P-65380_7 Executed BOA Nomad to MFaaS.pdf

State of Illinois Chief Procurement Office General Services 1 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ORDERING INFORMATION

Item Description

(manufacturer, model, serial number, feature, etc.) Qty One Time Charge Periodic Charge

Unit Extension Unit Extension

1 KYNINC7 IBM Mainframe as a Service (MFaaS) One-time Charge for Migration Services (3 months) 1 $92,587.66 $92,587.66

2 KYNINC12 IBM Mainframe as a Service (MFaaS) Monthly Recurring Charges for Managed Hosting Services 12 $24,825.00 $297,900.00

3 Technical Systems and Solutions Specialist III 250 $242.81 $60,702.50 BOA Total: NTE $ 451,190.16

STATE OF ILLINOIS BASIC ORDERING AGREEMENT (BOA) for Orders Against Master Contracts The terms and conditions of this BOA, including those terms and conditions set forth in the additional documents referenced below, and any continuation sheets, constitute the entire agreement between the parties with respect to the subject matter of this BOA. State documents will prevail in the event of a conflict between State and Vendor documents. The State shall not be bound by terms and conditions contained in any other document except as attached herein.

CONTACT INFORMATION

Vendor Name: Kyndryl, Inc.

Address: One Vanderbilt Ave., 15th Floor, New York, NY 10017 Contact: Anita Mikus Phone #: 602.326.2020 Email: Anita.Mikus@kyndryl.com

State Agency Name: Department of Innovation and Technology Address: 120 W. Jefferson Street, Springfield, IL 62702 Contact: Amber Wright Phone #: 312-814-1477 Email: Amber.Wright2@Illinois.gov

Bill To:

Dept of Innovation & Technology Attn: Accounts Payable 120 W. Jefferson Street Springfield, IL 62702 DoIT.AccountsPayable@illinois.gov

Ship To:

Dept of Innovation & Technology 5300 S. 6th Street Springfield, IL 62703 Phone: 217-557-1122 DoIT.ITPO.Communications@illinois.gov

CONTRACT INFORMATION

Contract #: P-65380:7 Action: New Acquisition Type: Purchase Payment Cycle: one-time payment / monthly Terms and Conditions: Master Contract Number Master Contract # for Terms and Conditions:

24-448DOIT-ADMIN-P-65380

Term:

Begin Date:

10/1/2025

End Date:

9/15/2026

In processing this BOA, Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest, if any, as attached to the Master Contract referenced above are true and accurate as of the date of Vendor’s processing of this BOA.

mailto:Anita.Mikus@kyndryl.com mailto:Amber.Wright2@Illinois.gov mailto:DoIT.AccountsPayable@illinois.gov mailto:DoIT.ITPO.Communications@illinois.gov

State of Illinois Chief Procurement Office General Services 2 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ADDITIONAL INFORMATION / REFERENCES / ATTACHMENTS

Master Contract # 24-448DOIT-ADMIN-P-65380 NASPO Value Point Contract #AR3710 (To the extent that the Master Contract, including any additional licensing/product specific terms or other attachments thereto, expires or terminates, the terms and conditions of the Master Contract shall survive and continue to apply to the products and services being provided under this BOA. Further, the terms and conditions of the Master Contract shall continue to govern beyond the Term of this BOA and throughout the life and duration of the products/licenses and any related services being provided hereunder.) | Kyndryl Hosted Mainframe Services SOW dated 9.10.2025

SIGNATURES: The undersigned parties agree to these terms and conditions.

Vendor State of Illinois

Signature: N/A State Agency: Department of Innovation and Technology

Printed Name: Signature agency representative:

Title: Printed Name: Brandon Ragle

Date: Title: Acting Secretary

Date:

State of Illinois

ALL NOTICES TO:

Email: DoIT.ITPO.Communications@Illinois.gov and DoIT.GeneralCounsel@Illinois.gov State of Illinois

Signature agency representative: Signature agency representative:

Printed Name: Radhika Lakhani Printed Name: Mary Feagans

Title: General Counsel Title: Chief Fiscal Officer

Date: Date:

STATE USE ONLY

Reference Number: R-285332/ P-65380:7 Source Selection Method: Order Against Master Is Financing Needed? No Using Agency Funding Source:

• Fiscal Year: 2026

• Type: State

Approp. Account Code:

Detailed Expenditure Object Code:

IPB Reference Number: B-42741 Award Code: B Original Procurement Method: RFP IPB Publication Date: 4/18/2024 Subcontractors Utilized? Yes Subcontractors Disclosed? Yes

Reviewed as to legal clause sufficiency – BPW 9/11/2025

09/26/2025

09/26/2025

09/26/2025 mailto:DoIT.ITPO.Communications@Illinois.gov mailto:DoIT.GeneralCounsel@Illinois.gov

Kyndryl and State of Illinois 10/4/2024

Kyndryl Hosted Mainframe Services Statement of Work for Client Company

1.0 Introduction

This Kyndryl Hosting Services Statement of Work (“SOW”), describes a set of hosting and related services (“Services”) Kyndryl Inc. (“Kyndryl”) will provide to the State of Illinois (“Customer” or “Client”) as ordered under Illinois Basic Ordering Agreement (the “BOA”) # R-285332 to which this SOW must be attached. This SOW shall be governed by the NASPO ValuePoint Master Agreement Terms and Conditions (Contract # AR3710) executed June 30, 2021 (“NASPO Agreement”) and the State of Illinois Participating Addendum P-68380 (“PA”) between Kyndryl Inc. and the State of Illinois executed on or about June 7, 2024 (“PA” and with the NASPO Agreement, collectively the “Agreement”), sets forth the complete terms and conditions under which Kyndryl will provide hosting and related services (“Services”) to Customer (“Agreement”).

