Contract+Amendment+2022-002.pdf

CONTRACT AMENDMENT

CONTRACT NAME AND NUMBER: PowerSchool ETL and Data Warehouse

Products and Services, #125

AMENDMENT NUMBER: 2022-002

This amendment (Amendment) is made to PowerSchool ETL and Data Warehouse Products and Services, Contract #125 (Contract) between the State of North Dakota, acting through its Information Technology Department and State Procurement Office (STATE), and Otis Educational Systems, Inc.

(CONTRACTOR).

The parties agree to the following terms and conditions and expressly agree that if any of the following terms and conditions conflict with any of the terms and conditions of the Contract, then, notwithstanding any term in the Contract, the following terms and conditions govern and control the rights and obligations of the parties.

The parties agree to amend the Contract as follows:

Scope of Services Contract Section 1, Scope of Services is amended to acknowledge that the following products remain under this Contract: iMart Synergyz and MPI. They were previously part of the iMart Annual Software Assurance; however, are being priced individually by the vendor at this time. ALM is being used by STATE, but does not have any cost or service/support associated with it.

MPI is a State hosted solution and Synergyz is a Software as a Service (SaaS) hosted by CONTRACTOR. The parties agree to incorporate into the Contract the terms of Exhibit A - Software as a Service (SaaS) Service Level Agreement (SLA) and Exhibit B – Otis Ed-iMart Bundle (Synergyz and MPI) End User License Agreement, each attached to this Amendment.

Term of Contract and Renegotiation Contract Section 2, Term of Contract, Renegotiation Option, allows the STATE to renegotiate the Contract after the completion of the initial term including any extensions and renewals, which have been executed.

The Contract was previously renegotiated for a short term period through May 9, 2022. The parties have agreed to renegotiate a new Term of Contract that will begin May 10, 2022 to May 9, 2024 and includes three (3) renewal options for a period of 12 months each.

State Technology Standards Contract Section 24, State Technology Standards is deleted in its entirety and replaced with the following: “CONTRACTOR shall comply with applicable STATE enterprise architecture technology standards. These standards can be found on STATE’s website at http://www.nd.gov/itd/standards. If CONTRACTOR is unable to comply with any applicable standard, CONTRACTOR shall request a waiver from that requirement by submitting a Request for Exemption from Information Technology Standards or Statutory Policies (SFN 51687) form in coordination with STATE’s procurement officer for the STATE’s review and approval or disapproval.”

Payments Contract Section 30, Payments is hereby amended to include the following rates:

Product May 10, 2022 – May 9, 2023 May 10, 2023 – May 9, 2024 Synergyz $5,000 $5,000

MPI $20,000 $20,000

http://www.nd.gov/itd/standards

All other terms of the Contract remain in effect. This Contract Amendment is not effective until fully executed by all parties.

EXECUTION

CONTRACTOR

Otis Educational Systems, Inc.

BY:

Printed Name:

Title:

Date:

STATE OF NORTH DAKOTA STATE OF NORTH DAKOTA

Acting through its Information Technology Department Acting through its State Procurement Office

BY: BY:

Printed Name: Printed Name:

Title: Title:

Date: Date:

04-21-2022

CEO

Gregory W. Newcom

Greg Hoffman

Deputy CIO 04/21/2022

Tricia Opp

IT Procurement Officer

4/21/2022

EXHIBIT A - Software as a Service (SaaS) Service Level Agreement (SLA)

1. DEFINITIONS

a) Control Environment - is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.

b) Data - means any information provided to, or collected, generated, stored, or processed by the system. Data includes user identification information and metadata which may contain Data or from which the STATE’s Data may be ascertainable.

c) Data Breach - means any access, destruction, loss, theft, use, modification or disclosure of Data by an unauthorized party or that is in violation of Contract terms and/or applicable state or federal law.

d) Data Classification - means the process of defining data into relevant categories so the information has the appropriate controls in place to protect confidentiality, integrity, and availability based on the type of information.

e) Personally Identifiable Information (PII) - information about an individual maintained by an agency, including that 1) can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; or (2) is linked or linkable to an individual, such as medical, educational, financial, and employment information.

