoing obligations are limited by the limitation of liability in paragraph 14.7. If none of the forgoing options can reasonably be effected, or if the use of the materials by State is made impractical by the nonconformance, then State may seek any remedy available to it under law."

14.10

1.2. Section 508 Compliance PageUp’s public facing

Applicant Services and Careers (as defined in the Statement of Work) aspects of the Application conform to Web Content Accessibility Guidelines 2.0 AA (“WCAG Guidelines”) to the extent listed in the attached PageUp Accessibility Conformance Report - Careers and PageUp Accessibility Conformance Report

PageUp's public facing Application conforms to the WCAG as set out in the VPAT document provided to the State.

2/13/2020 The State accepts the requested change

2/5/2020 Vendor added

1.1 Section 508 Compliance

Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this Contract shall comply with A.R.S. § 18-

131 and § 18-132 and Section 508 of the Rehabilitation Act of 1973, to the degree of conformance indicated in the Vendor’s Voluntary Product Accessibility Template (VPAT).

Based on the State accepting the requested change, the parties agree 14.10 is deleted and replaced with "Section 508 Compliance. Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this Contract shall comply with A.R.S. § 18-131 and § 18-132 and Section 508 of the Rehabilitation Act of 1973, to the degree of conformance indicated in the Vendor’s Voluntary Product Accessibility Template (VPAT)."

Vendor agrees to the following State requested amendment to 3.1.1 (u) Page 4: “Solution meets industry standard accessibility requirements (WCAG 2.1 compliant) to the degree of conformance indicated in the Vendor’s Voluntary Product Accessibility Template (VPAT).”

14.11

14.11 Cloud Applications PageUp can provide a list of penetration testing vendors that it utilizes for the State's review in accordance with (ADOA-ASET).

2/13/2020 The State accepts the requested change

14.11 2. State reserves the right to request the Contractor perform Penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

3. Upon request by the State, Contractor must submit system logs from cloud system to State of AZ security team be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

Based on the State accepting the requested change, the parties agree 14.11.2 is deleted and replaced with "State reserves the right to request the Contractor perform Penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

Parties agree 14.11.3. is delted and replaced with "Upon request by the State, Contractor must submit system logs from cloud system to State of AZ security team be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System)."

1.0

Section 2-D Uniform Terms and Conditions 1.0 Definitions PageUp reserves its rights in relation to the defined terms and proposes that these definitions be agreed during the contract negotiation.

Rejected, exception not accepted. The State is limited in its ability to modify the Uniform Terms and Conditions. Any Concerns would need to be documented and addressed in Special Terms and Conditions.

2/4/2020 Vendor Agreed to remove exception

The Contractor agrees to remove this objection.

2.0

15. Contract Interpretation Please refer to item 9 above.

Rejected, exception not accepted. The State is limited in its ability to modify the Uniform Terms and Conditions. Any Concerns would need to be documented and addressed in Special Terms and Conditions.

2/4/2020 Vendor Agreed to remove exception

The Contractor agrees to remove this objection.

3.0

16. Contract Administration and Operation Please refer to item 10 above

Rejected, exception not accepted. The State is limited in its ability to modify the Uniform Terms and Conditions. Any Concerns would need to be documented and addressed in Special Terms and Conditions.

2/4/2020 Vendor Agreed to remove exception

The Contractor agrees to remove this objection.

Section 2-D: Uniform Terms & Conditions

6.0 19 Risk and Liability Please refer to item 16 above.

PageUp seeks to amend the special terms and conditions by inserting a limitation of liability in this section in line with the limitation of liability set out in the special terms at 14.7.1

Rejected, exception not accepted. The State is limited in its ability to modify the Uniform Terms and Conditions. Any Concerns would need to be documented and addressed in Special Terms and Conditions.

2/13/2020 Vendor Agreed to remove exception

The Contractor agrees to remove this objection.

7.0 20 Warranties Please refer to item 17 above.

7.6.1. PageUp seeks to remove the requirement

that all representations and warranties made by the Contractor under this Contract shall survive the expiration or termination hereof, particularly given Services will no longer be provided post-termination.

Rejected, exception not accepted. The State is limited in its ability to modify the Uniform Terms and Conditions. Any Concerns would need to be documented and addressed in Special Terms and Conditions.

2/13/2020 Vendor Agreed to remove exception

The Contractor agrees to remove this objection.

9.0 22 Termination PageUp proposes that this section is deleted in its entirety and section 13 of the ASP Agreement applies.

9.4 Termination for Convenience - PageUp

requests 90 day notice for termination for convenience to ensure an orderly transition / decomissioning of Services.

9.5.2 Request re-draft to exclude PageUp IP, for

the avoidance of doubt.

9.5.3 This should be covered by general remedies

available to the State.

2/13/2020 The State accepts 9.5.2 change. Vendor accepts removing requested changes in 9.4 and 9.53

9.5.2 Upon termination under this paragraph, and with the exception of intellectual property originated or prepared by Contractor…