OR PA_SAMPLE PA.docx

Participating Addendum Number [#######] for Multi-Function Devices between State of Oregon and Participating Addendum Number [#######] for Multi-Function Devices Between State of Oregon and [Contractor]

[Contractor]

RFP #S-10700-00001810, OREGON SAMPLE PARTICIPATING ADDENDUM

Version 2023.06.15

This Participating Addendum (“Addendum”) is entered into by the State of Oregon Department of Administrative Services (“DAS”) Procurement Services (“DAS PS”) on behalf of State Agencies and ORCPP members (“Participating Entity”) and the following Contractor for the purpose of participating in NASPO ValuePoint Master Agreement Number [#######], executed by Contractor and the State of Oregon (“Lead State”) for Multi-Function Devices (“Master Agreement”):

[Contractor] (“Contractor”) [Contractor street address] [Contractor city, state, and zip code]

I. PARTICIPATING ADDENDUM CONTACTS.

Contractor’s contact for this Participating Addendum is:

[Contact name] [Contact title] [Contact email address] [Contact phone number] Participating Entity’s contact for this Participating Addendum is:

Marc Monetti Procurement Analyst P: 971-301-0760 E: marc.monetti@das.oregon.gov

II. TERM. This Participating Addendum is effective as of the date of the last signature below and will terminate upon termination of the Master Agreement, as amended, unless the Participating Addendum is terminated sooner in accordance with the terms set forth in this Participating Addendum.

III. PARTICIPATION AND USAGE. This Participating Addendum may be used by all state agencies, institutions of higher education, cities, counties, districts, and other political subdivisions of the state, and nonprofit organizations within the state if authorized herein and by law. Participating Entity has sole authority to determine which entities are eligible to use this Participating Addendum. If Contractor becomes aware that an entity’s use of this Participating Addendum is not authorized, Contractor will notify NASPO ValuePoint to initiate outreach to the appropriate parties.

IV. GOVERNING LAW. The construction and effect of this Participating Addendum and any Orders (each a “Contract”) placed hereunder will be governed by, and construed in accordance with, Participating Entity’s laws.

V. SCOPE. Except as otherwise stated in this Participating Addendum, this Participating Addendum incorporates the scope, pricing, terms, and conditions of the Master Agreement and the rights and obligations set forth therein as applied to Contractor and Participating Entity and Purchasing Entities.

a. Products. All products available through the Master Agreement may be offered and sold by Contractor to Purchasing Entities.

b. Services. All services available through the Master Agreement may be offered and sold by Contractor to Purchasing Entities.

c. Contractor Partners. All subcontractors, dealers, distributors, resellers, and other partners identified on Contractor’s NASPO ValuePoint webpage as authorized to provide Products and Services to Participating Entity may provide Products and Services to users of this Participating Addendum. Contractor will ensure that the participation of Contractor’s subcontractors, dealers, distributors, resellers, and other partners is in accordance with the terms and conditions set forth in the Master Agreement and in this Participating Addendum.

d. Any amendment to the Master Agreement will be deemed incorporated into this Participating Addendum unless the amendment is rejected by Participating Entity in writing to Contractor within ten (10) calendar days of the amendment’s effective date.

Any conflict between this Participating Addendum and the Master Agreement will be resolved in favor of the Participating Addendum. The terms of this Participating Addendum, including those modifying or adding to the terms of the Master Agreement, apply only to the Contractor and will have no effect on Contractor’s participating addenda with other participating entities or Contractor’s Master Agreement with the Lead State.

VI. ORDERS. Purchasing Entities may place orders under this Participating Addendum by referencing the Participating Addendum Number on an Order. Each Order placed under this Participating Addendum is subject to the pricing and terms set forth in this Participating Addendum and in the Master Agreement, including applicable discounts, reporting requirements, and payment of administrative fees to NASPO ValuePoint and Participating Entity, if applicable.

VII. PARTICIPATING ENTITY REPORTING REQUIREMENTS AND ADMINISTRATIVE FEE.

Contractor will submit volume sales reports to Participating Entity and will pay an administrative fee of two percent (2%) as set forth in: https://www.oregon.gov/das/Procurement/Documents/VSRandVCAFInstructions.docx VIII. FEDERAL FUNDING REQUIREMENTS. Orders funded with federal funds may have additional contractual requirements or certifications that must be satisfied at the time the Order is placed or upon delivery, as set forth in Exhibit No. 4. When applicable, a Purchasing Entity ("Authorized Purchaser”) will identify in the Order any alternative or additional requirements related to the use of federal funds. By accepting the Order, Contractor agrees to comply with the requirements set forth in Exhibit No. 4 and the Order.

IX. INFORMATION TECHNOLOGY STANDARDS. Purchasing Entity data, activities, or systems related to an Order may have additional requirements under law, administrative rule, policy, or contract that must be satisfied under an Order. Contractor will comply with all applicable requirements under law, administrative rule, policy, or contract that relate to the Order. By accepting the Order, Contractor agrees it has an affirmative duty to identify and will comply with all requirements related to Purchasing Entity data, activities, or systems, including as set forth in an Order, in law or rule, in written policy, or as otherwise provided to Contractor.

