Information Technology (IT) Supplemental

Applicability and Definitions. This Exhibit A, IT Supplemental, is incorporated into Purchase Order Request for Proposals (PORFP) No. BPM059327, issued as a secondary competition under the Commercial Off-the-Shelf Software (COTS 2012) Master Contract No. 060B2490021 (the “Master Contract”). As used in this Exhibit: “Contractor” means the Master Contractor awarded the Purchase Order; “Contract” means, collectively, the Master Contract, the PORFP (including this Exhibit A and Attachment Y – Data Use Agreement), and the resulting Purchase Order; “Order” means the Purchase Order issued under the PORFP; and “Quote” means the Master Contractor’s Proposal submitted in response to the PORFP, including the completed Bid Form. In the event of a conflict, the order of precedence established by the Master Contract shall govern. Notwithstanding the foregoing, where this Exhibit and Attachment Y – Data Use Agreement both address the same matter, including Security Incident and Data Breach notification, costs, and corrective actions, the provision more protective of the State and State Data shall govern.

1. Deliverables A. Deliverable Submission

The Contractor shall provide the deliverables identified in the Scope of Work and approved implementation plan in accordance with the agreed-upon project schedule.

Deliverables shall be submitted electronically to the Contract Monitor or designated State representative unless otherwise directed by the State.

B. Deliverable Acceptance

1. Deliverables requiring State acceptance shall be reviewed by the Contract Monitor or designated State representative for conformance with the applicable requirements of the Scope of Work, approved implementation plan, and Contract.

2. The State will either accept the deliverable or identify material deficiencies requiring correction. If deficiencies are identified, the Contractor shall correct the deficiencies and resubmit the deliverable within a mutually agreed-upon timeframe.

3. Acceptance of a deliverable does not waive the Contractor's responsibility to correct latent defects, errors, or deficiencies subsequently identified during implementation or operation of the Solution.

4. A deliverable shall not be deemed accepted solely by the passage of time, use of the deliverable, or payment of an invoice unless otherwise expressly provided in the Contract.

5. FA II – Installation and Training Services milestone fees identified in the Bid Form shall be invoiced only after the State has accepted the deliverables associated with that milestone: the Design milestone upon acceptance of Deliverables 3 through 5, the Deploy milestone upon acceptance of Deliverables 7 through 9, and the Closeout milestone upon acceptance of Deliverable 10. Deliverables 1, 2, and 6 are included in the milestone prices and shall not be invoiced separately.

C. Deliverable Descriptions/Acceptance Criteria Deliverables Summary Table

System Configuration

2. Contractor-Supplied Software, Hosting and Technology

A. The Contractor shall be responsible for providing and maintaining all Contractor-controlled hardware, software, cloud infrastructure, hosting, and related technology necessary to provide the SaaS Solution and Services required under the Contract. Except for State-controlled systems, interfaces, network connectivity, and equipment expressly identified as State responsibilities, the Contractor shall provide all technology necessary for operation of the hosted Solution at no additional cost beyond the pricing established under the Contract.

B. The SaaS Solution shall be accessible through supported standard web browsers and applicable interfaces without requiring State-hosted application infrastructure, except for approved integration or authentication components.

C. The Contractor shall maintain and update the SaaS Solution throughout the Contract term. For planned changes that may materially affect State functionality, integrations, authentication, data exchange, security, or user workflows, the Contractor shall provide reasonable advance notice and applicable release documentation.

D. Where reasonably available and appropriate, material changes affecting State integrations or business processes shall be made available for State review or validation prior to production implementation.

E. Emergency security patches and other changes necessary to address critical vulnerabilities or service availability may be implemented without advance State approval; however, the Contractor shall notify the State as soon as reasonably practicable of any material impact to the State.

F. The Contractor shall not place the Solution into production use for SHA until all applicable State information technology, cybersecurity, privacy, interface, and authorization requirements have been completed and the State has authorized production use.

G. The Contractor warrants that the SaaS Solution and Services will materially conform to the requirements of the Contract and applicable documentation throughout the Contract term. The Contractor shall correct material defects or nonconformities in accordance with the applicable maintenance, support, and service-level requirements of the Contract.