This SOW includes the following attachments:

Schedule A – Kyndryl Hosted Mainframe Services.

Attachment A – Hosting Base Components and Maintenance Schedule Attachment B – Hosting Charges, Contractual Baselines and Rates Attachment C – Customer Components Attachment D – Service Level Objectives Attachment E -- Additional Security Requirements

In the event of a conflict between the SOW and an attachment listed herein the SOW will prevail, except where the attachment expressly states that it will prevail over the SOW.

2.0 Definitions

a. “Affiliates” means entities that control, are controlled by, or are under common control with Kyndryl.

b. “Base Components” means the hardware and software that Kyndryl makes available, if any, as specified as a

Base Component in a Schedule.

c. “Burstable Bandwidth” means the bandwidth consumption in excess of the Committed Bandwidth.

d. “Committed Bandwidth” means the fixed circuit capacity that Kyndryl will make available to Customer for connectivity to the Internet.

e. “Content” consists of all data, software, and information that Client or its authorized users provides, authorizes access to, or inputs to the Services.

f. “Content Administrator” means an employee of Customer who is authorized by Customer to install, upload and/or maintain Content using a User Identification.

g. “Customer” has the meaning set forth in Section 1.0 above.

h. “Customer Components” means the hardware, software and other products, data, and Content that Customer provides, including those specified in a Schedule.

i. “Customer Initiated Changes” means patches or changes to the environment dictated to be installed by

Customer and installed by either Customer or by Kyndryl.

j. “Customer Production Ready Date” or “CPRD” means the date (following the Hosting Service Ready Date) that the following items have been completed: (1) Customer has notified Kyndryl that Customer has completed application testing and loading of Customer Content, and (2) Kyndryl has notified Customer that monitoring, and reporting have been enabled and end users may now begin using the Services. Commencing on the Customer Production Ready Date, Customer will not have administrative access for fully managed devices, unless specifically requested for a limited period of time mutually agreed between the parties, using the established change management procedures.

k. “Hosting Environment” or “Private Cloud Hosting Environment” or “Mainframe Hosting Environment” each means (on an interchangeable basis) –– the mainframe Servers and the associated hardware and software, which are used to host Customer’s mainframe LPARs within the Hosting. The Hosting Environment includes, but is not limited to the mainframe Servers, FICON Directors, OSA network cards, storage hardware, Hosting Software Products, and tape controllers.

l. “Hosting Service Ready Date” means a date when Kyndryl notifies Customer that Services are available for Customer use, Kyndryl installation responsibilities have been completed for such Services, and the installation has been accepted by the Customer within a time period agreed to by Kyndryl and the Customer. Customer will be part of the installation process and will have the opportunity to accept the Kyndryl date or suggest additional changes that may be required to the configuration of the Hosting Environment. Services may be initiated in stages and monthly recurring charges will begin for any portion of Services specified in such notification and accepted by Customer.

m. “Key Person” means the Kyndryl Project Manager.

n. “Kyndryl Hosting Center” means a facility used by Kyndryl to provide Services.

o. “Internet” means the public worldwide network of TCP/IP-based networks.

p. “Materials” means literary or other works of authorship (such as programs, program listings, programming tools, documentation, reports, drawings, and similar works) that Kyndryl may deliver to Customer as part of Services.

“Materials” does not include licensed program products available under their own license agreements or Base Components.

q. “Middleware” means any programming that serves to “glue together” or mediate between two separate and often already existing programs. A common application of middleware is to allow programs written for access to a particular database to access other databases. The systematic tying together of disparate applications, often through the use of middleware, is known as “Application Integration.”

r. “Operational Assistance” means the additional operational and physical assistance Services provided by Kyndryl.

s. “Operational Events” means the activities related to physical operations of an unmanaged Customer environment. These activities can include:

1. Device reboot or restart

2. Changing a tape

3. Changing a CD or a disk floppy

4. Preparing tapes for sending them offsite

5. Vendor management for hardware repair or replacement

6. Other types of events with the prior approval of the Kyndryl PM

t. “Operating System” or “OS” means the master control program (for example, zOS or VSE) that manages a computer’s internal functions and provides a means of control to the computer’s operations and file system.

u. “OS Image” means the initial binary image that a boot loader loads into memory and transfers control to start an operating system. The OS image is typically an executable containing the operating system kernel.

v. “OS Instance” means an occurrence of the OS Image.

w. “Remote Services” are Services Kyndryl provides via a network to support or manage Client’s on-premises and cloud computing environments.

x. “Required Consents” means any consents or approvals required to give Kyndryl and its Subcontractors the right or license to access, use and/or modify in electronic form and in other forms, including derivative works, the Customer Components, without infringing the ownership or intellectual property rights of the providers, licensors, or owners of such Customer Components.

y. “Services Recipients” means any external agents of Customer accessing the Hosted Environment or otherwise receiving or using the Services and any other entities or individuals which are authorized to receive or use, and are receiving or using, the Services, or the results of products of the Services.

