Exhibit N Additional Cloud Services Terms and Conditions-Supplier is Application Owner Q02FY2024 021624 Final.pdf

Contract No. _________ Page i

EXHIBIT N - CLOUD SERVICES

ADDITIONAL CONTRACT TERMS AND CONDITIONS-SUPPLIER IS APPLICATION OWNER

TABLE OF CONTENTS

1. DEFINITIONS 1

A. Acceptance 1 B. Application 1 C. Application Users 1 D. Content 1 E. Customization 1 F. Licensed Services 1 G. Project Onset 1 H. Supplier Product 1 I. Update 1

J. VITA 1

K. Web Site 2

2. TERM AND TERMINATION 2

A. Scalability 2

3. DESCRIPTION OF LICENSED SERVICES 2

4. SUPPLIER RESPONSIBILITIES 2

A. Standard Application Responsibilities 2 B. Ancillary Responsibilities 3 C. Subcontractors 4 It is understood that Supplier may utilize subcontractors to provide integral components of the Licensed Services and Application; however, except for those so named at time of Contract award, Supplier shall not use new or replacement subcontractors to perform or provide integral components of the Licensed Services or Application during performance of this Contract without advance written notification to and approval by Virginia Works. 4

5. VIRGINIA WORKS’ RESPONSIBILITIES 4

6. CONTENT PRIVACY AND SECURITY 4

7. PROPRIETARY RIGHTS 8

A. Supplier’s Proprietary Rights 8 B. Virginia Works Requirements and License Restrictions 8 viii). Virginia Works shall take reasonable care not to, and shall not intentionally or knowingly, use the Application to post, transmit, distribute, store or destroy any information: (i) in violation of any applicable law, statute, ordinance or regulation; (ii) in a manner that shall infringe the intellectual property rights of others; (iii) that is defamatory or trade libelous, or (iv) that contains any Computer Viruses; 9 C. Virginia Works Proprietary Rights 9

8. CLOUD EXIT ASSISTANCE 9

9. COMMENCEMENT AND ACCEPTANCE OF LICENSED SERVICES 9

A. Licensed Services Commencement Date 9 B. Acceptance 9 C. Cure Period 10

10. RECORDS AND AUDIT 10

11. APPLICATION AND LICENSED SERVICES SUPPORT 10

A. Coverage 10 B. Service Levels 10 C. Application Evolution 10

12. SERVICE LEVELS AND REMEDIES 11

Contract No. _________ Page ii

A. Availability 11 B. Provisioning 11 C. Reporting Requirements 11 D. Failure to Meet Service Level Commitments 12 E. Escalation Procedures 12

13. CYBER SECURITY LIABILITY INSURANCE 12

14. ESCROW AGREEMENT 12

A. Application Escrow Agreement 12 B. Content Escrow Agreement 12

15. CLOUD SERVICES WARRANTY 12

A. Licensed Services, Application and Documentation 12 B. Privacy and Security 13 C. Operating System and Software Supportability 13 D. Access to Product and Passwords 13

16. ACCEPTABLE USE POLICY (IF APPLICABLE) 13

17. LIST OF ATTACHMENTS ERROR! BOOKMARK NOT DEFINED.

ATTACHMENT A ERROR! BOOKMARK NOT DEFINED.

ATTACHMENT B ERROR! BOOKMARK NOT DEFINED.

Contract No. _________ Page 1

EXHIBIT N - CLOUD SERVICES

ADDITIONAL CONTRACT TERMS AND CONDITIONS-SUPPLIER IS APPLICATION OWNER

These additional terms and conditions for provision of Software as a Service, as part of Supplier’s contractual obligations for an overall solution provided by the Supplier are in support of and incorporated herewith under Contract No. ___________. This Exhibit (“Exhibit”) sets forth additional terms and conditions under which Supplier shall provide such Licensed Services (“Licensed Services”) to Virginia Works.

1. DEFINITIONS

A. Acceptance

Successful delivery and performance by the Supplier of its contractual commitments at the location(s) designated in the Contract, including completed and successful Acceptance testing in conformance with the requirements of the Contract.

B. Application The software programs in object code and other related data, including intellectual data, proprietary information and Documentation contained and applicable to Licensed Services hosted and supported by Supplier under the Contract, as described in Exhibit J of the Contract, including any Updates, enhancements, and replacements to the Application.

C. Application Users Virginia Works, or entities contracting with Virginia Works for services. Application User(s) also include customers, suppliers, members of the general public, and other entities with whom Virginia Works may find it necessary or desirable to process or communicate electronically in pursuit of its business.

D. Content Any data, including the selection, arrangement and organization of such data, entered, uploaded to the Application, or otherwise provided to Supplier by Virginia Works or by any Application User, and any software and related documentation, from whatever source, provided by Virginia Works or Application User to Supplier in connection with this Contract.

