ESBD_513148_1778762904931_03 Exhibit B - TxDMV Contract Uniform Terms and Conditions (Version 2.1).pdf

TxDMV Contract No.

TxDMV Contract Uniform Terms and Conditions with Affirmations (Version 2.1) Page 1 of 51 Published and Effective: September 16, 2025

Responsible Division: Office of General Counsel

Contract Uniform Terms and Conditions with Affirmations

Exhibit B

TABLE OF CONTENTS

ARTICLE 1, DEFINITIONS AND INTERPRETIVE PROVISIONS

1.1 Definitions

1.2 Interpretive Provisions

ARTICLE 2, CONSIDERATION, PAYMENT, AND FUNDING PROVISIONS

2.1 Prompt Payment

2.2 Submission of Invoices

2.3 Ancillary and Travel Expenses

2.4 No Quantity Guarantees

2.5 Debts and Delinquencies

2.6 Refunds and Overpayments

2.7 Taxes

2.8 Excess Obligations Prohibited

2.9 No Debt Against the State

ARTICLE 3, CONFIDENTIAL INFORMATION AND SECURITY PROVISIONS

3.1 Confidentiality and Security Requirements

3.2 Confidential Information Storage

3.3 Access to Internal Agency Network and Systems

3.4 Cybersecurity Training

ARTICLE 4, INTELLECTUAL PROPERTY PROVISIONS

4.1 Property Rights / Ownership of Work Product

4.2 Contractor’s Pre-Existing Works

4.3 Third-Party Intellectual Property

4.4 Agreements with Employees and Subcontractors

4.5 Delivery Upon Contract Termination or Expiration

4.6 Trademark Ownership

4.7 Data Ownership, Use, and Return

ARTICLE 5, RECORDS AND AUDIT PROVISIONS

5.1 Books and Records Retention

5.2 Agency’s Right to Audit and Inspect

5.3 Texas State Auditor’s Right to Audit

5.4 Response and Compliance with Audit or Inspection Findings

5.5 Public Information Act

5.6 Data Management and Security Controls

ARTICLE 6, CONTRACT MANAGEMENT AND ENFORCEMENT PROVISIONS

6.1 Contract Management and Remedies

6.2 Inspection and Testing of Deliverables

6.3 Termination for Convenience

6.4 Termination for Cause

6.5 Excluded Parties

6.6 Contractor’s Responsibility for Associated Costs

6.7 Liquidated Damages

6.8 Cumulative Remedies

ARTICLE 7, CONTRACT REPRESENTATIVES AND NOTIFICATION PROVISIONS .. 26

7.1 Contract Representatives

7.2 Notices

ARTICLE 8, WARRANTIES, AFFIRMATIONS, AND ASSURANCES PROVISIONS

8.1 Warranty

8.2 Software Warranty

8.3 Third-Party Warranties

8.4 Affirmations

8.5 Parties to the Affirmations

8.6 Federal Assurances and Certifications

ARTICLE 9, INDEMNIFICATION PROVISIONS

9.1 INDEMNIFICATION (GENERAL)

9.2 INDEMNIFICATION (INTELLECTUAL PROPERTY)

9.3 NO AGENCY INDEMNIFICATION

ARTICLE 10, CONTRACTOR AND SUBCONTRACTOR PROVISIONS

10.1 Independent Contractor

10.2 Contractor’s Personnel

10.3 Replacement of Contractor’s Personnel at Agency’s Request

10.4 Contractor’s Subcontractors and Subcontracts

10.5 Criminal History Background Checks

ARTICLE 11, INSURANCE REQUIREMENTS PROVISIONS

11.1 Insurance

ARTICLE 12, STATE PROPERTY PROVISIONS

12.1 Use of State Government Property

12.2 Damage to State Government Property

12.3 State Property Rights upon Termination or Expiration of the Contract

ARTICLE 13, WORK ORDER PROVISIONS

13.1 Work Orders

13.2 Proposals

13.3 Contract Termination or Expiration

ARTICLE 14, TECHNOLOGY PROJECT PROVISIONS

14.1 Technology Access / Accessibility Requirements

14.2 Artificial Intelligence Disclosure and Requirements

14.3 Cloud Computing State Risk and Authorization Management Program (TX-RAMP) ..34

14.4 Computer Equipment Recycling Program

14.5 Contractor’s Compliance Verification

14.6 Evaluation, Testing, and Monitoring

14.7 Information Management Standards

14.8 No Surreptitious Code Warranty

14.9 Remedies

14.10 Secure Erasure of Hard Disk Capability

14.11 Shrink-Wrap, Click-Wrap, and Browser-Wrap Agreements

14.12 Software Security Configuration

14.13 Technical Representations and Warranties

ARTICLE 15, MISCELLANEOUS AFFIRMATIONS PROVISIONS

15.1 Abortion Provider and Affiliate Transactions Prohibited

15.2 Americans with Disabilities Act

15.3 Antitrust

15.4 Buy Texas (Service Contracts)

15.5 Child Support Obligation

15.6 Contracting Information Responsibilities ($1 Million or Greater in Public Funds)

15.7 COVID-19 Vaccine Passports Prohibition

15.8 Critical Infrastructure

15.9 Dealings with Public Servants

15.10 Disaster Recovery Plan

15.11 Disclosure of Interested Parties

15.12 Disclosure of Prior State Employment (Consulting Services)

15.13 Entities that Boycott Energy Companies

15.14 Entities that Boycott Israel

15.15 Entities that Discriminate Against Firearm and Ammunition Industries

15.16 Executive Head of a State Agency

15.17 False Statements

15.18 Federal Occupational Safety and Health Law

15.19 Financial Participation Prohibited

15.20 Foreign Terrorist Organizations

15.21 Former Agency Employees (Certain Contracts)

15.22 Fraud, Waste, and Abuse

15.23 Hardening of State Government

15.24 Human Trafficking Prohibition

15.25 Immigration

15.26 Legal and Regulatory Actions

15.27 Lobbying Prohibition

15.28 No Conflicts of Interest

15.29 No Felony Criminal Convictions

15.30 Permits, Certifications, and License

