FULLY_SIGNED_MCSA0090_SA3_FINAL.pdf

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 1

Version date 03.01.24

SERVICE ATTACHMENT 3

UNDER

MASTER CLOUD SERVICES AGREEMENT MCSA0090

This Service Attachment 3 under Master Cloud Services Agreement #MCSA0090 (the “Service Attachment”) is between Motorola Solutions, Inc. (“Contractor”), having an office at 500 West Monroe Street, Suite 4400, Chicago, Illinois 60661, and the State of Ohio (“State”), through the Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215. The State and the Contractor are sometimes referred to jointly as the "Parties" or individually as a “Party.” This Service Attachment is effective as of the date signed by the State.

1. Definitions

The defined terms in the Contract will have the same meanings in this Service Attachment as they do in the Contract. There may be additional definitions contained herein.

2. Services

2.1 Overview

Identifying and mitigating cyber threats requires a reliable solution that supplies the right data to cybersecurity experts. Contractor will provide access to its ActiveEye Security Platform, along with 24x7 support from specialized security technologists, who will monitor State’s mission critical network against threat and intrusion.

The following ASTRO® 25 MDR features and services are included:

1) ActiveEye Managed Detection and Response Elements:

a) ActiveEye Security Management Platform;

b) ActiveEye Remote Security Sensor (AERSS); and

c) Internetworking Firewall.

2) Service Modules:

a) Log Collection / Analytics;

b) Network Detection;

c) External Vulnerability Scanning; and

d) Endpoint Detection and Response.

3) Security Operations Center Monitoring and Support.

Data security information:

a. The Service does not host or process State Data outside the United States.

b. The Service does not comply with the requirements to process Protected Health Information.

c. The Service does not comply with the requirements to process Federal Tax Information.

d. The Service does not comply with the requirements to process Criminal Justice Information

Systems data.

2.2 Standard Service Features.

Managed Detection and Response Elements This section and its subsections describe Managed Detection and Response elements, and its applicability for specific infrastructure.

ActiveEye Security Platform Contractor’s ActiveEye security platform collects and analyzes security event streams from

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 2

ActiveEye Remote Security Sensors (AERSS) in the State’s ASTRO 25 network and applicable CEN systems, using security orchestration and advanced analytics to identify the most important security events from applicable systems.

The platform automates manual investigation tasks, verifies activity with external threat intelligence sources, and learns what events will require rapid response action.

The State will receive access to the ActiveEye platform as part of this service. ActiveEye will serve as a single interface to display system security information. Using ActiveEye, the State will be able to configure alerts and notifications, review security data, and perform security investigations.

ActiveEye Managed Security Portal The ActiveEye Managed Security Portal synchronizes security efforts between the State and Contractor.

From this central point, the State will be able to view threat insights, event investigations, security reports, threat advisories, and status of any security cases.

1) Dashboard

a) Key information in the ActiveEye Portal is summarized on the dashboard. This dashboard provides details about open alerts, an overview of alert categories, alert processing, key performance indicators (KPI), open security cases, and recent threat advisories. Also, users can access more in-depth information like security cases, alert details, alert trends, reports, and group communications.

2) Security Cases

a) When the State and Contractor identify a threat, the SOC will create a security case. Through the

ActiveEye Portal, the State can view details of current or past cases, create new cases, or respond to ongoing cases.

3) Alert Details and Trends

a) Alerts can be evidence of a past, active, or developing threat. ActiveEye records relevant data for each alert, enabling users to quickly view its triggers, systems it impacts, and any actions taken to address the alert. ActiveEye Portal also provides tools for reviewing groups of alerts based on key attributes or time periods. Attribute filters enable users to toggle which alert groups ActiveEye Portal shows, helping to spot trends or threat activity. Users can also compare alert logs for specific time periods to determine if specific trends are associated with a threat or are false positives.