E. Customization Inventions, modifications, combinations, methods, formulae, techniques, processes, improvements, designs, computer programs, strategies, specific computer-related know-how, data and original works of authorship discovered, created or developed by Supplier for Virginia Works in the performance of this Contract.

F. Licensed Services The operation of the Application and the necessary operating system software, hardware and utilities on Supplier’s host computer system, furnishing Supplier Product to Application Users, storing Content and making the Application, Content, and Supplier Product available to Application User(s) via the Web Site, as more fully described in Exhibit J.

G. Project Onset The period after the Licensed Services or “software-as-a-service” delivery model is deployed by Supplier but prior to the hosting of any Commonwealth of Virginia (COV) data or other Content by Supplier.

H. Supplier Product Supplier’s proprietary reports, information and data made available to Virginia Works and its Application Users as part of the Licensed Services.

I. Update As applicable, any update, modification or new release of the Application, documentation or Supplier Product that Supplier makes generally available to its customers at no additional cost.

Software Updates include patches, fixes, upgrades, enhancements, improvements, or access mode, including without limitation additional capabilities to or otherwise improve the functionality, increase the speed, efficiency, or base operation of the Application and Licensed Services.

J. VITA

Virginia Information Technologies Agency.

Contract No. _________ Page 2

K. Web Site The Internet site operated by Supplier to provide access to the Application, with the Uniform Resource Locator (URL).

2. TERM AND TERMINATION

A. Scalability Virginia Works may make a written request to increase or decrease the scope (e.g., number of USERIDs) of Licensed Services (“revised usage”) under a change order to the Contract. The revised usage shall be effective not more than one (1) business hour following the request. Pricing for the revised usage of Licensed Services shall be calculated as provided in the Pricing Schedule of the Contract and shall be prorated on a daily basis for remaining portion of the current monthly billing period. For purposes of this provision, a written notice may include an e-mail or the use of a Supplier-provided provisioning website by Virginia Works designated administrator.

3. DESCRIPTION OF LICENSED SERVICES

During the term of this Contract, Supplier hereby agrees to host the Application(s) listed and described and specified in the Contract on servers owned, operated, housed, and maintained by Supplier and shall make such Application(s) available to Virginia Works’ designated Application Users through the Internet. Supplier has acquired any and all license rights in the Application(s) necessary and appropriate for Supplier to provide the Licensed Services as obligated by the Contract.

Supplier hereby grants to Virginia Works and its Application Users a non-exclusive, transferable, worldwide license to access and use by any method the Application during the term of the Contract.

The license fee for the rights shall be as set forth in the Pricing Schedule of the Contract, and shall apply regardless of access mode.

Virginia Works is an agency, as defined by §2.2-2006 and legislative, judicial, and independent agencies of the Commonwealth, board, commission, or other quasi-political entity of the Commonwealth of Virginia or other body referenced in Title 2.2 of the Code of Virginia, the license shall be held by the Commonwealth.

Notwithstanding any other provision or other unilateral license terms which may be issued by Supplier after the Effective Date of the Contract, and irrespective of whether any such provisions have been proposed prior to or after the issuance of this Contract for Licensed Services, including access to the Application(s), or the fact that such other agreement may be presented to Virginia Works or its Application Users at the time of accessing the Application(s) (“click wrap”), the terms and conditions set forth in this Contract and any amendments or modifications thereto shall supersede and govern licensing and use of all products and services hereunder.

4. SUPPLIER RESPONSIBILITIES

A. Standard Application Responsibilities Unless otherwise indicated in the requirements section of the Contract, Supplier shall acquire and maintain, at no charge to Virginia Works, the hardware and software required to host the Application(s). The hardware and software on which the Application(s) is hosted will be maintained in good operating condition, consistent with or exceeding generally accepted industry practices and procedures. In addition:

i). Supplier shall maintain sufficient hardware capacity to satisfy the technical requirements and the bandwidth and required storage capacity indicated in the requirements section of the Contract.

ii). Supplier shall be responsible for all telecommunication connections from the server hosting the Application to the Internet.

iii). Supplier may collect user-specific data only as necessary to provide the Licensed Services authorized under the Contract. No information regarding Virginia Works or any Application User shall be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall extend beyond the term of the Contract.

iv). The Application will be made available to Virginia Works and its designated Application Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime. For the

Contract No. _________ Page 3 purposes of this Contract, “Excusable Downtime” is defined as that period of time when the Licensed Services are not available to Virginia Works or its Application Users due to scheduled network, hardware or service maintenance and/or upgrades. Except in cases of emergency, Virginia Works shall be provided a two (2) business day advance notification of such maintenance and/or upgrade. In cases of emergency, Supplier will use its best efforts to notify Virginia Works of a planned Downtime as soon as practicable. Maintenance or upgrades are not to exceed thirty-six (36) hours in duration in a single month and cannot occur Monday through Friday, between the hours of 6:00 a.m.

