Exhibit B - General Contract Terms and Conditions.pdf

Exhibit B General Contract Terms and Conditions

State University of New York December 10, 2025

The Parties to the attached contract, license, lease, amendment or other agreement of any kind (hereinafter, "Agreement") agree to be bound by the following clauses which are hereby made a part of the contract (the word "Contractor" herein refers to any party other than the State or State University of New York, whether a Contractor, licensor, licensee, lessor, lessee or any other party; the State University of New York shall hereinafter be referred to as “SUNY”):

1. Amendments: The Agreement may be amended at any time only upon prior mutual written consent of the Parties.

Such written amendment will not be effective until signed by both Parties, and if required, approved by the New York State Office of the Attorney General (OAG) and the Office of the State Comptroller (OSC).

2. Prohibition of Contractor Weblinks and “Click-Wrap”/“Shrink-Wrap” Terms

a. Terms and conditions submitted or made unilaterally by the Contractor and accessed through URL hyperlinks, embedded weblinks, or other electronic means (including but not limited to “click-through,” “click-wrap” or “shrink-wrap” terms and conditions accompanying software and/or software updates upon delivery; order forms; purchase orders; or other documentation submitted for payment; notwithstanding SUNY’s subsequent acceptance of same or that SUNY has processed such information for approval and payment) shall not be binding on SUNY or the State of New York. Terms and conditions must be mutually agreed upon and incorporated and attached as an exhibit to this Agreement (or a written amendment to this Agreement signed by the Parties) to be effective and enforceable.

No provisions of pre-printed purchase orders, acknowledgements, or click-through terms may modify this Agreement, and such other or additional terms or conditions are void and of no effect.

b. If Contractor uses third-party software, platforms, or services in connection with the Services it provides pursuant to the Agreement, any terms or conditions (including “click-through,” “click-wrap,” “browse-wrap,” “shrink-wrap,” or similar agreements) that may be presented to or accepted by Contractor in connection with such third-party products will not bind or apply to SUNY, unless and until SUNY reviews and agrees to such terms in a subsequent signed writing. Contractor will not purport to accept any such terms on SUNY’s behalf.

3. Commodity Contract Sales Reports: Upon written request by SUNY, the Contractor shall furnish reports of detailed sales transactions including, but not limited to, the following: Campus, Product Number (or SKU), Product Description, Manufacturer, quantity purchased, unit price and total dollar volume of purchases.

4. Diversity Contracting Requirements

a. Diversity Practices and Equal Employment Opportunity: Contractor agrees to submit, upon SUNY’s request, all required forms relating to its diversity practices, including its efforts to include New York State certified Minority and Women-Owned Business Enterprises (MWBEs) in its business practices. Pursuant to Article 15 of the Executive Law (the "Human Rights Law"), all other State and Federal statutory and constitutional non-discrimination provisions, Contractor will not discriminate against any employee or applicant for employment because of race, creed, color, sex, religion, national origin, military status, sexual orientation, age, disability, genetic disposition or carrier status, domestic violence victim status, or marital status, and will undertake or continue existing programs of affirmative action to ensure that minority group members and women are afforded equal employment opportunities without discrimination, and will make and document its conscientious and active efforts to employ and utilize minority group members and women in its work force during its legal engagement with SUNY. It shall also follow the requirements of the Human Rights Law with regard to non-discrimination based on prior criminal conviction and prior arrest.

b. Service-Disabled Veteran-Owned Businesses (SDVOB): Contractor acknowledges SUNY’s commitment to the

State’s policy of encouraging the development of SDVOBs. The Service-Disabled Veteran-Owned Business Act (the “Act”) became effective on May 12, 2014, and SUNY has implemented the State's comprehensive plan and operational guidelines to promote SDVOBs and to assist them in obtaining opportunities to participate in the procurement of goods and services by the State. SUNY will employ applicable measures and procedures provided by the Director of the Division of Service-Disabled Veterans' Business Development in the Office of General Services (the "Division"), to ensure that SDVOBs are afforded the opportunity for meaningful participation in the performance of SUNY's contracts and to assist in achieving the Act’s statewide goal for participation on state contracts by SDVOBs. Contractor further acknowledges that in the event it willfully and intentionally fails to comply with the SDVOB participation requirements, it shall be liable to SUNY for damages, calculated based on costs for administration of SUNY’s SDVOB program.

c. Encouraging Use of New York State Businesses in Contract Performance: New York State businesses have a substantial presence in SUNY contracts and strongly contribute to the economies of New York and the nation. In recognition of their economic activity and leadership in doing business in New York State, the Contractor is strongly encouraged and expected to consider New York State businesses in the fulfillment of the requirements of this Agreement. Such partnering may be as subcontractors, suppliers, protégés or other supporting roles.

