MCSA0016_SA_25_Checkmarx_fully_signed.pdf

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 1

Version date 03.01.24

SERVICE ATTACHMENT 25

UNDER

MASTER CLOUD SERVICES AGREEMENT #MCSA0016

This Service Attachment 25 under Master Cloud Services Agreement #MCSA0016 (the “Service Attachment”) is between Carahsoft Technology Corporation (“Service Provider”), having an office at 11493 Sunset Hills Road, Suite 100, Reston, Virginia 20190,and the State of Ohio (“State”), through the Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215. The State and the Service Provider are sometimes referred to jointly as the "Parties" or individually as a “Party.” This Service Attachment is effective as of the date signed by the State and amends that certain Master Cloud Services Agreement #MCSA0016 between the Parties < dated July 1, 2025 (the “Agreement”).

1. Definitions

The defined terms in the Agreement will have the same meanings in this Service Attachment as they do in the Agreement. There may be additional definitions contained herein.

Contract has the same meaning as Agreement in the Agreement.

Contractor has the same meaning as Service Provider in the Agreement.

Subscriber has the same meaning as Subscribing Entity in the Agreement.

2. Services

2.1 Overview. The following Services are available under this Service Attachment that provide a full suite of enterprise AppSec solutions, that help security teams and developers secure applications from the first line of code to deployment in the cloud.

CxOne Essentials include:

SAST: Static Application Security Testing User License (Scanning static or source code);

SCA: Software Composition Analysis License (Scanning open source libraries);

API: Application Program Interface Security Testing (Detection and scanning API code); and Application Security Posture Management (ASPM) (Enhanced dashboarding and reporting).

Premium Support Package includes:

Increased SLAs;

Professional Service Hours;

Technical Consulting, Escalations, Migration and enablement support; and Concurrent Scans. Concurrent Scans are the number of code scans that may be run in parallel, and the number of concurrent scans will be determined by the number of licensed contributing developers in a 1:1 ratio.

Data security information:

a. The Services host or process Subscriber Data outside the United States.

b. The Services do not comply with the requirements to process Protected Health Information.

c. The Services do not comply with the requirements to process Federal Tax Information.

d. The Services do not comply with the requirements to process Criminal Justice Information Systems data.

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 2

2.2 Standard Service Features.

Standard Service features include Standard Support. Standard Support is local business hours Monday through Friday.

2.3 Optional Service Features.

Optional Service is Premium Support. Premium Support is 24x7 support which also includes access to a Customer Success Manager, enhanced SLAs and additional consulting included within the offering.

2.4 Provision of Services. The Contractor will make the Services available to the Subscribers for purchase pursuant to the Contract, including this Service Attachment. The Services will be Available to the Subscribers pursuant to the Contract and this Service Attachment during each Order Term. The State agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by the Contractor regarding future functionality or features.

2.5 Support. The Contractor must provide the Contractor’s basic support for the Services to the Subscribers at no additional charge and upgraded support if available and if purchased by a Subscriber.

Contractor’s basic support is described below. Contractor’s upgraded support options are described below.

Standard Support (included at no cost) includes:

Standard SLAs with Business Hours for support tickets (Automated and Standard);

Proactive AppSec Metric & Usage (Partial);

Roadmap Reviews (Partial);

Onboarding;

Customer success team (pooled);

Integration consulting; and Self-learning AppSec Team training.

Premium Support (Mandatory for Enterprise Customers) includes:

Improved SLAs with 24x7 support (Personalized and Prioritized);

Customer Success Manager (Personalized);

Root Cause Analysis Oversight;

Proactive AppSec Metrics & Usage;

Periodic Business Review;

Environmental Reviews;

Roadmap Reviews;

Knowledge Transfer;

Alternative Presets;

Onboarding;

Integration Consulting;

Instructor-led AppSec Team Training;

Technical Consulting;

Troubleshooting;

AppSec Program Consulting;

Developer Workshops;

Query Tuning;

Preset Optimization; and 1:1 Concurrent scan per developer ratio.

3. Fees and Payment

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 3

3.1 Pricing. The specific pricing for this Service Attachment is set forth in the Pricing Addenda attached hereto and incorporated herein.

Subscriptions are for a 12-month period.

Additional discounts may be applicable for a three-year commitment pursuant to the provisions of the Contract. Billable annually. Three-year terms ensure maximum discount and no annual uplift.

