EXHIBIT ___

COMMONWEALTH OF VIRGINIA

CLOUD TERMS AND CONDITIONS

These additional terms and conditions for provision of Software as a Service, as part of the contractual obligations of [insert name of Supplier] (“Supplier”), for an overall solution provided by the Supplier to [insert name of agency] (“Public Body”) are in support of and incorporated herewith under Contract No. ___________. This Exhibit (“Exhibit”) sets forth additional terms and conditions under which Supplier shall provide such Cloud Services (as hereinafter defined) to Public Body.

Controlling Terms. In the event of any conflict or inconsistency between these Cloud Terms and Conditions and any other contract documents, Supplier policy or terms, click-wrap or online terms, or third-party agreement, these Cloud Terms shall govern and control.

Purpose and Grant of License Rights. Subject to the terms and conditions of the Contract, Supplier grants to Public Body a non-exclusive, non-transferable, time-limited license to access and use the Cloud Services, including any related Documentation, solely for Public Body’s internal operations. The rights granted hereunder extend to Public Body.

Public Body is an agency, as defined by §2.2-2006 or a legislative, judicial, or independent agency of the Commonwealth, or a board, commission, or other quasi-political entity of the Commonwealth of Virginia or other body referenced in Title 2.2 of the Code of Virginia, and as such, any licenses shall be held by the Commonwealth.

1. Definitions As used in the following terms:

a) “Active Oversight” refers to the ongoing monitoring process conducted by the COV Ramp team, which involves reviewing compliance reports regularly submitted by the application Supplier.

b) “Approved Application List” means the catalog of applications available on the VITA website that have successfully completed the COV Ramp assessment and met the required standards. To remain on this list, applications must comply with the following conditions:

1. the supplier must agree to the established cloud terms, and

2. the application must achieve Active Oversight status within one year of approval

c) “Cloud Services” means, [insert the name of the Cloud Services], the application(s) and/or services that Public Body subscribes to, licenses, or otherwise obtains from Supplier and that are not hosted in a Commonwealth of Virginia facility.

d) “Content” means any data (including the selection, arrangement, and organization of such data) entered, uploaded, or otherwise provided to Supplier by Users.

e) “Contract” means these Commonwealth of Virginia Cloud Terms and Conditions and all other documents that constitute the public contract between Supplier and Public Body for the procurement of the Cloud Services. [Note: Edit this as appropriate to ensure it includes all contract documents.]

f) “Supplier” means the entity providing the Cloud Services to the Public Body under this Contract.

g) “Users” means personnel of Public Body (whether employees or independent contractors) and other persons who are authorized by Public Body to access or use the Cloud Services or who are persons with whom Public Body may find it necessary or desirable to interact with, through, or in connection with the Cloud Services in pursuit of its business.

2. Compliance with Commonwealth Standards:

The Cloud Services shall be provided in compliance with Commonwealth information security standards SEC530 (Information Security Standard) and SEC514 (Removal of Commonwealth Data from Electronic Media Standard), current versions of which are located on VITA’s public website (https://www.vita.virginia.gov/policy--governance/policies-standards--guidelines/) under Information Security, as agreed upon in Supplier’s COV Ramp assessment, provided to VITA on [insert date assessment request was submitted]. In addition, Supplier shall ensure that the Cloud Services are not provided in any way that prevents Public Body from compliance with other Commonwealth security standards. Comment by De La Garza, Leia (VITA): Procurement Lead - this is the date agency submitted the COV Ramp assessment request in ServiceNow, and would be filled in once you determine which supplier(s) you’ll negotiate with

Supplier shall comply with the following additional contractual requirements resulting from the COV Ramp assessment: Comment by De La Garza, Leia (VITA): Procurement Lead - this would be filled in once you determine which supplier(s) you’ll negotiate with and VITA has completed the review of their COV Raamp assessment [Note: insert any contractual requirements resulting from COV Ramp Assessment]

3. Prohibited Information Technology:

In accordance with Virginia Code § 2.2-5514, Supplier shall not use any hardware, software, or services that have been prohibited for use on Commonwealth systems. Further information on prohibited information technology is available in Commonwealth Information Security Policy SEC 528.