f) Recovery Point Objective (RPO) - means the point in time to which Data can be recovered and/or systems restored when service is restored after an interruption. The Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup of Data immediately preceding the interruption. The RPO is detailed in the SLA.

g) Recovery Time Objective (RTO) - means the period of time within which information technology services, systems, applications and functions must be recovered following an unplanned interruption. The RTO is detailed in the SLA.

h) Software as a Service (SaaS). The capability provided to the consumer is to use the provider’s applications running on a provider’s infrastructure. The applications are accessible from various client devices through interfaces such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. This definition is based on and consistent with National Institute of Standards and Technology (NIST) Special Publication 800-145.

i) Users – means contractors, subcontractors, outsourcing vendors, consultants and others who have a need to use the software for the benefit of STATE.

2. SAAS AVAILABILITY:

The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon scheduled maintenance downtime).

3. SUPPORT:

Support is defined in Exhibit B – Otis Ed-iMart Bundle (Synergyz and MPI) End User License Agreement.

4. SCHEDULED MAINTENANCE AND NOTIFICATIONS

1) Standard Maintenance Windows 9PM to 5AM CT each Friday through Sunday. During this timeframe, short periods of slow response or intermittent access issues will be expected with the database and web components.

2) Notification of Scheduled Maintenance Downtime

CONTRACTOR shall provide a minimum of two weeks advance notice to the STATE of any scheduled maintenance downtime outside of the Standard Maintenance Windows.

In cases of emergency, CONTRACTOR shall use its best efforts to notify STATE of a planned downtime as soon as practicable.

5. RPO AND RTO

CONTRACTOR commits to a RPO of four (4) hours and RTO of twelve (12) hours. In other words, when unscheduled downtime occurs, CONTRACTOR will resume service with data matching what the system contained at some point within the four hours preceding the unscheduled downtime.

Additionally, the system cannot be down for longer than twelve (12) hours during unscheduled downtime.

6. SAAS AND DATA SECURITY:

a) CONTRACTOR shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract;

2) Compliance with the following:

i. Undergo an annual Statement on Standards for Attestation Engagements (SSAE)

Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the CONTRACTOR’s Control Environment. Audit results and CONTRACTOR’s plan to correct any negative findings shall be provided to the STATE within seven (7) calendar days upon CONTRACTOR’s receipt of such;

ii. Provide STATE with a detailed description of the audited Control Environment. If STATE determines the Control Environment is not satisfactory, the STATE may request CONTRACTOR to correct any deficiencies;

3) Compliance with applicable industry standards, law, regulations and guidelines.

b) CONTRACTOR shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the STATE’s access to its Data.

c) CONTRACTOR shall allow the STATE reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Contract and the STATE’s Data, at no cost to the STATE.

d) CONTRACTOR assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by CONTRACTOR other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the STATE.

f) Remote access to Data from outside the continental United States, including remote access to Data by authorized SaaS support staff in identified support centers, is prohibited unless approved in advance by Chief Information Officer of the State.

7. SAAS AND ARCHITECURE:

CONTRACTOR shall provide STATE with detailed architectural diagrams on an annual basis. The architectural diagrams are to include but not limited to servers, hardware, software solution (operating system, application servers, databases, identity repository), network architecture (dataflow diagram, firewalls, proxies, IDS/IPS). CONTRACTOR shall allow the STATE reasonable access to review the architecture.

8. ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

9. DATA PROCESSING AND LOCATION:

a) CONTRACTOR shall transmit, process, and store STATE Data within the continental United

States.

b) CONTRACTOR shall notify STATE at least 90 days prior to any relocation of STATE’s Data to a different hosting facility. STATE reserves the right to terminate the Contract without penalty if STATE does not approve of the new hosting facility.

10. RIGHTS TO DATA:

The parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the STATE, and CONTRACTOR has a limited, non-exclusive license to access and use the Data as provided to CONTRACTOR solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of Data by CONTRACTOR or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

STATE shall have the ability to export data in partial or in entirety at its discretion without interference from the CONTRACTOR. This includes the ability for the STATE to export data to other service providers.

