MCSA0086_AppExtremes_dba_Conga_AM1_and_Renewal_SIGNED.pdf

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 1 of 13

Version 5/24

MASTER CLOUD SERVICES AGREEMENT (#MCSA0086)

AMENDMENT 1 AND RENEWAL

This Amendment and Renewal to contract #MCSA0086 (the “Renewal”) is between the State of Ohio, Department of Administrative Services (the “State”) and AppExtremes, LLC d.b.a. Conga (the “Contractor”). This Renewal renews AppExtremes, LLC d.b.a. Conga Master Cloud Services Agreement (MCSA0086) (the “Contract)”) for the term set forth below..

WHEREAS, the State and Contractor entered into the Contract on May 5, 2020; expiring on May 5, 2025;

WHEREAS, the State and Contractor desire to renew the Contract; and

WHEREAS, the State and Contractor determined that an amendment is necessary to address certain revisions to the Contract.

NOW, THEREFORE, the Contract is renewed and amended as follows:

1. Pursuant to Section 1.5, Agreement-Renewal, the Contract is renewed for an additional term of two years, beginning on May 6, 2025, and ending on May 5, 2027.

2. In Section 1.7, Relationship of the Parties and Subscribers, delete the PEDACKN form link in its entirety and replace it with the following link:

https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf .

3. In Article 1, General Information, add the following as new Section 1.15 OhioBuys:

1.15. OhioBuys

This Contract may become part of OhioBuys, an electronic procurement system which provides electronic contract and catalog hosting and management services. Ordering Agencies access this system to place orders for the procurement of goods and services using State of Ohio contracts. When the Contract becomes part of OhioBuys, the Contractor agrees to establish, maintain and support its contract and catalog in OhioBuys.

4. In Section 9.6, Drug-Free Workplace, delete it in its entirety and replace it with the following:

9.6. Drug Free Workplace

The Contractor agrees to comply with all applicable state and federal laws regarding drug-f ree workplace and shall make a good faith ef fort to ensure that all Contractor employees, while working on State property or performing work on behalf of the State, will not purchase, transfer, use, be under the inf luence of , or possess illegal drugs, non-medical cannabis (recreational marijuana), or alcohol, or abuse prescription drugs or medical marijuana in any way.

5. In Section 9.13, Prohibition of the Expenditure of Public Funds for Of fshore Services, delete it in its entirety and replace it with the following:

9.13. Prohibition of the Expenditure of Public Funds for Offshore Services

No State Cabinet, Agency, Board or Commission will enter into any contract to purchase services provided outside the United States or that allows State data to be sent, taken, accessed, tested, maintained, backed-up, stored, or made available remotely outside (located) of the United States, unless a duly signed waiver f rom the State has been attained. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid for services https://www.opers.org/forms-archive/PEDACKN-Non-Member-Acknowledgment.pdf

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 2 of 13 the Contractor performs outside of the United States for which it did not receive a waiver. The State does not waive any other rights and remedies provided the State in the Contract.

Further, no State agency, board, commission, State educational institution, or pension fund will make any purchase f rom or investment in any Russian institution or company. Notwithstanding any other terms of this Contract, the State reserves the right to recover any funds paid to Contractor for purchases or investments in a Russian institution or company in violation of this paragraph. The provisions of this paragraph will expire when the applicable Executive Order is no longer ef fective.

The Contractor must complete the Contractor/Subcontractor Af f irmation and Disclosure Form af f irming the Contractor understands and will meet the requirements of the above prohibition.

During the performance of this Contract, if the Contractor changes the location(s) disclosed on the Af f irmation and Disclosure Form, Contractor must complete and submit a revised Af f irmation and Disclosure Form ref lecting such changes.

6. In Section 9.29, Amendments, delete it in its entirety and replace it with the following:

9.29. Amendments

No change to any provision of this Contract will be ef fective unless it is in writing and signed by both Parties. However, the State may document non-material changes in writing and provide notice to the Contractor. Unless specif ically provided otherwise in this Contract or agreed to in writing by the Subscriber in a Contractor’s quote or ordering document, no terms or conditions included on a Contractor’s quote or ordering document will be valid or enforceable against the State and are specif ically excluded f rom this Contract. Notwithstanding the foregoing and for clarity, in the case of any conf lict between such terms and conditions and this Contract, this Contract will take precedence. Further, no “click-through,” “shrink-wrap,” “browse-wrap,” or other terms that have not been specif ically negotiated by the Contractor and the State, whether before, on, or af ter the date of this Contract, will be ef fective to add or modify the terms of this Contract, regardless of any Party’s “acceptance” of those terms by electronic means. No State employee has the authority to modify, amend, or supplement this Contract through electronic means.