5. Compliance with SUNY Policies: At all times when rendering Services under the Agreement, or when on SUNY premises, all Contractor and subcontractor personnel shall comply with all applicable SUNY regulations, policies, and procedures including, but not limited to:

a. The requirement to wear an identity tag clearly identifying them as being an employee or agent of the Contractor or subcontractor, as applicable.

b. The prohibition against smoking within the buildings or on the grounds owned or leased by SUNY.

c. The parking regulations. Parking violations are subject to fines and are the sole responsibility of the Contractor. All vehicles must be registered with SUNY.

d. SUNY Information Security Policy 6900 and all Procedures and Policies contained and/or referenced therein. See:

https://www.suny.edu/sunypp/documents.cfm?doc_id=848

The Contractor must communicate these policies to its employees, subcontractors (at any level), volunteers, and any other individuals or entities assigned to enter upon SUNY grounds and premises to perform the contract services.

6. Contractor’s Representations and Warranties:

a. The Contractor warrants that the Services it provides under this Agreement will conform substantially to the specifications set out in the Agreement and that all work will be performed in a professional and workmanlike manner, in accordance with the highest applicable industry standards. For purposes of this Agreement, “highest applicable industry standards” shall be defined as the degree of care, skill, efficiency, and diligence that a prudent person possessing technical expertise in the subject area and acting in a like capacity would exercise in similar circumstances.

b. Contractor represents that it is fully capable and willing to provide the Services required by the Agreement; that it has full right and authority to enter into the Agreement; that consent, authorization, order or approval of, or filing or registration with any governmental agency, commission, board, other regulatory body, any person or entity or any corporate affiliates is either not required or has been obtained for or in connection with the execution and delivery of the Agreement by Contractor and the performance of the work hereunder; that it is not a party to, subject to, or bound by, any agreement, judgment, order, writ, injunction or decree which would prevent the carrying out of the Agreement.

7. Insurance: During the term of this Agreement, Contractor must maintain insurance coverage at its own expense as provided in this Section and shall deliver Certificates of Insurance in a form satisfactory to SUNY before commencing any work under this Agreement. Certificates shall reference the Contract Number of this Agreement. Certificates of Insurance must indicate the applicable deductible/self-insured retention on each policy. Certificates shall be mailed to:

[Campus Name and Address] [For System: State University of New York, Attn: Contract Administrator, H. Carl McCall SUNY Building, 353 Broadway, Albany, NY 12246].

https://www.suny.edu/sunypp/documents.cfm?doc_id=848

The policies of insurance set forth below shall be written by companies authorized by the New York Department of Financial Services to issue insurance in the state of New York (“admitted carriers”) with an A.M. Best company rating of “A-” or better. Unless otherwise agreed in writing, policies shall include an endorsement providing that coverage shall not be cancelled, materially changed, or not renewed without at least thirty (30) days prior written notice to the following address (ten (10) days for non-payment of premium) as required by law to: [Campus Name and Address] [For System:

State University of New York, Attn: Contract Administrator, H. Carl McCall SUNY Building, 353 Broadway, Albany, NY 12246].

All insurance policies shall provide that the required coverage shall apply on a primary and not on an excess or contributing basis as to any other insurance that may be available to SUNY for any claim arising from the Contractor’s work under this Agreement, or as a result of the Contractor’s activities. Any other insurance maintained by SUNY shall be excess of and shall not contribute with the Contractor’s insurance, regardless of any “other insurance” clause contained in any SUNY policy of insurance. All policies must include a waiver of subrogation in favor of the People of the State of New York, the State University of New York, and other entities authorized to utilize the Agreement, and their officers, agents, and employees, to the extent permitted by law.

At least two weeks prior to the expiration of any policy required under this Agreement, evidence of renewal or replacement of policies of insurance with terms no less favorable to SUNY than the expiring policies shall be delivered to SUNY in the manner required for service of Notice under this Agreement. Contractor shall obtain and maintain in full force and effect, insurance with limits not less than those described below, or as required by law, whichever is greater (limits may be provided through a combination of primary and umbrella/excess policies):

a. Commercial General Liability Insurance: Insurance covering the liability of Contractor for bodily injury, property damage, and personal/advertising injury from all work and operation under this Agreement. The limits under such policy shall not be less than the following:

i. Each Occurrence Limit: One Million Dollars ($1,000,000.00)

ii. General Aggregate: Two Million Dollars ($2,000,000.00) in the aggregate

iii. Products/Completed Operations Aggregate: Two Million Dollars ($2,000,000.00)

iv. Personal/Advertising Injury: One Million Dollars ($1,000,000.00)

v. Damage to Rented Premises: Fifty Thousand Dollars ($50,000.00)

vi. Medical Expenses: Five Thousand Dollars ($5,000.00)

Coverage shall include, without limitation, the following:

i. Premises liability;

ii. Independent contractors;

iii. Blanket contractual liability, including tort liability of another assumed in a contract;

iv. Defense and/or indemnification obligations, including obligations assumed under this Agreement;

v. Cross liability for additional insureds;

vi. Products/completed operations for a term of no less than three (3) years, which commences upon acceptance of the work as required by this Agreement; and

vii. Contractor means and methods, where applicable.

