ESBD_365992_1719870766708_Exhibit A SAVNS Certification and Service Agreement.pdf

Exhibit A

VENDOR CERTIFICATION AND SERVICE AGREEMENT FOR THE

STATEWIDE AUTOMATED VICTIM NOTIFICATION SERVICE (SAVNS)

OAG Contract No.

WHEREAS, the Office of the Attorney General (OAG) is the Texas State agency tasked with certifying a statewide vendor to provide a Statewide Automated Victim Notification Service (SAVNS) to a variety of political subdivisions of the State of Texas, including counties, county Sheriffs, clerks and attorneys, district attorneys, and courts (“Participating Entities”);

WHEREAS OAG solicited offers to perform the development, implementation and execution of a Statewide Automated Victim Notification System (SAVNS) to the various Participating Entities in a Request for Offer (RFO) for SAVNS, RFO #[ ], dated [ ];

WHEREAS OAG has accepted the offer of [VENDOR] to perform the requested Scope of Services - Statement of Work Requirements and Terms of Conditions Applicable to and for the various Participating Entities in response to the RFO #[ ], dated [ ];

NOW, THEREFORE, THIS CONTRACT is entered into by and between the OAG and VENDOR. OAG and VENDOR may be referred to in this contract (“Contract”) individually as “Party” or collectively as “Parties.”

The Parties, in consideration of their respective promises, agreements, and covenants contained and recited herein, hereby agree to the mutual obligations and performances described in this Contract as follows:

SECTION 1: CONTRACT TERM. This Contract shall commence on the date the final signature is affixed hereto (“Effective Date”) and shall terminate on August 31, 2020. (“Initial Term”). This Contract may be renewed for two (2) additional two (2) year renewal terms (each a “Renewal Term”), in the sole and absolute discretion of OAG. If renewed, any Renewal Term shall begin on September 1 and end on August 31, always coinciding with the State’s fiscal year. Each such Renewal Term shall be subject to all specifications and terms and conditions of this Contract and the Incorporated Documents as defined in Section 2 below.

OAG shall have the option to require continued performance, beyond the Initial or any Renewal Term of any of the within described services at the rates specified in this Contract. This option may be exercised more than once, but the total extension of performance hereunder shall not exceed four (4) calendar months or December 31, 2024, whichever is later. Such extension of services shall be subject to the requirements of the Contract, with the sole and limited exception that the original date of termination shall be extended pursuant to this provision. The OAG may exercise this option upon thirty (30) calendar day’s written notice to Vendor.

The Initial Term collectively with all Renewal Terms and all total extensions of services hereunder shall constitute the “Term” of the Contract.

SECTION 2: CONTRACT DOCUMENTS.

Vendor and OAG agree to be bound by the provisions contained in the following documents (“Incorporated Documents”), which describe the required performances in more detail and are incorporated by reference herein in their entirety in descending order of precedence:

1. This Contract.

2. OAG Standard Terms and Conditions

3. The RFO # [ ], dated [ ] including all posted documents, attachments, and Addenda (“RFO”), not attached hereto but known to and in the possession of both Parties and incorporated herein by reference.

4. Vendor written response to submission to the RFO, dated [ ], as accepted, not attached hereto but known to and in the possession of both Parties and incorporated herein by reference. (“Vendor Response”).

If there is, and to the extent of, any conflict between the Incorporated Documents, such conflict will be resolved according to the order of precedence as set forth above. Capitalized terms used herein and not otherwise defined shall have the same meaning as in the applicable Incorporated Document.

SECTION 3: CERTIFICATION OF A STATE-WIDE VENDOR. Consistent with the OAG’s authority contemplated by the RFO, this Contract shall serve as certification of the Vendor as the state-wide vendor for the provision of SAVNS to Participating Entities, (“Vendor Certification”) under the limitations specified herein. This Vendor Certification extends only to contracts relating to the SAVNS program that utilize the Participating Entity Services Agreement (“Participating Entity Services Agreement”) template provided by the OAG, attached hereto as Exhibit A.

The Vendor Certification is subject to Vendor’s continued adherence to any and all requirements of this Contract and the Incorporated Documents. The OAG may withdraw, terminate, or modify this Vendor Certification if Vendor violates any provision in this Contract or the Participating Entity Services Agreement.

The OAG may also withdraw, terminate, or modify this Vendor Certification at any time for Vendor’s failure to comply with any requirements of the RFO, the Vendor Response, or the failure to comply with any applicable Texas or federal law. Termination of this Vendor Certification shall terminate this Contract pursuant to Section 12, below.

SECTION 4: SERVICES TO BE PERFORMED BY VENDOR.

4.1 Project. Vendor agrees to develop, implement, maintain, operate, and monitor a SAVNS system as set forth in the RFO and the Vendor Response, (collectively the “Scope of Work” or “SOW”) which shall meet all of the requirements set forth in Section 4 of the RFO, all in accordance with the requirements of the Incorporated Documents referenced in Section 2 (“Project”). This Project includes but is not limited to the following services (collectively the “Services”):

[The specific scope of services to be provided by the Vendor will be determined during negotiations and prior to award of the certification and contract and provided herein.]