4. Content Privacy and Security:

Supplier shall provide the Cloud Services in a secure environment that protects the privacy and security of the Cloud Services and of the Content.

Supplier understands that Content is intended solely for the business of Public Body and is subject to certain confidentiality and/or privacy protections under Virginia law. Accordingly, Supplier agrees that all Content of Public Body is private data, and Supplier shall not disclose Content other than as authorized in writing by Public Body or required by applicable law. If required by applicable law to disclose Content, Supplier shall provide written notice in advance to Public Body unless Supplier is prohibited by law from providing such notice.

Supplier shall, at all times, remain compliant with privacy and security requirements of applicable federal, state, and local law.

5. Geographic Restriction on Content and Personnel:

All Content shall be stored, processed, and maintained only within the United States at all times.

6. Return and Destruction of Content:

Using secure and usable protocols and methods, and in a usable electronic format, Supplier shall enable the export of Content (including associated metadata) to Public Body promptly upon request and at the conclusion of the Contract, without additional financial or contractual requirements.

Within fifteen (15) business days after the expiration or termination of the Contract, Supplier shall remove all Content from all systems where the Content resided during provision of the Cloud Services in a manner that complies with and/or exceeds SEC514, the Commonwealth Data Removal standard. Supplier shall confirm in writing to the Public Body that all Content has been removed. The written confirmation shall describe (i) the processes and procedures used in removing the Content, (ii) the locations from which it was removed, and (iii) the date the removals were performed.

7. Incident Reporting and Cooperation:

Supplier shall notify Public Body in writing of all incidents related to Public Body’s tenant environment or the Cloud Services that threaten or could potentially threaten the security of Public Body's Content and/or Public Body’s use of the Cloud Services. Notice for each incident shall be provided within 24 hours from when the incident was discovered. This notice is required to allow the Commonwealth to commence any necessary internal actions to address or remediate such incident. Supplier shall fully cooperate with Commonwealth incident response and law enforcement personnel as needed with respect to the handling and reporting of security incidents. If a temporary suspension of use of the Cloud Services by Public Body, as directed by the Chief Information Officer of the Commonwealth (“CIO”), becomes necessary related to a security incident, the Supplier further agrees not to impose any penalty on Public Body.

8. Prior Notifications In order to allow sufficient time to consider and discuss significant changes, Supplier agrees to provide written notification to Public Body and VITA in advance as follows:

a) At least thirty (30) days’ notice prior to replacing or adding a subcontractor or any other third-party that will have non-public access to Content.

b) At least 60 days’ notice prior to a material change in the security of the Cloud Services (as measured against the initial COV Ramp assessment).

9. Required Reporting Supplier agrees to provide the following reporting by (i) email to enterpriseservices@vita.virginia.gov; (ii) a mutually acceptable secure transfer mechanism; or (iii) maintaining a portal or website where Public Body can obtain such information periodically as needed for the COV Ramp Active Oversight of the Cloud Services.

a) Annual Active Oversight reports:

1) For the hosting environment in which Content is stored, a current, unredacted AICPA SOC 2, Type II report covering the Trust Service Principles of Security, Availability, Processing Integrity, Privacy and Confidentiality.

2) For the Cloud Services, a SOC 2, Type II or a security gap analysis, using SEC 530 as the framework, conducted by an accredited third party;

b) Active Oversight reports:

By the 5th of each month, Supplier shall provide:

1) On a monthly basis: summaries of:

i. SLA performance (for the performance standards set forth in Exhibit __ Table of Service Levels and Remedies for Cloud Services,

ii. vulnerability scanning results,

iii. patching results (including compliance with patching within 30 days), and

iv. the geographic location of Commonwealth Content (for Content not stored in a Commonwealth facility);

2) On a quarterly basis: summary of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events.

