EOED SOW - One Stop Grant RFR~4.docx

SOW - FFP (09.12.2025)

STATEMENT OF WORK

BETWEEN

THE EXECUTIVE OFFICE OF ECONOMIC DEVELOPMENT

AND

[CONTRACTOR NAME]

FOR THE

[EOED COMMUNITY ONE STOP GRANT MANAGEMENT SYSTEM REQUEST FOR RESPONSE]

COMMBUYS BD-27-1100-EED01-EED01-131710

1. INTRODUCTION

The following document will serve as a Statement of Work (“SOW”) between the Executive Office of Economic Development (“EOED” or “Agency”) and [CONTRACTOR NAME] (“Contractor”) governing Contractor’s work on the [EOED Community One Stop Grant Management System Request for Quotation]. The entire agreement (the “Agreement”) between the parties consists of the following documents, in the following order of precedence. In the event of a conflict, the document of higher precedence shall govern.

(1) The Commonwealth Terms and Conditions or Commonwealth Terms and Conditions for Information Technology Contracts, as applicable

(2) The Commonwealth Standard Contract Form

(3) Request for Response [EOED RFR Grant Management System] (“RFR”)

(4) Contractor’s response to the RFR

(5) Request for Quotes [EOED RFR Grant Management System, BD-27-1100-EED01-EED01- 131710, 7/24/2026] (“RFR”)

(6) Appendix A to this SOW

(7) this SOW and any Task Orders or other documents negotiated between the parties

(8) Contractor’s response to the RFR

2. DEFINITIONS

The following terms shall have the following meanings. All other terms used in this SOW shall have the meaning ascribed to them in the other documents that constitute the Agreement between the Parties.

“Business Days” means all days except for weekends and Commonwealth holidays. A list of Commonwealth holidays is available at https://www.sec.state.ma.us/divisions/cis/holiday-info.htm.

“Deliverable” means any work product that Contractor delivers for the purposes of fulfilling its obligations to Agency.

“Key Personnel” means Contractor personnel directly responsible for management of the SOW or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the SOW.

“Party” or “Parties” means, as applicable, one or both of Contractor or Agency.

“Services” means the activities engaged in by Contractor for the purpose of fulfilling its obligations under the terms of the SOW, which may or may not result in the creation of a Deliverable.

“Task” means a material activity engaged in by Contractor for the purpose of fulfilling its obligations to Agency.

“Task Order” means an amendment to this SOW that specifies Tasks or Deliverables to be completed by Contractor within a specified time period.

3. EFFECTIVE DATE AND TERM

This SOW’s term (the “Term”) begins on the date it is executed by both Parties (the “Effective Date”) and shall terminate on June 30, 2027 (“Termination Date”) unless extended or renewed via written amendment executed by the Parties.

4. PROJECT BACKGROUND AND OVERVIEW

One Stop is a coordinated, cross-agency initiative led by EOED to streamline access to state economic development and community investment programs for municipalities and other eligible applicants. The One Stop provides a unified application and review process for a range of grant and technical assistance programs administered by multiple state agencies and authorities. Through the One Stop, applicants submit a single application that may be considered for multiple funding programs aligned with local priorities such as housing production, economic development, infrastructure, placemaking, and community revitalization. The One Stop is designed to reduce administrative burden, improve coordination across state agencies, and enable more strategic and holistic investment in local projects.

EOED manages the overall One Stop process, including application intake, interagency coordination, review, and award recommendations, while participating agencies retain responsibility for program-specific eligibility requirements, compliance, contracting, and grant administration. Since its inception, Community One Stop for Growth has become a central mechanism for deploying state economic development resources in a coordinated and applicant-centered manner.

EOED has managed the One Stop through a legacy grants management system that was inherited through existing agency contracts. The system has enabled EOED to administer a complex, multi-program application and support core grants management functions. However, as the One Stop has expanded in scope, participation, and operational complexity, EOED has identified opportunities to enhance system flexibility, scalability, user experience, reporting capabilities, and integration with evolving Commonwealth technology standards. In particular, EOED seeks a solution that more readily supports configurable workflows, advanced automation, improved data analytics, and a modern, intuitive interface for both applicants and staff. This procurement reflects EOED’s commitment to continuous improvement and to ensuring that the technology supporting the One Stop aligns with current best practices and the Commonwealth’s long-term digital strategy.

4.1 PROJECT SCOPE

The scope of this procurement includes the initial implementation and ongoing maintenance, support, and enhancement of the Software, including all required software licenses, hosting, maintenance and support, training, and documentation. The selected Contractor will be expected not only to deploy the Software, but to provide sustained operational and development support to ensure the platform continues to evolve in alignment with EOED’s programmatic, technical, and regulatory needs.

