DOR15018 Hardware Queuing Draft Contract.pdf

Routing # TAA 15/

STATE OF COLORADO

Colorado Department of Revenue

Contract with

TABLE OF CONTENTS

1. PARTIES

2. EFFECTIVE DATE AND NOTICE OF NONLIABILITY

3. RECITALS

4. DEFINITIONS

5. TERM

6. STATEMENT OF WORK

7. PAYMENTS TO CONTRACTOR

8. REPORTING - NOTIFICATION

9. CONTRACTOR RECORDS

10. CONFIDENTIAL INFORMATION-STATE RECORDS

11. CONFLICTS OF INTEREST

12. REPRESENTATIONS AND WARRANTIES

13. INSURANCE

14. BREACH

15. REMEDIES

16. NOTICES and REPRESENTATIVES

17. RIGHTS IN DATA, DOCUMENTS, AND COMPUTER SOFTWARE

18. GOVERNMENTAL IMMUNITY

19. STATEWIDE CONTRACT MANAGEMENT SYSTEM

20. GENERAL PROVISIONS

21. COLORADO SPECIAL PROVISIONS

22. SIGNATURE PAGE

EXHIBIT A – STATEMENT OF WORK

EXHIBIT B – PRICES AND RATES

EXHIBIT C – CONTRACTOR’S PROPOSAL

EXHIBIT D – OPTION LETTER

EXHIBIT E – STATEMENT OF CONFIDENTIALITY

EXHIBIT F – AFFADAVIT OF NON-CONFLICT OF INTEREST

1. PARTIES

This Contract (hereinafter called “Contract”) is entered into by and between __________ (hereinafter called “Contractor”), and the STATE OF COLORADO acting by and through the Colorado Department of Revenue, Division of Motor Vehicles (hereinafter called the “State”). Contractor and the State hereby agree to the following terms and conditions.

2. EFFECTIVE DATE AND NOTICE OF NONLIABILITY

This Contract shall not be effective or enforceable until it is approved and signed by the Colorado State Controller or designee (hereinafter called the “Effective Date”). The State shall not be liable to pay or reimburse Contractor for any performance hereunder including, but not limited to, costs or expenses incurred, or be bound by any provision hereof prior to the Effective Date.

3. RECITALS

A. Authority, Appropriation, and Approval

Authority to enter into this Contract exists in the Law and funds have been budgeted, appropriated and otherwise made available and a sufficient unencumbered balance thereof remains available for payment.

Required approvals, clearance and coordination have been accomplished from and with appropriate agencies.

B. Consideration The Parties acknowledge that the mutual promises and covenants contained herein and other good and valuable consideration are sufficient and adequate to support this Contract.

C. Purpose The State is pursuing a new contract for an Offeror to provide kiosks and ancillary hardware for the DMV.

D. References All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits or other attachments, are references to sections, subsections, exhibits or other attachments contained herein or incorporated as a part hereof, unless otherwise noted.

4. DEFINITIONS

The following terms as used herein shall be construed and interpreted as follows:

Administrator – “Administrator” means DMV individuals given access to the System to conduct

Administrator functions as identified in this Contract.

Applicant – “Applicant” means customer and citizen Budget - “Budget” means the budget for the Work described in Exhibit A.

Contract - “Contract” means this Contract, its terms and conditions, attached exhibits, documents incorporated by reference under the terms of this Contract, and any future modifying agreements, exhibits, attachments or references incorporated herein pursuant to Colorado State law, Fiscal Rules, and State Controller Policies.

Contract Funds - “Contract Funds” means funds available for payment by the State to Contractor pursuant to this Contract.

C.R.S. – “C.R.S.” means Colorado Revised Statutes, a compilation of our State laws.

Department - “Department” means Department of Revenue of the State of Colorado.

DLO – “DLO” means Driver’s License Office.

DLS – “DLS” means Driver’s License System; which is a DMV mainframe application.

DMV – “DMV” means Division of Motor Vehicles.

Evaluation - “Evaluation” means the process of examining Contractor’s Work and rating it based on criteria established in §6 and Exhibit A.

Technician – “Technician” means Driver’s License Technician.

Exhibits and other Attachments - The following are attached hereto and incorporated by reference herein:

Exhibit A (Statement of Work) , Exhibit B (Prices and Rates), Exhibit C (Contractor’s Proposal), Exhibit D (Option Letter), Exhibit E (Statement of Confidentiality), and Exhibit F (Affidavit of Non-Conflict of Interest).

FCC – “FCC” means Federal Communications Commission.

Goods - “Goods” means tangible material acquired, produced, or delivered by Contractor either separately or in conjunction with the Services Contractor renders hereunder.