SECTION 5: SCHEDULE

5.1 Time is of the Essence. Time is of the essence in rendering of Services required by this Contract.

5.2 Performance Schedule. The Project shall be performed by Vendor according to a schedule to be mutually agreed by the Parties (“Schedule”) which shall set forth the required delivery dates of each report, plan, written notification, or other deliverable as required by the Incorporated Documents. Notwithstanding the foregoing, Vendor shall provide the reports and written notifications as required under Sections 7.7 and 7.8 of this Contract below at the corresponding frequency or timeline.

SECTION 6: COMPENSATION AND INVOICING

6.1 Payments for Services Rendered. The Parties stipulate and agree that OAG is the statutory party charged with administering grant funds to Participating Entities to pay for Vendor for the Services.

Accordingly, OAG shall not be directly responsible for any payment to Vendor for Services provided hereunder or pursuant to any individual Participating Entity Service Agreement, except as otherwise explicitly agreed.

All payments for such Services shall be made by each individual Participating Entity pursuant to the agreed pricing index (“Agreed Pricing Index”) attached hereto as Exhibit B.

6.2 Invoices for Services. Vendor shall submit an invoice to each of the Participating Entities no more frequently than once per quarter or four (4) times per year, for the expense of Services rendered for the prior billing period. All such invoices shall be billed to the respective Participating Entities in accordance with the Agreed Pricing Index. Notwithstanding the foregoing, the Vendor shall provide information and/or documentation related to the invoices sent to the various Participating Entities, as the OAG may reasonably require. The Vendor shall respond to an OAG request for all such information and/or documentation to support payments due to Vendor under the respective Participating Service Agreements within five (5) calendar days of receipt.

6.3 Pricing for Change Order Services. If either party submits a Change Order pursuant to Section 7 of this Contract, during the performance of the Services required under this Contract, to be considered by the other party, Vendor shall offer any such Additional Services as defined in Section 8.1 of this Contract, at the same rate as proposed in Vendor’s Pricing Submission as attached and incorporated into the Vendor’s Response.

SECTION 7: PROJECT MANAGEMENT

7.1 Key Personnel. Vendor shall assign professional personnel to the Project, with the necessary education, training, skill and experience to perform the Project for the duration of the Contract, who are material to the success of the Project (“Key Personnel”). Vendor shall assign each of the following roles as Key Personnel who shall perform the duties and responsibilities as required by Section 2.7.1 of the RFO:

(a) Project Manager who shall have expertise in project management and demonstrated experience in managing the Services required under this Contract;

(b) Support Services Manager who shall have the expertise and demonstrated experience in the development of promotional material and training curriculums related to the SAVNS system and the providing technical performance training related to the SAVNS system;

(c) Financial Specialist who shall have expertise and demonstrated experience in the consecutive issuance of invoices related to various multiple service contracts and management of multiple contractual relationships which require reporting thereunder.

All Key Personnel shall, using best efforts, oversee and manage the performance of Vendor’s Project obligations, including without limitation those described in this Contract, the RFO, and all other Incorporated Documents.

7.2 Removal. If OAG objects to a member of the Key Personnel assigned to the Project, or during the Project performance determines that a member of Key Personnel becomes unacceptable to OAG, in its sole discretion, OAG shall inform Vendor and Vendor shall remove that person from the Project (“Removal”) and provide a Replacement as set forth in Section 7.4 below.

7.3 Substitution. Vendor shall not substitute Key Personnel for any reason other than in Section 7.2 of this Contract, without OAG advance written approval to allow such substitution (“Substitution”). If OAG approves a Substitution, Vendor shall provide a Replacement as set forth in Section 7.4 below.

7.4 Replacement. If OAG has requested a Removal, or if a Substitution of personnel has been approved in advance by OAG, Vendor shall propose an alternate substitute professional with similar education, training, skill and experience to assume the position. If OAG objects to the replacement, Vendor shall propose another individual. OAG shall, if the replacement person is acceptable, provide a written approval to Vendor for the change. If Vendor is unable to provide an acceptable replacement person, Vendor may seek OAG approval to enter into a subcontract with a third party pursuant to Section 7.5 below.

7.5 Third Party Subcontractors. Vendor shall remain responsible for the performance of any part of this

Contract by any third parties hired by Vendor to participate in the provision of Project services as a subcontractor (“Subcontractor”) to Vendor, to the same extent as for Vendor’s employees. If Vendor desires to use any Subcontractors, Vendor shall seek the advance, written approval of OAG, which may be withheld in OAG’s sole discretion. If OAG agrees to allow Vendor to engage a particular Subcontractor, Vendor shall provide a subcontractor agreement that is consistent with and include the applicable terms of Incorporated Documents (“Sub Agreement”) to OAG for written approval. If OAG has approved a Sub Agreement, in writing in advance, Vendor may hire the Subcontractor set forth therein. Vendor shall use best efforts to ensure that:

(a) each such approved Subcontractor is made aware of, and understands, all terms of the Sub Agreement; and

(b) such Subcontractor’s performance conforms to the Sub Agreement at all times. Vendor shall also follow all HUB subcontracting TCPA guidelines.