15.31 Prior Disaster Relief Contract Violation

15.32 Public Nature of Response and Posting of Certain Contracts on Websites

15.33 Restricted Employment for Certain State Personnel

15.34 Signature Authority

15.35 Surveillance, Intimidation, and Related Acts

15.36 Suspension and Debarment

15.37 Television Equipment Recycling Program

15.38 Unfair Business Practices

ARTICLE 16, MISCELLANEOUS PROVISIONS

16.1 Amendment

16.2 Assignments and Acquisitions

16.3 Binding Effect

16.4 Change in Law and Compliance with Laws

16.5 Equal Employment Opportunity

16.6 Conflict with Applicable Law or Regulation

16.7 Consulting Reports

16.8 Counterparts

16.9 Critical Infrastructure Subcontracts

16.10 Dispute Resolution and Escalation Procedure

16.11 Electrical Items

16.12 E-Verify Program

16.13 Force Majeure

16.14 Governing Law and Venue

16.15 Legal Obligations

16.16 Limitation on Authority; Other Obligations

16.17 Media Releases and Marketing Activities

16.18 National Anthem

16.19 No Implied Waiver

16.20 No Third-Party Beneficiaries

16.21 Partially Completed Work

16.22 Permits, Certifications, and Licenses

16.23 Prohibition on Non-Compete Restrictions

16.24 Rolling Estoppel

16.25 Severability

16.26 Sovereign Immunity

16.27 Survival

16.28 Technical Guidance Letters

ARTICLE 1, DEFINITIONS AND INTERPRETIVE PROVISIONS

1.1 Definitions

As used in the Contract and any Attachments incorporated and made part of the Contract, the following terms and acronyms have the meaning set forth below, unless the context clearly indicates otherwise; all other terms have their ordinary meanings:

“Amendment” means a written document that formally records modifications or changes to the

Contract, except for those changes that are expressly permitted by Work Orders or Technical

Guidance Letters, as herein defined.

“Attachment” means the documents, terms, conditions, or other information appended to the

Contract or incorporated by reference, which are considered an integral part of the Contract for all purposes.

“Contract” means the legally enforceable written agreement between TxDMV and Contractor, which includes the Signature Document (if applicable); the Purchase Order; these Contract

Uniform Terms and Conditions with Affirmations; Attachments; Amendments; Exhibits; Purchase

Order change notices; Work Orders; and Technical Guidance Letters that may be issued by

TxDMV, and incorporated into and made part of the Contract for all purposes. TxDMV, in its sole and absolute discretion, may issue a Signature Document and/or Purchase Order. See, Signature

Document and Purchase Order definitions below.

“Contractor” means the vendor selected by TxDMV to provide the Deliverables to TxDMV under the Contract.

“Deliverable” means a good, product, or Service, including all reports and Contract documentation, required to be prepared, developed, performed, supported, provided, or procured by Contractor under the Contract. May also be referred to in its plural form as “Deliverables.”

“Effective Date” means the date agreed to by the Parties as the date on which the Contract takes effect.

“Federal Fiscal Year” means the annual accounting period for the United States government from

October 1st through September 30th of each year.

“GAAP” means the Generally Accepted Accounting Principles, a set of accounting rules and standards that companies use to prepare and report their financial statements established by the

U.S. Securities and Exchange Commission and the default accounting standard for companies in the United States.

“GASB” means the Governmental Accounting Standards Board, a private, non-governmental organization, and the source of generally accepted accounting principles used by state and local governments in the United States.

“HUB” means a Historically Underutilized Business, as defined by Chapter 2161 of the Texas

Government Code.

“Intellectual Property” means the worldwide proprietary rights or interests, including patent, copyright, trade secret, trademark rights, branding, or other indicia of source or origin, as such rights may be evidenced by or embodied in:

i. any idea, design, concept, personality right, method, process, technique, apparatus, invention, discovery, or improvement;

ii. any work of authorship, including any compilation, computer code, website or web page design, literary work, pictorial work, or graphic work;

iii. domain name registrations; and

iv. any other proprietary or similar rights.

The Intellectual Property Rights of a Party include all worldwide proprietary rights or interests that the Party may have acquired by assignment, by exclusive license, or by license with the right to grant sublicenses.

“MVCPA” means the Motor Vehicle Crime Prevention Authority, a division within TxDMV, established under Chapter 1006 of the Texas Transportation Code.

“Parties” means TxDMV and Contractor, collectively.

“Party” means either TxDMV or Contractor, individually.

“Project” means the Deliverables to be provided by Contractor under the Contract.