OIT – “OIT” means Office of Information Technology.

Party or Parties - “Party” means the State or Contractor and “Parties” means both the State and Contractor.

PC – “PC” means Personal Computer.

PIC – “PIC” means Personal Identification Code.

PII – “PII” means Personally Identifiable Information.

PIN – “PIN” means Personal Identification Number.

Review - “Review” means examining Contractor’s Work to ensure that it is adequate, accurate, correct and in accordance with the criteria established in §6 and Exhibit A.

Services - “Services” means the required services to be performed by Contractor pursuant to this Contract.

State – “State” means State of Colorado.

System – “System” means hardware and software provided by Contractor .

UL – “UL” means Underwriter’s Laboratories.

Work - “Work” means the tasks and activities Contractor is required to perform to fulfill its obligations under this Contract and Exhibit A, including the performance of the Services and delivery of the Goods.

Work Product - “Work Product” means the tangible or intangible results of Contractor’s Work, including, but not limited to, software, research, reports, studies, data, photographs, negatives or other finished or unfinished documents, drawings, models, surveys, maps, materials, or work product of any type, including drafts.

5. TERM

A. Initial Term-Work Commencement The Parties’ respective performances under this Contract shall commence on the later of either the Effective Date or _______. This Contract shall terminate on _______ unless sooner terminated or further extended as specified elsewhere herein.

B. Two Month Extension The State, at its sole discretion and upon written notice to Contractor as provided in §16, may unilaterally extend the term of this Contract for a period not to exceed two months if a replacement contract has not been fully executed by the term date of this Contract. The provisions of this Contract in effect when such notice is given, including, but not limited to prices, rates, and delivery requirements, shall remain in effect during the two-month extension. The two month extension shall immediately terminate when and if a replacement contract is approved and signed by the Colorado State Controller.

C. State’s Option to Extend The State may require continued performance of maintenance and support for two (2) additional one (1) year periods at the same rates in Exhibit B and same terms specified in the Contract. If the State exercises this option, it shall provide written notice to Contractor at least 30 days prior to the end of the current contract term in form substantially equivalent to Exhibit D If exercised, the provisions of the Option Letter shall become part of and be incorporated into this Contract. The total duration of this Contract, including the exercise of any options under this clause, shall not exceed 5 years.

6. STATEMENT OF WORK

A. Completion Contractor shall complete the Work and its other obligations as described herein and in Exhibit A on or before May 31, 2015. The State shall not be liable to compensate Contractor for any Work performed prior to the Effective Date or after the termination of this Contract.

B. Goods and Services Contractor shall procure Goods and Services necessary to complete the Work. Such procurement shall be accomplished using the Contract Funds and shall not increase the maximum amount payable hereunder by the State.

C. Employees All persons employed by Contractor to perform Work under this Contract shall be Contractor’s employee(s) for all purposes hereunder and shall not be employees of the State for any purpose as a result of this Contract.

7. PAYMENTS TO CONTRACTOR

The State shall, in accordance with the provisions of this §7, pay Contractor in the amounts and using the methods set forth below:

A. Maximum Amount The maximum amount payable under this Contract to Contractor by the State is $________as determined by the State from available funds. Payments to Contractor are limited to the unpaid obligated balance of the Contract set forth in Exhibit B. The maximum amount payable by the State to Contractor during each State fiscal year of this Contract shall be:

$ in FY2015 $ in FY2016

B. Payment

i. Advance, Interim and Final Payments Payment under this contract will be made upon project completion and acceptance by the State as identified in this Contract. If the State extends the timeline for project completion, the State shall pay for work completed and accepted by the State up to the date of project extension. In the event of an extension to the deployment timeline, the State shall withhold ten percent (10%) of each payment milestone as retainage. Upon final system acceptance by the DMV, the retainage will be released.

Any advance payment allowed under this Contract or in Exhibit B shall comply with State Fiscal Rules and be made in accordance with the provisions of this Contract or such Exhibit. Contractor shall initiate any payment requests by submitting invoices to the State in the form and manner set forth in approved by the State.

ii. Interest The State shall fully pay each invoice within 45 days of receipt thereof if the amount invoiced represents performance by Contractor previously accepted by the State. Uncontested amounts not paid by the State within 45 days shall bear interest on the unpaid balance beginning on the 46th day at a rate not to exceed one percent per month until paid in full; provided, however, that interest shall not accrue on unpaid amounts that are subject to a good faith dispute. Contractor shall invoice the State separately for accrued interest on delinquent amounts. The billing shall reference the delinquent payment, the number of day’s interest to be paid and the interest rate.