It is contemplated by the Parties hereto that Vendor shall conduct the performances provided by this Contract substantially with its own resources and through the services of its own staff. In the event that Vendor should determine that it is necessary or expedient to subcontract for any of the performances specified herein, Vendor shall subcontract for such performances only after Vendor has transmitted to the OAG a true copy of the subcontract according to the procedure in Section 7.5 of this Contract. If any changes need to be made to subcontractors previously submitted on the HSP, prior written acknowledgment from the OAG is required. The OAG HUB Coordinator should be contacted prior to any changes being made to the HUB Subcontracting Plan in order to ensure that all HUB Good Faith Effort requirements of Texas Government Code §2161 have been met.

Vendor, in subcontracting for any performances specified herein, expressly understands and acknowledges that in entering into such subcontract(s), the OAG nor any Participating Entity is in any manner liable to any subcontractor(s) of Vendor. In no event shall this provision relieve Vendor of the responsibility for ensuring that the performances rendered under all subcontracts are rendered so as to comply with all terms of this Contracts or the Incorporated Documents.

7.6 Status Meetings. At OAG’s reasonable request, regularly scheduled status meetings relating to day-to-day activities of the Project shall be held on-site at the office of OAG at mutually agreed times between OAG personnel and Key Personnel.

7.7 Reporting. Pursuant to Section 5.2 of this Contract, OAG and Vendor shall agree on a Schedule to perform the Project which shall set forth the dates of each report, plan, or other deliverable as required by the Incorporated Documents. Notwithstanding the foregoing, Vendor shall provide the following reporting at the corresponding frequency.

(a) Monthly Project Status Reports. The Vendor’s Account Manager shall, throughout the Term of this Contract provide OAG a written monthly status report, on or before the 10th day of each month or other agreed upon date each month, which shall include the following data or information:

(i) Status of the SAVNS implementation and maintenance;

(ii) Establish priorities;

(iii) Identify and track status on performance issues;

(iv) Report work accomplished during the reporting period;

(v) Report on work to be accomplished during the subsequent reporting period;

(vi) Resolution status and/or plan for all actual or anticipated problems;

(vii) Written requests to make any significant deviation from the previously agreed upon plans; and

(viii) Date of next quarterly meeting with the OAG’s project manager and other designated

OAG staff members.

(b) Monthly Performance Reports. The Vendor shall, throughout the Term of this Contract and no later than the 10th day of each month, or at another mutually agreed date, provide the following written reports including the requested data or information for the prior calendar month:

(i) Down time reports by Participating Entity;

(ii) Number of SAVNS registrants;

(iii) Number and type of successful and unsuccessful notifications;

(iv) System interruption report;

(v) Function disabled report; and

(vi) Data transfer report by Participating Entity or statewide.

(c) Quarterly Performance Report. Prior to each quarterly performance review held at OAG facility as contemplated by Section 5.4.1 of the RFO, Vendor shall, throughout the Term of this Contract, deliver to OAG a quarterly report which shall include any of the data or information as required by 7.7(a) or 7.7(b) above, for the prior quarter and as reasonably requested by OAG.

(d) Annual Financial Report. Vendor shall, throughout the Term of this Contract, submit annual financial statements (balance sheet, income statement, and cash flow statement) no later than sixty (60) calendar days after the end of the Vendor’s fiscal year, including statements for any applicable parent or Subcontractor representing equal to or greater than ten percent (10%) of the gross dollar value of the pricing submission included as part of Vendor’s Response.

(e) Ad Hoc Reporting. Notwithstanding anything in the foregoing to the contrary, OAG shall be entitled to request or require additional information or more frequent reporting pursuant to the agreed Schedule or as otherwise contemplated by the Incorporated Documents.

7.8 Performance Notifications. In addition to any other notification required by this Contract, the Schedule, or the Incorporated Documents, Vendor shall, throughout the term of this Contract, provide written notification to the OAG within twenty-four hours of discovery that any of the performance measures included in Section

5.1 of the RFO or any of the other performance standards included in the Incorporated Documents fall below the required performance threshold therein.

SECTION 8: CHANGE ORDER PROCESS

8.1 Additional Services. OAG may require the Vendor to perform additional services from among the optional services that are set forth in the SOW which are not included in the Services required under this Contract (“Additional Services”), to be considered by the Parties in accordance with this Section 7 of this Contract for the generation of a change order (“Change Order”).

8.2 Procedure. Within five (5) business days following Vendor’s receipt of any Change Order from OAG, Vendor shall provide to OAG a written estimate of the impact of the proposed Additional Services on the Schedule, the Project and any additional cost associated with the Additional Services (“Impact Statement”). If OAG accepts the Impact Statement, and signs the Change Order, the Schedule shall be amended to include the Additional Services set forth in the Change Order, which shall be governed by, and performed pursuant to, the terms and provisions of this Contract.

8.3 Change Orders to be Mutually Agreed. No work or services shall commence, or products provided, pursuant to any Change Order unless and until the applicable fees, and all other impacts on the Project and Schedule as specified by Vendor in the Impact Statement are mutually agreed upon, in writing, by OAG and Vendor. No Change Order or any applicable fees associated therewith shall be deemed to modify this Contract or obligations between OAG and Vendor except to the extent the Change Order is mutually agreed upon, in advance in writing, and signed by both OAG and Vendor.

