FULLY_SIGNED_MCSA0088_Renewal.pdf

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 1 of 15

Version 7/23

MASTER CLOUD SERVICE AGREEMENT (MCSA0088)

AMENDMENT 2 AND RENEWAL

This Amendment 2 to and Renewal of contract #MCSA0088 (the “Amendment”) is between the State of Ohio, Department of Administrative Services (the “State”) and Skillsoft (US) LLC (the “Contractor”). This Amendment changes the terms of the Master Cloud Service Agreement (MCSA0088) (the “Agreement”).

WHEREAS, the State and the Service Provider entered into the Agreement on June 16, 2020; and

WHEREAS, Skillsoft (US) Corporation entered into an entity conversion and became Skillsoft (US) LLC on or about September 29, 2022; and

WHEREAS, the State and the Service Provider determined that an amendment is necessary to address certain revisions to the Agreement.

NOW, THEREFORE, the Agreement is renewed and amended as follows:

1. In Section 1.5., Term, delete the expiration date and replace it with the following date: June 30, 2027.

2. Pursuant to Section 1.6., Agreement - Renewal, the Agreement is renewed for an additional two year term, effective July 1, 2025 and expiring June 30, 2027.

3. In Section 1.8., Relationship of the Parties and Subscribers, delete the link in its entirety and replace it with the following:

https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf.

4. In Section 2.1. Standards, delete all text after the first paragraph through the end of Section 2.1 in its entirety.

5. In Article 1, General Information, add the following new section 1.16. Quarterly Reporting:

1.16. Quarterly Reporting

Contractor must report the quarterly dollar value (in U.S. currency rounded to the nearest whole dollar) of the sales under this Agreement each calendar quarter (i.e., January-March, April-June, July- September and October-December). The dollar value of the sales reported must equal the price paid by all State agencies and Cooperative Purchasing Members for purchases under this Agreement during the reporting period.

Contractor must submit the quarterly sales report to the State via the State’s Ordering System, and when Contractor will be submitting a payment, Contractor must also complete and submit the Quarterly Sales Report and Revenue Share Remittance Form (available at ) with Contractor’s Revenue Share payment. If no sales occur, Contractor must show zero sales on the report. The report must be submitted 30 days after the completion of the reporting period.

Contractor also must submit a closeout sales report within 120 days after the expiration of this Agreement. For purposes of this subsection, the Agreement expires on the physical completion of the last, outstanding task or completion of an Order of the Agreement. The closeout sales report must cover all sales not shown in the final quarterly sales report and reconcile all errors and credits. If Contractor reported all Agreement sales and reconciled all errors and credits on the final quarterly sales report, then Contractor should show zero sales in the closeout sales report.

Contractor’s failure to submit any sales report in a timely manner or falsification of any sales report shall constitute a material breach of this Agreement and the State may terminate this Agreement pursuant to Section 6.1(i).

Docusign Envelope ID: F148B130-30CD-48DE-8208-DCEE8B3D1D51 https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 2 of 15

6. In Section 7.6., Cost Recovery, delete it in its entirety and replace it with the following:

7.6. Revenue Share

The Contractor must pay to the State a share of the sales transacted under this Agreement as a fee to the State to cover the estimated costs the State will incur in administering this Agreement and the Services offered under it (“Revenue Share”). The Contractor must remit the Revenue Share in U.S.

dollars within 30 days after the end of the quarterly reporting period. The Revenue Share that the Contractor must pay under this Agreement equals 2% of the total quarterly sales reported. The Revenue Share must be included in the prices reflected in any order and reflected in the total amount charged to the State, and the Contractor may not add a surcharge to orders under this Agreement to cover the cost of the Revenue Share.

The Contractor must remit any amount due as the result of a quarterly or closeout sales report at the time the quarterly or closeout sales report is submitted to the Department of Administrative Services, Office of State Purchasing. To ensure the payment is credited properly, the Contractor must identify the payment as a “State of Ohio Revenue Share” and include this Agreement number, total report amount, and reporting period covered.

