OITModelPersonalServicesContract010516.docx (1).docx

CMS Routing #

STATE OF COLORADO

Governor’s Office of Information Technology

CONTRACT

With Insert Contractor’s Full Legal Name.

TABLE OF CONTENTS

1. PARTIES

This Contract (“Contract”) is entered into by and between Insert Contractor’s Name (“Contractor”), and the STATE OF COLORADO acting by and through the Governor’s Office of Information Technology (“State” or “OIT”). Contractor and the State hereby agree to the following terms and conditions.

2. EFFECTIVE DATE AND NOTICE OF NONLIABILITY

This Contract shall not be effective or enforceable until it is approved and signed by the Colorado State Controller or designee (“Effective Date”). The State shall not be liable to pay or reimburse Contractor for any performance hereunder, including, but not limited to, costs or expenses incurred, or be bound by any provision hereof prior to the Effective Date.

3. RECITALS

Authority, Appropriation and Approval Authority to enter into this Contract exists in CRS § 24-37.5-105 and funds have been budgeted, appropriated, and otherwise made available and a sufficient unencumbered balance thereof remains available for payment. Required approvals, clearance, and coordination have been accomplished from and with appropriate agencies. The Contractor was selected in accordance with State law as a result of Insert RFP Number.

Consideration The Parties acknowledge that the mutual promises and covenants contained herein and other good and valuable consideration are sufficient and adequate to support this Contract.

Purpose Briefly describe the contract’s purpose.

References All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits, or other attachments are references to sections, subsections, exhibits, or other attachments contained herein or incorporated as a part hereof, unless otherwise noted.

4. DEFINITIONS

The following terms as used herein shall be construed and interpreted as follows:

Budget “Budget” means the budget for the Work described in this Contract and its Exhibits.

Contract “Contract” means this Contract, its terms and conditions, attached Exhibits, documents incorporated by reference under the terms of this Contract, and any future modifying agreements, exhibits, attachments or references incorporated herein pursuant to Colorado State law, Fiscal Rules, and State Controller Policies.

Contract Funds “Contract Funds” means funds available for payment by the State to Contractor pursuant to this Contract.

Contract Term “Contract Term” means the Initial Term and the Renewal Term, if any, as provided in §5.

Criminal Justice Information (CJI) Data “Criminal Justice Information (CJI) Data” means information collected by criminal justice agencies that is needed for the performance of their legally authorized, required function, which includes, but is not limited to, wanted person information; missing person information; unidentified person information; stolen property information; criminal history information; information compiled in the course of investigation of crimes that are known or believed on reasonable grounds to have occurred, including information on identifiable individuals; and information on identifiable individuals compiled in an effort to anticipate, prevent, or monitor possible criminal activity.

Deliverable “Deliverable” means the outcome to be achieved or output to be provided, in the form of a tangible or intangible object that is produced as a result of Contractor’s Work that is intended to be delivered to the State by Contractor. Examples of Deliverables include, but are not limited to, report(s), document(s), server upgrade(s), software license(s), and may be composed of multiple smaller deliverables.

Evaluation “Evaluation” means the process of examining Contractor’s Work and rating it based on criteria established in §6, this Contract, and its Exhibits.

Exhibits and Other Attachments The following are attached hereto and incorporated by reference herein: Exhibit A (Statement of Work), Attachment A.1 (Form of Deliverable Acceptance Form), Exhibit B (Form of Option Letter), Exhibit C (Form of Contractor Notification Statement), Exhibit D (Confidentiality of Taxpayer Information Certification), Exhibit E (HIPAA Business Associate Addendum), Attachment E.1 (HIPAA BAA Attachment).

Federal Tax Information (FTI) Data “Federal Tax Information (FTI) Data” means federal or state tax returns, return information, and such other tax-related information as may be protected by State and federal law.

Fiscal Year “Fiscal Year” means the State’s fiscal year, which begins on July 1 of each calendar year and ends on June 30 of the following calendar year.

Force Majeure “Force Majeure” means failures or delays in performance by a Party due to causes beyond its reasonable control, including war, strikes, lockouts, fire, flood, storm, or other acts of God. Both Parties agree to use their best efforts to minimize the effects of such failures or delays.

Goods “Goods” means tangible material acquired, produced, or delivered by Contractor either separately or in conjunction with the Services Contractor renders hereunder.

