The file's text, extracted by GovTribe without its formatting.
02.05.2025 Version
ATTACHMENT - CLOUD TERMS TABLE
The following terms shall apply to Cloud Solutions, which may include software and services, purchased by the Commonwealth. Bidder must provide a response indicating the manner in which the proposed Cloud Solution meets each term or provide justification as to why a term is not applicable to the offered Cloud Solution. These terms may be negotiated between Agency and the awarded Bidder and shall take precedence over any conflicting terms provided by the Cloud Solution Provider.
| Category |
| Term |
| Bidder’s Response |
| Support and Training |
| Technical support must be provided via online helpdesk and toll-free phone number, during Business Hours (Monday through Friday from 8:00 a.m. to 6:00 p.m. Eastern Time) or 24x7x365. |
| Service Level |
| Bidder will provide a Service Level Agreement (SLA) which includes (1) guaranteed uptime percentage of at least 99.9%, excluding scheduled maintenance and Force Majeure Events as defined in the Commonwealth Terms and Conditions for Information Technology Contracts and (2) a definition of uptime and how it is calculated |
| Service Level |
| Scheduled maintenance is limited to ten (10) hours per month. The calculation of downtime will include scheduled maintenance in excess of ten hours per month. |
| Service Level |
| Scheduled maintenance must occur with at least two (2) business days’ advance notice, at agreed-upon times, and in no event during Business Hours. |
| Service Level |
| The SLA must include: (1) response and resolution times, (2) multiple levels of defect classifications, and (3) other applicable metrics based on industry standards. |
| Remedies |
| The SLA must include remedies for failure to meet guaranteed uptime, response and resolution time, and other metrics. Remedies may include fee reductions, credits, and extensions in service period at no cost. Remedies for failure to meet guaranteed uptime must scale upwards as availability decreases. |
| Remedies |
| Repeated or consistent failures to meet SLA metrics shall result in (1) a refund of all fees paid by Agency for the period in which failure occurred and (2) participation by the Cloud Solution Provider in a root cause analysis and corrective action plan at Agency’s request. |
| Remedies |
| If uptime is less than 98.0% three times during the Term, or below 90% at any time during the Term, Agency may terminate the subscription and receive a pro-rated refund of all prepaid fees. |
| Reports |
| Agency will be provided with a written report of performance metrics, including uptime percentage and service support requests, classifications, and response and resolution times, as requested by Agency. Agency may independently audit the report at Agency’s expense. |
| Reports |
| Cloud Solution Provider and Agency will meet as often as reasonably requested by either party to review the performance of the Cloud Solution. |
| Reports |
| Cloud Solution Provider will provide to Agency regular status reports during unscheduled downtime, at least once per day or upon Agency’s request. |
| Reports |
| Cloud Solution Provider will provide Agency with root cause analysis within thirty (30) days of unscheduled downtime. |
| Changes |
| Cloud Solution Provider may not change the Cloud Solution during the agreed upon term or period of performance in any manner that adversely affects Agency or degrades the service levels applicable to Agency without Agency’s written approval. |
| Updates and upgrades |
| Cloud Solution Provider will make updates and upgrades available to Agency at no additional cost when solution provider makes such updates and upgrades generally available to its users. |
| Updates and upgrades |
| Cloud Solution Provider will notify Agency at least sixty (60) days in advance prior to any major update or upgrade. |
| Updates and upgrades |
| Cloud Solution Provider will notify Agency at least five (5) business days in advance prior to any minor update or upgrade, except in the case of an emergency such as a security breach. Nothing in this section is intended to alter or modify Cloud Solution Provider’s legal or contractual notice, reporting, or performance obligations with respect to security incidents or data breaches. |
| Updates and upgrades |
| No update, upgrade, or other change may decrease the Cloud Solution’s functionality; or materially and adversely affect Agency’s use of, or access to, the Cloud Solution; or increase the cost to Agency. |
| Agency Data |
| Agency retains full right and title to data provided by Agency and any data derived therefrom, including metadata (collectively, the “Agency Data”). |
| Agency Data |
| Cloud Solution Provider will not collect, retain, access, or use Agency Data except for the specific purpose of, and as strictly necessary for, providing the Cloud Solution to Agency. No Agency Data may be disclosed, provided, rented or sold to any third party for any reason unless required by law. |
| Agency Data |
| Cloud Solution Provider will not use any information collected in connection with the agreement, including the Agency Data, for any purpose other than fulfilling its obligations under the agreement. |
| Agency Data |
| Agency Data must remain within the United States. Cloud Solution Provider must disclose to Agency the identity and location of any third-party host or processor of Agency Data. |
