IL IT Specific Supplemental Terms and Conditions - Amendment 2.doc

INFORMATION TECHNOLOGY SPECIFIC SUPPLEMENTAL TERMS AND CONDITIONS

State of Illinois Department of Children & Family Services BidBuy Reference #20-418DCFS-PROCU-B-9536 Agency Reference PO19-304 Contract # PO19-304 Amendment 2 H

INFORMATION TECHNOLOGY SPECIFIC SUPPLEMENTAL TERMS AND CONDITIONS

Table of Contents

51.

Purpose and Scope

52.

Definitions

5A.

Acceptance

5B.

Agent

5C.

Application

5D.

Application User(s)

5E.

Component

5F.

Computer Virus

5G.

Confidential Information

6H.

Content

6I.

Deliverable

6J.

Documentation

6K.

Licensed Services

6L.

Maintenance Period

6M.

Maintenance Services (or “Maintenance” or “Software Maintenance”)

6N.

Party

6O.

Requirements

7P.

Services

7Q.

Service Level Agreements (SLAs)

7R.

Software

7S.

Software Publisher

7T.

Solution

7U.

Supplier

7V.

Update

7W.

Warranty Period

7X.

Work Product

83.

Term and termination

8A.

Contract Kick-Off Meeting

8B.

Contract Closeout

84.

Federal Funds

85.

supplier responsibilities

8A.

Standard Application Responsibilities

86.

State responsibilities

97.

SOFTWARE LICENSE/Licensed services

9A.

License Grant

10B.

License Type

10C.

No Subsequent, Unilateral Modification of Terms by Supplier (“Shrink Wrap”)

11D.

Description of Licensed Services

118.

RIGHTS TO WORK PRODUCT

11A.

Work Product

11B.

Ownership

12C.

Pre-existing Work

12D.

Return of Materials

129.

Proprietary Rights

12A.

Supplier’s Proprietary Rights

12B.

The State Requirements and License Restrictions

13C.

The State Proprietary Rights

1310.

GENERAL Warranty

13A.

Interoperability Warranty

13B.

Documentation and Deliverables

14C.

Malicious Code

14D.

Open Source

14E.

Degradation and Security Vulnerbilities

14F.

Operating System and Software Supportability

14G.

Access to product and Passwords

1511.

DELIVERY AND INSTALLATION

15A.

Scheduling

15B.

Deployment of Solution

15C.

Documentation of Software Configuration

15D.

Data Backup

1512.

acceptance

15A.

Software and Deliverable Acceptance Criteria

16B.

Software and Deliverable Cure Period

16C.

Complete Solution Acceptance Criteria

16D.

Complete Solution Cure Period

16E.

Federal Review

1713.

WARRANTY AND MAINTENANCE SERVICES

17A.

Known Defects

17B.

New Releases

17C.

Coverage

17D.

Solution Evolution

17E.

Escalation and De-escalation Procedures

17F.

Remedies

1814.

OrderING PROCEDURE

1815.

DOCUMENTATION

1816.

THE STATE self-sufficiency

1817.

Transition Assistance

1918.

ESCROW AgreeMENT

19A.

Escrow Account

19B.

Materials

19C.

Verification

20D.

Escrow Warranty

2019.

CYBER SECURITY LIABILITY INSURANCE

2120.

Indemnification and LIABILITY

21A.

Indemnification of Data Breach

21B.

Claim Resolution

21C.

Liability (if applicable)

2121.

SECURITY COMPliance

22A.

Risk Assessment, Data Classification, System Categorization Process, and System Security Plan

22B.

State and Federal Laws

23C.

Safeguards

23D.

DoIT Security Requirements

2622.

Data Access

2623.

BANKRUPTCY

2624.

GenerAL provisions

26A.

Advertising and Use of Proprietary Marks

26B.

Captions/Headings

2725.

acceptable use policy (if aPPLICABLE)

2726.

Third-Party Terms and Conditions

INFORMATION TECHNOLOGY SPECIFIC SUPPLEMENTAL TERMS AND CONDITIONS

1. Purpose and Scope

The following clauses are added to the State of Illinois – Contract Reference # PO19-304. In the event of conflict between these supplemental terms and the State’s standard terms and conditions these supplemental terms and conditions shall control.

2. Definitions

A. Acceptance

Successful delivery and performance by the Supplier of its contractual commitments to implement the solution for the State, including completed and successful Acceptance testing and quality control in conformance with the Requirements. The State reserves the right to contract with a third-party for Acceptance testing and quality control, and the State reserves right for final determination of Acceptance. The Supplier agrees to cooperate and provide complete transparency to any third-party of the State’s chosing.

B. Agent

Any independent third-party or unit of government under contract or agreement with the State.

