Exhibit E_Cloud Terms.docx

EXHIBIT E

COMMONWEALTH OF VIRGINIA

CLOUD TERMS AND CONDITIONS

These additional terms and conditions for provision of Software as a Service, as part of the contractual obligations of (insert name of Supplier) (“Supplier”), for an overall solution provided by the Supplier are in support of and incorporated herewith under Contract No. ___________. This Exhibit (“Exhibit”) sets forth additional terms and conditions under which Supplier shall provide such Cloud Services (as hereinafter defined) to Public Body.

In the event of any conflict or inconsistency between the Commonwealth of Virginia Cloud Terms and Conditions and any other contract provisions or terms, any Supplier policy, or any third-party term or condition, the Commonwealth’s Cloud Terms and Conditions shall be controlling.

1. Definitions As used in the following terms:

a) “Active Oversight” refers to the ongoing monitoring process conducted by the COV Ramp team, which involves reviewing compliance reports regularly submitted by the application vendor.

b) “Approved Application List” means the catalog of applications available on the VITA website that have successfully completed the COV Ramp assessment and met the required standards. To remain on this list, applications must comply with the following conditions:

1. the vendor must agree to the established cloud terms, and

2. the application must achieve Active Oversight status within one year of approval

c) “Cloud Services” means, (insert the name of the Cloud Services), the application(s) and/or services that Public Body subscribes to, licenses, or otherwise obtains from Supplier and that are not hosted in a Commonwealth of Virginia facility.

d) “Content” means any data (including the selection, arrangement, and organization of such data) entered, uploaded, or otherwise provided to Supplier by Users.

e) “Contract” means these Commonwealth of Virginia Cloud Terms and Conditions and all other documents that constitute the public contract between Supplier and Public Body for the procurement of the Cloud Services. [Edit this as appropriate to ensure it includes all contract documents.]

f) “Supplier” means (insert name), the entity with which Virginia Department of Education (VDOE or “Public Body”) is contracting.

g) “Users” means personnel of Public Body (whether employees or independent contractors) and other persons who are authorized by Public Body to access or use the Cloud Services or who are persons with whom Public Body may find it necessary or desirable to interact through or in connection with the Cloud Services in pursuit of its business.

2. Compliance with Commonwealth Standards:

The Cloud Services shall be provided in compliance with Commonwealth information security standards SEC530 (Information Security Standard) and SEC514 (Removal of Commonwealth Data from Electronic Media Standard), current versions of which are located on VITA’s public website (https://www.vita.virginia.gov/policy--governance/policies-standards--guidelines/) under Information Security, as agreed upon in Supplier’s COV Ramp assessment, provided to VITA on [INSERT DATE ASSESSMENT REQUEST WAS SUBMITTED]. In addition, Supplier shall ensure that the Cloud Services are not provided in any way that prevents Customer from compliance with other Commonwealth security standards.

Supplier shall comply with the following contractual requirements:

<insert any contractual requirements resulting from COV Ramp Assessment>

3. Prohibited Information Technology:

In accordance with Virginia Code § 2.2-5514, Supplier shall not use any hardware, software, or services that have been prohibited for use on Commonwealth systems. Further information on prohibited information technology is available in Commonwealth Information Security Policy SEC 528.

4. Content Privacy and Security:

Supplier shall provide the Cloud Services in a secure environment that protects the privacy and security of the Cloud Services and of the Content.

Supplier understands that Content is intended solely for the business of Public Body and is subject to certain confidentiality and/or privacy protections under Virginia law. Accordingly, Supplier agrees to consider all Content of Public Body private data and not to disclose Content other than as authorized in writing by Public Body or required by applicable law. If required by applicable law to disclose Content, Supplier agrees to provide written notice in advance to Public Body unless Supplier is prohibited by law from providing such notice.

Supplier shall, at all times, remain compliant with privacy and security requirements of applicable federal, state, and local law.

5. Geographic Restriction on Content and Personnel:

All Content shall be stored, processed, and maintained within the United States at all times.

6. Return and Destruction of Content:

Using secure and usable protocols and methods, and in a usable electronic format, Supplier shall enable the export of Content (including associated metadata) to Public Body promptly upon request and at the conclusion of the Contract, without additional financial or contractual requirements.

If Supplier does not have a written, publicly accessible, and binding policy concerning destruction of data sufficient to demonstrate destruction of Content after the expiration or termination of the provision of the Cloud Services to Public Body, then within fifteen (15) business days after the expiration or termination of this Contract, Supplier shall confirm in writing to Public Body that all Content has been removed from all systems where the Content resided during provision of the Cloud Services in a manner that complies with and/or exceeds SEC514, the Commonwealth Data Removal standard. The written confirmation shall describe (i) the processes and procedures used in removing the Content, (ii) the locations from which it was removed, and (iii) the date the removals were performed.