“Purchase Order” means either the funding instrument supporting the Signature Document signed by the Parties, or the legally enforceable document issued by TxDMV without a Signature

Document and accepted by the Contractor by its performance in accordance with the Purchase

Order terms and conditions, which are subject to these Contract Uniform Terms and Conditions;

Attachments; Amendments; Purchase Order change notices; Work Orders; and Technical

Guidance Letters that may be issued by TxDMV, which are attached, incorporated into, and made part of the Purchase Order for all purposes. The Purchase Order may indicate the Effective Date, terms, types, quantities, and agreed prices for the Deliverables the Contractor will provide to

TxDMV during the Contract term. Also, considered the Contract when issued by TxDMV without a TxDMV contract Signature Document. May also be referred to as “PO.”

“Service” means the tasks, functions, and responsibilities assigned and delegated to Contractor under the Contract. May also be referred to in its plural form as “Services.”

“Signature Document” means the document executed by both Parties, that specifically sets forth and incorporates all the documents that constitute the Contract.

“Solicitation” means the document or communication submitted or issued by TxDMV, under which the Deliverables provided under the Contract were initially requested, which is incorporated herein by reference for all purposes in its entirety, including all Amendments and Attachments.

“Solicitation Response” means Contractor’s full and complete response to the Solicitation, which is incorporated herein by reference for all purposes in its entirety, including any Exhibits, Attachments, and Addenda. May also be referred to as “Response.”

“State” means the state of Texas and its instrumentalities, including TxDMV and any other State agency or public institution of higher education.

“State Fiscal Year” means the annual accounting period for the State from September 1st through

August 31st of each year. May also be referred to as “Texas Fiscal Year” or “Fiscal Year.” This term is not to be confused with Federal Fiscal Year or calendar year.

“State of Texas Textravel” means Title 34 of the Texas Administrative Code, Part 1, Chapter 5, Subchapter C, Section 5.22, relative to travel reimbursements under the Contract, if any.

“Statement of Work” means the description of requirements and specifications for the

Deliverables as specified in the Contract, and as may be amended, that the Contractor is required to provide under the Contract. May also be referred to as “Scope of Work,” “Statement of

Services to be Performed,” or “Scope of Services to be Performed.”

“Subcontract” means any written agreement between Contractor and a third party to fulfill the requirements of the Contract. All Subcontracts are required to be in writing.

“Subcontractor” means any individual or entity (including a subcontractor of a subcontractor) that enters a contract with Contractor to perform part or all of the obligations of Contractor under the Contract.

“TxDMV” means the Texas Department of Motor Vehicles, an administrative agency within the executive branch of the State, established under Chapter 1001 of the Texas Transportation Code.

May also be referred to as “Department” or “Agency.”

“Work” means all Deliverables to be provided, and any appurtenant actions performed, and items produced, conceived, or developed under the Contract.

“Work Order” means an individually negotiated document that is executed by both Parties, and which authorizes a project under the Contract, if any, in an indefinite quantity Contract.

“Work Product” means any and all works, including work papers, notes, materials, approaches, designs, specifications, systems, software, programs, source code or other programming code, innovations, improvements, inventions, documentation, training materials, audio or audiovisual recordings, methodologies, concepts, studies, reports, to all products and materials developed, whether finished or unfinished, and whether or not included in the Deliverables, that are developed, produced, generated, or provided by Contractor in connection with Contractor’s performance of its duties under the Contract or through use of any funding provided under the Contract.

1.2 Interpretive Provisions

A. The meanings of defined terms include the singular and plural forms.

B. The words “hereof,” “herein,” “hereunder,” and similar words refer to the Contract as a whole and not to any particular provision, section, Attachment, or schedule of the Contract unless otherwise specified.

C. Any reference to “day” or “days” is a reference to calendar days unless the reference is specifically to a business day.

D. The term “including” is not limiting and means “including without limitation” and, unless otherwise expressly provided in the Contract, (1) references to contracts (including the

Contract) and other contractual instruments will be deemed to include all subsequent

Amendments and other modifications, but only to the extent that such Amendments and other modifications are not prohibited by the terms of the Contract, and (2) references to any statute or regulation are to be construed as including all statutory and regulatory provisions consolidating, amending, replacing, supplementing, or interpreting the statute or regulation.

E. Unless the context clearly indicates otherwise, any references to “sections,” “appendices,” or “Attachments” are references to sections, appendices, or Attachments of the Contract.

F. Any references to agreements, contracts, statutes, or administrative rules or regulations in the Contract are references to these documents as amended, modified, or supplemented during the term of the Contract.

G. The captions and headings of the Contract are for convenience of reference only and do not affect the interpretation of the Contract.

H. All Attachments, including those incorporated by reference, and any Amendments are considered part of the Contract.

I. The Contract may use several different limitations, regulations, or policies to regulate the same or similar matters. All such limitations, regulations, and policies are cumulative, and each will be performed in accordance with its terms.

J. Unless otherwise expressly provided, reference to any action of TxDMV or by TxDMV by way of consent, approval, or waiver will be deemed to include the phrase “in its sole discretion.”

K. Time is of the essence in the performance under the Contract. Contractor must strictly comply with all of the deadlines, requirements, and standards of performance under the

Contract.