and 8:00 p.m. Eastern Time.

v). Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the Supplier’s Application, (iii) an electric utility failure at Supplier’s facility where the Application is hosted, or (iv) a network failure up to, but not including, the interconnection point of Supplier’s network to the public switched telephone network.

vi). Supplier guarantees the Application will be available for use at least ninety-nine percent (99%) of the total time during each month, excluding Excusable Downtime.

vii). If non-Excusable Downtime exceeds the parameters listed above, Supplier will credit to Virginia Works the total recurring fees that would otherwise be owed by Virginia Works under this Contract during the month of such failure. Such credit will be issued in the month immediately following the failure.

viii). Supplier shall be required to notify Virginia Works in writing at least sixty (60) days prior to of any planned change(s) or Update(s) to the Application; its functionality; Content storage/ backup/disaster recovery, including physical location; security architecture, features or settings; terminations and/or replacement of any Supplier subcontractor. The planned changes or Updates include any change(s) that would potentially impact the secure and efficient use of the Application, as understood and agreed to between Supplier and Virginia Works at Contract award. The purpose of this notice is to allow sufficient time for Supplier and Virginia Works to discuss any technical/functional considerations and/or changes that would require action by the Commonwealth.

ix). Supplier is responsible for documenting and maintaining any Customizations made for operational use of the Application and/or for interoperability use with other systems or applications used by Virginia Works and paid for solely by Virginia Works. The associated technical data, code, documentation and other necessary information about such Customizations shall be provided by Supplier to Virginia Works within ten (10) business days of the Customizations’ operational use.

Suppler shall be required to routinely transfer knowledge regarding the Application and Licensed Services, including Updates and all material changes, to Virginia Works in a reasonable manner to ensure proper and efficient use of Application and Licensed Services without degrading performance thereof.

x). Supplier agrees to work with Virginia Works to ensure compliance with any approved security exceptions or other identified gaps or requirements provided to Virginia Works in writing by VITA.

xi). Supplier shall not use any software, hardware or services which have been prohibited pursuant to § 2.2-5514 of the Code of Virginia.

In addition, and at no additional cost to Virginia Works, Supplier shall provide access to additional Updates, features, and functionalities of the Application as are provided by Supplier to other customers of Supplier who require functionality similar to that of the Application provided to Virginia Works. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Supplier website.

Notwithstanding the provisions of this Section and except as agreed to in writing by Virginia Works and Supplier, nothing in the Contract shall oblige Supplier to undertake any modifications to the Application, and all such modifications are at Supplier’s sole discretion whether suggested by an Virginia Works or another party.

B. Ancillary Responsibilities Supplier shall, throughout the term of this Contract, make available such resources, including Supplier personnel, as are reasonably required to: (i) train designated Virginia Works personnel in the use of the Application; (ii) develop modifications to the Application as agreed by Virginia Works and Supplier in the Contract or any exhibit hereto or as agreed to by Supplier and Virginia Works; and

Contract No. _________ Page 4

(iii) otherwise support the Application as provided under this Contract and any exhibits hereto or as agreed to between Supplier and Virginia Works.

C. Subcontractors It is understood that Supplier may utilize subcontractors to provide integral components of the Licensed Services and Application; however, except for those so named at time of Contract award, Supplier shall not use new or replacement subcontractors to perform or provide integral components of the Licensed Services or Application during performance of this Contract without advance written notification to and approval by Virginia Works.

Supplier is responsible for the performance of its subcontractors used in providing any portion of the Licensed Services or Application. Additionally, Supplier is responsible for its subcontractors’ compliance with the terms and conditions of this Contract.

If any part of this Contract is supported in whole or in part with federal funds, Supplier shall not subcontract any Services to any subcontractor that is a party excluded from Federal Procurement and Nonprocurement Programs. In no event shall Supplier subcontract with any subcontractor which is debarred by the Commonwealth of Virginia, or which owes back taxes to the Commonwealth and has not made arrangements with the Commonwealth for payment of such back taxes.

5. VIRGINIA WORKS’ RESPONSIBILITIES

Unless otherwise agreed and as applicable, Virginia Works or its Agent, or an A be responsible for input of Content into Supplier’s Application and Virginia Works or its Agent will be responsible for keeping said Content current and accurate. Supplier will have no responsibility for assisting Virginia Works in creating, modifying or inputting the Content, unless specified in this Contract.

