Exhibit_3_ITS75_IaaS_Additional_Terms~1.docx

Exhibit 3 to RFR ITS75 Software-and-Services Infrastructure as a Service (IaaS) additional terms and conditions

1. Data Ownership The Eligible Entity will own all right, title and interest in its data. The Contractor shall not access Eligible Entity user accounts or Eligible Entity data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of RFR ITS75, (4) as required by the express terms of an agreement between the Eligible Entity and Contractor placed under, and subject to, RFR ITS75 (an “RFR ITS75 Order”), or (5) at the Eligible Entity’s written request. Contractor shall not collect, access, or use user-specific Eligible Entity Data except as strictly necessary to provide Service to the Eligible Entity.

No information regarding an Eligible Entity’s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of RFR ITS75.

Data Protection Protection of personal privacy and data shall be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of Eligible Entity information at any time. To this end, the Contractor shall safeguard the confidentiality, integrity and availability of Eligible Entity information and comply with the following conditions:

a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non-Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own Personal Data and Non-Public Data of similar kind.

b. All data obtained by the Contractor in the performance of an RFR ITS75 Order shall become and remain the property of the Eligible Entity.

c. All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the RFR ITS75 Order.

d. Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit. The Eligible Entity shall identify data it deems as Non-Public Data to the Contractor. The level of protection and encryption for all Non-Public Data shall be identified in the SLA.

e. At no time shall any data or processes — that either belong to or are intended for the use of an Eligible Entity or its officers, agents or employees — be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Eligible Entity.

f. The Contractor shall not use any information collected in connection with the Services issued from an RFR ITS75 Order for any purpose other than fulfilling the Services.

Data Location The Contractor shall provide its services to the Eligible Entity and its end users solely from data centers in the United States. Storage of Eligible Entity data at rest shall be located solely in data centers in the United States. The Contractor shall not allow its personnel or contractors to store Eligible Entity data on portable devices, including personal computers, except for devices that are used and kept only at its United States data centers. The Contractor shall permit its personnel and contractors to access Eligible Entity data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in an RFR ITS75 Order.

Security Incident or Data Breach Notification The Contractor shall inform the Eligible Entity of any security incident or data breach related to Eligible Entity’s Data within the possession or control of the Contractor and related to the service provided under RFR ITS75 or the applicable RFR ITS75 Order. Such notice shall include, to the best of Contractor’s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown.

Security Incident and Data Breach Reporting Requirements If Contractor knows or has reason to know of a security incident or data breach that may affect the security of Eligible Entity data, Contractor shall notify such Eligible Entity as soon as practicable from the date of the security incident or data breach, and in no event more than three (3) days, and shall cooperated with the Eligible Entity to meet any requirements under applicable state or Federal law.

In the event of a security incident or data breach, Contractor will take commercially reasonable steps to mitigate the effects, to resolve the security incident or data breach in a timely manner, and to put measures in place to prevent the reoccurrence of similar security incidents or breaches in the future.

Security Incident and Data Breach Notices If requested by the Eligible Entity, or if required by applicable Federal or State law (including without limitation M.G.L. c. 93H), Contractor will provide notice as soon as practicable to those individuals who data was affected or may have been affected by a security incident or data breach. If the security incident or data breach is due to the negligence of the Contractor, Contractor shall provide all requested and/or required notices at its sole expense.

Breach Responsibilities This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor and related to the service provided under RFR ITS75.

a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Eligible Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident.

b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Eligible Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law or the RFR ITS75 Order, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Contractor shall (1) cooperate with the Eligible Entity as reasonably requested by the Eligible Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

Notification of Legal Requests The Contractor shall contact the Eligible Entity upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the Eligible Entity’s data under RFR ITS75, or which in any way might reasonably require access to the data of the Eligible Entity. The Contractor shall not respond to subpoenas, service of process and other legal requests related to the Eligible Entity without first notifying and obtaining the approval of the Eligible Entity, unless prohibited by law from providing such notice.