ARTICLE 2, CONSIDERATION, PAYMENT, AND FUNDING PROVISIONS

2.1 Prompt Payment

Any payments to the Contractor by TxDMV under the Contract will be made in accordance with

Chapter 2251 of the Texas Government Code (the “Texas Prompt Payment Act”). Chapter 2251 will govern remittance of payment and remedies for late payment and non-payment.

2.2 Submission of Invoices

A. To receive payment under the Contract, Contractor must submit correct itemized invoice(s) that includes the Contract number or Purchase Order number, whichever is applicable, that satisfies the minimum standards established under Title 34 of the Texas Administrative

Code, Part 1, Chapter 20, Subchapter F, Division 1, Section 20.487, in a secure, non-alterable electronic form (.pdf acceptable) emailed to: dmv_fin-invoices@txdmv.gov, or mailed to: Texas Department of Motor Vehicles, Attn: Payment Processing, 4000 Jackson

Avenue, Austin, Texas 78731, with a courtesy copy to the TxDMV Contract Representative identified in the Signature Document or Purchase Order. Any alternative invoice submission arrangements must be approved in writing by the TxDMV Contract

Representative.

Additionally, all invoices submitted via email by the Contractor must use the following naming convention for the subject line of the email: Invoice Submission: Contractor’s

Legal Entity Name, Invoice Number, TxDMV Contract Number, and Services Date(s) or

Month(s). For example, an invoice submitted to TxDMV by ABC, Inc. for the month of

January 2025 would state: “Invoice Submission: ABC, Inc., Invoice No. 1, TxDMV

Contract No. 608-25-000001, January 2025.”

B. When Contractor submits an invoice, the Contractor certifies:

i. the invoice has been carefully reviewed to ensure the invoice accurately describes the Deliverables provided;

ii. the Deliverables provided are in compliance with the Contract and accepted by

TxDMV;

iii. the amount of the invoice and all previous submitted invoices together does not exceed the not-to-exceed amount of the Contract or negotiated fees;

iv. the charges documented in the invoice are reasonable and necessary; and mailto:dmv_fin-invoices@txdmv.gov

v. all appropriate and required supporting documentation is attached to the invoice.

C. TxDMV may withhold payment of any charges that it disputes in good faith pursuant to

Title 34 of the Texas Administrative Code, Part 1, Chapter 20, Subchapter F, Division 1, Section 20.487(b) and may offset amounts the Contractor owes the state of Texas (“State”) or TxDMV as credits against charges payable to the Contractor under the Contract.

D. If TxDMV requests corrections to an invoice or additional information, documentation, or justification, the Contractor must submit a revised invoice with all corrections initialed or information necessary with the invoice’s date of submission changed to the date of resubmission.

E. The final invoice must be submitted by the Contractor within 30 days following Contract termination or expiration.

2.3 Ancillary and Travel Expenses

Except as otherwise provided in the Contract, no ancillary expenses incurred by the Contractor in connection with its provision of the Deliverables will be reimbursed by TxDMV. Ancillary expenses include any per diem, travel, mileage rates, trip charges, hotel, phone calls, reproduction services, office space, labor, materials, supplies, tools, equipment, personnel, shipping and handling, insurance, or other incidental expenses related to the provision of Deliverables under any Contract that may result from this Solicitation.

When the reimbursement of travel expenses is authorized by the Contract, all such expenses will be reimbursed in accordance with the rates set by the Texas Comptroller of Public Accounts’

Textravel guidelines, currently accessible at: https://fmx.cpa.texas.gov/fmx/travel/textravel/.

2.4 No Quantity Guarantees

All Work requested under the Contract may be on an irregular and as needed basis throughout the

Contract term, and TxDMV makes no guarantee of volume or usage of Work under the Contract.

2.5 Debts and Delinquencies

Contractor acknowledges and agrees that, to the extent Contractor owes any debt including, but not limited to, delinquent taxes, delinquent student loans, and child support owed to the State, any payments or other amounts Contractor is otherwise owed under the Contract may be applied toward any debt Contractor owes the State until the debt is paid in full. These provisions are effective at any time the Contractor owes any such debt or delinquency.

2.6 Refunds and Overpayments

A. At its sole discretion, TxDMV may:

i. withhold all or part of any payments to Contractor to offset overpayments, unallowable or ineligible costs made to the Contractor, or if any required financial status report(s) is not submitted by the due date(s); and/or

ii. require the Contractor to promptly refund or credit, within 30 days of written notice, any funds erroneously paid by TxDMV which are not expressly authorized under the Contract or deduct such amounts owing TxDMV from any payments due Contractor.

B. “Overpayments,” as used in this Section, include payments:

i. made by TxDMV that exceed the maximum allowable rates;

https://fmx.cpa.texas.gov/fmx/travel/textravel/

ii. that are not allowed under applicable laws, rules, or regulations; and/or

iii. that are otherwise inconsistent with the Contract, including any unapproved expenditures. Contractor understands and agrees that it will be liable to TxDMV for any costs disallowed pursuant to financial and compliance audit(s) of funds received under the Contract. Contractor further understands and agrees that reimbursement of such disallowed costs will be paid by Contractor from funds which were not provided or otherwise made available to Contractor under the

Contract.

2.7 Taxes

Purchases made for State use are exempt from State and local sales and use tax and United States excise tax. TxDMV will furnish Tax Exemption Certificates upon request. Contractor represents and warrants that it will pay any required taxes or similar amounts resulting from the Contract, including, but not limited to, any United States, State, or local income, sales or excise taxes of

Contractor or its employees. TxDMV will not be liable for any taxes resulting from the Contract.