C. Application

Applications is software or the combination of multiple software as defined in this Contract, and intellectual data, proprietary information and Documentation contained and applicable to Licensed Services hosted and supported by Supplier under the Contract, as described in the IT Specific Supplemental Terms and Conditions, including any Updates, enhancements, and replacements to the Application.

D. Application User(s) Application Users shall include employees of the State, independent contractors engaged by the State, or entities contracting with the State for services, as well as suppliers, members of the general public, and other entities with whom the State may find it necessary or desirable to process or communicate electronically in pursuit of its business.

E. Component

Software or Deliverable delivered by Supplier under this Contract.

F. Computer Virus

Any malicious code, program, or other internal component (e.g., computer virus, computer worm, computer time bomb, or similar component), which could damage, destroy, alter or disrupt any computer program, firmware, or hardware or which could, in any manner, reveal, damage, destroy, alter or disrupt any data or other information accessed through or processed by such software in any manner.

G. Confidential Information

Any confidential or proprietary information of a Party that is disclosed in any manner, including oral or written, graphic, machine readable or other tangible form, to any other Party in connection with or as a result of discussions related to this Contract, and which at the time of disclosure either (i) is marked “Confidential” or “Proprietary”; (ii) is otherwise reasonably identifiable as the confidential or proprietary information of the disclosing Party; (iii) under the circumstances of disclosure should reasonably be considered as confidential or proprietary information of the disclosing Party; (iv) is identifiable or should be reasonably considered as protected health information; or (v) any personally identifiable information, including information about the State employees, contractors, and customers, that is protected by statute or other applicable law. A request for confidential treatment will not supersede the State’s legal obligations under Illinois Freedom of Information Act (FOIA) (5 ILCS 140).

H. Content

Any data, including the selection, arrangement and organization of such data, entered, uploaded to the Application, or otherwise provided to Supplier by the State or by any Application User, and any Software and related Documentation, from whatever source, provided by the State or Application User to Supplier in connection with this Contract.

I. Deliverable

The tangible embodiment of the work performed or Services, Maintenance Services, Licensed Services, Solution, Component, Software, Application, plans, reports, data, product, Supplier product and Updates provided by the Supplier in fulfilling its obligations under the Contract, including the development or creation of Work Product, if Work Product is authorized under the Contract.

J. Documentation

Those materials (including user manuals, training materials, guides, product descriptions, technical manuals, product specifications, supporting materials and Updates) detailing the information and instructions needed in order to allow the State and its Agents to make productive use of the Application, Software, Solution, Component, product, Service, Licensed Services or Deliverable, and to implement and develop self-sufficiency with regard to the Application, Software, Solution, Component, product, Service, Licensed Services or Deliverable, provided by Supplier in fulfilling its obligations under the Contract.

K. Licensed Services

The operation of the Application and the necessary operating system software, hardware and utilities on Supplier’s host computer system, furnishing Supplier product to Application Users, storing Content and making the Application, Content, and Supplier product available to Application User(s).

L. Maintenance Period

The time period in which Maintenance Services shall be provided.

M. Maintenance Services (or “Maintenance” or “Software Maintenance”)

If authorized by the Contract, means those services, preventive and remedial, provided or performed by Supplier under the Contract to ensure continued operation of the Solution, Software or product, including Software Updates. Maintenance Services shall include support services. Software Maintenance Services may include the development of Work Product, if so authorized in the Contract. Maintenance Serivces may be further defined in Service Level Agreements and incorporated into this Contract.

N. Party

The State or Supplier.

O. Requirements

The functional, performance, operational, compatibility, Acceptance testing criteria and other parameters and characteristics of the product, Software, Solution, Component, Service(s), Application and Licensed Services and Deliverables, as authorized by the Contract and/or as set forth in Attachment(s), Exhibit(s), Statements of Work (SOW), and/or Appendices and/or such other parameters, characteristics, or performance standards that may be agreed upon in writing by the Parties.

P. Service(s) Means the furnishing of labor, time, or effort by a contractor, not involving the delivery of a specific end product other than reports or supplies that are incidental to the required performance.

Q. Service Level Agreements (SLAs) The defined parameters of Maintenance Services, including the times during which and time-frames in which Supplier shall respond to a request for Maintenance Services. The available maintenance levels shall be defined and attached to this Contract.

R. Software

Software is programs, code, object code, and configuration files, other asset files, and other related data provided by Supplier under the Contract as a component(s) of any Deliverable or Component of any Solution, or Component of any Application and any subsequent modification of such programs, code, object code, and configuration files, other asset files, and other related data, excluding Work Product. For COTS (boxed) software, means the programs, code, object code, and configuration files, and other asset files, and any subsequent releases, provided by Supplier under this Contract. For Software Maintenance contracts Software also includes the programs, code, object code, and configuration files, other asset files, and other related data provided by Supplier under the Contract in the form of Software Updates.

S. Software Publisher

Means the licensor of the Software provided by Supplier under this Contract, if Software is authorized under the Contract.

