ESBD_494239_1772808334972_Exhibit A - IT Data Security Addendum.pdf

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 1 of 24

Exhibit A

Addendum to Agreement #______

Texas Tech University Data Security Addendum

Texas Tech University (referred to as “TTU”) and [insert Contractor name] (referred to as “Contractor”) agree to enter into this Data Security Addendum (“Addendum”), which is incorporated and made a part of the Agreement (“Agreement”) made between TTU and Contractor.

In the event of any conflict between the terms of this Addendum and the terms of the Agreement, the terms of this Addendum shall control.

Throughout the term of the Agreement, Contractor and TTU shall cooperatively maintain safeguards to protect the data and information of both parties.

TTU retains full ownership of all TTU data input, fed into, and/or created within Contractor’s systems. The Contractor will not use or allow access to personally identifiable information (“PII”) from TTU data, except in accordance with the requirements established by the Agreement and this Addendum. Access to TTU data shall be limited to authorized individuals who have an operational or administrative need for access and shall not be released to other individuals or third parties, unless required by applicable state or federal law, without the express prior consent of TTU. Exceptions may be made only with the written approval of TTU.

Definitions:

When used below, the term:

1. “Confidential Information,” has the meaning assigned by 1 Texas Administrative Code (TAC) §202.1. This generally includes all confidential and/or proprietary information of a party disclosed to the other party, whether verbally or in writing, that is designated as confidential, or it is reasonably understood to be confidential given the nature of the information and the circumstances of disclosure. However, this definition may be extended to include other information identified by TTU.

2. “Information Resources,” has the meaning assigned by Texas Government Code §2054.003. This generally includes the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information.

3. “Personally Identifiable Information,” or “PII” has the meaning(s) assigned by 34 CFR § 99.3 (as it relates to student education records) and/or Texas Business and Commerce Code §521.002, but may be extended to include other personal information identified by TTU.

I. FERPA

https://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC?tac_view=5&ti=1&pt=10&ch=202&sch=A&rl=Y https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2054.htm#2054.003 https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-A/section-99.3 https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm#521.002

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 2 of 24

1. IF given access to education records, the Contractor agrees to abide by the limitations on re-disclosure of

PII from education records set forth in The Family Educational Rights and Privacy Act (“FERPA”) (20 U.S.C. § 1232g; 34 CFR § 99.33) and with the TTU Information Security terms set forth below.

2. Contractor agrees that it may create, receive from or on behalf of TTU, or have access to, records or record systems that are subject to FERPA (collectively, the "FERPA Records"). To the extent that Contractor has access to “education records” under the Agreement, it is deemed a “school official,” as each of these terms are defined under FERPA. Contractor represents, warrants, and agrees that it will: (1) hold the FERPA Records in strict confidence and will not use or disclose the FERPA Records except as

(a) permitted or required by this Addendum, (b) required by law, or (c) otherwise authorized by TTU in writing; (2) safeguard the FERPA Records according to commercially reasonable administrative, physical, and technical standards that are no less rigorous than the standards by which Contractor protects its own confidential information; and (3) continually monitor its operations and take any action necessary to assure that the FERPA Records are safeguarded in accordance with the terms of this Addendum. At the request of TTU, Contractor agrees to provide TTU with a written summary of the procedures Contractor uses to safeguard the FERPA Records.

II. Contractors/Subcontractors

Contractor must require its third-party contractors, subcontractors, and affiliates that handle or have access to TTU data to comply with the data disclosure terms and limitations in the Agreement and this Addendum.

Contractor is responsible for any and all damages, fines, and/or corrective action(s) arising from any failure of Contractor to secure and protect TTU data, whether arising from the negligence or acts or omissions of Contractor, its contractors, subcontractors, agents, and/or affiliates.

III. Physical Security

1. TTU data shall be hosted in facilities that are physically secured and operated in accordance with NIST

Special Publication 800-53 OR a generally recognized comparable cybersecurity standard. Only Contractor’s personnel, its authorized contractors, subcontractors, and employees operating the physical facility shall have physical access to the computer servers housing TTU’s data.

2. When receiving media containing TTU data, Contractor will keep the media physically secured against unauthorized access. Once the data has been transferred to its intended destination, Contractor will render the media unreadable using industry-standard processes.

IV. System Access

Any access to TTU’s computer systems must be approved and coordinated through the TTU Chief Information Security Officer or their designee. No automated tools may be installed by Contractor without prior authorization from the TTU Office of the Chief Information Officer (“CIO”).

V. Information Security https://www.govinfo.gov/content/pkg/USCODE-2011-title20/pdf/USCODE-2011-title20-chap31-subchapIII-part4-sec1232g.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title20/pdf/USCODE-2011-title20-chap31-subchapIII-part4-sec1232g.pdf

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 3 of 24

1. Contractor shall abide by and implement the controls specified in NIST Special Publications 800-53 OR another generally recognized comparable cybersecurity standard. Examples of controls include, but are not limited to: (1) firewalls, (2) vulnerability scanning, (3) endpoint protection software, (4) regular backups including off-site transfer to facilitate disaster recovery, (5) up-to-date installation of all current patches, (6) encrypting all communications containing personally identifiable or other sensitive or confidential information, and, if required by TTU, (7) encryption in the Contractor’s database of all passwords and personally identifiable or other sensitive or confidential information.