Should Supplier fail to perform in compliance with any provision of this Section, Public Body and Supplier will follow the Cure and Termination process as defined in the Contract. Additionally, if Public Body deems Supplier in breach and/or default of the Contract, the Cloud Services will be removed from the Approved Application List. The Approved Application List reflects the Suppliers and Applications that are COV Ramp approved.

10. Cyber Insurance:

In addition to any other insurance coverage requirements, Supplier shall carry Cyber Security Liability insurance coverage in an amount per occurrence not less than $5,000,000.

Supplier’s insurance coverage shall include any and all Supplier acts, claims, errors, omissions, and negligence; infringement of intellectual property (including copyright, patent and trade secret); network security and privacy risks (including unauthorized access; failure of security; information theft; damage to, destruction of, or alteration of electronic information; breach of privacy perils; wrongful disclosure and release of private information or other negligence in the handling of confidential information).

Supplier’s insurance coverage shall include related regulatory fines, defenses, and penalties and incident and data breach response costs and expenses, payable whether incurred by Supplier or Public Body, including for consumer notification, computer forensic investigations, public relations and crisis management, and credit file or identity monitoring or other remediation services.

11. Truthfulness and Accuracy:

Supplier attests that the answers provided in the COV Ramp assessment questionnaire, along with any supporting documentation, artifacts, or additional responses submitted in connection with the assessment, are and will remain accurate and complete. In the event of a change to the information previously submitted to VITA on [insert date assessment was submitted to VITA]—including updates to questionnaire responses or any related materials—within 30 business days of such change, Supplier shall provide an updated COV Ramp assessment questionnaire and any revised artifacts or supporting documentation to Public Body for submission to VITA. Comment by De La Garza, Leia (VITA): Procurement Lead - this is the date agency submitted the COV Ramp assessment request in ServiceNow, and would be filled in once you determine which supplier(s) you’ll negotiate with

12. Data Protection and Publicity:

Supplier may collect and use data specific to Users only as necessary to provide the Cloud Services under the Contract. No information regarding Public Body’s or any User’s use of the Cloud Services, shall be disclosed, provided, rented, or sold by Supplier to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation extends for as long as Supplier possesses such User-specific data, including any period of possession beyond the term of the Contract. Supplier may mention that Public Body is a user of the Cloud Services, or publish a case study, testimonial, or other text regarding use of the Cloud Services by Public Body, so long as Supplier obtains Public Body’s advance review and written approval of the intended mention or published text.

13. Warranties:

a) Cloud Services and Documentation Supplier warrants the following with respect to the Cloud Services:

i. The Cloud Services are obtained pursuant to a particular Request for Proposal (RFP), and therefore such Cloud Services shall be fit for the particular purposes specified by Public Body in the RFP and in the Contract. Supplier is possessed of superior knowledge with respect to the Cloud Services and is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services.

ii. Supplier warrants that the Cloud Services will conform to the applicable specifications and documentation, not including any modifications or alterations to the documentation that represent a material diminishment of the functionality of the Cloud Services and that are made after the time of contracting. Supplier is possessed of superior knowledge with respect to the Cloud Services, is aware that Public Body is relying on Supplier's skill and judgment in providing the Cloud Services and will provide the Cloud Services in a professional and workmanlike manner.

iii. Any software included in the Cloud Services is at the current release level unless Public Body has specified an older version in the Contract;

iv. Supplier shall not introduce any corrections, work arounds, or future releases that shall degrade the Cloud Services, cause any other warranty to be breached, or require Public Body to acquire additional hardware equipment, software, or services without prior approval from the Public Body. Notifications about such changes will be communicated to the Public Body at least 30 days in advance.;

v. Supplier warrants that all updates, changes, alterations, or modifications to the Cloud Services after the time of contracting will be compatible with, and will not materially diminish, the features or functionality of the Cloud Services when used in accordance with the documentation and the Contract.

vi. Supplier warrants that the documentation and all modifications or amendments thereto which Supplier is required to provide under this Contract shall be sufficient in detail and content to allow a user to understand and utilize fully the Cloud Services without reference to any other materials or information.