8.4 OAG’s Internal Development or Use of a Third Party. If the parties cannot agree on a Change Order for the Additional Services, OAG may elect to perform the services internally or retain a third-party contractor to perform the Additional Services, and in such event, Vendor shall cooperate with OAG internal personnel and/or such third party as reasonably required.

SECTION 9: WARRANTIES

9.1 Vendor Warranties. In addition to any warranty obligations in the Incorporated Documents, Vendor hereby represents and warrants:

(a) that Vendor shall perform the Project with the professional skill and care ordinarily provided by comparable professionals in the same industry;

(b) that each of the Vendor employees and agents assigned to perform Vendor’s obligations under this Contract and Incorporated Documents, shall have the skill and training to perform the Project in accordance with the foregoing standard of care, and that all work shall be produced in a professional and workmanlike manner;

(c) that the SAVNS system shall conform to and shall be fit for their particular purpose as set forth in this Contract, and in the SOW and Incorporated Documents;

(d) that all deliverables provided hereunder shall conform to and shall be fit for their particular purpose as set forth in this Contract, and in the SOW and Incorporated Documents;

(e) that all Project performance and deliverables provided under the Contract are, and will be, free of all liens, claims and other restrictions, and that OAG’s use and possession of such deliverables will not violate the terms or conditions of any license, confidentiality agreement, non-competition agreement, employment agreement or any other agreement to which Vendor, its agents, officers, employees or subcontractors may be subject;

(f) that Vendor has the right to develop and assign all ownership rights in the deliverables to

OAG as contemplated under this Contract, free from infringement claims, free from violations of unfair competition law, and free from violations of any other contact or law; and

(g) that Vendor will implement reasonable and appropriate measures to prevent unauthorized disclosure or exposure of OAG Protected Data during Vendor’s performance of the Services due under this Contract and the Incorporated Documents.

These representations and warranties are essential and material to OAG’s willingness to enter into this Contract.

9.2 Warranty of Law. Vendor warrants and represents that to the best of its knowledge: (i) Vendor has full authority to enter into this Contract and to consummate the transactions contemplated hereby and (ii) this Contract is not prohibited by any other agreement to which Vendor is a party or by which it may be bound (the “Legal Warranty”). In the event of a breach of the Legal Warranty, Vendor shall indemnify and hold harmless OAG from and against any and all losses, liabilities, damages, causes of action, claims, demands, and expenses (including reasonable legal fees and expenses) incurred by OAG, arising out of or resulting from said breach.

SECTION 10: DATA PROTECTION AND INFORMATION SECURITY

10.1 Definitions. Capitalized terms used herein shall have the meanings set forth in this Section 10.

(a) “Authorized Employees” shall mean Vendor’s employees who have a need to know or otherwise access OAG Protected Data to enable Vendor to perform its obligations under this Contract or any of the Incorporated Documents.

(b) “Authorized Persons” shall mean (i) Authorized Employees; and (ii) Vendor’s contractors or agents, as each is specified on Exhibit C to this Contract who have a need to know or otherwise access OAG Protected Data to enable Vendor to perform its obligations under this Contract or any of the Incorporated Documents, and who are bound in writing by confidentiality obligations sufficient to protect OAG Protected Data in accordance with the terms and conditions of this Contract.

(c) “OAG Protected Data” shall mean all documents, reports, data, records, forms, and other materials obtained by Vendor from the OAG, the Participating Entities, any individual registered to receive notifications from the SAVNS system, or is otherwise received by Vendor as a result of providing the Services as required under this Contract or any of the Incorporated Documents which includes personally identifiable information, federal tax information, personal health information, criminal justice information, or any information that is classified as confidential or sensitive by federal or state law, by agency policy, or is defined as "Personal Identifying Information" under Texas Business and Commerce Code §521.002(a)(1) or "Sensitive Personal Information" as defined by Texas Business and Commerce Code §521.002(a)(2) or any other data or information which (i) has been marked as confidential by any party; (ii) whose confidential nature has been made known to the Vendor by the OAG, the Participating Entities, or any individual registered to receive notifications under the SAVNS system; or (iii) that due to their character and nature, a reasonable person under like circumstances would treat as confidential.

(d) “Personal Identifiable Information” shall have the meaning set forth in Texas Business and Commerce Code §521.002(a)(1).

(e) “SAVNS Data” shall mean all documents, reports, data, records, forms, and other materials obtained by Vendor from the OAG, the Participating Entities, any individual registered to receive notifications from the SAVNS system, or is otherwise received by Vendor as a result of providing the Services as required under this Contract or any of the Incorporated Documents, without regard to whether such data includes the type of information included in the definition of OAG Protected Data.

(f) “Security Breach” means (i) any act or omission that materially compromises either the security, confidentiality or integrity of OAG Protected Data, or the physical, technical, administrative or organizational safeguards put in place by Vendor or any Authorized Persons that relate to the protection of the security, confidentiality or integrity of OAG Protected Data, (ii) receipt of a complaint in relation to the privacy practices of Vendor or any Authorized Persons or a breach or alleged breach of this Contract relating to such privacy practices.