This includes:

· Professional services associated with implementation, including installation, configuration, system design, development, quality assurance, testing, data conversion and migration, integration, and other related services necessary to achieve a fully operational production environment.

· Managed services associated with ongoing hosting, storage, security management, help desk operations, troubleshooting, system upgrades, and performance monitoring.

· Ongoing development and configuration support to accommodate complex enhancements, evolving business requirements, new program additions, cross-agency coordination needs, reporting modifications, automation improvements, and other iterative system refinements. EOED anticipates that the Software will require periodic reconfiguration and structured enhancement releases to support continuous improvement of the One Stop process.

Additionally, EOED is seeking comprehensive training services and materials for both internal and external users, including the training of at least two internal staff members to deliver future training and support. Ongoing help desk services must provide timely technical assistance to applicants during application submission and to EOED and participating agencies in connection with review, reporting, compliance, and data extraction activities.

Project Timeline:

The project is expected to follow the timeline below:

Additionally, Bidder Software should support:

1. Mobile Ready Design and Access Software should be mobile-ready and user-friendly via web browsers on phones, tablets, and other devices in addition to personal computers and laptops. The Software should be able to be accessed through today's leading web browsers, including, but not limited to Google Chrome, Safari, and Microsoft Edge.

2. Enterprise Services The Commonwealth is transitioning from siloed, application-centric, and agency-centric IT investments to an enterprise approach. The Software should implement an extensible, flexible, scalable, and secure architecture on a platform that uses industry standards and standardized integration points. To promote the reuse and sharing of services across the Commonwealth, the Software effort may leverage existing and emerging components and services.

5. FIXED PRICE TASKS AND DELIVERABLES

This Section describes the Tasks to be completed by the Contractor, the Deliverables to be provided by the Contractor, and a timeline for delivery. A Task or Deliverable will be considered “complete” when all the acceptance criteria set forth in this SOW have been met. All written Deliverables shall be delivered in a format specified by Agency. All meetings shall be held on premises at the address of Agency, unless agreed to otherwise by the Project Managers.

For the Fixed Price Tasks and Deliverables of this Agreement, Contractor shall perform Tasks and deliver Deliverables in conformance with the Description and Metrics of Acceptance on or before the Due Dates set forth in Table 1. Upon acceptance by Agency of the Deliverables or Tasks, the amounts specified in Table 1 associated with each Deliverable or Task shall be payable to Contractor.

TABLE 1: FIXED PRICE TASKS AND DELIVERABLES

TOTAL:

6 KEY PERSONNEL

6.1 Commonwealth Project Manager(s)

[NAME] ([email address], [phone number]) will serve as the Agency Project Manager (“PM”) and will: (i) work closely with the Contractor PM to ensure successful completion of the project; (ii) consult with Contractor PM to develop the Project Management Plan; (iii) review [weekly] status reports and schedule [weekly] meetings with Contractor, as necessary; (iv) coordinate participation from other agencies and/or vendors as required during the engagement; (v) acquire Agency project team members as needed; and (vi) coordinate Agency’s review of the Deliverables and sign an acceptance form to signify acceptance for each accepted Deliverable.

[OPTIONAL: [NAME] ([email address], [phone number]) will serve as the Agency Technical Project Manager (“Technical PM”) and will: (i) work closely with the Agency PM and Contractor PM to ensure successful completion of the project; (ii) consult with the Agency PM and Contractor PM to develop the Project Management Plan; and (iii) serve as a technical resource for Contractor PM and Contractor personnel.]

[OPTIONAL: [NAME][email address][phone number]] will serve as the [OTHER AGENCY] Project Manager (“PM”) and will: (i) work closely with the Agency and Contractor PM to ensure successful completion of the project; (ii) consult with the Agency and Contractor PM to develop the Project Management Plan; (iii) review [weekly] status reports and schedule [weekly] meetings with Contractor, as necessary; (iv) coordinate participation from other agencies and/or vendors as required during the engagement; (v) acquire [OTHER AGENCY] project team members as needed; and (vi) coordinate [OTHER AGENCY]’s review of the Deliverables and sign an acceptance form to signify acceptance for each accepted Deliverable.]