iii. Available Funds-Contingency-Termination The State is prohibited by law from making commitments beyond the term of the State’s current fiscal year. Therefore, Contractor’s compensation beyond the State’s current Fiscal Year is contingent upon the continuing availability of State appropriations as provided in the Colorado Special Provisions. If federal funds are used to fund this Contract, in whole or in part, the State’s performance hereunder is contingent upon the continuing availability of such funds. Payments pursuant to this Contract shall be made only from available funds encumbered for this Contract and the State’s liability for such payments shall be limited to the amount remaining of such encumbered funds. If State or federal funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may terminate this Contract immediately, in whole or in part, without further liability in accordance with the provisions hereof.

iv. Erroneous Payments At the State’s sole discretion, payments made to Contractor in error for any reason, including, but not limited to overpayments or improper payments, and unexpended or excess funds received by Contractor, may be recovered from Contractor by deduction from subsequent payments under this Contract or other contracts, grants or agreements between the State and Contractor or by other appropriate methods and collected as a debt due to the State. Such funds shall not be paid to any person or entity other than the State.

C. Use of Funds Contract Funds shall be used only for eligible costs identified herein and/or in the Budget.

8. REPORTING - NOTIFICATION

Reports, Evaluations, and Reviews required under this §8 shall be in accordance with the procedures of and in such form as prescribed by the State and in accordance with §19, if applicable.

A. Performance, Progress, Personnel, and Funds Contractor shall submit a report to the State upon expiration or sooner termination of this Contract, containing an Evaluation and Review of Contractor’s performance and the final status of Contractor's obligations hereunder. In addition, Contractor shall comply with all reporting requirements, if any, set forth in Exhibit A.

B. Litigation Reporting Within 10 days after being served with any pleading in a legal action filed with a court or administrative agency, related to this Contract or which may affect Contractor’s ability to perform its obligations hereunder, Contractor shall notify the State of such action and deliver copies of such pleadings to the State’s principal representative as identified herein. If the State’s principal representative is not then serving, such notice and copies shall be delivered to the Executive Director of Colorado Department of Revenue.

C. Noncompliance Contractor’s failure to provide reports and notify the State in a timely manner in accordance with this §8 may result in the delay of payment of funds and/or termination as provided under this Contract.

9. CONTRACTOR RECORDS

A. Maintenance Contractor shall make, keep, maintain, and allow inspection and monitoring by the State of a complete file of all records, documents, communications, notes and other written materials, electronic media files, and communications, pertaining in any manner to the Work or the delivery of Services or Goods hereunder.

Contractor shall maintain such records until the last to occur of: (i) a period of three years after the date this Contract expires or is sooner terminated, or (ii) final payment is made hereunder, or (iii) the resolution of any pending Contract matters, or (iv) if an audit is occurring, or Contractor has received notice that an audit is pending, until such audit has been completed and its findings have been resolved (collectively, the “Record Retention Period”).

B. Inspection Contractor shall permit the State, the federal government and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy and/or transcribe Contractor's records related to this Contract during the Record Retention Period for a period of three years following termination of this Contract or final payment hereunder, whichever is later, to assure compliance with the terms hereof or to evaluate performance hereunder. The State reserves the right to inspect the Work at all reasonable times and places during the term of this Contract, including any extensions or renewals. If the Work fails to conform to the requirements of this Contract, the State may require Contractor promptly to bring the Work into conformity with Contract requirements, at Contractor’s sole expense. If the Work cannot be brought into conformance by re-performance or other corrective measures, the State may require Contractor to take necessary action to ensure that future performance conforms to Contract requirements and exercise the remedies available under this Contract, at law or in equity, in lieu of or in conjunction with such corrective measures.

C. Monitoring Contractor shall permit the State, the federal government, and governmental agencies having jurisdiction, in their sole discretion, to monitor all activities conducted by Contractor pursuant to the terms of this Contract using any reasonable procedure, including, but not limited to: internal evaluation procedures, examination of program data, special analyses, on-site checking, formal audit examinations, or any other procedures. All monitoring controlled by the State shall be performed in a manner that shall not unduly interfere with Contractor’s performance hereunder.

D. Final Audit Report If an audit is performed on Contractor’s records for any fiscal year covering a portion of the term of this Contract, Contractor shall submit a copy of the final audit report to the State or its principal representative at the address specified herein.