Labor Law Coverage: If the work under the Agreement involves any construction, renovation, maintenance, or repair work performed on SUNY premises, the CGL policy shall not exclude coverage for claims arising under New York Labor Law Sections 200, 240, or 241. Contractor shall provide written confirmation of this upon request.

b. Comprehensive Business Automobile Liability: Insurance covering liability arising out of the use of any motor vehicle in connection with the work, including owned, leased, hired and non-owned vehicles bearing, or under the circumstances under which they are being used, required by the Motor Vehicle Laws of the State of New York to bear, license plates. Such policy shall have a minimum combined single limit for Bodily Injury and Property Damage of Two Million Dollars ($2,000,000.00) and shall name the People of the State of New York, the State University of New York, and other entities authorized to utilize the Agreement, and their officers, agents, and employees, as additional insureds. The limits may be provided through a combination of umbrella/excess liability policies.

In the event that Contractor does not own or lease any vehicles to fulfill the requirements of this Agreement, Contractor must attest to that fact in writing. If at any time during the Agreement term Contractor acquires or leases any vehicles for use under this Agreement, Contractor shall immediately obtain compliant coverage and provide evidence to SUNY within ten (10) days of binding.

c. Technology Errors and Omissions Insurance (Required where Contractor is providing technology-related services): Contractor shall procure and maintain Technology Errors and Omissions insurance with a limit of at least $2,000,000.00 per claim and in the aggregate covering the negligent acts, errors, or omissions of Contractor in the provision of professional services required under this Agreement, for damages arising from computer-related services including, without limitation, the following:

i. Consulting;

ii. Data Processing;

iii. Programming;

iv. System Integration;

v. Hardware or Software Development;

vi. Installation;

vii. Distribution or Maintenance;

viii. Systems Analysis or Design;

ix. Training;

x. Staffing or Other Support Services; and

xi. Manufactured, Distributed, Licensed, Marketed or Sold Cloud Computing Services.

The limits may be provided through a combination of primary and excess/umbrella liability policies. The policy shall include coverage for third party fidelity if the same is not provided as part of the Data Breach and Privacy/Cyber Liability insurance. If the insurance is written on a claims-made basis, Contractor shall purchase, at its sole expense, an Extended Discovery Clause (“tail coverage”) providing coverage for up to three (3) years after the work is completed if coverage is cancelled or not renewed.

Alternative to Technology Errors and Omissions Insurance Above (Professional Services)

Professional Liability Policy: Insurance (errors and omissions) in the amount of One Million Dollars ($1,000,000.00), which shall be maintained for a period of three (3) years after expiration or termination of the Agreement. If said policy is issued on a claims-made policy form, the policy shall be purchased with extended Discovery Clause coverage of up to three (3) years after work is completed if coverage is cancelled or not renewed.

Note: The People of the State of New York, the State University of New York, and other entities authorized to utilize the Agreement, and their officers, agents, and employees, shall not be named as an additional insured under any professional liability policy.

d. Data Breach and Privacy/Cyber Liability: Contractor shall maintain Data Breach and Privacy/Cyber Liability insurance throughout the term of the Agreement and for any additional period required under this Section. Coverage must include liability for failure to safeguard confidential, proprietary, or personal information; failure of the security of Contractor’s computer systems; and any resulting unauthorized access to SUNY’s or other Authorized Users’ data. Said insurance shall be maintained with a minimum of Ten Million Dollars ($10,000,000.00) for each occurrence. The limits may be provided through a combination of primary and excess/umbrella liability policies. The insurance shall provide coverage for damages arising from, without limitation, the following:

i. Breach of duty to protect the security and confidentially of nonpublic proprietary corporate information;

ii. Breach of a duty to protect the security and confidentiality of personally identifiable nonpublic information (i.e.: medical, financial or personal in nature in electronic and non-electronic form)

iii. Privacy notification, credit monitoring, and related incident response costs

iv. Regulatory defense and penalties;

v. Website media liability; and,

vi. Cyber theft of property, including but not limited to money and securities.

If the policy is written on a claims-made basis and does not provide the same, it must be endorsed to provide proof that it has an Extended Discovery Clause (also known as “tail coverage”) providing coverage for up to three (3) years after the work is completed in the event that the coverage is cancelled or not renewed.

If, in SUNY’s reasonable judgment, the Contractor’s performance under this Agreement involves the collection, storage, transmission, or processing of a substantial volume of personally identifiable information (PII) or other confidential data on behalf of SUNY or an Authorized User, SUNY may require that the Contractor’s cyber liability policy name the State University of New York and/or an Authorized User as a loss payee with respect to any amounts payable for notification, credit monitoring, or other remedial costs incurred by SUNY due to a covered data breach.

e. Workers Compensation, Disability Benefits, and Paid Family Leave: Coverage for the life of the Agreement for the benefit of employees required to be covered by the New York State Workers Compensation Law and the New York State Disability Benefits and Paid Family Leave Law. Evidence of coverage must be provided on forms specified by the Commissioner of the New York State Workers’ Compensation Board.

f. Owners and Contractors Protective (OCP) Liability: If the Contractor is performing construction, major renovation, or other high-risk physical work, the Contractor shall provide an Owners and Contractors Protective (OCP) Liability Insurance policy that provides primary coverage with limits of at least $1,000,000 per occurrence and $2,000,000 aggregate (or higher at SUNY’s discretion). The policy must name the People of the State of New York, the State University of New York, and other entities authorized to utilize the Agreement, and their officers, agents, and employees, as the insured.