Contractor will pay the Revenue Share by check remittance, both normal and overnight, credit card payment via the State’s epayment portal, or ACH payment, if approved by the State, using the instructions below.

Check remittance: Follow the remittance instructions on the required Quarterly Sales Report and Revenue Share Remittance Form at the following link, https://das.ohio.gov/revenueshareform.

Credit Card Payments: To pay by credit card, use the following link, https://epay.das.ohio.gov/Payment, select “Revenue Share” as the payment type and follow the on-screen prompts.

ACH Payments: If this payment method is approved by the State, the State will provide payment instructions to Contractor.

If the full amount of the Revenue Share is not paid within 30 days after the end of the applicable reporting period, the non-payment will constitute a contract debt to the State. The State may setoff any unpaid Revenue Share from any amount owed to the Contractor under this Agreement and employ all other remedies available to it under Ohio law for the non-payment of the Revenue Share.

Contractor’s failure to pay the Revenue Share in a timely manner shall constitute a material breach of this Agreement, and the State may terminate this Agreement pursuant to Section 6.1(i).

7. In Section 9.6., Drug-Free Workplace, delete it in its entirety and replace it with the following:

9.6. Drug-Free Workplace

The Contractor agrees to comply with all applicable state and federal laws regarding drug-free workplace and shall make a good faith effort to ensure that all Contractor employees, while working on State property or performing work on behalf of the State, will not purchase, transfer, use, be under the influence of, or possess illegal drugs, non-medical cannabis (recreational marijuana), or alcohol, or abuse prescription drugs or medical marijuana in any way.

8. In Section 9.13., Prohibition of the Expenditure of Public Funds for Offshore Services, delete it in its entirety and replace it with the following:

9.13. Prohibition of the Expenditure of Public Funds for Offshore Services

Docusign Envelope ID: F148B130-30CD-48DE-8208-DCEE8B3D1D51 https://das.ohio.gov/revenueshareform https://epay.das.ohio.gov/Payment

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 3 of 15

No State Cabinet, Agency, Board or Commission will enter into any contract to purchase services provided outside the United States or that allows State data to be sent, taken, accessed, tested, maintained, backed-up stored, or made available remotely outside (located) of the United States, unless a duly signed waiver from the State has been attained. Notwithstanding any other terms of this Agreement, the State reserves the right to recover any funds paid for services the Contractor performs outside of the United States for which it did not receive a waiver. The State does not waive any other rights and remedies provided the State in the Agreement.

Further, no State agency, board, commission, State educational institution, or pension fund will make any purchase from or investment in any Russian institution or company. Notwithstanding any other terms of this Agreement, the State reserves the right to recover any funds paid to Contractor for purchases or investments in a Russian institution or company in violation of this paragraph. The provisions of this paragraph will expire when the applicable Executive Order is no longer effective.

The Contractor must complete the Contractor/Subcontractor Affirmation and Disclosure Form affirming the Contractor understands and will meet the requirements of the above prohibition. During the performance of this Agreement, if the Contractor changes the location(s) disclosed on the Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

9. In Section 9.29., Amendments, delete it in its entirety and replace it with the following:

9.29. Amendments

No change to any provision of this Agreement will be effective unless it is in writing and signed by both Parties. However, the State may document non-material changes in writing and provide notice to the Contractor. Unless specifically provided otherwise in this Agreement or agreed to in writing by the Subscriber, no terms or conditions included on a Contractor’s quote or ordering document will be valid or enforceable against the State and are specifically excluded from this Agreement. Further, no “click-through,” “shrink-wrap,” “browse-wrap,” or other terms that have not been specifically negotiated by the Contractor and the State, whether before, on, or after the date of this Agreement, will be effective to add or modify the terms of this Agreement, regardless of any Party’s “acceptance” of those terms by electronic means. No State employee has the authority to modify, amend, or supplement this Agreement through electronic means.

