PrePass+-ND-+Amendment+1+-+FINAL+-+SIGNED.pdf

CONTRACT AMENDMENT

CONTRACT NAME AND NUMBER: 044 - Commercial Vehicle Screening

AMENDMENT NUMBER: 1

This amendment is made to 044 - Commercial Vehicle Screening (Contract) between the State of North Dakota, acting through its Office of Management & Budget, State Procurement Office (STATE), and PrePass Safety Alliance, formerly known as Heavy-vehicle Electronic License Plate, Inc.

(CONTRACTOR).

The parties agree to the following terms and conditions and expressly agree that if any of the following terms and conditions conflict with any of the terms and conditions of the Contract, then, notwithstanding any term in the Contract, the following terms and conditions govern and control the rights and obligations of the parties.

The parties agree to amend the Contract as follows:

Renewal and Extensions Contract Section 7, Term of Contract. The Contract commenced on March 31, 2023 for a period of two

(2) years through March 31, 2025 with three (3) options to renew the Contract for twenty-four (24) months each and an option to extend the Contract for up to twelve (12) months.

The parties have agreed to renew the Contract for an additional twenty-four (24) months; therefore, the Contract is amended to change the expiration date to March 31, 2027. The Contract has two (2) renewals remaining. The Contract can be extended for an additional twelve (12) months.

Software as a Service (SAAS) and Service Level Agreement (SLA) Contract Section 28.B, Software as a Service (SAAS) and Service Level Agreement (SLA). This section is hereby deleted in its entirety and replaced with the following:

28.B. SOFTWARE AS A SERVICE (SAAS) AND SERVICE LEVEL AGREEMENT (SLA)

CONTRACTOR represents and warrants that the subscription services (including software/hardware updates and technical support services for the subscription services pursuant to this Contract commencing at the end of the warranty period) will be performed in a professional manner consistent with industry standards reasonably applicable to such services.

The CONTRACTOR system is a closed loop system which does not interface with or access State networks or State Data.

A. SAAS AVAILABILITY:

The SaaS shall be available at least 99% of the time in any given month during the term and any renewal term, (excluding scheduled maintenance, non- operating hours of any State facility or site supporting this Contract, or other matters beyond the reasonable control of CONTRACTOR) Default”). For purposes of this Contract, “Available” means that STATE users are able to access all features and functions of the licensed product and services including, but not limited to the licensed software and licensed content.

B. RESPONSE TIME SERVICE LEVEL:

CONTRACTOR represents and warrants that ninety-five percent (95%) of all transactions shall process at a mutually agreed upon time threshold. STATE retains right to use a Third-Party service to validate the performance of CONTRACTOR’s response times.

C. SCHEDULED MAINTENANCE AND NOTIFICATIONS

a) Standard Maintenance Windows

The SaaS maintenance window (reboots) occurs every Tuesday at 3 AM (weekly). A reminder will prompt five (5) minutes prior to a system reboot.

System reboots take 5 - 10 minutes on average to complete (system downtime).

b) Notification of Scheduled Maintenance Downtime CONTRACTOR shall provide 48 hours advance notice to the STATE of any scheduled maintenance downtime which will cause the total scheduled maintenance downtime for the month to exceed four (4) hours or will occur outside of the Standard Maintenance Windows outlined above. In cases of emergency, CONTRACTOR shall notify STATE of a planned downtime as soon as practicable.

D. RPO AND RTO

CONTRACTOR commits to use commercially reasonable efforts to maintain an RPO of eight (8) hours and RTO of twenty-four (24) hours as well as the SLA requirements as set forth in Section 28A Software Support – Service Level Requirement.

E. SAAS AND DATA SECURITY:

a) CONTRACTOR shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract as compliant with applicable industry standards, laws, regulations and guidelines.

b) CONTRACTOR shall undergo the third-party security questionnaire on an annual basis at no cost to the STATE, unless CONTRACTOR has received FedRAMP, StateRAMP, or HiTrust certification. CONTRACTOR shall provide completed questionnaire within twenty-one (21) calendar days of receiving a written request. CONTRACTOR shall undergo the third-party security questionnaire when a breach has occurred.

c) CONTRACTOR shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the STATE’s access to its Data.

c) In the event of a Data Breach. CONTRACTOR shall allow the STATE reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect the STATE’s Data, at no cost to the STATE.

d) CONTRACTOR assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by CONTRACTOR other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the STATE. For the avoidance of doubt, the forgoing restrictions relating to Data shall not apply to Contractor Data.

F. ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

G. RIGHTS TO DATA:

The Parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the STATE, and CONTRACTOR has a limited, non-exclusive license to access and use the Data, if necessary, as provided to CONTRACTOR solely for performing its obligations under the Contract. As between the STATE and CONTRACTOR, all right, title and interest to CONTRACTOR Data shall remain with CONTRACTOR.

Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party.

Unauthorized use of Data by CONTRACTOR or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of Data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

H. DATA BACKUP:

a) CONTRACTOR shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by CONTRACTOR of its obligations under this Contract (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) CONTRACTOR shall use appropriate and reliable storage media.

CONTRACTOR shall regularly backup STATE Data and retain such backup copies for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

I. DATA RETENTION SCHEDULE AND DISPOSAL:

a) At the STATE’s election, CONTRACTOR will either securely destroy or transmit to STATE repository any backup copies of STATE Data.

b) CONTRACTOR shall supply STATE a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

c) CONTRACTOR shall retain logs associated with STATE activity for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

J. DATA BREACH:

a) Upon discovery or reasonable belief of any Data Breach, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. CONTRACTOR shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after CONTRACTOR reasonably believes there has been such a Data Breach. To the extent known at the time of notification, CONTRACTOR’s notice shall include:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What CONTRACTOR has done or will do to quarantine and mitigate the

Data Breach; and

5) What corrective action CONTRACTOR has taken or will take to prevent future Data Breaches.

b) CONTRACTOR will provide daily updates, or more frequently if required by the STATE, regarding findings and actions performed by CONTRACTOR until the Data Breach has been effectively resolved to the STATE’s satisfaction.

c) CONTRACTOR shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with SLA set above in this attachment.

Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

d) CONTRACTOR shall conduct an investigation of the Data Breach and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement, as required by law.

K. DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit. CONTRACTOR shall provide such notification within twenty-four (24) hours after CONTRACTOR reasonably believes there has been such a disaster or catastrophic failure. In the notification, CONTRACTOR shall inform the STATE of:

1) The scale and quantity of the Data loss;

2) What CONTRACTOR has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action CONTRACTOR has taken or will take to prevent future Data loss.

4) If CONTRACTOR fails to respond immediately and remedy the failure, the STATE may exercise its options for assessing damages or other remedies under this Contract.

b) CONTRACTOR shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA.

Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

c) CONTRACTOR shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement as required by law.

L. AUDIT AND EXAMINATION:

a) Upon reasonable advance written request, CONTRACTOR agrees that the

STATE or its designated representative (at its cost and expense) shall have access to CONTRACTOR’s SaaS operational documentation, records and databases, including online inspections, that directly relate to the Data Breach.

b) The online inspection shall allow the STATE, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended.

Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the STATE or representatives on behalf of the STATE.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR will, at its expense, have an independent, industry-recognized, STATE-approved third party perform an information security audit.

The audit results shall be shared with the STATE within seven (7) days of CONTRACTOR’s receipt of such results. Upon CONTRACTOR receiving the results of the audit, CONTRACTOR will provide the STATE with written evidence of planned remediation within thirty (30) days and promptly modify its security measures, to the extent necessary, in order to meet its obligations under this Contract.

M. DISCOVERY:

If CONTRACTOR receives a request which may reasonably be interpreted as requiring access to Data or the STATE’s use of the SaaS, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. CONTRACTOR shall provide such notification within forty-eight

(48) hours after CONTRACTOR receives the request. CONTRACTOR shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at CONTRACTOR regarding this Contract without first notifying the STATE unless prohibited by law from providing such notification.

CONTRACTOR agrees to provide, unless prohibited by law from doing so, its intended responses to the STATE with adequate time for the STATE to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction.

CONTRACTOR shall not respond to legal requests directed at the STATE unless authorized in writing to do so by the STATE.