T. Solution

The Supplier’s contractually committed technical approach for solving a technology business objective and associated Requirements as defined and authorized by the scope of the Contract. Solution means all Supplier and Supplier’s third-party providers’ Components making up the Solution, including but not limited to Software, Application, configuration, design, implementation, Supplier-developed interfaces, Services, documentation, and Work Product.

U. Supplier

Means the Supplier and any of its Affiliates (i.e., an entity that controls, is controlled by, or is under common control with Supplier).

V. Update

As applicable, any update, modification, new release or new version of the Software, System Software, Application, Solution, Documentation or Supplier product that Supplier makes generally available to its customers at no additional cost. Software Updates include, but are not limited to, patches, fixes, upgrades, enhancements, improvements, or access mode, including without limitation additional capabilities to or otherwise improve the functionality or security, increase the speed, efficiency, or base operation of the Software.

W. Warranty Period

The period, post acceptance, during which the Vendor shall provide all necessary resources to fix problems, defects and complaints regarding inferior product quality (work, service), which are due to a production fault. During the warranty period the Vendor must fix all software defects within the agreed time limit. The warranty period shall be 30 days for SOW, 60 days for Release(s), and 90 for the Solution.

X. Work Product

Inventions, combinations, machines, methods, formula, techniques, processes, improvements, software designs, computer programs, strategies, specific computer-related know-how, data and original works of authorship (collectively, the "Work Product") discovered, created, or developed by Supplier, or jointly by Supplier and the State in the performance of this Contract. Work Product shall not include configuration of software.

3. Term and termination

A. Contract Kick-Off Meeting

Within 30 days of Contract execution, Supplier may be required to attend a contract orientation meeting, along with the the State contract manager/administrator, the State and/or other agency project manager(s) or authorized representative(s), technical leads, the State representatives, as applicable, and any other significant stakeholders who have a part in the successful performance of this Contract. The purpose of this meeting will be to review all contractual obligations for both parties, all administrative and reporting requirements, and to discuss any other relationship, responsibility, communication and performance criteria set forth in the Contract. The Supplier is required to have its assigned engagement manager and a representative from its contracts department in attendance. The time and location of this meeting will be coordinated with Supplier and other meeting participants by State personnel.

B. Contract Closeout

Prior to the contract’s expiration date, Supplier shall provide State contract close out documentation and shall complete, sign and return to the appropriate State personnel within 90 days of receipt. This documentation includes, but is not limited to: Patent/Royalty Certificate, Tangible Property/Asset Certificate, Escrow Certificate, BEP compliance, Completion Certificate, and Final Payment Certificate. Supplier is required to process these as requested to ensure completion of close-out administration and to maintain a positive performance reputation with the State. Any closeout documentation not received within 30 days of Supplier’s receipt of the State’ request will be documented in the contract file as Supplier non-compliance. Supplier’s non-compliance may affect any pending payments due the Supplier, including final payment, until the documentation is returned.

4. Federal Funds If this Contract is supported in part with federal funds. No federal funds received under this contract shall be paid to any party that is a party excluded from Federal Procurement and Nonprocurement Programs.

5. supplier responsibilities – reserved

6. GENERAL Warranty

Supplier warrants that the Services, Solution, Components, Deliverables, product, Software, Updates, as authorized and provided by Supplier under this Contract, shall meet or exceed the Requirements. Supplier shall correct, at no additional cost to the State, all errors identified during the Contract Term that result in Supplier’s failure to meet the Requirement or its contractual obligations.

Further, Supplier warrants and represents to the State that Supplier will fulfill its contractual obligations and meet all Requirements.

Y. Interoperability Warranty

Supplier warrants that each Component, regardless of the origin of the Component, delivered under this Contract shall be interoperable with other Components so as to meet or exceed the performance specified in the Requirements.

Z. Documentation and Deliverables – Reserved AA. Malicious Code

Supplier has used its best efforts through quality assurance procedures to ensure that there are no Computer Viruses or undocumented features in any Solution, Solution Component, Deliverables, product, Software, System Software, Update, Application and/or Licensed Service, as obligated and provided by Supplier at the time of delivery to the State. Supplier warrants that the Solution, Solution Components, Deliverables, product, Software, System Software, Update, Application, and/or Licensed Services, as obligated and provided by Supplier does not contain any embedded device or code (e.g., time bomb) that is intended to obstruct or prevent the State’ use of the Solution, Solution Components, Deliverables, product, Software, System Software, Application, and/or Licensed Service.

Notwithstanding any rights granted under this Contract or at law, Supplier hereby waives under any and all circumstances any right it may have or may hereafter have to exercise Electronic Self-Help. Supplier agrees that the State may pursue all remedies provided under law in the event of a breach or threatened breach of this Section, including injunctive or other equitable relief.