Volume discounts for developer counts between 100-300, 301-500, 500-1000, and 1000 + (Enterprise licenses)

3.2 Fee Structure and Payment. The Subscribers will pay all fees specified in all Orders hereunder, subject to the terms of the Contract. Except as otherwise specified, fees are based on Services purchased and not actual usage, and the number of Object subscriptions (e.g., the number of users) purchased cannot be decreased during the relevant Order Term. They may, however, be increased during an Order Term pursuant to Section 5.2, Orders and Modification, of the Contract. Object subscription fees are based on annual periods that begin on the subscription start date and each 12-month anniversary thereof. No Order may specify a Service or provision not identified and/or priced in this Service Attachment, nor may it cover any billable services not listed in this Service Attachment as a Service.

Any mid-term changes to an annual Order are pro-rated accordingly and charged to the same Order date.

If a Subscriber has not paid the fees specified in an Order by 30 days from the payment due date, the Contractor may suspend a delinquent Subscriber’s access to the unpaid Service(s) until all delinquent amounts are paid, upon written notice to the Subscriber, notwithstanding any prohibition against self-help provided for elsewhere in the Contract. However, Contractor may not suspend Services if the Subscriber is disputing the applicable charges reasonably and in good faith, and is otherwise cooperating diligently to resolve the dispute.

3.3 Invoicing. Fees will be invoiced annually and otherwise in accordance with the Contract. Fees are due in accordance with the terms of the Contract and this Service Attachment, which no Order may alter. Each Subscriber is responsible for providing complete and accurate billing and contact information to the Contractor and notifying the Contractor of any changes to such information.

4. Proprietary Rights

4.1 Reservation of Rights in Services. Subject to the limited rights expressly granted hereunder, the Contractor reserves all rights, title, and interest in and to the Services, including all related intellectual property rights. No rights are granted to the State or Subscribers hereunder other than as expressly set forth herein or elsewhere in the Contract.

4.2 Restrictions. The State and Subscribers will comply with the requirements set forth in Section 2.6, State and Subscriber Rights and Responsibilities, of the Contract. .

4.3 Subscriber Applications and Code. The Subscriber authorizes the Contractor to host, copy, transmit, display, and adapt Subscriber Data solely as necessary for the Contractor to provide the Services in accordance with this Contract.

5. Service Levels and Response Times

5.1 General. The Contractor must use commercially reasonable efforts to make the Services Available 24 hours a day, 7 days a week to Subscribers during the Order Term, except for scheduled downtime described below or any Unavailability covered by the Contract’s Excusable Delay clause or by this Service Levels section.

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 4

5.2 SLAs for the Services. This Service Attachment includes Service Level Agreements (“SLAs”) that will be used to monitor and manage the Contractor’s performance of the Services. The minimum SLAs are listed below, but the Contractor may supplement them with additional SLAs that are generally applicable to its other Services customers, so long as those additional SLAs cover parameters not addressed in the below SLAs or are more stringent than those listed below. Modifications to the SLAs provided below may only be made by the written agreement of the State and the Contractor, except with respect to SLAs the Contractor offers generally to other customers that are more stringent or in addition to those below.

5.3 Availability. “Availability” or “Available” means the Subscriber’s users are able to access a Service and use all material features and functions of the Service effectively and efficiently and the Service meets all the SLAs contained in this Service Attachment. “Unavailable” or “Unavailability” means the Subscriber’s users are unable to access the Service or use all the Service’s features and functions effectively and efficiently or they do not otherwise meet all SLAs in this Service Attachment, subject to the following:

5.3.1 A Service may be Unavailable to a Subscriber’s users during the support window.

Contractor must give Subscribers at least one hour notice via the Services of any scheduled downtime outside of the support window. The support window will occur between the hours of Friday 10:00 pm and Sunday 11:00 pm, Eastern US Time. The Contractor may change the support window to other non-business hours upon reasonable notice to the affected Subscribers. Scheduled downtime will be comprised on the support window, emergency maintenance Contractor performs outside of the support window with one hour notice to Customer, interruptions in third party networks that prevent Internet users from accessing the Services; scheduled or emergency maintenance performed by the infrastructure provider; but will not include other times when the Services are Unavailable.

5.3.2 In addition to scheduled downtime, the following will not be considered times when a Service is Unavailable:

(i) Outages resulting from a Subscriber’s equipment or its Internet service provider;

(ii) A Subscriber’s negligence or breach of its material obligations under this Contract; and

(iii) Excusable Delays, as provided for and handled in accordance with the Contract.