z. “System Administration” means day-to-day routine tasks performed in a production environment by a system administrator. This does not include, re-carving storage sub-systems, re-building enterprise class systems, major upgrades to the environment, major security services, database administration, application development, systems integration, or extensive performance tuning responsibilities.

aa. “Subcontractor” means a contractor, vendor, agent, or consultant selected and retained by Kyndryl.

bb. “TCP/IP” means Transmission Control Protocol/Internet Protocol.

cc. “Time and Materials (T&M)” means the additional operational, systems administrative and technical, physical, and logical assistance Services provided by Kyndryl that are not included with the services set forth in a Schedule.

dd. “User Identification” or “User ID” means a string of characters that uniquely identifies a Content Administrator.

ee. “Virtual Local Area Network (VLAN)” means a logical grouping of two or more devices which are not necessarily on the same physical network segment, but which share the same network segment.

ff. “Virtual Private Network (VPN)” means a private network that uses a public network (usually the Internet) to connect remote sites or users together.

3.0 Kyndryl Responsibilities

3.1 Kyndryl Services

Kyndryl will perform the Services described in this SOW and the applicable Schedule and Attachments.

3.2 Kyndryl Project Manager

Kyndryl will designate an Kyndryl Project Manager (“PM”) to whom Customer will address communications specific to the provision of the Services provided under this SOW. An Kyndryl PM will be associated through the life cycle of this project. The Kyndryl PM will:

• Be responsible for service delivery and customer satisfaction;

• Coordinate ongoing account status calls;

• Coordinate monthly Change Advisory Board meetings;

• Review monthly reports;

• Review open incidents;

• Review service levels;

• Review client satisfaction;

• Review monitoring/utilization statistics;

• Review recommendations for improvement/new technology;

• Address any billing questions;

• Coordinate all identified tasks/and the required resources;

• Ensure incidents and requests are addressed; and

• Assist client with future systems planning.

4.0 Term and Termination

4.1 Term

The terms in this SOW will effectively begin ( “ E f f e c t i v e D a t e ” ) and end as indicated in the State’s BOA # R- 285332. The one-time-charges (OTC) will be invoiced upon signature of the BOA and monthly recurring charges will be invoiced on the first of the month with the starting month as noted in the Effective Date. The charges are outlined in section B-2 of Attachment B assuming the Effective Date to be October 1, 2025. Termination may be earlier if in accordance with the terms of the Agreement. The parties anticipate that the Hosting Service Ready Date estimated to be up to three months after the Effective Date.

4.2 Additional Provisions

a. Where a cloud platform is provided as part of a Remote Service, Client may terminate the affected cloud platform on 30 days’ notice: i) at the written recommendation of a government or regulatory agency following a change in either applicable law or the cloud platform; ii) if a change to the affected cloud platform causes Client to be noncompliant with applicable laws; iii) if Kyndryl notifies Client of a change to the affected cloud platform that has a material adverse effect on Client's use of such Remote Service, provided that Kyndryl will have 90 days to work with Client to minimize such effect including the transition of Client to another service; or iv) upon notice of withdrawal of a service provided within the cloud platform.

4.3 Post-Termination Return and Erasure of Content

Following expiration or termination of the SOW or the Agreement for any reason (including termination for breach by Customer), Kyndryl shall permit Customer to download a complete copy of all Content in the possession of Kyndryl for a period of thirty (30) days after such expiration or termination. Promptly after the expiration of such period, Kyndryl shall erase all Content of Customer held by Kyndryl.

5.0 Charges and Payment

Invoicing and related payments, including late payment charges, shall be governed by the Agreement. Kyndryl invoices will specify the amount due in accordance with this section. Anticipated fees are listed in Attachment B.

6.0 Warranties and Disclaimers

6.1 Kyndryl Representations and Warranties

Kyndryl warrants that it provides Services using commercially reasonable care and skill and as described in this SOW, including any completion criteria, Project Materials will comply with this SOW at the time of delivery. The warranty for a Service ends when the Service ends.

6.2 Exclusivity of Warranties

These warranties and those provided under the Agreement are the exclusive warranties from Kyndryl, and disclaims all other warranties, including the implied warranties of merchantability, and fitness for a particular purpose.

6.3 Security

6.3.1 While Kyndryl endeavors to provide security measures to keep all data secure, Kyndryl does not warrant Kyndryl can prevent all third-party disruptions to or all unauthorized third-party access to the Services.

Notwithstanding Kyndryl will perform its obligations specified in the Agreement with respect to the encryption and other security measures to be undertaken by Kyndryl as specified in the Agreement.

6.4 Other Disclaimers

Kyndryl does not operate as a provider of services regulated by the Federal Communications Commission (FCC) or state regulatory authorities (State Regulators) and does not intend to provide any services which are regulated by the FCC or State Regulators. If the FCC or any State Regulator imposes regulatory requirements or obligations on any Services provided by Kyndryl hereunder, this shall be considered a change in law, regulation, or similar governmental action that will be subject to Section 13.1 and Section 13.3, except that Kyndryl may additionally suspend services to the extent necessary to avoid being subject to regulatory penalties, fines, or fees. If the Parties are unable to reach mutual agreement on a Replacement SOW within 30 days, the Parties mutually agree to terminate this SOW.