2. Contractor personnel shall regularly monitor server security logs and firewall event logs for potential breaches of security. Contractor will regularly audit the security measures on all servers and network equipment and take appropriate measures to maintain the integrity and security of those systems.

3. IF any systems and/or applications are connected to the TTU network, they will be scanned for vulnerabilities on a weekly basis, per TTU IT’s Vulnerability Management Program. Contractor agrees to timely vulnerability assessment and mitigation and to be subject to other applicable TTU IT policies.

4. In accordance with Texas Government Code §2054.516, deliverables such as a website or mobile apps that process sensitive information, PII, or Confidential Information must have had a recent vulnerability scan and penetration test conducted (i.e., within the last two years.)

5. Data transfers must be done via an agreed-upon secure method of transmission approved by the TTU

Chief Information Security Officer or their designee.

VI. Geographic Location of TTU Data

Contractor will ensure that TTU Data, including backup copies, is stored only on servers and in data centers located within the borders of the continental United States; Contractor shall not store or transfer TTU Data outside of the continental United States.

VII. Username and Password Security

IF the product requires integration with any TTU enterprise systems (e.g., SSO), the Contractor must coordinate with the TTU Office of the CIO. When authenticating TTU users, Contractor may be required to integrate with TTU’s authentication system using a method approved by TTU. Under certain mutually agreed upon circumstances, Contractor may issue and manage usernames and passwords for TTU users. The passwords must use suitable hashing algorithms with salts applied and be at least as strong as the current standard used by TTU.

VIII. Breach of Security

Contractor and TTU share responsibility for being alert for breaches of security. Contractor shall notify TTU immediately of each instance of an actual or suspected (i) unauthorized access to or use of TTU data or (ii) unauthorized disclosure, misuse, alteration, destruction, or other compromise of TTU data. Contractor shall cooperate with any reasonable request of TTU in enforcing its rights. Both parties shall cooperate in the investigation of such breach, sharing all evidence and findings.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2054.htm#2054.516

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 4 of 24

IX. Destruction of Data

1. In the event of expiration or termination of the Agreement and at TTU’s discretion, all TTU data will be:

a. returned to TTU (and any copies remaining with Contractor will be destroyed and confirmation of the destruction shall be provided to TTU); OR

b. destroyed and confirmation of the destruction shall be provided to TTU.

2. If such information cannot be returned or destroyed due to statutory requirements, Contractor will continue to protect any TTU data retained after expiration or termination of the Agreement, in compliance with NIST Special Publications 800-53, OR another comparable cybersecurity standard.

3. TTU data includes all TTU information, TTU databases, TTU confidential information, any backup copies, and copies stored on external/third–party hosted storage.

X. eCommerce

For eCommerce purchases, a PCI SSC validated P2PE solution must be used unless an exception is granted in writing by the TTU Office of the CIO.

XI. Cybersecurity Training

1. In accordance with Texas Government Code §2054.5192, any Contractor with access to a state computer system or database (i.e., any person who has been given an account to access any state (or local) information system) must complete an annual cybersecurity training program provided by TTU.

2. For the purposes of this section, “Contractor” includes subcontractors, affiliates, officers, or employees of the Contractor.

XII. Accessibility

1. Accessibility is a State of Texas requirement for all electronic and information resources (“EIR”) procured by institutions of higher education. IF determined to be applicable by TTU, Contractor will address all required accessibility standards in 1 TAC §206, and 1 TAC §213 by providing accessibility documentation attesting to any EIR accessible features and capabilities.

a. Per 1 TAC §213, acceptable accessibility documentation includes a completed Voluntary Product Accessibility Template (“VPAT”) or Accessibility Compliance Report (“ACR”), vendor’s accessibility policy, accessibility testing documents, examples of prior accessible work results, and/or contractual warranties for accessibility.

b. TTU reserves the right to perform testing on the Contractor's deliverables to ensure the accuracy of their accessibility documentation regarding conformance with the 1 TAC §206/1 TAC §213 accessibility requirements.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2054.htm#2054.5192 https://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC?tac_view=5&ti=1&pt=10&ch=206&sch=C&rl=Y https://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC?tac_view=5&ti=1&pt=10&ch=213&sch=C&rl=Y

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 5 of 24

2. Per 1 TAC §213, accessibility testing, planning, and execution criteria shall be documented for the project and accessibility testing shall be performed by a third-party testing resource or knowledgeable institution of higher education staff member to validate compliance with 1 TAC §206.70 and 1 TAC §213 for any EIR project whose developments costs exceed $500,000 and that:

a. requires one year or longer to reach operations status;

b. involves more than one institution of higher education or state agency; or

c. substantially alters work methods of institution of higher education or agency personnel or the delivery of services to clients.