6.2 Contractor Project Manager

[NAME] ([email address], [phone number]) will serve as the Contractor Project Manager (the “Contractor PM”) and will (i) be responsible for administering this SOW and the managing of the day-to-day operations under this SOW, (ii) serve as an interface between the Agency PM and all Contractor personnel participating in this engagement; (iii) develop and maintain the Project Management Plan in consultation with the Agency PM; (iv) facilitate regular communication with the Agency PM, including [weekly] status reports/updates, and review the project performance against the project plan and facilitate [weekly] project status meetings for the duration of the engagement; (v) update the Project Management Plan on a [weekly] basis and distribute it at [weekly] meetings for the duration of the engagement; (vi) sign acceptance forms to acknowledge receipt; and (vii) be responsible for the management and deployment of Contractor personnel.

The PMs bear the primary responsibility for issue resolution. If an issue cannot be resolved by the PMs, the Agency PM shall escalate to [NAME] and the Contractor PM shall escalate to [NAME]. The PMs shall be responsible for coordinating a meeting with Agency and Contractor leadership to review and resolve any issues.

6.3 Contractor Personnel

Contractor will provide the following personnel for the following estimated time commitment. All services shall be performed exclusively by personnel who are physically located and operating in the United States.

TABLE 2: PERSONNEL

If a change to the assigned personnel is necessary, the Contractor PM will provide a written change request at least two (2) weeks prior to the change to the Agency PM. The Agency PM may reject or accept such change. Any personnel replacements must have the same or similar qualifications (educational background and certifications) and experience as that of the Contractor resources being replaced. Contractor shall take full responsibility for project management and for conducting a knowledge transfer to the new personnel at no additional cost to the Agency or extension to the agreed-upon timelines. Contractor shall take full responsibility for project management. Contractor shall ensure any subcontractor(s) providing work under this SOW comply with all terms of the Agreement and Contractor shall be responsible for the performance of each such subcontractor.

7. ACCEPTANCE OR REJECTION PROCESS

The Contractor PM will submit each Deliverable to the Agency PM on or before the Due Date specified in Table 1. Agency will review each Deliverable and determine whether it has met in all material respects the criteria established in this Agreement.

Prior to the submission of the Final Deliverable—which is defined as the comprehensive and complete product or output that fulfills all contractual requirements and specifications outlined in this Agreement—the Contractor PM shall submit interim Deliverables at agreed-upon intervals to the Agency PM for review and feedback. These interim Deliverables must be spaced sufficiently apart to allow for meaningful evaluation and to facilitate timely input from the Agency.

The Agency PM may request multiple interim Deliverables, as necessary, to ensure alignment with the criteria established in this Agreement.

The Agency PM will review each interim Deliverable and the Final Deliverable to determine whether they meet, in all material respects, the criteria established in this Agreement.

Within ten (10) Business Days of receipt of each Deliverable, the Agency PM will notify the Contractor PM, in writing, of acceptance or rejection. A rejection will include a written description of the defects of the Deliverable. If the Agency PM does not respond with acceptance or rejection within ten (10) Business Days of receipt, the Contractor PM shall provide a reminder notice to the Agency PM. If Agency PM fails to respond after the receipt of the reminder notice, Contractor must notify Agency PM and the Parties must agree to a new deadline for acceptance or rejection of the Deliverable. Upon receipt of rejection of a Deliverable, Contractor will act diligently to correct the specified defects and deliver an updated version of the Deliverable to the Agency PM. Acceptance or rejection of the updated version of the Deliverable will be subject to the process described in this paragraph.

Following any acceptance of a Deliverable which requires additional work to be entirely compliant with the pertinent specifications, and until the next delivery, Contractor will use reasonable efforts to provide a prompt correction or workaround.

8. PAYMENT TERMS

A Deliverable or Task will be considered “completed” when the Agency PM has accepted the Deliverable or Task in accordance with Section 7 of this SOW. Contractor shall issue invoices to Agency for the Deliverables or Tasks that are completed (each, a “Valid Invoice”) within 45 calendar days of the acceptance of the Deliverable or Task. Valid Invoices shall be sent to [INVOICE PROCESSING POC] and include all relevant and requested details, such as resource names, dates of service, the hours worked and approved, and the relevant Task/Deliverable Name(s) as specified in Table 1 for each date of service. Approved invoices will be payable by Agency in accordance with the Commonwealth’s bill-paying policies. Agency may reduce the amount payable under an invoice submitted more than 45 calendar days after the Services were rendered.

Unless otherwise agreed to by the Parties in the form of an executed written amendment hereto, the total amount payable to Contractor by Agency shall be the firm fixed price total of [TOTAL].

9. AMENDMENTS TO THE SOW

The SOW may be amended prior to the end of the Term. The PM who would like to request a change will provide the suggested amendment in writing to the other Party’s PM. The PMs will jointly determine whether the change impacts any terms contained within the Agreement. The Parties may mutually agree to the change through a written signed amendment to the SOW.