X. ATTACHMENTS. This Participating Addendum includes the following attachments which in the event of a conflict will be interpreted in the following order:

a. This Participating Addendum, less its exhibits.

b. Exhibit No. 1, Changes to Master Agreement State-Specific Constitutional Statutory and Other Requirements

c. Exhibit No. 2, Insurance Requirements

d. Exhibit No. 3, Contractor Data

e. Exhibit No. 4, Federal Provisions

f. Exhibit No. 5, Sample Purchase Order XI. NOTICE. Any notice required under this Participating Addendum must be sent to the following:

For Contractor:

[Contact name] [Contact title] [Contact email address] [Contact phone number] For Participating Entity:

Marc Monetti Procurement Analyst marc.monetti@das.oregon.gov P: 971-301-0760 XII. SUBMISSION OF PARTICIPATING ADDENDUM TO NASPO VALUEPOINT. Upon execution, Contractor will promptly email a copy of this Participating Addendum and any amendments hereto to NASPO ValuePoint at pa@naspovaluepoint.org. The Participating Addendum, including as amended, may be published on the NASPO ValuePoint website.

SIGNATURE

The undersigned for each party represents and warrants that this Participating Addendum is a valid and legal agreement binding on it and enforceable in accordance with the Participating Addendum’s terms and that the undersigned is duly authorized and has legal capacity to execute and deliver this Participating Addendum and bind the party to the terms of this Participating Addendum.

IN WITNESS WHEREOF, the parties have executed this Participating Addendum.

CONTRACTOR: PARTICIPATING ENTITY:

DERPARTMENT OF JUSTICE FOR PARTICIPATING ENTITY:

Signature

Printed Name

Title

Date

Matter Number

EXHIBIT NO. 1

Changes to Master Agreement State-Specific Constitutional, Statutory and Other Requirements

1. Incorporation of Master Agreement. Participating State and Purchasing Entities are intended beneficiaries of the Master Agreement and are entitled to rely upon all of the representations and warranties, rights, remedies, and benefits under the Master Agreement and this Addendum, subject to the State-Specific Constitutional, Statutory and other requirements set forth herein.

2. Definitions. Capitalized terms not defined in this Addendum have the meaning ascribed to them in the Master Agreement and its exhibits. The following terms have the meanings set forth below:

“ORCPP” is the State of Oregon’s Cooperative Purchasing Program. ORCPP members are authorized to use DAS PS statewide agreements. ORCPP members include: State Agencies not subject to DAS PS purchasing authority, cities, counties, school districts, special districts, Qualified Rehabilitation Facilities (QRFs), residential programs under contract with the Oregon Department of Human Services, United States governmental agencies, and American Indian tribes or agencies.

“State Agency” or “State Agencies” means boards, commissions, departments, or agencies of the State of Oregon, whose costs are paid, in whole or in part from funds held in the State Treasury.

3. Lease Terms To be negotiated

4. Hard Drive Removal. At Authorized Purchaser’s written request, and according to the listed price, Contractor must, upon removing a Product from Authorized Purchaser’s premises, whether upon lease termination or otherwise, remove the hard drive or other storage device from the Product and leave the hard drive or other storage device with the Authorized Purchaser’s authorized representative, and obtain documentation by the Authorized Purchaser accepting the returned hard drive or other storage device. Contractor must leave a copy of such signed documentation with the Authorized Purchaser, maintain another copy of such signed documentation with the Authorized Purchaser, and maintain another copy in accordance with the records retention requirements set forth in the Addendum.

5. Award of Participating Addenda; Selection of Contractor.

5.1 Award of Participating Addenda. In the event of a multiple award of Master Agreements under the solicitation, the State of Oregon intends to enter into a Participating Addendum with one or more of the awardees of Master Agreements. The State of Oregon may elect not to enter into a Participating Addendum with each of the awardees. In the event the State of Oregon elects not to enter into a Participating Addendum with each of the awardees, after applying all applicable State preferences, the State of Oregon may enter into a Participating Addendum with the three highest ranked Proposers who provide products or services on a national level, and in addition the State of Oregon may enter into a Participating Addendum with the three highest ranked Proposers who provide Products or Services in the State of Oregon only.

5.2 Purchasing Entity Selection of Contractor. In the event the State of Oregon elects to enter into a Participating Addendum with more than one of the awardees of Master Agreements, a Purchasing Entity, that is a state agency, using the State of Oregon’s Participating Addenda, must apply all applicable State preferences and use one the following three processes to make its selection of a provider among the holders of State of Oregon Participating Addenda. The Purchasing Entity must document its selection process in its procurement file.

6. Orders.

6.1 Eligible Purchasing Entities. All state agencies under DAS procurement authority and all state agencies with their own procurement authority, institutions of higher institution, political subdivisions and other entities that are members of the Oregon Cooperative Purchasing Program (ORCPP), are eligible to acquire Products and Services under this Addendum.