10. CONFIDENTIAL INFORMATION-STATE RECORDS

Contractor and the State shall comply, and shall cause each of its Subcontractors and any other party performing work under this Contract to comply with the provisions of this §10 if either Party becomes privy to confidential information in connection with its performance hereunder. “State Confidential Information” means information, data, records, and documentary materials belonging to the State regardless of physical form or characteristics, including but not limited to any non-public State records, sensitive State data, protected State data, State personnel records, personally identifiable information (“PII”), and other information or data concerning individuals, which has been communicated, furnished or disclosed by the State to Contractor. Notwithstanding the foregoing, State Confidential Information shall not include information which (i) is subject to disclosure pursuant to the Colorado Open Records Act, CRS §24-72- 200.1, et seq.; (ii) is already known to Contractor without restrictions at the time of its disclosure by Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by

Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any State Confidential Information. “State Data and Records” means information, data, records, and documentary materials belonging to the State regardless of physical form or characteristics, including but not limited to any public State records, non-sensitive State data, and other information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished or disclosed by the State to Contractor which (i) is subject to disclosure pursuant to the Colorado Open Records Act, CRS §24-72-200.1, et seq.; (ii) is already known to Contractor without restrictions at the time of its disclosure by Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any Confidential Information. “Contractor Confidential Information” means information, data, records, and documentary materials belonging to the Contractor regardless of physical form or characteristics, including but not limited to any non-public Contractor records, sensitive Contractor data, protected Contractor data, Contractor personnel records, personally identifiable information (“PII”), and other information or data concerning individuals, which has been communicated, furnished or disclosed by the Contractor to State. Notwithstanding the foregoing, Contractor Confidential Information shall not include information which (i) is subject to disclosure pursuant to the Colorado Open Records Act, CRS §24-72-200.1, et seq.; (ii) is already known to the State without restrictions at the time of its disclosure by the State; (iii) is or subsequently becomes publicly available without breach of any obligation owed by the State to the Contractor; (iv) is disclosed to the State, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any Contractor Confidential Information.

A. Confidentiality Contractor shall keep all State Confidential Information confidential at all times and comply with all laws and regulations concerning confidentiality of State Confidential Information. Any request or demand by a third party for State Confidential Information and/or State Data and Records in the possession of Contractor shall be immediately forwarded to the State’s principal representative. Contractor shall have the right to inspect Contractor records being requested or demanded from the State by a third party within the limited time frame permitted by the Colorado Open Records Act, CRS §24-72-200.1, et seq., and protect against the release of its Contractor Confidential Information prior to the State’s release of information marked confidential to the public; however, such information shall not include information required to be disclosed pursuant to the Colorado Open Records Act. Unless otherwise expressly pre-approved in writing by the the State, all employees, officers, staff, temporary employees and/or subcontractor(s) of the Contractor involved in the performance of any aspect of this Contract shall execute a “Statement of Confidentiality and Use” (Exhibit E). The signed Statements of Confidentiality and Use shall be made available to the State upon the State’s request.

Because of the confidential nature of the State Confidential Information, the State may, in its sole discretion, require background checks of any or all of the Contractor’s employees or subcontractors who may have access to the System information and/or other State Confidential Information. The Contractor, its employees, temporary staff, and/or subcontractor shall cooperate in any such background checks.

Background checks may include criminal reviews, as well as financial and credit reviews. These reviews may occur at any time during the term of the Contract, including any extensions.

All State Confidential Information and State Data and Records received by the Contractor from the State will be property of the State and may not be utilized by the Contractor for any purpose outside of the scope of this Contract. State Confidential Information and State Data and Records, in any form, may not be provided to any other party for any reason without explicit, written permission of the State.

B. Notification Contractor shall notify its agent, employees, Subcontractors and assigns who may come into contact with State Confidential Information that each is subject to the confidentiality requirements set forth herein, and shall provide each with a written explanation of such requirements before permitting them to access such State Confidential Information.

C. Use, Security, and Retention State Confidential Information of any kind shall not be distributed or sold to any third party or used by Contractor or its agents in any way, except as authorized by this Contract or approved in writing by the State. Contractor shall provide and maintain a secure environment that ensures confidentiality of all State Confidential Information wherever located. State Confidential Information shall not be retained in any files or otherwise by Contractor or its agents, except as permitted in this Contract or approved in writing by the State. State Confidential Information and State Data and Records that is sent to the central issuance facility servers for card printing must be deleted by Contractor no more than thirty (30) days after receipt of the print request. Sensitive information must be encrypted by Contractor at rest and in transit. Access is restricted to those with a need to know following the principle of least privilege.