10. NOTIFICATION OF INCOMPLETE TASKS AND DELIVERABLES

The Contractor PM must notify the Agency PM in writing at least thirty (30) days prior to the SOW Termination Date if it is anticipated that all Tasks and Deliverables will not be completed by the SOW Termination Date or additional funds are required to complete any new scope of work.

11. DATA CLASSIFICATION

In the course of providing services under this SOW, Contractor will gain access or potential access to certain information assets of the Commonwealth which may require certifications, background checks, or other additional requirements.

M. G. L. c. 66A M. G. L. c. 93I

Commonwealth Dept. of Revenue Standard Forms See attached Publication 1075 Exhibit 7 and Commonwealth Dept. of Revenue standard forms. Contractor will submit to Commonwealth Dept. of Revenue certification including a background check of employees with access or potential access to Federal Tax Return Information. Contractor will assist the Commonwealth in applying for any necessary Federal approvals.

NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20 See attached Memorandum of Agreement. Contractor will submit to the Dept. of Criminal Justice Information certification including a background check of employees with access or potential access.

NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20 See attached Memorandum of Agreement. Contractor will submit to the Dept. of Criminal Justice Information certification including a background check of employees with access or potential access.

5 U.S.C. 552a s. 1106 Contractor will submit to Commonwealth certification including a background check of employees with access or potential access to Social Security Administration Data. Contractor will assist the Commonwealth in applying for any necessary Federal approvals.

Contractor certifies that its products or services, as provided under this SOW, meet all applicable legal and regulatory requirements pertaining to the identified data types indicated above. Contractor agrees to enter into additional agreement(s), as reasonably requested by the Commonwealth prior to gaining access, or potential access, to Commonwealth information assets. Contractor acknowledges that Agency may designate additional data types, applicable laws and regulations, and additional required documentation during the Term, which will be documented in the form of a written amendment hereto.

12. ADDITIONAL CONTRACTOR REQUIREMENTS

[TBD BY EOED DURING CONTRACTING]

13. DIGTIAL ACCESSIBILITY STANDARDS

Definitions

a. “Accessibility Conformance Report (ACR)” is a document that details how well a product or service meets an established accessibility standards such as the Web Content Accessibility Guidelines (WCAG). A completed Voluntary Product Accessibility Template or VPAT is often called an Accessibility Conformance Report.

b. “Accessibility Violation” is a failure to meet an established accessibility standard, such as the Web Content Accessibility Guidelines (WCAG), or an instance of incompatibility with assistive technology.

c. "Automated Accessibility Testing" refers to accessibility testing using a scanning tool that examines code and flags violations of WCAG success criteria. Automated testing is limited in its ability to identify Accessibility Violations.

d. “Deliverable” refers to the digital products and/or services including but not limited to the end user and admin interfaces and any digital output it generates delivered by the vendor to the Commonwealth in connection with the solicitation.

e. “Digital Accessibility Roadmap” is a structured remediation plan that outlines how the vendor will improve the accessibility of its products, services, or digital content. For each Accessibility Violation, the roadmap includes the Web Content Accessibility Guidelines (WCAG) success criterion, component, location, violation description, severity level, status, target date for remediation, date remediated, and the technique used to remediate each violation.

f. “Digital Asset” refers to any item of value that exists in a digital format.

g. “Manual Accessibility Testing” refers to testing performed by a human tester using manual methods including the use of assistive technology.

h. “Vendor Digital Accessibility Questionnaire” refers to a series of written questions that are designed to assess a vendor’s capabilities at designing, developing, and delivering accessible digital products.

i. “VPAT” refers to the Voluntary Product Accessibility Template developed by the Information Technology Industry Council (ITI) in collaboration with the U.S. General Services Administration (GSA) to help assess the accessibility of products.

j. “WCAG” refers to the Web Content Accessibility Guidelines published by the World Wide Web Consortium (W3C).

k. “Written Validation” refers to the documented confirmation that an Accessibility Violation has been successfully remediated. This validation is based on testing against criteria such as the Web Content Accessibility Guidelines (WCAG) and includes the technique implemented to remediate the violation and the testing method used to validate conformance.

Digital Accessibility Standards

a. Deliverables must conform to the Digital Accessibility Standards as defined in the Enterprise Digital Accessibility Policy as it may be amended from time to time.