Health Insurance Portability and Accountability Act (HIPAA) Data “Health Insurance Portability and Accountability Act (HIPAA) Data” means any information, whether oral or recorded in any form or medium, that (i) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (ii) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (iii) identifies the individual or with respect to which there is reasonable basis to believe the information can be used to identify the individual. HIPAA Data includes, but is not necessarily limited to, protected health information as defined in 45 CFR § 160.103 and 45 CFR § 164.501.

Incident “Incident” means an accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources of the State pursuant to CRS § 24-37.5-401 et seq. Incidents include, but are not limited to (i) successful attempts to gain unauthorized access to a State system or State Information regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State’s knowledge, instruction, or consent.

Initial Term “Initial Term” means the Initial Term of this Contract as provided in §5.A.

Party or Parties “Party” means the State or Contractor and “Parties” means both the State and Contractor.

Payment Card Information (PCI) Data “Payment Card Information (PCI) Data” means any data related to card holders’ names, credit card numbers, or other credit card information as may be protected by State and federal law.

Personally Identifiable Information (PII) Data “Personally Identifiable Information (PII) Data” means information about an individual collected by the State or any other governmental entity that could reasonably be used to identify such individual as defined in CRS § 24-72-501(2) and includes, but is not limited to, any combination of (i) first and last name, (ii) first name or first initial and last name, (iii) residence or other physical address, (iv) electronic mail address, (v) telephone number, (vi) birth date, (vii) credit card information, (viii) social security number, (ix) driver’s license number, (x) identification card number, or (xi) any other information that identifies an individual personally.

Renewal Term “Renewal Term” means the extension of the Initial Term pursuant to an Option Letter as provided in §5.C.

Review “Review” means examining Contractor’s Work to ensure that it is adequate, accurate, correct, and in accordance with the criteria established in §6, this Contract, and its Exhibits.

Services “Services” means the required services to be performed by Contractor pursuant to this Contract.

State Confidential Information “State Confidential Information” means all information, data, records, and documentary materials which are of a sensitive nature and belong to the State regardless of physical form or characteristics, including but not limited to any non-public State records, sensitive State data, protected State data, State personnel records, PII, FTI, PCI, and other information or data concerning individuals, which has been communicated, furnished, or disclosed by the State to Contractor. Notwithstanding the foregoing, State Confidential Information shall not include State Records.

State Controller “State Controller” means the Colorado State Controller or authorized designee of the Colorado State Controller.

State Information “State Information” means the combination of State Confidential Information and State Records.

State Records “State Records” means all information, data, records, and documentary materials which are not sensitive and belong to the State regardless of physical form or characteristics, including but not limited to any public State records, non-sensitive State data, and other information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished, or disclosed by the State to Contractor which (i) is subject to disclosure pursuant to the Colorado Open Records Act, CRS § 24-72-200.1, et seq.; (ii) is already known to Contractor without restrictions at the time of its disclosure by Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any State Confidential Information. Notwithstanding the foregoing, State Records shall not include State Confidential Information.

Subcontractor “Subcontractor” means any third party engaged by Contractor to aid in performance of Contractor’s obligations.

Work “Work” means the tasks and activities Contractor is required to perform to fulfill its obligations under this Contract and its Exhibits, including the performance of the Services and delivery of the Goods.

Work Product “Work Product” means the tangible or intangible results of Contractor’s Work, including, but not limited to, software, research, reports, studies, data, photographs, negatives, or other finished or unfinished documents, drawings, models, surveys, maps, materials, or work product of any type, including drafts.

5. TERM AND EARLY TERMINATION

Initial Term – Work Commencement The Parties’ respective performances under this Contract shall commence on its Effective Date. This Contract shall terminate Insert number of years, e.g. two (2) years from the Effective Date unless sooner terminated or further extended as specified elsewhere herein.

Two (2) Month Extension The State, at its sole discretion and upon written notice to Contractor as provided in §16, may unilaterally extend the Contract Term for a period not to exceed two (2) months if the Parties are negotiating a replacement contract (and not merely seeking a term extension) at or near the end of the Initial Term or any Renewal Term. The provisions of this Contract in effect when such notice is given, including, but not limited to, prices, rates, and delivery requirements, shall remain in effect during the two (2) month extension. The two (2) month extension shall immediately terminate when and if a replacement contract is approved and signed by the State Controller.