7.0 Reserved

8.0 Reserved

9.0 Reserved

10.0 Reserved

11.0 Dependencies

11.1 Customer Contact

Customer will designate an individual to whom all of Kyndryl’s communications will be addressed and who has the authority to act and make decisions for Customer in all aspects of the Services, including requesting changes, problem resolution, Service requests, assignment of Customer focal points with authority over specific Services, and designation of customer authorized representative (“Customer Authorized Contact”).

11.2 Services Support

Kyndryl’s ability to provide the Services is contingent upon Customer working in good faith to support the Services as specified in this SOW and its attachments.

11.3 Reserved

11.4 Suspected Violations

Kyndryl may conduct its own investigation into potential violations of the Acceptable Use Policy in Section 13.2 at no cost to Customer. If a breach of the Acceptable Use Policy has occurred then Kyndryl may, in its sole discretion:

1. Suspend or restrict Customer’s access to the Services; and/or

2. remove or require removal of any offending Content.

Except in an emergency or as may otherwise be required by law, before undertaking the activities in Subsection 11.4(1) or 11.4(2), Kyndryl will attempt to notify Customer by any reasonably practical means under the circumstances, such as, without limitation, by telephone or e-mail, and if the cause of a suspension can be remedied, provide notice of the actions Customer must take to reinstate the Services.

11.5 Customer Components

1. Customer (or its Affiliates or third parties) retains all right, title, and interest or license in and to the Customer

Components.

2. Kyndryl’s performance of the Services is dependent upon Customer having in place all rights and licenses to all Customer Components necessary for Kyndryl to perform all of its obligations as set forth in this SOW.

Customer agrees and acknowledges that Kyndryl’s performance may be delayed in the event such rights and licenses are not in place, and extended delays may jeopardize successful provision of Services under this SOW.

In the event a Party believes that delays will prevent successful provision of services, the Parties will meet to address the issue and may engage in the PCR process under Section 13.3. Kyndryl will adhere to reasonable terms and conditions pertaining to Customer Components as notified in writing to Kyndryl.

3. Kyndryl agrees not to remove or alter any copyright or other proprietary notice on or in any Customer Component without Customer’s consent.

11.6 Capacity Planning

Customer agrees and acknowledges that it will determine whether the Services, Hosting Environment, Customer Components and their combination will meet Customer’s capacity, performance, or scalability needs. Customer will plan for and request changes to the Hosting Environment, including any additional capacity required to support anticipated peaks in demand that may significantly increase web site hits, transaction volumes, or otherwise increase system resource utilization pursuant to the PCR process in Section 13.3.

11.7 Content

Kyndryl is not responsible for:

1. any Content including, without limitation, its selection, creation, encryption, transmission, transfer, design, licensing, installation, accuracy, maintenance, testing, backup, and support;

2. any copyright, patent and trademark clearances in all applicable jurisdictions and usage agreements for any and all Content;

3. the selection and implementation of controls on the access and use of Content; and

4. the selection, management, separate storage of keys, and use of any public and private keys and digital certificates held by Customer that Customer may use with the Services.

12.0 Other License and Rights

12.1 License for Base Components

1. Kyndryl (or its Affiliates or subcontractors) retains all right, title, and interest in Base Components.

2. Kyndryl grants Customer a nonexclusive, nontransferable, revocable license to access and use the Base

Components solely in connection with the Services as provided under this SOW. Customer agrees not to download or otherwise copy, reverse assemble, reverse compile, decompile, or otherwise translate the software portions of the Base Components, other than to make one copy for backup purposes.

3. Customer agrees not to remove or alter any copyright or other proprietary notice on or in any Base Component without Kyndryl’s consent.

12.2 No Sale or Lease of Goods

As between Customer and Kyndryl, Kyndryl retains all right, title and interest in the Base Components. No goods are sold or leased by Kyndryl under this SOW.

12.3 No Lease of Real Property

This SOW is a services SOW and not a lease of any real property.

13.0 Changes

13.1 Service Description

Kyndryl shall not provide Services in violation of any applicable law, rules, regulation, order or rule of a court of competent jurisdiction, or similar governmental action which applies to Kyndryl as a technology services provider.

In the event an applicable law, regulation, ruling by a court of competent jurisdiction, or a similar governmental action renders provision of the Services noncompliant or unlawful, the Parties will meet and will work in good faith to resolve the issue and may further, upon mutual agreement and thirty (30) days prior notice to Customer, engage in the PCR process under Section 13.3. Kyndryl may suspend Services to the extent necessary to avoid violating an applicable law, regulation, ruling by a court of competent jurisdiction, or a similar governmental action until resolved pursuant to the foregoing.

13.2 Acceptable Use Policy

The following acceptable use terms apply for Client's use of the Remote Services where a cloud platform is used as part of the infrastructure. Remote Services may not knowingly be used for unlawful, harmful, obscene, offensive or fraudulent Content or activity (“Prohibited Activities”). Examples of Prohibited Activities include: advocating or causing harm, interfering with or violating the integrity or security of a network or system, evading filters, sending unsolicited, abusive or deceptive messages, introducing viruses or harmful code, or violating third party rights (“Acceptable Use Policy”). In the event of a required change to the AUP, Customer and Kyndryl will meet to address the need and may engage in the PCR Process under Section 13.3. If the Parties are unable to agree, Customer may terminate this SOW in accordance with the terms of the PA.