If Supplier issues unique USERIDs and passwords to an Application User:

i). Virginia Works is responsible for protecting said passwords and for any authorized and unauthorized use made of the passwords. Virginia Works will fully cooperate with law enforcement authorities in the detection and prosecution of illegal activity related to unauthorized use of the Licensed Services.

ii). Virginia Works shall have the right to add, activate, change access for, or disable USERIDs at its sole discretion. Virginia Works shall designate administrators who will be authorized to add, activate, change access for or disable USERIDs.

iii). Upon notification by Virginia Works of an Application User’s disabled access, Supplier shall remove access authorization by said Application User from its server within one (1) hour of receipt of such notification, ensuring that historical access audit details of such Application User shall not be deleted or lost. If Supplier fails to make such a removal of access, Virginia Works shall not be held liable for any charges or damages incurred due to use of the unauthorized USERID.

iv). Virginia Works and Application Users of this Contract agree to notify Supplier of any degradation, potential breach, or breach of the Content and Application privacy or security as soon as possible after discovery. Virginia Works further agrees to provide Supplier the opportunity to participate in the investigation of the reported situation.

6. CONTENT PRIVACY AND SECURITY

Supplier shall provide a secure environment for Content and any hardware and software, including servers, network and data components provided by Supplier as part of its performance under this Contract. Supplier shall provide a secure environment for Content and any hardware and software in accordance with Commonwealth’s security standards located at: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/ in order to prevent unauthorized access to and use or modification of, and to protect, the Application and Content. Supplier agrees that all Content of Virginia Works is intended solely for the business of Virginia Works and is considered private data. Therefore, Supplier shall, at a minimum, implement the following procedures designed to protect the privacy and security of Content:

a) User identification and access controls designed to limit access to Content to Application Users in accordance with the principles of least privilege.

https://www.vita.virginia.gov/it-governance/itrm-policies-standards/

Contract No. _________ Page 5

b) Supplier shall ensure that all personnel with physical or logical access to Content will receive industry standard annual security awareness training and all other training as required by Content owner, Commonwealth security standards, regulation, or law.

c) Supplier shall ensure that the Application and/or Licensed Services are capable of auditing the following events. Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.

d) Supplier shall ensure that the Application and/or Licensed Services are capable of auditing the following events, for Web applications. All administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes.

e) Supplier shall ensure that the Application and/or Licensed Services employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the Application and/or Licensed Services to support organizational processes for investigation, alerting and response to suspicious activities.

f) Supplier shall ensure that the Application and/or Licensed Services support exporting of log files to the Commonwealth for review and analysis.

g) Supplier shall ensure that the Application and/or Licensed Services are capable of maintaining all audit records in accordance with Commonwealth record retention policies found at the following URL:

http://www.lva.virginia.gov/agencies/records/.

h) Provide evidence of a comprehensive continuous monitoring program encompassing all systems with access to Content.

i) Provide evidence that the Application and/or Licensed Services adhere to a security baseline, which is based on least functionality.

j) Supplier shall ensure that all changes to proposed Application and/or Licensed Services are authorized according to change management policies.

k) Supplier agrees to maintain all metadata associated with any original Content submitted into the Application and/or Licensed Services by Virginia Works for easy retrieval and access, using secure industry standard protocols, within a predefined period as specified in the Contract.

l) Supplier agrees to provide a secure method of exporting Content when requested.

m) Supplier shall ensure that the Content exported from the supplier’s Application or infrastructure is in an industry standard format that provides for interoperability and portability.

n) Supplier shall ensure that the Application and/or Licensed Services provides and maintains a backup of Content that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives, as specified in the Contract.

o) Supplier shall ensure that the Application and/or Licensed Services can store a backup of Content, at least daily, in an off-site “hardened” facility, located within the United States, maintaining the security of the Content.

p) Implement a contingency plan designed to maintain the access to the Application and/or Licensed Services and to prevent the unintended destruction or loss of Content. This plan should provide a predefined frequency, consistent with recovery time and recovery point objectives, as specified in the Contract, for disaster recovery and archival purposes of Content at a secure facility located within the United States.

q) Supplier shall partition, in aggregate for this contract, all Content submitted into the Application and/or Licensed Services by Virginia Works in such a manner that it will not be impacted or forfeited http://www.lva.virginia.gov/agencies/records/

Contract No. _________ Page 6 due to E-discovery, search and seizure or other actions by third parties obtaining or attempting to obtain records, information or Content for reasons or activities that are not directly related to the business of Virginia Works.

r) Service must support multi-factor authentication for access to any administrative portal and/or any remote administrative interface.

s) Supplier shall fully cooperate with Commonwealth incident response resources and all required law enforcement personnel for assistance in the handling and reporting of security incidents.

t) Supplier shall maintain an incident response program that implements incident handling for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes.

u) Incident response must have the capability to support automated mechanisms for supporting incident handling processes.

v) Supplier shall provide quarterly summary reports of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events to: enterpriseservices@vita.virginia.gov

w) Supplier ensures that all Content is removed or destroyed in accordance with and/or exceeding the requirements of the Commonwealth Data Removal standard located at the following URL:

https://www.vita.virginia.gov/it-governance/itrm-policies-standards/.

x) Supplier shall support physical security measures, including securing all Content on a secure server, in locked data cabinets within a secure facility located within the United States.