3. Product Requirements

A. The Contractor shall be a Master Contractor under the Master Contract and an authorized reseller of the PRiSM Compliance Management Software, manufactured by Early Morning Software, provided as software-as-a-service (the “Solution” or “SaaS Solution”), together with the SaaS subscriptions, maintenance, support, and related services identified in the Contractor’s Quote. The Contractor shall ensure that Early Morning Software and any other software provider, subcontractor, or third-party provider required to provide the Solution is authorized in accordance with the applicable requirements of the Master Contract. Upon request, the Contractor shall provide documentation demonstrating such authorization, including a Letter of Authorization (LOA) from the manufacturer or distributor.

B. All subscriptions purchased under an Order shall align with the period of performance identified in the applicable Order unless otherwise expressly approved by the State. No subscription shall automatically renew or extend beyond the authorized Contract or Order term without affirmative written authorization by the State.

C. Any terms of use, end-user license agreement (EULA), software-as-a-service agreement, publisher terms, click-through terms, or other supplemental terms applicable to the proposed Solution or Services shall be submitted with the Master Contractor’s Proposal in response to the PORFP. Terms not provided with the Proposal shall not bind the State, as provided in the PORFP. Such terms shall not be binding upon the State unless expressly accepted in writing by an authorized State representative and incorporated into the Contract, as applicable. In the event of a conflict, the order of precedence established by the Master Contract shall govern.

D. The Contractor shall provide the State with the subscription, access, and usage rights necessary for authorized State users to use the SaaS Solution throughout the applicable Order term. Nothing in the Contract transfers ownership of the Contractor's or software provider's pre-existing intellectual property to the State. State Data remains subject to the ownership, access, use, export, retention, and disposition requirements established by the Contract.

4. Maintenance

A. Maintenance and support for the SaaS Solution shall commence upon activation of the applicable subscription services and shall continue throughout the applicable subscription term in accordance with the Contract and applicable Order.

B. Throughout the applicable subscription term, the Contractor shall provide maintenance, updates, patches, bug fixes, vulnerability remediation, and other maintenance services applicable to the subscribed SaaS Solution in accordance with the Master Contract, the PORFP, the applicable Order, and incorporated product-specific terms.

C. Material Defects. The Contractor shall notify the State of known material errors or defects affecting the SaaS Solution that could materially impair functionality, security, data integrity, or the accuracy of system results and shall take appropriate corrective or mitigating action in accordance with the Contract.

5. Technical Support

A. The Contractor shall provide technical support and Help Desk services for the SaaS Solution throughout the applicable subscription term in accordance with the support services established under the Contract and applicable Order.

B. Technical Support shall be available during the support hours established in the Contract, applicable Order, or incorporated support documentation.

C. The Contractor shall maintain records sufficient to identify the date and time an incident or service request was reported, its status, applicable severity or priority, actions taken, and date and time of resolution or closure.

D. Applicable response times, resolution targets, escalation procedures, availability requirements, and other performance standards shall be governed by Sections 6 through 8 of this Exhibit.

6. Service Level Agreement (SLA)

A. Service Availability means the availability of the Core Applications comprising the SaaS Solution to authorized State users, measured monthly.

B. Scheduled Maintenance means routine, planned maintenance performed during non-peak usage periods in accordance with the Contract, not to exceed eight (8) hours per calendar month, performed outside 7:00 a.m. to 7:00 p.m. ET, Monday through Friday, unless otherwise approved in writing by the State.

C. Emergency Issue means an issue resulting in the State's inability to access or materially use the SaaS Solution or a critical production function.

D. Routine Issue means a non-critical issue, request, or inquiry that does not materially prevent the State from performing its business functions.

E. Business Hours and support hours mean 8:00 a.m. to 5:00 p.m. ET, Monday through Friday, excluding State holidays, unless the support program identified in the Quote provides broader hours. Business Day means any day on which Business Hours occur.