SUNY reserves the right to inspect any coverage and request copies of actual policies. Failure to maintain the required insurance may be deemed a material breach of this Agreement.

8. Data Privacy and Security Requirements:

All information and data of any kind, provided or made available by SUNY, SUNY students, or SUNY End Users to Contractor, for the authorized purposes of this Agreement, regardless of form, format or content, is and at all times shall be exclusively owned by, and under the exclusive control of, SUNY (collectively “SUNY Data”). [Campus Agreement: SUNY Data is further defined in Appendix 1, attached hereto and made a part hereof.] [System-Wide Agreement: SUNY Data is further defined in Appendix 1, which will be attached to the Exhibit H SUNY Institution Sample Order Form for each Campus and made a part thereof.] When Contractor accesses, creates, receives, processes, maintains or transmits SUNY Data, Contractor expressly represents and warrants that Contractor will comply with the following requirements to safeguard SUNY Data:

a. Data Privacy; General Requirements

i. All SUNY Data shall be considered to be confidential and shall be treated as such by Contractor, and its employees, agents, volunteers, consultants, subcontractors and sub-subcontractors of any level (collectively, “Authorized Representatives”). For purposes of this Section, references to Contractor shall be deemed to include Contractor’s Authorized Representatives.

ii. Contractor will only use SUNY Data for the purpose of fulfilling Contractor’s duties under the Agreement for the benefit of SUNY and will not share such data with, or disclose it to, any third party without the prior written consent of SUNY, except as required by the Agreement or as otherwise required by law. If Contractor is required by law or legal process to disclose any Confidential Information, it shall:

A. Provide SUNY with prompt written notice before making the disclosure, unless prohibited by law; and B. Cooperate with SUNY’s efforts to limit or prevent such disclosure, including seeking protective orders or similar remedies.

iii. All SUNY Data, including but not limited to student data, academic records, personal information, and any data provided to or made available to Contractor, and/or generated through use of the Services (regardless of form, format, or content), shall remain the sole property of SUNY. Contractor shall have no title, ownership rights, or claims to any such SUNY Data.

iv. To the extent any Services include the use of Artificial Intelligence (“AI”) systems and technologies:

A. Use of SUNY Data to develop or train AI Systems, or to build upon an AI System model, shall require the prior written consent of SUNY, which consent (if approved) may be subject to any such conditions as SUNY may determine are necessary to: (I) comply with current or future applicable laws, rules, regulations, guidelines, policies, and/or procedures; (II) protect the privacy and security of SUNY Data; and/or (III) manage risk, and promote accountability, safety, and fairness and equity. Execution of this Agreement does not constitute such consent.

B. Use of any AI System in any manner that would authorize (or have the effect of authorizing) automatic decision-making without any human oversight shall be prohibited.

C. Use of any AI System in a manner that would result in (or have the effect of resulting in) any discrimination or bias, as defined under applicable New York State or federal laws, rules, and/or regulations, shall be prohibited.

D. For purposes of this Agreement, “AI Systems” or an “AI System” shall include but not be limited to any system or technology utilizing machine learning (“ML”), large language modeling (“LLM”), natural language processing and/or computer vision technologies, including but not limited to generative AI, frontier AI, algorithms or other computational models. “AI Systems” or “AI System” shall not include basic calculations, basic automation, or pre-defined conditional If This Then That (“ITTT”) response systems.

v. Contractor shall not anonymize, aggregate, or otherwise process student or SUNY Data in a manner that could enable its use for AI training or other unauthorized purposes, even if the SUNY Data is de-identified.

vi. Any use of SUNY Data for marketing or advertising purposes is strictly prohibited.

vii. To the extent any SUNY Data is provided to Contractor in de-identified, anonymized, pseudonymized, or another masked or encrypted form, and except as expressly authorized or required pursuant to this Agreement, Contractor shall be prohibited from re-identifying any SUNY Data (including without limitation personal information protected by the New York State Privacy Protection Law, Article 6-A of the NYS Public Officers Law (“PPPL”), and education records or personally identifiable information (“PII”) from education records protected by Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) (“FERPA”)), in whole or in part, through any means, including without limitation, any system, algorithm, computational model, AI, ML, LLM, or other software or technology.

viii. Contractor will ensure that Contractor and its Authorized Representatives, and any providers of services or technology solutions utilized by Contractor to fulfill Contractor’s duties under this Agreement, shall comply with pertinent provisions, as may from time to time be amended, of this Agreement; applicable federal and New York State laws, rules and/or regulations; and the policies, procedures and other requirements of SUNY and/or the SUNY Board of Trustees, as applicable to the privacy, use and security of SUNY Data.