11. DATA BACKUP:

a) CONTRACTOR shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by CONTRACTOR of its obligations under this Contract (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) CONTRACTOR shall use appropriate and reliable storage media. CONTRACTOR shall regularly backup STATE Data and retain such backup copies for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

12. DATA RETENTION AND DISPOSAL:

a) CONTRACTOR shall retain STATE’s Data until the STATE deletes the STATE’s Data or for the time period mutually agreed to by the parties in this Contract.

b) At the STATE’s election, CONTRACTOR will either securely destroy or transmit to STATE repository any backup copies of STATE Data.

c) CONTRACTOR shall supply STATE a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

d) CONTRACTOR shall retain logs associated with STATE activity for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

13. TRANSITION ASSISTANCE:

a) For ninety (90) days prior to the expiration date of this Contract, or upon notice of termination of this Contract, CONTRACTOR shall assist the STATE in extracting and/or transitioning all Data securely in the format determined by the STATE (“Transition Period”). CONTRACTOR agrees that there shall be no additional fees to execute the transition of Data during Transition Period.

b) CONTRACTOR and STATE shall develop a Transition Plan (“Transition Plan”) detailing each party’s respective tasks in connection with the orderly transition and migration of the licensed software, Data, any generated contextual data such as reference tables, metadata, structured and unstructured data not necessarily provided by STATE, and hosting services.

c) During the Transition Period, SaaS and Data access shall continue to be made available to the STATE without alteration.

d) Unless otherwise stated in the Transition Plan, as determined by the STATE, the CONTRACTOR shall permanently destroy or render inaccessible any portion of the Data in CONTRACTOR’s and/or subcontractor’s possession or control following the expiration of all obligations in this section. Within thirty (30) days, CONTRACTOR shall issue a written statement to the STATE confirming the destruction or inaccessibility of the STATE’s Data.

e) In the event the Transition Plan is implemented, costs shall not be higher than the current amounts assessed to STATE by CONTRACTOR under this Contract. CONTRACTOR shall provide reasonable assistance as requested by STATE to successfully complete transition. The STATE at its option, may purchase additional transition services as agreed upon in the Transition Plan.

f) In the event the SaaS is decommissioned or no longer offered the Transition Plan shall be implemented.

14. DATA BREACH:

a) Upon discovery or reasonable belief of any Data Breach, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. CONTRACTOR shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after CONTRACTOR reasonably believes there has been such a Data Breach. To the extent known at the time of notification, CONTRACTOR’s notice shall include:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What CONTRACTOR has done or will do to quarantine and mitigate the Data Breach;

and

5) What corrective action CONTRACTOR has taken or will take to prevent future Data

Breaches.

b) CONTRACTOR will provide daily updates, or more frequently if required by the STATE, regarding findings and actions performed by CONTRACTOR until the Data Breach has been effectively resolved to the STATE’s satisfaction.

c) CONTRACTOR shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with SLA set above in this attachment. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

d) CONTRACTOR shall conduct an investigation of the Data Breach and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

15. DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit. CONTRACTOR shall provide such notification within twenty-four (24) hours after CONTRACTOR reasonably believes there has been such a disaster or catastrophic failure. In the notification, CONTRACTOR shall inform the STATE of:

1) The scale and quantity of the Data loss;

2) What CONTRACTOR has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action CONTRACTOR has taken or will take to prevent future Data loss.

4) If CONTRACTOR fails to respond immediately and remedy the failure, the STATE may exercise its options for assessing damages or other remedies under this Contract.

b) CONTRACTOR shall restore continuity of SaaS, restore Data in accordance with the RPO and

RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

c) CONTRACTOR shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

16. AUDIT AND EXAMINATION:

a) Upon advance written request, CONTRACTOR agrees that the STATE or its designated representative shall have access to CONTRACTOR’s SaaS operational documentation, records and databases, including online inspections, that relate to the SaaS purchased by the STATE.

b) The online inspection shall allow the STATE, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the STATE or representatives on behalf of the

STATE.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, CONTRACTOR will at its expense have an independent, industry-recognized, STATE-approved third party perform an information security audit. The audit results shall be shared with the STATE within seven (7) days of CONTRACTOR’s receipt of such results. Upon CONTRACTOR receiving the results of the audit, CONTRACTOR will provide the STATE with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.

