Direct Contract Arizona Department of Corrections, Rehabilitation

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

CONTRACTOR IS STRONGLY ENCOURAGED TO READ THE ENTIRE CONTRACT.

Table of Contents

Scope of Work 2 Special Terms and Conditions 5 Addendum A - Contractor Insurance Requirements 13 Addendum B - Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures 18 Uniform Terms and Conditions 10.5 22 Contract Signature Page 38 Attachment 1 - Participation in Boycott of Israel 39 Attachment 2 - Forced Labor of Ethnic Uyghurs Ban 40 Attachment 3 - Rules for Non-Employees of ADCRR in Arizona State Prisons Form 43 Attachment 4 - Pricing 45

Direct Contract | Revision No. 1 | Revised 03-24 | Page 1 of 45

Scope of Work Arizona Department of

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

Scope of Work

1. Purpose and Background

1.1. Purpose: Proposal for University of Cincinnati Information Technology Solutions Center (ITSC) to provide services for the Arizona Department of Corrections Rehabilitation and Reentry (ADCRR) in the form of implementation, maintenance and support of the web-based application, UC’s Risk Assessment System.

1.2. Legal Authority: In accordance with Arizona Revised Statutes (A.R.S.) § 41-2536, and Arizona Administrative Code (A.A.C.) R2-7-E303, Competition Impracticable, ADCRR establishes this Contract with University of Cincinnati Research Institute (UCRI), through its authorized subcontractor by affiliation the ITSC to provide the Materials or Services described herein.

2. Application Description

2.1. The ITSC, through a partnership with the University of Cincinnati's Criminal Corrections Institute (UCCI), provides a risk assessment web application system for criminal justice agencies.

2.1.1. The system automates the scoring and recording of an individual assessment of risk for a justice-involved person, but also provides platforms to use assessment results in evidence-based case planning practices.

2.1.2. The software includes data analysis components that are utilize for informed decision-making across their justice population.

2.2. Upon set up and implementation completion, yearly maintenance service and support for users will begin. This service and support are separate from the initial setup, begins immediately after the production system goes live, and requires yearly renewal. System operation and maintenance will include upkeep of server availability, regular hardware and software maintenance, and updates to the system for reported bugs. Support for users will be provided by the ITSC Help Desk accessible via phone, email and web. User issues will be documented, tracked and responded to within twenty-four (24) business hours to provide status updates.

3. Scope of Work ITSC shall:

3.1. Implement the Risk Assessment Web-Base Application and provide one (1) year of software support, and maintenance post-implementation.

3.2. Provide optional services as descbribed in Section 3.8.

3.3. Post-implementation and one year of maintenance, the maintenance and support can be

Direct Contract | Revision No. 1 | Revised 03-24 | Page 2 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software renewed for one year.

3.3.1. Setup ADCRR hierarchy, user roles, and role permissions.

3.3.2. Setup users and offender data.

3.3.3. Provide a template before going live to upload offender data through a file upload.

3.3.4. Up to 3 uploads can be completed prior to going live to allow cleanup of data.

3.3.5. API integration can be supported at an additional cost.

3.3.6. Attend kickoff meeting and implementation meetings to provide updates.

3.4. Furnish Risk Assessment Web-Base Application Custom Features that include, but not limited to:

3.4.1. Send automated notifications to the primary officer three (3) days before reassessment due date.

3.4.2. Generate weekly summary notifications to primary officer on the offender’s current risk category, upcoming reassessment due dates, and any changes on the offender record.

3.4.3. Generate a notification to primary officer when an offender’s risk level changes from “low” to “high”.

3.4.4. Allow a configuration to skip “pre-questions” section on creating an assessment.

3.5. Provide Support for Users that include, but are not limited to:

3.5.1. Phone, email, and web-based support between 9:00am and 4:00pm EST during business hours;

3.5.2. Document and track all issues; and

3.5.3. Provide users with a status update within twenty-four (24) business hours of initial request.

3.6. Be responsible for System Operation and Maintenance that include, but is not limited to:

3.6.1. Maintaining server availability;

3.6.2. Perform regular hardware and software maintenance; and

3.6.3. Release updates to the system to fix any reported bugs.

3.7. Deliver Recorded Trainings:

3.7.1. One recorded training video for users; and

Direct Contract | Revision No. 1 | Revised 03-24 | Page 3 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

3.7.2. One recorded training video for administrators.

3.8. Optional Items:

3.8.1. Create additional dashboard features to enable users and administrators to view interactive data that can assist with their day-to-day decision-making. Five dashboard modules are included. Additional modules are available for creation.