6.2 DAS Purchasing Threshold. Purchasing Entities that are agencies of the State of Oregon under DAS procurement authority may issue ordering instruments under this Addendum for any dollar amount without further delegation of procurement authority from DAS. Notwithstanding the foregoing DAS delegation, Purchasing Entities that are agencies of the State of Oregon must obtain all other necessary approvals, including but not limited to legal sufficiency approval, as may be required.

6.3 Verification of Purchasing Entities. Contractor much verify that it provides Products and Services under this Addendum only to eligible Purchasing Entities. Contractor may verify that a particular entity is an ORCPP member on-line at http://www.oregon.gov/das/Procurement/Pages/Orcppmember.aspx or by using the Oregon Procurement Information Network (ORPIN) at http://orpin.oregon.gov/open.dll/welcome.

6.4 Effect of Orders. The State is only liable for purchases under Orders issued by State of Oregon agencies. Other Purchasing Entities are responsible for any purchases under Orders they issue. The State expressly disclaims any liability for purchases made by non-State agency Purchasing Entities or any other entity.

7. Third Party Agreements. To the extent any Products or Services are subject to the provisions of a third-party license agreement, subscription agreement, maintenance and support agreement or any other third-party agreement, Contractor must provide Purchasing Entity with a copy of any such third-party agreement. Purchasing Entity will have thirty (30) calendar days to review the agreement. Purchasing Entity may accept the terms of the agreement, reject the terms, or attempt to negotiate the terms with the third-party provider. In the event Purchasing Entity rejects the terms or is unable to come to agreement with the third-party provider, Purchaser Entity may revoke the Order and will be entitled to a full refund of all amounts paid and will not be subject to any early termination fees.

8. Payment Provisions; Expenses. All payments are subject to ORS 293.462. Purchasing Entity will not be obligated to pay any travel expenses unless expressly agreed upon in an Order. Any obligation to pay travel expenses, including transportation, lodging, or meals, is subject to the rates and limitations set under Oregon law. Contracts with the State of Oregon are subject to the rates and limitations of the Statewide Travel Policy, currently found online at: http://www.oregon.gov/das/Financial/Acctng/Documents/40.10.00.pdf.

9. Funds available and authorized/non-appropriation. The State of Oregon’s and its agencies’ payment obligations under this Addendum are conditioned upon Purchasing Entity receiving funding, appropriations, limitations, allotments, or other expenditure authority sufficient to allow Purchasing Entity, in the exercise of its reasonable administrative discretion, to meet its payment obligations under any Order issued under this Addendum. Contractor is not entitled to receive payment under this Addendum or any Order from any part of Oregon state government other than Purchasing Entity. Nothing in this Addendum or Order is to be construed as permitting any violation of Article XI, section 7 of the Oregon Constitution or any other law regulating liabilities or monetary obligations of the State of Oregon. Purchasing Entity represents that it has sufficient appropriations and limitation for the current biennium to make payments under any Order issued under this Addendum.

10. Warranties. Purchasing Entities are entitled to the warranties, rights, remedies, and benefits under the Master Agreement and this Addendum. The warranties set forth the Master Agreement are in addition to, and not in lieu of, any other warranties provided by law. All warranties are cumulative and will be interpreted expansively so as to afford Purchasing Entity the broadest warranty protection available.

11. Dispute Resolution. Any dispute between the parties under this Addendum that is not resolved through informal discussions may be submitted to mediation upon the consent of both parties. If informal discussions or mediation are unsuccessful, either party may initiate litigation to resolve the dispute. The parties specifically disclaim any right to arbitration of disputes. Neither party waives its right to a jury trial or right to participate in class, collective, or representative claims.

12. Control of Defense and Settlement. Contractor’s obligation to indemnify Purchasing Entity as set forth in the Master Agreement is conditioned on Purchasing Entity providing to Contractor prompt notification of any claim or potential claim of which Purchasing Entity becomes aware. Contractor will have control of the defense and settlement of any claim that is subject to indemnification; however, neither Contractor nor any attorney engaged by Contractor may defend the claim in the name of the State of Oregon or any Purchasing Entity of the State of Oregon, nor purport to act as legal representative of the State of Oregon or any of its agencies, without the approval of the Attorney General, nor may Contractor settle any claim on behalf of the State of Oregon without the approval of the Attorney General. The State of Oregon may, at its election and expense, assume its own defense and settlement in the event that the State of Oregon determines that Contractor is prohibited from defending the State of Oregon, is not adequately defending the State of Oregon’s interests, or that an important governmental principle is at issue and the State of Oregon desires to assume its own defense.

13. Limitation of Liability; Exclusions. The Participating Entity’s or a Purchasing Entity’s indemnification obligations to Contractor, if any, are subject to the provisions of Article XI, Section 7 of the Oregon Constitution and the Oregon Tort Claims Act (ORS 30.260 to 30.300).