10. In Section 9.30., Boycotting, delete it in its entirety and replace it with the following:

9.30. Boycotting

Pursuant to R.C. 9.76(B), Contractor warrants that Contractor is not boycotting any jurisdiction with whom the State of Ohio can enjoy open trade, including Israel, and will not do so during the contract period.

The State of Ohio does not acquire supplies or services that cannot be imported lawfully into the United States or transact business with any entity or individual subject to financial sanctions imposed by the United States. The Contractor certifies that it, its subcontractors, and any agent of the Contractor or its subcontractors, will acquire any supplies or services in accordance with all trade control laws, regulations or orders of the United States, including the prohibited source regulations set forth in subpart 25.7, Prohibited Sources, of the Federal Acquisition Regulation and any sanctions administered or enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control. A list of those entities and individuals subject to sanctions can be found at https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists. These sanctions generally preclude most transactions involving Cuba, Iran, and Sudan, and most imports from Burma or North Korea.

11. In Article 9, Standard Provisions, add the following new sections:

Docusign Envelope ID: F148B130-30CD-48DE-8208-DCEE8B3D1D51 https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 4 of 15

9.32. Legal Representation and Rights

The Ohio Attorney General is the chief law officer for the State of Ohio, its agencies, boards and commissions, and only the Ohio Attorney General has the authority to appoint outside legal counsel to represent the State. Contractor agrees that any provisions in this Agreement or any documents incorporated by reference that provide or allow for outside legal representation to defend or settle claims on behalf of the State or provide for a third party to have sole control of a defense or settlement of a claim do not meet the requirements of state law and are considered stricken. Contractor also agrees that, unless specifically agreed to in writing by the State, any provisions that require or provide for a waiver of any legal rights, remedies, or litigation defenses (i.e., waiver of a jury trial) do not meet the requirements of state law and are considered stricken.

9.33. Statute of Limitations

Statutes of limitations generally do not apply to actions brought by the State and any such provisions in this Agreement or in any documents incorporated by reference are considered stricken.

9.34. OhioBuys

This Agreement may become part of OhioBuys, an electronic procurement system which provides electronic contract and catalog hosting and management services. Ordering Agencies access this system to place orders for the procurement of goods and services using State of Ohio contracts. When the Agreement becomes part of OhioBuys, the Contractor agrees to establish, maintain and support its contract and catalog in OhioBuys.

9.35. Affirmation and Disclosure Form

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 5 of 15

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 6 of 15

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 7 of 15

9.36. Data Security and Privacy Terms Services

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms apply to all Services, and personnel across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with these Terms as they apply to the Services being provided to the State. The Contractor is responsible for maintaining information security in any environments under the Contractor’s management in accordance with these Terms.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contract means the contract entered into between the Contractor and the State to which these

Terms are attached and/or incorporated.

2. Contractor means the person or entity with whom the State has entered into the Contract and, for purposes of these Terms. Contractor will be responsible, and liable to the State, for any acts or omissions in violation of this Contract by any Affiliate, employee, subprocessor, agent and/or subcontractor of Contractor.

3. Personally Identifiable Information as defined in the Ohio Revised Code means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics.

4. Security Event is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds that does not adversely impact or potentially impact State Data or information systems.

5. Security Incident means there is successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

6. Confidential Data means any type of data that is required to be protected by law or regulation, is intended for confidential use, and may not be copied or removed from the State’s operational control without authorized permission. Confidential Data includes data that, if compromised, may result in loss of life, serious injury, or other harm to an individual or group, or disruption to critical State operations. Confidential Data is included in the definition of Confidential Information in the Contract.

Confidential Data includes (if applicable), but is not limited to:

A. Personally Identifiable Information (PII);

B. Student information under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security

Guidelines for federal, state, and local agencies;

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 8 of 15

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45 CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C.

1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards (PCI DSS);

G. Social Security Administration (SSA) Data which is data received by the State from the Social

Security Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

At a minimum, the Contractor must maintain the security of State Data in accordance with the moderate level security baseline of the current published version of the National Institute of Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (NIST 800-53).