A. Contractor will provide access to SUNY Data only to its employees and subcontractors who need to access the data to fulfill Contractor’s obligations for the benefit of SUNY under the Agreement.

B. Contractor will ensure that its employees and other Authorized Representatives, and any providers of services or technology solutions utilized by Contractor to fulfill Contractor’s obligations for the benefit of SUNY under this Agreement, are expressly informed of the limitations on access and use of SUNY Data, and have read, understood, and received appropriate instruction as to how to comply with the data protection provisions of this Agreement.

C. Contractor will ensure that its employees and other Authorized Representatives, and any providers of services or technology solutions utilized by Contractor to fulfill Contractor’s obligations for the benefit of SUNY under this Agreement, protect all SUNY Data with reasonable data security measures and procedures consistent with this Agreement, which shall include physical and/or technological access controls.

D. Contractor shall execute a written agreement with each of its subcontractors and shall require all subcontractors to execute with their sub-subcontractors (at any level) a written agreement which shall bind each to the terms and provisions of this Agreement, insofar as such terms and provisions are applicable to the work to be performed by such subcontractors or sub-subcontractors (at any level). Contractor shall require all subcontractors and sub-subcontractors (at any level) to promptly file with SUNY upon request a copy of such agreements, from which the price and terms of payment may be deleted.

ix. Location and Use of Data: SUNY Data will not be stored, processed, backed up, acted upon, archived or otherwise retained on systems physically located outside the United States without prior written consent from SUNY and execution of this Agreement is not considered prior written consent. For purposes of this Agreement, “stored” includes, but shall not be limited to, any form of housing, retention, or persistent caching of data.

x. Federal Data Security Program (DSP) (28 C.F.R. Part 202): To the extent applicable, Contractor shall not engage in any data “transfer” or other “transaction” constituting a “covered data transaction” that allows “access” by a “country of concern” or “covered person” to “bulk U.S. sensitive personal data” or U.S.

“government-related data,” as defined by the U.S. Department of Justice’s Final Rule implementing Executive Order 14117, codified at 28 C.F.R. Part 202, as it may be amended from time to time. In compliance therewith, Contractor shall not transmit to or otherwise store SUNY Data with any prohibited party and must implement and maintain security measures consistent with applicable guidance. For avoidance of doubt: (A) Contractor shall not engage in any “restricted transaction” subject to Subpart D of 28 C.F.R. Part 202 without the prior written consent of SUNY pursuant to a written agreement signed by the Parties; and (B) execution of this Agreement shall not constitute such consent. Contractor must also promptly report suspected or actual violations and agrees that SUNY may audit compliance with these obligations upon reasonable written notice.

xi. FERPA Compliance: In addition to any other privacy and/or confidentiality obligations herein, Contractor agrees that any disclosure by SUNY of education records and/or student PII from education records is subject to applicable law including FERPA and any implementing regulations (20 U.S.C. § 1232g; 34 CFR Part 99). With respect to any such disclosure, Contractor agrees to the following: (A) that Contractor’s use of education records and/or PII from education records will be limited to those purposes expressly authorized in this Agreement; and (B) that Contractor will abide by the limitations on re‐disclosure of education records and/or PII from education records as set forth in FERPA; and (C) that, unless the Parties designate another exception in the Agreement, any disclosure of education records and/or PII from education records is done so pursuant to the “school official” exception to FERPA, Contractor is a “school official” with a “legitimate educational interest” in any education records and/or PII from education records disclosed, and Contractor is under the direct control of SUNY with respect to the use and maintenance of any such education records and/or PII from education records. Education records and/or PII from education records are as defined in FERPA and include any and all records, data, or information related to any student or students of SUNY. This obligation shall survive termination of this Agreement.

xii. European Union (“EU”) General Data Protection Regulation (“GDPR”) and Other International Data Privacy and Security Laws and Regulations: Unless otherwise agreed in writing by both Parties, Contractor, as well as any subcontractors Contractor may engage (at any level) to perform any of Contractor’s obligations under the Agreement, shall be solely responsible for compliance with the EU GDPR 2016/679 and the European Artificial Intelligence Act (Regulation (EU) 2024/1689), if applicable, and any other international data privacy and security laws and regulations that may be applicable to the proposed solution, if any (e.g. China Personal Information Protection Law or “PIPL”).

xiii. Gramm-Leach-Bliley Act: Pursuant to the Gramm-Leach-Bliley Act (P.L. 106-102) and the Federal Trade Commission’s Safeguards Rule (16 CFR Part 314) (“GLBA”), and to the extent Contractor is a financial institution or service provider of SUNY under these regulations with respect to student or customer information, Contractor will comply with the Safeguards Rule including the requirement to implement and maintain a written Information Security Program (“Program”) in order to protect such nonpublic customer information (any record containing nonpublic personal information as defined in 16 CFR §313.3(n), whether in paper, electronic, or other form that is handled or maintained by or on behalf of SUNY or SUNY affiliates (16 CFR §314.2)). Examples may include, but are not limited to, name, address, phone number, Social Security Number, bank/credit account information, and student ID numbers.

xiv. HIPAA: Contractor will comply with all personal health information protection requirements, if applicable, of the United States Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information, promulgated pursuant to the administrative simplification provisions of the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as set forth in 45 C.F.R.