Termination and Suspension of Service

a. In the event of an early termination of RFR ITS75 or the applicable RFR ITS75 Order, Contractor shall allow for the Eligible Entity to retrieve its digital content and provide for the subsequent secure disposal of the Eligible Entity’s digital content.

b. During any period of service suspension, the Contractor shall not take any action to intentionally erase or otherwise dispose of any of the Eligible Entity’s data.

c. In the event of early termination of any Services under an RFR ITS75 Order or RFR ITS75 in its entirety, the Contractor shall not erase Eligible Entity’s data for a period of ninety (90) days after the effective date of termination, unless otherwise agreed to by the Eligible Entity in writing. Contractor shall impose no fees for access and retrieval of Eligible Entity data during this ninety (90) day period. After such day period, the Contractor shall have no obligation to maintain or provide any Eligible Entity data and shall thereafter, unless legally prohibited, delete all Eligible Entity data in its systems or otherwise in its possession or under its control.

d. The Eligible Entity shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an SLA.

e. Upon termination of the Services or RFR ITS75 in its entirety, Contractor shall securely dispose of all Eligible Entity’s data in all of its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the Eligible Entity. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the Eligible Entity.

Background Checks

a. Upon the request of the Eligible Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Eligible Entity’s information among the Contractor’s employees and agents.

b. The Contractor and the Eligible Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Eligible Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.

c. If any of the stated personnel providing services under an RFR ITS75 Order is not acceptable to the Eligible Entity in its sole opinion as a result of the background or criminal history investigation, the Eligible Entity, in its’ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the RFR ITS75 Order and any related service agreement.

Access to Security Logs and Reports

a. The Contractor shall provide reports on a schedule specified in the RFR ITS75 Order to the Eligible Entity directly related to the infrastructure that the Contractor controls upon which the Eligible Entity’s account resides. Unless otherwise agreed to in the SLA, the Contractor shall provide the public jurisdiction a history or all API calls for the Eligible Entity account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Contractor. The report will be sufficient to enable the Eligible Entity to perform security analysis, resource change tracking and compliance auditing.

b. The Contractor and the Eligible Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Eligible Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.

Contract Audit The Contractor shall allow the Eligible Entity to audit conformance to the RFR ITS75 terms. The Eligible Entity may perform this audit or contract with a third party at its discretion and at the Eligible Entity’s expense.

Data Center Audit The Contractor shall perform an independent audit of its data centers at least annually and at its own expense, and provide an unredacted version of the audit report upon request to the Eligible Entity. The Contractor may remove its proprietary information from the unredacted version. For example, a Service Organization Control (SOC) 2 audit report would be sufficient.

Change Control and Advance Notice The Contractor shall give a minimum forty eight (48) hour advance notice (or as determined by an Eligible Entity and included in the SLA) to the Eligible Entity of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number.

Contractor will make updates and upgrades available to Eligible Entity at no additional costs when Contractor makes such updates and upgrades generally available to its users.

No update, upgrade or other charge to the Service may decrease the Service’s functionality, adversely affect Eligible Entity’s use of or access to the Service, or increase the cost of the Service to the Eligible Entity.

Contractor will notify the Eligible Entity at least sixty (60) days in advance prior to any major update or upgrade.

Security As requested by an Eligible Entity, the Contractor shall disclose its non-proprietary system security plans (SSP) or security processes and technical limitations to the Eligible Entity such that adequate protection and flexibility can be attained between the Eligible Entity and the Contractor. For example: virus checking and port sniffing — the Eligible Entity and the Contractor shall understand each other’s roles and responsibilities.

Non-disclosure and Separation of Duties The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of Eligible Entity data to that which is absolutely necessary to perform job duties.