AB. Open Source

Supplier will notify the State if the Solution, Solution Components, Deliverables, product, Software, Updates, Application, and/or Licensed Services, as obligated and provided by Supplier, contains any Open Source code and identify the specific Open Source License that applies to any embedded code dependent on Open Source code, provided by Supplier under this Contract.

THE OBLIGATIONS OF SUPPLIER UNDER THIS GENERAL WARRANTY SECTION ARE MATERIAL. SUPPLIER MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY CONCERNING MERCHANTABILITY OR FITNESS FOR ANY OTHER PARTICULAR PURPOSE.

AC. Degradation and Security Vulnerbilities Supplier warrants that Supplier and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Solution, Application, Software, Licensed Services, Supplier product, and any related deliverables do not include any degradation, known security vulnerabilities, or breach of privacy or security. Supplier agrees to notify the State of any occurrence of such as soon as possible after discovery and provide the State with fixes or upgrades for security vulnerabilities within ninety (90) days of discovery.

AD. Operating System and Software Supportability

Supplier warrants that Supplier and its employees, subcontractors, partners and third-party providers have taken all necessary and reasonable measures to ensure that the Solution, Application, Software, Licensed Services, Supplier product, and any deliverables do not have dependencies on other operating systems or software that are no longer supported by Supplier, or its Subcontractors, partners and third-party providers.

AE. Access to product and Passwords

Supplier warrants that the Solution, Application, Software and Licensed Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Solution, Application, Software, Licensed Services or the hardware or software of the State or its Application Users. In addition, Supplier warrants that the State and its Application Users will be provided commercially reasonable uninterrupted access to the Application. Supplier also warrants that it will not cancel or otherwise terminate access to the Application by disabling passwords, keys or tokens that enable continuous use of the Application by the State and its Application Users during the term of this Contract. Supplier further warrants that the Solution, Application, Software and Licensed Services are compatible with and will operate successfully on the equipment.

7. DELIVERY AND INSTALLATION

AF. Scheduling

Supplier shall deliver the Solution, including any Component parts, and complete performance of Services according to the delivery dates set forth in the Contract.

Supplier shall make available all appropriate and/or related Documentation at the time of delivery of the relevant Component of the Solution. Any Solution Component delivered without the appropriate and required Documentation shall be considered "shipped short" until the applicable documentation has been received.

AG. Deployment of Solution - Reserved AH. Data Backup

Supplier must maintain a robust and reliable data backup system. Supplier must perform a daily backup of the data and systems. Supplier must maintain a minimum thirty (30) days of data backups. At least two weekly copies of the data and systems backups shall be archived and securely transported to a secure external site. Daily backup reports of all successful/failed systems backups/archives must be provided to the State. Data recovery must be accomplished with a minimum slowdown of system functions. Supplier must provide a copy of all data to the State without delay upon request by the State.

8. acceptance

AI. Software and Deliverable Acceptance Criteria

Software and Deliverables shall be deemed accepted when the State determines that such Software and Deliverables successfully operate in accordance with the Requirements of the Contract. At a minimum, Acceptance Criteria for Software and Deliverables, and for the Solution as a whole, shall meet all of the functionality described in the Requirements set forth in the Contract. Acceptance of any one Deliverable shall not imply the State’ concurrence that the Deliverable will function properly with or within the Solution. Supplier shall be responsible for ensuring that all Deliverables function properly within the Solution. Should a previously Accepted Deliverable require further modification in order to work properly with or within the Solution, Supplier shall be responsible for all costs associated with such modification. The State agrees to commence Acceptance testing as mutually agreed by all parties. Supplier agrees to provide to the State and any third-party the State is contracted with, such assistance and advice as the State may reasonably require, at no additional cost, during such Acceptance testing.

AJ. Software and Deliverable Cure Period

Supplier shall correct any non-conformities identified during Acceptance testing and re-submit such non-conforming Software or Deliverable for re-testing within a reasonable time as mutually agreed to by the parties upon written notice of non-conformance. Should Supplier fail to cure the non-conformity or deliver Software or a Deliverable which meets the Requirements, the State may, in its sole discretion: (i) reject the Software or Deliverable in its entirety and recover amounts previously paid hereunder; (ii) issue a “partial Acceptance” of the Software or Deliverable with an equitable adjustment, as determined by the State, in the price to account for such deficiency; or (iii) conditionally accept the applicable Software or Deliverable while reserving its right to revoke Acceptance if timely correction is not forthcoming. Failure of the Software or a Deliverable to meet, in all material respects, the Requirements after a reasonable amount of acceptance tests as defined by the State shall constitute a default by Supplier. In the event of such default, the State may, at its sole discretion, terminate the Contract, in whole or in part, for the Solution to be provided thereunder by Supplier with a refund of any amounts previously paid hereunder for work that has not been Accepted. The State retains its rights to seek any available legal or equitable remedies, including but not limited to monetary damages and reasonable attorney fees and costs.