3.8.2. Create additional reports to enable users to access their data directly and export the data to excel and pdf. Ten reports are included for a list of standard reports. Additional reports are available for creation at a rate of $650 per report. Reports will be determined by ADCRR.

3.8.3. Additional guided online training as needed to train users or administrators (up to 3 hours, up to 15 users). Additional trainings are available at a rate of $550 per training.

3.8.4. API integration can be supported at an additional cost. This scope of work does not include API integration and the cost can be assessed separately if requested.

4. ADCRR shall:

4.1. Complete Data Submission and return the templates, starting with user and offender data four

(4) weeks after project kickoff is completed.

5. Deliverables:

ITSC shall:

5.1. Submit AZ Ramp requirements and approval.

5.2. Milestone 1: Project Kickoff Meeting – Held post-contract execution to review ADCRR structure and share data upload templates due on November 3, 2025.

5.3. Discovery - Requirements gathering due on November 7, 2025.

5.4. System Configuration – ITSC will begin implementing custom features and uploading data to the staging environment

5.5. Reference Data Setup – Once staging is ready, we’ll meet to determine the ADCRR’s preferred reference data (offender status options etc).

5.6. Milestone 2: Reference Data Implementation – ITSC will configure the system reference data based on the discussion on January 12, 2026.

5.7. Pilot Testing – ADCRR will provide a small group to test in the staging environment to validate data accuracy and system functionality .

5.8. Training Preparation – ITSC will provide training videos for the ADCRR team to upload into their training system and track user completion.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 4 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

5.9. Production Data Upload – After training, ADCRR will submit a recent copy of data in the data upload templates for the production environment due on February 13, 2026.

5.10. Milestone 3: Final Testing due on February 20, 2026.

5.11. Go-Live Planning – Once ADCRR administrators validate the production environment, we will schedule a go-live date (a phased rollout is recommended).

5.12. System Training Videos Distributed Agency Wide for identified Users to Complete

5.13. Milestone 4: Go-Live Execution – Users will be able to use the production environment on March 9, 2026.

6. Reporting:

6.1. The Contractor shall submit reports to the ADCRR Business Office with the monthly invoices that include the date, time, and detail of services provided.

7. Payments:

7.1. Milestone 1: Project Kickoff Ten percent (10%) payment

7.2. Milestone 2: Reference Data Implementation Completion Thirty percent (30%) payment

7.3. Milestone 3: Final Testing Completion Thirty percent (30%) payment

7.4. Milestone 4: Go Live Thirty percent (30%) payment

Direct Contract | Revision No. 1 | Revised 03-24 | Page 5 of 45

Special Terms and Conditions Arizona Department of

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

Special Terms and Conditions

1.0 Contract Administration and Operation

1.1 Term of Contract. The term of the Contract will commence on the date indicated on the Offer and Acceptance and continue for twelve (12) months unless canceled, terminated, or permissibly extended.

1.2 Contract Extensions. State may, at its discretion, request for a mutual agreement to extend the initial Contract term in increments of one (1) or more months and do so one or more times, provided that the maximum aggregate term of the Contract including extensions cannot exceed the maximum aggregate term of five (5) years.

1.3 Eligible Agency: This contract is a single-agency contract for the sole use of Arizona Department of Corrections, Rehabilitation & Reentry.

2.0 Costs and Payments

2.1 Pricing: Fixed Pricing

2.2 Price Increase. The State may review a fully documented request for a price increase. The requested increase shall be in writing and be based upon a cost increase to the contractor that was clearly unpredictable at the time of the offer and is directly correlated to the price of the product concerned. Contractor must provide conclusive evidence of a need for any price increases.