7. Incident Reporting and Cooperation:

Supplier agrees to notify Public Body in writing of all incidents related to Public Body’s tenant environment or the Cloud Services that threaten or could potentially threaten the security of Public Body's Content and/or Public Body’s use of the Cloud Services. Notice for each incident shall be provided within 24 hours from when the incident was discovered. This notice is required to allow the Commonwealth to commence any necessary internal actions to address or remediate such incident. Supplier shall fully cooperate with Commonwealth incident response and law enforcement personnel as needed with respect to the handling and reporting of security incidents. If a temporary suspension of use of the Cloud Services by Public Body, as directed by the Chief Information Officer of the Commonwealth (“CIO”), becomes necessary related to a security incident, the Supplier further agrees not to impose any penalty on Public Body.

8. Prior Notifications In order to allow sufficient time to consider and discuss significant changes, Supplier agrees to provide written notification to Public Body and VITA in advance as follows:

a) At least thirty (30) days notice prior to replacing or adding a subcontractor or any other third-party that will have non-public access to Content.

b) At least 60 days notice prior to a material change in the security of the Cloud Services (as measured against the initial COV Ramp assessment).

9. Required Reporting Supplier agrees to provide the following reporting by (i) email to enterpriseservices@vita.virginia.gov; (ii) a mutually acceptable secure transfer mechanism; or (iii) maintaining a portal or website where Public Body can obtain such information periodically as needed for the COV Ramp Active Oversight of the Cloud Services.

a) Annual Active Oversight reports:

1) For the hosting environment in which Commonwealth Content is stored, a current, unredacted AICPA SOC 2, Type II report covering the Trust Service Principles of Security, Availability, Processing Integrity, Privacy and Confidentiality.

2) For the Cloud Services, a SOC 2, Type II or a security gap analysis, using SEC 530 as the framework, conducted by an accredited third party;

b) Active Oversight reports:

By the 5th of each month, Supplier shall provide:

1) On a monthly basis: summaries of:

i. SLA performance (for the performance standards set forth in Exhibit __ Table of Service Levels and Remedies for Cloud Services,

ii. vulnerability scanning results,

iii. patching results (including compliance with patching within 30 days), and

iv. the geographic location of Commonwealth Content (for Content not stored in a Commonwealth facility);

2) On a quarterly basis: summary of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events.

Should Supplier fail to perform in compliance with any provision of this Section, Public Body and Supplier will follow the Cure and Termination process as defined in the Contract. Additionally, if Public Body deems Supplier in breach and/or default of the Contract, the Cloud Services will be removed from the Approved Application List.

10. Cyber Insurance:

In addition to any other insurance coverage requirements, Supplier shall carry Cyber Security Liability insurance coverage in an amount per occurrence not less than $5,000,000.

Supplier’s insurance coverage shall include any and all Supplier acts, claims, errors, omissions, and negligence; infringement of intellectual property (including copyright, patent and trade secret); network security and privacy risks (including unauthorized access; failure of security; information theft; damage to, destruction of, or alteration of electronic information; breach of privacy perils; wrongful disclosure and release of private information or other negligence in the handling of confidential information).

Supplier’s insurance coverage shall include related regulatory fines, defenses, and penalties and incident and data breach response costs and expenses, payable whether incurred by Supplier or Public Body, including for consumer notification, computer forensic investigations, public relations and crisis management, and credit file or identity monitoring or other remediation services.

11. Truthfulness and Accuracy:

Supplier attests that the answers provided on the COV Ramp assessment questionnaire and the information Supplier is required to report above are and will be accurate and complete. In the event of a change to any of Supplier’s responses provided on the COV Ramp assessment questionnaire, submitted to VITA on [INSERT DATE ASSESSMENT REQUEST WAS SUBMITTED], Supplier will provide an updated COV Ramp assessment to Customer for Customer to submit to VITA.

12. Data Protection and Publicity:

Supplier may collect and use data specific to Users only as necessary to provide the Cloud Services under the Contract. No information regarding Public Body’s or any User’s use of the Cloud Services, shall be disclosed, provided, rented, or sold by Supplier to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation extends for as long as Supplier possesses such User-specific data, including any period of possession beyond the term of the Contract. Supplier may mention that Public Body is a user of the Cloud Services, or publish a case study, testimonial, or other text regarding use of the Cloud Services by Public Body, so long as Supplier obtains Public Body’s advance review and written approval of the intended mention or published text.