XIII. Indemnification

Contractor will indemnify and hold harmless TTU from and against all claims, actions and proceedings resulting from Contractor’s — including its subcontractor’s or affiliate’s—breach of any obligations under the Agreement or this Addendum, including but not limited to (i) (a) the cost of notification of affected persons, (b) third party credit monitoring services, (c) establishing and maintaining a call center in the event of a security breach, and (d) cost of an investigation (including computer forensic work) to access and/or mitigate the effects of a security breach; and (ii) TTU’s costs and reasonable attorney’s fees which arise as a result of Contractor’s breach of any of its obligations under the Agreement or this Addendum, or other failure to safeguard TTU data as provided for under law. Contractor shall indemnify TTU for all losses, damages, liabilities, judgments, penalties, fines, and expenses incurred by TTU in any such claim, action, or proceeding.

XIV. Audit Of Systems and Data

As stated in Texas Government Code §2054, TTU Information Resources are strategic assets of the State of Texas that must be managed as valuable state resources. TTU will accept either of the following two options as verification of Contractor’s security protocols used to protect TTU Information Resources:

A 2. Contractor may provide a recent compliance report or certification based on a current industry standard cybersecurity framework (e.g., ISO/IEC 27001:2013, SOC 2 Type II, SSAE16 SOC 1 Type II, ISAE 3402 Type II, HECVAT, or equivalent).

OR

B 2. With advance notice and coordination, TTU reserves the right to conduct a security assessment on Contractor’s system that stores TTU data. If TTU’s assessment finding is that the confidentiality, security, and/or integrity of TTU data is insecure, TTU will notify Contractor in writing of the deficiencies identified in the assessment and Contractor will utilize prevailing industry recognized security controls and best practices to correct such deficiencies within thirty (30) days or within a mutually agreed-upon timeframe following such written notice. Contractor’s failure to correct

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 6 of 24 the deficiencies within the thirty-day or mutually agreed-upon timeframe is a material breach of this Agreement.

XV. Use Of Artificial Intelligence (AI)

Contractor hereby represents and warrants that:

1. Artificial Intelligence (“AI”) includes machine learning, natural language processing (“NLP”), robotic process automation (“RPA”), computer vision, robotics, expert systems, or any other forms of AI.

2. Contractor will promptly provide TTU written disclosure of any current or contemplated use of AI throughout the course of the Agreement with the parties.

3. Contractor will cooperate with TTU to ensure the provision, use, and storage of TTU data complies with all laws and regulations, including those pertaining to data privacy and security.

4. Contractor will not use TTU data and any AI output resulting from TTU data for any other purpose than to fulfill Contractor’s obligations under this Agreement.

5. While any information obtained from and related to TTU, including any derivative data, is in the possession or control of Contractor, Contractor will implement and maintain physical, administrative, and technical safeguards to protect the information from inadvertent or unauthorized access, disclosure, use, or modification, taking into the account the sensitivity and confidentiality of such information.

Contractor further warrants and represents that it has and will continue to comply with all applicable data protection laws and regulations with respect to the AI system and any data that is collected or processed.

6. Contractor maintains, and shall continue to maintain security safeguards and controls in compliance with

NIST Special Publications 800-53, or another comparable cybersecurity standard, including proper access controls for the AI.

7. To the best of Contractor’s knowledge, there has been no unauthorized use of or access to AI and no AI has been used in violation of any applicable laws and regulations.

8. Contractor’s current or contemplated use of the AI does not, and will not, infringe upon or violate any intellectual property rights, rights of likeness or publicity, or any other third-party right of any kind.

9. Contractor maintains and shall continue to maintain commercially reasonable insurance coverage for claims or losses pertaining to the AI.

10. Contractor warrants that the AI has not been subject to any claims, suits, demands, rulings, judgements, threats, fines, penalties, or a cease-and-desist letter asserted against, or brought by, Contractor pertaining to intellectual property or any other rights violation or breach of any applicable law, rule, or regulation.

XVI. GDPR Addendum

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 7 of 24

For purposes of this section, the terms:

1. “personal data”, “personal data breach”, and “process” have the meanings given to them under the

GDPR, and

2. “Contractor” has the same meaning as “Service Provider” and includes subcontractors, affiliates, officers, or employees of the Contractor.

To the extent applicable, Contractor agrees to comply with the EU General Data Protection Regulation or any successor to that regulation (“GDPR”). Specifically, Contractor agrees to:

1. only process TTU data in accordance with TTU’s lawful, documented instructions;

2. only allow third parties to process TTU data where the third party is bound by a contractual or statutory obligation of confidentiality;

3. ensure there are appropriate technical and organizational measures to protect TTU personal data against personal data breaches;

4. let TTU know immediately and without delay if Contractor detects that a personal data breach has occurred and, where requested, assist TTU to communicate with individuals who are impacted by the data breach;

5. not appoint a third party to process TTU data on Contractor’s behalf without advising TTU that

Contractor is doing so and TTU has not objected;

6. ensure any third party appointed to process data on Contractor’s behalf adheres to terms that are at least as protective as these terms and Contractor will remain responsible for all acts and omissions of such third party;