7. In Section 9.30, Boycotting, delete it in its entirety and replace it with the following:

9.30. Boycotting

Pursuant to R.C. 9.76(B), Contractor warrants that Contractor is not boycotting any jurisdiction with whom the State of Ohio can enjoy open trade, including Israel, and will not do so during the contract period.

The State of Ohio does not acquire supplies or services that cannot be imported lawfully into the United States or transact business with any entity or individual subject to f inancial sanctions imposed by the United States. The Contractor certif ies that it, its subcontractors, and any agent of the Contractor or its subcontractors, will acquire any supplies or services in accordance with all trade control laws, regulations or orders of the United States, including the prohibited source regulations set forth in subpart 25.7, Prohibited Sources, of the Federal Acquisition Regulation and any sanctions administered or enforced by the U.S. Department of Treasury’s Of f ice of Foreign Assets Control. A list of those entities and individuals subject to sanctions can be found at https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists. These sanctions generally preclude most transactions involving Cuba, Iran, and Sudan, and most imports f rom Burma or North Korea.

8. In Article 9, Standard Provisions, add the following as new sections:

9.32. Legal Representation and Rights

https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/04-Affirmation%20and%20Disclosure%20Form_3-4-22.pdf https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 3 of 13

The Ohio Attorney General is the chief law of f icer for the State of Ohio, its agencies, boards and commissions, and only the Ohio Attorney General has the authority to appoint outside legal counsel to represent the State. Contractor agrees that any provisions in this Contract or any documents incorporated by reference that provide or allow for outside legal representation to defend or settle claims on behalf of the State or provide for a third party to have sole control of a defense or settlement of a claim do not meet the requirements of state law and are considered stricken. Contractor also agrees that, unless specif ically agreed to in writing by the State, any provisions that require or provide for a waiver of any legal rights, remedies, or litigation defenses (i.e., waiver of a jury trial) do not meet the requirements of state law and are considered stricken.

9.33. Statute of Limitations

Statutes of limitations generally do not apply to actions brought by the State and any such provisions in this Contract or in any documents incorporated by reference are considered stricken.

9.34. Data Security and Privacy Terms

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms apply to all work, services, and personnel across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Sof tware as a Service, Platform as a Service, or Inf rastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with these Terms as they apply to the services being provided to the State. The Contractor is responsible for maintaining information security in any environments under the Contractor’s management in accordance with these Terms.

These Terms are in addition to the Contract terms and conditions. In the event of a conf lict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contract means the contract entered into between the Contractor and the State to which these Terms are attached and/or incorporated.

2. Contract Data means State Data that the Contractor has access to, transmits, processes, possesses, creates or stores in providing services to the State.

3. Contractor means the person or entity with whom the State has entered into the Contract and, for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

4. Personally Identifiable Information as def ined in the Ohio Revised Code means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identif ier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 4 of 13

5. Security Event is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-def ined incident thresholds that does not adversely impact or potentially impact Contract Data or information systems.

6. Security Incident means there is successful unauthorized access, use, disclosure, modif ication, or destruction of information or interference with system operations in an information system.

7. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information f rom, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Conf idential Data. All State Data is and will remain the property of the State and, unless specif ically provided otherwise in the Contract, Contractor acquires no right, title, or interest in or to State Data.

8. Confidential Data means any type of data that is required to be protected by law or regulation, is intended for conf idential use, and may not be copied or removed f rom the State’s operational control without authorized permission. Conf idential Data includes data that, if compromised, may result in loss of life, serious injury, or other harm to an individual or group, or disruption to critical State operations. Conf idential Data is included in the def inition of Conf idential Information in the Contract.

Conf idential Data includes, but is not limited to:

A. Personally Identif iable Information (PII);

B. Student information under the Family Educational Rights and Privacy Act (20 U.S.C. §

1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security

Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and

Accountability Act (45 CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards (PCI DSS);

G. Social Security Administration (SSA) Data which is data received by the State f rom the

Social Security Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration;

and

H. Other types of information not associated with an individual such as security and inf rastructure records, trade secrets, and business bank account information.

9. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

At a minimum, the Contractor must maintain the security of Contract Data in accordance with the moderate level security baseline of the current published version of the National Institute of https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 5 of 13

Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (NIST 800-53). In the alternative, the Contractor may maintain the security of Contract Data in accordance with International Organization for Standardization 27001 (ISO 27001) if the Contractor implements the additional necessary controls to achieve compliance with the requirements of NIST 800-53. Hereinaf ter, references in these Terms to “NIST 800-53" means both of the f rameworks def ined in this paragraph.

The Contractor must implement the information security policies, standards, and capabilities set forth in the Contract, where applicable, support the State’s adherence to the State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards.

If the Contractor accesses the State’s facilities or networks, or provides products, solutions, or services that will be implemented or integrated in the State’s controlled environment, the Contractor must ensure its products, solutions, or services comply with applicable State IT Security Polices and Standards, as appropriate (available at the link provided above in the def inition of State IT Security Policies and Standards).

The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per the State IT Security

Policies and Standards.

C. Upon identif ication of a potential issue with maintaining an “as provided” State inf rastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of Contract Data

The Contractor must maintain an information security program made up of policies, procedures, technical and organizational safeguards, and training designed to protect Contract Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect Contract Data, the Contractor must use due diligence to ensure that computer and telecommunications systems and services involved in storing, using, or transmitting Contract Data are secure and prevent Contract Data f rom unauthorized disclosure, modif ication, use, or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding Contract Data in addition to the conf identiality requirements in the Contract:

A. Assume all Contract Data is both conf idential and critical for State operations.

B. Maintain, in conf idence, Contract Data it may obtain, maintain, process, or otherwise receive f rom or through the State during the term of the Contract and pursuant to the provisions of the Contract and these Terms.

C. Use and permit its employees, of f icers, agents, and subcontractors to use any Contract Data received f rom the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, of f icers, agents, and subcontractors to sell, rent, lease, or disclose, any Contract Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 6 of 13

E. Take all commercially reasonable steps to (a) protect the conf identiality of Contract Data received f rom the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to Contract Data received by the Contractor f rom the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of Contract Data.

G. Ensure that the Contractor’s internal security policies, plans, and procedures address the basic security elements of conf identiality, integrity, and availability of Contract Data, and periodically review and update these policies, plans, and procedures as needed.

For services hosted on SFDC (SalesForce dot com), the residency requirements for Contract Data are determined by SFDC and outlined in any applicable terms between SFDC and the State. For services hosted on SFDC, physical security and encryption requirements are determined by SFDC and outlined in any applicable terms between SFDC and the State.

For services not hosted on SFDC, the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two dif ferent and distant geographic locations ensuring physical and environment protection controls. All Contract Data not hosted on SFDC that is not classif ied as public by the State must be encrypted at rest and while in transit utilizing industry standards.

If the Contractor will be accessing, processing, transmitting, possessing, creating, or storing Conf idential Data, the State may require additional documentation f rom the Contractor and/or input to complete State documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as def ined in the current published version of NIST 800-53 and of fer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

The Contractor’s information security program must be designed to protect Contract Data by implementing an industry security and privacy standard including, at a minimum:

A. Security and conf identiality of Contract Data.

B. Protection against anticipated threats or hazards to the security or integrity of Contract Data.

C. Protection against unauthorized access to, disclosure of , or use of Contract Data.

D. Giving access to Contract Data only to those individual employees, of f icers, agents, and subcontractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperating with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroying or returning to the State, in a format designated by the State, all Contract Data received f rom or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract. Notwithstanding the foregoing, the Contractor may keep a copy of the Contract Data to comply with contractual, legal, or

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 7 of 13 record keeping obligations, and any such retained Contract Data is subject to the requirements of this Contract for so long as the Contractor has the Contract Data in its possession.

G. Maintaining appropriate and ef fective business continuity and disaster recovery plans to ensure resiliency of Contract Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identif ied, is considered Contract Data and Conf idential Information under this Contract.

The Contractor must scan all source code for vulnerabilities, including before and af ter any source code changes are made, must promptly remediate vulnerabilities, and/or provide the State with patches to address the vulnerabilities at no cost to the State. The Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notif ication, correction, and indemnif ication), the Contractor warrants that its sof tware is f ree f rom viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of Contract Data is permitted as set forth in the Contract. Additionally, disclosure of Contract Data is also permitted when required by applicable law, regulation, court order, or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Conf idential Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State within 48 hours of receipt of the order or request in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also cooperate in the State’s ef forts to obtain a protective order or other reasonable assurance that conf idential treatment will be accorded the information provided by the State.