AK. Complete Solution Acceptance Criteria

Solution shall be deemed accepted when the State determines that such Solution successfully operates in accordance with the Requirements. The State agrees to commence Acceptance testing as mutually agreed by all parties after deployment of the Solution. Acceptance testing will be completed as agreed in writing between the State and Supplier, after deployment of the Solution. Supplier agrees to provide to the State and any third-party the State is contracted with such assistance and advice as the State may reasonably require, at no additional cost, during such Acceptance testing.

AL. Complete Solution Cure Period

Supplier shall correct any non-conformities identified hereunder and shall thereafter re-submit such previously non-conforming Solution or Component products or Services for re-testing within a reasonable time as mutually agreed to by the parties following written notice of non-conformance to Supplier. Should Supplier fail to deliver a Solution which meets the Requirements, the State may, in its sole discretion: (i) reject the Solution in its entirety and recover amounts previously paid hereunder; (ii) issue a "partial Acceptance" of the Solution with an equitable adjustment, as determined by the State, in the price to account for such deficiency; or (iii) conditionally accept the applicable Solution while reserving its right to revoke Acceptance if timely correction is not forthcoming. Failure of the Solution to meet, in all material respects, the specifications and performance standards after a reasonable amount of acceptance tests as defined by the State shall constitute a default by Supplier. In the event of such default, the State may, at its sole discretion, terminate the Contract, in whole or in part, for the Solution to be provided hereunder by Supplier, with a refund of any amounts previously paid hereunder. The State retains its rights to seek any available legal or equitable remedies, including but not limited to monetary damages and reasonable attorney fees and costs.

AM. Federal Review

All Deliverables and Work Products shall be retained by the State and the Supplier for review by Federal authorities for the duration of the project. All deliverables and Work Product will become property of the State.

9. WARRANTY AND MAINTENANCE SERVICES

The following warranty or maintenance services shall supplement any warranties or SLAs outlined in the Contract. Supplier shall provide the following warranty or maintenance services (including unlimited telephonic support and all necessary travel and labor) to maintain the Solution in accordance with the Requirements.

AN. Known Defects

Promptly notify the State in writing of any defects or malfunctions in the Solution or Documentation of which it learns from any source, correct any such defects or malfunctions or provide a work around until corrected, within 1 (one) day of Supplier's knowledge of such defect or malfunction and provide the State with corrected copies of same.

AO. New Releases – Reserved AP. Coverage

AQ. See IFB and Contract for Helpdesk support terms. Solution Evolution

Should Supplier or subcontractor, at any tier, merge or splinter the Solution previously provided to the State, such action on the part of Supplier or subcontractor shall not in any way result in the State being charged additional license or support fees in order to receive enhancements, releases, Updates, upgrades, new versions or support for the Solution.

If Supplier or subcontractor, at any tier, reduces or replaces functionality contained in a licensed Software or Application and provides the same or substantially similar functionality as, or within a separate or renamed Software or Application, then the State shall be entitled to license such Software or Application at no additional license or maintenance fee, and subject to the terms and conditions herein.

If Supplier or subcontractor, at any tier, releases an option, future Software or Application or other release that has substantially the same functionality as the Software or Application provided under this Contract, and Supplier and/or subcontractor ceases to provide maintenance for the older Software or Application, then Supplier or subcontractor shall offer the State the option to exchange licenses for such replacement product or function at no additional charge.

AR. Escalation and De-escalation Procedures

To be provided by Supplier and agreed to by both Parties.

AS. Remedies

If Supplier is unable to make the Solution or any Component thereof conform, in all material respects to the Requirements of the Contract, within thirty (30) days following notification by the State, Supplier shall, at the State’s request, accept return of the tangible Solution Components, and (a) during the Warranty Period, return all monies paid by the State for the returned Solution and Documentation or (b) during any subsequent Maintenance Period, return all monies paid by the State for the returned Solution Components and Documentation, pro-rated using the straight-line method for an estimated Solution life cycle of ten (10) years for perpetual licenses. Pursuant to the remedies above the State shall discontinue use of any Solution Component Software or product.

10. OrderING PROCEDURE

The Supplier is required to accept all Statements of Work (SOW) from the State for work requested that is germane to the Contract and was unforeseeable at the time of Contract award. The State shall submit the SOW outlining scope of work requested. Supplier shall provide an estimated cost and schedule for the completion of the SOW in accordance with pricing schedule outlined in this Contract. No billable work shall begin on SOWs without the written approval of the CIO. In addition, all SOWs over $250,000.00 require Director written approval. Supplier shall notify the State immediately upon discovery that the SOW will exceed approved cost and or schedule and shall cease billable work upon request until a new SOW is approved.