4) Investigations and Reporting

a) ActiveEye Portal includes robust ad hoc reporting capabilities, which will provide important, additional information about active and historical threats. Users can share information outside of ActiveEye Portal by downloading reports in .csv or .json format.

b) In addition to ad hoc reporting, ActiveEye Portal can provide a daily email summary and monthly report. Daily email summaries can include alert counts, security cases opened or closed, saved queries that have new data, and detailed endpoint security statistics. If needed, ActiveEye Portal can send one or more summary emails with different content for different groups. Monthly reports are available as a PDF download.

5) Security Advisories

a) Security Advisories are messages initiated from the SOC that share information on active threats with the State’s security teams. These advisories guide security teams on how to best take action against a threat and tell them where they can find further information.

6) Information Sharing

a) The ActiveEye Portal includes several functions for sharing information. Automatic security alerts notify pre-defined contacts of incidents, based on incident priority. Other information sharing functions include:

i) SOC Bulletins - Instructions from the State, or the SOC, that SOC analysts reference when creating security cases. These can communicate short-term situations where a security case may not be needed, such as during testing or maintenance windows.

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 3

b) State Notebook - The SOC will use the State Notebook to document the State’s environment and any specific network implementation details that will help the SOC investigate security cases.

c) Contact Procedures - Escalation procedures and instructions on who to contact if an incident occurs. Contact procedures include instructions and procedures for specific security incident levels. The SOC and the State will jointly manage contact procedures.

7) User Access

a) The ActiveEye Portal provides the ability to add, update, and remove user access. Every ActiveEye user can save queries, customize reports, and set up daily email summaries. Users may be given administrative access, allowing them to perform administrative tasks, such as setting up new service connectors, resetting passwords, and setting up multi-factor authentication for other users.

ActiveEye Remote Security Sensor One or more AERSS will be deployed into the ASTRO 25 network and if applicable to CEN environments to deliver the service. These sensors monitor geo diverse sites for security events and pass security information to the ActiveEye platform.

AERSS integrate the ActiveEye platform with network elements, enabling it to collect logs from Syslog, as well as to analyze network traffic over port(s) and scan elements for vulnerabilities.

Internetworking Firewall Contractor introduces a formalized and centralized Internet connection to the ASTRO® 25 system using an Internetworking Firewall. The Internetworking Firewall serves as a security barrier and demarcation point between a master site and the Internet (or a customer network leading to the Internet). The Internetworking Firewall supports traffic for various ASTRO® 25 features that require access to the Internet. The Internetworking Firewall sits between the Demilitarized Zone (DMZ) and the Internet (or customer network leading to the Internet).

Part Number Description LSV01S02973A ASTRO Managed Detection and Response SSV00S02729A ActiveEye Implementation Services (One Time) T8953A ActiveEye Remote Security Sensor (AERSS)

Service Modules ActiveEye delivers service capability by integrating one or more service modules. These modules provide ActiveEye analytics more information to correlate and a clearer vision of events on the MARCS network.

In addition, modules enable security teams and analysts to more easily access and compare data from these disparate systems. The following subsections describe each ActiveEye service module in detail.

Log Collection / Analytics The AERSS deployed in the system collects logs and other security information from applicable servers, workstations, switches, routers, Network Detection, and firewalls. This information is forwarded to the ActiveEye platform, which uses advanced analytics to identify signs of security incidents. If it identifies signs of a security incident, ActiveEye notifies the SOC for further analysis.

Collected events will be stored in the ActiveEye Security Platform to enable historical searching or threat hunting as needed. Some high volume, repetitive logs may be aggregated as noted in the documentation.

The default storage time period is one year, but no longer than 90 days, following expiration or termination of the Agreement.

Network Detection The AERSS supports Network Detection, constantly monitoring traffic passing across, into, or out of infrastructure. Network Detection analyzes traffic for signs of malicious activity in real time, and performs packet level and flow level analysis to enable communications modeling. This information is used to

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 4 identify anomalous behavior that is not captured by pre-defined traffic signatures, including traffic using encrypted connections. Network Detection forwards detected suspicious activity to the SOC for further analysis.