N. SAAS NOTICE:

All notices or other communications required under this exhibit must be provided to the following:

STATE - Agency CONTRACTOR

Jamie Bostyan Mark Doughty

Procurement Coordinator President and CEO

600 E Boulevard Ave, Dept 504 2929 N. Central Ave., Suite 1500

Bismarck, ND 58505-0602 Phoenix, AZ 85012

701.328.5402 602.601.4779 jamie.bostyan@nd.gov mark@prepassalliance.org

STATE – ITD

GRC Team

GRC Team

4201 Normandy Street

Bismarck, ND 58503

701-328-4470 cygrc@nd.gov mailto:jamie.bostyan@nd.gov mailto:cygrc@nd.gov

Nondiscrimination – Compliance with Laws Contract Section 42, Nondiscrimination – Compliance with Laws. This section is hereby deleted in its entirety and replaced with the following:

42. NONDSICRIMINATION – COMPLIANCE WITH LAWS

CONTRACTOR agrees to comply with all applicable federal and state laws, rules, and policies, including those relating to nondiscrimination, accessibility and civil rights. (See N.D.C.C. Title 34 – Labor and Employment, specifically N.D.C.C. ch. 34-06.1 Equal Pay for Men and Women.)

CONTRACTOR agrees to timely file all required reports, make required payroll deductions, and timely pay all taxes and premiums owed, including sales and use taxes, unemployment compensation and workers' compensation premiums. CONTRACTOR shall have and keep current all licenses and permits required by law during the Term of this Contract.

CONTRACTOR is prohibited from boycotting Israel for the duration of this Contract. (See N.D.C.C § 54-44.4-15.) CONTRACTOR represents that it does not and will not engage in a boycotting Israel during the term of this Contract. If STATE receives evidence that CONTRACTOR boycotts Israel, STATE shall determine whether the company boycotts Israel. The foregoing does not apply to contracts with a total value of less than $100,000 or if CONTRACTOR has fewer than ten (10) full-time employees.

CONTRACTOR’s failure to comply with this section may be deemed a material breach by CONTRACTOR entitling STATE to terminate in accordance with the Termination for Cause section of this Contract.

Artificial Intelligence (AI) and Machine Learning (ML) The contract is hereby amended to include the following Use of Artificial Intelligence (AI) and Machine Learning (ML) section as Section 45:

45. USE OF ARTIFICIAL INTELLIGENCE (AI) AND MACHINE LEARNING (ML)

CONTRACTOR does not utilize Artificial Intelligence (AI) or Machine Learning (ML) in the performance of its obligations under this Contract. In the event that CONTRACTOR access to the State network is required, CONTRACTOR’s future use of AI/ML is subject to prior, written approval by STATE. In such event, CONTRACTOR shall provide to STATE detailed information, in writing, on the use of AI/ML in CONTRACTOR’s obligations under this Contract.

CONTRACTOR agrees to submit new information to STATE for approval any time CONTRACTOR substantially changes its use of AI/ML, if utilized in the future to access STATE Data. STATE reserves the right to terminate the Contract for cause if CONTRACTOR uses AI/ML while accessing State networks in a manner that STATE has not had the opportunity to approve or denied approval.

Data Security The contract is hereby amended to include the following Data Security section as Section 46:

46. DATA SECURITY

a. Remote access to Data from outside the United States, including remote access to Data by authorized support staff in identified support centers, is prohibited.

b. CONTRACTOR shall transmit, process, and store STATE Data within the continental United

States.

c. To the extent any Data is retained or stored in the CONTRACTOR system, CONTRACTOR shall notify STATE, at least 90 days prior to any relocation of STATE’s Data to a different hosting facility. STATE reserves the right to terminate the Contract without penalty if STATE does not approve of the new hosting facility.

http://www.legis.nd.gov/cencode/t34c01.pdf http://www.legis.nd.gov/cencode/t34c06-1.pdf https://www.ndlegis.gov/cencode/t54c44-4.pdf

All other terms of the Contract remain in effect. This Contract Amendment is not effective until fully executed by all parties.

CONTRACTOR

PrePass Safety Alliance

Printed Name:

Title:

Date:

EXECUTION

STATE OF NORTH DAKOTA

Acting through its Office of Management & Bud et, State Procurement Office

BY:

Printed Name: Abigail Dschaak

Title: State Procurement Officer

Date: 3/25/25

President and CEO

3/25/2025

Mark Doughty