2.2.1 Initial Contract prices shall be honored for one year after award of Contract.

2.2.2 The State needs sufficient time to make a fair and equitable determination in response to any Contractor requests for price adjustments. As a result, the State requests that the Contractor provide ninety (90) days advance notice prior to any price adjustment whenever possible, and at a minimum, sixty (60) days advance notice. Requests sent to the State with less than sixty (60) days notice will be denied, unless the Contractor provides proper documentation demonstrating the urgency of the request. The State shall determine whether the price increase is in the best interest of the State.

2.2.3 All price adjustments will be implemented by a formal Contract Amendment. State shall determine whether the requested price increase or an alternate option is in the best interest of the State.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 6 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

3.0 Contract Changes

3.1 General Contractor Indemnification and Insurance Requirements

3.1.1 Contractor Indemnification (Not Public Agency). To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona.

3.1.2 Public Agency Language Only. Each party (as 'indemnitor') agrees to indemnify, defend, and hold harmless the other party (as 'indemnitee') from and against any and all claims, losses, liability, costs, or expenses (including reasonable attorney's fees) (hereinafter collectively referred to as 'claims') arising out of bodily injury of any person (including death) or property damage but only to the extent that such claims which result in vicarious/derivative liability to the indemnitee, are caused by the act, omission, negligence, misconduct, or other fault of the indemnitor, its officers, officials, agents, employees, or volunteers."

Direct Contract | Revision No. 1 | Revised 03-24 | Page 7 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

3.1.3 Insurance Requirements: Addendum A to the Special Terms and Conditions:

Contractor Insurance Requirements is incorporated herein as part of the Special Terms and Conditions.

4.0 Warranties

4.1 Warranties and Requirements Related to Information Technology. Addendum B:

Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures is incorporated herein as part of the Special Terms and Conditions.

5.0 General Provisions for Services:

5.1 Applicability. Article 13 applies to the extent the Work is or includes Services.

5.2 Comprehensive Services. Contractor shall provide the comprehensive range of Services for which a price is established in the Contract for ordering by Eligible Agencies.

5.3 Additional Services. State at its discretion may modify the scope of the Contract by Contract Amendment to include additional Services or service categories that are within the general scope of the ones originally covered by the Contract. Once the Contract Amendment is fully executed, Contractor shall then update all applicable pricing and make them available to all affected entities at no additional cost. Either party may make the request to add Services to the Contract; regardless of who makes the request, the parties shall negotiate in good faith a fair price for any additional Services, but State may elect not to add some or all of the Services in question if no agreement is reached on pricing in a timely manner. Contractor’s request or proposal in response to State’s request shall include documentation demonstrating that the proposed price for the additional Services is both fair and reasonable and comparable to the original prices.

5.4 Off-Contract Services. Contractor shall ensure that the ordering process for the Services prevents Orders for Services not included in the scope of the Contract (and for which no price or compensation has been established in the Contract) or Services explicitly excluded from the Contract. Notwithstanding that State might have its own internal administrative rules regarding off-contract or excluded ordering of Services, and endeavors to prevent such Orders from occurring, Contractor is responsible for not accepting any such Orders.

State may, at its discretion, cancel any such Order without obligation.

5.5 Removal of Personnel. Notwithstanding that Contractor is in every circumstance responsible for hiring, assigning, directing, managing, training, disciplining, and rewarding its personnel, State may at its discretion, and without the obligation to demonstrate cause, Direct Contract | Revision No. 1 | Revised 03-24 | Page 8 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software instruct Contractor to remove any of its personnel from State’s facilities or from further assignment under the Contract. In such cases, Contractor shall promptly replace removed personnel with other personnel that have equivalent qualifications, experience, and capabilities.

5.5.1 The inability of Contractor find such replacement personnel possessing the equivalent qualifications, experience, and capabilities of the removed personnel, shall not constitute breach by Contractor under this Contract.

5.6 Accuracy of Work. Contractor is responsible for the accuracy of the Services and shall promptly make all necessary revisions or corrections resulting from errors and omissions on its part without additional compensation. Acceptance by State shall not relieve Contractor of responsibility for correction of any errors discovered subsequently or necessary clarification of any ambiguities.

5.7 Requirements at Location of Services

5.7.1 Contractor personnel shall perform their assigned portions of the Services at the specific location indicated in the Order. Contractor acknowledges that the location might be inside an industrial building, institutional building, or one of various office types and classes.