| Agency Data |
| Agency may export the Agency Data at any time during the Term, and for a period of at least three (3) months following termination, in an agreed-upon file format and medium. |
| Agency Data |
| Three (3) months after the termination or expiration of the Term or upon Agency’s earlier written request, solution provider must at its own expense destroy and erase all Agency Data and Agency Confidential Information, unless otherwise required by law. Cloud Solution Provider will maintain, and will send to Agency upon request a written certification certifying that it has destroyed the Agency Data and Confidential Information in compliance with this section. |
| Data Privacy and Security |
| Cloud Solution Provider will comply with all applicable laws related to data privacy and security. Cloud Solution Provider will obtain FedRAMP certification for the Solution and will maintain such certification for the duration of the agreement with Agency. |
| Data Privacy and Security |
| Cloud Solution Provider will not access Agency user accounts or Agency Data except; (1) in the course of data center operations; (2) in response to service or technical issues, as required by the express terms of the agreement; or (3) at Agency’s written request. |
| Data Privacy and Security |
| Cloud Solution Provider will not share Agency Data with its parent company, other affiliate, or any other third party without Agency’s express written consent. |
| Data Privacy and Security |
| Prior to contract execution, Cloud Solution Provider will disclose, and provide all information necessary for Agency to verify, whether Cloud Solution Provider or the Solution will access sensitive data, including without limitation: |
Personal data under M.G.L. c. 66A Personal information under M. G. L. c. 93H and 201 CMR 17.00 Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 Records under the Federal Education Rights and Privacy Act of 1974 Federal Tax Information under IRS Pub. 1075 Criminal Justice Information Criminal Offender Record Information
If the Cloud Solution Provider or the Solution will store, use, access, or obtain potential access to, sensitive data, Cloud Solution Provider and Agency will document any additional specifications and/or requirements pertaining to the Cloud Solution and Cloud Solution Provider.
| Data Privacy and Security |
| Cloud Solution Provider will provide a secure environment for Agency Data and any hardware and software, including servers, network, and data components provided by Cloud Solution Provider as part of its performance. Cloud Solution Provider will utilize information security best practices to protect and prevent unauthorized access to, use of, or modification of, the Cloud Solution and Agency Data. |
| Data Privacy and Security |
| Cloud Solution Provider will encrypt personal and non-public Agency Data in transit and at rest. |
| Data Privacy and Security |
| Cloud Solution Provider will partition Agency Data from other data in such a manner that access to it will not be impacted or forfeited due to e-discovery, search and seizure or other actions by third parties obtaining or attempting to obtain solution provider’s records, information or data for reasons or activities that are not directly related to Agency’s business. |
| Data Privacy and Security |
| In the event of any successful unauthorized access, use, disclosure, modification, or destruction of information that has the potential to impact Agency Data or Cloud Solution Provider’s obligations (a “Security Incident”), or any evidence that leads Cloud Solution Provider to believe that a Security Incident is imminent, Cloud Solution Provider shall promptly (and in no event more than twenty-four hours after discovering such breach) notify Agency. Cloud Solution Provider shall promptly investigate the Security Incident, identify the potentially impacted Agency Data, and inform Agency of the actions it is taking or will take to reduce the risk of further loss to Agency. Cloud Solution Provider shall provide Agency the opportunity to participate in the investigation of the Security Incident and to exercise control over reporting the unauthorized disclosure, to the extent permitted by law. Cloud Solution Provider will cooperate with Agency with respect to any investigations relating to the Security Incident and will provide Agency with any information reasonably requested by Agency in relation to any Security Incident |
| Data Privacy and Security |
| If sensitive data is compromised, Cloud Solution Provider shall be responsible for providing breach notification to data owners in coordination with Agency and the Commonwealth as required by M.G.L. ch. 93H or other applicable law or Commonwealth policy. Cloud Solution Provider shall not send any breach notification notices to Commonwealth's data owners without receiving prior written approval of the Commonwealth. |
| Disaster Recovery |
| Cloud Solution Provider will maintain and follow a disaster recovery plan designed to maintain Agency access to the cloud solution, and to prevent the unintended destruction or loss of Agency Data. In no event shall the Cloud Solution be unavailable for a period in excess of twenty-four (24) hours. |
| Disaster Recovery |