13.3 Project Change Control Procedure

. To better adapt to project needs, skills, and other project-related factors, the project leaders with the State and Provider may mutually agree and approve via e-mail to adjust the number of units allocated within and between each listed line item in Section B-2 of Attachment B, without requiring a project change request, provided such changes do not affect the not-to-exceed value of the BOA. The Parties acknowledge that this SOW may not be amended. Any additional required Services, required changes to Services, required changes to the terms of this SOW, or additional costs or fees shall be subject to prior internal State of Illinois written approvals, the terms and conditions of the Agreement, and the requirements and limitations of applicable laws and regulations, including but not limited to the Illinois Procurement Code (30 ILCS 500) and the Illinois Criminal Code (720 ILCS 5/33E-9). A request for changes (“Project Change Request” or “PCR”) should be submitted in writing by the requesting party.

The PCR should reference this SOW, describe in a reasonable level of detail the proposed change, the rationale for the change, and the impact the proposed change may have on the SOW. The parties will review the PCR and agree to meet, confer, and work together in good faith to effectuate an outcome in response to the PCR which may include but is not limited to a mutually agreed upon supplemental SOW and/or a replacement SOW subject to requirements and limitations of applicable laws and regulations, including but not limited to the Illinois Procurement Code (30 ILCS 500) and the Illinois Criminal Code (720 ILCS 5/33E-9). In the event the PCR is rejected, the rejecting party will inform the requesting party of the reason for the rejection.

13.4 Changes and Withdrawal of Standard Services

a. Kyndryl reserves the right to take action at its discretion, as the situation requires; Kyndryl may: i) make available additional features and functionality; ii) improve and clarify existing commitments; or iii) maintain alignment to current adopted operational and security standards or applicable laws to the extent such changes do not degrade the security or functionality the Services.

b. Changes will be effective when published or on the specified effective date.

14.0 General

14.1 Headings

The headings of the various sections of this SOW have been inserted for convenience only and shall not affect the interpretation of this SOW.

14.2 Publicity and Trademarks

Neither party grants the other the right to use its or any of its Affiliates’ trademarks, trade names, or other designations in any promotion, publication, or Web site without prior written consent.

14.3 Personnel

Each party is responsible for the supervision, direction, and control of its respective personnel. Kyndryl reserves the right to determine the assignment of its personnel. Kyndryl may subcontract portions of the Services subject to the terms of the Agreement.

14.4 Independent Contractor

Kyndryl is acting as an information technology provider only. Kyndryl’s direction, suggested usage, guidance or Client’s use of Services does not constitute medical, clinical, legal, or accounting advice.

14.5 Business Contact Information

Kyndryl, its affiliates, and contractors of either require use of business contact information and certain account usage information. This information is not Content. Business contact information is used to communicate and manage business dealings with the Client. Examples of business contact information include name, business telephone, address, email, user ID and, and tax registration information. Account usage information is required to enable, provide, manage, support, administer, and improve Services. Examples of account usage information include information related to diagnostics, configurations, capacities, components, system health and performance, and digital information gathered using tracking technologies, such as cookies and web beacons. The Kyndryl Privacy Statement at https://www.Kyndryl.com/privacy/ provides additional details with respect to Kyndryl's collection, use, and handling of business contact and account usage information. For the avoidance of doubt, information provided via hyperlinks is not intended to impose legal obligations on the State. To the extent any aforementioned information to impose any legal obligations on the State, such language is not binding on or applicable to the State; in no instance shall this clause constitute a waiver of the Parties’ obligations described in this Agreement. When Client provides information to Kyndryl and notice to, or consent by, the individuals is required for such processing, Client will notify individuals and obtain consent.

14.6 Content and Data Protection

a. Content consists of all data, software, and information that Client or its authorized users provides, authorizes access to, or inputs to Services. Providing or authorizing access to Content or Client's use of Services will not affect Client's ownership or license rights in such Content. Kyndryl, its affiliates, and contractors of either will access and use the Content solely for the purpose of providing and managing the applicable Services. Kyndryl will treat all Content as confidential by not disclosing Content except to Kyndryl employees and contractors, and only to the extent necessary to deliver the Services.

b. Client has necessary rights and permissions to enable Kyndryl, its affiliates, and contractors to use, provide, store and otherwise process Content, or access and use Client’s systems and other computing environments, in connection with the Services.

c. In accordance Section 5.14 of the PA, the State of Illinois, a sovereign entity within the United States, operates outside the scope of the General Data Protection Regulation (GDPR) and therefore none of the data it processes or hosts will ever be subject to GDPR regulations.

d. Client will not provide Kyndryl or authorize Kyndryl to access to Content containing any individual’s information, including personal or other regulated data in such Content unless it has taken required action(s) under applicable laws and regulations, including but not limited to data privacy laws, that regulate the Content. Client is responsible for adequate backup of Content unless this SOW specifies that Kyndryl will provide. Client will not provide or allow access to Content that could be subject to governmental regulation or may require security measures beyond those specified by Kyndryl for the Services, unless specifically permitted in the terms of this SOW or unless Kyndryl has otherwise first agreed in writing to implement additional security and other measures.

e. Kyndryl Data Security and Privacy Principles (DSP), at https://kyndryl.com/terms/dsp, apply for generally available standard Services as identified in this SOW. For the avoidance of doubt, information provided via hyperlinks is not intended to impose legal obligations on the State. To the extent any aforementioned information would impose any legal obligations on the State, such language is not binding on or applicable to the State; in no instance shall this clause constitute a waiver of the Parties’ obligations described in this Agreement. At Kyndryl's discretion, Kyndryl may change the DSP from time to time and the change will be effective when published or on the specified effective date. The intent of any change will be to improve and clarify existing commitments and maintain alignment to current adopted operational and security standards or applicable laws. The intent is not to degrade the security or functionality. In addition to the DSP, any specific security features and functions of a Remote Service will be described in this SOW. Client is responsible for selecting, enabling, or using available data protection features appropriate to support Client's use of Services.

http://www.kyndryl.com/privacy/ https://kyndryl.com/terms/dsp

Client is responsible for assessing the suitability of the Services for the Content and Client's intended use or the use of Content with Services Kyndryl will provide. Client acknowledges that the use of Services meets Client's requirements and processing instructions required to comply with applicable laws.