(f) “Sensitive Personal Information” shall have the meaning set forth in Texas Business and

Commerce Code §521.002(a)(2).

10.2 Standard of Care. (a) Vendor acknowledges and agrees that, during the course of its engagement by OAG and the various Participating Entities, Vendor may receive or have access to OAG Protected Data. Vendor shall comply with the terms and conditions set forth in this Contract, the RFO, and OAG Information Security Standards (Attachment 4 to the RFO) in its collection, receipt, transmission, storage, disposal, use and disclosure of both OAG Protected Data and be responsible for the unauthorized collection, receipt, transmission, access, storage, disposal, use and disclosure of OAG Protected Data under its control or in its possession by all Authorized Employees and/or Authorized Persons. Vendor shall be responsible for, and remain liable to OAG for the actions and omissions of all Authorized Persons that are not Authorized Employees concerning the treatment of OAG Protected Data as if they were Vendor’s own actions and omissions.

(b) In recognition of the foregoing, Vendor agrees and covenants that it shall:

(i) keep and maintain all OAG Protected Data in strict confidence, using such degree of care a s is appropriate to avoid unauthorized access, use or disclosure;

(ii) use and disclose OAG Protected Data solely and exclusively for the purposes for which the OAG Protected Data, or access to it, is provided pursuant to the terms and conditions of this Contract, and not use, sell, rent, transfer, distribute, or otherwise disclose or make available OAG Protected Data for Vendor’s own purposes or for the benefit of anyone other than the OAG, Participating Entities OAG, in each case, without OAG’s prior written consent; and

(iii) not, directly or indirectly, disclose OAG Protected Data to any person or entity other than its Authorized Employees and/or Authorized Persons (“Unauthorized Third Party”) without the prior express written consent from OAG, unless and to the extent required by applicable law or court order in which case, Vendor shall (1) use best efforts to notify OAG before such disclosure or as soon thereafter as reasonably possible; (2) be responsible for and remain liable to OAG for the actions and omissions of any Unauthorized Third Party concerning the treatment of such OAG Protected Data as if they were Vendor’s own actions and omissions; and (iii) require the Unauthorized Third Party that has access to Personal Information to execute a written agreement agreeing to comply with the terms and conditions of this Contract, the RFO, and the OAG Information Security Standards (Attachment 4 to the RFO) relating to the treatment of OAG Protected Data.

10.3 Information Security. (a) Vendor represents and warrants that its collection, access, use, storage, disposal and disclosure of OAG Protected Data does and will comply with all applicable federal, state, and local privacy and data protection laws, as well as all other applicable regulations and directives, including but not limited to Texas Business and Commerce Code Chapter 521, Texas Administrative Code Chapter 202 and the Health Insurance Portability and Accountability of 1996 (HIPAA) and all amendments thereto.

(b) Without limiting Vendor’s obligations under Section 10.3(a) above, Vendor shall implement administrative, physical and technical safeguards to protect OAG Protected Data. Vendor shall, upon request, submit to OAG security framework implemented in Vendor’s organization, such as International Organization for Standardization’s standards: ISO/IEC 27001:2013 ,Code of Practice for International Security Management, the Information Technology Library (ITIL) standards, the Control Objectives for Information and related Technology (COBIT) standards or other applicable industry standards for information security, and shall ensure that all such safeguards, including the manner in which OAG Protected Data is collected, accessed, used, stored, processed, disposed of and disclosed are in compliance with and in addition to the OAG Information Security Standards (Attachment 4 to the RFO).

(c) In addition to and inclusive of the requirements set forth in OAG Information Security Standards (Attachment 4 to the RFO), at a minimum, Vendor’s safeguards for the protection of OAG Protected Data shall include: (i) limiting access of OAG Protected Data to Authorized Employees/Authorized Persons;

(ii) securing business facilities, data centers, paper files, servers, back-up systems and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability; (iii) implementing network, device application, database and platform security; (iv) securing information transmission, storage and disposal; (v) implementing authentication and access controls within media, applications, operating systems and equipment; (vi) encrypting Sensitive Personal Information stored on any mobile media; (vii) encrypting Sensitive Personal Information transmitted over public or wireless networks;

(viii) strictly segregating OAG Protected Data, and information from its other customers so that OAG Protected Data is not commingled with any other types of information; (ix) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with any applicable state or federal law; and (x) providing appropriate privacy and information security training to Vendor’s employees, contractors, or agents.

(d) During the term of each Authorized Employee’s employment by Vendor, Vendor shall at all times cause such Authorized Employees to abide strictly by Vendor’s obligations under this Contract, the RFO, and the OAG Information Security Standards (Attachment 4 to the RFO). Upon OAG’s written request, Vendor shall promptly identify for OAG in writing all Authorized Employees as of the date of such request.

10.4 Security Breach Procedures.

(a) Vendor shall:

(i) provide OAG with the name and contact information for an employee of Vendor who shall serve as OAG’s primary security contact and shall be available to assist OAG twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a Security Breach;

(ii) notify OAG of a Security Breach as soon as practicable, but no later than twenty-four

(24) hours after Vendor becomes aware of it; and

(iii) notify the following OAG Contact of any Security Breaches by both telephone and email with a read receipt:

Rebecca Esparza

512.936.2280 Rebecca.esparza@oag.texas.gov

The email sent to the above OAG contact shall be copied to incidents@oag.texas.gov.