7. assist TTU to respond to individuals’ exercise of their data subject rights to the extent related to TTU personal data which Contractor processes;

8. promptly TTU if Contractor reasonably believes its processing of TTU data is likely to result in a high risk to the data protection rights and freedoms of individuals, and assist TTU in carrying out a data protection impact assessment and consulting with TTU’s relevant data protection authority;

9. if TTU requests, share with TTU records that relate to the TTU personal data Contractor processes and any independent third-party assessments or audit reports that assess Contractor’s technical and organizational measures designed to protect TTU personal data;

10. if TTU requests, complete and return TTU’s data privacy and security questionnaire to TTU;

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 8 of 24

11. not process TTU personal data any longer than necessary in order to provide Contractor’s services to TTU or to comply with a lawfully documented instruction TTU has given Contractor; and

12. when finished providing services to TTU, (at TTU’s election) return or destroy data and confirmation of the destruction be provided to TTU unless Contractor needs to retain the data to comply with an applicable law.

Right To Withdraw

Unless otherwise noted in the Agreement or additionally agreed upon in writing by both parties, TTU reserves the right to review and approve any data security changes that affect the terms and/or the services provided through the Agreement. TTU reserves the right to withdraw from the Agreement without penalty should those changes not be acceptable to TTU.

Compliance with Texas Government Code §2054.0593 (TX-RAMP)

Pursuant to Texas Government Code §2054.0593, relating to the Texas Department of Information Resource’s State Risk and Authorization Management Program (“Program”), Contractor represents and warrants that it complies with the requirements of the Program and Contractor agrees that throughout the term of the Agreement it shall maintain the required certifications and comply with the Program requirements in the performance of the Agreement. If the Contractor fails to maintain the requirements of the Program, TTU has the right to terminate the Agreement immediately without any further cause.

This Addendum contains or has attached hereto all revised terms and conditions agreed upon by contracting parties.

IN WITNESS THEREOF, this Addendum is signed and entered into on the date indicated below:

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2054.htm#2054.0593

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 9 of 24

ADDENDUM

To ______

TTUS and ________

This Addendum, effective the date of last signature (the “Effective Date”), is incorporated into and forms a part of the attached _______’s ________ (“Contractor Terms”). Together these documents form the “Contract.” “TTUS” means Texas Tech University System, an agency of the State of Texas and a system of higher education; “TTU” means Texas Tech University, an agency of the State of Texas, a component institution of TTUS, and an institution of higher education; and "Contractor" means _________. In addition, and to the extent they do not conflict with the terms in this Addendum, the TTUS purchase order terms and conditions will apply to all purchases of goods and services by TTUS and are incorporated by reference into this Addendum. They are found at https://www.depts.ttu.edu/procurement/FormRepository/Purchase-Order-terms-and-conditions.pdf.

Notwithstanding any express provision stating that the terms of the Contractor Terms will control in the event of conflict, Contractor’s signature to this Addendum acknowledges that the Addendum is controlling in the event of a conflict of terms in the Contract.

1. Representations and Warranties by Contractor. Contractor represents and warrants it is duly organized, validly existing, and in good standing under the laws of the state of its incorporation or organization and is duly authorized and in good standing to conduct business in the State of Texas, that it has all necessary approvals to execute the Contract, and the individual executing the Contract on behalf of Contractor has been duly authorized to act for and bind Contractor.

2. Additional fees. Any reference to payment or reimbursement of additional, future, or undefined Contractor fees in the Contract (e.g. travel expenses) is agreed to only if approved by TTUS in writing prior to invoicing.

3. Tax Certification. If Contractor is a taxable entity as defined by Chapter 171, Texas Tax Code (“Chapter 171”), then Contractor certifies that it is not currently delinquent in the payment of any taxes due under Chapter 171, or that Contractor is exempt from the https://www.depts.ttu.edu/procurement/FormRepository/Purchase-Order-terms-and-conditions.pdf https://www.depts.ttu.edu/procurement/FormRepository/Purchase-Order-terms-and-conditions.pdf

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 10 of 24 payment of those taxes, or that Contractor is an out-of-state taxable entity that is not subject to those taxes, whichever is applicable.

4. Tax exempt. TTUS is exempt from Texas Sales & Use Tax on goods and services in accordance with §151.309, Texas Tax Code, and Title 34 Texas Administrative Code

(“TAC”) §3.322.

5. Payments. So long as Contractor has provided TTUS with its current and accurate Federal Tax Identification Number in writing, TTUS will pay Contractor for goods and services in accordance with Chapter 2251, Texas Government Code.

6. Loss of Funding. Performance by TTUS under the Contract may be dependent upon the appropriation of funds by the Texas State Legislature, the federal government, or any granting agencies, and/or allocation of funds by the Board of Regents of the Texas Tech University System (“TTUS Regents”). If the Texas State Legislature, federal government, or any granting agencies fails to appropriate the necessary funds, or the TTUS Regents fail to allocate the necessary funds, then TTU will issue written notice to Contractor, and TTUS may terminate this Contract without further duty or obligation hereunder, other than payment for goods and services already delivered or provided to TTUS. Contractor acknowledges that appropriation, allotment, and allocation of funds are beyond the control of TTUS.