5.7.2 If performing the Services requires Contractor personnel to work inside a secured perimeter at certain institutional facilities (including but not limited to prisons) where prior clearances are required, Contractor shall contact the facility directly in advance of performing the Services to confirm its current security clearance procedures, allowable hours for work, visitor dress code, and other applicable rules. State shall not pay any additional fees (including but not limited to service charges) or excuse late performance, if Contractor has failed to comply with these requirements.

5.7.3 Acceptance of Services. State has the right to accept Services subject to acceptance criteria. State may apply acceptance criteria to the Contract or a specific Order, which may include, but are not limited to, accuracy, completeness, conformance to requirements, or quality. State shall not pay Contractor for unaccepted Services, and State may, at its discretion, withhold or make partial payment for any rejected Services, while Contractor is in the process of re-performing or otherwise curing the grounds for State’s rejection.

5.7.4 Corrective Action Required. Notwithstanding any other guarantees, general warranties, or particular warranties Contractor has given under the Contract, and in addition to any other rights and remedies available under the Contract, if Contractor fails to perform any material portion of the Services including, but not limited to, failure to complete any contractual deliverable or failure to meet agreed-upon

Direct Contract | Revision No. 1 | Revised 03-24 | Page 9 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software service levels or service standards set out in or referred to in the Contract, then Contractor shall perform a root-cause analysis to identify the source of the failure and use all commercially reasonable efforts to correct the failure and meet the Contract requirements as promptly as is practicable.

5.7.4.1 Contractor shall provide State a report detailing the identified cause and setting out its detailed corrective action plan promptly after the date the failure occurred (or the date when the failure first became apparent, if it was not apparent immediately after occurrence).

5.7.4.2 State may demand to review and approve Contractor’s analysis and plans, and Contractor shall make any and all reasonable corrections State instructs and adopt State’s recommendations, including any measures State determines to be necessary for employee or public safety, or the protection of property or the environment.

5.7.4.3 Contractor shall take the necessary action(s) to avoid any like failures in the future.

5.8 Redress of Infringement

5.8.1 Replace, License, or Modify. If Contractor becomes aware that any Materials or Services infringe, or are likely to be infringing, on any third party’s intellectual property rights, then Contractor shall, at its sole cost and expense and in consultation with State, either:

5.8.1.1 replace any infringing items with non-infringing ones;

5.8.1.2 obtain for State the right to continue using the infringing items; or

5.8.1.3 modify the infringing items so that they become non-infringing, so long as they continue to function as specified following the modification.

5.8.2 Cancellation Option. In every case under 15.6.1, if none of those options can reasonably be accomplished, or if the continued use of the infringing items is impracticable, State may cancel the relevant Order or terminate the Contract, and Contractor shall take back the infringing items. If State does cancel the Order or terminate the Contract, Contractor shall refund to State:

5.8.3 for any software created for State under the Contract, the amount State paid to Contractor for creating it;

5.8.4 for all other Materials, the net book value of the product provided according to generally accepted accounting principles; and

Direct Contract | Revision No. 1 | Revised 03-24 | Page 10 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

5.8.5 for Services, the amount paid by State or an amount equal to twelve (12) months of charges, whichever is less.

5.9 Exceptions. Contractor will not be liable for any claim of infringement based solely on any of the following by a State Indemnitee:

5.9.1 modification or use of Materials other than as contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor;

5.9.2 operation of Materials with any operating software other than that supplied by Contractor or authorized or proposed by a Contractor Indemnitor; or

5.9.3 combination or use with other products in a manner not contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor.

6.0 Press/Publicity: Prior to pursuing any press or publicity regarding these services, the contractor shall work with ADCRR’s Communications Department. ADCRR retains approval rights concerning any such factors.

7.0 Business Standing A.R.S. § 10-1501: A selected Contractor whose business structure requires that documents be filed regularly with the Arizona Corporation Commission (ACC) must remain in good standing with the ACC during the term of the Contract. An out-of-state firm selected for Contract award must file necessary documents with the ACC as doing business in Arizona prior to execution of the Contract and, throughout the term of the Contract, must remain in good standing with the ACC and the entity where the original documents were filed.