2.8 Excess Obligations Prohibited

The Contract is subject to termination or cancellation, without penalty to TxDMV, either in whole or in part, subject to the availability of United States and/or State funds. TxDMV is a State agency whose authority and appropriations are subject to actions of the Texas Legislature. If TxDMV becomes subject to a legislative change, revocation of statutory authority, or lack of appropriated funds that would render either TxDMV’s or Contractor’s delivery or performance under the

Contract impossible or unnecessary, the Contract will be terminated or cancelled and be deemed null and void. In the event of a termination or cancellation under this Section, TxDMV will not be liable to Contractor for any damages that are caused or associated with such termination or cancellation, and TxDMV will not be required to give prior notice.

2.9 No Debt Against the State

The Contract will not be construed as creating any debt by or on behalf of the State.

ARTICLE 3, CONFIDENTIAL INFORMATION AND SECURITY PROVISIONS

3.1 Confidentiality and Security Requirements

Any specific confidentiality agreement/data use agreement between the Parties takes precedence over the terms of this Section.

A. Definitions. As used in these Contract Uniform Terms and Conditions, the following definitions have the meaning set forth below when used in the context of Confidential

Information (as defined below in Section 3.1(A)(4)), unless the context clearly indicates otherwise. The defined terms are as follows:

(1) “Authorized Purpose” means the specific purpose or purposes described in the

Contract for Contractor to fulfill its obligations under the Contract, or any other purpose expressly authorized by TxDMV in writing in advance.

(2) “Authorized User” means a person: who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze

Confidential Information pursuant to the Contract; for whom Contractor warrants and represents has a demonstrable need to create, receive, maintain, use, disclose or have access to the Confidential Information; and who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential

Information as required by the Contract.

(3) “Breach” means an impermissible use or disclosure of electronic or non-electronic sensitive personal information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identity theft, or medical identity theft. Any acquisition, access, use, disclosure, or loss of Confidential Information other than as permitted by the

Contract will be presumed to be a Breach unless Contractor demonstrates, based on a risk assessment, that there is a low probability that the Confidential

Information has been compromised.

(4) “Confidential Information” means any communication or record (whether oral, written, electronically stored or transmitted, or in any other form) provided by or on behalf of TxDMV to Contractor, or otherwise made available to the Contractor by TxDMV, or gathered, received, maintained, stored, used, processed, disclosed, transmitted, accessed, or generated by the Contractor on behalf of TxDMV under the Contract, or otherwise in the course of Contractor’s performance under the

Contract, that includes, but is not limited to, TxDMV Data (as defined below in

Section 4.6), business activities, practices, systems, conditions, services, all privileged work product, motor vehicle records, financial data, sensitive governmental records, and other information that TxDMV designates as secret, proprietary, or confidential, and any communication or record that is protected by

United States or State law or regulation.

Exclusions from Confidential Information. Confidential Information will not include, and the confidentiality obligations contained in this Article will not apply to, information that the Contractor can demonstrate:

(i) contractor received from a third party without restriction on disclosure and without breach of the Contract, or other wrongful act;

(ii) was independently developed by Contractor, not as part of Contractor’s performance or obligations under the Contract, as sufficiently demonstrated by Contractor’s written records;

(iii) is available to the public without breach of the Contract; or

(iv) is required to be disclosed by law or court order, provided that

Contractor provides TxDMV with adequate notice to allow TxDMV to seek a protective order or other similar order with respect to such

Confidential Information. In this instance, Contractor must reasonably cooperate with TxDMV at TxDMV’s cost and expense, in any effort made by TxDMV to seek a protective order or other appropriate protection of Confidential information.

(5) “Destroy” or “Destruction,” of Confidential Information, means:

(i) paper, film, or other hard copy media that has been shredded or destroyed such that the Confidential Information cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction.

(ii) electronic media that has been cleared, purged, or destroyed within systems, devices, and storage media consistent with National Institute of Standards and Technology (“NIST”) Special Publication 800-88, “Guidelines for Media Sanitization” or equivalent, such that the

Confidential Information cannot be retrieved.

(6) “Discover” or “Discovery,” means the first day on which a Breach becomes known to Contractor, or by exercising reasonable diligence, should have been known to Contractor.

B. Information Security Controls. Contractor agrees that:

(1) To the extent permitted by law, the Contractor must keep all information confidential, in whatever form produced, prepared, observed, or received by

Contractor from TxDMV, unless such use or disclosure is required for Contractor to perform Work under the Contract. The Contractor must maintain as confidential and is prohibited from disclosing to third parties without TxDMV’s prior written consent, any Confidential Information. This requirement must be included in all subcontracts awarded by Contractor.

Contractor must: (i) use appropriate legal, organizational, physical, administrative, and technical measures, and security procedures, including, without limitation, ensuring Confidential Information will be encrypted at rest and in motion, to ensure the integrity, security, and availability of Confidential Information, and safeguard and ensure the security of Confidential Information from unauthorized access, hacking, disclosure, duplication, theft, use, modification and/or loss; and

(ii) implement physical security and access controls at any of its facilities

(including any data centers) that house Confidential Information in accordance with applicable laws, rules, and regulations. The foregoing requirements in this

Subpart apply to Confidential Information that is in the Contractor’s actual or constructive possession.