If Kyndryl stores any Content on Kyndryl computing resources, Kyndryl will return or remove Content from Kyndryl computing resources upon the expiration or cancellation of the Services, or earlier upon Client's request. Kyndryl does not archive Content; however, some Content may remain in backup files until expiration of such files as governed by Kyndryl's backup retention practices.

By signing below, Customer and Kyndryl agree that this SOW, including these Base Terms and Schedules, is the complete agreement between the parties relating to this subject matter. Once signed, 1) any reproduction of this SOW or a Schedule made by reliable means (for example, photocopy or facsimile) is considered an original and 2) all Services ordered under this SOW are subject to it.

Agreed and Accepted:

Customer Identification Number: State Of Illinois, DoIT Kyndryl, Inc.

1 Vanderbilt Avenue New York, NY 10017

By: By:

Customer Authorized Signature Authorized Signature

____________________________________________ Pavan Potharazu Name (type or print): Name (type or print):

Customer Partner_______________________ Title Title

Agreement name: NASPO Value Point Master Agreement Terms and Conditions (Contract # AR3710) executed June 30, 2021 and the Participating Addendum executed June 7, 2024.

Agreement number:

Kyndryl Hosted Mainframe Services SOW number:

Contract support:

Pavan Potharazu pavan.potharazu@kyndryl.com

After signing, please return a copy of this SOW to the Kyndryl or partner sales representative listed above.

Brandon Ragle

Acting Secretary, State CIO

Reviewed as to legal clause sufficiency – BPW 9/11/2025 mailto:pavan.potharazu@kyndryl.com

Schedule A – Kyndryl Hosted Mainframe Services

1. Definitions

a. “Alternate Server” means –– the Server within the Hosting Environment which has been assigned to host a

Customer LPAR during Disaster Recovery.

b. “Assigned Resource Units” means –– the number of Resource Units assigned to Customer.

c. “Base Component” has the meaning set forth in the SOW.

d. “Cap” means –– a Server or LPAR capacity limit (Hard Cap) that is established for the Customer environment.

e. “Change Management Process” means –– the process agreed to by the parties in the SOW for handling changes to the Services.

f. “Customer Component” has the meaning set forth in the SOW.

g. “DASD” means –– Direct access storage device or disk storage.

h. “Disaster Recovery LPAR” means –– an inactive LPAR on an Alternate Server within the Hosting Environment at the Secondary Site that is initiated at the declaration of a disaster recovery event or for testing purposes, with an identical configuration to the Standard LPAR which can host the workload normally running on the Standard

LPAR.

i. “Forecasted Monthly Usage” means –– a twelve (12) month rolling forecast of anticipated Resource Units provided by Customer to assist Kyndryl with capacity planning.

j. “Gigabytes or GB” means –– 1,000,000,000 bytes of data.

k. “Global Mirror” means –– a type of disk storage data replication described in Section 2.3.2 of this Schedule.

l. “ISV” means –– the independent software vendor for software products which are licensed for use by Customer within its assigned LPAR(s).

m. “Large System Performance Reference (LSPR)” means –– the set of relative performance indicators for System z published by IBM.

n. “LPAR” means –– a logical partition of the mainframe in which physical resources are assigned and a unique instance of the operating system is installed.

o. “MIPS” means –– millions of instructions per second and is a standard measure of capacity for mainframes.

Each System z server model will have a stated MIPS rating.

p. “MSU” means –– millions of service units and is a capacity measurement used for licensing software by some vendors including IBM. IBM defines the ratio between MSU and MIPS. This ratio varies between processor families and models. Each System z server model will have a stated MSU rating.

q. “Primary Server” means –– the Server within the Hosting Environment which has been assigned to host a Customer LPAR(s) during normal operation.

r. “Primary Site” means –– the Kyndryl Delivery Partner Data Center hosting the Customer Primary Server.

s. “Reduced Resource Credit (“RRC”) means –– the credit, as set forth in Attachment B (Hosting Charges, Contractual Baselines and Rates), to Customer if Assigned Resource Units are below the applicable Hosting Contractual Baseline.

t. “Resource Unit or (RU)” means –– units of resource for which Kyndryl and Customer have established a Hosting Contractual Baseline.

u. “Secondary Site” means –– an Kyndryl Delivery Partner Data Center that is geographically separate from the Primary Site from which Hosting services may also be provided.

v. “Server” means –– the physical processor and processor components that are in the Hosting Environment.

w. “Service Build” means –– the activities to be performed by Kyndryl and Customer described in Section 3.2 of this Schedule.

x. “Short Term Resource Flex Up Rate” means –– the MIPS rate specified in Attachment B (Hosting Charges, Contractual Baselines and Rates) for short term increases to MIPS.