8.0 Independent Status Of The Contractor:

8.1 Personnel actions of employees on the Contractor’s payroll shall be the Contractor's responsibility. The Contractor shall comply with all applicable government regulations related to the employment, compensation and payment of personnel.

8.2 The Department will not be responsible in any way for the damage or loss caused by fire, theft, accident, or otherwise to the Contractor's stored supplies, materials, equipment, or Contractor’s employee's personal property stored on Department property.

9.0 Confidentiality Of Records: The Contractor shall establish and maintain procedures and controls, that are acceptable to the Department for the purpose of assuring that no information contained in its records or obtained from the Department or from others in carrying out its functions under the Contract shall be used or disclosed by it, its agents, officers, or employees, except as required to efficiently perform duties under the Contract. Persons requesting such information should be referred to the Department. Contractor also agrees that any information pertaining to individual persons shall not be divulged other than to employees or officers of the Contractor as needed for the performance of duties under the Contract, unless otherwise agreed to in writing by the Department.

10.0 Compliance With Department Laws, Rules And Regulations: The Contractor shall abide by all formally adopted Department Rules and General Operating Policies and Procedures as

Direct Contract | Revision No. 1 | Revised 03-24 | Page 11 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software applicable for fulfilling the obligations outlined in the Contract. Any allegations of non-compliance with Department Rules, General Operating Policies and/or Procedures, or other Contractor misconduct shall be subject to investigation by the Department and may result in Contract termination. The Department’s General Operating Policies and Procedures are available for review upon request.

11.0 Rules And Regulations

11.1 Attention of the bidders is called to the requirements of the document Rules and Regulations for Non-Employees of the Department of Corrections in Arizona State Prison Complex, Attachment 3, which are attached herein, and which shall be adhered to in all respects.

11.2 Should the owner require signatures of other parties such as subcontractor or persons directly or indirectly employed by the contractor, it shall be the contractor's responsibility to obtain such signatures. The signed document must be submitted within ten (10) days of notification of intent to award.

12.0 ADCRR reserves the right to make investigations, as deemed necessary, to determine the ability of the contractor to perform the specified work. The contractor shall furnish to ADCRR all such information and data for this purpose as may be requested. ADCRR reserves the right to reject any bid if evidence submitted or investigation fails to satisfy the owner that the contractor is properly qualified to carry out the obligations of the solicitation. Conditional bids shall not be accepted.

13.0 Notice Warning: Any person who takes into or out of or attempts to take into or out of a correctional facility or the grounds belonging to or adjacent to a correctional facility, any item not specifically authorized by the correctional facility, shall be prosecuted under the provisions of the Arizona Revised Statutes. All persons, including employees and visitors, entering upon these confines are subject to routine searches of their persons, vehicles, property or packages.

Authority: A.R.S. § 13-2501;

A.R.S. § 13-2505;

ADCRR Department Order 708

14.0 Contraband: Contraband means any dangerous drug, narcotic drug, intoxicating liquor of any kind, deadly weapon, dangerous instrument, explosive or any other article whose use of or possession would endanger the safety, security or preservation of order in a correctional facility or any person therein. (Any other article includes any substance which could cause abnormal behavior, i.e., marijuana, nonprescription medication, etc.) Promoting prison contraband A.R.S.

§ 13-2505:

Authority: A.R.S. § 13-2501;

A.R.S. § 13-2505;

ADCRR Department Order 708

15.0 Federal Prison Rape Elimination Act 2003: The Contractor shall comply with the Federal Prison Rape Elimination Act of 2003. Reference 28 C.F.R. Part 115.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 12 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

15.1 Is employed by the ADCRR or the Department of Juvenile Corrections.

15.2 Is employed by a private prison facility or a city or county jail.

15.3 Contracts to provide services with the ADCRR, the Department of Juvenile Corrections, a private prison facility or a city or county jail.

15.4 Is an official visitor, volunteer or agency representative of the ADCRR, the Department of Juvenile Corrections, a private prison facility or a city or county jail.

15.5 This section does not apply to a person who is employed by the ADCRR, a private prison facility or a city or county jail or who contracts to provide services with the ADCRR, a private prison facility or a city or county jail or an offender who is on release status if the person was lawfully married to the prisoner or offender on release status before the prisoner or offender was sentenced to the ADCRR or was incarcerated in a city or county jail.