State’s Option to Extend The State may require continued performance of this Contract for Insert number of renewal terms, e.g. three (3) Renewal Terms of Insert number of years, e.g. two (2) years each beyond the Initial Term at the same rates and same terms specified in the Contract. If the State exercises the options, it shall provide written notice to Contractor at least thirty (30) days prior to the end of the Initial Term or Renewal Term in form substantially equivalent to Exhibit B, specifying the length of the Renewal Term. If exercised, the provisions of the Option Letter shall become part of and be incorporated into this Contract. The total duration of this Contract, including the exercise of any options under this clause, shall not exceed Insert number of years, e.g. two (2) years.

6. STATEMENT OF WORK

Completion Contractor shall complete the Work and its other obligations as described in this Contract and its Exhibits on or before the termination date of the Contract set forth in §5.A. The State shall not be liable to compensate Contractor for any Work performed prior to the Effective Date or after the termination of this Contract.

Goods and Services Contractor shall procure Goods and Services necessary to complete the Work. Such procurement shall be accomplished using the Contract Funds available and shall not increase the maximum amount payable hereunder by the State. Contractor shall not enter into separate or individual contracts for the Goods and/or Services provided under this Contract with other State agencies during the term of this Contract without the express written consent of OIT.

Employees All persons employed by Contractor or Subcontractors to perform Work under this Contract shall be Contractor’s or Subcontractor’s employee(s) for all purposes hereunder and shall not be employees of the State for any purpose as a result of this Contract.

7. PAYMENTS TO CONTRACTOR

The State shall, in accordance with the provisions of this §7, pay Contractor in the amounts and using the methods set forth below:

Maximum Amount The maximum Contract amount payable under this Contract to Contractor by the State is Insert Written Max $ Amount, e.g. One Thousand Dollars and Insert Pennies as Fraction, e.g. 56/100 Cents ($Insert Max $ Amount), as determined by the State from available funds. Payments to Contractor are limited to the unpaid obligated balance of the Contract set forth herein and in this Contract’s Exhibits. The maximum amount payable by the State to Contractor during each State Fiscal Year of this Contract shall be:

Insert $ Amount in FY Insert FY, e.g. 2015-16

Insert $ Amount in FY Insert FY, e.g. 2016-17

Insert $ Amount in FY Insert FY, e.g. 2017-18

Insert $ Amount in FY Insert FY, e.g. 2018-19

Insert $ Amount in FY Insert FY, e.g. 2019-20

Insert $ Amount in FY Insert FY, e.g. 2020-21

Payment Advance, Interim, and Final Payments Any advance payment allowed under this Contract or in any of its Exhibits shall comply with State Fiscal Rules and be made in accordance with the provisions of this Contract or such Exhibit. Contractor shall initiate any payment requests by submitting invoices to the State in the form and manner set forth and approved by the State. Invoices shall be sent to Governor’s Office of Information Technology, 601 E. 18th Avenue, Suite 150, Denver, CO, 80203. Attn: Accounting.

Interest The State shall fully pay each invoice within forty-five (45) days of receipt thereof if the amount invoiced represents performance by Contractor previously accepted by the State. Uncontested amounts not paid by the State within forty-five (45) days shall bear interest on the unpaid balance beginning on the forty-sixth (46th) day at a rate not to exceed one percent (1%) per month until paid in full; provided, however, that interest shall not accrue on unpaid amounts that are subject to a good faith dispute. Contractor shall invoice the State separately for accrued interest on delinquent amounts. The billing shall reference the delinquent payment, the number of days’ interest to be paid, and the interest rate.

Available Funds – Contingency – Termination The State is prohibited by law from making commitments beyond the term of the State’s current Fiscal Year. Therefore, Contractor’s compensation beyond the State’s current Fiscal Year is contingent upon the continuing availability of State appropriations as provided in the Colorado Special Provisions. If federal funds are used to fund this Contract, in whole or in part, the State’s performance hereunder is contingent upon the continuing availability of such funds. Payments pursuant to this Contract shall be made only from available funds encumbered for this Contract and the State’s liability for such payments shall be limited to the amount remaining of such encumbered funds. If State or federal funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may terminate this Contract immediately, in whole or in part, without further liability in accordance with the provisions hereof.

Erroneous Payments At the State’s sole discretion, payments made to Contractor in error for any reason, including, but not limited to, overpayments or improper payments, and unexpended or excess funds received by Contractor, may be recovered from Contractor by deduction from subsequent payments under this Contract or other contracts, grants, or agreements between the State and Contractor or by other appropriate methods and collected as a debt due to the State. Such funds shall not be paid to any party other than the State.