Accessibility Conformance Report

a. Upon request by the Commonwealth, the vendor shall provide a current Accessibility Conformance Report (ACR), based on the latest version of the Voluntary Product Accessibility Template (VPAT®) that evaluates conformance with WCAG 2.1 or WCAG 2.2 level A and AA success criteria. The Accessibility Conformance Report (ACR) must meet the following requirements:

a. Be no more than 12 months old at the time of submission.

b. Accurately reflect the product’s current state of accessibility.

c. Be specific to the product or version proposed for use.

d. Be completed by qualified personnel knowledgeable in digital accessibility and the digital product.

b. Failure to provide a current Accessibility Conformance Report (ACR) that meets these requirements may result in disqualification of the vendor’s proposal, delay in contract execution, or cancellation of the contract.

Vendor Digital Accessibility Questionnaire

a. The vendor shall provide written responses to the Vendor Digital Accessibility Questionnaire upon request by the Commonwealth.

Digital Accessibility Roadmap

a. Upon request by the Commonwealth, for any known Accessibility Violation including those indicated on the ACR where a success criterion is “not met” or “partially met”, the vendor shall provide a Digital Accessibility Roadmap (the “Roadmap”). For each Accessibility Violation, the Roadmap must include the following items:

a. WCAG success criterion.

b. Location of each Accessibility Violation (e.g., page name and position on the page).

c. Component involved.

d. Violation description.

e. Severity level (e.g. critical, serious, medium, minor).

f. Status of remediation.

g. Target date for remediation.

h. Remediation date.

i. Technique implemented to remediate the Accessibility Violation.

b. The Roadmap and any successor Roadmaps created based on new findings, if applicable, will become part of the Agreement.

Vendor Remediation Responsibilities

a. If any Accessibility Violation is known or becomes known to the vendor during the term of the Agreement, whether by notice from the Commonwealth or through vendor’s own testing, vendor shall promptly remediate the violation at no additional cost to the Commonwealth.

a. Where any other provision of this Agreement limits fixes of defects to a warranty period, this provision controls.

b. Where any other provision of this Agreement requires that vendor only perform “reasonable efforts” to correct defects, this provision controls.

b. The vendor is responsible for addressing Accessibility Violations in any implementation, configuration, or documentation delivered or performed by the vendor.

c. Upon request by the Commonwealth, the vendor shall provide updates on remediation progress for any Accessibility Violation.

d. When an Accessibility Violation has been resolved, the vendor shall provide Written Validation of successful remediation.

Digital Accessibility Testing and Validation

a. During the bidding process and thereafter upon request, vendor shall cooperate and provide the Commonwealth, or any third-party digital accessibility service provider procured by the Commonwealth, access to test its digital products for accessibility at no additional cost to the Commonwealth.

b. The vendor shall perform accessibility testing as part of its development and quality assurance processes, including Automated Accessibility Testing and Manual Accessibility Testing as defined in the Commonwealth’s Vendor Digital Accessibility Testing Obligations. Vendor shall perform such testing at no additional cost to the Commonwealth.

c. The vendor shall perform accessibility testing on Deliverables in their final configured or customized state, remediate any Accessibility Violations identified during such testing prior to delivery, and provide Written Validation of compliance with Digital Accessibility Standards upon delivery at no additional cost to the Commonwealth.

Consequences for Non-Compliance In addition to any other rights and remedies in the Agreement, the Commonwealth may exercise the following remedies:

a. If the vendor fails to perform its accessibility obligations, including but not limited to timely remediation of Accessibility Violations or performance of their accessibility testing obligations, the Commonwealth may

a. terminate the contract without penalty;

b. perform necessary testing and/or remediate and deduct the actual cost from any outstanding payments to the vendor or seek reimbursement; or

c. elect not to renew the contract upon expiration.

Maintenance

a. For any new release or upgrade, vendor shall maintain the accessibility of Deliverables including interoperability with the environments specified in the vendor Accessibility Testing Matrix.

b. For any major release, the vendor shall provide an updated Accessibility Conformance Report (ACR).

Trainings, Demonstrations, and Documentation

a. The vendor shall coordinate with the Commonwealth in the identification of all prospective attendees at vendor trainings who require accommodations and shall cooperate with the Commonwealth in its provision of such accommodations.

b. All administrator and end user documentation and any training materials delivered by the vendor must be in compliance with the Digital Accessibility Standards.

Indemnification

a. The vendor shall indemnify and hold the Commonwealth harmless from any and all claims, damages, costs, and expenses arising from or relating to any failure of the Deliverables to meet the accessibility requirements outlined in this Agreement.

b. Pursuant to Section 13 of the Commonwealth Terms and Conditions for Information Technology Contracts, “The vendor’s liability for any other claim shall not exceed the greater of: (i) $100,000; or (ii) two times the total value of the Contract (or in the case of subscription-based Contracts, two times the total value of the Contract during the committed subscription term).