5.4 SLA Credits.

The “Target Availability Level” is the Service’s Availability level that the Contractor plans to meet or exceed during each annual term. The “Service Availability Level” is the number of hours during a particular period that the Service was Available to the Subscriber, excluding scheduled downtime permitted above, divided by the total number of hours during such period. The Target Availability Level is provided in the next section.

The Contractor must permit the State to actively monitor and report any and all Unavailability of a Service annually, along with reasonable details regarding such Unavailability. To the extent agreed in Section 5.5, the Contractor also must provide each Subscriber that uses the Service a credit within 30 days of any calendar month in which the Service Availability Level is below the Target Availability Level, calculated as set forth herein.

The applicable credit will be calculated as follows: If the Contractor fails to meet the Target Availability Level for twenty four hours, each affected Subscriber will be entitled to the equivalent of one day’s fee for the Service. That is, if the fee is an annual fee, the credit would be 1/365th of that annual fee, the aggregate amount of such credits not to exceed ten percent (10%) of the corresponding annual fee.

Any such credits must be credited to the Subscriber within 30 days after the year in which the Contractor fails to meet the Target Availability Level. The credit will appear on the affected Subscriber’s next invoice, or if no future invoices are forthcoming or if the Subscriber so requests, the Contractor will issue a check to the Subscriber as payment within 30 days of the request.

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 5

5.5 Specific SLAs.

The Target Availability Level for the Service(s) is 99.5% for the annual term.

5.6 Response Times

5.6.1 Standard Support Response Times.

P1 (Critical) 6-hour SLA;

P2 (Severe Impact) 12-hour SLA; and P3 (Minor Impact) 2 business days SLA.

Coverage: Working hours, Business Days.

5.6.2 Premium Support Response Times.

P1 (Critical) 2 hour SLA;

P2 (Severe Impact) 4 hour SLA; and P3 (Minor Impact) 2 Business Days.

Coverage: 24x7.

6. Term and Modification

6.1 Term of Service Attachment. This Service Attachment is effective on the date of State signature below and remains in effect for the term of the Contract unless earlier terminated pursuant to the Contract.

6.2 Term of Services. Services purchased under this Service Attachment commence on the start date specified in the applicable Order and continue for the term specified therein, subject to relevant provisions in the Contract, such as the Contract’s termination and non-appropriation provisions. Should a Subscriber and Contractor agree to renew a Services subscription, provided this Contract and Service Attachment remain in effect, the renewal will be at mutually agreed rates.

6.3 Modification. If a change in law, rules, or regulations requires a modification of the renewal price or any terms and conditions in this Service Attachment, the Parties will in good faith negotiate the modifications necessitated by such a change, and any modifications will only be effective upon a written agreement signed by the Parties.

7. Miscellaneous

7.1 Affirmation and Disclosure Form. Contractor must complete an Affirmation and Disclosure Form for this Service Attachment (the form of which is attached as Exhibit I) affirming the Contractor understands and will meet the requirements of Section 9.13 of the Contract. During the performance of the Services under this Service Attachment, if the Contractor changes the location(s) disclosed on an Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 6

IN WITNESS WHEREOF, the Parties have executed this Service Attachment as of the dates written below.

CARAHSOFT TECHNOLOGY

CORPORATION

STATE OF OHIO, DEPARTMENT OF

ADMINISTRATIVE SERVICES

Signature Signature

Kathleen C. Madden Printed Name Printed Name

Director

Title Title

Date Effective Date

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 7

PRICING ADDENDUM 1

Service Attachment 25 Pricing July 1, 2025

Line

Number Part Number Description Price

1 C1- Essential CxOne Essential 1 Year Checkmarx Inc- C1- Essential $1,355.47

2 C1-Concurrent Scan CxOne Concurrent Scan Included Checkmarx Inc - C1- Concurrent Scan

$0.00

3 Premium Support Package

Premium Support Package Checkmarx Inc - Premium Support Package

20% of Services cost

4 CX-Adoption Checkmarx Inc - CX- Adoption $18,279.57

Carahsoft Technology Corporation MCSA0016 Service Attachment 25 (Checkmarx) Page 8

EXHIBIT I

Affirmation and Disclosure Form

The current version of the Affirmation and Disclosure Form is available at:

https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/Af firmation_and_Disclosure_Form_fillable_form.pdf https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/Affirmation_and_Disclosure_Form_fillable_form.pdf https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/Affirmation_and_Disclosure_Form_fillable_form.pdf