13. Warranties:

a) Cloud Services and Documentation Supplier warrants the following with respect to the Cloud Services:

(Include the first paragraph under subsection (i) only if true (if an RFP was issued). Delete the first paragraph if no RFP was issued and utilize the second paragraph for procurements that are not utilizing an RFP).

i. The Cloud Services are obtained pursuant to a particular Request for Proposal (RFP), and therefore such Cloud Services shall be fit for the particular purposes specified by Public Body in the RFP and in the Contract. Supplier is possessed of superior knowledge with respect to the Cloud Services and is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services.

ii. Supplier warrants that the Cloud Services will conform to the applicable specifications and documentation, not including any modifications or alterations to the documentation that represent a material diminishment of the functionality of the Cloud Services and that are made after the time of contracting. Supplier is possessed of superior knowledge with respect to the Cloud Services, is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services and will provide the Cloud Services in a professional and workmanlike manner.

iii. Any software included in the Cloud Services is at the current release level unless Public Body has specified an older version in the Contract;

iv. Supplier shall not introduce any corrections, work arounds, or future releases that shall degrade the Cloud Services, cause any other warranty to be breached, or require Public Body to acquire additional hardware equipment, software, or services without prior approval from the Public Body. Notifications about such changes will be communicated to the Public Body at least 30 days in advance.;

v. Supplier warrants that all updates, changes, alterations, or modifications to the Cloud Services after the time of contracting will be compatible with, and will not materially diminish, the features or functionality of the Cloud Services when used in accordance with the documentation and the Contract.

vi. Supplier warrants that the documentation and all modifications or amendments thereto which Supplier is required to provide under this Contract shall be sufficient in detail and content to allow a user to understand and utilize fully the Cloud Services without reference to any other materials or information.

b) Privacy and Security Supplier warrants that Supplier and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not include any degradation or known security vulnerabilities. Supplier agrees to notify Public Body of any occurrence of such as soon as possible after discovery and provide Public Body with fixes or upgrades for security vulnerabilities within 90 days of discovery.

c) Operating System and Software Supportability Supplier warrants that Supplier and its employees, subcontractors, partners and third party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not have dependencies on other operating systems or software that are no longer supported by Supplier, or its subcontractors, partners, and third-party providers.

d) Access to Product and Passwords Supplier warrants that the Cloud Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Cloud Services or the hardware or software of Public Body or its Users. In addition, Supplier warrants that Public Body and its Users will be provided commercially reasonable uninterrupted access to the Cloud Services. Supplier also warrants that it will not cancel or otherwise terminate access to the Cloud Services by disabling passwords, keys, or tokens that enable continuous use of the Cloud Services by Public Body and its Users during the term of this Contract.

14. Rights in Cloud Services:

Supplier has acquired any and all rights in the Cloud Services necessary and appropriate for Supplier to provide the Cloud Services as provided in the Contract, and the Cloud Services do not infringe any third party proprietary rights including (without limitation) any trademark, trade name, trade secret, copyright, moral rights, patents or similar intellectual property rights.

Supplier hereby grants to Public Body and its Users all rights necessary to access and use the Cloud Services during the term of the Contract. The fee for the rights shall be as set forth in the Pricing Schedule of the Contract and shall apply regardless of access mode.

Public Body is an agency, as defined by §2.2-2006 or a legislative, judicial, or independent agency of the Commonwealth, or a board, commission, or other quasi-political entity of the Commonwealth of Virginia or other body referenced in Title 2.2 of the Code of Virginia, and as such, any licenses shall be held by the Commonwealth.

15. Subcontractors:

With respect to any subcontractors, including but not limited to subprocessors, Supplier uses in the provision of the Cloud Services:

a) Supplier is responsible for (i) the performance of such subcontractors, and (ii) such subcontractors’ compliance with the terms and conditions of this Contract.

b) Except for subcontractors named in writing at time of Contract award, Supplier shall not add or replace subcontractors who have non-public access during performance of this Contract without providing advance written notification to the public body.

16. Prohibition on Debarred/Delinquent Subcontractors:

a) Supplier shall not subcontract with any subcontractor which is debarred by the Commonwealth of Virginia or which owes back taxes to the Commonwealth and has not made arrangements with the Commonwealth for payment of such back taxes.

b) If any part of this Contract is supported in whole or in part with federal funds, Supplier shall not subcontract to a party excluded from Federal Procurement and Nonprocurement Programs.