The Contractor must implement the information security policies, standards, and capabilities set forth in the Contract, support the State’s adherence to the State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards.

If the Contractor accesses the State’s facilities or networks, or provides products, solutions, or services that will be implemented or integrated in the State’s controlled environment, the Contractor must ensure its products, solutions, or services comply with State IT Security Polices and Standards, as appropriate (available at the link provided above in the definition of State IT Security Policies and Standards).

Notwithstanding the foregoing, the parties agree that Contractor will not have access to the State’s facilities or networks hereunder, nor will Contractor provide products, solutions, or services that will be implemented or integrated within the State’s controlled environment.

The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Assist in the implementation of associated security procedures with respect to the Skillsoft Product(s) with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per the State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

Docusign Envelope ID: F148B130-30CD-48DE-8208-DCEE8B3D1D51 https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 9 of 15

2. Protection and Handling of State Data

The Contractor must maintain an information security program made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure that computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and prevent State Data from unauthorized disclosure, modification, use, or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding State Data addition, subject to the confidentiality requirements in the Contract set forth in Section 4 “Confidentiality and Handling of Data”:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during the term of the Contract and pursuant to the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and subcontractors to sell, rent, lease, or disclose, any State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that the Contractor’s internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations, ensuring physical and environmental protection controls are implemented as defined in State IT Security Policy 2100-15 and be handled in accordance with the requirements of these Terms at all Contractor locations. . All State Data that is not classified as public by the State must be encrypted at rest and while in transit utilizing industry standards that meet Federal Information Processing Standards (FIPS) validated algorithms and comply with State IT Security Policy IT-14, Securing Confidential Data.

If the Contractor will be accessing, processing, transmitting, possessing, creating, or storing Confidential Data, the State may require additional commercially reasonable documentation from the Contractor and/or input to complete State documentation from time to time, upon reasonable written request to Contractor.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with NIST 800-53 requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 10 of 15

Contractor agrees to maintain FedRAMP Authorization at Moderate Risk Management Framework for the duration of this Agreement.

The Contractor’s information security program must be designed to protect State Data by implementing an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against unauthorized access to, disclosure of, or use of State Data.

D. Giving access to State Data only to those individual employees, officers, agents, and subcontractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperating with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroying or returning to the State per the State’s instructions, in a format designated by the State, all Confidential Information received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

Notwithstanding the foregoing, the Contractor may keep a copy of the Confidential Information to comply with contractual, legal, or record keeping obligations, and any such retained Confidential Information is subject to the requirements of this Contract for so long as the Contractor has the Confidential Information in its possession.

G. Maintaining appropriate and reasonable business continuity and disaster recovery plans to ensure resiliency of State Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered Contract Data and Confidential Information under this Contract, unless it ceases to be PII under applicable law.

The Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, must promptly remediate vulnerabilities, and/or provide the State with patches to address the vulnerabilities at no cost to the State.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), the Contractor warrants that except as otherwise provided in Sections 2.5viii and 6.1iii of the Agreement, its Skillsoft Product(s) as delivered do not contain and will not facilitate the introduction of viruses, malware, and other harmful or malicious code that may, without State’s consent: (i) alter, destroy, inhibit, or discontinue State’s beneficial use of the Skillsoft Products; (ii) erase, destroy, corrupt, or modify any data, programs, materials, or information used by State; (iii) store any data, programs, materials, or information on State’s computers, other than as needed for Contractor to meet its obligations under this Agreement;

or (iv) bypass any internal or external security measure to obtain access to State resources.

4. Permitted Disclosure to Third Parties

Disclosure of Confidential Information is permitted as set forth in the Contract. Additionally, disclosure of Confidential Information is also permitted when required by applicable law, regulation, court order, Skillsoft (US) LLC MCSA0088, Amendment 1 Page 11 of 15 or subpoena. If Receiving Party or any of its representatives are ordered or requested to disclose any Confidential Information of the Disclosing Party hereunder, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Receiving Party must notify the Disclosing Party within 24 hours of receipt of the order or request in order for the Disclosing Party to seek a protective order or take other appropriate action, as desired, unless such notice would be in violation of law. The Receiving Party must also cooperate in the Disclosing Party’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the Disclosing Party.