If , in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable ef forts to obtain conf idential treatment for the information disclosed.

The Contractor may disclose Conf idential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding conf identiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the conf identiality of the information they receive.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 8 of 13

5. Auditing

A. If the Contractor provides a solution, service, or product hosted by the Contractor or a cloud provider, the Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certif ied Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 Type 2 (SOC 2 Type 2). At any point during the term of the Contract and if not already obtained, the Contractor may obtain and must thereaf ter maintain StateRAMP or FedRAMP authorization in lieu of a SOC 2 Type 2 audit.

B. If Contractor provides a solution, service, or product hosted by the Contractor or a cloud provider that completes a f inancial duty on behalf of the State, the Contractor must obtain an annual audit of the services being provided under this Contract that meets the AICPA SSAE No. 18, Service Organization Control 1 Type 2 (SOC 1 Type 2).

C. The SOC 1 Type 2 and SOC 2 Type 2 audits will be completed at the sole expense of the Contractor and upon the State’s request, Contractor shall make information relating to the audit results available to the State. The results of the audits provided to the State are considered Conf idential Information under the Contract. At no cost to the State, the Contractor must remedy material issues, material weaknesses, or other items identif ied in each audit as they pertain to the services provided under this Contract.

D.

E. In the event the State does not f ind the certif ications and audit reports suitable, Contractor will make its applicable premises and personnel available to the State (or its third-party independent auditor that is not a competitor of the Contractor) for audit upon request and at the State’s cost. Before the commencement of any such audit, the parties shall mutually agree upon the scope, timing, and duration of the audit.

6. Background Investigations of Contractor Personnel

Any person who (a) has been convicted at any time of any criminal of fense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such of fense, (b) is named by the Of f ice of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform certain services under the Contract.

The Contractor must conduct background investigations on Contractor personnel that may have access to Contract Data.

If any Contractor personnel refuses to have a background investigation completed or has an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the Contract Data.

7. Security Incidents and Events

A. Categories

Security Incidents may fall into one or more of , but are not limited to, the following categories:

i. Loss or Thef t

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 9 of 13

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of , but are not limited to, the following categories:

i. Unsuccessful log-on attempts

ii. Unsuccessful denial of service attacks

iii. Unsuccessful phishing attacks

iv. Unsuccessful network attacks such as pings, probes of f irewalls, or port scans.

B. Security Incident Response and Reporting

The Contractor is responsible for Security Incident response, including containment, eradication, and recovery, to minimize the impact to the State. In addition to the requirements in the Contract, the Contractor must perform the following in response to a Security Incident involving Contract Data.

The Contractor is not required to report Security Events unless a pattern of attacks signif icantly increases the risk of impact.

The Contractor must report in writing to the State within 48 hours of the Contractor becoming aware of any Security Incident and/or use or disclosure of Contract Data not authorized by the Contract, including any reasonable belief that unauthorized access to or acquisition of Contract Data has occurred, and fully cooperate with the State to mitigate the consequences of the Security Incident. Within f ive business days of the initial Security Incident report to the State, the Contractor must document and begin providing follow-up reports for all Security Incidents to the State. The Contractor must provide updates to the follow-up reports until the investigation is complete. At a minimum, the Security Incident reports will include:

i. Data elements involved, the extent of the Contract Data involved in the Security

Incident, and the identif ication of af fected individuals, if applicable.

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed Contract Data, or to have been responsible for the Security Incident.

iii. A description of where the Contract Data is believed to have been improperly transmitted, sent, or utilized, if applicable.

iv. A description of the probable causes of the Security Incident and, in the f inal report, the root cause.

v. A description of the proposed plan for preventing similar future Security Incidents, including a recommended risk remediation plan.

vi. A description of the corrective actions taken, including repair (elimination of a defect or incident and/or restoration of system functionality requirements according to the Contract) and resolution (a temporary workaround to enable system function).

vii. Whether the Contractor believes any federal or state laws requiring notif ications to individuals are triggered.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 10 of 13

The Contractor must comply with all applicable laws that require the notif ication of individuals, or with other reasonable direction of the State for notif ication, in the event of a Security Incident involving personally identif iable information, or any other event requiring such notif ication. The State may, in its sole discretion, choose to provide notice to any or all parties af fected by a Security Incident, but the Contractor shall reimburse the State for the cost of providing such notif ication. Contractor further agrees to provide, or to reimburse the State for its costs in providing, any credit monitoring or similar services that are necessary as a result of Contractor’s Security Incident. Under Ohio law, Contract Data is State property and any illegal activity involving State property is subject to a criminal investigation. The Contractor shall preserve suf f icient evidence to ensure accurate Security Incident records, facilitate an investigation, and determine the extent of the Security Incident.