Subtitle A, Subchapter 3, Parts 160 and 164 (as now or hereafter amended or superseded), and shall complete the HIPAA Business Associate Agreement if so required.

xv. NYS Personal Privacy Protection Law: Contractor will comply with applicable provisions of the New York State Privacy Protection Law (NY Public Officers Law §§91-99) and the University’s implementing regulations under 8 NYCRR § 315. See SUNY Other Requirement 6603 Compliance with Personal Privacy Protection Law: https://www.suny.edu/sunypp/documents.cfm?doc_id=539.

b. Mandatory Data Security Requirements

Contractor agrees at all times to maintain industry standard information and critical infrastructure security features and protocols, which at a minimum, include: network firewall provisioning; intrusion detection; Distributed Denial of Service (DDoS) threats of a minimum of two terabits per second; the use of network monitoring and protection tools monitored 24/7/365 by security analysts; and regular (at least annually) third-party vulnerability assessments, or equivalent, including providing SUNY a copy of the annual Attestation of Compliance (AOC) document, if requested. Further, Contractor agrees to maintain information and critical infrastructure security that conforms to generally recognized “Industry Standards” and best practices that Contractor applies to its own network, infrastructure, applications and data.

Generally recognized Industry Standards include but are not limited to the current standards and benchmarks set forth and maintained by the Center for Internet Security (see http://www.cisecurity.org) or Payment Card Industry/ Data Security Standards (“PCI/DSS”) (see http://www.pcisecuritystandards.org).

Contractor will maintain a data security plan (“Data Security Plan”), which will comply with applicable PCI/DSS requirements and all applicable legal and regulatory requirements for data protection. In addition, the Data Security Plan will protect against any anticipated threats or hazards to the security or integrity of information stored on its servers and unauthorized access to or use of such information that could result in harm or inconvenience to the person who is the subject of such information. Contractor will review, at least annually, its Data Security Plan and update and revise it as needed. A copy of Contractors’ Data Security Plan, or equivalent, will be made available to SUNY upon request.

Contractor shall maintain mandatory procedures and protocols outlined in its “Information Security Incident Response Policy” to be undertaken in the event of an identified or suspected breach of credit card information or current or former student education records (and/or PII from education records) that is not Directory Information as defined in FERPA. A copy of Contractor’s Information Security Incident Response Policy, or equivalent, will be made available to SUNY upon request. In the event a breach is suspected, Contractor will: (i) immediately contain the possible exposure while not compromising any data on its system; (ii) contact all members of its Corporate Security Committee; (iii) initiate a local analysis within 24 hours of the suspected breach to determine the type of information that has been potentially compromised, the individuals and SUNY Institutions and Other Authorized Users at risk, the incident time frame at risk and the suspected cause of the incident; and (iv) if a breach is identified, immediately contact affected parties with details of the breach.

Contractor must have integrated continuous security testing into its code and build development process, including the following processes: (i) Static Application Security Testing (SAST): Analysis of source code and binaries to identify security vulnerabilities; (ii) Dynamic Application Security Testing (DAST): The execution of simulated attacks on live applications to detect runtime vulnerabilities; and (iii) Software Composition Analysis (SCA): Evaluation of all software components, including external libraries and dependencies, to identify security risks within the codebase.

Contractor agrees to provide evidence of compliance with these requirements before this Agreement becomes effective and at any other time upon reasonable request of SUNY. The following report(s) and/or certification(s) shall be prepared by Contractor and made available to SUNY:

1. A Higher Education Community Vendor Assessment Tool (HECVAT) spreadsheet report completed by Contractor and provided to the SUNY Chief Information Security Officer (CISO).

And

2. Either:

https://www.suny.edu/sunypp/documents.cfm?doc_id=539 http://www.cisecurity.org/ http://www.pcisecuritystandards.org/

a. A completed up-to-date SOC 2 Type 2 report pursuant to Statement on Standards for Attestation Engagements (SSAE) 18, and issued by an independent third-part auditor, that includes the Security, Availability, Confidentiality, and Privacy of all SUNY Data and the technology solution comprising the Services provided by Contractor to SUNY pursuant to this Agreement.

Or

b. An up-to-date ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) certification from an accredited body, prepared pursuant to ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements, and accompanied by the Statement of Applicability (SoA) showing which controls are in scope, and covering all people, systems, and locations involved in delivering the product and/or services to SUNY.

3. Contractor agrees to address the ability to provide the same levels and types of security through multiple data access methods (e.g., Web, mobile devices, or network).