D. Protection If Contractor or any of its Subcontractors provide physical or logistical storage, processing or transmissions of State Confidential Information and State Data and Records, Contractor shall provide, and shall cause its Subcontractors to provide, physical and logical protection for State hardware, software, applications and data that meet or exceed industry standards and requirements as set forth in this Contract. Contractor shall provide the State with access, subject to Contractor’s reasonable access security requirements, seven (7) days a week, twenty-four (24) hours a day, for the purpose of inspecting and monitoring access and use of State Confidential Information and State Data and Records, maintaining State systems, and evaluating physical and logical security control effectiveness. If Contractor retains, stores, or is given State Confidential Information and State Data and Records, the Contractor at all times shall maintain, and shall cause its Subcontractors to maintain, network, System, and application security, which includes network firewalls, intrusion detection, and annual security testing. If Contractor retains, stores, or is given State Confidential Information and State Data and Records, Contractor shall comply and shall cause its Subcontractors to comply, with State and federal regulations and guidelines related to security, confidentiality and auditing. If Contractor retains, stores, or is given State Confidential Information and State Data and Records, the Contractor shall ensure, and shall cause its Subcontractors to ensure, that security is not compromised by unauthorized access to computers, programs, software, databases, or other electronic environments and shall promptly report all breaches or attempted breaches to a representative of the Office of Information Security (“OIS”).

Neither Contractor nor its Subcontractors shall have any rights to use or access any Governor’s Office of Information Technology (“OIT”) or other State agency data or information, except with the prior written approval of the State. Contractor shall review, on a semi-annual basis, the Colorado Cyber Security Program (CCSP), posted at http://www.colorado.gov/cs/Satellite/Cyber/CSIO/1207820732279, and its related documents, including its policies and procedures to ensure compliance with the standards and guidelines published therein. Contractor shall cooperate, and shall cause its Subcontractors to cooperate, with performance of security audits and penetration tests required by the OIS or its designee. Contractor shall follow, and shall cause its Subcontractors to follow, the State’s Data Handling and Disposal policy, which can be found at www.colorado.gov/oit/security_policies. Contractor shall permit the State to conduct security checks or scans on the System (also called penetration testing) as required by the State. All State Confidential Information and State Data and Records stored by Contractor or its Subcontractors shall reside in the United States. Contractor shall perform, and shall cause its Subcontractor’s to perform, in a form reasonably acceptable to the State, current background checks on all of its respective employees and agents performing services or having access to State Confidential Information and/or State Data and Records provided under this Contract. A background check performed within thirty (30) days prior to the date such employee or agent begins performance or obtains access shall be deemed to be current.

E. Security-Notice Contractor is responsible for the security of all State Confidential Information and/or State Data and Records provided to it by the State. If State Confidential Information and/or State Data and Records is provided to Contractor or any Subcontractor by the State, Contractor shall comply, and shall cause its Subcontractors to comply, with the State’s Cyber Security Policies, which the OIS has promulgated pursuant to CRS §§24-37.5-401 through 406 and 8 CCR 1501-5. The Policies are posted at http://www.colorado.gov/cs/Satellite/Cyber/CSIO/1207820732279.

F. Security Breach Remediation Contractor is required to notify the State of any security breach at its central issuance facilities where State cards are produced, any location where material or equipment used to produce cards for the State are stored and any location where hardware or software resides that contains State Confidential Information and/or State Data and Records data of State customers, including locations owned or operated by the Contractor’s Subcontractors. If Contractor becomes aware of a data security breach involving any State Confidential Information and/or State Data and Records that Contractor has received from the State (“Security Breach”), Contractor shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, if any. Unless Contractor can establish that Contractor or any of its Subcontractors is not the cause or source of the Security Breach, Contractor shall be responsible for the cost of notifying each Colorado resident and residents of other states whose personal information may have been compromised by the Security Breach. Notice shall be made as soon as possible within the legitimate needs of law enforcement and according to the requirements of the State. Contractor shall be responsible for performing an analysis to determine the cause of the Security Breach, and for producing a remediation plan to reduce the risk of incurring a similar type of breach in the future. Contractor shall present such analysis and remediation plan to the State within ten (10) days of notifying the State of the Security Breach. The State reserves the right to adjust this plan, in its sole discretion. If Contractor cannot produce the required analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis, produce a remediation plan, and Contractor shall reimburse the State for reasonable costs thereof.

G. Safeguarding Personally Identifiable Information (PII) Under this Contract, Contractor and its Subcontractors will have access to information which is considered personally identifiable information (“PII”) data as defined below, the dissemination of which is limited by federal and/or state law, including the Federal Drivers Privacy Protection Act, 18 USC 2721 et. seq.