14. AUTHORITY TO EXECUTE

The undersigned hereby represent that they are duly authorized to execute this Statement of Work on behalf of their respective organizations. The signer on behalf of Contractor further represents that he/she is listed as an Authorized Signatory under the applicable Statewide Contract or RFR. This Statement of Work may be signed in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.

[AGENCY] [Enter Contractor Name]

Signature: ______________________________ Signature: ______________________________

Name: _________________________________ Name: ________________________________

Title: _________________________________ Title: ________________________________

Date: __________________________________ Date: _________________________________

APPENDIX A

The following terms are entered into by and between the Commonwealth entity and the Contractor signing the Statement of Work (“SOW”) attached hereto. The term “Agency” as used in this Appendix A shall refer to the Commonwealth entity signing the SOW. The following terms cannot be modified unless a written waiver is provided by the Agency General Counsel, or designee. The following Sections shall continue in effect beyond the Termination Date of the SOW: 2, 3, 6, 8, 9 and any other Sections that would under the circumstances reasonably extend beyond the Termination Date of the SOW.

1. Equipment and Workplace

Agency will provide standard workspace, office equipment, and network connectivity, as provided to state employees, and as required to enable Contractor personnel working on-site to provide the services contemplated under the SOW. Contractor will submit a list of personnel who will need access to the building and to state systems before execution of the SOW. Any Contractor personnel who have access to IT resources must comply with the Acceptable Use of Information Technology Policy (https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy) and any other workplace policies provided to Contractor by Agency.

2. System Security

Contractor shall comply with the Commonwealth’s Enterprise Information Security Policies and Standards (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards).

Contractor will be required to use data provided by Agency (“Commonwealth Data”) and will implement commercially reasonable safeguards necessary to: (i) prevent unauthorized access to Commonwealth Data from any public or private network; (ii) prevent unauthorized physical access to any information technology resources involved in the SOW project; and (iii) prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

If Contractor uses, or receives access or potential access to, Commonwealth personal data under M.G.L. c. 66A or personal information under M.G.L. c. 93H (collectively, “Commonwealth Personal Data”). Contractor shall implement the maximum feasible safeguards reasonably needed to: (i) ensure the security, confidentiality and integrity of electronic personal data and personal information; (ii) prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Personal Data from any public or private network; and (iii) notify Agency immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

3. Digital Accessibility

Contractor must comply with the digital accessibility obligations set forth in the Vendor Digital Accessibility Contract Language and Vendor Digital Accessibility Testing Obligations and any subsequent versions or amendments.

4. MassGIS Web Mapping Services

MassGIS is the Commonwealth’s Bureau of Geographic Information. Its legislative mandate includes coordinating GIS activities in the Commonwealth’s public agencies and distributing GIS data. MassGIS has also developed and is the host for the Commonwealth’s web mapping services.

If the Deliverables include the capability for viewing maps and related information as part of an Internet browser-based client application or in mobile mapping applications, and if those applications will display map information available through MassGIS web mapping services (e.g., parcels, orthophotos, streets, wetlands or any of MassGIS’ tile-cached map services), then Contractor shall use MassGIS geospatial web mapping services. Additionally, if the Deliverables include an application that relies on validating street addresses or geocoding addresses to determine a coordinate location for that address, the Contractor must discuss the possibility of using MassGIS address validation and geocoding services with MassGIS. MassGIS provides low or modest demand address validation and geocoding services which MassGIS may determine to be suitable for an application’s specific needs. MassGIS may grant a waiver of these requirements if Contractor demonstrates to MassGIS’ satisfaction that using the MassGIS services for the proposed application is not reasonably practical due to one or more of the following: (i) performance of the application would be degraded due to using the MassGIS services; (ii) the proposed application requires reliability that exceeds those that MassGIS can reasonably be expected to provide; (iii) the security requirements of the application preclude using the MassGIS services; and (iv) cost. Waivers are not valid under this Agreement unless they are provided in writing by the Director of MassGIS or, if the Director is not available, MassGIS’ Web Mapping Services Manager.

5. Code Review

If the Deliverables include software code or applications developed by Contractor for Agency, such code or applications shall follow current industry design and best practices, including, but not limited to those published by the National Institute of Standards & Technology (NIST), the SANS (SysAdmin, Audit, Network, Security (SANS) Institute), and other recognized bodies.