11. DOCUMENTATION

Supplier shall deliver to the State, in the form of electronic media, documentation applicable to Supplier's Deliverable provided to the State upon acceptance. Should Supplier revise or replace the Documentation, or should Documentation be modified to reflect Updates, Supplier shall deliver to the State such updated or replacement Documentation. The State shall have the right, as part of any license grant, to make as many additional copies of the Documentation, in whole or in part, for its own use as required. This Documentation shall include, but not be limited to, overview descriptions of all major functions, detailed step-by-step installation and operating procedures for each screen and activity, and technical reference manuals. Technical reference manuals shall be defined and agreed upon by both parties prior to Deliverable acceptance. Such Documentation shall be revised to reflect any modifications, fixes or updates made by Supplier. The associated technical data, code, documentation and other necessary information shall be provided by Supplier to the State within ten (10) business days of the customizations’ operational use. The State shall have the right, as part of the license granted by Supplier, at its own discretion, to take all or portions of the Documentation, modify or completely customize it in support of the authorized use of the licensed application or software and may duplicate such Documentation and include it in the State’ document or platform. The State will continue to include Supplier's copyright notice.

12. THE STATE self-sufficiency - Reserved

13. Transition Assistance – reserved

14. ESCROW AgreeMENt – reserved

15. CYBER SECURITY LIABILITY INSURANCE

In addition to other insurance coverage requirements in the Contract, Supplier shall carry Cyber Security Liability insurance coverage in the amount of $1,000,000 per occurrence. Cyber liability insurance shall be sufficiently broad to cover all duties and obligations undertaken by Supplier and shall include, but not be limited to, claims involving infringement of intellectual property, but not limited to, infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or description of electronic information, release of private information, alteration of electronic information, extortion and network security. Coverage should include breach response, regulatory fines and penalties, and credit monitoring expenses, with limits sufficient to respond to these obligations. Higher limits may be required when the contract involves large amounts of protected information or is high risk.

Supplier is required to submit the Certificate of Insurance to the solicitation contact within ten (10) days of award. Supplier is required to submit annually thereafter.

16. Indemnification and LIABILITY

AT. Indemnification of Data Breach Supplier shall fully indemnify the State against any and all 3rd party claims against the State due to a data security breach or unauthorized access of the data caused by the vendor, vendor’s employees, representatives, sub-contractors or agents.

AU. Claim Resolution

In the event of a Claim pursuant to any actual or alleged infringement or misappropriation of any third-party’s intellectual property rights by any of the Supplier-provided Deliverables, products, Software, Services, Solution, including Solution Components, Application and Licensed Services, as applicable, or Supplier’s performance, and in addition to all other obligations of Supplier in this Section, Supplier shall at its expense, either:

a) procure for the State the right to continue use of such infringing Deliverables, products, Software, Services, Solution, including Solution Components, Application and Licensed Services, as applicable, or any component thereof; or

b) replace or modify such infringing Deliverables, products, Software, Services, Solution, including Solution Components, Application and Licensed Services, as applicable, or any component thereof, with non-infringing Deliverables, products, Software, Services, Solution or Solution Component(s), Application and Licensed Services, as applicable, satisfactory to the State.

And in addition, Supplier shall provide the State with a comparable temporary replacement product(s) and/or service(s) or reimburse the State for the reasonable costs incurred by obtaining an alternative product or service, in the event the State cannot use the affected Deliverable, product, Software, Services, Solution or Solution Component(s), Application and Licensed Services, as applicable, or any component thereof. If Supplier cannot accomplish any of the foregoing within a reasonable time and at commercially reasonable rates, then Supplier shall accept the return of the infringing Deliverables, products, Software, Services, Solution, Solution Component, Application and Licensed Services, as applicable, or any component thereof, along with any other components rendered unusable by the State as a result of the infringing component, and refund the price paid to Supplier for such components.

AV. Liability (if applicable) Except for liability with respect to (i) any intentional or willful misconduct or negligence of any employee, agent, or subcontractor of Supplier, (ii) any act or omission of any employee, agent, or subcontractor of Supplier, (iii) claims for bodily injury, including death, and real and tangible property damage, (iv) Supplier’s indemnification obligations, (v) Supplier’s confidentiality obligations, (vi) Supplier’s security compliance obligations, and (vii) Supplier’s data privacy and security obligations as specified under this Contract, Supplier’s liability shall be limited to twice the aggregate award value of this Contract. The limitation shall apply on a per-incident basis, it being understood that multiple losses stemming from the same root cause constitute a single incident.

17. SECURITY COMPliance

The State of Illinois has specific security requirements for information and systems. Security and compliance requirements apply to Supplier and all subcontractors utilized for this contract. Supplier must ensure these requirements are fully understood and allocate sufficient project time and resources to address the security requirements. The State reserves the right to identify additional security requirements and incorporate them into this contract.