17. Export of Content:

Supplier agrees to provide a secure method of exporting Content when requested. Supplier shall ensure that the Content exported from Supplier’s Services or infrastructure is in an industry standard format that is usable and provides interoperability and portability.

18. Escrow:

a) Cloud Services Escrow Supplier is providing a General Use or COTS Cloud Service and no custom-built source code is authorized under this Contract. Therefore, Cloud Service Escrow is not required.

[This language is applicable if Supplier is providing a general use or COTS Cloud Service and no custom built source code is authorized under the Contract. If this language cannot be used, please request the more expansive Cloud Service escrow language]

b) Content Escrow Should Supplier cease to do business, file bankruptcy, or fail to support Public Body, Supplier shall promptly make all Content available to Public Body as a native database export provided through a Supplier FTP server or other transfer mechanism approved by VITA.

[If Content Escrow is needed, please request the more expansive language.]

19. Right to Updates:

a) “Update” means any update, modification, or new release of the Cloud Services that Supplier makes generally available to its customers at no additional cost. Updates include patches, fixes, upgrades, enhancements, and improvements, and may include additional capabilities or improvements in the functionality, speed, efficiency, security, or other features or operations of the Cloud Services.

b) At no additional cost to Public Body, Supplier shall provide access to Updates to the Cloud Services. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Supplier website. Nothing in this provision obliges Supplier to undertake any modifications to the Cloud Services or constrains Supplier’s discretion regarding whether to undertake modifications suggested by Public Body or another party.

c) Should Supplier merge or splinter the Cloud Services during the term of Public Body's subscription, license, or use of it, such action on the part of Supplier shall not in any way result in Public Body being charged additional fees to access the Cloud Services, to enable its Users to access the Cloud Services, or to receive Updates to or support for the Cloud Services.

d) Updates or other changes to the Cloud Services that affect the security controls and environment will require an updated Assessment, and Supplier agrees to cooperate with any such updated Assessment.

20. Service Levels and Remedies:

a) Availability The Cloud Services will be made available to Public Body and its Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime.

Supplier shall make the Cloud Services available for use at least ninety-nine percent (99%) of the total time during each month, excluding Excusable Downtime. (Note to Procurement Lead: this may be changed to a mutually agreed-to availability percentage or to align with Supplier’s SLA.)

For the purposes of this Contract, “Excusable Downtime” is defined as that period of time when the Cloud Services are not available to Public Body or its Users due to scheduled network, hardware or service maintenance and/or upgrades. Excusable downtime shall follow the performance standard/service level set forth below. In cases of emergency, Supplier will use its best efforts to notify Public Body of a planned Downtime as soon as practicable.

Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the Supplier’s Cloud Services, (iii) an electric utility failure at Supplier’s facility where the Cloud Services are hosted, or (iv) a network failure up to, but not including, the interconnection point of Supplier’s network to the public switched telephone network.

Supplier’s failure to make the Cloud Services available to Public Body and its Users at the performance standard/service level set forth below excluding scheduled maintenance or excusable downtime, shall be deemed a service level default (“Service Level Default”) and Public Body may obtain the non-exclusive remedies set forth below. For purposes of this Contract, “Available” means that Public Body and its Cloud Services Users are able to access all features and functions of the Cloud Services required by Public Body.

In the event Public Body is eligible for a 100% Service Level Credit under this Section during any given month of the term the Contract, Public Body may terminate the Contract without penalty upon written notice to Supplier and, in addition to the remedies available under this Section, receive any additional remedies set forth in the Contract.

If availability does not meet the required levels in these Cloud Terms, when payment is made on an annual basis, Software Publisher will refund to Public Body the applicable percentage as listed in the table below of the monthly payment amount. Such refund will be issued in the month immediately following the failure. If availability does not meet the required levels in these Cloud Terms, when payment is made on a monthly basis, credits shall be applied against the next invoice. If a credit or refund as applicable is not made by the due date, the amount of such credit or refund may be withheld from future payments by Public Body. In the event a Service Level Default occurs, if Public Body has given notice of termination pursuant to the Term and Termination section of the Contract or due to non-appropriation of funds, or Public Body has made final payment to Supplier for the Cloud Services and no further invoices shall issue as a result, Supplier shall refund to Public Body the amount of the appropriate Service Level Credit due for the period of default within thirty (30) calendar days. Supplier shall measure Availability on a monthly basis and shall provide information regarding the Availability to Public Body on a monthly basis.

Any dispute between the Supplier and any provider/subcontractor regarding responsibility for any events giving rise to the imposition of the remedies shall not relieve the Supplier of their liability for said remedies.