If, in the absence of a protective order, the Receiving Party is compelled as a matter of law to disclose the information provided by the Disclosing Party, the Receiving Party may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Receiving Party must provide reasonable advance written notice to the Disclosing Party and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Receiving Party may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To employees, Affiliates, or consultants of the Receiving Party who are required to have the information in order for Receiving Party to fulfill its obligations under the Agreement.

C. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

D. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. Contractor shall make available all reasonable information necessary for the State to confirm Contractor’s compliance with this Section 9.36 . If the State has a reasonable basis to conclude that such information provided by Contractor is not satisfactory to confirm such compliance, the State may, at the State’s sole expense, upon reasonable prior notice, conduct an audit during normal business hours and in a manner that does not disrupt Contractor’s business of those Contractor systems and records relevant to Contractor’s processing of State Data on the State’s behalf. Contractor shall limit its exercise of audit rights to not more than once in any 12 calendar month period, unless (1) required by applicable law, rule, or regulation; or (2) following a Security Incident. If the Contractor provides a solution, service, or product hosted by the Contractor or a cloud provider, the Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 Type 2 (SOC 2 Type 2). At any point during the term of the Contract and if not already obtained, the Contractor may obtain and must thereafter maintain FedRAMP authorization in lieu of a SOC 2 Type 2 audit.

B. The SOC 2 Type 2 audits will be completed at the sole expense of the Contractor and the results must be provided to the State upon reasonable request, not more than once annually.

The results of the audits provided to the State are considered Contractor’s Confidential Information under the Contract.

C. When required by law, rule, or regulation, or if the Contractor does not obtain or obtains an adverse opinion on the SOC 2 Type 2 audit described above, the State may, at any time in its

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 12 of 15 sole discretion, elect to perform a security and data protection audit. This includes a reasonable review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met provided such third-party contractor comply with all confidentiality obligations hereunder or be bound by confidentiality terms at least as restrictive.

The State will provide its request in writing and will work with the Contractor to schedule a commercially reasonable time to conduct the audit during normal business hours.

D. At no cost to the State, the Contractor must make a commercially reasonable remedy material issues, material weaknesses, or other items identified in each SOC 2 Type 2 audit hereunder as they pertain to the Skillsoft Product(s) provided under this Contract.

6. Background Investigations of Contractor Personnel

Any person who, to Contractor’s knowledge, (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform Services under the Contract.

The Contractor must conduct background investigations on US Contractor personnel that have access to State Data. The State may conduct background investigations on Contractor personnel that have or may have access to Confidential Data, critical infrastructure systems, or when required by law, rule, or regulation.

If any Contractor personnel refuses to have a background investigation completed or has an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the State Data.

7. Security Incidents and Events

A. Categories Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of, but are not limited to, the following categories:

i. Unsuccessful log-on attempts

ii. Unsuccessful denial of service attacks

iii. Unsuccessful phishing attacks

iv. Unsuccessful network attacks such as pings, probes of firewalls, or port scans.

B. Security Incident Response and Reporting

The Contractor is responsible for Security Incident response with respect to a Security Incident involving the Skillsoft Product(s) ordered by the State, including containment, eradication, and

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 13 of 15 recovery, to minimize the impact to the State. In addition to the requirements in the Contract, the Contractor must perform the following in response to a Security Incident involving State Data.

The Contractor is not required to report Security Events unless a pattern of attacks significantly increases the risk of impact.

The Contractor must report in writing to the State within 24 hours of the Contractor becoming aware (not at the conclusion of an investigation) of any Security Incident and/or use or disclosure of State Data not authorized by the Contract, and fully cooperate with the State to mitigate the consequences of the Security Incident. Within five business days of the initial Security Incident report to the State, the Contractor must document and begin providing follow-up reports for all Security Incidents to the State. The Contractor must provide updates to the follow-up reports until the investigation is complete. At a minimum, the Security Incident reports will include:

i. Data elements involved, the extent of the State Data involved in the Security Incident, and the identification of affected individuals, if applicable.