Use of Funds Contract Funds shall be used only for eligible costs identified herein and/or in the Budget.

8. REPORTING – NOTIFICATION

Reports, Evaluations, and Reviews required under this §8 shall be in accordance with the procedures of and in such form as prescribed by the State and in accordance with §21, if applicable.

Performance, Progress, Personnel, and Funds State shall submit a report to Contractor, upon expiration or sooner termination of this Contract, containing an Evaluation and Review of Contractor’s performance and the final status of Contractor’s obligations hereunder. In addition, Contractor shall comply with all reporting requirements, if any, set forth in this Contract and its Exhibits.

Litigation Reporting Within ten (10) days after being served with any pleading in a legal action filed with a court or administrative agency, related to this Contract or which may affect Contractor’s ability to perform its obligations hereunder, Contractor shall notify the State of such action and deliver copies of such pleadings to the State’s principal representative as identified herein. If the State’s principal representative is not then serving, such notice and copies shall be delivered to the Chief Information Officer of OIT.

Performance outside the State of Colorado and/or the United States [Not applicable if Contract Funds include any federal funds] Following the Effective Date, Contractor shall provide written notice to the State, in accordance with §16 and in form substantially equivalent to Exhibit C, within twenty (20) days of the earlier to occur of Contractor’s decision to perform, or its execution of an agreement with a Subcontractor to perform, Services outside the State of Colorado and/or the United States. Such notice shall specify the type of Services to be performed outside the State of Colorado and/or the United States and the reason why it is necessary or advantageous to perform such Services at such location or locations. All notices received by the State pursuant to this §8.C shall be posted on the Colorado Department of Personnel & Administration’s website. Knowing failure by Contractor to provide notice to the State under this §8.C shall constitute a material breach of this Contract.

Noncompliance Contractor’s failure to provide reports and notify the State in a timely manner in accordance with this §8 may result in the delay of payment of funds and/or termination as provided under this Contract.

Subcontracts Contractor, with the consent of the State, may enter into one or more written subcontracts for the performance of Contractor’s obligations under this Contract. Each subcontract shall comply with all applicable federal and state laws and provide that such subcontract shall be governed by the laws of the State of Colorado. Contractor shall notify the State immediately, in writing by certified mail, of any action or suit filed and prompt notice of any claim made against Contractor by any Subcontractor or vendor which in the reasonable opinion of Contractor may result in litigation related in any way to the Contract with the State. Contractor shall notify the State in writing, in accordance with §16 below, within ten (10) days of discovering that a Subcontractor has been served with any pleading in a legal action filed with a court or administrative agency which may affect such Subcontractor’s ability to perform its obligations under a subcontract.

9. CONTRACTOR RECORDS

Maintenance Contractor shall make, keep, maintain, and allow inspection and monitoring by the State of a complete file of all records, documents, communications, notes and other written materials, and electronic media files, pertaining in any manner to the Work or to the delivery of Services or Goods hereunder. Contractor shall maintain such records until the last to occur of: (i) a period of three (3) years after the date this Contract expires or is sooner terminated, or (ii) final payment is made hereunder, or (iii) the resolution of any pending Contract matters, or (iv) if an audit is occurring, or Contractor has received notice that an audit is pending, until such audit has been completed and its findings have been resolved (collectively, the “Record Retention Period”).

Inspection Contractor shall permit the State, the federal government, and any other duly authorized agent of a governmental agency to audit, inspect, examine, copy, and/or transcribe Contractor’s records related to this Contract during the Record Retention Period for a period of three (3) years following termination of this Contract or final payment hereunder, whichever is later, to assure compliance with the terms hereof or to evaluate performance hereunder. The State reserves the right to inspect the Work at all reasonable times and places during the Contract Term, including any extensions or renewals. If the Work fails to conform to the requirements of this Contract, the State may require Contractor to promptly bring the Work into conformity with Contract requirements at Contractor’s sole expense. If the Work cannot be brought into conformance by re-performance or other corrective measures, the State may require Contractor to take necessary action to ensure that future performance conforms to Contract requirements and exercise the remedies available under this Contract, at law or in equity, in lieu of or in conjunction with such corrective measures.

Monitoring Contractor shall permit the State, the federal government, and governmental agencies having jurisdiction, in their sole discretion, to monitor all activities conducted by Contractor pursuant to the terms of this Contract using any reasonable procedure, including, but not limited to: internal evaluation procedures, examination of program data, special analyses, on-site checking, formal audit examinations, or any other procedures. All monitoring controlled by the State shall be performed in a manner that shall not unduly interfere with Contractor’s performance hereunder.