y. “Software Stack” means –– the software available and listed in Section B-2 of Attachment B, (Hosting Charges, Contractual Baselines and Rates).

z. “Standard Disk” means –– a type of disk in which Customer data will reside in a storage sub-system connected to the Hosting with no mirroring.

aa. “Standard LPAR” means –– an LPAR that is hosted on a single Server within the Hosting Environment.

bb. “Standard Tape” means –– a physical tape in a single shared automated tape library.

cc. “Sub Capacity Licensing Agreement” means –– means the licensor of a software product agrees that a subset of the Server’s overall capacity can be a valid measure of the capacity upon which such software is licensed.

dd. “Virtual Network Addressing” means –– network definitions automatically detect an application’s location within the Hosting Environment.

ee. “Hosting” means –– the Kyndryl Managed Services which provides the hardware, software, and management processes upon which the Customer mainframe LPARs will operate.

ff. “Hosting Contractual Baseline” means –– the quantity of Hosting Resource Units assigned to Customer utilized for calculating charges as set forth in Attachment B, (Hosting Charges, Contractual Baselines and Rates).

gg. “Hosting Custom Software” means –– the IBM or Independent Software Vendor (ISV) software products which are licensed as customer-specific for use by Customer for operation within its assigned LPARs.

hh. “Hosting Disk Storage Service” Type means –– the type of disk storage available to Customer described in Section 2.3 of this Schedule.

ii. “Hosting Hardware Levels” means –– the provided hardware levels of the Base Components as published in the Hosting Service Plan as described in Section 3.2.

jj. “Hosting LPAR Service Type(s)” means –– the type of LPARs described in Section 2.2 of this Schedule.

kk. “Hosting Maintenance Schedule” means –– the schedule of Hosting Maintenance Window.

ll. “Hosting Maintenance Window” means –– the period(s) of time and date(s) upon which one or more Servers in the Hosting Environment will undergo hardware maintenance which may result in Hosting Service Outages for Customer standard LPAR(s).

mm. “Hosting Server Outage” means –– that period of time being the duration of a planned Hosting Maintenance Window or an unscheduled failure of a Server within the Hosting Environment hosting any Customer LPAR.

nn. “Hosting Service Criteria” means –– those Service Criteria which must be continuously met in order for Customer’s systems to be eligible to reside on a Hosting Environment, as more fully described in the Hosting Service Plan.

oo. “Hosting Service Hours” means –– the hours of normal operations as defined in the Hosting Service Plan.

pp. “Hosting Service Plan” means –– the document defined in Section 3.2 of this Schedule.

qq. “Hosting Software Levels” means –– the permitted software levels of the Hosting Software Products as published in the Hosting Service Plan described in Section 3.2.

rr. “Hosting Software Product” means –– a software product centrally licensed as part of the Hosting service.

Kyndryl and Customer will agree to and document the level (version, release, and modification) as described in Section 3.3 to which Customer LPARs hosted on the Hosting service must be maintained.

ss. “Hosting Storage Outage” means –– the duration of a planned Hosting Maintenance Window or an unscheduled failure of a storage device within the Hosting Environment holding the data for any Customer LPAR.

tt. “Hosting Tape Service Types” means – the type of tape services described in Section 2.4 of this Schedule.

2. General Services

2.1 Introduction

The following sections include the specific terms and conditions for the provision of Mainframe as a Service.

These terms and conditions include Kyndryl and Customer rights and responsibilities. Kyndryl’s performance is dependent upon Customer’s fulfillment of its responsibilities at no charge to Kyndryl. Any delay in performance of Customer’s responsibilities may result in additional charges and/or delay of the completion of Services and will be handled in accordance with the Project Change Control Procedure.

2.2 Scope - Hosting LPAR Service Types

Kyndryl will provide Hosting LPAR Service Types to Customer as set forth in Attachment B, (Hosting Charges, Contractual Baselines and Rates).

Changes in the Hosting Service Type assigned to an LPAR will be handled in accordance with the Change Management Process.

Each Customer LPAR may be assigned to a specific named Server within the Hosting Environment (the “Primary Server”). Kyndryl reserves the right to change the Primary Server via the Change Management Process. Kyndryl will provide the customer with a timely written notification related to all changes that affect the process of providing the services to the customer. .

2.2.1 Standard LPAR

A Standard LPAR is the Hosting Service Type in which the Customer workload is hosted on a single Server within the Hosting Environment for which there is no alternate server to run the workload during a Hosting Server Outage.

In the event of a Hosting Server Outage on the Server hosting a Customer Standard LPAR that LPAR will be unavailable until the event has completed.

For each Standard LPAR Kyndryl will perform Service Build activities described in Section 3.1 below to create a Standard LPAR on the Primary Server to meet Customer’s Hosting Contractual Baseline MIPS set forth in Attachment B; (Hosting Charges, Contractual Baselines and Rates).

2.3 Scope - Hosting Disk Storage Service Types

Kyndryl will provide Hosting Disk Storage Service Types available to Customer according to the Hosting Contractual Baselines as set forth in Attachment B, (Hosting Charges, Contractual Baselines and Rates).

Changes in the Hosting Disk Storage Service Types will be handled in accordance with the Change Management Process. The following Hosting Disk Storage Service Types are available to Customer:

2.3.1 Standard Disk

Standard Disk is the Hosting Disk Service Type in which the Customer data will reside in a storage sub-system(s) connected to the Hosting via fiber connection (“FICON”) with no mirroring.