Import and Export of Data The Eligible Entity shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Contractor at any time during the term of Contractor’s contract with the Eligible Entity. This includes the ability for the Eligible Entity to import or export data to/from other Contractors. Contractor shall specify if Eligible Entity is required to provide its’ own tools for this purpose, including the optional purchase of Contractors tools if Contractors applications are not able to provide this functionality directly.

Responsibilities and Uptime Guarantee The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Contractor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime), and provide service to customers as defined in the SLA. Unless specifically agreed to in writing by the Contractor and the Eligible Entity, Contractor must provide a SLA that contains the following: (1) a specified guaranteed uptime percentage of at least 99.0%, (2) a maximum of ten hours of scheduled maintenance per month, which will in no event occur during the Eligible Entity’s regular business hours, (3) Contractor’s commitment to provide at least five days’ advance notice of scheduled downtime, (4) notification of unscheduled downtime no later than twenty-four hours after its occurrence, (5) response and resolution times for defects based on industry standards, (6) applicable performance metrics (e.g. latency, transaction time), based on industry standards, (7) remedies for failure to meet the guaranteed uptime percentage and response and resolution times, which will be issued by Contractor with no action required from Eligible Entity, and (8) remedies for repeated consistent failures to meet SLA metrics. Contractor will provide to Eligible Entity credit amounts or refunds in connection with downtime. In the event that the Eligible Entity’s access to the IaaS falls below an agreed-upon percentage in any given month during the applicable term, in addition to other rights and remedies provided in RFR ITS75, the Eligible Entity may terminate the applicable RFR ITS75 Order with no further liability to Contractor and Contractor will provide a pro-rated refund of prepaid fees to the Eligible Entity.

Subcontractor Disclosure Contractor shall identify all of its strategic business partners related to services provided under this RFR ITS75, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the Contractor, and who shall be involved in any application development and/or operations.

The Eligible Entity shall have the right at any time to require that the Contractor remove from interaction with Eligible Entity any Contractor representative who the Eligible Entity believes is detrimental to its working relationship with the Contractor. The Eligible Entity shall provide the Contractor with notice of its determination, and the reasons it requests the removal. If the Eligible Entity signifies that a potential security violation exists with respect to the request, the Contractor shall immediately remove such individual. The Contractor shall not assign the person to any aspect of RFR ITS75 or future work orders without the Eligible Entity’s consent.

Business Continuity and Disaster Recovery The Contractor shall provide a Disaster Recovery Plan and ensure that the Eligible Entity’s recovery time objective (“RTO”) of twenty-four hours is met. Contractor and Eligible Entity may agree in writing to a different RTO. In the event of an IaaS failure, Contractor must ensure that the Eligible Entity’s recover point objective (“RPO”) of twenty-four hours is met. Contractor and Eligible Entity may agree in writing to a different RPO.

Contractor will work with Eligible Entity to perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed by Contractor and Eligible Entity. If Eligible Entity, in its sole discretion, designated the IaaS as mission-critical: (1) Contractor shall review and test the Disaster Recovery plan regularly, at minimum twice annually, and (2) Contractor shall back up Eligible Entity data no less than twice daily in an off-site hardened facility located within the continental United States.

Compliance with Accessibility Standards The Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Eligible Entity. Contractor must comply with Eligible Entity’s established standards for accessibility. Eligible Entities within the Commonwealth of Massachusetts Executive Department are subject to the Enterprise IT Accessibility Standards available via https://www.mass.gov/guides/enterprise-it-accessibility-standards#-contact,-terms-and-document-history- (or a successor link thereto). Additional accessibility terms may be provided by Eligible Entities.

Encryption of Data at Rest The Contractor shall enable hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data, unless the Eligible Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the RFR ITS75 Order.

Subscription Terms Contractor grants to an Eligible Entity a license to: (i) access and use the Service for its business purposes; (ii) for IaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractor’s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Eligible Entities unless such terms are included in this RFR ITS75.

05/18/2020 Exhibit 3: IaaS Additional Terms and Conditions 1