F. Core Applications means the Solution modules, functions, and State-facing interfaces (including SSO authentication and approved integrations) included in the subscription purchased under the Order, as identified in the Quote.

7. SLA Requirements

A. The Contractor shall ensure that the SaaS Solution is provided in accordance with the service standards established in this Section and any incorporated Service Level Agreement applicable to the Solution. The Contractor shall:

1. Maintain the Core Applications at a minimum monthly availability of 99.0%, excluding Scheduled Maintenance and other exclusions expressly permitted under the Contract.

2. Notify the State's designated technical contact within one (1) hour after the Contractor becomes aware of an outage resulting in the State's complete inability to access the SaaS Solution.

3. Provide at least forty-eight (48) hours' advance notice, where reasonably practicable, of Scheduled Maintenance expected to materially affect State access to or use of the Solution.

4. Maintain a support-ticketing mechanism through which the State may submit, track, and obtain status information regarding reported issues.

5. Respond to Emergency and Routine Issues in accordance with the applicable response times established in Section 8.C, Support Response Times.

8. SLA Effective Date (SLA Activation Date)

The service-level requirements of this Section shall become effective upon Production Deployment/Go-Live and shall remain in effect throughout the applicable subscription term

A. Service Level Reporting

Upon request, the Contractor shall provide information reasonably sufficient to demonstrate performance against applicable availability, outage, support, and response requirements.

The Contractor shall promptly identify any material failure to meet an applicable service level and provide the State with the cause, impact, corrective action taken or planned, and expected resolution, as applicable.

B. Root Cause Analysis Upon request by the State, the Contractor shall provide a root cause analysis for a material or recurring service interruption, significant degradation of the Solution, or repeated failure to meet an applicable service-level requirement. The root cause analysis shall identify, as applicable, the cause of the event, corrective actions taken, and measures implemented or planned to reduce the likelihood of recurrence.

C. Support Response Times

1 Business Hour during support hours; after-hours response by 9:00 AM ET the next Business Day

The service-level requirements applicable to the State shall not be materially reduced or modified during the Contract term without the State's prior written agreement. Updates to website-posted or other product-specific service standards shall not supersede the service-level requirements incorporated into the Contract.

Where the support program purchased under the Order (including the CARES Program service level identified in the Quote) provides response times, availability, or other service levels more favorable to the State than those in Sections 6 through 8 of this Exhibit, the more favorable terms shall apply.

9. Required Project Policies, Guidelines and Methodologies The Contractor must comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. These include, but are not limited to:

https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx

https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards

10. Disaster Recovery and Data A. Redundancy, Data Backup and Disaster Recovery

1. Unless specified otherwise, throughout the Contract term, the Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

2. The Contractor shall maintain geographically separated disaster recovery or redundant hosting capabilities sufficient to support recovery of the SaaS Solution and State Data following a material failure of the primary production environment.

3. The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within 24 hours from notification, with a recovery point objective of one hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

4. The Contractor shall test the contingency/DR plans at least annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

5. Such contingency and DR plans shall be available for the State to review upon request, together with the results of the most recent test, and subject to regular updating, revising, and testing throughout the term of the Contract.

B. Data Export/Import

1. At no additional cost to the State, the Contractor shall provide the State the ability to export State Data in a commonly used, industry-standard, non-proprietary or otherwise mutually agreed-upon format.

2. Upon request by the State, the Contractor shall provide a full or partial export of State Data within a commercially reasonable timeframe agreed upon by the parties based upon the scope and volume of the requested data. Routine exports available through the Solution shall be accessible to authorized State users without unnecessary Contractor intervention.

3. All imports and exports containing State Data shall be performed using secure methods consistent with the information-security requirements of the Contract.

4. The Contractor shall not withhold State Data because of a contractual dispute or expiration or termination of the Contract, subject to applicable law and the Contract.

C. Data Ownership and Access

1. As set forth in the Contract, data, databases and derived data products created, collected, manipulated, or directly purchased under the Contract are the property of the State. The purchasing State agency is considered the custodian of all State data.