(2) TxDMV will have the right to review the Contractor’s security measures to ensure any Confidential Information that is in the Contractor’s possession is secure. For any Contractor or Subcontractor that transmits, processes, or stores Confidential

Information, TxDMV may require the Contractor or Subcontractor to periodically provide evidence of its information security policies, procedures, and controls. The

Contractor must cooperate fully by providing such evidence and by making resources, employees, and systems available to TxDMV and TxDMV’s authorized representative(s), if requested by TxDMV. TxDMV also reserves the right to immediately terminate network and system connections not meeting such requirements. For any information security risks of the Contractor identified by

TxDMV throughout the term of the Contract, TxDMV may require an action plan to mitigate or remediate the security risk and Contractor agrees to provide such action plan promptly upon request.

(3) Contractor must provide notice to TxDMV’s Information Security Officer via email to txdmvsecurityincidents@txdmv.gov, with a copy to TxDMV’s Contract

Representative, within 24 hours of the Contractor’s Discovery of unauthorized use, exposure, access, disclosure, compromise, modification, or loss of

Confidential Information or any Breach, denial of service attack and/or inaccessible data due to ransomware or other type of malware (each such event, a

“Security Incident”). Additionally, within 24 hours of the Discovery of a

Security Incident, the Contractor must provide a written report to TxDMV’s mailto:txdmvsecurityincidents@txdmv.gov

Information Security Officer detailing the circumstances of the Security Incident which includes, at a minimum:

(i) description of the nature of the Security Incident;

(ii) the type of Confidential Information involved;

(iii) who may have obtained the Confidential Information;

(iv) what steps Contractor has taken or will take to investigate the Security

Incident;

(v) what steps Contractor has taken or will take to mitigate any negative effect of the Security Incident; and

(vi) a point of contact for additional information.

(4) Each day thereafter, or as additional information becomes available, and until the investigation is complete, the Contractor must provide TxDMV’s Information

Security Officer with a written report regarding the status of the investigation and the following additional information:

(i) who is known or suspected of having gained unauthorized access to

Confidential Information;

(ii) whether there is any knowledge that Confidential Information has been abused or compromised;

(iii) what additional steps Contractor has taken or will take to investigate the Security Incident;

(iv) what steps Contractor has taken or will take to mitigate any negative effect of the Security Incident; and

(v) what corrective action Contractor has taken or will take to prevent future similar unauthorized use or disclosure.

(5) Further, Contractor must notify TxDMV within 12 hours of any new report of any security vulnerability that affects its platforms directly or indirectly, that is published in sources including, but not limited to, the Common Vulnerabilities and

Exposures and publications of the U.S. Cybersecurity and Infrastructure Security

Agency (each such event, a “Security Vulnerability”).

(6) Furthermore, the Contractor must provide an action plan for final resolution of such Security Incident or Security Vulnerability within one week of the date of such Security Incident or Security Vulnerability and complete remediation of such

Security Incident or Security Vulnerability must be completed at the Contractor’s sole expense.

(7) Contractor must confer with TxDMV’s Chief Information Security Officer regarding the proper course of the investigation and risk mitigation. TxDMV reserves the right to conduct an independent investigation of any Security Incident, and should TxDMV choose to do so, the Contractor must cooperate fully by making resources, employees, and systems access available to TxDMV and

TxDMV’s authorized representative(s). Subject to review and approval of

TxDMV’s Information Security Officer, the Contractor, at its own cost, will provide notice that satisfies the requirements of applicable United States and State law and regulation to individuals whose personal, confidential, or privileged data were compromised or likely compromised as a result of the Security Incident.

(8) Contractor also acknowledges and understands that if a “breach of system security” is determined to have occurred, Contractor must comply with all notification requirements outlined in Section 521.053 of the Texas Business and

Commerce Code. This includes, but is not limited to, notifying the Texas Office of the Attorney General within 30 days of certain breaches.

(9) If Contractor has any questions or concerns regarding whether particular material or information is Confidential Information, Contractor must obtain the prior written approval of TxDMV prior to using, disclosing, or releasing such information. Contractor acknowledges that Confidential Information is unique and valuable, and that TxDMV may have no adequate remedy at law if Contractor does not comply with its confidentiality obligations under the Contract.

Therefore, TxDMV will have the right, in addition to any other rights it may have, to seek temporary, preliminary, and/or permanent injunctive relief to restrain any breach, threatened breach, or otherwise to specifically enforce any confidentiality obligations of the Contractor if Contractor fails to perform any of its confidentiality obligations under the Contract.

(10) With respect to all Confidential Information, Contractor must:

(a) Ensure websites that process, transmit, or store Confidential

Information will be accessible through a secure connection (HTTPS-only, with HTTP Strict Transport Security (“HSTS”)), utilizing

Transport Layer Security (“TLS”) version 1.2 or higher.

(b) Exercise reasonable care and no less than the same degree of care

Contractor uses to protect its own confidential, proprietary and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized Purpose or as required by law, which includes industry standard physical and electronic security measures, password protection, recordkeeping controls, and personnel procedures. The Contractor will access, create, maintain, receive, use, disclose, transmit or Destroy Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses.

(c) Implement, update as necessary, and document privacy, security and

Breach notice policies and procedures and an incident response plan to address a Breach, to comply with the privacy, security, and Breach notice requirements of this Article prior to performing Work under the

Contract. The Contractor will provide to TxDMV, within five business days of request, copies of its policies and procedures and records relating to the use or disclosure of Confidential Information.