14. Insurance. Within ten (10) calendar days of the effective date of a Contract, Contractor must deliver to DAS a certificate evidencing the insurance coverage set forth on Exhibit No. 2. No Orders may be placed or accepted until proof is provided that these requirements have been met. Purchasing Entities may request additional insurance coverage, as necessary.

15. Jurisdiction and Venue. Any claim, action, suit or proceeding (collectively, “Claims”) between State or any other agency or department of the State of Oregon, and Contractor, that arises from or relates to this Addendum or an Order under this Addendum, will be brought and conducted solely and exclusively in the Circuit Court of Marion County for the State of Oregon; provided, however, if a Claim must be brought in a federal forum, then it will be brought and conducted solely and exclusively in the United States District Court of the District of Oregon. CONTRACTOR, BY EXECUTION OF THIS ADDENDUM OR ACCEPTANCE OF AN ORDER SUBMITTED PURSUANT TO THIS ADDENDUM HEREBY CONSENTS TO THE IN PERSONAM JURISDICTION OF SAID COURTS. Nothing in this section will be construed as a waiver of the State of Oregon’s sovereign immunity with respect to any Claim, whether brought under State or federal law, or the consent to jurisdiction in state or federal court.

Any Claims between Contractor and an Purchasing Entity other than the State of Oregon or State agency that arise from or are related to individual Orders or this Addendum will be brought and conducted solely and exclusively within the Circuit Court of the county in the State of Oregon in which such Purchasing Entity resides or has its principal office, or at Purchasing Entity’s option, within such other county as Purchasing Entity will be entitled to proceed under the venue laws of Oregon to bring or defend Claims. If any such Claim must be brought in a federal forum, then it will be brought and conducted solely and exclusively within the United States District Court for the District of Oregon.

16. Remedies. If any Products or services furnished by Contractor are, in Contractor’s opinion, likely to become the subject of an Infringement Claim, or if an Purchasing Entity is prevented from exercising its rights under this Addendum based on any Infringement Claim or court order arising from any Infringement Claim, then Contractor may, at its option and expense, procure for the Purchasing Entity the right to continue using the allegedly infringing Products or services, or replace or modify the Products or services so that they become non-infringing; provided that the replacement or modified good or service meets the specifications set forth in the applicable Order to the satisfaction of the Purchasing Entity. If the foregoing remedies are not available, then Purchasing Entity will return the allegedly infringing Products or terminate the allegedly infringing services, and Contractor will refund Purchasing Entity’s payments, in full, for the allegedly infringing Products or services.

17. Term and Termination of Participating Addendum.

17.1 This Addendum remains in effect until the earlier of (a) the expiration or termination of the Master Agreement, or (b) termination of this Addendum in accordance with its terms.

17.2 Termination. In addition to its termination rights under the Master Agreement, DAS may terminate this Addendum, in whole or in part, at any time upon thirty (30) days prior written notice to Contractor.

18. Termination of Individual Orders. In addition to its termination rights under the Master Agreement, Purchasing Entity may, at its sole discretion, terminate individual Orders, in whole or in part, upon 30 calendar days written notice to Contractor, or Purchasing Entity and Contractor may agree to terminate an Order at any time by written consent.

19. Governing Law. The laws of the State of Oregon (without giving effect to its conflicts of law principles) govern all matters arising out of or relating to this Addendum and resulting Orders, including, without limitation, their validity, interpretation, construction, performance, and enforcement.

20. Compliance with Law.

20.1 General. In addition to the compliance of law provisions of the Master Agreement, Contractor shall comply with all federal, state and local laws, rules, regulations, executive orders and ordinances applicable to Contractor or to the Products or Services ordered under this Addendum or any Order, including as may be modified or adopted from time to time. Further, a Purchasing Entity’s performance under an Order is conditioned on Contractor’s compliance with the provisions of ORS 279B.220, 279B.235, 279B.230. and 279B.270.

20.2 Pay Equity. Contractor shall comply with ORS 652.220 and shall not unlawfully discriminate against any of Contractor’s employees in the payment of wages or other compensation for work of comparable character on the basis of an employee’s membership in a protected class. “Protected class” means a group of persons distinguished by race, color, religion, sex, sexual orientation, national origin, marital status, veteran status, disability or age. Contractor’s compliance with this section constitutes a material element of this Addendum and a failure to comply constitutes a breach that entitles DAS or Purchasing Entity to terminate this Addendum or an Order for cause.

Contractor may not prohibit any of Contractor’s employees from discussing the employee’s rate of wage, salary, benefits, or other compensation with another employee or another person. Contractor may not retaliate against an employee who discusses the employee’s rate of wage, salary, benefits, or other compensation with another employee or another person.

20.3 False Claims. Contractor understands and acknowledges it is subject to the Oregon False Claims Act (ORS 180.750 to 180.785) and to any liabilities or penalties associated with the making of a false claim under that Act. By its execution of the Addendum, Contractor certifies the truthfulness, completeness, and accuracy of any statement or claim it has made, it makes, it may make, or cause to be made that pertains to the Addendum or the Orders, including but not limited to Contractor invoices, correspondence, reports, or other deliverables.