4. Required Time Periods

a. Each reporting or certification period shall cover the previous twelve (12) consecutive months.

b. Report(s) and/or certification(s) shall be provided to SUNY annually and within fifteen (15) days of final issuance by the Contractor (HECVAT), independent third-party auditor (SOC 2) and/or independent third-party accredited body (ISO/IEC certification).

c. Report(s) and/or certification(s) shall be provided to SUNY no later than fifteen (15) months after the end date of the previous annual report.

d. For report(s) and/or certification(s) with an end date of greater than ninety (90) days from the date of receipt by SUNY, the Contractor shall provide a bridge letter signed by executive management attesting: (I) that no material changes have occurred which would adversely affect the report and/or certification’s conclusions; and (II) that any new high-severity control deficiencies discovered since the report or certification end date are disclosed and accompanied by a remediation plan and/or corrective action plan.

The HECVAT, and the SOC 2 Type 2 report or ISO/IEC certification, must be completed by the appropriate experts in these areas. Failure to comply with these Mandatory Data Security Requirements (including without limitation, any suspension, withdrawal, or non-renewal of a report or certification and/or failure to implement corrective action plan or agreed-upon remediation plan within the required time frame(s)) shall constitute a breach of the Agreement.

c. Other Mandatory Information Security and Service Requirements

i. Compliance With Breach Notification and Data Security Laws: The Contractor shall comply with all applicable federal and New York State data protection and breach notification laws, including the New York State Information Security Breach and Notification Act (General Business Law § 899-aa; State Technology Law § 208) (“ISBNA”), the Stop Hacks and Improve Electronic Data Security Act (General Business Law § 899-bb) (“SHIELD Act”), the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act (“GLBA”), and any other applicable statute, rule, or regulation governing the collection, use, security, or disclosure of personally identifiable information or sensitive data.

The Contractor shall implement and maintain appropriate administrative, physical, and technical safeguards to protect the security, confidentiality, and integrity of any private information (as defined by ISBNA) and other SUNY Data to which it has access in connection with the performance of this Agreement.

In the event that the Contractor becomes aware of or reasonably suspects any actual or suspected unauthorized acquisition, access, use, or disclosure of SUNY Data (“Security Incident”), the Contractor shall:

(1) notify SUNY in writing without unreasonable delay, and in no event later than two (2) business days after discovery of the Security Incident;

(2) take all reasonable measures to investigate, contain, and remediate the Security Incident;

(3) cooperate fully with SUNY, including providing access to relevant records, personnel, and systems as necessary to support SUNY’s investigation and response; and

(4) comply with all applicable legal requirements concerning breach notification and mitigation.

SUNY shall have the sole discretion to determine the content, method, and recipients of any required notifications to affected individuals or government agencies. If the Security Incident is caused by the negligent or willful acts or omissions of the Contractor or its officers, employees, agents, consultants, or subcontractors (at any tier), the Contractor shall be responsible for all reasonable costs and expenses incurred by SUNY in connection with the Security Incident, including investigation, remediation, notification, and credit monitoring services, if applicable.

Upon expiration or termination of this Agreement, the Contractor shall, in accordance with instructions provided by SUNY, return or securely destroy all SUNY Data in its possession. If destruction is authorized, the Contractor shall certify in writing that such data has been irretrievably destroyed using industry-standard methods consistent with ISBNA, SHIELD, and any other applicable law to prevent unauthorized access to or use of SUNY Data and will render the private information so that it cannot be read or reconstructed.

ii. Service Level Requirements: Contractor will ensure availability of the Services in accordance with the provisions of the Agreement and, if applicable, Exhibit E: Service Level Agreement, attached hereto and made a part hereof.

iii. Disaster Recovery: Contractor shall maintain disaster recovery services at the dedicated facility that is able to handle SUNY Data and business continuity needs under the Agreement in the event disaster recovery is needed. Throughout the term of the Agreement, Contractor shall maintain contracts or arrangements that are substantially equivalent or an improvement to those currently in effect. Contractor shall test disaster recovery capabilities at least once every calendar year and provide SUNY with a copy of its disaster recovery plan, or equivalent, upon request.

iv. Business Continuity: Contractor at all times must have a business continuity plan in place designed to minimize the risks associated with a disaster or similar incident impacting Contractor’s ability to provide Services under the Agreement.

v. Data Portability: Contractor agrees that SUNY owns the SUNY Data generated, received, or maintained in connection with the Agreement. At SUNY’s direction, Contractor shall take all steps and actions that are necessary and reasonable to facilitate and complete the orderly, efficient, expedient, and professional transfer of SUNY Data, in whole or in part, to SUNY, a SUNY Institution, or third-party designated by SUNY. Such transfer shall occur during the Term and/or upon expiration or termination of the Agreement and shall be completed in the format and on the media specified by SUNY. All costs related to such transfer services shall be at no additional expense to SUNY.

vi. Destruction of SUNY Data:

A. Timing and Method of Destruction: Upon the expiration or termination of the Agreement and following completion of the transfer obligations under Section 8(c)(v), Contractor shall, unless otherwise directed in writing by SUNY, complete the destruction of all SUNY Data in its possession or control no later than thirty (30) calendar days after such expiration, termination, or direction. Destruction shall apply to all forms and media of SUNY Data, including written, electronic, or other formats, and shall include physical and electronic copies, partial files, notes, derivative materials, working files, and backups. All destruction shall be performed in accordance with the National Institute of Standards and Technology (NIST) Guidelines for Media Sanitization, Special Publication 800-88 Revision 1 (December 2014), as now or hereafter amended or superseded (NIST SP 800-88).