External Vulnerability Scanning External Vulnerability Scanning is provided for the ASTRO® internet-facing, external network interfaces.

The scan is enabled from an internet cloud hosted service outside the ASTRO® network. Discovery and vulnerability scans will be run quarterly or on a less frequent schedule defined with the State.

Endpoint Detection and Response Endpoint Detection and Response (EDR) is an endpoint security agent that integrates with the ActiveEye security platform to provide additional threat detection, investigation, and response actions to optimize protection of critical systems.

EDR integration with ActiveEye accelerates investigations by making necessary information available for analysts in a single platform where they can quickly access details of what caused an alert, its context, and its history.

The platform enables analysts to initiate response actions (i.e., isolate host, ban or block a file hash, terminate a process) on endpoints to respond to detection of verified malicious activity within the system.

Available responses are determined by the State’s security policies.

Security Operations Center Services Contractor delivers SOC Monitoring using one or more SOC facilities. The SOC includes any centralized hardware and software used to deliver this Service and its service modules. The SOC and its centralized hardware and software are housed within an SSAE-18 compliant data center.

Contractor’s SOC is staffed with security experts who will use ActiveEye Security Management Platform to monitor elements integrated by service modules. In addition, SOC staff will take advantage of their extensive experience to investigate and triage detected threats, and to recommend responses to the Subscriber.

2.3 Optional Service Features. None.

2.4 Provision of Services. The Contractor will make the Services available to the Subscribers for purchase pursuant to the Contract, including this Service Attachment. The Services will be Available to the Subscribers pursuant to the Contract and this Service Attachment during each Order Term. The State agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by the Contractor regarding future functionality or features.

2.5 Support. The Contractor must provide the Contractor’s basic support for the Services to the Subscribers at no additional charge and upgraded support if available and if purchased by a Subscriber.

Contractor’s basic support is described below. Contractor’s upgraded support options are described below.

3. Fees and Payment

3.1 Pricing. The specific pricing for this Service Attachment is set forth in the Pricing Addenda attached hereto and incorporated herein.

3.2 Fee Structure and Payment. The Subscribers will pay all fees specified in all Orders hereunder, subject to the terms of the Contract. Except as otherwise specified, fees are based on Services purchased and not actual usage, and the number of Object subscriptions (e.g., the number of users) purchased cannot be decreased during the relevant Order Term. They may, however, be increased during an Order Term

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 5 pursuant to Section 5.2, Orders and Modification, of the Contract. Object subscription fees are based on annual periods that begin on the subscription start date and each annual anniversary thereof. No Order may specify a Service or provision not identified and/or priced in this Service Attachment, nor may it cover any billable services not listed in this Service Attachment as a Service.

If a Subscriber has not paid the fees specified in an Order by 90 days from the payment due date, the Contractor may suspend a delinquent Subscriber’s access to the unpaid Service(s) until all delinquent amounts are paid, upon written notice to the Subscriber, notwithstanding any prohibition against self-help provided for elsewhere in the Contract. However, Contractor may not suspend Services if the Subscriber is disputing the applicable charges reasonably and in good faith, and is otherwise cooperating diligently to resolve the dispute.

3.3 Invoicing. Fees will be invoiced annually in advance and otherwise in accordance with the Contract.

Fees are due in accordance with the terms of the Contract and this Service Attachment, which no Order may alter. Each Subscriber is responsible for providing complete and accurate billing and contact information to the Contractor and notifying the Contractor of any changes to such information.

4. Proprietary Rights

4.1 Reservation of Rights in Services. Subject to the limited rights expressly granted hereunder, the Contractor reserves all rights, title, and interest in and to the Services, including all related intellectual property rights. No rights are granted to the State or Subscribers hereunder other than as expressly set forth herein or elsewhere in the Contract.