Contractor and its Subcontractors shall provide for the security of such PII, in a form acceptable to the State, including, without limitation, non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections and audits. Contractor shall take full responsibility for the security of all PII data in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure of loss thereof. For purposes of this Contract, “PII data” shall mean information about an individual collected by the State or any other governmental entity that could reasonably be used to identify such individual, including, but not limited to any combination of (i) first and last name, (ii) first name or first initial and last name, (iii) residence or other physical address, (iv) electronic mail address, (v) telephone number, (vi) birth date, (vii) credit card information, (viii) social security number, (ix) driver’s license number, (x) identification card number, or (xi) any other information that identifies an individual personally. A breach of PII data shall have occurred when there has been unauthorized acquisition of unencrypted PII data (electronic or otherwise) used in performance of this Contract, or any subcontract from Contractor’s or any Subcontractors possession which compromises security, confidentiality, or integrity of such PII. Contractor agrees to be liable for any unauthorized disclosure of PII in its possession or in the possession of its Subcontractors as if Contractor was the owner of the data. Contractor acknowledges that any breach of PII is a material breach of this Contract.

Contractor shall notify the State immediately of any breach or suspected breach, but in no event later than twenty-four (24) hours after Contractor learns of suspected breach. The State may establish required remediation procedures and Contractor shall comply without limitation as directed by the State. Contractor shall bear all costs of such remediation.

H. Disclosure-Liability Disclosure of State Confidential Information and/or State Data and Records by Contractor for any reason may be cause for legal action by third parties against Contractor, the State or their respective agents.

Contractor shall indemnify, save, and hold harmless the State, its employees and agents, against any and all claims, damages, liability and court awards including costs, expenses, and attorney fees and related costs, incurred as a result of any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees pursuant to this §10. Notwithstanding any other provision of this Contract, Contractor shall be liable to the State for all consequential and incidental damages arising from a Security Breach. The State, in its sole discretion may securely deliver State Confidential Information and/or State Data and Records directly to the facility where such data is used to perform the Work. State Confidential Information and/or State Data and Records is not to be maintained or forwarded to or from any other facility or location except for the authorized and approved purposes of backup and disaster recovery purposes. The Contractor shall ensure that State Confidential Information and/or State Data and Records is not retained beyond timeframes established by the State.

I. End of Agreement Data Handling Upon request by the State made before or within sixty (60) days after the effective date of termination of this Contract, Contractor will make available to the State a complete and secure (i.e. encrypted and appropriately authenticated), download file of all System data in XML format, including all including all State Confidential Information and/or State Data and Records, schema and transformation definitions, and/or delimited text files with documented, detailed schema definitions along with attachments in their native format. Contractor shall transfer all image files and data to a State or third party database as specified by the State. The Contractor shall provide technical support for a period of two (2) months after the data transfer to ensure that the data is migrated in a way that is usable by the State. The Parties agree that on the termination of the provision of data processing services, Contractor shall, at the choice of the State, return all State Confidential Information and/or State Data and Records, and the copies thereof to the State, or shall destroy all the data, records, and State Confidential Information and/or State Data and Records and certify to the State that it has done so, unless legislation imposed upon Contractor prevents it from returning or destroying all or part of the data transferred. Any State Confidential Information and/or State Data and Records which is neither transferred nor destroyed shall be maintained for a period not to exceed the Records Retention Period set forth in §9.B herein.

J. Disposition of Data The State retains the right to use the established operational services to access and retrieve State State Confidential Information and/or State Data and Records content stored on Contractor’s infrastructure at its sole discretion. Contractor and Subcontractor warrant that upon request of the State and/or of the supervisory authority, Contractor will submit its data processing facilities for an audit of the measures referred to in §9. The State reserves all right, title and interest, including all proprietary rights, in and to System data and content, State Confidential Information, and State Data and Records.

H. Safeguarding Payment Card Industry (PCI) Data If Contractor or any of its Subcontractors will or may receive payment card industry (“PCI”) data under this Contract, Contractor shall provide for the security of the PCI data, in accordance with PCI Data Security Standard (DSS) 1.1. For the purposes of this Contract, “PCI data” shall mean any data related to card holders’ names, credit card numbers, or other credit card information as may be protected by State and federal law. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Contractor’s or its Subcontractor’s obligations under this Contract, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications and inspections.

11. CONFLICTS OF INTEREST

Contractor shall not engage in any business or personal activities or practices or maintain any relationships which conflict in any way with the full performance of Contractor’s obligations hereunder. Contractor acknowledges that with respect to this Contract, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Contractor shall refrain from any practices, activities or relationships that reasonably appear to be in conflict with the full performance of Contractor’s obligations to the State hereunder. If a conflict or appearance exists, or if Contractor is uncertain whether a conflict or the appearance of a conflict of interest exists, Contractor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction in regard to the apparent conflict constitutes a breach of this Contract.