Hardware based data encryption will be included if specified in Attachment A.

In the event of a Hosting Storage Outage on the disk sub-systems hosting Customer’s Standard Disk allocation, the data on those disk sub-systems will be unavailable until service has been restored.

In the case of an unplanned outage, Customer will, if necessary, recover the data from a back-up copy.

For each Standard Disk footprint Kyndryl will perform the activities described in the Service Build Section

3.1 below to create a Standard Disk allocation on the primary disk sub-system to meet Customer’s Hosting Contractual Baselines for Gigabytes as set forth in the Attachment B, (Hosting Charges, Contractual Baselines and Rates).

2.3.2 Global Mirror

Kyndryl will provide global mirror processing that provides a remote copy solution from the Primary Site to the Secondary Site by using asynchronous technology. With Global Mirror, the data at the Secondary Site is maintained to be a point-in-time consistent copy of the data at the Primary Site.

2.4 Scope - Hosting Tape Service Types

Kyndryl will provide Hosting Tape Services to Customer as per the Hosting Contractual Baselines set forth in Attachment B, (Hosting Charges, Contractual Baselines and Rates). Changes to the Hosting Tape Service Type will be handled in accordance with the Change Management Process. The following Hosting Tape Service Types are available to Customer.

3. Preparing Hosting Infrastructure for Customer

3.1 Service Build

Service Build is the process of preparing the Hosting Environment to create Customer LPARs.

a. Kyndryl will:

(1) assign a project manager to manage the transition of Customer into the Hosting Environment;

(2) setup calls and meetings as needed with Customer representatives to gather and verify system specifications;

(3) create new LPARs, configure storage, install any Base Component as listed in Attachment A, (Hosting Base Components and Maintenance Schedule) and set forth in the Hosting technical solution design document;

(4) customize hardware configuration for the Customer LPAR(s);

(5) perform data migration via method described in Attachment A;

(6) perform handover to Customer for Customer to perform further content load activities and the operations, administration, and management of the LPARs; and

(7) provide IPL assistance via the HMC.

b. Customer will:

(1) assign Customer key contact for Hosting transition. This person will serve as main Customer contact for Kyndryl to work project schedule, questions, and issues;

(2) review and assist Kyndryl as needed with the build of the Customer Hosting LPARs and storage configurations;

(3) approve the Hosting configuration and deployment;

(4) configure unique Customer application parameters of Customer Components;

(5) deliver any Customer Components as outlined in Attachment C, (Customer Components) to

Kyndryl;

(6) confirm Customer has the license rights for Customer Components prior to delivery to Kyndryl;

and

(7) for all ISV software for which Customer is the licensee:

(a) Customer is responsible to confirm that Customer license to use such ISV software allows for Sub Capacity Licensing;

(b) Customer is responsible to confirm that the license to use such ISV software is hardware characteristic (e.g. serial number, software model type) agnostic permitting use on any of the Servers within the Hosting Environment, and charging is based on the sum of MIPS required across all Customer LPARs in the Hosting Environment including;

(c) Customer is responsible to confirm that the software authorization process to use such ISV software is not dependent on keys or other mechanisms that are dependent on hardware specific information such as hardware model, software model or serial number.

Where this is not possible and software keys containing hardware specific information are required to execute ISV software, make available to Kyndryl at all times, keys for each of the Servers in the Hosting Environment;

(d) define, install, and validate the operation of Customer Components; and

(e) perform operational and application functional testing.

(f) Customer will continue to be responsible to meet the conditions and requirements for their

ISV licenses and IBM licenses not included as supplied by the Kyndryl hosting service within this contract.

(8) All Customer’s responsibilities of this section are contingent upon the reasonable cooperation and support of Kyndryl where applicable.

3.2 Hosting Service Plan

The Hosting Service Plan is a document that is agreed to by the Customer and Kyndryl and maintained by Kyndryl which defines:

1. the supported Hosting Hardware Levels;

2. the supported Hosting Software Levels;

3. the current Hosting Maintenance Schedule;

4. the Hosting Service Criteria; and

5. The Hosting Hardware Levels, Software Levels and Maintenance Schedule current at the time of this

SOW are listed in Attachment A, (Hosting Base Components and Maintenance Schedule).

3.3 Hosting Service Tasks

The Hosting Environment is a shared information technology computing environment. This section outlines the tasks Kyndryl, and Customer will perform as it relates to general services in the Hosting Environment.

3.3.1 Kyndryl Responsibilities

To maintain consistent service delivery for all Hosting users Kyndryl will:

1. manage the Hosting Environment;

2. provide, operate, maintain, and support the Base Components as listed in Attachment A; (Hosting Base Components and Maintenance Schedule) as defined in the Hosting Service Plan;

3. provide no less than three (3) months written notice to Customer of any changes to the Hosting Service Plan;

4. provide reasonable prior notice to Customer of any change to the Servers in the Hosting Environment which are likely to require new or replacement software keys;

5. publish and be responsible for managing changes to the Hosting Maintenance Schedule as defined by Kyndryl in the Hosting Service Plan;

6. Kyndryl will support connected devices, as identified in Attachment A;

7. reserve the right to use the hardware within the Hosting Environment, in the sole discretion of Kyndryl, to host LPARs which are owned and used by Kyndryl, or by other…