(b) Immediately following Vendor’s notification to OAG of a Security Breach, the parties shall coordinate with each other to investigate the Security Breach. Vendor agrees to reasonably cooperate with OAG in OAG’s handling of the matter, including, without limitation:

(i) assisting with any investigation;

(ii) providing OAG with physical access to the facilities and operations affected;

(iii) facilitating interviews with Vendor’s employees and others involved in the matter; and

(iv) (making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards, this Contract, the RFO, and the OAG Information Security Standards (Attachment 4 to the RFO) or as otherwise reasonably required by OAG.

(c) Vendor shall use best efforts to immediately remedy any Security Breach and prevent any further Security Breach at Vendor’s expense in accordance with applicable privacy rights, laws, regulations and standards. Vendor shall reimburse OAG for actual costs incurred by OAG in responding to, and mitigating damages caused by, any Security Breach, including all costs of notice and/or remediation pursuant to Section 10.4(d).

(d) Vendor agrees that it shall not inform any third party of any Security Breach without first obtaining OAG’s prior written consent, except to the extent required under Texas Business and

Commerce Code Chapter 521 or any other applicable law or to any Participating Entity pursuant to the Participating Entity Services Agreement. Notwithstanding the foregoing, Vendor shall provide prior written notice to OAG of its intent to inform any third-party, other than a Participating Entity, of any Security Breach and identify the applicable law the Vendor believes requires such disclosure

(e) In the event of any Security Breach, Vendor shall promptly use its best efforts to prevent a recurrence of any such Security Breach.

10.5 Oversight of Security Compliance. Upon OAG’s written request, to confirm compliance with this Contact, the RFO, the OAG Information Security Standards (Attachment 4 to the RFO) as well as any applicable laws and industry standards, Vendor shall promptly and accurately complete a written information security questionnaire provided by OAG or a third party on the OAG’s behalf regarding Vendor’s business practices and information technology environment in relation to all OAG Protected Data being handled and/or mailto:Rebecca.esparza@oag.texas.gov mailto:incidents@oag.texas.gov services being provided by Vendor to OAG or any of the Participating Entities pursuant to this Contract or the Incorporated Documents. Vendor shall fully cooperate with such inquiries. OAG shall treat the information provided by Vendor in the security questionnaire as Vendor’s confidential, proprietary information under Section 11.1 below.

10.6 Return or Destruction of OAG Protected Data. At any time during the term of this Contract at the OAG’s written request or upon the termination or expiration of this Contract for any reason, Vendor shall, and shall instruct all Authorized Persons to, promptly return to the OAG all copies, whether in written, electronic or other form or media, of OAG in its possession or the possession of such Authorized Persons, or securely dispose of all such copies, and certify in writing to the OAG that such OAG Protected Data has been returned to OAG or disposed of securely. Vendor shall comply with all reasonable directions provided by OAG with respect to the return or disposal of OAG Protected Data.

10.7 Equitable Relief. Vendor acknowledges that any breach of its covenants or obligations set forth in this Section 10 may cause OAG irreparable harm for which monetary damages would not be adequate compensation and agrees that, in the event of such breach or threatened breach, OAG is entitled to seek equitable relief, including a restraining order, injunctive relief, specific performance and any other relief that may be available from any court, in addition to any other remedy to which OAG may be entitled at law or in equity. Such remedies shall not be deemed to be exclusive but shall be in addition to all other remedies available at law or in equity, subject to any express exclusions or limitations in this Contract to the contrary.

10.8 Material Breach. Vendor’s failure to comply with any of the provisions of this Section 10 is a material breach of this Contract. In such event, OAG may terminate the Contract for cause, effective immediately upon written notice to the Vendor without further liability or obligation to OAG.

10.9 Indemnification. In addition to any of the indemnification or hold harmless obligations of Vendor provided for within the RFO or the OAG’s Standard Terms and Conditions, Vendor shall also defend, indemnify and hold harmless the State of Texas and OAG, and/or their officers, agents, employees, representatives, contractors, assignees, and/or designees (collectively the “OAG Indemnitees”) from and against all losses, damages, liabilities, deficiencies, actions, judgments, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys’ fees, the cost of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers, arising out of or resulting from any third party claim against any OAG Indemnitee arising out of or resulting from Vendor’s failure to comply with any of its obligations under this Section 10.

10.10 Ownership and Use of SAVNS Data. Notwithstanding anything in this Contract to the contrary, nothing contained herein shall be construed to grant the Vendor any ownership rights in any SAVNS Data provided to Vendor in connection with this Contract, the SOW, or any of the Incorporated Documents. Vendor shall not sell, provide, or otherwise commercialize SAVNS Data without the prior written consent of OAG.

Vendor shall only use the OAG SAVNS Data in connection with the Services required hereunder and otherwise consistent with this Contract and the Incorporated Documents.