2. The Contractor may not access State data other than as necessary to perform the services under this Contract.

3. At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

11. Information Technology Security

1. The Contractor shall comply with applicable State of Maryland Information Technology Security Policies and Standards applicable to the Solution, Services, and State Data throughout the Contract term. Updated and revised versions of the State IT Policy and Standards are available online at: Policies, Standards, and Guidelines.

2. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State as directed and coordinated with the Contract Monitor. The Contractor shall:

1. For information-security requirements not specifically addressed by applicable State policies and standards, implement administrative, physical, and technical safeguards no less rigorous than generally accepted industry information-security practices appropriate to the SaaS Solution and State Data.

2. Single Sign-On and Multi-Factor Authentication. The Solution shall integrate with the State's designated Identity Provider through Single Sign-On (SSO). Authentication of State users shall be routed through the State's Identity Provider to enable enforcement of applicable State Multi-Factor Authentication (MFA), password, account-management, and access-control requirements.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12. Data Protection and Controls

1. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract according to a written security policy (“Security Plan”) no less rigorous than that of the State and using best practices that comply with an accepted industry standard, such as the NIST cybersecurity framework.

2. The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract. The Security Plan shall be provided to the State upon request and, where required by the State, prior to production deployment. The Contractor shall provide material updates to the Security Plan when changes affecting the security of the Solution or State Data occur.

3. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls during the Contract Term (the Contractor may augment this list with additional controls):

a. Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not utilized in test or training environment(s).

b. Ensure that State data is not commingled with non-State data through the proper application of compartmentalization Security Measures. State Data shall be logically segregated from data belonging to other customers through appropriate tenant isolation, access controls, or equivalent security mechanisms designed to prevent unauthorized access, use, or disclosure.

c. Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and when archived for backup purposes, using encryption that complies with FIPS 140-3. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

d. Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including the Maryland Department of Information Technology’s Information Security Manual.

e. Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The State shall have the right to inspect the logs and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

f. The Contractor shall perform regular vulnerability assessments of systems supporting the Solution and shall remediate identified vulnerabilities in accordance with applicable State security requirements and risk-based remediation timelines appropriate to the severity and exploitability of the vulnerability. Where remediation cannot be completed within the applicable timeframe, the Contractor shall document appropriate compensating controls or a remediation plan. Upon reasonable request, the Contractor shall provide documentation or other reasonable evidence of applicable vulnerability-management activities, subject to confidentiality and security restrictions.

g. Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Contractor Personnel may access State data remotely only as required to provide technical support and with the prior approval of the State.

h. The Contractor shall maintain appropriate anti-malware, endpoint protection, and vulnerability-management controls on Contractor-controlled systems supporting the Solution, consistent with applicable State security requirements and generally accepted industry practices.

i. State-classified Confidential information shall not be transmitted through standard unencrypted email. Such information shall be transmitted through the secure encrypted Solution or another State-approved secure transmission method.

j. Access to State Data shall be restricted based upon authorized roles and the principle of least privilege. Contractor shall maintain access-control mechanisms appropriate to the sensitivity of the State Data processed by the Solution

13. Security Logs and Reports Access

1. Authorized State users shall have access to available audit information applicable to State user activity and State Data, including user access and material administrative activity, to the extent supported by the Solution

2. Upon reasonable request in connection with a suspected or confirmed Security Incident, the Contractor shall provide relevant security log information reasonably necessary to support the State's investigation, subject to applicable security, confidentiality, and third-party restrictions.

14. Security Incident Response

A. The Contractor shall notify the State within twenty-four (24) hours after discovery of a Security Incident that involves or is reasonably suspected to involve State Data or materially affects the State's use of the Solution, unless a shorter notification period is required by applicable law. The Contractor shall provide additional information and updates as material information becomes available. Contractor’s notice shall identify:

a. the nature of the unauthorized use or disclosure;

b. the State data used or disclosed,

c. who made the unauthorized use or received the unauthorized disclosure;

d. what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

e. what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

f. The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

B. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract. The Contractor shall obtain approval from the State prior to communicating with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise.