7. Payment of Debt or Delinquency to the State. Pursuant to §§2107.008 and 2252.903, Texas Government Code, Contractor agrees that any payments owing to Contractor under the Contract may be applied directly toward any debt or delinquency that Contractor owes the State of Texas or any agency of the State of Texas regardless of when it arises, until such debt or delinquency is paid in full.

8. Texas Family Code Child Support Certification. Pursuant to §231.006, Texas Family Code, Contractor certifies that it is not ineligible to receive the awarded Contract or payments under the Contract and acknowledges that the Contract may be terminated and payment withheld if this certification is inaccurate.

9. Early Termination. TTUS may terminate the Contract for any reason by providing Contractor with ten (10) days prior, written notice. Despite anything in the Contractor

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 11 of 24

Terms to the contrary, in no event will termination give rise to any liability on TTUS’ part including, but not limited to, Contractor’s claims for compensation for anticipated profits, unabsorbed overhead, or interest on borrowing. TTUS’ sole obligation hereunder is to pay Contractor for goods and services received prior to the date of termination.

10. Texas Public Information Act. All information, documentation, and other material submitted by Contractor for and under this Contract are subject to public disclosure under the Texas Public Information Act (Texas Government Code, Chapter 552).

Contractor is hereby notified that TTUS strictly adheres to this statute and the interpretations thereof rendered by the Courts and the Texas Attorney General (“AG”).

TTUS will use its best efforts to maintain the confidentiality of all Contractor submitted information except where TTUS is required to disclose it under the Act. The AG will ultimately decide whether Contractor proprietary information is released to the public, however TTUS will give Contractor notice of all requests for its proprietary information in accordance with the Act. TTUS cannot represent Contractor interests to the AG and Contractor seeking to protect their proprietary information will be required to submit a letter, brief, or memorandum to the AG with reasons in support of withholding their information.

11. Publicity and Marks. Contractor agrees that it will not publicize this Contract or disclose, confirm, or deny any details of this Contract to third parties. The Contractor shall not use TTUS’ name or protected identity marks, including but not limited to wordmark, logos, seals, imagery, and insignia (collectively, “Marks”) without TTUS’ prior express written approval from TTUS or any component institution if applicable.

The approved use of any Marks shall cease upon termination of the Contract or upon written notification by TTUS. The Contractor shall not use TTUS’ Marks to represent any type of relationship between TTUS and the Contractor or that TTUS endorses the Contractor unless formally approved in writing. The use of all identity marks shall be governed by each component institution’s identity guidelines policy, which may be updated from time to time.

12. Notices. All notices, consents, approvals, demands, requests, or other communications provided for or permitted to be given under any of the provisions of the Contract to TTUS will be in writing and will be sent via registered or certified mail, overnight courier, or email, and notice will be deemed given (i) if mailed, when deposited, postage prepaid, in the United States mail, (ii) if sent by overnight courier, one (1) business day after delivery to the courier, (iii) if sent by email, when received:

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 12 of 24

Contract Management Procurement Services

Texas Tech Plaza

1901 University Avenue

Suite 408

Lubbock, Texas 79410 contracting@ttu.edu or such other person or address as may be given in writing by TTUS to Contractor.

Notwithstanding any other requirements for notices given by a party under the Contract, if Contractor intends to deliver written notice to TTUS pursuant to §2251.054, Texas Government Code, then Contractor will send that notice to TTUS as follows:

Contract Management Procurement Services

PO Box 41094

Lubbock, Texas 79409

13. Venue; Governing Law. Lubbock County, Texas, will be the proper place of venue for any legal action or proceeding arising out of this Contract or enforcement of any provision in this Contract. This Contract and all of the rights and obligations of the parties hereto and any claims arising from this Contract will be construed, interpreted, and governed by the laws of the State of Texas.

14. Limitation on TTUS’ Liability. It is understood and agreed that TTUS will not be liable for any negligent or wrongful acts, either of commission or omission, chargeable to it unless such liability is imposed by Texas law and that this Contract will not be construed as seeking to either enlarge or diminish any obligation or duty owed by TTUS to Contractor or to any third party.

mailto:contracting@ttu.edu

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 13 of 24

15. Indemnification. The Contractor agrees to indemnify, defend, and hold harmless Texas Tech University System, its component institutions, and its respective affiliated enterprises, regents, officers, directors, attorneys, employees, representatives, and agents, against any and all liability, claims, suits, losses, costs, and legal fees caused by, arising out of, or resulting from any negligent act or omission of the Contractor in the performance or failure to perform within the Contract including the negligent acts or omission of any Subcontractor or any direct or indirect employees of the Contractor or Subcontractors. The indemnification obligations set forth in the Contract will survive termination or expiration of the Contract.