Final Audit Report If an audit is performed on Contractor’s records for any fiscal year covering a portion of the Contract Term, Contractor shall submit a copy of the final audit report to the State or its principal representative at the address specified herein. Contractor shall ensure the provisions of this paragraph apply to any subcontract related to performance under the Contract. Contractor shall, at Contractor’s sole expense, reconstruct any records not preserved or retained as required by this paragraph.

10. CONFIDENTIAL INFORMATION – STATE RECORDS

Contractor shall comply with and shall cause each of its Subcontractors and any other party performing Work under the Contract to comply with the provisions of this §10 if it becomes privy to State Information in connection with its performance.

Confidentiality Contractor shall comply with all laws and regulations concerning confidentiality of State Confidential Information. Any request or demand by a third party for State Information in the possession of Contractor shall be immediately forwarded to the State’s principal representative.

Notification Contractor shall provide its agents, employees, Subcontractors, and assigns who may come into contact with State Information with a written explanation of the confidentiality requirements herein, to which they are subject, before permitting them to access such State Information.

Use, Security, and Retention State Information of any kind shall be stored, processed, or transferred only in or to facilities located within the United States, and shall not be distributed or sold to any third party, retained in any files or otherwise, or used by Contractor or its agents in any way, except as authorized by this Contract, by law, or approved in writing by the State. Contractor shall provide and maintain a secure environment that ensures confidentiality of all State Confidential Information wherever located. Neither Contractor nor its Subcontractors shall have any rights to use or access any OIT or other State agency data or information, except with the prior approval of the State.

Protection Contractor is responsible for the protection and security of all State Information provided to it by the State. If Contractor provides physical or logical storage, processing or transmission of, or retains, stores, or is given, State Information, Contractor shall, and shall cause its Subcontractors to, (i) provide physical and logical protection for all related hardware, software, applications, and data that meet or exceed industry standards and requirements as set forth in this Contract; (ii) maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), and annual security testing; (iii) comply with State and federal regulations and guidelines related to overall security, confidentiality, integrity, availability, and auditing; (iv) ensure that security is not compromised by unauthorized access to computers, program, software, databases, or other electronic environments; and (v) shall promptly report all Incidents to a representative of the Office of Information Security (“OIS”). Contractor shall provide the State with access, subject to Contractor’s reasonable access security requirements, seven (7) days a week, twenty-four (24) hours a day, for the purpose of inspecting and monitoring access and use of State Information, maintaining State systems, and evaluating physical and logical security control effectiveness.

Compliance Contractor shall review, on a semi-annual basis, all OIS policies and procedures which OIS has promulgated pursuant to CRS §§ 24-37.5-401 through 406 and 8 CCR § 1501-5 and posted at http://oit.state.co.us/ois, to ensure compliance with the standards and guidelines published therein. Contractor shall cooperate, and shall cause its Subcontractors to cooperate, with the performance of security audit and penetration tests by OIS or its designee.

Background Checks Contractor shall perform, and shall cause its Subcontractors to perform, in a form reasonably acceptable to the State, current background checks on all of its respective employees and agents performing services or having access to State Information provided under this Contract. A background check performed within thirty (30) days prior to the date such employee or agent begins performance or obtains access to State Information shall be deemed to be current.

Delivery and Support The State, in its sole discretion, may securely deliver State Information directly to the facility where such data is used to perform the Work. State Information is not to be maintained or forwarded to or from any other facility or location except for the authorized and approved purposes of backup and disaster recovery purposes.

Incident Notice If Contractor becomes aware of an Incident involving any State Information, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, if any. Unless Contractor can establish that Contractor or any of its Subcontractors is not the cause or source of the Incident, Contractor shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident.

Incident Remediation Contractor shall be responsible for determining the cause of an Incident, and for producing a remediation plan to reduce the risk of incurring a similar type of breach in the future. Contractor shall present its analysis and remediation plan to the State within ten (10) days of notifying the State of an Incident. The State reserves the right to adjust this plan, in its sole discretion. If Contractor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Contractor shall reimburse the State for the reasonable costs thereof.