| Cloud Solution Provider will review and test the disaster recovery plan regularly, at minimum twice annually. Cloud Solution Provider will back up Agency Data in an off-site “hardened” facility located within the United States. In the event of service failure, Cloud Solution Provider will restore the Cloud Solution, including Agency Data, with loss of no more than twelve (12) hours of Agency Data and transactions prior to failure. |
| Records and Audit |
| Cloud Solution Provider will maintain accurate, reasonably detailed records pertaining to: (1) substantiation of claims for payment, (2) service levels, including service availability and downtime. |
| Records and Audit |
| Cloud Solution Provider shall keep such records for a minimum of six (6) years from the date of creation. |
| Records and Audit |
| Agency or its designated agent shall have the right, upon reasonable notice, to audit, review, and copy all records collected by Cloud Solution Provider that may reasonably relate to Agency’s use of the Solution. Such records will be made available to Agency or Agency’s agent at no cost to Agency. |
| Transition Assistance |
| Cloud Solution Provider shall reasonably cooperate with Agency and other parties in connection with the Solution. Cloud Solution Provider shall assist Agency in exporting and extracting the Agency Data, in a format usable without the use of the Solution and as agreed to by Agency. |
| Transition Assistance |
| If Agency determines that a documented transition plan is necessary, Cloud Solution Provider shall reasonably cooperate with Agency to document such transition plan no later than sixty (60) days prior to termination or expiration of the agreement. |
| Generative AI Disclosure |
| Contractor will disclose the use of any Generative Artificial Intelligence (“Gen AI”), as defined in EOTSS’ Enterprise Use and Development of Generative Artificial Intelligence Policy issued by EOTSS on January 31, 2025, as they may be amended from time to time. Please follow this link to the policy: www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download. |
| Generative AI Disclosure |
| Contractor will disclose to the Agency in its bid response, and, during the term of the contract, promptly following Contractor’s discovery of such event, the addition of Gen AI or additional Gen AI components to the product or service roadmap of a solution or service. Contractor is under a continuing obligation during the term of any contract with Agency to disclose (a) the Contractor’s intent to use or provide Gen AI and (b) the addition of Gen AI to the product or service roadmap for the solution or services. Such disclosure will include sufficient detail, in plain language, to allow the Agency to fully understand how the Contractor will use Gen AI and meet the requirements of the Commonwealth’s Enterprise Guidelines on the Development and Use of Generative Artificial Intelligence (see link above). Contractor’s failure to timely and clearly disclose such information to the Commonwealth during the bidding or contracting process and during the term of the contract may constitute grounds for disqualification of Contactor’s bid and termination of the contract, in whole or in part, without further cause or penalty. |
| Generative AI Disclosure |
| Contractor will disclose in the bid and in the contract whether access to and use of Agency Data is needed for training or tuning the base model, to test the model prior to production use, or for prompts to generate output during production use of the Gen AI and whether the Agency has the option, prior to or during the term of the contract, of opting out of having its data used for such purpose. |
| Generative AI Disclosure |
| Contractor will disclose whether the Agency may opt out of or disable the use of Gen AI without materially affecting the performance and functionality of the Contractor’s solution or the services and, if so, the procedural and technical steps by which the Agency can effectuate such opt out or disablement. The Agency reserves the right to opt out of contract terms enabling such use at any time during the term of the contract without penalty should Contractor breach these or any other contract terms limiting such use. |
| Generative AI Disclosure |
| Contractor will disclose whether the use of Gen AI requires the Gen AI solution or service to access and/or use data in any form (include without limitation source code) obtained from or provided by Agency Data; what data will be accessed or used by the Gen AI component of the solution or services; and whether such data would be in the form of production data, non-production data or both. |
| Generative AI Disclosure |
| Contractor will disclose in its bid and in the contract whether any derivative data will be created from Agency Data, where “derivative data” means any data that is generated, transformed, or derived from the original Agency Data, including without limitation aggregated data. Contractor will explain in its bid and the contract the purpose for which the derivative data would be generated and the limits on its use, including whether the derivative data would be shared with third parties, used for training AI models, or used for other purposes. |
| Generative AI Disclosure |
| Contractor will disclose the type(s) and frequency of any accuracy and bias or discriminatory outcomes testing performed on its proposed Gen AI solution along with the results of the most recent testing. |