4.2 Restrictions. Subscribers will comply with the requirements set forth in Section 2.7, State and Subscriber Responsibilities, of the Contract. Nothing herein prohibits a Subscriber from porting and hosting Generated Files, as defined in this Contract, to other sites to support its own business purposes during and after any term of an Order.

4.3 Subscriber Applications and Code. If a Subscriber, a third party acting on a Subscriber’s behalf, or a user creates applications data or code using the Services, such will be part of the Subscriber Data.

The Subscriber authorizes the Contractor to host, copy, transmit, display, and adapt such Subscriber Data solely as necessary for the Contractor to provide the Services in accordance with this Contract. Further, the Subscriber will be entitled to port, use, modify, disclose, license, sell, and host such anywhere.

5. Service Levels and Response Times

5.1 General. The Contractor must use commercially reasonable efforts to make the Services Available 24 hours a day, 7 days a week to Subscribers during the Order Term, except for scheduled downtime described below or any Unavailability covered by the Contract’s Excusable Delay clause or by this Service Levels section.

5.2 SLAs for the Services. This Service Attachment includes Service Level Agreements (“SLAs”) that will be used to monitor and manage the Contractor’s performance of the Services. The minimum SLAs are listed below, but the Contractor may supplement them with additional SLAs that are generally applicable to its other Services customers, so long as those additional SLAs cover parameters not addressed in the below SLAs or are more stringent than those listed below. Modifications to the SLAs provided below may only be made by the written agreement of the State and the Contractor, except with respect to SLAs the Contractor offers generally to other customers that are more stringent or in addition to those below.

5.3 Availability. “Availability” or “Available” means the Subscriber’s users are able to access a Service and use all material features and functions of the Service effectively and efficiently and the Service meets all the SLAs contained in this Service Attachment. “Unavailable” or “Unavailability” means the Subscriber’s

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 6 users are unable to access the Service or use all the Service’s features and functions effectively and efficiently or they do not otherwise meet all SLAs in this Service Attachment, subject to the following:

5.3.1 A Service may be Unavailable to a Subscriber’s users during scheduled downtime.

Contractor must give Subscribers at least eight hours’ notice via the Services of any scheduled downtime. Scheduled downtime will only occur for less than one hour between 10:00 p.m. and 6:00 a.m. Eastern Time and on Weekends, and not more than once monthly. The Contractor may change the scheduled downtime to other non-business hours upon reasonable notice to the affected Subscribers. Scheduled downtime will not be considered times when the Services are Unavailable.

5.3.2 In addition to scheduled downtime, the following will not be considered times when a Service is Unavailable:

(i) Outages resulting from a Subscriber’s equipment or its Internet service provider;

(ii) A Subscriber’s negligence or breach of its material obligations under this Contract; and

(iii) Excusable Delays, as provided for and handled in accordance with the Contract.

5.4 SLA Credits. The “Target Availability Level” is the Service’s Availability level that the Contractor plans to meet or exceed during each calendar month. The “Service Availability Level” is the number of hours during a particular period that the Service was Available to the Subscriber, excluding scheduled downtime permitted above, divided by the total number of hours during such period. The Target Availability Level is provided in the next section.

The Contractor must actively monitor and report to the State and each Subscriber any and all Unavailability of a Service monthly, along with reasonable details regarding such Unavailability. The Contractor also must provide each Subscriber that uses the Service a credit within 30 days of any calendar month in which the Service Availability Level is below the Target Availability Level, calculated as set forth herein.

The applicable credit will be calculated as follows: If the Contractor fails to meet the Target Availability Level by up to four hours, each affected Subscriber will be entitled to the equivalent of one day’s fee for the Service. That is, if the fee is an annual fee, the credit would be 1/365th of that annual fee, or if it is a monthly fee, the Subscriber would be entitled to 1/30th of its monthly fee as a credit. Further, the credit will double if the Target Availability Level is missed by more than four but less than twelve hours for any calendar month. If the failure to meet the Target Availability Level is greater than twelve hours, the Subscriber will be entitled to the entire fee applicable to that month.