SECTION 11: CONFIDENTIALITY

11.1 OAG’s Responsibilities. OAG hereby agrees that (i) specific identified methodologies, materials, plans, or other proprietary information related to the development and implementation of the SAVNS system as provided by Vendor under this Contract shall be treated as confidential in nature; (ii) OAG shall implement reasonable and appropriate measures designed to secure the confidentiality of such confidential information, and (iii) except as permitted by the SOW and Section 11.2 of this Contract, none of such materials shall be in any way disclosed by OAG to any third party, in whole or in part, without the prior written consent of Vendor.

If OAG becomes aware of the unauthorized possession of such materials, it shall promptly notify Vendor.

Notwithstanding anything in this Contract to the contrary, any report, plan, or other deliverable required to be provided to OAG pursuant to the Incorporated Documents shall not be considered to be confidential in nature and OAG is under no obligation to maintain the confidentiality thereof.

11.2 OAG Compliance and Vendor Cooperation with Texas Public Information Act Requests.

Notwithstanding any provisions of this Contract to the contrary, Vendor understands that OAG will comply with the Texas Public Information Act, Texas Government Code, Chapter 552 as interpreted by judicial opinions and opinions of the Attorney General of the State of Texas. OAG agrees to notify Vendor in writing within a reasonable time, of a request for information related to Vendor’s work under this Contract. Vendor will cooperate with OAG in the production of documents responsive to the request. OAG will make a determination whether to submit a Public Information Act request to the Attorney General. Vendor will notify OAG General Counsel within twenty-four (24) hours of receipt of any third-party requests for information that was provided by the State of Texas for use in performing this Contract and all data and other information generated or otherwise. Vendor is required to make any information created or exchanged with OAG, the State of Texas, or any of its agencies pursuant to this Contract, and not otherwise excepted from disclosure under the Texas Public Information Act, available in a format that is accessible by the public at no additional charge to the state.

11.3 Vendor’s Responsibilities. Vendor hereby agrees that (i) any information related to the official business of OAG that Vendor obtains from OAG in the course of the performance of this Contract is the confidential and proprietary information of OAG, (ii) Vendor shall implement reasonable and appropriate measures designed to secure the confidentiality of such information, and (iii) such information shall not be in any way disclosed by Vendor to any third party, in whole or in part, without the prior written consent of OAG, which may be granted or withheld in its sole discretion. If Vendor becomes aware of the unauthorized possession of such information, it shall promptly notify OAG. Vendor shall also assist OAG with preventing the recurrence of such unauthorized possession and with any litigation against the third parties deemed necessary by OAG to protect its proprietary rights.

11.4 Exclusions. Each party shall be a receiving party (“Receiving Party”) relative to the other party’s confidential information. The provisions of this Section 11 (“Confidentiality”) shall not apply to any information (i) that is in the public domain prior to the disclosure or that becomes part of the public domain, or otherwise becomes publicly known, by publication or otherwise, other than by way of a breach of this Contract by the Receiving Party, (ii) that was known to, or in the lawful possession of the Receiving Party without obligation, as the case may be, prior to the disclosure in connection with the Contract, (iii) that was disclosed to the Receiving Party by a third party who was in lawful possession of the information and who had the right to make such disclosure at the time of the disclosure, (iv) that was independently developed by the Receiving Party outside the scope of this Contract, or (v) that Receiving Party, is required to disclose by law or legal process, in which case Receiving Party shall notify the owning party so that action may be taken to protect the affected confidential information. Notwithstanding any other provision herein to the contrary, all provisions in this Section 11 are subject to the Public Information Act, as further described in the Contract. Further, nothing in this Section 11.4 shall be deemed to alter, limit, or otherwise modify any of Vendor’s obligations related to the use and protection of OAG Protected Data pursuant to Section 10 of this Contract, the RFO, and OAG’s OAG Information Security Standards (Attachment 4 to the RFO).

SECTION 12: TERMINATION

12.1 Termination by Vendor. Vendor may terminate this Contract if OAG commits any material breach under this Contract and fails to remedy such breach within (30) days after written notice of such breach is delivered by Vendor to OAG.

12.2 Termination by OAG. OAG shall have the right to terminate this Contract (reserving cumulatively all other rights and remedies under this Contract, the RFO, and the Incorporated Documents, in law and/or in equity) without further obligation or liability to Vendor if Vendor or any subcontractor to Vendor commits any material breach of this Contract and fails to remedy such breach within thirty (30) days after written notice by OAG to Vendor of such breach. OAG shall have the right to terminate this Contract effective immediately and without prior notice if Vendor goes into liquidation or files for bankruptcy. Notwithstanding the foregoing, OAG shall also have the right to terminate this Contract (reserving cumulatively all other rights and remedies under this Contract, the RFO, and the Incorporated Documents, in law and/or in equity) without further obligation or liability to Vendor pursuant to the terms of the OAG Standard Terms and Conditions, Article IV.

Termination.

12.3 Effect of Termination. Termination of this Contract shall not affect any rights and/or obligations of the parties which arose prior to any such termination and such rights and/or obligations shall survive any such termination. Upon termination, each party shall return the confidential property of the other party obtained under this Contract or the Incorporated Documents, as applicable, however excluding all Work Product as that is defined in OAG Standard Terms and Conditions, Article I, Definitions, produced pursuant to this Contract which shall remain the property of OAG. In addition, the confidentiality obligations of the parties in Section 11 (“Confidentiality”) shall survive the termination of this CONTRACT.