If the Deliverables include software or code that will be developed by Contractor and migrated into a production environment, Contractor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software or code creation life cycle, including during development, testing, and production: (i) Contractor shall configure at least two software environments including a development/quality assurance (QA) environment and a production environment; (ii) Contractor shall implement a change management procedure to ensure that activities in the development/QA environment remain separate and distinct from the production environment; (iii) Contractor shall segregate duties between development and testing of software changes and migration of changes to the production environment; (iv) Contractor shall implement security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment; (v) Contractor shall create a process to log and review all source control activities; (vi) Contractor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment; (vii) Contractor shall not make any development or code changes in a production environment; and (viii) Contractor shall implement additional internal controls as specified in the Agreement.

Contractor shall cooperate with Agency’s code review of the relevant software or application Deliverables. Prior to implementation or acceptance of a Deliverable, Contractor shall subject such Deliverable, if it includes software code or script, to independent application review by Agency or its delegated reviewer to validate that all applicable enterprise IT standards and security policies have been met, as well as other specifications as identified in this Agreement. The review shall be performed by individuals other than Contractor’s or Agency’s personnel who developed the Deliverables. For purposes of this requirement, "independent" may include other staff of the Agency provided that no direct reporting relationships exist between the development and review organizations.

6. Intellectual Property Rights

The term Property includes patents, copyrights, trademarks, trade secrets, technical or business information, and works of authorship fixed in any tangible medium, including without limitation, computer programs in object and/or source code form, scripts, data, documentation, content related to layout and graphical representation, and training materials.

Contractor Property includes: (1) Property created by Contractor for the open market, (2) Property developed by Contractor for other clients, and (3) Property developed by Contractor for internal purposes. Contractor will retain all right, title and interest in and to Contractor Property. The Agency’s possession, installation or use of Contractor Property will not transfer to it any title to such property. Except as expressly authorized, the Agency will not copy, modify, distribute, transfer, display, sublicense, rent, reverse engineer, decompile or disassemble Contractor Property.

Commonwealth Property includes: (1) Property developed by the Commonwealth, (2) Property owned by the Commonwealth independent of this Agreement, and (3) Deliverables created under this Agreement by Contractor, subcontractor, or both, in exchange for State or Federal funds. The Commonwealth retains all right, title and interest in and to the Commonwealth Property and all derivative works thereof. The Commonwealth grants to Contractor a non-exclusive, revocable, temporary license to use Commonwealth Property as described in categories (1) and (2) of this paragraph, as reasonably needed solely to perform the services contemplated under this Agreement. In accordance with the Commonwealth Terms and Conditions or the Commonwealth Terms and Conditions for IT Contracts, as applicable, all Deliverables described in category (3) of this paragraph are works made for hire.

Contractor hereby sells, transfers, and assigns to the Commonwealth, all rights, title, and interest in and to the Deliverables, and any derivative works thereof. CONTRACTOR HEREBY WAIVES IN FAVOR OF THE COMMONWEALTH (AND SHALL CAUSE ITS PERSONNEL TO WAIVE IN FAVOR OF THE COMMONWEALTH) ANY AND ALL ARTIST’S OR MORAL RIGHTS IT MAY HAVE PURSUANT TO ANY STATE OR FEDERAL LAWS OF THE UNITED STATES IN RESPECT TO ANY DELIVERABLE AND ALL SIMILAR RIGHTS UNDER THE LAWS OF ALL OTHER APPLICABLE JURISDICTIONS. Contractor agrees to execute all documents and take all actions that may be reasonably requested by Agency to evidence this transfer of ownership, including providing any code used to develop such Deliverables to Agency and the documentation for such code.

Notwithstanding the foregoing, if Contractor is engaged by Agency to customize or configure Contractor Property, and if the resulting customization or configuration provides no functionality independent of the Contractor Property, Contractor shall retain ownership of the Contractor Property and the customization or configuration, provided that it grants to the Commonwealth a fully-paid, royalty-free, non-exclusive, non-transferable, worldwide, irrevocable, perpetual, assignable license to such customization or configuration to use, reproduce, distribute, modify, publicly display, publicly perform, digitally perform, transmit, copy, sublicense, and create derivative works therefrom. Contractor shall not encumber or otherwise transfer any rights that would preclude a free and clear license grant to the Commonwealth.

If Contractor is engaged by Agency for the development of a web site, Agency will bear sole responsibility for registering the software or system domain name or URL, applying for any trademark registration relating to the software or system domain name or URL and applying for any copyright registration related to its copyright ownership with respect to any Commonwealth Property.

If the Deliverables contain or will contain any third-party Property, Contractor must provide to Agency documentation providing a sublicense of such third-party Property to the Commonwealth (“Sublicense Agreements”). The Sublicense Agreements must be included in Contractor’s initial quotation to Agency, or, if the requirement to use sublicensed third-party Property is not known at the outset of the project, as soon as the requirement becomes known. Sublicenses to third-party Property can only be provided under the Agreement if they are provided at no charge to the Commonwealth.