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed State Data, or to have been responsible for the Security Incident.

iii. A description of where the State Data is believed to have been improperly transmitted, sent, or utilized, if applicable.

iv. A description of the probable causes of the Security Incident and, in the final report, the root cause.

v. A description of the proposed plan for preventing similar future Security Incidents, including a recommended risk remediation plan.

vi. A description of the corrective actions taken, including repair (elimination of a defect or incident and/or restoration of system functionality requirements according to the Contract) and resolution (a temporary workaround to enable system function).

vii. Whether the Contractor believes any federal or state laws requiring notifications to individuals are triggered.

The Contractor must comply with all applicable laws that require the notification of individuals, or with other reasonable direction of the State for notification, in the event of a Security Incident involving personally identifiable information, or any other event requiring such notification. The State may, in its sole discretion, choose to provide notice to any or all parties affected by a Security Incident., but the Contractor shall reimburse the State for the reasonable cost of providing such notification. Contractor further agrees to provide, or to reimburse the State for its costs in providing, any credit monitoring or similar services that are necessary as a result of Contractor’s Security Incident. Under Ohio law, State Data is State property and any illegal activity involving State property is subject to a criminal investigation. The Contractor shall preserve sufficient evidence to ensure accurate Security Incident records, facilitate an investigation, and determine the extent of the Security Incident.

The Contractor shall work with the State to establish a Security Incident reporting communications procedure including Contractor and State contacts, communication methods and tools. If there is no procedure established, the Contractor must report Security Incidents to the primary contact listed in the Contract or that contact’s successor and the Contractor must report the Security Incident to the State via email at CSC@ohio.gov or call 877.644.6860.

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 14 of 15

The State reserves the right to conduct an independent investigation of the Security Incident at its cost, and the Contractor shall reasonably cooperate with the investigation. The independent investigation may be conducted by a State agency or a third party acting on behalf of the State.

8. Generative Artificial Intelligence

“AI System” means any generative AI system within or accessed via the Skillsoft Product(s) that uses self-improving or machine learning software, algorithms, hardware, or any other artificial intelligence tools or aids of any kind. Contractor will use commercially reasonable methods to disclose to the State when AI products are integrated in the Skillsoft Product(s) and identify to a user when the user will be engaging with an AI System, such as (i) using the terms “AI” or “Artificial Intelligence” in the name of the applicable product or feature in which the user will engage with an AI System, for example “AI Assistant”; or (ii) by providing a notice on screen when the user first engages with such product or feature. The State may review the generative AI in the Skillsoft Product(s) to determine if such complies with the State IT Policy IT-17, Use of Artificial Intelligence, and the State may turn off the generative AI features within the Skillsoft Product(s) if necessary via the State’s administrative access to the Skillsoft Product(s). The Contractor is not permitted to utilize State Data in training generative AI models except as specifically approved by the State.

9. Intentionally omitted.

10. Intentionally omitted.

11. Intentionally omitted.

12. Intentionally omitted.

This Amendment shall become effective as of the date of the State’s signature and shall remain in full force and effect for the term of the Agreement. Except as modified by this Amendment, all other terms, conditions and pricing of the Agreement shall remain the same and in full force and effect.

IN WITNESS WHEREOF, the parties have executed this Amendment as of the dates appearing below.

SKILLSOFT (US) LLC STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

By: By:

Name: Name: Kathleen C. Madden

Title: Title: Director

Date: Date:

Docusign Envelope ID: F148B130-30CD-48DE-8208-DCEE8B3D1D51

SVP Sales

Tom Infantino

7/23/2025

Skillsoft (US) LLC MCSA0088, Amendment 1 Page 15 of 15

SUMMARY OF AMENDMENTS

Amendment Number

Effective Date Description

1 Pending Agreement renewal through 6/30/2027 and updated renewal language.