16. Force Majeure. “Event of Force Majeure” means an event beyond the control of Contractor or TTUS which prevents or makes a party’s compliance with any of its obligations under the Contract illegal or impracticable, including but not limited to: act of God (including, without limitation, fire, explosion, earthquake, tornado, drought, and flood); war, act or threats of terrorism, hostilities (whether or not war be declared), invasion, act of enemies, mobilization, requisition, or embargo; rebellion, insurrection, military or usurped power, or civil war; contamination or destruction from any nuclear, chemical, or biological event; riot, commotion, strikes, go slows, lock outs, or disorder;

epidemic, pandemic, viral outbreak, or health crisis; or directive of governmental authority. No party will be considered in breach of the Contract to the extent that performance of their respective obligations is prevented or made illegal or impracticable by an Event of Force Majeure that arises during the term (or after execution of the Contract but prior to the beginning of the term). A party asserting an Event of Force Majeure hereunder (“Affected Party”) will give reasonable notice to the other party of an Event of Force Majeure upon it being foreseen by, or becoming known to, Affected Party. In the event of an Event of Force Majeure, Affected Party will endeavor to continue to perform its obligations under the Contract only so far as reasonably practicable.

17. Insurance. Contractor agrees that TTUS may self-fund against general liability risk and that any Contractor requirements for TTUS to carry insurance are waived. The Texas Tort Claims Act governs relief with respect to property damage, personal injury, and death proximately caused by the wrongful act or omission of a TTUS employee acting within the scope of employment.

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 14 of 24

18. Breach of Contract Claims. The dispute resolution process provided for in Texas Government Code Chapter 2260 and the related rules adopted by the Texas Attorney General pursuant to Chapter 2260 will be used by TTUS and Contractor to attempt to resolve any claim for breach of contract made by Contractor that cannot be resolved in the ordinary course of business. The Assistant Vice President and Chief Procurement Officer of TTUS will examine Contractor's claim and any counterclaim and negotiate with Contractor in an effort to resolve such claims. The parties specifically agree that (i) neither the execution of the Contract by TTUS nor any other conduct, action, or inaction of any representative of TTUS relating to the Contract constitutes or is intended to constitute a waiver of TTUS’ or the state's sovereign immunity to suit; and (ii) TTUS has not waived its right to seek redress in the courts. Any term or provision in the Contractor Terms indicating agreement to arbitration, other alternative dispute resolution, or litigation options in the event of a dispute between the parties is expressly rejected and is null and void.

19. Assignment. Neither this Contract, nor any rights or obligations of monies due hereunder are assignable or transferable (as security for advances or otherwise) unless TTUS agrees in writing. Contractor will not assign or sub award any portion of a Contract without TTUS' prior written approval, which will not be unreasonably withheld. TTUS will not recognize any assignment or sub agreement made without TTUS' prior written approval, and any such assignment by Contractor will be wholly void and ineffective for all purposes unless made in conformity with this section.

20. Entire Contract; Modifications. The Contract supersedes all prior agreements, written or oral, between Contractor and TTUS and will constitute the entire Contract and understanding between the parties with respect to the subject matter hereof. The Contract and each of its provisions will be binding upon the parties and may not be waived, modified, amended, or altered except in writing signed by TTUS and Contractor.

21. FERPA. IF given access to the personally identifiable information about any student during performance of any services, Contractor agrees to abide by the limitations on re-disclosure of personally identifiable information from student records as set forth in The Family Educational Rights and Privacy Act (“FERPA”) 34 CFR, §99.3. Contractor agrees that it may create, receive from or on behalf of TTUS, or have access to, records or record systems that are subject to FERPA (collectively, the "FERPA Records"). To the extent that Contractor has access to “education records” under the Contract, it is deemed a “school official,” as each of these terms are defined under FERPA. Contractor

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 15 of 24 represents, warrants, and agrees that it will: (1) hold the FERPA Records in strict confidence and will not use or disclose the FERPA Records except as (a) permitted or required by this Contract, (b) required by law, or (c) otherwise authorized by TTUS in writing; (2) safeguard the FERPA Records according to commercially reasonable administrative, physical, and technical standards that are no less rigorous than the standards by which Contractor protects its own confidential information; and (3) continually monitor its operations and take any action necessary to assure that the FERPA Records are safeguarded in accordance with the terms of this Contract. At the request of TTUS, Contractor agrees to provide TTUS with a written summary of the procedures Contractor uses to safeguard the FERPA Records. Contractor will indemnify and hold harmless TTUS from and against all claims, actions, and proceedings resulting from Contractor’s or its subcontractor’s or affiliate’s breach of any obligations under this paragraph.

22. Required Posting. Contractor acknowledges and agrees that TTUS is required to post certain contracts and documents relating to contract solicitations under Texas Government Code §§2054.067 and 2261.253.