b) Privacy and Security Supplier warrants that Supplier and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not include any degradation or known security vulnerabilities. Supplier agrees to notify Public Body of any occurrence of such as soon as possible after discovery and provide Public Body with fixes or upgrades for security vulnerabilities within 90 days of discovery.

c) Operating System and Software Supportability Supplier warrants that Supplier and its employees, subcontractors, partners and third party providers have taken all necessary and reasonable measures to ensure that the Cloud Services do not have dependencies on other operating systems or software that are no longer supported by Supplier, or its subcontractors, partners, and third-party providers.

d) Access to Product and Passwords Supplier warrants that the Cloud Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Cloud Services or the hardware or software of Public Body or its Users. In addition, Supplier warrants that Public Body and its Users will be provided commercially reasonable uninterrupted access to the Cloud Services. Supplier also warrants that it will not cancel or otherwise terminate access to the Cloud Services by disabling passwords, keys, or tokens that enable continuous use of the Cloud Services by Public Body and its Users during the term of this Contract.

14. Rights in Cloud Services:

Supplier has acquired any and all rights in the Cloud Services necessary and appropriate for Supplier to provide the Cloud Services as provided in the Contract, and the Cloud Services do not infringe any third party proprietary rights including (without limitation) any trademark, trade name, trade secret, copyright, moral rights, patents or similar intellectual property rights.

Supplier hereby grants to Public Body and its Users all rights necessary to access and use the Cloud Services during the term of the Contract. The fee for the rights shall be as set forth in the Pricing Schedule of the Contract and shall apply regardless of access mode.

15. Subcontractors:

With respect to any subcontractors, including but not limited to subprocessors, Supplier uses in the provision of the Cloud Services:

a) Supplier is responsible for (i) the performance of such subcontractors, and (ii) such subcontractors’ compliance with the terms and conditions of this Contract.

b) Except for subcontractors named in writing at time of Contract award, Supplier shall not add or replace subcontractors who have non-public access during performance of this Contract without providing advance written notification to the public body.

16. Prohibition on Debarred/Delinquent Subcontractors:

a) Supplier shall not subcontract with any subcontractor which is debarred by the Commonwealth of Virginia or which owes back taxes to the Commonwealth and has not made arrangements with the Commonwealth for payment of such back taxes.

b) If any part of this Contract is supported in whole or in part with federal funds, Supplier shall not subcontract to a party excluded from Federal Procurement and Nonprocurement Programs.

17. Export of Content:

Supplier shall provide a secure method of exporting Content when requested. The Content shall be exported in an industry standard format that is usable and provides interoperability and portability.

18. Escrow:

a) Cloud Services Escrow Supplier is providing a General Use or COTS Cloud Service and no custom-built source code is authorized under this Contract. Therefore, Cloud Service Escrow is not required.

[Note to Procurement Lead: This language is applicable if Supplier is providing a general use or COTS Cloud Service and no custom built source code is authorized under the Contract. If this language cannot be used, please request the more expansive Cloud Service escrow language from VITA SCM.]

b) Content Escrow Should Supplier cease to do business, file bankruptcy, or fail to support Public Body, Supplier shall promptly make all Content available to Public Body as a native database export provided through a Supplier FTP server or other transfer mechanism approved by VITA.

[Note to Procurement Lead: If Content Escrow is needed, please request the more expansive Content Escrow language from VITA SCM.]

19. Right to Updates:

a) “Update” means any update, modification, or new release of the Cloud Services that Supplier makes generally available to its customers at no additional cost. Updates include patches, fixes, upgrades, enhancements, and improvements, and may include additional capabilities or improvements in the functionality, speed, efficiency, security, or other features or operations of the Cloud Services.

b) At no additional cost to Public Body, Supplier shall provide access to Updates to the Cloud Services. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Supplier website. Nothing in this provision obliges Supplier to undertake any modifications to the Cloud Services or constrains Supplier’s discretion regarding whether to undertake modifications suggested by Public Body or another party.

c) Should Supplier merge or splinter the Cloud Services during the term of Public Body's subscription, license, or use of it, such action on the part of Supplier shall not in any way result in Public Body being charged additional fees to access the Cloud Services, to enable its Users to access the Cloud Services, or to receive Updates to or support for the Cloud Services.

d) Updates or other changes to the Cloud Services that affect the security controls and environment will require an updated Assessment, and Supplier agrees to cooperate with any such updated Assessment.

