Drivewyze+-+Amendment+1+-+Final+-+signed.pdf

CONTRACT AMENDMENT

CONTRACT NAME AND NUMBER: 044 - Commercial Vehicle Screening

AMENDMENT NUMBER: 1

This amendment is made to 044 - Commercial Vehicle Screening (Contract) between the State of North Dakota, acting through its Office of Management & Budget, State Procurement Office (STATE), and Drivewyze Ltd. (CONTRACTOR).

The parties agree to the following terms and conditions and expressly agree that if any of the following terms and conditions conflict with any of the terms and conditions of the Contract, then, notwithstanding any term in the Contract, the following terms and conditions govern and control the rights and obligations of the parties.

The parties agree to amend the Contract as follows:

Renewal and Extensions Contract Section 7, Term of Contract. The Contract commenced on March 27, 2023 for a period of two

(2) years through March 31, 2025 with three (3) options to renew the Contract for twenty-four (24) months each and an option to extend the Contract for up to twelve (12) months.

The parties have agreed to renew the Contract for an additional twenty-four (24) months; therefore, the Contract is amended to change the expiration date to March 31, 2027. The Contract has two (2) renewals remaining. The Contract can be extended for an additional twelve (12) months.

Software as a Service (SAAS) and Service Level Agreement (SLA) Contract Section 30, Software as a Service (SAAS) and Service Level Agreement (SLA). This section is hereby deleted in its entirety and replaced with the following:

30. SOFTWARE AS A SERVICE (SAAS) AND SERVICE LEVEL AGREEMENT (SLA)

CONTRACTOR represents and warrants that the services will be performed in a professional manner consistent with industry standards reasonably applicable to such services.

A. SAAS AVAILABILITY:

The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon scheduled maintenance downtime).

B. RESPONSE TIME SERVICE LEVEL:

CONTRACTOR represents and warrants that ninety-five percent (95%) of all transactions shall process at a mutually agreed upon time threshold. STATE retains right to use a Third-Party service to validate the performance of CONTRACTOR’s response times.

C. SCHEDULED MAINTENANCE AND NOTIFICATIONS

a) Standard Maintenance Windows

Drivewyze plans on-site visits and refresher training on a 6 month schedule.

Drivewyze will work with the State to plan training during State training programs.

Software is updated on an as needed basis.

b) Notification of Scheduled Maintenance Downtime

CONTRACTOR shall provide 48 hours advance notice to the STATE of any scheduled maintenance downtime which will cause the total scheduled maintenance downtime for the month to exceed 4 hours or will occur outside of the Standard Maintenance Windows outlined above. In cases of emergency, CONTRACTOR shall use its best efforts to notify STATE of a planned downtime as soon as practicable.

D. RPO AND RTO

CONTRACTOR commits to a RPO of four (4) hours and RTO of twelve (12) hours. In other words, when unscheduled downtime occurs, CONTRACTOR will resume service with data matching what the system contained at some point within the four hours preceding the unscheduled downtime. Additionally, the system cannot be down for longer than twelve (12) hours during unscheduled downtime.

E. SAAS AND DATA SECURITY:

a) CONTRACTOR shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract.

2) Compliance with the following:

i. Undergo an annual Statement on Standards for Attestation

Engagements (SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the CONTRACTOR’s Control Environment. Audit results and CONTRACTOR’s plan to correct any negative findings shall be provided to the STATE within seven (7) calendar days upon CONTRACTOR’s receipt of such.

ii. Provide STATE with a detailed description of the audited Control Environment. If STATE determines the Control Environment is not satisfactory, the STATE may request CONTRACTOR to correct any deficiencies.