(d) Obtain TxDMV’s prior written consent to disclose or allow access to any portion of the Confidential Information to any person, other than

Authorized Users, Workforce, or Subcontractors who have completed training required by the Contract in confidentiality, privacy, security and the importance of promptly reporting any Breach to Contractor’s management.

(e) Obtain prior written approval of TxDMV, to disclose or provide access to any Confidential Information on the basis that such act is required by law or regulation, so that TxDMV may have the opportunity to object to the disclosure or access and seek appropriate relief. If

TxDMV objects to such disclosure or access, the Contractor will refrain from disclosing or providing access to the Confidential

Information until TxDMV has exhausted all alternatives for relief.

(f) Certify that its Authorized Users have a demonstrated need to know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose and that each

Authorized User has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in this Article. Contractor and its Subcontractors will maintain at all times an updated, complete, accurate list of Authorized

Users and supply it to TxDMV upon request.

(g) Provide, and will cause its Subcontractors and agents to provide, to

TxDMV periodic written confirmation of compliance with controls and the terms and conditions of the Contract.

(h) Return to TxDMV or Destroy, at TxDMV’s election and at

Contractor’s expense, all Confidential Information received from

TxDMV or created or maintained by Contractor or any of Contractor’s agents or Subcontractors on TxDMV’s behalf upon the termination or expiration of the Contract, if reasonably feasible and permitted by law and regulation. The Contractor will certify in writing to TxDMV that all such Confidential Information has been Destroyed or returned to

TxDMV, and that Contractor and its agents and Subcontractors have retained no copies thereof. Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destroy any Confidential

Information if United States or State law, rule, or regulation, TxDMV record retention policy, or a litigation hold notice prohibits such

Destruction. If such return or Destruction is not reasonably feasible, or is impermissible by law or regulation, Contractor will immediately notify TxDMV of the reasons such return, or Destruction is not feasible, and agree to extend the protections of this Article to the

Confidential Information for as long as Contractor maintains such

Confidential Information.

(i) If required under the terms of the Solicitation, complete, return, and comply with the Contract and the Information Resources Security

Compliance & Confidentiality Agreement.

(j) Contractor’s security controls will comply with all NIST standards, as amended. Contractor will update its security controls assessment whenever there are significant changes in security controls for TxDMV

Confidential Information and will provide the updated document to

TxDMV. TxDMV also reserves the right to request updates as needed to satisfy United States and State monitoring requirements.

(k) Contractor will only conduct secure transmissions of Confidential

Information whether in paper, oral, or electronic form. A secure transmission of electronic Confidential Information in motion includes

Secure File Transfer Protocol (“SFTP”) or encryption at an appropriate level as required by rule, regulation, or law. Confidential Information at rest requires encryption unless there is adequate administrative, technical, and physical security as required by law, regulation, or rule.

All electronic data transfer and communications of Confidential

Information will be through secure systems. Contractor will provide proof of system, media or device security and/or encryption to TxDMV no later than 72 hours after TxDMV’s written request in response to a compliance investigation, audit, or the Discovery of a Breach. TxDMV may also request production of proof of security at other times as necessary to satisfy United States and State monitoring requirements.

Deidentification of Confidential Information in accordance with

HIPAA de-identification standards, if applicable, is deemed secure.

(l) Make available to TxDMV any information TxDMV requires to fulfill

TxDMV’s obligations to provide access to, or copies of, Confidential

Information in accordance with applicable laws, rules, regulations, or demands of a regulatory authority relating to Confidential Information.

The Contractor will provide such information in a time and manner reasonably agreed upon or as designated by the applicable law or regulatory authority.

(m) Comply with NIST standards and all United States and State laws and regulations applicable to the type of Confidential Information and

Contractor’s Authorized Purpose.

(n) Be permitted to use or disclose Confidential Information for the proper management and administration of the Contractor to carry out

Contractor’s legal responsibilities, except as otherwise limited by this

Article or law, rule, or regulation applicable to the Confidential

Information, if:

(i) Disclosure is required by law, rule, or regulation; or

(ii) Contractor obtains reasonable assurances from the person or entity to whom the information is disclosed that the person or entity will:

• Maintain the confidentiality of the Confidential

Information in accordance with the Contract;

• Use or further disclose the information only as required by law, rule, or regulation, or for the

Authorized Purpose for which it was disclosed to the person; and

• Notify Contractor in event of a Breach of

Confidential Information that the person Discovers or should have Discovered with the exercise of reasonable diligence.

(o) Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any sensitive personal information collected or maintained by

Contractor under the Contract.

3.2 Confidential Information Storage

Contractor must ensure that all Confidential Information, including any Confidential Information residing in backup or disaster recovery systems, remains within the contiguous United States, and may not be accessed, viewed, stored, processed, transmitted, received, or disposed of via information technology systems located outside the contiguous United States without obtaining prior written approval from TxDMV. The Contractor must also not store Confidential Information on portable devices, including personal laptops and desktop computers, except as required for the

Contractor to fulfill its obligations under the Contract, or as authorized in advance in writing by

TxDMV. Additionally, upon request by TxDMV, the Contractor must immediately disclose any data center(s) and server locations where Confidential Information is held or will be stored, as well as any redundant server locations.