In addition to the remedies outlined in the table below, Public Body may exercise all available rights and remedies under law and equity.

TABLE OF SERVICE LEVELS AND REMEDIES FOR CLOUD SERVICES

Public Body to update all areas highlighted in aqua before sending to the Supplier. The percentages contained in the SLA table below can be increased or decreased depending on the Public Body’s business needs. Do not delete any of the performance standards set forth in the table below without consulting your assigned Cloud Sourcing Specialist in advance.

99% or above=0 98.99-97%=10% 96.99-95%=25% 94.99-93%=50% Below 93%=100% and, at PUBLIC BODY’s sole discretion, termination of the Contract

Incident resolution time – Cloud Services: Severity 1 (within 6 hours)

% of incidents resolved within the 6-hour timeframe Severity 1 incidents Severity 1 incident = Critical production issue that severely impacts the service or the system is down, including production issues caused by misconfiguration of components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions)

Incident resolution time: Severity 2 (within 24 hours)

% of incidents resolved within the 24-hour timeframe.

Severity 2 incident = Critical situation where functionality is impacted, or customer experience is seriously degraded, including production issues caused by misconfiguration of Components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions).

Note: If an incident is escalated to Severity 2, then the resolution time measurement restarts upon escalation to Severity 2 Total Severity 2 incidents resolved within 24 hours divided by total resolved Severity 2 incidents

Incident resolution time: Severity 3 (within 3 calendar days)

% of incidents resolved within the 3-calendar day timeframe.

Severity 3 incident = A partial loss of service with a medium to low impact on the Public Body. Public Body is still able to function, including production issues caused by misconfiguration of Components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions).

Note: If an incident is escalated to Severity 3, then the resolution time measurement restarts upon escalation to Severity 3 Total Severity 3 incidents resolved within 3 calendar days divided by total resolved Severity 3 incidents

Excusable Downtime: Advanced Notice to Public Body of Scheduled Maintenance and/or Upgrades Advanced Notice = two (2) business days NOTE: This performance measure does not apply to notification of downtime for emergency maintenance.

Supplier’s notice to Public Body of scheduled maintenance and/or upgrades requiring Excusable Downtime is equal to or exceeds two (2) business days

For the avoidance of doubt, Excusable Downtime means the same as Section XX.X in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to notify Public Body of maintenance requiring Downtime

Excusable Downtime: Acceptable Duration of maintenance and/or upgrades

Acceptable Duration = Thirty-six (36) hours in a single month Maintenance and/or upgrades requiring Excusable Downtime shall not exceed thirty-six (36) hours in duration in a single month

For the avoidance of doubt, Excusable Downtime has the same meaning as Section XX.X in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to conduct maintenance and/or upgrade(s) requiring Downtime within the allowable 36 hours in a single month

Excusable Downtime: Acceptable timeframe for execution of maintenance and/or upgrades requiring Downtime

Acceptable timeframe = maintenance and/or upgrades must occur outside of the hours of 6:00AM-8:00PM Eastern Time (ET) Monday-Friday Maintenance and/or upgrades requiring Downtime cannot occur between the hours of 6:00AM-8:00PM ET Monday-Friday For the avoidance of doubt, Excusable Downtime has the same meaning as Section XX.X of this Exhibit of Cloud Terms and Conditions.

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to failure to execute maintenance and/or upgrades requiring Downtime within the allowable timeframe

b) Cloud Services and Cloud Services Support

At any time during the term of this Contract, Supplier shall provide the following Cloud Services support (including unlimited telephonic support and all necessary travel and labor) without additional charge to Public Body in order to ensure Public Body and its Cloud Services Users are able to access and use the Cloud Services in accordance with the requirements of the Contract.

i) Coverage Twenty-four (24) hours per day, seven (7) days a week, Supplier shall provide to Public Body all reasonably necessary telephone or written consultation requested by Public Body in connection with use, problems and operation of the Cloud Services.

ii) Service Levels Supplier will respond to requests for support from a Public Body or VITA, in its governance role, of the Cloud Services in accordance with the procedures identified in the Table of Service Levels. In each case, Public Body may describe the problem by telephone or electronic mail or via a web site provided by Supplier. Supplier shall use commercially reasonable efforts to meet Response Time and Resolution Times.

The level of severity (e.g., 1, 2, 3), shall be defined by Public Body.

Supplier Legal Name By:

(Signature)

Name:

(Print)

Title:

Date:

Virginia Department of Education By:

(Signature)

Name:

(Print)

Title:

Date:

Commonwealth of Virginia Cloud Terms and Conditions – Q01FY26 2