3) Compliance with applicable industry standards, law, regulations and guidelines.

b) CONTRACTOR shall undergo the third-party security questionnaire on an annual basis at no cost to the STATE, unless CONTRACTOR has received FedRAMP, StateRAMP, or HiTrust certification. CONTRACTOR shall provide completed questionnaire within twenty-one (21) calendar days of receiving a written request. CONTRACTOR shall undergo the third-party security questionnaire when a breach has occurred.

c) CONTRACTOR shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the STATE’s access to its Data.

c) CONTRACTOR shall allow the STATE reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Contract and the STATE’s Data, at no cost to the STATE.

d) CONTRACTOR assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by CONTRACTOR other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the STATE.

F. SAAS AND ARCHITECURE:

CONTRACTOR shall provide STATE with detailed architectural diagrams on an annual basis. The architectural diagrams are to include but not limited to servers, hardware, software solution (operating system, application servers, databases, identity repository), network architecture (dataflow diagram, firewalls, proxies, IDS/IPS). CONTRACTOR shall allow the STATE reasonable access to review the architecture.

G. ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

H. RIGHTS TO DATA:

The Parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the STATE, and CONTRACTOR has a limited, non-exclusive license to access and use the Data as provided to CONTRACTOR solely for performing its obligations under the Contract.

Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party.

Unauthorized use of Data by CONTRACTOR or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

STATE shall have the ability to export data in partial or in entirety at its discretion without interference from the CONTRACTOR. This includes the ability for the STATE to export data to other service providers.

I. DATA BACKUP:

a) CONTRACTOR shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by CONTRACTOR of its obligations under this Contract (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) CONTRACTOR shall use appropriate and reliable storage media.

CONTRACTOR shall regularly backup STATE Data and retain such backup copies for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

J. DATA RETENTION SCHEDULE AND DISPOSAL:

a) CONTRACTOR shall retain STATE’s Data until the STATE deletes the data.

b) At the STATE’s election, CONTRACTOR will either securely destroy or transmit to STATE repository any backup copies of STATE Data.

c) CONTRACTOR shall supply STATE a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

d) CONTRACTOR shall retain logs associated with STATE activity for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

K. DATA BREACH:

a) Upon discovery or reasonable belief of any Data Breach, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. CONTRACTOR shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after CONTRACTOR reasonably believes there has been such a Data Breach. To the extent known at the time of notification, CONTRACTOR’s notice shall include:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What CONTRACTOR has done or will do to quarantine and mitigate the

Data Breach; and

5) What corrective action CONTRACTOR has taken or will take to prevent future Data Breaches.

b) CONTRACTOR will provide daily updates, or more frequently if required by the

STATE, regarding findings and actions performed by CONTRACTOR until the Data Breach has been effectively resolved to the STATE’s satisfaction.

c) CONTRACTOR shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with SLA set above in this attachment.

Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

d) CONTRACTOR shall conduct an investigation of the Data Breach and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

L. DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit. CONTRACTOR shall provide such notification within twenty-four (24) hours after CONTRACTOR reasonably believes there has been such a disaster or catastrophic failure. In the notification, CONTRACTOR shall inform the STATE of:

1) The scale and quantity of the Data loss;

2) What CONTRACTOR has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action CONTRACTOR has taken or will take to prevent future Data loss.

4) If CONTRACTOR fails to respond immediately and remedy the failure, the STATE may exercise its options for assessing damages or other remedies under this Contract.

b) CONTRACTOR shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA.

Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

c) CONTRACTOR shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

M. AUDIT AND EXAMINATION:

a) Upon advance written request, CONTRACTOR agrees that the STATE or its designated representative shall have access to CONTRACTOR’s SaaS operational documentation, records and databases, including online inspections, that relate to the SaaS purchased by the STATE.

b) The online inspection shall allow the STATE, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended.

Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the STATE or representatives on behalf of the STATE.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, CONTRACTOR will at its expense have an independent, industry-recognized, STATE-approved third party perform an information security audit. The audit results shall be shared with the STATE within seven (7) days of CONTRACTOR’s receipt of such results. Upon CONTRACTOR receiving the results of the audit, CONTRACTOR will provide the STATE with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.