y) Supplier shall ensure that access to facilities housing Content or supporting applications are restricted to only allow access to Supplier’s personnel and agents who have a need to know in connection with operation and support of the Application and/or Licensed Services.

z) Supplier shall ensure that notification is sent to Virginia Works in writing thirty (30) days prior to its intention to replace or add any third-party that will be provided access to Content whether that access is provided by Supplier or Supplier’s subcontractors. The Virginia Works may reject any additional or new third parties who may be provided access to Content.

aa) Supplier shall ensure that the Application and/or Licensed Services operating systems, middleware, applications, and interfaces will be scanned for vulnerabilities every 30 days and scanning reports be provided to Virginia Works as required by Commonwealth security standards.

bb) Supplier shall cooperate with the Commonwealth to allow monthly vulnerability scans against all public-facing interfaces with access to Commonwealth data.

cc) Application and/or Licensed Services must have the capability to set affinity on tiered systems.

Supplier ensures that no one hypervisor can host the application and the data storage.

dd) Supplier shall ensure that all Content is stored, processed and maintained within the United States at all times.

ee) Supplier shall report the exact geographic location of all Commonwealth data at all times if that Content is not stored in a Commonwealth facility. Supplier shall provide a report to confirm the exact geographic location of any Content not stored in a Commonwealth facility every 30 days.

ff) Supplier shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state and local laws and regulations.

gg) Supplier shall ensure performance of an AICPA SOC-2 (Type 2) audit at least once annually of the Application’s environment. Upon request from Virginia Works, Supplier shall provide a non-mailto:enterpriseservices@vita.virginia.gov

Contract No. _________ Page 7 redacted copy of current AICPA SOC-2 (Type 2) audit. Supplier shall assist Virginia Works in obtaining the current AICPA SOC-2 (Type 2) audit report from any third-party providing services to Supplier, if said third-party services involve the processing or storage of any Content. The Trust Service Principles that should be covered in the SOC -2 Type 2 are: Security, Availability, Processing Integrity, Privacy and Confidentiality.

hh) Supplier understands that Virginia Works or a third-party audit organization is responsible for performing a security audit within 90 days after contract award to determine control gaps between the supplied audit and the Information Security Standard (SEC530). If no audit is supplied, a complete security controls audit utilizing SEC530 must be performed. Failure to do so may result in remedies being levied as provided in the terms and conditions of the contract.

ii) Supplier shall ensure that external connections incorporated into the Application and/or Licensed Services have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Supplier.

jj) Supplier shall ensure that the Application and/or Licensed Services will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through.

kk) Supplier shall ensure that the Application and/or Licensed Services will use industry standard encryption techniques to protect Content that is transmitted or stored on behalf of the Commonwealth. Supplier shall ensure that the Application will provide for the Commonwealth to maintain exclusive control of all encryption keying material.

ll) Supplier shall ensure that they will apply all security updates to their systems as required by Commonwealth security standards. For third-party hosted systems, updates should be installed in compliance with SEC530. Please refer to the following link for the above mentioned Commonwealth security standard: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/.

mm) Supplier shall ensure that they will utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to Content.

nn) Supplier shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files from the software vendor.

oo) Within fifteen (15) business days after the expiration or termination of this Contract, Supplier shall confirm in writing to Virginia Works that all Content has been removed from all systems where the Content resided during performance of this Contract in a manner that complies with and/or exceeds the Commonwealth Data Removal standard located at the following URL:

https://www.vita.virginia.gov/it-governance/itrm-policies-standards/. The written confirmation shall include (i) sufficient detail describing the processes and procedures used in removing the Content, (ii) information about the locations of where it was removed from within the Application and storage and other locations, and (ii) the date the removals were performed. All metadata, in its original form, shall be returned to Virginia Works.

pp) Regular training for Supplier personnel regarding the security and data recovery programs referenced in this Section.

qq) Regular testing of the systems and procedures outlined in this Section; and

rr) Supplier agrees to provide written notice within 24 hours to Virginia Works of all incidents that threaten or could potentially threaten the security of the Commonwealth's Content and Virginia Works’ use of the Licensed Services. This notice is required to allow the Commonwealth to commence any necessary internal actions to remediate such incident, which may include a

Contract No. _________ Page 8 temporary suspension of use of the Licensed Service by Virginia Works as directed by the CIO. If a suspension of use becomes necessary, the Supplier further agrees not to impose any penalty on Virginia Works or the Commonwealth.

ss) Audit controls that record and monitor Application and Licensed Services activity continuously.