Unless otherwise expressly pre-approved in writing by the Executive Director of the Colorado Department of Revenue, all employees, officers, staff or temporary employees of the Contractor involved in the performance of any aspect of this Contract shall execute and be bound by an “Affidavit of Non-Conflict of Interest”, attached hereto as Exhibit F. This is a continuing requirement through the term of the Contract, including any extensions. Within ten (10) business days upon notification of the awarded Contract, the signed Affidavits shall be timely sent to the State in accordance with Section 16, “Notices and Representatives”, of this Contract.

12. REPRESENTATIONS AND WARRANTIES

Contractor makes the following specific representations and warranties, each of which was relied on by the State in entering into this Contract.

A. Standard and Manner of Performance Contractor shall perform its obligations hereunder in accordance with the highest standards of care, skill and diligence in Contractor’s industry, trade, or profession and in the sequence and manner set forth in this Contract.

B. Legal Authority – Contractor Signatory Contractor warrants that it possesses the legal authority to enter into this Contract and that it has taken all actions required by its procedures, and by-laws, and/or applicable laws to exercise that authority, and to lawfully authorize its undersigned signatory to execute this Contract, or any part thereof, and to bind Contractor to its terms. If requested by the State, Contractor shall provide the State with proof of Contractor’s authority to enter into this Contract within 15 days of receiving such request.

C. Licenses, Permits, Etc.

Contractor represents and warrants that as of the Effective Date it has, and that at all times during the term hereof it shall have and maintain, at its sole expense, all licenses, certifications, approvals, insurance, permits, and other authorizations required by law to perform its obligations hereunder. Contractor warrants that it shall maintain all necessary licenses, certifications, approvals, insurance, permits, and other authorizations required to properly perform this Contract, without reimbursement by the State or other adjustment in Contract Funds. Additionally, all employees, and agents of Contractor performing Services under this Contract shall hold all required licenses or certifications, if any, to perform their responsibilities.

Contractor, if a foreign corporation or other foreign entity transacting business in the State of Colorado, further warrants that it currently has obtained and shall maintain any applicable certificate of authority to transact business in the State of Colorado and has designated a registered agent in Colorado to accept service of process. Any revocation, withdrawal or non-renewal of licenses, certifications, approvals, insurance, permits or any such similar requirements necessary for Contractor to properly perform the terms of this Contract is a material breach by Contractor and constitutes grounds for termination of this Contract.

13. INSURANCE

Contractor shall obtain and maintain insurance as specified in this section at all times during the term of this Contract. All policies evidencing the insurance coverage required hereunder shall be issued by insurance companies satisfactory to Contractor and the State.

A. Contractor

i. Public Entities If Contractor is a "public entity" within the meaning of the Colorado Governmental Immunity Act, CRS §24-10-101, et seq., as amended (the “GIA”), then Contractor shall maintain at all times during the term of this Contract such liability insurance, by commercial policy or self-insurance, as is necessary to meet its liabilities under the GIA. Contractor shall show proof of such insurance satisfactory to the State, if requested by the State.

ii. Non-Public Entities If Contractor is not a "public entity" within the meaning of the GIA, Contractor shall obtain and maintain during the term of this Contract insurance coverage and policies meeting the same requirements set forth in §13(B).

B. Contractors Contractor shall meet insurance requirements substantially similar to the following:

i. Worker’s Compensation Worker’s Compensation Insurance as required by State statute, and Employer’s Liability Insurance covering all of Contractor or Subcontractor employees acting within the course and scope of their employment.

ii. General Liability Commercial General Liability Insurance written on ISO occurrence form CG 00 01 10/93 or equivalent, covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: (a) $1,000,000 each occurrence; (b) $1,000,000 general aggregate; (c) $1,000,000 products and completed operations aggregate; and (d) $50,000 any one fire.

If any aggregate limit is reduced below $1,000,000 because of claims made or paid, Subcontractor shall immediately obtain additional insurance to restore the full aggregate limit and furnish to Contractor a certificate or other document satisfactory to Contractor showing compliance with this provision.

iii. Professional Liability Professional Liability Insurance covering any damages caused by an error, omission or any negligent act with limits of not less than $1,000,000 per occurrence and in the aggregate and written on an occurrence form. If an occurrence form is not commercially available, then the policy must remain in effect for the duration of this Contract and for at least two years beyond the completion of the Contract or the Contractor may also purchase a two year extended reporting endorsement.

iv. Cyber Privacy Liability Such insurance shall include, at a minimum, coverage for claims and losses with respect to network or data risks such as data breaches, release of confidential information, unauthorized access/use of information, identity theft, invasion of privacy, damage/loss/theft of data, etc. and have limits of liability of not less than $1 million per occurrence.