SECTION 13: LIMITATIONS ON LIABILITY AND INDEMINITIES

13.1 Limitation of Liability. NOTWITHSTANDING ANY OTHER PROVISION OF THIS CONTRACT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, SPECIAL OR

CONSEQUENTIAL DAMAGES OR LOSS OF ANTICIPATED PROFITS OR REVENUES IN

CONNECTION WITH OR ARISING OUT OF THE SUBJECT MATTER OF THIS CONTRACT.

13.2 Indemnification. In addition to the indemnification and hold harmless obligations of Vender in this Contract included in Section 9.2 and Section 10.9 above, Vendor shall indemnify and hold harmless the State of Texas, the OAG, and/or their employees, agents, representatives, contractors, assignees, and/or designees pursuant to the terms of the OAG Standard Terms and Conditions, Article VIII., Indemnities.

SECTION 14: GENERAL

14.1 Waiver, Amendment or Modification. The waiver, amendment or modification of any provision of this Contract or any right, power or remedy hereunder shall not be effective unless made in writing and signed by both parties. No failure or delay by either party in exercising any right, power or remedy with respect to any of its rights hereunder shall operate as a waiver thereof. Neither the execution of this Contract by OAG, any provision herein, nor any other conduct of OAG relating to this Contract or any of the Incorporated Documents, will be considered a waiver of sovereign immunity.

14.2 Notice. All notices under this Contract shall be in writing and shall be deemed to have been duly given if delivered in person, by commercial overnight courier or by registered or certified mail, postage prepaid, return receipt requested, and addressed as follows:

To VENDOR: [INSERT VENDOR Contact Information].

To OAG: [Insert OAG Contact Information]

14.3 No Third-Party Beneficiaries. This Contract is not intended to create any right in or for the public, or any member of the public, any subcontractor, supplier or any other third party, or to authorize anyone not a party to this Contract to maintain a suit to enforce or take advantage of its terms.

14.4 Successors and Assigns. Neither party may assign this Contract in whole or part without the prior written consent of the other party. Any attempt to assign this Contract without the prior written consent of the other party is void and without legal effect, and such an attempt constitutes a material breach and grounds for termination by the other party. Subject to the foregoing, all of the terms, conditions, covenants and agreements contained herein shall inure to the benefit of, and be binding upon, any successor and any permitted assignees of the respective parties hereto. It is further understood and agreed that consent by either party to such assignment in one instance shall not constitute consent by the party to any other assignment. A transfer of corporate control, merger, sale of substantially all of a party’s assets and the like shall be considered an assignment for these purposes.

14.5 Dispute Resolution. Any dispute arising under or related to this Contract shall be resolved according to the Dispute Resolution procedure set forth in the OAG Standard Terms and Conditions, Article IX., Dispute Resolution.

14.6 Governing Law. The validity, construction and performance of this Contract and the legal relations among the parties to this Contract shall be governed by and construed in accordance with the laws of the State of Texas without giving effect to its conflict of law principles. The venue shall be as set forth in the OAG Standard Terms and Conditions, Article XII. Venue and Choice of Law.

14.7 Independent Contractor. Vendor, in performance of this Contract, is acting as an independent contractor. Vendor personnel (including personnel supplied by subcontractors) hereunder are not OAG ‘s personnel or agents, and Vendor assumes full responsibility for their acts. Vendor shall be solely responsible for the payment of compensation of Vendor employees and contractors assigned to perform services hereunder, and such employees and contractors shall be informed that they are not entitled to the provision of any OAG employee benefits. OAG shall not be responsible for payment of worker’s compensation, disability or other similar benefits, unemployment or other similar insurance or for withholding income or other similar taxes or social security for any Vendor employee, and such responsibility shall solely be that of Vendor.

14.8 Severability. In the event any one or more of the provisions of the Contract shall for any reason be held to be invalid, illegal or unenforceable, the remaining provisions of this Contract shall be unimpaired, and the invalid, illegal or unenforceable provision shall be replaced by a provision, which, being valid, legal and enforceable, comes closest to the intention of the parties underlying the invalid, illegal or unenforceable provision.

14.9 Entire Agreement; Inconsistent Terms. This Contract, all exhibits, appendices, and schedules attached hereto, and the Incorporated Documents are the complete and exclusive statement of the agreement between the OAG and the Vendor, and supersede any and all other agreements, oral or written, between the parties. This Contract may not be modified except by written instrument signed by the OAG and by an authorized representative of the Vendor. The parties agree that any terms or conditions of any purchase order or other instrument that are inconsistent with, or in addition to, the terms and conditions hereof, shall not bind or obligate the Vendor.

14.10 Counterparts. This Contract and other Incorporated Documents which are required to be duly executed, may be executed in counterparts and by the exchange of signatures by facsimile or PDF.

[VENDOR] BY:

Signature Date

Name Title

OAG BY:

Signature Date

Name Title

EXHIBITS TO…