17. DISCOVERY:

If CONTRACTOR receives a request which may reasonably be interpreted as requiring access to the Data of the STATE or the STATE’s use of the SaaS, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. CONTRACTOR shall provide such notification within forty-eight (48) hours after CONTRACTOR receives the request.

CONTRACTOR shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at CONTRACTOR regarding this Contract without first notifying the STATE unless prohibited by law from providing such notification. CONTRACTOR agrees to provide its intended responses to the STATE with adequate time for the STATE to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. CONTRACTOR shall not respond to legal requests directed at the STATE unless authorized in writing to do so by the

STATE.

18. SAAS NOTICE:

All notices or other communications required under this exhibit must be provided to the following:

STATE - Agency CONTRACTOR

Tracy Korsmo Greg Newcom

Business Intelligence Specialist CEO

4201 Normandy Ave. 1560 Wilson Blvd, Suite 250

Bismarck, ND 58505 Arlington, VA 22209 tkorsmo@nd.gov sales@OtisEd.com

701-328-4134 770-871-5373

STATE – ITD

Shawn Riley

Chief Information Officer

4201 Normandy Ave.

Bismarck, ND 58505 sriley@nd.gov

701-328-1001 mailto:tkorsmo@nd.gov mailto:sales@OtisEd.com mailto:sriley@nd.gov

EXHIBIT B – OTIS ED-IMART BUNDLE (SYNERGYZ AND MPI)

END USER LICENSE AGREEMENT

This is a license agreement between Otis Educational Systems, Inc. ("Licensor") and North Dakota Information Technology Department, ("Licensee") in which Licensor grants Licensee certain rights in the software known as "OtisEd-iMart Bundle (Synergyz and MPI)" ("Software").

The Software refers to the current release version of the product at the time of this agreement and includes User Interface Programs, SQL Server databases, stored procedures, SQL Server Reports, source code, functions, documentation files, associated media, and printed materials.

BY USING THE SOFTWARE OR ANY LARGER WORK THAT IS BASED ON THE SOFTWARE; LICENSEE INDICATES LICENSEE’S ACCEPTANCE OF THIS LICENSE, AND ALL ITS TERMS AND CONDITIONS FOR COPYING OR

MODIFYING THE SOFTWARE OR PRODUCING LARGER WORK BASED ON IT.

1. GRANT OF LICENSE

All ownership rights to Licensor's software provided to Licensee under this contract (intellectual property owned by Licensor prior to performance of this contract) will remain with Licensor. If Licensor incorporates any of Licensor's software in any work product provided to Licensee, Licensor agrees to provide written notice to Licensee of its incorporation in the work product and to convey to Licensee a non-exclusive, perpetual, cost free license, and patent and copyright indemnity, for the software to use that software for its intended purpose.

a. LICENSE GRANT AND SCOPE OF USE Licensor grants to Licensee a perpetual, non-exclusive, non-transferable, royalty free license to use the software. The license grants Licensee a license to the software source code, meaning the source code can be modified.

2. OWNERSHIP

Licensee has no ownership rights in the Software. Rather, licensee has a license to use the Software as long as this License Agreement remains in full force and effect. Ownership of the Software, Documentation and all intellectual property rights therein shall remain at all times with Licensor. Any other use of the Software by any other entity is strictly forbidden and is a violation of this License Agreement. Licensee has full ownership of any code, including source code, SQL Server databases, stored procedures, functions, reports, documentation, associated media, and printed materials developed by Licensee in the use of the Software.

3. COPYRIGHT

The Software contains material that is protected by United States Copyright Law and Trade Secret Law, and by international treaty provisions. Licensor expressly reserves all rights not granted to Licensee herein.

Licensee may not remove any proprietary notice of Licensor from any copy of the Software.

4. DISTRIBUTION

Licensee may not resell, rent, lease or distribute the Software in any form.

5. RESTRICTIONS

Licensee is not authorized to transfer, resell, reproduce, copy, use for hosting, or use source code for any purpose other than for those of Licensee’s internal purposes. Licensee is NOT authorized to modify the Software source code.