15. Data Breach Responsibilities A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the Contractor shall, unless otherwise directed:

1. Notify the appropriate State-identified contact within 24 hours by telephone and email to the Maryland Security Operations Center (MD-SOC) in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2. Cooperate with the State to investigate and resolve the data breach;

3. Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4. Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. With respect to State data within the possession or control of the Contractor, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by the State, in consultation with the Contractor, based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

C. The public disclosure of a cybersecurity incident shall be pursuant to Guidelines for the Public Disclosure of Cybersecurity Incidents or any successor thereto.

16. Solution-Specific Security Requirements

1. The Contractor shall cooperate with the State and Early Morning Software, as the software provider, in satisfying security conditions applicable to the Solution throughout the Contract term.

2. Prior to production deployment, the Contractor shall cooperate with the State in completing and executing a Service Interface Agreement (SIA) for the Solution, including requirements governing security controls, system interfaces, State Data, and Security Incident notification consistent with the Security Incident Response and Data Breach Responsibilities requirements of Section 11. The Solution shall not be placed into production use until the SIA has been executed.

3. Contractor Personnel authorized to access State Data shall receive appropriate security and data-handling training applicable to their responsibilities.

4. Prior to production deployment, and thereafter upon request, the Contractor shall provide a Software Bill of Materials (SBOM) for the Solution or, if the software provider does not make an SBOM available, other documentation acceptable to the State reasonably sufficient to support the State's assessment of software supply-chain risk associated with the Solution.

17. State Security Review Rights

Upon reasonable request, the State shall have the right to review documentation or other reasonable evidence necessary to assess the Contractor's compliance with security requirements applicable to the Solution. Such review shall be subject to reasonable confidentiality, security, and third-party restrictions applicable to shared cloud infrastructure.

18. Survival and Flow-Down Obligations relating to confidentiality, State Data protection, Security Incident and Data Breach responsibilities, data return or disposition, and other provisions that by their nature are intended to survive shall survive expiration or termination of the Contract as applicable.

The Contractor shall ensure that applicable security and State Data protection requirements are flowed down to subcontractors and service providers to the extent such entities access, process, store, transmit, or otherwise handle State Data or perform material Services supporting the Solution.

19. SOC 2 Type II Audit Report

1. The Contractor shall ensure that a current independent security assessment applicable to the Solution production environment, such as a SOC 2 Type II Audit Report, is performed at least annually and maintained throughout the Contract term. The assessment shall address security controls relevant to the services provided to the State, including, as applicable, Security, Availability, and Confidentiality.

2. The Contractor shall provide to the Contract Monitor, within thirty (30) calendar days of the issuance of the final SOC 2 Type II Audit Report, the audit results and a documented corrective action plan that addresses each audit finding or exception contained in the SOC 2 Type II Audit Report, identifying in detail the remedial action to be taken by the Contractor along with the date(s) when each remedial action is to be implemented. The scope of the SOC 2 Type II Audit Report shall include work performed by any subcontractors that handle, store, or process Sensitive Data or are responsible for security controls and provide essential support to the Contractor for or essential support to the Information Functions and Processes for the services provided to the State under the Contract. The Contractor shall ensure the audit includes all such subcontractors operating in performance of the Contract or, in the case the subcontractor’s services are covered by a separate SOC 2 Type II Audit, that separate SOC 2 Type II Audit reports are obtained from all subcontractors and submitted to the Contract Monitor via the Contractor’s primary point of contact.

3. If a current SOC 2 Type II Audit Report or other required independent security assessment becomes unavailable during the Contract term, the Contractor shall promptly notify the State and provide alternative independent security assurance documentation reasonably acceptable to the State. The State may require a corrective action plan or other reasonable remediation based upon the nature and risk of the deficiency.

4. If the period covered by the most recent SOC 2 Type II Audit Report does not extend through the date of the State's review, the Contractor shall provide, upon request and if available, an applicable bridge letter or similar documentation addressing material changes to the control environment since the end of the report period

IT Supplemental Effective Date: November 2025