20.4 Non-Discrimination. Contractor certifies that it has a written policy and practice that meets the requirements described in ORS 279A.112 for preventing sexual harassment, sexual assault, and discrimination against employees who are members of a protected class. Contractor agrees, as a material condition, to maintain such policy and practice in force during the term of this Addendum and each Order.

20.5 Undisclosed Debt; Tax Compliance and Certification. By executing this Addendum, the undersigned certifies under penalty of perjury that, to the best of the individual’s knowledge, Contractor has no undisclosed liquidated and delinquent debt owed to the State of Oregon or any of its agencies, boards, commissions, departments or divisions, and Contractor complied with the tax laws of the State of Oregon and the applicable tax laws of any political subdivision of this state, and Contractor shall, for the term of this Addendum and any extensions, comply with all tax laws of this state and all applicable tax laws of any political subdivision of this state. For the purposes of this section, “tax laws” includes: (i) All tax laws of this state, including but not limited to ORS 305.380(4), ORS 305.620 and ORS chapters 316, 317, and 318; (ii) Any tax provisions imposed by a political subdivision of this state that apply to Lessor, to Lessor’s property, operations, receipts, or income, or to Lessor’s performance of or compensation for any work performed by Lessor; (iii) Any tax provisions imposed by a political subdivision of this state that apply to Lessor, or to Products, services, or property, whether tangible or intangible, provided by Lessor; and (iv) Any rules, regulations, charter provisions, or ordinances that implemented or enforced any of the foregoing tax laws or provisions. Any violation of this provision will be considered a material breach of this Addendum and applicable Orders. DAS and Purchasing Entity, as applicable, may pursue any and all remedies set forth in the Master Agreement, including termination of this Addendum or a Order.

This Addendum will be reported to the Oregon Department of Revenue. The Department of Revenue may take any and all actions permitted by law relative to the collection of taxes and debt due to the State of Oregon or a political subdivision, including (i) garnishing Lessor’s compensation under this Lease, or (ii) exercising a right of setoff against Lessor’s compensation relating to this Lease for any amounts that may be due and unpaid to the State of Oregon or its political subdivisions for which the Department of Revenue collects debts.

21. Security and Data Privacy Laws.

21.1 Ownership of Authorized Purchaser Data. Any information Contractor or its employees or agents receives or creates relating to Authorized Purchaser or Authorized Purchaser’s clients (Authorized Purchaser Data) is owned by Authorized Purchaser. For the avoidance of doubt, Authorized Purchaser Data does not include equipment performance or usage related data collected and utilized by Contractor to perform its responsibilities under this Participating Addendum. Authorized Purchaser hereby grants Contractor a license to use Authorized Purchaser Data to fulfill the purposes of this Addendum, and otherwise only as specifically described in this Addendum. Contractor hereby irrevocably assigns, transfers and conveys, and will cause its employees, subcontractors and agents to assign, transfer and convey without further con-sideration all right, title, and interest in Authorized Purchaser Data to Authorized Purchaser. Upon request by Authorized Purchaser, Contractor will or will cause the execution and delivery of any documents that may be necessary to preserve, or enable Authorized Purchaser to enforce, its rights with respect to Authorized Purchaser Data.

21.2 Privacy and Security Training. Contractor shall ensure its employees, agents, and contractors receive periodic training on privacy and security obligations relating to this Addendum.

21.3 Limited Purposes. Contractor shall limit the use or disclosure of Authorized Purchaser Data to persons directly connected with the administration of this Addendum.

21.4 No Overseas Access, Storage, or Transmission. Authorized Purchaser Data will not be accessed from, transmitted, or stored outside of the United States or its territories, including for any maintenance, support, disaster recovery, or da-ta backup.

21.5 Prohibition on Data Mining. Contractor shall not capture, maintain, scan, index, share or use Authorized Purchaser Data, or otherwise use any data-mining technology, for any non-authorized activity, and shall not permit its agents or subcontractors to do so. For purposes of this requirement, “non-authorized activity” means data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in this Addendum.

21.6 Privacy Protections. The information exchanged between the parties may include Authorized Purchaser Data subject to specific confidentiality protections under state or federal law, and the implementing regulations of those laws. Contractor, its employees, agents, and contractors shall comply with laws and regulations applicable to the information, including as those laws and regulations may be updated from time to time. Contractor shall maintain protections required by law or this Addendum for any retained Authorized Purchaser Data for so long as Contractor (including through any third party) retains Authorized Purchaser Data.

21.7 Access. Contractor shall not suspend Authorized Purchaser’s access to Authorized Purchaser Data at any time during the term of this Addendum or the post-termination access period.

21.8 Post-Termination Access to Authorized Purchaser Data. Upon Addendum termination (including by expiration), Contractor shall, at Authorized Purchaser’s discretion, either return all Authorized Purchaser Data to Authorized Purchaser (or delegate) in an agreed-upon format, or ensure Authorized Purchaser has access and the ability to retrieve Authorized Purchaser Data for at least a 90 calendar day period following termination. This 90 day period will be at no additional charge to Authorized Purchaser. Contractor shall not retain any copies of Authorized Purchaser Data following Authorized Purchaser’s written verification that Authorized Purchaser no longer requires post-termination access, except as necessary for audit verification purposes.