The Contractor shall work with the State to establish a Security Incident reporting communications procedure including Contractor and State contacts, communication methods and tools. If there is no procedure established, the Contractor must report Security Incidents to the primary contact listed in the Contract or that contact’s successor and the Contractor must report the Security Incident to the State via email at CSC@ohio.gov or call 877.644.6860.

The State reserves the right to conduct an independent investigation of the Security Incident, and to the Contractor’s best ability shall cooperate with the investigation. The independent investigation may be conducted by a State agency or a third party acting on behalf of the State.

8. Generative Artificial Intelligence

The Contractor must disclose the use of generative artif icial intelligence (AI) to the State when producing work that will be owned by the State or the integration of generative AI in products or services used by the State. The Contractor must work with the State to ensure the use of generative AI is reviewed, approved, and complies with the State IT Policy IT-17, Use of Artif icial Intelligence, prior to utilizing the generative AI components. The Contractor is not permitted to utilize Conf idential Data in training generative AI models except as specif ically approved by the State.

9. Contractor Access

When the Contractor accesses State network systems, data, and facilities, including remotely, the Contractor must maintain a robust security capability that incorporates generally recognized system hardening techniques. The Contractor must use appropriate measures to ensure that Contract Data is secure before transferring control of any systems or media on which Contract Data is stored. The method of securing the Contract Data must be in alignment with the required data classif ication. The Contractor may permit Contract Data to be loaded onto portable computing devices or portable storage components or media only if adequate security measures are in place to ensure the integrity and security of Contract Data and the Contract Data is encrypted. The transfer of any such system or media must be reasonably necessary for the performance of the Contractor’s obligations under the Contract. The Contractor shall use multifactor authentication to limit access to systems that contain Conf idential Data.

The Contractor must also maintain an accurate inventory of all such devices and the individuals to whom they are assigned. The Contractor must have reporting requirements for lost or stolen portable computing devices authorized for use with Contract Data and must report any loss or theft of such devices containing Contract Data to the State in writing as def ined in Section 7.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 11 of 13

10. Family Educational Rights and Privacy Act

When the Contractor is handling Contract Data that includes student information, the Contractor must comply with all applicable provisions of Ohio and federal laws regarding student information, including Parts B and C of the Individuals with Disabilities Education Act (20 U.S.C. 1400 and Title 34 of the Code of Federal Regulations Part 300, and 20 U.S.C. 1400 and Title 34 of the Code of Federal Regulations Part 303, respectively) and the Family Educational Rights and Privacy Act (20 U.S.C. 1232) (FERPA) or its State equivalent including any amendments or other relevant provisions of federal law as well as all requirements of Chapter 99 of Title 34 of the Code of Federal Regulations. Nothing in this Contract shall be construed to allow either party to maintain, use, disclose, or share student information in a manner not allowed by either state or federal laws or regulations.

11. HIPAA Compliance

When the Contractor is handling Contract Data that includes health or medical data, the Contractor must comply with the data handling and privacy requirements of HIPAA and its associated regulations. Additionally, some or all of the Contract Data may be client identifying information covered by 42 C.F.R. Part 2. Contractor may only disclose such client identifying information back to the State and is bound in all respects by the regulations of 42 C.F.R. Part 2. If required, the Contractor must execute a business associate agreement with the State when handling protected health information.

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 12 of 13

This Renewal shall become ef fective as of the date of the State’s signature and shall remain in full force and ef fect for the term of the Contract short name. Except as modif ied by this Renewal, all other terms, conditions and pricing of the Contract short name shall remain the same and in full force and ef fect.

IN WITNESS WHEREOF, the parties have executed this Renewal as of the dates appearing below.

APPEXTREMES, LLC d.b.a. Conga STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

By: By:

Name: Veronika Wallace Name: Kathleen C. Madden

Title: Senior Legal Counsel Title: Director

Date: Date:

AppExtremes, LLC d.b.a. Conga MCSA0086, Amendment 1 and Renewal Page 13 of 13

SUMMARY OF AMENDMENTS

Amendment Number

Ef fective Date Description

1 Pending

This renewal amendment updates the terms and conditions and renews the contract for SFY26-27.