v. Automobile Liability Automobile Liability Insurance covering any auto (including owned, hired and non-owned autos) with a minimum limit of $1,000,000 each accident combined single limit.

vi. Additional Insured The State shall be named as additional insured on all Commercial General Liability and Automobile Liability Insurance policies (leases and construction contracts require additional insured coverage for completed operations on endorsements CG 2010 11/85, CG 2037, or equivalent) required of Contractor and any Subcontractors hereunder.

vii. Primacy of Coverage Coverage required of Contractor and Subcontractor shall be primary over any insurance or self-insurance program carried by Contractor or the State.

viii. Cancellation The above insurance policies shall include provisions preventing cancellation or non-renewal without at least 30 days prior notice to Contractor and Contractor shall forward such notice to the State in accordance with §16 (Notices and Representatives) within seven days of Contractor’s receipt of such notice.

ix. Subrogation Waiver All insurance policies in any way related to this Contract and secured and maintained by Contractor or its Subcontractors as required herein shall include clauses stating that each carrier shall waive all rights of recovery, under subrogation or otherwise, against Contractor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers.

C. Certificates Contractor shall provide certificates showing insurance coverage required hereunder to the State within seven business days of the Effective Date of this Contract. No later than 15 days prior to the expiration date of any such coverage, Contractor shall deliver to the State or Contractor certificates of insurance evidencing renewals thereof. In addition, upon request by the State at any other time during the term of this Contract, Contractor shall, within 10 days of such request, supply to the State evidence satisfactory to the State of compliance with the provisions of this §13.

14. BREACH

A. Defined In addition to any breaches specified in other sections of this Contract, the failure of either Party to perform any of its material obligations hereunder, in whole or in part or in a timely or satisfactory manner, constitutes a breach. The institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within 20 days after the institution or occurrence thereof, shall also constitute a breach.

B. Notice and Cure Period In the event of a breach, notice of such shall be given in writing by the aggrieved Party to the other Party in the manner provided in §16. If such breach is not cured within 30 days of receipt of written notice, or if a cure cannot be completed within 30 days, or if cure of the breach has not begun within 30 days and pursued with due diligence, the State may exercise any of the remedies set forth in §15. Notwithstanding anything to the contrary herein, the State, in its sole discretion, need not provide advance notice or a cure period and may immediately terminate this Contract in whole or in part if reasonably necessary to preserve public safety or to prevent immediate public crisis.

15. REMEDIES

If Contractor is in breach under any provision of this Contract, the State shall have all of the remedies listed in this §15 in addition to all other remedies set forth in other sections of this Contract following the notice and cure period set forth in §14(B). The State may exercise any or all of the remedies available to it, in its sole discretion, concurrently or consecutively.

A. Termination for Cause and/or Breach

The State may terminate this entire Contract or any part of this Contract. Exercise by the State of this right shall not be a breach of its obligations hereunder. Contractor shall continue performance of this Contract to the extent not terminated, if any.

i. Obligations and Rights

To the extent specified in any termination notice, Contractor shall not incur further obligations or render further performance hereunder past the effective date of such notice, and shall terminate outstanding orders with third parties. However, Contractor shall complete and deliver to the State all Work, Services and Goods not cancelled by the termination notice and may incur obligations as are necessary to do so within this Contract’s terms. At the sole discretion of the State, Contractor shall assign to the State all of Contractor's right, title, and interest under such terminated orders. Upon termination, Contractor shall take timely, reasonable and necessary action to protect and preserve property in the possession of Contractor in which the State has an interest. All materials owned by the State in the possession of Contractor shall be immediately returned to the State. All Work Product, at the option of the State, shall be delivered by Contractor to the State and shall become the State’s property.

ii. Payments The State shall reimburse Contractor only for accepted performance up to the date of termination. If, after termination by the State, it is determined that Contractor was not in breach or that Contractor's action or inaction was excusable, such termination shall be treated as a termination in the public interest and the rights and obligations of the Parties shall be the same as if this Contract had been terminated in the public interest, as described herein.

iii. Damages and Withholding Notwithstanding any other remedial action by the State, Contractor shall remain liable to the State for any damages sustained by the State by virtue of any breach under this Contract by Contractor and the State may withhold any payment to Contractor for the purpose of mitigating the State’s damages, until such time as the exact amount of damages due to the State from Contractor is determined. The State may withhold any amount that may be due Contractor as the State deems necessary to protect the State against loss, including loss as a result of outstanding liens, claims of former lien holders, or for the excess costs incurred in procuring similar goods or services. Contractor shall be liable for excess costs incurred by the State in procuring from third parties replacement Work, Services or substitute Goods as cover.

B. Early Termination in the Public Interest The State is entering into this Contract for the purpose of…