21.9 Transition Services. Contractor shall at Authorized Purchaser’s option provide transition services to support a responsible and secure transition of Services and Authorized Purchaser Data to another service provider or to Authorized Purchaser.

21.10 Sanitization. Subject to Section 23, Access to Records, and Section 4, Hard Drive Removal, Contractor must not retain any copies of Authorized Purchaser Data following the post-termination access period referenced in Section 19.8. Contractor must not destroy Authorized Purchaser Data without Authorized Purchaser’s written authorization. Contractor must notify Authorized Purchaser of any conditions that make returning all Authorized Purchaser Data not feasible. Upon Authorized Purchaser’s written acknowledgement that returning all Authorized Purchaser Data is not feasible and consent, Contractor must purge or destroy retained Authorized Purchaser Data in all its forms (including copies of returned data) in accordance with the most current version of NIST SP 800-88 [or other agreed-upon standard] and provide Authorized Purchaser with written certification of sanitization.

22. Notifications.

22.1 Incidents and Breaches. In the event Contractor or its subcontractor or agents discover or are notified of a security incident, or a breach or potential breach of security or privacy, Contractor must notify Authorized Purchaser’s point of contact (or delegate) of the incident, breach, or potential breach as soon as practically reason-able. An incident is an observable, measurable occurrence that is a deviation from expected operations or activities. Breaches include a failure to comply with Contractor’s confidentiality obligations. If Authorized Purchaser determines that a breach requires notification of its clients, or other notification required by law, Authorized Purchaser will have sole control over the notification content, timing, and method, subject to Contractor’s obligations under applicable law.

22.2 Requests for Authorized Purchaser Data. In the event Contractor receives a third party request for Authorized Purchaser Data, including any electronic discovery, litigation hold, or discovery searches, Contractor shall first give Authorized Purchaser notice and provide such information as may reasonably be necessary to enable Authorized Purchaser to take action to protect its interests.

22.3 Changes in Law. Each party will provide notice to the other of any change in law, or any other legal development, which may significantly affect its ability to perform its obligations.

23. Security and Hosting.

23.1 Compliance with Laws, Regulations, and Policies. Contractor shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of Authorized Purchaser Data and access to State of Oregon information assets, including as those laws, regulations, and policies may be updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

•Oregon’s Statewide Information Security Standards:

https://www.oregon.gov/das/OSCIO/Documents/2017%20ISO%20Standards%20 Oregon.pdf.

•Oregon’s Statewide Information Security Plan, https://www.oregon.gov/das/OSCIO/Documents/StatewideInformationSecurityPla n.pdf; and •Oregon’s Statewide Policies: www.oregon.gov/das/Pages/policies.aspx#IT.

•The Oregon Consumer Identity Theft Protection Act, ORS 646A.600 through 646A.628, to the extent applicable.

•Requirements adopted by the State pursuant to Oregon Executive Order 23-26, which established the State Government Artificial Intelligence Advisory Council: https://www.oregon.gov/gov/eo/eo-23-26.pdf.

23.2 Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security, and privacy of Authorized Purchaser Data. Contractor shall monitor, periodically assess, and update its physical, technical, and logical security controls and risk to ensure continued effectiveness of those controls.

23.3 Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required by this Addendum is documented in a security risk management plan. Contractor will make its plan available to Authorized Purchaser for review upon request.

23.4 Testing. Authorized Purchaser may conduct periodic security testing upon reasonable advanced notice to Contractor.

23.5 Background Checks. Contractor has completed a criminal background check on its employees, agents, and contractors providing services related to this Addendum. At the request of Authorized Purchaser, Contractor shall certify in writing that such background checks have been completed, and the checks revealed no negative findings pertaining to dishonesty, fraud, or theft to the extent examined by the back-ground checks on employees, agents, or contractors providing services related to this Addendum.

23.6 Third Party Audit. Contractor shall ensure it and its subservice organizations undergo annual examination from an independent auditor to assess the Services’ compliance with at least NIST 800-53 “Moderate” security controls (National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53). Contractor shall provide an exact copy of the most recent examination results report to Authorized Purchaser upon request.

23.7 Security Logs and Reports. Contractor shall allow Authorized Purchaser access to system security logs that affect the Services, Authorized Purchaser Data, or processes. This includes the ability for Authorized Purchaser to request a report of the records that a specific user accessed over a specified period of time.

23.8 Authorized Purchaser Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Addendum, and provide Authorized Purchaser, the Oregon Secretary of State, the federal government, and their duly authorized representatives access to Contractor’s officers, agents, contractors, subcontractors, employees, facilities and records to:

•Determine Contractor’s compliance with this Addendum, •Validate Contractor’s written security risk management plan, or •Gather or verify any additional information Authorized Purchaser may require to meet any state or federal laws, rules, or orders, including those regarding Authorized Purchaser Data.