Contractor shall provide SUNY with a signed and dated Certificate of Sanitization in a format substantially similar to Appendix G of NIST SP 800-88 within ten (10) business days following the completion of such destruction.

B. Retention of Required Records: Notwithstanding Section 8(c)(vi)(A), Contractor may retain only the minimum amount of administrative Records necessary to demonstrate compliance with the Agreement, and only for the period required under Section 10 of Exhibit A (SUNY Standard Contract Clauses). Contractor shall complete destruction of such Records no later than thirty (30) calendar days after the end of the required retention period. Destruction shall be carried out in accordance with NIST SP 800-88, and Contractor shall provide SUNY with a signed and dated Certificate of Sanitization, in a format substantially similar to Appendix G of NIST SP 800-88, within ten (10) business days following the completion of destruction. Except for the limited retention described in this subsection, Contractor shall not retain any SUNY Data or Records following expiration or termination of the Agreement without prior written authorization from a duly authorized SUNY representative.

C. Survival: The obligations set forth in Section 8(c)(v) and Section 8(c)(vi) shall survive the expiration or termination of the Agreement for so long as Contractor retains any SUNY Data or Records in any form or media.

9. Diesel Emissions Reduction Act of 2006 (the “Act”): If Contractor operates any diesel powered heavy duty vehicle(s) pursuant to the Agreement, Contractor certifies and warrants that all such heavy duty vehicles, as defined in New York State Environmental Conservation Law (ECL) Section 19-0323, will comply with the specifications and provisions of ECL Section 19-0323 and any regulations promulgated pursuant thereto, including but not limited to, 6 NYCRR Part 248, which requires the use of best available retrofit technology and ultra-low sulfur fuel. If needed, qualification for a waiver will be Contractor’s responsibility. If applicable, annually, but no later than March 1st, Contractor shall complete and submit directly to SUNY, via electronic mail, the “Regulated Entity and Contractor Vehicle Inventory Form” and “Regulated Entity and Contractors Annual Report Form” that can be found at the New York State Department of Environmental Conservation (“DEC”) website: http://www.dec.ny.gov/chemical/4754.html. SUNY reserves the right to require Contractor to periodically certify compliance with the provisions of ECL Section 19-0323.

10. Dispute Resolution: At SUNY’s sole option, the Parties shall attempt in good faith to resolve any dispute arising under this Agreement through informal discussions. If the Parties are unable to resolve the dispute within thirty (30) calendar days of written notice of the dispute, either Party may pursue available legal or equitable remedies.

11. Electronic and Information Technology (“EIT”) Accessibility:

a. SUNY is committed to providing an accessible, usable, and integrated experience for all its students, staff and community. Electronic and information technology (“EIT”) consists of information technology and any equipment or interconnected system or subsystem of equipment that is used in the creation, conversion, or duplication of data or information that will be deployed in connection with such technology, equipment or systems. Further, EIT includes, but is not limited to, telecommunications products, information kiosks and transaction machines, Internet and Intranet websites, web-delivered content (including without limitation word processing, spreadsheet, presentation files, and PDF files), software, mobile applications, electronic books and electronic book reading systems, search engines and databases, multimedia, classroom technology, and office equipment.

b. Contractor warrants that all EIT and the technology solution comprising the Services shall conform to all current and future applicable state and/or federal accessibility laws, rules, regulations, and/or standards, and/or the policies of the State of New York and/or the SUNY Board of Trustees, including but not limited to the following:

http://www.dec.ny.gov/chemical/4754.html

i. New York State Executive Law § 170-f, requiring that every contractor, subcontractor, vendor, consultant, or other person providing services pursuant to a state contract shall conform any website provided by such contractor, subcontractor, vendor, consultant, or other person in relation to and for the provision of such services to the most current version of the Web Content Accessibility Guidelines (“WCAG”) adopted by the World Wide Web Consortium for accessibility, or successor standards (currently WCAG 2.2, released October 05, 2023);

ii. Title 28, Code of Federal Regulations, Part 35 (28 C.F.R. Part 35), Subpart H Web and Mobile Accessibility, §§ 35.200 – 35.209, Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities, as now or hereafter amended, addressing, among other things, web content and mobile app accessibility, and currently referencing best practices of WCAG 2.1 AA (regulations effective June 24, 2024) (regulatory compliance date April 24, 2026);

iii. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d), and its implementing regulations set forth at Title 36, Code of Federal Regulations, Part 1194 (36 C.F.R. Part 1194), as now or hereafter amended; and

iv. To the extent applicable, Section 504 of the Rehabilitation Act of 1973, as amended (29 U.S.C. §

794), and its implementing regulations set forth at Title 45, Code of Federal Regulations, Part 84 (45 C.F.R. Part 84), as now or hereafter amended, addressing, among other things, requirements related to providing accessible web content, mobile…