20. Service Levels and Remedies:

a) Availability The Cloud Services will be made available to Public Body and its Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime.

Supplier shall make the Cloud Services available for use at least ninety-nine percent (99%) of the total time during each month, excluding Excusable Downtime. [Note to Procurement Lead: this may be changed to a mutually agreed-to availability percentage or to align with Supplier’s SLA.]

For the purposes of this Contract, “Excusable Downtime” is defined as that period of time when the Cloud Services are not available to Public Body or its Users due to scheduled network, hardware or service maintenance and/or upgrades. Excusable downtime shall follow the performance standard/service level set forth below. In cases of emergency, Supplier will use its best efforts to notify Public Body of a planned period of Excusable Downtime as soon as practicable.

Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the Supplier’s Cloud Services, (iii) an electric utility failure at Supplier’s facility where the Cloud Services are hosted, or (iv) a network failure up to, but not including, the interconnection point of Supplier’s network to the public switched telephone network.

Supplier’s failure to make the Cloud Services available to Public Body and its Users at the performance standard/service level set forth below excluding scheduled maintenance or excusable downtime, shall be deemed a service level default (“Service Level Default”) and Public Body may obtain the non-exclusive remedies set forth below. For purposes of this Contract, “Available” means that Public Body and its Cloud Services Users are able to access all features and functions of the Cloud Services required by Public Body.

In the event Public Body is eligible for a 100% Service Level Credit under this Section during any given month of the term the Contract, Public Body may terminate the Contract without penalty upon written notice to Supplier and, in addition to the remedies available under this Section, receive any additional remedies set forth in the Contract.

If availability does not meet the required levels in these Cloud Terms, when payment is made on an annual basis, Software Publisher will refund to Public Body the applicable percentage as listed in the table below of the monthly payment amount. Such refund will be issued in the month immediately following the failure. If availability does not meet the required levels in these Cloud Terms, when payment is made on a monthly basis, credits shall be applied against the next invoice. If a credit or refund as applicable is not made by the due date, the amount of such credit or refund may be withheld from future payments by Public Body. In the event a Service Level Default occurs, if Public Body has given notice of termination pursuant to the Term and Termination section of the Contract or due to non-appropriation of funds, or Public Body has made final payment to Supplier for the Cloud Services and no further invoices shall issue as a result, Supplier shall refund to Public Body the amount of the appropriate Service Level Credit due for the period of default within thirty (30) calendar days. Supplier shall measure Availability on a monthly basis and shall provide information regarding the Availability to Public Body on a monthly basis.

Any dispute between the Supplier and any provider/subcontractor regarding responsibility for any events giving rise to the imposition of the remedies shall not relieve the Supplier of their liability for said remedies.

In addition to the remedies outlined in the table below, Public Body may exercise all available rights and remedies under law and equity.

TABLE OF SERVICE LEVELS AND REMEDIES FOR CLOUD SERVICES

[Note to Procurement Lead: This table is used for Cloud Service contracts. It relates to Section 20, Service Levels and Remedies. It is a sample, and the highlighted areas should be customized to meet your agency’s business needs. Please ensure that all remedy amounts can be legally justified by your Finance Department.]

Public Body to update all areas highlighted in aqua before sending to the Supplier. The percentages contained in the SLA table below can be increased or decreased depending on the Public Body’s business needs. Do not delete any of the performance standards set forth in the table below without consulting your assigned Cloud Sourcing Specialist in advance.

99% or above=0 98.99-97%=10% 96.99-95%=25% 94.99-93%=50% Below 93%=100% and, at PUBLIC BODY’s sole discretion, termination of the Contract

Incident resolution time – Cloud Services: Severity 1 (within 6 hours)

% of incidents resolved within the 6-hour timeframe Severity 1 incidents Severity 1 incident = Critical production issue that severely impacts the service or the system is down, including production issues caused by misconfiguration of components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions)

Incident resolution time: Severity 2 (within 24 hours)

% of incidents resolved within the 24-hour timeframe.