Any such credits must be paid to the Subscriber within 30 days after the month in which the Contractor fails to meet the Target Availability Level.

If the Contractor fails to meet the Target Availability Level for three consecutive calendar months, any affected Subscriber may terminate any or all Orders for that Service for cause.

5.5 Specific SLAs. The platform utilizes a multi-zone architecture which can recover from failures in different data collection, enhancement, analysis, and visualization tiers. Motorola Solutions will make commercially reasonable efforts to provide monthly availability of 99.9% for the ActiveEye Platform services with the exception of; maintenance windows, telecommunication circuit availability/performance between Customer sites, any on-premise core and/or between on-premise equipment and the ActiveEye Platform.

There are many factors beyond Motorola Solutions’ control that may impact Motorola Solutions’ ability to achieve this goal, including but not limited to a Force Majeure event.

5.6 Response Times

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 7

Incident Priority Level Definitions and Response Times Priority for alert-generated incident or Events of Interest is determined by the ActiveEye Platform analytics that process multiple incoming alert feeds, automation playbooks, and cybersecurity analyst knowledge.

Priority Definition Service Coverage Critical Security incidents that have caused, or are suspected to have caused significant damage to the functionality of the Subscriber’s ASTRO 25 system or information stored within it. Efforts to recover from the incident may be significant.

Response provided 24 hours, 7 days a week, including United States (U.S.) public holidays.

High Security incidents that have localized impact and may become more serious if not quickly addressed. Effort to recover from the incident may be moderate to significant.

Response provided 24 hours, 7 days a week, including U.S. public holidays.

Medium Security incidents that potentially indicate an attacker is performing reconnaissance or initial attempts at accessing the system. Effort to recover from the incident may be low to moderate.

Response provided on standard business days, Monday through Friday 8 a.m. to 5 p.m.

CST/CDT, excluding U.S. public holidays.

Low These are typically service requests from the Subscriber. Response provided on standard business days, Monday through Friday 8 a.m. to 5 p.m.

CST/CDT, excluding U.S. public holidays.

Response Time Goals

Priority Response Time Critical An SOC Cybersecurity Analyst will make contact with the customer technical representative within one hour of the request for support being logged in the issue management system or the creation of an alert suggesting a cybersecurity incident that requires action. Continual effort will be maintained to identify the extent of the incident and provide actions for containment.

High An SOC Cybersecurity Analyst will make contact with the customer technical representative within four hours of the request for support being logged at the issue management system or the creation of an alert suggesting a cybersecurity incident that requires action. Continual effort will be maintained to identify the extent of the incident and provide actions for containment.

Medium An SOC Cybersecurity Support Engineer will make contact with the customer technical representative within the next business day of the request for support being logged at the issue management system or the creation of an alert suggesting a cybersecurity incident that requires action.

Low An SOC Cybersecurity Support Engineer will make contact with the Customer technical representative within seven business days of the logged request for support at the issue management system.

6. Term and Modification

6.1 Term of Service Attachment. This Service Attachment is effective on the date of State signature below and remains in effect for the term of the Contract unless earlier terminated pursuant to the Contract.

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 8

6.2 Term of Services. Services purchased under this Service Attachment commence on the start date specified in the applicable Order and continue for the term specified therein, subject to relevant provisions in the Contract, such as the Contract’s termination and non-appropriation provisions. Should a Subscriber elect to renew a Services subscription, provided this Contract and Service Attachment remain in effect, the renewal will be at the Subscriber’s option and will be for the same or greater discount from list as the Services subscription being renewed and under the same terms and conditions.

6.3 Modification. If a change in law, rules, or regulations requires a modification of the renewal price or any terms and conditions in this Service Attachment, the Parties will in good faith negotiate the modifications necessitated by such a change, and any modifications will only be effective upon a written agreement signed by the Parties.