N. DISCOVERY:

If CONTRACTOR receives a request which may reasonably be interpreted as requiring access to the Data of the STATE or the STATE’s use of the SaaS, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. CONTRACTOR shall provide such notification within forty-eight (48) hours after CONTRACTOR receives the request.

CONTRACTOR shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at CONTRACTOR regarding this Contract without first notifying the STATE unless prohibited by law from providing such notification. CONTRACTOR agrees to provide its intended responses to the STATE with adequate time for the STATE to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. CONTRACTOR shall not respond to legal requests directed at the STATE unless authorized in writing to do so by the STATE.

O. SAAS NOTICE:

All notices or other communications required under this exhibit must be provided to the following:

STATE - Agency CONTRACTOR

Jamie Bostyan Brian Taylor

Procurement Coordinator VP Sales

600 E Boulevard Ave, Dept 504 500 New Karner Road

Bismarck, ND 58505-0602 Albany, NY 12205

701.328.5402 306.361.5737 jamie.bostyan@nd.gov btaylor@drivewyze.com mailto:jamie.bostyan@nd.gov

STATE – ITD

GRC Team

GRC Team

4201 Normandy Street

Bismarck, ND 58503

701-328-4470 cygrc@nd.gov

Nondiscrimination – Compliance with Laws Contract Section 44, Nondiscrimination – Compliance with Laws. This section is hereby deleted in its entirety and replaced with the following:

44. NONDSICRIMINATION – COMPLIANCE WITH LAWS

CONTRACTOR agrees to comply with all applicable federal and state laws, rules, and policies, including those relating to nondiscrimination, accessibility and civil rights. (See N.D.C.C. Title 34 – Labor and Employment, specifically N.D.C.C. ch. 34-06.1 Equal Pay for Men and Women.)

CONTRACTOR agrees to timely file all required reports, make required payroll deductions, and timely pay all taxes and premiums owed, including sales and use taxes, unemployment compensation and workers' compensation premiums. CONTRACTOR shall have and keep current all licenses and permits required by law during the Term of this Contract.

CONTRACTOR is prohibited from boycotting Israel for the duration of this Contract. (See N.D.C.C § 54-44.4-15.) CONTRACTOR represents that it does not and will not engage in a boycotting Israel during the term of this Contract. If STATE receives evidence that CONTRACTOR boycotts Israel, STATE shall determine whether the company boycotts Israel. The foregoing does not apply to contracts with a total value of less than $100,000 or if CONTRACTOR has fewer than ten (10) full-time employees.

CONTRACTOR’s failure to comply with this section may be deemed a material breach by CONTRACTOR entitling STATE to terminate in accordance with the Termination for Cause section of this Contract.

Artificial Intelligence (AI) and Machine Learning (ML) The contract is hereby amended to include the following Use of Artificial Intelligence (AI) and Machine Learning (ML) section as Section 47:

47. USE OF ARTIFICIAL INTELLIGENCE (AI) AND MACHINE LEARNING (ML)

STATE and CONTRACTOR agree CONTRACTOR may wish to use Artificial Intelligence (AI) and Machine Learning (ML) (together AI/ML) to complete CONTRACTOR’s obligations under this Contract. CONTRACTOR’s use of AI/ML is subject to prior, written approval by STATE.

CONTRACTOR shall provide to STATE detailed information, in writing, on the use of AI/ML in CONTRACTOR’s obligations under this Contract. CONTRACTOR agrees to submit new information to STATE for approval any time CONTRACTOR substantially changes its use of AI/ML. STATE reserves the right to terminate the Contract for cause if CONTRACTOR uses AI/ML in a manner that STATE has not had the opportunity to approve or denied approval.

Data Security The contract is hereby amended to include the following Data Security section as Section 48:

mailto:cygrc@nd.gov http://www.legis.nd.gov/cencode/t34c01.pdf http://www.legis.nd.gov/cencode/t34c06-1.pdf https://www.ndlegis.gov/cencode/t54c44-4.pdf

3/20/25