tt) Should Supplier fail to perform in compliance with any provision of this Section, Virginia Works may provide Supplier with a written notice to cure. Supplier shall have fifteen (15) days to cure its noncompliance, or with agreement from Virginia Works and VITA, in its governance role, may request a reasonable extension for time to cure providing Virginia Works, and a copy to VITA at:

enterpriseservices@vita.virginia.gov, with a written plan of action to cure. If Suppler fails to cure, Virginia Works may deem Supplier in breach and/or default of the Contract and may immediately terminate the Contract, in whole or in part. Upon such termination, neither the Commonwealth, nor Virginia Works, nor VITA shall have any future liability except Virginia Works will be responsible for deliverables accepted by Virginia Works and Licensed Services rendered to Virginia Works by Supplier. In the event of such termination, Supplier shall accept return of any deliverable that was not accepted by Virginia Works, and Supplier shall refund any monies paid by Virginia Works for such deliverable and for any unused, remaining term paid for in advance by Virginia Works for the Licensed Services up to the date of such termination. Supplier agrees that Virginia Works may pursue all remedies provided under law in the event of a breach or threatened breach of this Section, including reprocurement or transition costs or injunctive or other equitable relief.

7. PROPRIETARY RIGHTS

A. Supplier’s Proprietary Rights

Except as otherwise stated herein, the Licensed Services (including without limitation, the Application and Updates, and Supplier Product, except to the extent that Supplier Product contains Content) and Documentation are the sole and exclusive property of Supplier and its licensors. All modifications, enhancements, Updates, and translations of the Licensed Services shall be deemed a part thereof.

B. Virginia Works Requirements and License Restrictions Except as otherwise provided in this Contract or as provided by law:

i). Virginia Works will use commercially reasonable efforts to ensure that Application Users comply with all of the terms and conditions hereof;

ii). Virginia Works shall not reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from any of the software comprising or in any way making up a part of the Application;

iii). Virginia Works shall not directly or indirectly copy or reproduce all or any part of the Application, whether electronically, mechanically or otherwise, in any form including, but not limited to, the copying of presentation, style or organization, without prior written permission from Supplier; provided, however, Virginia Works may reproduce and distribute any Application output generated from the Virginia Works Content, and an Application User may reproduce and distribute any Application output generated pursuant to the permissions set forth in the Contract;

iv). Virginia Works shall not rent, lease, sublicense, resell for profit, loan, distribute, network or modify the Application or Supplier Product or any component thereof, provided as part of the Licensed Services, except as otherwise authorized by Supplier. However, Virginia Works may reproduce and distribute any Application output (e.g., reports) generated by Virginia Works using the Application, and an Application User may reproduce and distribute any reports or output generated by the Application User using the Application and pursuant to the permissions in the Contract;

v). Virginia Works shall only use the Application and Supplier Product in the normal course of business, in connection with, and as part of, the Licensed Services;

vi). Virginia Works shall not attempt to gain unauthorized access to the Application or Licensed Services, other user accounts, computer systems or networks connected to the Licensed Services;

vii). Virginia Works shall not remove, obscure or alter Supplier’s proprietary notices, disclaimers, trademarks, or other proprietary rights notices of any kind affixed or contained in the Application or

Contract No. _________ Page 9

Licensed Services or any written or electronic report, output or result generated in connection with the Licensed Services;

viii). Virginia Works shall take reasonable care not to, and shall not intentionally or knowingly, use the Application to post, transmit, distribute, store or destroy any information: (i) in violation of any applicable law, statute, ordinance or regulation; (ii) in a manner that shall infringe the intellectual property rights of others; (iii) that is defamatory or trade libelous, or (iv) that contains any Computer Viruses;

ix). Virginia Works shall not use the Application or Licensed Services for any illegal, obscene, offensive or immoral purpose.

C. Virginia Works Proprietary Rights Except as otherwise stated herein and with the exception of any applicable third-party rights, Content and any Customizations made for Virginia Works operation of the Application or for interoperability with other Virginia Works systems or applications paid for by Virginia Works, are and shall remain the sole and exclusive property of Virginia Works, including all applicable rights to patents, copyrights, trademarks, trade secrets or other proprietary property rights thereto. Additionally, all right, title and interest in and to any Content or Customizations relating to Virginia Works business shall remain the property of Virginia Works, whether or not supplied to Supplier or uploaded into the Application. Nothing in this Contract shall be construed as conveying any rights or interest in Content or Customizations to Supplier. Upon termination of the Contract, Supplier agrees to either provide the Content and Customizations to Virginia Works, or, at Virginia Works request, certify in writing that said Content and Customizations in all formats, have been destroyed.

8. CLOUD EXIT ASSISTANCE

Upon execution of this Contract, Supplier and Virginia Works will develop an exit plan (“Exit Plan”) detailing each party’s respective tasks for the orderly transition and migration of all Content stored by Supplier pursuant to the Contract to Virginia Works archive and/or to a system or application maintained by Virginia Works.

At a minimum, the Exit Plan must provide that within 30 days of the expiration or termination of this Contract for any reason, Supplier shall return all Content in its possession provided to Supplier by Virginia Works and/or its Application Users and stored by the Application on behalf of Virginia Works to the Virginia Works in a format accessible without the use of Supplier’s Application. Supplier’s failure to do so will constitute a material breach of this Contract and Virginia Works may exercise all available rights and remedies under law and equity, in addition to any remedies set forth in this Contract.