7. Miscellaneous

7.1 Affirmation and Disclosure Form. Contractor must complete an Affirmation and Disclosure Form for this Service Attachment (the form of which is attached as Exhibit I) affirming the Contractor understands and will meet the requirements of Section 9.13 of the Contract. During the performance of the Services under this Service Attachment, if the Contractor changes the location(s) disclosed on an Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

IN WITNESS WHEREOF, the Parties have executed this Service Attachment as of the dates written below.

MOTOROLA SOULTIONS, INC.

STATE OF OHIO, DEPARTMENT OF

ADMINISTRATIVE SERVICES

Signature Signature Andrea M. Ballou, PMP Kathleen C. Madden

Printed Name Printed Name Regional Services Manager Director

Title Title

Date Effective Date

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 9

PRICING ADDENDUM 1

Service Attachment 3 Pricing June 1, 2025

Part Number Description Price (year) SSV00S02729A ActiveEye Implementation Services (One Time) $29,628.00 T8953A ActiveEye Remote Security Sensor (AERSS) Qty 3 $27,950.00 LSV01S02973A MDR for ASTRO - Year 1 Service - 7/1/2025 - 6/30/2026 $183,376.17 LSV01S02973A MDR for ASTRO - Year 2 Service - 7/1/2026 - 6/30/2027 $186,098.21 LSV01S02973A MDR for ASTRO - Year 3 Service - 7/1/2027 - 6/30/2028 $193,542.14 LSV01S02973A MDR for ASTRO - Year 4 Service - 7/1/2028 - 6/30/2029 $201,283.83 LSV01S02973A MDR for ASTRO - Year 5 Service - 7/1/2029 - 6/30/2030 $209,341.88 LSV01S02973A MDR for ASTRO - Year 6 Service - 7/1/2030 - 6/30/2031 $217,716.30 LSV01S02973A MDR for ASTRO - Year 7 Service - 7/1/2031 - 6/30/2032 $226,425.70 LSV01S02973A MDR for ASTRO - Year 8 Service - 7/1/2032 - 6/30/2033 $235,488.68 LSV01S02973A MDR for ASTRO - Year 9 Service - 7/1/2033 - 6/30/2034 $244,905.25 LSV01S02973A MDR for ASTRO - Year 10 Service - 7/1/2034 - 6/30/2035 $254,694.01 LSV01S02973A MDR for ASTRO - Year 11 Service - 7/1/2035 - 6/30/2036 $267,428.71 LSV01S02973A MDR for ASTRO - Year 12 Service - 7/1/2036 - 6/30/2037 $280,800.15 LSV01S02973A MDR for ASTRO - Year 13 Service - 7/1/2037 - 6/30/2038 $294,840.15 LSV01S02973A MDR for ASTRO - Year 14 Service - 7/1/2038 - 6/30/2039 $309,582.16 LSV01S02973A MDR for ASTRO - Year 15 Service (6 Months) - 7/1/2039-12/31/2039 $162,530.63

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 10

EXHIBIT I

Affirmation and Disclosure Form

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

The Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate “Not Applicable” in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

Motorola Solutions, Inc. MCSA0090 Service Attachment 3 Page 11

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Contractor also affirms, understands, and agrees that Contractor and its subcontractors are under a duty to disclose to the State any change or shift in location of services performed by Contractor or its subcontractors before, during and after execution of any contract with the State. Contractor agrees it shall so notify the State immediately of any such change or shift in location of its services. The State has the right to immediately terminate the contract, unless a duly signed waiver from the State has been attained to perform the services outside the United States.

On behalf of the Contractor, I acknowledge that I am duly authorized to execute this Affirmation and Disclosure Form and have read and understand that this form is a part of any Contract that Contractor may enter into with the State and is incorporated therein.

By: __________________________________ Contractor

Print Name: ___________________________

Title: __________________________________

Date: __________________________________