23.9 Except as stated below for security logs, access to facilities, systems, and records under this section will be granted following reasonable notice to Contractor. Records include paper or electronic form, and related system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

24. System Security Logs. Contractor shall provide designated Authorized Purchaser staff on-demand access to system security logs in report form for the Services, including user-level access logs for both Authorized Purchaser and Contractor users.

25. Access to Records. Contractor will maintain all fiscal records relating to Orders in accordance with generally accepted accounting principles and will maintain any other records relating to Orders in such a manner as to clearly document Contractor's performance thereunder. The Authorized Purchaser, the State and its agencies, the Oregon Secretary of State Audits Division and their duly authorized representatives will have access to such fiscal records and to all other books, documents, papers, plans and writings of Contractor which reasonably relate to this Participating Addendum to perform examination and audits and make excerpts and transcripts. To the extent provided by law, the federal government will be entitled to the same access as the State of Oregon and Authorized Purchasers. Contractor will retain and keep accessible all such fiscal records, books, documents, papers, plans, and writings for a minimum of six years, or such longer period as may be required by applicable law following final payment and termination of this Participating Addendum, or until the conclusion of any audit, controversy or litigation arising out of or related to this Addendum, whichever date is later.

26. Application of Public Records Law. Participating State or Purchasing Entity’s obligations of confidentiality, if any, are subject to application of the Oregon Public Records Law, including but not limited to ORS 192.311 to 192.478, the provisions for the Custody and Maintenance of Public Records, ORS 192.005 – 192.710, and of ORS 646.461 - 646.475.

27. Recycled Products. To the maximum extent economically feasible in the performance of this Addendum or any Order, Contractor will use recycled paper (as defined in ORS 279A.010(1)(gg)), recycled PETE products (as defined in ORS 279A.010(1)(hh)), and other recycled plastic resin products and recycled products (as “recycled product” is defined in ORS 279A.010(1)(ii)).

28. Foreign Contractor. If Contractor is not domiciled in or registered to do business in the State of Oregon as of the effective date of this Addendum, Contractor will promptly provide to the Oregon Department of Revenue all information required by that Department relative to the Addendum or any Order. A Purchasing Entity may withhold final payment under an Order until Contractor has provided the Oregon Department of Revenue with the required information.

29. Independent Contractor. Contractor certifies that it is an independent contractor and at all times shall act as an independent contractor and not as an agent or employee of Purchasing Entity. Contractor has no right or authority to incur or create any obligation for or legally bind Purchasing Entity in any way. Contractor is not an "officer", "employee", or "agent" of Purchasing Entity (or any other agency, office, or department of the State of Oregon), as those terms are used in ORS 30.265, and shall not make representations to third parties to the contrary. Neither party shall make any statements, representations, nor commitments of any kind or to take any action binding on the other except as provided for herein or authorized in writing by the party to be bound.

30. Access to Records. Contractor will maintain all fiscal records relating to Orders in accordance with generally accepted accounting principles and will maintain any other records relating to Orders in such a manner as to clearly document Contractor's performance thereunder. The Purchasing Entity, the State and its agencies, the Oregon Secretary of State Audits Division and their duly authorized representatives will have access to such fiscal records and to all other books, documents, papers, plans and writings of Contractor which relate to this Addendum to perform examination and audits and make excerpts and transcripts. To the extent provided by law, the federal government will be entitled to the same access as the State of Oregon and Purchasing Entities. Contractor will retain and keep accessible all such fiscal records, books, documents, papers, plans, and writings for a minimum of six years, or such longer period as may be required by applicable law following final payment and termination of this Addendum, or until the conclusion of any audit, controversy or litigation arising out of or related to this Addendum, whichever date is later.

EXHIBIT NO. 2

INSURANCE

In addition to the insurance coverage requirements set forth in the Master Agreement, Contractor shall obtain at Contractor’s expense the additional insurance coverages specified in this Exhibit No. 2 prior to performing under this Addendum and shall maintain it in full force and at its own expense throughout the duration of this Addendum, the term of all Orders, and all warranty periods. Contractor shall obtain the required insurance from insurance companies or entities that are authorized to transact the business of insurance and issue coverage in State and that are acceptable to DAS. Coverage must be primary and non-contributory with any other insurance and self-insurance. Contractor shall pay for all deductibles, self-insured retention and self- insurance, if any.

WORKERS’ COMPENSATION & EMPLOYERS’ LIABILITY. All employers, including Contractor, shall provide workers’ compensation insurance as required by applicable workers’ compensation laws for persons performing work under this Addendum including Employers’ Liability Insurance with limits not less than $500,000 each accident. Contractor shall require and ensure that each of its subcontractors complies with these requirements.

COMMERCIAL GENERAL LIABILITY. Commercial General Liability Insurance covering bodily injury, death and property damage in a form and with coverage that are satisfactory to the State. This insurance must include personal injury liability, products and completed operations, and contractual liability coverage. Coverage must be written on an occurrence basis in an amount of not less than $1,000,000.00 per occurrence. Annual aggregate limit may not be less than $2,000,000.00.