23. Audit. Contractor understands that acceptance of funds under the Contract constitutes acceptance of the authority of the Texas State Auditor's Office, or any successor agency, TTUS, or any of its components (collectively, “Auditor”), to conduct an audit or investigation in connection with those funds pursuant to §51.9335(c), Texas Education Code. Contractor agrees to cooperate with the Auditor in the conduct of the audit or investigation, including without limitation providing all records requested. Further, TTUS has the right, at TTUS’ sole cost, to audit Contractor’s financial records pertaining to the Contract for the preceding twelve (12) month period either using TTUS’ personnel or an independent third party. TTUS will complete such audit at Contractor’s office, on reasonable advance notice, and on dates and times mutually agreed to by the parties. If the audit reveals Contractor owes TTUS money, Contractor will pay the amount due within thirty (30) days of the date TTUS notifies Contractor of the audit results. If the audit reveals TTUS owes Contractor money, TTUS will pay Contractor within thirty (30) days of the date the audit is complete.

23.1 Audit of Systems and Data. As stated in Texas Government Code §2054, TTUS Information Resources are strategic assets of the State of Texas that must be managed as valuable state resources. TTUS will accept either of the following two options as verification of Contractor’s security protocols used to protect TTUS Information Resources:

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 16 of 24

Option 1. Contractor may provide a recent compliance report or certification based on a current industry standard cybersecurity framework (e.g., ISO/IEC 27001:2013, SOC 2 Type II, SSAE16 SOC 1 Type II, ISAE 3402 Type II, HECVAT, or equivalent).

Option 2. With advance notice and coordination, TTUS reserves the right to conduct a security assessment on Contractor’s system that stores TTUS data. If TTUS’ assessment finding is that the confidentiality, security, and/or integrity of TTUS data is insecure, TTUS will notify Contractor in writing of the deficiencies identified in the assessment and Contractor will utilize prevailing industry recognized security controls and best practices to correct such deficiencies within thirty (30) days or within a mutually agreed-upon timeframe following such written notice. Contractor’s failure to correct the deficiencies within the thirty-day or mutually agreed-upon timeframe is a material breach of this Contract.

24. Independent Contractor. Contractor agrees that it is an independent contractor and that this Contract does not form a joint venture or partnership. TTUS will not be responsible for the Federal Insurance Contribution Act (“FICA”) payments, federal or state unemployment taxes, income tax withholding, Workers Compensation Insurance payments, or any other insurance payments, nor will TTUS furnish any medical or retirement benefits or any paid vacation or sick leave. Contractor is responsible for conduct of business operations, including employee salaries, travel, etc.

25. Not Exclusive. Contractor acknowledges and agrees that the Contract with TTUS is non-exclusive and TTUS has the right to engage with other contractors for similar or identical scopes of work, and to purchase similar or identical goods or services from other contractors. Any term or provision in the Contractor Terms indicating the Contract is exclusive is expressly rejected and is null and void.

26. Contract Amendments. No modification or amendment to this Contract will become valid unless agreed to by TTUS in writing and signed by both parties. All correspondence regarding modifications or amendments to the Contract must be forwarded to the TTU Office of Procurement Services for prior review and approval.

https://library.educause.edu/resources/2020/4/higher-education-community-vendor-assessment-toolkit

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 17 of 24

Only the Assistant Vice President and Chief Procurement Officer or his/her designee will be authorized to process changes or amendments. All amendments must be signed by the same person who signed this original Contract or their successor(s).

27. Limitations. THE PARTIES ARE AWARE THAT THERE MAY BE

CONSTITUTIONAL AND STATUTORY LIMITATIONS ON THE AUTHORITY

OF TTUS TO ENTER INTO CERTAIN TERMS AND CONDITIONS,

INCLUDING TERMS AND CONDITIONS (IF ANY) RELATING TO LIENS ON

TTUS’ PROPERTY; DISCLAIMERS AND LIMITATIONS OF WARRANTIES;

DISCLAIMERS AND LIMITATIONS OF LIABILITY FOR DAMAGES; WAIVERS,

DISCLAIMERS AND LIMITATIONS OF TTUS’ LEGAL RIGHTS, REMEDIES,

REQUIREMENTS, AND PROCESSES; LIMITATIONS OF PERIODS TO BRING

LEGAL ACTION; GRANTING CONTROL OF LITIGATION OR SETTLEMENT

TO ANOTHER PARTY; LIABILITY FOR ACTS OR OMISSIONS OF THIRD

PARTIES; PAYMENT OF ATTORNEYS’ FEES; DISPUTE RESOLUTION;

INDEMNITIES; ANY PROVISION THAT CREATES AN UNKNOWN OR

UNFUNDED LIABILITY; AND CONFIDENTIALITY (COLLECTIVELY, THE

“LIMITATIONS”), AND TERMS AND CONDITIONS RELATED TO THE

LIMITATIONS WILL NOT BE BINDING ON TTUS EXCEPT TO THE EXTENT

AUTHORIZED BY THE LAWS AND CONSTITUTION OF THE STATE OF

TEXAS.

28. Contractor Certification. Contractor certifies this Contract is not prohibited under Texas Government Code §2261.252(b) and agrees that if Contractor’s certification is or becomes untrue, this Contract is void, and Contractor will not seek and waives its right to seek any legal or equitable remedy for past or future performance under this Contract, including damages, whether under breach of contract, unjust enrichment, or any other legal theory; specific performance; and injunctive relief.