15.6 Unlawful sexual conduct with an offender who is under fifteen years of age is a class 2 felony. Unlawful sexual conduct with an offender who is between fifteen and seventeen years of age is a class 3 felony. All other unlawful sexual conduct is a class 5 felony.

15.7 Unlawful sexual conduct; correctional facilities; classification; Definition A.R.S. §13-1419.

16.0 Unlawful Sexual Conduct: A person commits unlawful sexual conduct by intentionally or knowingly engaging in any act of a sexual nature with an offender who is in the custody of the ADCRR, the Department of Juvenile Corrections, a private prison facility or a city or county jail or with an offender who is under the supervision of either Department or a city or county. For the purposes of this subsection, "person" means a person who:

17.0 Eligibility For State Or Local Public Benefits; Documentation And Violations: Contractors providing services to the State, shall ensure compliance with A.R.S. § 1-502. A.R.S. § 1-502 requires each person applying or receiving a public benefit to provide documented proof which demonstrates a lawful presence in the United States. The State shall reserve the right to conduct unscheduled, periodic process and documentation audits to ensure Contractor compliance. All available contract remedies, up to and including termination may be taken for failure to comply with A.R.S. § 1-502 in the delivery of services under this Contract.

18.0 Security: Contractor shall, forty-eight hours prior to starting work, supply the full names, dates of birth and social security numbers for all employees and subcontractor employees who may be working at the job-site, for advance security clearance.

18.1 Contractor will be required to perform all work in conjunction with the Security Unit while on the institutional grounds and shall be responsible for all personnel employed by their firm to ensure that institutional dress codes and overall policies are followed.

19.0 Permits: Contractor will obtain and pay for all required permits and licenses.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 13 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

20.0 Invoicing/Billing Requirements: A legible and detailed invoice shall be provided by the Contractor to Accounting at ADCPayables@azadc.gov or mail to the address below:

Arizona Department of Corrections, Rehabilitation, and Reentry Attn: Accounts Payable 701 E. Jefferson Street Phoenix, AZ 85034

20.1 At a minimum the invoice shall include:

Department Location’s Name and Address Contractor’s Name, Remit to Address and Contact Information Contract Number Purchase Order Number Invoice Number and Date Date the items or services were shipped or provided Applicable Contract line item Applicable taxes Total Invoice Amount Due

20.2 Invoices not sent to the proper address or not containing the necessary and required information may delay payment. A Contractor whose payments are delayed due to improper invoicing shall make no claim(s) against the Department or the State for late or finance charges.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 14 of 45

Addendum A to the Special Terms and Conditions Arizona Department of

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

Addendum A - Contractor Insurance Requirements

Insurance Requirements

1. Indemnification Clause

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

1.1. Insurance Requirements

1.1.1. Contractor and subcontractors shall procure and maintain, until all of their obligations have been discharged, including any warranty periods under this Contract, insurance against claims for injury to persons or damage to property arising from, or in connection with, the performance of the work hereunder by the Contractor, its agents, representatives, employees or subcontractors.

1.1.2. The Insurance Requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State of Arizona in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that arise out of the performance of the work under this Contract by the Contractor, its agents, representatives, employees or subcontractors, and the Contractor is free to purchase additional insurance.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 15 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

1.2. Minimum Scope and Limits of Insurance

Contractor shall provide coverage with limits of liability not less than those stated below

1.2.1. Commercial General Liability (CGL) – Occurrence Form

Policy shall include bodily injury, property damage, and broad form contractual liability coverage.

● General Aggregate $2,000,000

● Products – Completed Operations Aggregate $1,000,000

● Personal and Advertising Injury $1,000,000

● Damage to Rented Premises $50,000

● Each Occurrence $1,000,000

a. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by or on behalf of the Contractor.

b. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

1.2.2. Business Automobile Liability

Bodily Injury and Property Damage for any owned, hired, and/or non- owned automobiles used in the performance of this Contract.