Severity 2 incident = Critical situation where functionality is impacted, or customer experience is seriously degraded, including production issues caused by misconfiguration of Components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions).

Note: If an incident is escalated to Severity 2, then the resolution time measurement restarts upon escalation to Severity 2 Total Severity 2 incidents resolved within 24 hours divided by total resolved Severity 2 incidents

Incident resolution time: Severity 3 (within 3 calendar days)

% of incidents resolved within the 3-calendar day timeframe.

Severity 3 incident = A partial loss of service with a medium to low impact on the Public Body. Public Body is still able to function, including production issues caused by misconfiguration of Components by Supplier on Public Body systems (See Section X.X of Exhibit [fill in]—Cloud Services Additional Contract Terms and Conditions).

Note: If an incident is escalated to Severity 3, then the resolution time measurement restarts upon escalation to Severity 3 Total Severity 3 incidents resolved within 3 calendar days divided by total resolved Severity 3 incidents

Excusable Downtime: Advanced Notice to Public Body of Scheduled Maintenance and/or Upgrades Advanced Notice = two (2) business days NOTE: This performance measure does not apply to notification of downtime for emergency maintenance.

Supplier’s notice to Public Body of scheduled maintenance and/or upgrades requiring Excusable Downtime is equal to or exceeds two (2) business days

For the avoidance of doubt, Excusable Downtime means the same as Section XX.X in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to notify Public Body of maintenance requiring Downtime

Excusable Downtime: Acceptable Duration of maintenance and/or upgrades

Acceptable Duration = Thirty-six (36) hours in a single month Maintenance and/or upgrades requiring Excusable Downtime shall not exceed thirty-six (36) hours in duration in a single month

For the avoidance of doubt, Excusable Downtime has the same meaning as Section XX.X in this Exhibit of Cloud Terms and Conditions

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to their failure to conduct maintenance and/or upgrade(s) requiring Downtime within the allowable 36 hours in a single month

Excusable Downtime: Acceptable timeframe for execution of maintenance and/or upgrades requiring Downtime

Acceptable timeframe = maintenance and/or upgrades must occur outside of the hours of 6:00AM-8:00PM Eastern Time (ET) Monday-Friday Maintenance and/or upgrades requiring Downtime cannot occur between the hours of 6:00AM-8:00PM ET Monday-Friday For the avoidance of doubt, Excusable Downtime has the same meaning as Section XX.X of this Exhibit of Cloud Terms and Conditions.

NOTE: collection of the remedies owed for failure to meet this SLA does not relieve Supplier of other remedies owed during the same Measurement Period due to failure to execute maintenance and/or upgrades requiring Downtime within the allowable timeframe

b) Cloud Services and Cloud Services Support

At any time during the term of this Contract, Supplier shall provide the following Cloud Services support (including unlimited telephonic support and all necessary travel and labor) without additional charge to Public Body in order to ensure Public Body and its Users are able to access and use the Cloud Services as required under the Contract.

i) Coverage Supplier shall provide twenty-four (24) hours per day, seven (7) days a week support and consultation related to use and operation of the Cloud Services, by phone, email, or secure web portal.

ii) Service Levels Supplier will respond to requests for support from a Public Body or VITA, in its governance role, of the Cloud Services in accordance with the procedures identified in the Table of Service Levels. In each case, Public Body may describe the problem by telephone or electronic mail or via a web site provided by Supplier. Supplier shall use commercially reasonable efforts to meet Response Time and Resolution Times.

The level of severity (e.g., 1, 2, 3), shall be defined by Public Body.

Supplier Legal Name By:

(Signature)

Name:

(Print)

Title:

Date:

Public Body name By:

(Signature)

Name:

(Print)

Title:

Date:

Commonwealth of Virginia Cloud Terms and Conditions – Q01FY26 2