In addition, at Virginia Works option, Supplier shall continue to provide Licensed Services for up to six (6) months after the date of expiration or termination of the Contract in order to facilitate Virginia Works transition to another service model or provider. Supplier shall also provide such reasonable assistance as may be requested by Virginia Works and agrees such assistance will not be unreasonably withheld.

Supplier shall perform such assistance at the hourly rate or a charge agreed upon by Supplier and Virginia Works. In the event of a termination for breach by Supplier, Supplier shall provide the transition assistance at no charge or fee to Virginia Works.

9. COMMENCEMENT AND ACCEPTANCE OF LICENSED SERVICES

A. Licensed Services Commencement Date

The Supplier shall begin delivery of Licensed Services on the date requested by Virginia Works and agreed to by the Supplier in the Contract. Virginia Works may delay the Licensed Services commencement date by notifying the Supplier at least ten (10) days before the scheduled Licensed Services commencement date.

B. Acceptance The Application shall be deemed accepted when Virginia Works reasonably determines that Virginia Works and its Application Users can successfully access and use all functionalities of the Application which Supplier is required to provide to such Users. Virginia Works agrees to complete Acceptance testing within thirty (30) days after receiving written notice from Supplier of the ability of Virginia Works and its Application Users to access the Application, or within such other period as set forth in the Contract. Supplier agrees to provide to Virginia Works such assistance and advice as Virginia Works may reasonably require, at no additional cost, during such Acceptance testing, other than pre-approved travel expenses incurred which will be reimbursable by Virginia Works at the then current per diem amounts set forth by the Virginia Department of Accounts and published at: http://www.doa.virginia.gov/ http://www.doa.virginia.gov/

Contract No. _________ Page 10 or a successor URL(s). Virginia Works shall provide to Supplier written notice of Acceptance upon completion of successful Acceptance testing. Should Virginia Works fail to provide Supplier written notice of successful or unsuccessful Acceptance testing within five (5) business days following the Acceptance testing period, the Service shall be deemed Accepted.

C. Cure Period If during the Acceptance test period, Virginia Works is unable to access the licensed functionalities of the Application, Supplier shall provide Virginia Works with such access, and Virginia Works Application Users with their required access, within seven (7) days of written notice of inability to access, or as otherwise agreed between Virginia Works and Supplier in the Contract. Should Supplier fail to provide access to the licensed functionalities of the Application, Virginia Works may, in its sole discretion: (i) reject the Application in its entirety and recover amounts previously paid hereunder; (ii) issue a “partial Acceptance” of the Application access with an equitable adjustment in the price to account for such deficiency; or (iii) conditionally accept the applicable Application access while reserving its right to revoke Acceptance if timely correction is not forthcoming.

If Virginia Works and its Application Users are unable to access the licensed functionalities of the Application after a second set of acceptance tests, Supplier shall be deemed in default of the Contract. In the event of such default, Virginia Works may, at its sole discretion, terminate the Contract, in whole or in part, for the Licensed Services to be provided thereunder by Supplier.

10. RECORDS AND AUDIT

Supplier shall maintain accurate records and other evidence pertaining to the costs and expenses for all Licensed Services performed/delivered under this Contract in support of its charges invoiced to Virginia Works. The records will be to the extent and in such detail as will properly reflect all direct and indirect costs associated with the Contract. In addition, Supplier shall maintain accurate records of the Licensed Services, including but not limited to, the “Uptime” and “Downtime” as set forth in the Supplier Responsibilities Section. Virginia Works shall have the right, at any reasonable time during regular business hours after giving reasonable advance notice, to inspect and audit the records applicable to the Contract. Supplier shall preserve such records for three (3) years after termination/completion of the Licensed Services agreed to under this Contract.

11. APPLICATION AND LICENSED SERVICES SUPPORT

At any time during the term of this Contract, Supplier shall provide the following Application Services (including unlimited telephonic support and all necessary travel and labor) without additional charge to Virginia Works in order to ensure Virginia Works and its Application Users are able to access and use the Application in accordance with the requirements of the Contract.

A. Coverage Twenty-four (24) hours per day, seven (7) days a week, Supplier provide to Virginia Works all reasonably necessary telephone or written consultation requested by Virginia Works in connection with use, problems and operation of the Application.

B. Service Levels Within one (1) hour after a request from Virginia Works or VITA, in its governance role, Supplier will respond to such request for support of Licensed Services regarding the Application and Licensed Services, including Application, Supplier Product and documentation in accordance with the procedures identified in Exhibit X, Service Level Agreement. In each case, Virginia Works may describe the problem by telephone or electronic mail or via a web site provided by Supplier. Supplier shall use its best efforts/commercially reasonable efforts to meet Response Time and Resolution Time.