● Combined Single Limit (CSL) $1,000,000

a. Policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by, or on behalf of, the Contractor involving automobiles owned, hired and/or non-owned by the Contractor.

b. Policy shall contain a waiver of subrogation endorsement as required by this written agreement in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 16 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

1.2.3. Workers’ Compensation and Employers' Liability

● Workers' Compensation Statutory

● Employers' Liability o Each Accident $1,000,000 o Disease – Each Employee $1,000,000 o Disease – Policy Limit $1,000,000

1.3. Additional Insurance Requirements

The policies shall include, or be endorsed to include, as required by this written agreement, the following provisions

1.3.1. The Contractor's policies, as applicable, shall stipulate that the insurance afforded the Contractor shall be primary and that any insurance carried by the Department, its agents, officials, employees or the State of Arizona shall be excess and not contributory insurance, as provided by A.R.S. § 41-621 (E).

1.3.2. Insurance provided by the Contractor shall not limit the Contractor’s liability assumed under the indemnification provisions of this Contract.

1.4. Notice of Cancellation

Applicable to all insurance policies required within the Insurance Requirements of this Contract, Contractor’s insurance shall not be permitted to expire, be suspended, be canceled, or be materially changed for any reason without thirty (30) days prior written notice to the State of Arizona. Within two (2) business days of receipt, Contractor must provide notice to the State of Arizona if they receive notice of a policy that has been or will be suspended, canceled, materially changed for any reason, has expired, or will be expiring. Such notice shall be sent directly to the Department and shall be mailed or emailed to Arizona Department of Corrections, Rehabilitation, and Reentry: 701 E.

Jefferson St. Procurement Services, Mail Code 55302 Phoenix, AZ 85034, email:

PROCUREMENT@azadc.gov

1.5. Acceptability of Insurers

Contractor’s insurance shall be placed with companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers. Insurers shall have an “A.M. Best” rating of not less than A- VII. The State of Arizona in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 17 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

1.6. Verification of Coverage

Contractor shall furnish the State of Arizona with certificates of insurance (valid ACORD form or equivalent approved by the State of Arizona) evidencing that Contractor has the insurance as required by this Contract. An authorized representative of the insurer shall sign the certificates.

1.6.1. All such certificates of insurance and policy endorsements must be received by the State before work commences. The State’s receipt of any certificates of insurance or policy endorsements that do not comply with this written agreement shall not waive or otherwise affect the requirements of this agreement.

1.6.2. Each insurance policy required by this Contract must be in effect at, or prior to, commencement of work under this Contract. Failure to maintain the insurance policies as required by this Contract, or to provide evidence of renewal, is a material breach of contract.

1.6.3. All certificates required by this Contract shall be sent directly to the Department.

The State of Arizona project/contract number and project description shall be noted on the certificate of insurance. The State of Arizona reserves the right to require complete copies of all insurance policies required by this Contract at any time.

1.7. Subcontractors

Contractor’s certificate(s) shall include all subcontractors as insureds under its policies or Contractor shall be responsible for ensuring and/or verifying that all subcontractors have valid and collectable insurance as evidenced by the certificates of insurance and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum Insurance Requirements identified above. The Department reserves the right to require, at any time throughout the life of this contract, proof from the Contractor that its subcontractors have the required coverage.

1.8. Approval and Modifications

The Contracting Agency, in consultation with State Risk, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary. Such action will not require a formal Contract amendment but may be made by administrative action.

1.9. Exceptions

In the event the Contractor or subcontractor(s) is/are a public entity, then the Insurance Requirements shall not apply. Such public entity shall provide a certificate of self-insurance. If the Contractor or subcontractor(s) is/are a State of Arizona agency, Direct Contract | Revision No. 1 | Revised 03-24 | Page 18 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software board, commission, or university, none of the above shall apply.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 19 of 45

Addendum B to the Special Terms and Conditions Arizona Department of

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

Addendum B - Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures

1. Security Standards

1.1. Security of the State’s systems and Data are of utmost importance to the State. In order to assure security from a personnel and operations perspective, Contractor shall comply with all requirements, in their entirety, as described in the statewide enterprise architecture; statewide Information Technology security policies, standards, and procedures; and any applicable agency-specific Information Technology security policies, standards, and procedures.

1.2. Contractor shall follow the correct, current version of these policies, standards, and procedures established by the Arizona Department of Homeland Security (AZDOHS) pursuant to their authority under A.R.S. Title 41, Chapter 41. The current website for these policies, standards, and procedures is: Information Technology Policies, Standards and Procedures.