Incident Liability Disclosure of State Information by Contractor or any Subcontractor for any reason may be cause for legal action by third parties against Contractor, the State, or their respective agents. Contractor shall indemnify, save, and hold harmless the State, its employees, and agents against any and all claims, damages, liability, and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees pursuant to this §10. Notwithstanding any other provision of this Contract, Contractor shall be liable to the State for all consequential and incident damages arising from an Incident caused by Contractor or its Subcontractors.

End-of-Agreement Data Handling Upon request by the State made before or within sixty (60) days after the effective date of termination of the Contract, Contractor will make available to the State a complete and secure (i.e. encrypted and appropriately authenticated) download file of all data, including, but not limited to, all State Information, schema and transformation definitions, or delimited text files with documented, detailed schema definitions along with attachments in its native format. The Parties agree that on the termination of the provision of data processing services, Contractor shall, at the choice of the State, return all State Information provided by the State to Contractor, and the copies thereof, to the State, or Contractor shall destroy all such State Information and certify to the State that it has done so. If legislation imposed upon Contractor prevents it from returning or destroying all or part of the State Information provided by the State to Contractor, Contractor warrants that it will guarantee the confidentiality of all State Information provided by the State to Contractor and will not actively process such data anymore.

Disposition of Data The State retains the right to use the established operational services to access and retrieve State Information stored on Contractor’s infrastructure at its sole discretion. Contractor and Subcontractor warrant that upon request of the State or of the supervisory authority, Contractor will submit its data processing facilities for an audit of the measures referred to in §10.D in accordance with §9.C. The State reserves all right, title, and interest, including all intellectual property and proprietary rights, in and to system data, State Information, and all related data and content.

Safeguarding PII Data If Contractor or any of its Subcontractors will or may receive PII Data under this Contract, Contractor shall provide for the security of such PII Data, in a form acceptable to the State, including, without limitation, non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Contractor shall take full responsibility for the security of all PII Data in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure or loss thereof.

Safeguarding FTI Data If Contractor or any of its Subcontractors will or may receive FTI Data under this Contract, Contractor shall provide for the security of the FTI Data, in a form acceptable to the State and in accordance with State and federal law and the Confidentiality of Taxpayer Information Certification which is attached hereto and incorporated herein by this reference as Exhibit D. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Contractor’s or its Subcontractor’s obligations under this Contract, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications, and inspections. Contractor shall comply with the requirements of IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, revised and effective January 1, 2014, found at: http://www.irs.gov/pub/irs-pdf/p1075.pdf and incorporated herein by this reference.

Safeguarding PCI Data If Contractor or any of its Subcontractors will or may receive PCI Data under this Contract, Contractor shall provide for the security of the PCI Data, in accordance with PCI Data Security Standard (DSS) 1.1. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Contractor’s or Subcontractor’s obligations under this Contract, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications, and inspections.

Safeguarding CJI Data If Contractor or any of its Subcontractors will or may receive CJI Data under this Contract, Contractor shall provide for the security of CJI Data in accordance with the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services (CJIS) Security Policy, Version 5.3, dated 8/4/2014, found online at: http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center and incorporated herein by this reference.

Safeguarding HIPAA Data If Contractor or any of its Subcontractors will or may receive HIPAA Data under this Contract, Contractor shall provide for the security of the HIPAA Data in accordance with the provisions of the State HIPAA Business Associate Addendum, attached hereto and incorporated herein by this reference as Exhibit E and its associated Attachment E.1.

11. CONFLICTS OF INTEREST

Contractor acknowledges that with respect to this Contract, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Contractor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Contractor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Contractor is uncertain as to such, Contractor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction in regard to the actual or apparent conflict constitutes a breach of this Contract.

12. REPRESENTATIONS AND WARRANTIES

Contractor makes the following specific representations and warranties for the benefit of the State on the date hereof, each of which was relied upon and will be relied upon by the State in entering into this Contract.

Standard and Manner of Performance Contractor shall perform its obligations hereunder in accordance with the highest standards of care, skill, and diligence in Contractor’s industry, trade, or profession and in the sequence and manner set forth in this Contract.

Legal Authority – Contractor Signatory Contractor warrants that it possess the legal authority to enter into this Contract and that it has taken all actions required by its procedures, by-laws, and/or applicable laws to exercise that authority, to lawfully authorize its undersigned signatory to execute this Contract or any part thereof, and to bind Contractor to its terms. If requested by the State, Contractor shall provide the State with proof of Contractor’s authority to enter into this Contract within fifteen (15) days of receiving such request.

Licenses, Permits, Etc.