29. No Boycott. If this Contract has a value of $100,000 or more that is to be paid wholly or partly from public funds of TTUS, and if Contractor is a company, other than a sole proprietorship, with ten (10) or more full-time employees, then pursuant to Texas Government Code Chapter 2271, Contractor affirmatively states that it does not boycott Israel and will not boycott Israel during the term of this Contract. In this paragraph, the terms “company” and “boycott Israel” shall have the meanings described in Texas Government Code §808.001.

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 18 of 24

30. American Steel. To the extent the Contract awarded relates to a project as defined Texas Government Code §2252.201(5) (a project to construct, remodel, or alter a building, structure, or infrastructure; to supply material for such a project; or to finance, refinance, or provide funds for such a project), and no exemption in Texas Government Code §2252.203 applies, any iron or steel product produced through a manufacturing process and used in the project that is the subject of the Contract must be produced in the United States (as defined in Texas Government Code §2252.201(4).

31. Trafficking of Persons. Under §2155.0061, Texas Government Code, the Contractor certifies that the individual or business entity named in the bid or Contract is not ineligible to receive the specified Contract and acknowledges that the Contract may be terminated and payment withheld if this certification is inaccurate.

32. Emergency Health and Safety Procedures. In the event of pandemic, epidemic, viral outbreak, health crisis, or other emergency (“Emergency”), TTUS may, at its sole discretion, implement new or modified health and safety procedures in order to protect the health and safety of the TTUS community. In the event of Emergency, Contractor agrees to adhere to all such procedures and related directives from TTUS when entering onto and performing services on TTUS’ campuses.

33. Texas Health and Safety Code. The Contractor affirmatively states that it will comply with the requirements of Texas Health and Safety Code, § 161.0085(c).

34. Compliance with Texas Government Code §2274.002. If this Contract has a value of $100,000 or more to be paid wholly or partly from public funds of TTUS, and if Contractor is a company, other than a sole proprietorship, with ten (10) or more full-time employees, then pursuant to Texas Government Code §2274.002, Contractor affirmatively states it does not boycott energy companies and will not boycott energy companies during the term of this Contract. In this paragraph, the terms “company” and “boycott energy companies” shall have the meanings described in Texas Government Code §809.001.

Contractor verifies it (1) does not have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association; and (2) will not discriminate during the term of the Contract against a firearm entity or trade association.

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 19 of 24

35. Executive Order No GA—48. Pursuant to Executive Order No GA—48, Contractor certifies that it, and, if applicable, its holding companies or subsidiaries, are not:

• Listed in Section 889 of the 2019 National Defense Authorization Act (NDAA);

or

• Listed in Section 1260H of the 2021 NDAA; or

• Owned by the government of a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4; or

• Controlled by any governing or regulatory body located in a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4.

36. Applicable Laws & Regulations. Contractor agrees that it will comply with all federal, state, or local laws or regulations applicable to Contractor’s performance under the Contract, and agrees to obtain and maintain all permits, licenses and other approvals required in connection with the operations contemplated under the Contract. Contractor also agrees that pursuant to Texas Education Code §51.9335(h), in any Contract for the acquisition of goods or services to which TTUS is a party, any provision required by applicable law to be included in the Contract is considered to be part of the Contract whether or not the provision appears on the face of the Contract or if the Contract contains any provision to the contrary.

37. Destruction of Data.

1. In the event of expiration or termination of the Contract and at TTUS’ discretion, all TTUS data will be:

a. returned to TTUS (and any copies remaining with Contractor will be destroyed and confirmation of the destruction shall be provided to TTUS);

b. destroyed and confirmation of the destruction shall be provided to TTUS.

RFP 2025-1124 Textbook, Course Material, and Merchandise Operations Exhibit A Page 20 of 24

2. If such information cannot be returned or destroyed due to statutory requirements, Contractor will continue to protect any TTUS data retained after expiration or termination of the Contract, in compliance with NIST Special Publications 800-53, OR another comparable cybersecurity standard.

3. TTUS data includes all TTUS information, TTUS databases, TTUS confidential information, any backup copies, and copies stored on external/third–party hosted storage.

38. Uptime. In consideration of TTUS’ payment of the fees under this Contract, Contractor will use commercially reasonable efforts to make its solution available, at least, 99.99% of the time, except for scheduled maintenance (performed outside normal business hours to the extent possible) and unscheduled maintenance required for repairs and events beyond Contractor’s reasonable control.

39. Accessibility.

1. Accessibility is a State of Texas requirement for all electronic and information resources (“EIR”) procured by institutions of higher education. IF determined to be applicable by TTUS, Contractor will address all required accessibility standards in 1 TAC §206, and 1 TAC §213 by providing accessibility documentation attesting to any EIR accessible features and capabilities.

a. Per 1 TAC §213, acceptable accessibility documentation include(s) a completed Voluntary Product Accessibility Template (“VPAT”) or Accessibility Compliance Report (“ACR”), vendor’s accessibility policy, accessibility testing documents, examples of prior accessible work results, and/or contractual warranties for accessibility.

b. TTUS reserves the right to perform testing on the Contractor's deliverables to ensure the accuracy of their accessibility documentation regarding…