Note that this link is provided for convenience only.

1.3. For security reasons, some state facilities require non-state personnel to have escorts. If required by the state facility, Contractor personnel shall only be allowed inside of a State facility if accompanied by an escort designated by the State. This is applicable in Correctional facilities, Public Safety facilities, State Lottery, and other facilities as designated by the State.

2. Security Framework

2.1. The State of Arizona information security policies and standards follow the National Institute of

Standards and Technology (NIST) SP 800-53 Rev. 5 Security and Privacy Guidelines may currently be located at:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.

2.2. The State has established a process to assess risk associated with storing, processing and/or transmitting State of Arizona Data with external, non-State of Arizona entities. The Arizona Risk and Authorization Management Program (AZRamp) was developed to ensure State and contractors meet these requirements.

2.3. In the State’s sole discretion, the State may also accept current FedRamp and StateRamp certifications as evidence that the Contractor has met the State's risk assessment requirements.

2.4. Other forms of Cybersecurity Frameworks (CSF), Trust Documents, Self-Attestations, including, but not limited to, ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance, may be reviewed as part of the State’s risk assessment, but are not exclusive or conclusive evidence that the Contractor has met the State’s risk assessment requirements.

3. Additional Security Requirements

3.1. Contractor shall comply with all security requirements requested by the State.

Direct Contract | Revision No. 1 | Revised 03-24 | Page 20 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software

3.2. If an Arizona Risk and Authorization Management Program (AZRamp) is required, it will generally follow these steps, each of which shall be completed by the Contractor upon request by the State:

3.2.1. Contractor shall submit a completed Arizona Baseline Infrastructure Security

Controls Prerequisite assessment spreadsheet with its Offer. The Arizona Baseline Infrastructure Security Controls Prerequisite assessment spreadsheet as found at:

https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_pre-requis ite__0_0.xls, and mitigate gaps or install compensating controls for any issues of concern identified by State.

3.2.2. Contractor shall provide Information Security documentation for the AZRamp assessment to include System Security Plan (SSP), Written Information Security Programs (WISP), or supporting written IT policies for review of the assessment.

3.2.3. Note regarding the confidential treatment of Contractor information:

3.2.3.1. The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDA) for release to review submitted SSPs, WISPs, or written IT policies will not be considered.

3.2.3.2. Submitted SSPs, WISPs, or written IT policies are deleted and not retained after AZRamp Authorization is granted.

3.2.3.3. Procedures for submission of documents considered confidential or proprietary are identified within this RFP.

3.2.3.4. Special secure transfer of documents related to this AZRamp review process may be made by contacting: GRC@AZDOHS.gov to make special arrangements for the transfer of these documents.

3.2.4. If applicable to this Solicitation, Contractor shall complete and submit with the Offer an unedited and signed State of Arizona Health Insurance Portability and Accountability Act (HIPAA) Business Associate Addendum (BAA).

3.2.5. All contract awards are contingent on the successful completion of the AZRamp 125 Low Impact (public information) or the AZRamp 325 Moderate (Confidential, PII, or PHI) Impact Control spreadsheet titled “Arizona Infrastructure Security Controls 2017 (Excel),” to be determined by the Enterprise Security, Privacy & Risk Compliance team. Low (Column E) and Moderate (Column F) Impact controls spreadsheet can be located here:

https://azdohs.gov/sites/default/files/arizona_baseline_security_controls_2017_v2_ 0_0.xls.

3.3. The State reserves the right to conduct risk assessments, vulnerability assessments, black-box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall

Direct Contract | Revision No. 1 | Revised 03-24 | Page 21 of 45

& Reentry 701 E. Jefferson Street

Phoenix, AZ 85034

Contract No.: CTR079289

Description: Ohio Risk Assessment System and Case Planning - Software respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s).

3.4. Upon request, Contractor shall submit copies of system logs from Contractor’s environment to the State of AZ security team in the format requested to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3.5. Contractor shall comply with all applicable State and Federal laws and regulations, including, but not limited to, the following (please note that the links are provided for convenience only and may change):

3.5.1. State of Arizona statewide policies, standards and procedures:

https://azdohs.gov/information-technology-it-policies-standards-and-procedures;

3.5.2. Federal…