7. Warranty Contractor represents and warrants that (i) Contractor and its subcontractors are sufficiently staffed and equipped to fulfill Contractor’s obligations under this Agreement; (ii) Contractor’s services will be performed: by appropriately qualified and trained personnel; with due care and diligence and to a high standard of quality as is customary in the industry; in compliance with the Due Dates and the terms and conditions of this Agreement; and in accordance with all applicable professional standards for the field of expertise; (iii) Deliverables delivered under the SOW will substantially conform with the Tasks and Deliverable descriptions set forth in this Agreement; (iv) all media on which Contractor provides any software under this Agreement shall be free from defects; (v) all software delivered by Contractor under the SOW shall be free of Trojan horses, back doors, and other malicious code; (vi) Contractor has obtained all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties supplied or specified by Contractor for incorporation in the Deliverables to be developed; (vii) documentation provided by Contractor under the SOW shall be in sufficient detail so as to allow suitably skilled, trained, and educated Agency personnel to understand the operation of the Deliverables and Contractor shall promptly, at no additional cost to Agency, make corrections to any documentation that does not conform to this warranty; and (viii) any systems created or modified by Contractor under the SOW shall operate in substantial conformance with the specifications for the system or modifications for a minimum of six months (the “Warranty Period”) after Agency accepts such system or modifications pursuant to Section 7 (Acceptance or Rejection Process) of the SOW. Notwithstanding the foregoing, any subscription term licenses provided by Contractor shall be warranted for the duration of the subscription term. During the Warranty Period, Contractor shall correct any defects, at no charge to Agency.

8. Transfer of Engagement Products at Contract Termination

As of the Termination Date of the SOW, Contractor shall make available all Commonwealth Data to Agency in a format to be agreed upon by Agency and Contractor. Contractor shall provide reasonable assistance at no charge to provide knowledge transfer to Agency personnel, or Agency designees. Agency and Contractor may execute a Task Order or Change Order governing the transfer period if additional services are required by Agency.

9. Other Representations

Contractor agrees and shall ensure that its personnel and subcontractor personnel agree to the following terms.

Contractor shall not use for its own benefit, or divulge or disclose to anyone, except to (i) persons within the Commonwealth whose positions require them to know it and (ii) persons designated by Agency who have a need to know, any information not already lawfully available to the public concerning the Commonwealth (“Confidential Information”), including but not limited to information regarding any project of the Commonwealth, any e-commerce products or services, any web development strategy, any financial information or any information regarding users of or vendors to the Commonwealth. Confidential Information also includes, without limitation, any technical data, design, pattern, formula, computer program, source code, object code, algorithm, subroutine, manual, product specification, or plan for a new, revised or existing product or web site; any business, marketing, financial or sales information; and the present or future plans of the Commonwealth.

As of the termination of the Agreement with the Commonwealth, Contractor agrees to return to the Commonwealth all Commonwealth Property, Commonwealth Information and materials, documents and property, in Contractor’s possession or control, including without limitation, all materials relating to work done while assigned to Commonwealth projects. Contractor shall return to the Commonwealth all materials concerning past, present and future or potential products and/or services of the Commonwealth. Contractor shall return to the Commonwealth all materials provided by persons doing business with the Commonwealth and all teaching materials provided by the Commonwealth.

Contractor represents and warrants that it is not a party to any agreement or arrangement which would constitute a conflict of interest with the obligations undertaken under the SOW or would prevent Contractor from carrying out its obligations hereunder.

Contractor represents and warrants that it has paid all due state and federal taxes, or, if its tax status is in dispute or in the process of settlement, that it has responded as directed and within the required timeframes to all communications received from the state or federal government.

Contractor acknowledges that it is not an employee of any Massachusetts state or municipal government agency, and is not entitled to any benefits, guarantees or other rights granted to state or municipal government agencies, including but not limited to group insurance, disability insurance, paid vacations, sick leave or other leave, retirements plans, health plans, or premium overtime pay. Should Contractor be deemed to be entitled to receive any such benefits by operation of law or otherwise, Contractor expressly waives any claim or entitlement to receiving such benefits from Massachusetts state or municipal government agencies.

10. GenAI

The Commonwealth consistently seeks to realize the benefits of new technology, in particular generative artificial intelligence (AI). Contractor must comply with the Enterprise Use and Development of Generative Artificial Intelligence Policy issued by EOTSS on January 31, 2025, as it may be amended from time to time. Please follow this link to the policy: www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download .