3.3 Access to Internal Agency Network and Systems

As a condition of gaining remote access to any internal TxDMV network and systems, if applicable, the Contractor must comply with TxDMV’s policies and procedures, more fully detailed in the security and awareness training that every contractor and its employees are required to complete prior to obtaining access to TxDMV networks and systems. TxDMV’s remote access request procedures will require Contractor to submit TxDMV Applicable Access Request forms for TxDMV’s review and approval. Remote access technologies provided by Contractor must be approved by TxDMV’s Information Security Officer. TxDMV, in its sole discretion, may deny network or system access to any individual that does not complete the required forms. Contractor must secure its own connected systems in a manner consistent with TxDMV’s requirements. The off-site downloading, transfer, and/or storage of Confidential Information is strictly prohibited unless such acts are specifically allowed by the Contract.

3.4 Cybersecurity Training

If Contractor or a Subcontractor will have access to any State computer system or database in the performance of the Contract, Contractor represents and warrants that it and any Subcontractor will comply with the requirements of Section 2054.5192 of the Texas Government Code relating to cybersecurity training and required verification of completion of the training program. TxDMV will not compensate Contractor for completing the cybersecurity training.

ARTICLE 4, INTELLECTUAL PROPERTY PROVISIONS

4.1 Property Rights / Ownership of Work Product

A. All rights, title, and interest in the Work Product, including all Intellectual Property Rights therein, are exclusively owned by TxDMV. Contractor and Contractor’s employees will have no rights in or ownership of the Work Product or any other property of TxDMV.

B. Any and all Work Product that is copyrightable under United States copyright law is deemed to be a “work made for hire” owned by TxDMV, as provided by Title 17 of the

United States Code. To the extent Work Product does not qualify as a work made for hire under applicable United States law, and to the extent that the Work Product includes materials subject to copyright, patent, trade secret, trademarks, registrations, or other proprietary right protection, Contractor hereby irrevocably assigns and transfers to

TxDMV, its successors and assigns, the entire right, title, and interest in and to the Work

Product, including any and all Intellectual Property Rights embodied therein or associated therewith, and in and to all works based upon, derived from, or incorporating the Work

Product, and in and to all income, royalties, damages, claims and payments now or hereafter due or payable with respect thereto, and in and to all causes of action, either in law or equity for past, present or future infringement based on the copyrights, and in and to all rights corresponding to the foregoing.

C. Contractor agrees to execute all papers, provide all assistance, and perform any acts as

TxDMV may deem necessary to secure and perfect the rights herein assigned, without any charge or expense beyond those amounts payable for Deliverables provided under the

Contract.

D. In the event Contractor has any rights in and to the Work Product that cannot be assigned to TxDMV, Contractor hereby grants to TxDMV an exclusive, worldwide, royalty-free, transferable, irrevocable, and perpetual license, with the right to sublicense to third parties solely for the purpose of engaging such third parties to assist or carryout TxDMV’s internal business use of the Work Product, to reproduce, distribute, modify, create derivative works of, publicly perform and publicly display, make, have made, use, sell and offer for sale, and transmit the Work Product and any products developed by practicing such rights.

E. The foregoing does not apply to Incorporated Pre-Existing Works (as defined below in

Section 4.2) or Third-Party IP that are incorporated in the Work Product by Contractor.

Contractor will provide TxDMV access during normal business hours to all Contractor materials, premises, and computer files containing the Work Product.

F. For the avoidance of doubt, nothing in this Section affects the ownership of Intellectual

Property Rights of either Party which were in existence prior to the Effective Date or are developed independently of the Contract.

The following Section 4.2(A) below will not apply to, or have any force or effect on, the

Contract if Contractor is licensing software to TxDMV under the Contract. In contrast, if

Contractor is licensing software to TxDMV under the Contract, Section 4.2(B) will apply to the Contract.

4.2 Contractor’s Pre-Existing Works

A. Pre-Existing Works - Non-Software

(1) To the extent Contractor incorporates into the Work Product, any works of

Contractor that were created by Contractor, or that Contractor acquired rights in:

(i) independent of the performance of the Services; or (ii) prior to the Effective

Date of the Contract (collectively, the “Incorporated Pre-Existing Works”), Contractor retains ownership of such Incorporated Pre-Existing Works.

(2) License Grant. Contractor hereby grants to TxDMV an irrevocable, perpetual, non-exclusive, royalty-free, transferable, worldwide right and license, with the right to sublicense, to use, reproduce, modify, copy, create derivative works of, publish, publicly perform and display, sell, offer to sell, make and have made, the

Incorporated Pre-Existing Works, in any medium, with or without the associated

Work Product.

(3) Contractor represents, warrants, and covenants to TxDMV that Contractor has all necessary rights and authority to grant the foregoing license in the Incorporated

Pre-Existing Works to TxDMV.

B. Pre-Existing Works - Software

(1) To the extent Contractor incorporates into the Work Product, any works of

Contractor that were created by Contractor, or that Contractor acquired rights in:

(i) independent of the performance of the Services; or (ii) prior to the Effective

Date of the Contract (collectively, the “Incorporated Pre-Existing Works”), Contractor retains ownership of such Incorporated Pre-Existing Works.

(2) Software License Grant. During the Contract Term (as defined below in Section

4.2(B)(7)), Contractor hereby grants to…