Contractor represents and warrants that as of the Effective Date it has, and that at all times during the term hereof it shall have and maintain, at its sole expense, all licenses, certifications, approvals, insurance, permits, and other authorizations required by law to perform its obligations hereunder, without reimbursement by the State or other adjustment in Contract Funds. Additionally, all employees, agents, and Subcontractors of Contractor performing Services under this Contract shall hold all required licenses or certifications, if any, to perform their responsibilities. Contractor, if a foreign corporation or other foreign entity transacting business in the State of Colorado, further warrants that it currently has obtained and shall maintain any applicable certificate of authority to transact business in the State of Colorado and has designated a registered agent in Colorado to accept service of process. Any revocation, withdrawal, or non-renewal of licenses, certifications, approvals, insurance, permits, or any such similar requirements necessary for Contractor to properly perform the terms of this Contract is material breach by Contractor and constitutes grounds for termination of this Contract.

13. INSURANCE

Contractor and its Subcontractors shall obtain and maintain insurance as specified in this section at all times during the Contract Term. All policies evidencing the insurance coverage required hereunder shall be issued by insurance companies satisfactory to Contractor and the State.

Contractor Public Entities If Contractor is a “public entity” within the meaning of the Colorado Governmental Immunity Act, CRS § 24-10-101, et seq., as amended (the “GIA”), then Contractor shall maintain at all times during the term of this Contract such liability insurance, by commercial policy or self-insurance, as is necessary to meet its liabilities under the GIA. Contractor shall show proof of such insurance satisfactory to the State, if requested by the State. Contractor shall require each contract with a Subcontractor that is a public entity to include the insurance requirements necessary to meet such Subcontractor’s liabilities under the GIA.

Non-Public Entities If Contractor is not a “public entity” within the meaning of the GIA, Contractor shall obtain and maintain during the term of this Contract insurance coverage and policies meeting the same requirements set forth in §13.B with respect to Subcontractors that are not “public entities.”

Contractors – Subcontractors Contractor shall require each contract with Subcontractors other than those that are public entities, providing Goods or Services in connection with this Contract, to include insurance requirements substantially similar to the following:

Worker’s Compensation Worker’s Compensation Insurance as required by State statute, and Employer’s Liability Insurance covering all of Contractor or Subcontractor employees acting within the course and scope of their employment.

General Liability Commercial General Liability Insurance written on ISO occurrence form CG 00 01 10/93 or equivalent, covering premises operations, fire damage, independent contractors, products and completed operations, blanket commercial liability, personal injury, and advertising liability with minimum limits as follows: (a) $1,000,000 each occurrence; (b) $1,000,000 general aggregate; (c) $1,000,000 products and completed operations aggregate; and (d) $50,000 any one fire. If any aggregate limit is reduced below $1,000,000 because of claims made or paid, Subcontractor shall immediately obtain additional insurance to restore the full aggregate limit and furnish to Contractor a certificate or other document satisfactory to Contractor showing compliance with this provision.

Automobile Liability Automobile Liability Insurance covering any auto (including owned, hired, and non-owned autos) with a minimum limit of $1,000,000 each accident combined single limit.

Professional Liability Contractor agrees to maintain in full force and effect a Professional Liability Insurance Policy in the minimum amount of $1,000,000 per occurrence and $1,000,000 in the aggregate, written on an occurrence form that provides coverage for its work undertaken pursuant to this Contract. If a policy written on an occurrence form is not commercially available, the claims-made policy shall remain in effect for the duration of this State Contract and for at least two (2) years beyond the completion and acceptance of the Work under this Contract, or, alternatively, a two (2) year extended reporting period must be purchased.

Cyber Privacy Liability Contractor agrees to maintain Cyber Privacy Insurance for claims and losses with respect to network, internet (cloud) or other data disclosure risks (such as data breaches, releases of confidential information, unauthorized access/use of information, and identity theft) with minimum limits of not less than $1,000,000 per occurrence and $2,000,000 aggregate.

Additional Insured The State shall be named as additional insured on all Commercial General Liability Insurance policies (leases and construction contracts require additional insured coverage for completed operations on endorsements CG 2010 11/85, CG 2037, or equivalent) required of Contractor or any Subcontractors hereunder.

Primacy of Coverage Coverage required of Contractor and Subcontractor shall be primary over any insurance or self-insurance program carried by Contractor or the State.