AW. Risk Assessment, Data Classification, System Categorization Process, and System Security Plan

Prior to the commencement of system development or solution delivery activities, Supplier must participate with the risk assessment, data classification, and system categorization process. The formal risk assessment, data classification, and system categorization process will be administered by the Illinois Department of Innovation & Technology (DoIT). Supplier program and project management personnel must ensure the coordination of these activities with State program and project management personnel.

1. If not specifically addressed in other Supplier Information Technology Requirements, Supplier must adhere to State of Illinois and Illinois Department of Innovation & Technology technology and security Policies, Procedures, and Standards. https://www2.illinois.gov/sites/doit/support/policies/Pages/default.aspx

2. Supplier must also adhere to a minimum-security baseline as identified in the National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Systems and Organizations. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf . If not specifically addressed in other Supplier Information Technology Requirements, Suppliers must assure the adoption of, at minimum, the low security control baselines. Exceptions to this requirement must be approved by the Illinois Department of Innovation & Technology, Division of Information Security.

3. Cloud solutions must adhere to recommendations of the Cloud Security Alliance. Suppliers may find guidance and cross-referencing to the NIST 800-53, Revision 4 with the Cloud Security Alliance controls at https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/ AX. State and Federal Laws

State and Federal laws, rules and regulations as well as industry-specific guidelines require specific and often enhanced security controls on information and systems. The State of Illinois is required to comply with the below laws, standards and regulations. Suppliers must ensure compliance with the below as appropriate based upon the formal risk assessment to include a data classification and system categorization process.

1. Illinois Identity Protection Act (5 ILCS 179)

2. Illinois Personal Information Protection Act (815 ILCS 530)

3. The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99)

4. Illinois Uniform Conviction Information Act (UCIA) (20 ILCS 2635, et seq.)

5. Federal Bureau of Investigations Criminal Justice Information Services (CJIS) Security Policy, (https://www.fbi.gov/about - cjis-security-policy-resource-center).

6. Federal Centers for Medicare & Medicaid Services (CMS) MARS-E Document Suite, Version 2.0 Catalog of Minimum Acceptable Risk Security and Privacy Controls for Exchanges November 10, 2015.

7. Federal Centers for Medicare & Medicaid Services Information Security Acceptable Risk Safeguards (ARS) CMS Minimum Security Requirements Version 2.0 September 20, 2013.

8. Federal Information Processing Standards (FIPS)- 200 Minimum Security Controls

9. Code of Federal Regulations (CFR)- CFR HIPPA 45 CFR- 160, 162, 164

10. Internal Revenue Service (IRS 1075)- Information Security Guidelines

11. Service Organization Control (SOC 2) Compliance

12. National Institute of Standards and Technology Publications 800-18, 22, 30, 88, 122 AY. Safeguards

Upon request, the State shall have the right to review Supplier's information security program during the term of this Agreement. During the performance of this Contract, on an ongoing basis from time to time, the State, at its own expense, shall be entitled to perform, or to have performed, an on-site audit of Supplier's information security program. In lieu of an on-site audit, upon request by the State, Supplier shall implement any reasonably required safeguards as identified by any program audit.

1. Supplier shall not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State.

2. Supplier certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-16) certifications and must provide the State with SOC 1 Type 2, SOC 2 Type 2, or equivalent certifications and other related documents, at initial implementation and on an annual basis going forward.

3. Supplier must allow the State of Illinois Technical Safeguards Unit the ability to perform vulnerability scans at initial implementation and when there are major modifications to the application as defined in the Vulnerability Scanning Agreement.

4. Supplier shall ensure that the Application and/or Licensed Services provides and maintains a backup of Content that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives, as specified in the Contract.

5. Implement a contingency plan designed to maintain the access to the Application and/or Licensed Services and to prevent the unintended destruction or loss of Content. This plan should provide a predefined frequency, consistent with recovery time and recovery point objectives, as specified in the Contract, for disaster recovery and archival purposes of Content at a secure facility located within the continental United States.

AZ. DoIT Security Requirements

DoIT may, at its own expense, and with reasonable notice to Supplier, conduct a security assessment of Supplier’s solution which may include the following;

1. Prior to production deployment;

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. DoIT will not conduct any DOS attacks

e. DoIT will not scan or test any infrastructure devices (servers, switches, routers, ips, etc.)

2. On a quarterly basis for the first year after production deployment;

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. DoIT will not conduct any DOS attacks

e. DoIT will not scan or test any infrastructure devices (servers, switches, routers, ips, etc.)

3. Prior to any enhancements or upgrades being deployed to production;

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. DoIT will not conduct any DOS attacks

e. DoIT will not scan or test any infrastructure devices (servers, switches, routers, ips, etc.)

4. Monthly vulnerability scan;

a. no whitelisting, non-credentialed scan (same day every month),

b. Supplier is required to notify hosting provider that DoiT will be scanning but does not need any whitelisting

5. Remediation of high vulnerabilities and medium vulnerabilities within the application detected during the security assessments that are determined by the SOI to pose an unacceptable risk, must be remediated by the Supplier. Rescans to verify remediation prior to deployment to the production will be conducted by DoIT at its own expense.