AUTOMOBILE LIABILITY INSURANCE. Automobile Liability Insurance covering all owned, non-owned, or hired vehicles with a combined single limit of not less than $1,000,000.00 for bodily injury and property damage.

PROFESSIONAL LIABILITY. Professional Liability insurance covering any damages caused by an error, omission or any negligent acts related to the services to be provided under this Addendum in an amount not less than $ 1,000,000.00 per occurrence. Annual aggregate limit may not be less than $2,000.000.00. If coverage is on a claims made basis, then either an extended reporting period of not less than 24 months must be included in the Professional Liability insurance coverage, or Contractor shall provide Tail Coverage as stated below.

ADDITIONAL INSURED. The Commercial General Liability insurance and Automobile Liability insurance required under this Addendum must include the State of Oregon, its officers, employees and agents as Additional Insureds but only with respect to Contractor's activities to be performed under this Addendum.

TAIL COVERAGE. If any of the required insurance is on a claims made basis and does not include an extended reporting period of at least 24 months, Contractor shall maintain either tail coverage or continuous claims made liability coverage, provided the effective date of the continuous claims made coverage is on or before the effective date of this Addendum, for a minimum of 24 months following the later of (i) Contractor’s completion and DAS’ acceptance of all Services required under this Addendum, or, (ii) The expiration of all warranty periods provided under this Addendum.

CERTIFICATE(S) AND PROOF OF INSURANCE. Contractor shall provide to DAS Certificate(s) of Insurance for all required insurance before delivering any Products and performing any Services required under this Addendum. The Certificate(s) must list the State of Oregon, its officers, employees and agents as a Certificate holder and as Additional Insured, specify that Contractor shall pay for all deductibles, self-insured retention and self-insurance, if any, that all coverage is primary and non-contributory with any other insurance and self-insurance, and confirm that either an extended reporting period of at least 24 months is provided on all claims made policies or that tail coverage is provided. As proof of insurance DAS has the right to request copies of insurance policies relating to the insurance requirements in this Addendum.

NOTICE OF CHANGE OR CANCELLATION. Contractor or its insurer must provide at least 30 Days’ written notice to DAS before cancellation of, material change to, potential exhaustion of aggregate limits of, or non-renewal of the required insurance coverage(s).

INSURANCE REQUIREMENT REVIEW. Contractor agrees to periodic review of insurance requirements by DAS under this Addendum and to provide updated requirements as agreed upon by Contractor and DAS.

EXHIBIT NO. 3

CONTRACTOR DATA

Contractor Information. This information is requested pursuant to ORS 305.385.

PLEASE PRINT OR TYPE THE FOLLOWING INFORMATION

Contractor Name (exactly as filed with the IRS):

Street address:

City, state, zip code:

Email address:

Contractor's taxpayer identification numbers;

Federal Tax Number _______________ Oregon Tax Number ______________ Is Contractor a nonresident alien, as defined in 26 U.S.C. § 7701(b)(1)?

(Check one box): |_| YES |_| NO

Business Designation: (Check one box):

EXHIBIT NO. 4

FEDERAL PROVISIONS

Contractor shall comply and shall cause its subcontractors to comply with the following federal requirements, as may be applicable to the Participating Addendum and Order. For purposes of this Participating Addendum and Order, all references to federal laws are references to federal laws and implementing administrative rules as they are adopted and amended from time to time.

Contractor or Subrecipient Determination: In accordance with the Oregon State Controller’s Oregon Accounting Manual, policy 30.40.00. 104, Purchasing Entity’s determination is that:

___ Contractor is a subrecipient ___ Contractor is a contractor Source of Funds (if known): Catalog of Federal Domestic Assistance (CFDA) #(s) of federal funds to be paid through this Participating Addendum and Order: _______________

1. Equal Employment Opportunity. If this Participating Addendum and Order, including amendments, is for more than $10,000, then Contractor shall comply with Executive Order 11246, entitled “Equal Employment Opportunity,” as amended by Executive Order 11375, and as supplemented in Department of Labor regulations (41 CFR Part 60). The Executive Order prohibits contractors and federally-assisted construction contractors and subcontractors who do over $10,000 in government business in one year from discriminating in employment decisions on the basis of race, color, religion, sex, or national origin. The Executive Order also requires contractors to take affirmative action to ensure that equal opportunity is provided in all aspects of their employment. During the performance of the Participating Addendum and Order:

1.1. Contractor shall not discriminate against any employee or applicant for employment because of race, color, religion, sex, or national origin. Contractor will take affirmative action to ensure that applicants are employed, and that employees are treated during employment without regard to their race, color, religion, sex, or national origin. Such action must include, but not be limited to the following: employment, upgrading, demotion, or transfer; recruitment or recruitment advertising; layoff or termination; rates of pay or other forms of compensation; and selection for training, including apprenticeship. Contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices to be provided setting forth the provisions of this nondiscrimination clause.

1.2. Contractor will, in…