Cancellation The above insurance policies shall include provisions preventing cancellation or non-renewal without at least thirty (30) days’ prior notice to Contractor and Contractor shall forward such notice to the State in accordance with §16 within seven (7) days of Contractor’s receipt of such notice.

Subrogation Waiver All insurance policies in any way related to this Contract and secured and maintained by Contractor or its Subcontractors as required herein shall include clauses stating that each carrier shall waive all rights of recovery, under subrogation or otherwise, against Contractor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers.

Certificates Contractor and all Subcontractors shall provide certificates showing insurance coverage required hereunder to the State within seven (7) days of the Effective Date of this Contract. No later than fifteen (15) days prior to the expiration of any such coverage, Contractor and each Subcontractor shall deliver to the State or Contractor certificates of insurance evidencing renewals thereof. In addition, upon request by the State at any other time during the term of this Contract or any subcontract, Contractor and each Subcontractor shall, within ten (10) days of such request, supply to the State evidence satisfactory to the State of compliance with the provisions of this §13.

14. BREACH

Defined In addition to any breaches specified in other sections of this Contract, the failure of either Party to perform any of its material obligations hereunder in whole or in part or in a timely or satisfactory manner constitutes a breach. The institution of proceedings under any bankruptcy, insolvency, reorganization, or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within twenty (20) days after the institution or occurrence thereof, shall also constitute a breach.

Notice and Cure Period In the event of a breach, notice of such shall be given in writing by the aggrieved Party to the other Party in the manner provided in §16. If such breach is not cured within thirty (30) days of receipt of written notice, or if a cure cannot be completed within thirty (30) days, or if cure of the breach has not begun within thirty (30) days and pursued with due diligence, the State may exercise any of the remedies set forth in §15. Notwithstanding anything to the contrary herein, the State, in its sole discretion, need not provide advance notice or a cure period and may immediately terminate this Contract in whole or in part if reasonably necessary to preserve public safety or to prevent immediate public crisis.

15. REMEDIES

If Contractor is in breach under any provision of this Contract, the State shall have all of the remedies listed in this §15 in addition to all other remedies set forth in other sections of this Contract following the notice and cure period set forth in §14.B. The State may exercise any or all of the remedies available to it, in its sole discretion, concurrently or consecutively.

Termination for Cause and/or Breach The State may terminate this entire Contract or any part of this Contract. Exercise by the State of this right shall not be a breach of its obligations hereunder. Contractor shall continue performance of this Contract to the extent not terminated, if any.

Obligations and Rights To the extent specified in any termination notice, Contractor shall not incur further obligations or render further performance hereunder past the effective date of such notice, and shall terminate outstanding orders and subcontracts with third parties. However, Contractor shall complete and deliver to the State all Work, Services, and Goods not cancelled by the termination notice and may incur obligations as are necessary to do so within the terms of this Contract. At the sole discretion of the State, Contractor shall assign to the State all of Contractor’s right, title, and interest under such terminated orders or subcontracts. Upon termination, Contractor shall take timely, reasonable, and necessary action to protect and preserve property in the possession of the Contractor in which the State has an interest. All materials owned by the State in the possession of Contractor shall be immediately returned to the State. All Work Product, at the option of the State, shall be delivered by Contractor to the State and shall become the State’s property.

Payments The State shall reimburse Contractor only for accepted performance up to the date of termination. If, after termination by the State, it is determined that Contractor was not in breach or that Contractor’s action or inaction was excusable, such termination shall be treated as a termination in the public interest and the rights and obligations of the Parties shall be the same as if this Contract had been terminated in the public interest, as described herein.

Damages and Withholding Notwithstanding any other remedial action by the State, Contractor shall remain liable to the State for any damages sustained by the State by virtue of any breach under this Contract by Contractor and the State may withhold any payment to Contractor for the purpose of mitigating the State’s damages, until such time as the exact amount of damages due to the State from Contractor is determined. The State may withhold any amount that may be due Contractor as the State deems necessary to protect the State against loss, including loss as a result of outstanding liens, claims of former lien holders, or for the excess costs incurred in procuring similar goods or services. Contractor shall be liable for excess costs incurred by the State in procuring from third parties replacement Work, Services, or substitute Goods as cover.

Early Termination in the Public Interest The State is entering into this Contract for the purpose of carrying out the public policy of the State of Colorado, as determined by its Governor, General Assembly, and/or Courts. If this Contract ceases to further the public policy of the State, the State, in its sole discretion, may terminate this Contract in whole or in part.