6. MATCHING ALGORITHMS

This agreement grants the Licensee a run-time license for the MPIS with the following exceptions: This agreement grants the Licensee a Limited Developer’s License meaning adding matching algorithms only is allowed. Access and modification of the existing algorithms and system source code is prohibited.

7. CONFIDENTIALITY

Except as required under N.D.C.C. ch. 44-04, Licensee acknowledges that the Software contains proprietary trade secrets of Licensor and Licensee hereby agrees to maintain the confidentiality of the Software using at least as great a degree of care as Licensee uses to maintain the confidentiality of Licensee’s own most confidential information. Licensee agrees to reasonably communicate the terms and conditions of this License Agreement to those persons employed by Licensee who come into contact with the Software, and to use reasonable best efforts to ensure their compliance with such terms and conditions.

8. LIMITED WARRANTY

Licensor warrants to the Licensee, that the Software will perform substantially in conformance with the related documentation for a period of 90 calendar days from the date the last application module deployment is complete in production. Licensor makes no warranty with respect to hardware and software not supplied by Licensor. Any replacement software will be warranted for the remainder of the original warranty period or 90 days, whichever is longer.

9. LIMITATION OF LIABILITY

Reserved.

10. SUPPORT

Licensor will provide Licensee, under the terms of this agreement, access to any current software updates, such as patch releases and or bug fixes. These software updates will be available for download from a secure support website. Installation instructions and release notes are included with every update and are available in the secured support website. In addition, Licensor will send out communication when new updates are available.

Installation instructions point release notes and supporting documentation are included for the application updates. Included in this agreement are fifty (50) total hours annually per each installed product (Zipline, MPI) for a total of one hundred (100) hours, to support the installation of software updates. Licensee must approve any installation of an update, patch, or bug fix. Synergyz is a Licensor-hosted application and will be maintained by Licensor.

Licensee will have access to the Product Technical Support (Help Desk) services if annual software assurance is paid in full.

Licensor will provide product support with respect to: any access issues including Synergyz accounts; problems or performance deficiencies of the Software; and availability of the upgrades, patches, and bug-fixes for the Software.

Licensor Support will be available via telephone and email during the hours of 8:00 a.m. to 5:00 p.m., Eastern Time, Monday through Friday, excluding federal holidays.

Email: support@otised.com

Phone: 678-810-0080 Ext. 803

When contacting Product Technical Support, please provide the following:

1. Point of contact

2. Software and version number

3. As much pertinent information as you can reference to the issue, such as screen shots, repeatable steps, or others.

Product Technical Support includes the diagnosis and a resolution of problems related to the Software. Licensor will use its best efforts to cure the reported and reproducible errors in the software.

Licensor utilizes the following three (3) severity levels to categorize reported problems and provides the corresponding level of support:

Severity 1: Critical Business Impact The impact of the reported deficiency is such that the Licensee is unable to either use the software or reasonably continue work using the software. Licensor will commence work on resolving the deficiency within three (3) hours of notification and will engage staff until an acceptable resolution is achieved.

Severity 2: Some Business Impact Important features of the software are unavailable, but an alternative solution is available or non- essential features of the software are unavailable with no alternative solution. The Licensee impact, regardless of product usage, is moderate to minimal loss of operational functionality or implementation resources. Licensor will commence work on resolving the deficiency within eight (8) hours of notification and will engage staff during business hours until an acceptable resolution is achieved.

Severity 3: Minimal Business Impact Licensee submits a software information request, software enhancement or documentation clarification which has no operational impact. The implementation or use of the software by the Licensee is continuing and there is no negative impact on productivity. Licensor will provide an initial response regarding the request within three

(3) business days.

Support does not include services to diagnose or remediate project based, custom software configurations, custom ETL code, reports or any derivative works developed as a part of a project implementation. Support for Licensee-specific ETL and deployed derivative works can be provided by entering into a custom support agreement.

11. TERMINATION

Reserved.

12. GENERAL

The Licensee is not allowed to transfer or assign Licensee’s rights and duties arising from this contract to a third party. If a court of competent jurisdiction finds any part of this License Agreement invalid or unenforceable, the remainder of this License Agreement shall be interpreted in full force and effect.

13. CONTACT

Reserved