6. Data Destruction: After transfer of data back to Agency and/or migration of data to a new or replacement system, and following verification of the data, Supplier must purge any of the State's data that resides on its computer hardware or software. Supplier must perform this purge in a manner no less restrictive than set forth in the requirements for "Purge" contained in NIST Special Publication 800-88, Appendix A: Minimum Sanitization Recommendation for Media Containing Data. Agency reserves the right to verify that data has been properly transferred prior to erasure and to ensure that the data has been removed per this agreement. Supplier must certify in writing the method used including the date and time of data destruction.

7. Supplier must develop a System Security Plan (SSP) using the guidance from NIST Risk Management Framework (RMF) (NIST SP 800-18) to establish an information security program in accordance with the Federal Information Security Management Act (FISMA) and demonstrate compliance. Supplier will provide a security architecture diagram of Supplier’s hosting environment as applicable to the protection of the State’s data and application.

8. Security Control Assessment;

a. Supplier must perform an internal security control assessment. Guidance to conducting and documenting a Security Control Assessment can be obtained from NIST SP 800-53A Guide for Assessing Security Controls in Federal Information Systems. The results of this assessment will be documented in a Security Assessment Report (SAR) to be approved by the State.

9. Security Risk Assessment;

a. Once Supplier receives the approved SAR, Supplier must then develop a Security Risk Assessment based on the applicable security controls. Guidance to conducting and documenting the Security Risk Assessment can be obtained in NIST SP 800-30.

10. Plan of Action and Milestones (POA&M);

a. After Agency reviews and approves the Security Risk Assessment, Supplier shall develop a POA&M. The POA&M should be a living document that is based on the findings and recommendations of the security assessment report. The POA&M should describe the deficiencies in the security controls, address the residual risk and detail plans for remediation. Supplier will provide the State monthly updates regarding progress toward remediation of identified deficiencies in security controls.

11. Life-Cycle Management;

a. Supplier or its Business Associate shall perform security system reviews and reauthorization of the system at the direction of Agency.

12. Performing continuous monitoring of the security system;

13. Supplier’s continuous monitoring must include periodically selecting a subset of the baseline controls for assessment. Based on assessment of these controls, subsequent remediation actions must be identified and implemented. The ongoing remediation process should include updating key documents such as the SSP and POA&M.

14. Prior to any system or environmental modifications, Supplier must perform a security impact analysis. This must be included as a part of any change management or configuration management process. If the results of the modification indicate changes to security posture of the system, corrective actions should be initiated and appropriate documents revised and updated. The updating of the documentation and continuous monitoring should provide near real-time risk management.

15. A monthly Security Status Report must be produced by the Supplier for Agency. The Status Report should provide essential information regarding the security posture of the system as well as the effectiveness of the controls deployed. Ongoing monitoring activities should be detailed as well as ongoing remediation efforts to address known vulnerabilities.

16. Supplier shall house all of data pertinent to this contract within the United States.

17. Supplier shall ensure that the Application and/or Licensed Services employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the Application and/or Licensed Services to support organizational processes for investigation, alerting and response to suspicious activities.

18. Supplier shall ensure that the Application and/or Licensed Services support exporting of log files to the State for review and analysis.

19. Supplier shall partition, in aggregate for this Contract, all Content submitted into the Application and/or Licensed Services by the State in such a manner that it will not be impacted or forfeited due to E-discovery, search and seizure or other actions by third-parties obtaining or attempting to obtain records, information or Content for reasons or activities that are not directly related to the business of the State.

20. Supplier shall fully cooperate with State incident response resources and all required law enforcement personnel for assistance in the handling and reporting of security incidents.

21. Supplier shall provide the capability to document incidents and investigations in the State incident handling system.

22. Supplier shall provide quarterly summary reports of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events to the CIO of the Agency, Security Department of DoIT.

23. Supplier shall support physical security measures, including securing all Content on a secure server, in locked data cabinets within a secure facility located within the continental United States.

24. Supplier shall ensure that access to facilities housing Content or supporting applications are restricted to only allow access to Supplier’s personnel and agents who have a need to know in connection with operation and support of the Application and/or Licensed Services.

25. Supplier shall ensure that all Content is stored, processed and maintained within the continental United States at all times.

26. Supplier shall report the exact geographic location of all State data at all times if that Content is not stored in a State facility. Supplier shall provide a report to confirm the exact geographic location of any Content not stored in a State facility every year.

27. Supplier shall ensure that external connections incorporated into the Application and/or Licensed Services have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Supplier.

28. Supplier shall ensure that they will utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to Content.

29. Should Supplier fail to perform in compliance with any provision of this Section, the State…