The level of severity (e.g., 1, 2, 3), shall be defined by Virginia Works.

C. Application Evolution Should Supplier merge or splinter the Application previously provided to Virginia Works, such action on the part of Supplier shall not in any way result in Virginia Works being charged additional license or support fees in order to access the Application, to enable its Application Users to access the Application, or to receive enhancements, releases, upgrades or support for the Application.

Contract No. _________ Page 11

12. SERVICE LEVELS AND REMEDIES

A. Availability

Supplier’s failure to make the Licensed Services Available to Virginia Works and its Application Users at least 99% of the time in any given month during the term of the Contract, excluding scheduled maintenance or excusable downtime, shall be deemed a service level default (“Service Level Default”) and Virginia Works may obtain the non-exclusive remedies set forth in Exhibit X, Service Level Agreement. For purposes of this Contract, “Available” means that Virginia Works and its Application Users are able to access all features and functions of the Application and Licensed Services required by Virginia Works, including but not limited to the Application and Supplier Product.

In the event Virginia Works is eligible for a 100% Service Level Credit under this Section during any given month of the term the Contract, Virginia Works may terminate the Contract without penalty upon written notice to Supplier and, in addition to the remedies available under this Section, receive any additional remedies set forth in the Contract.

Credits shall be applied against the next invoice. In the event a Service Level Default occurs after Virginia Works has given notice of termination pursuant to the Term and Termination section of this Contract or due to non-appropriation of funds, or Virginia Works has made final payment to Supplier for the Application and Licensed Services and no further invoices shall issue as a result, Supplier shall refund to Virginia Works the amount of the appropriate Service Level Credit due for the period of default.

B. Provisioning Incremental adds, access authorizations, moves or reductions, including disabled access updates, in the scope of the Licensed Service (e.g., USERIDs), shall be completed within one (1) business hour of a written request (including e-mail or submission to Supplier’s provisioning website) from Virginia Works designated administrator. In the event that provisioning is not made available within one (1) business hour of the request, a credit for the incremental amount of the revision shall be applied against the next invoice for 1/30th of the corresponding pro-rated amount.

C. Reporting Requirements

(i) Monthly Reports:

By the 5th of each calendar month during the term of this Contract, Supplier shall provide Virginia Works with the following written monthly reports:

(a) Service Level Performance Report - a report that contains information with respect to the performance of the Application and Licensed Services. Such report, unless otherwise agreed upon by the parties, shall be in conformity with the reporting Supplier provides to its other customers utilizing an application and licensed services identical or similar to the Application and Licensed Services provided to Virginia Works.

(b) System/Application Patching Compliance Report – a report that illustrates that the supplier has installed security relevant software and firmware updates within 30 days of the release of the updates. .

(c) Scanning Reports (OS, Middleware, Applications and Interfaces) Report – a report that illustrates vulnerability scanning of Cloud Service Providers Operating Systems/infrastructure, databases and web applications(d) Geographic Locations of Data Being Hosted Report – a report that illustrates the location of Commonwealth data

(ii) Quarterly Reports:

By the 5th day of the first month of a calendar quarter, during the term of this Contract, Supplier shall provide the Virginia Information Technologies Agency (VITA) with the following written quarterly report

(a) Summary Report of Intrusion Detection Scans and Intrusion Prevention Scans – a report that demonstrates that supplier protects Commonwealth data with intrusion monitoring tools from unauthorized access, modification and deletion.

Supplier shall submit a copy of each report to VITA at: enterpriseservices@vita.virginia.gov.

Representatives of Supplier and Virginia Works, and VITA at its option, shall meet as often as may be reasonably requested by either party, but no less often than once each calendar quarter during the term of this Contract, to review Supplier’s performance of Licensed Services and the performance of the Application and to discuss technical plans, financial matters, system performance, service levels and any other matters related to the above required reports and to this Contract in general that may be reasonably requested by either Supplier or Virginia Works or VITA. Supplier shall notify VITA of such meetings by

Contract No. _________ Page 12 email to: enterpriseservices@vita.virginia.gov. Virginia Works or VITA may independently audit the report at its expense no more than two (2) times annually.

Failure to submit the required reports will place Supplier in breach of Contract and the Contract may be immediately terminated by the Virginia Works or VITA, in its governance role, and the Supplier/Application will be removed from the Approved Application List.

D. Failure to Meet Service Level Commitments In the event that such Application fails to meet the Service Levels specified herein, Supplier will: (i) promptly replace the Application with an Application that conforms to this Contract and such specifications; (ii) repair the Application, at Supplier’s expense, so that it conforms to this Contract and such specifications; or (iii) refund to Virginia Works all fees paid for the Application and the Licensed Services after the failure of the Application to meet the Service Levels. In the event Supplier fails to comply with these remedies, Virginia Works may exercise all available rights and remedies under law and equity.

E. Escalation…