Pro%20Forma%20Contract.pdf

09-18-25 NC

CONTRACT

BETWEEN THE STATE OF TENNESSEE,

DEPARTMENT OF COMMERCE AND INSURANCE

AND

[CONTRACTOR NAME]

This Contract, by and between the State of Tennessee, Department of Commerce and Insurance ("State”) and [Contractor Legal Entity Name] (“Contractor”) is for the provision of the administration of the National Home Inspector Examination for the Home Inspector Licensing Program, as further defined in the "SCOPE OF SERVICES." State and Contractor may be referred to individually as a “Party” or collectively as the “Parties” to this Contract.

The Contractor is [a/an Individual, For-Profit Corporation, Non-Profit Corporation, Special Purpose Corporation Or Association, Partnership, Joint Venture, Or Limited Liability Company].

Contractor Place of Incorporation or Organization: [Location] Contractor Edison Registration ID # [Number]

A. SCOPE OF SERVICES:

A.1. General Requirements.

The Contractor shall provide all goods or services and deliverables as required, described, and detailed below and shall meet all service and delivery timelines as specified by this Contract.

A.2. Definitions.

For purposes of this Contract, definitions shall be as follows and as set forth in the Contract:

a. “ADA” means the Americans with Disabilities Act, at 42 U.S.C,, ch. 126, § 12101 et seq.

b. “Business Days” means traditional workdays, including Monday, Tuesday, Wednesday, Thursday, and Friday, excluding Holidays.

c. “Holidays” means the days on which official holidays and commemorations, as defined in Tenn.

Code Ann. § 15-1-101 et seq., are observed.

d. “Home Inspector Licensing Program” or “Program” means the program created in 2005 to regulate home inspectors in the State of Tennessee.

e. “National Home Inspector Examination” or “NHIE” means the exam developed by the Examination Board of Professional Home Inspectors, which applicants are required to pass to qualify for a home inspector license in Tennessee, as stipulated by Tenn. Comp. R. & Regs. 0780-05-12-.04.

A.3. Examination Administration Services.

The Contractor shall administer the National Home Inspector Examination, with administration beginning December 1, 2026, and ending November 30, 2031, for the Home Inspector Licensing Program.

A.4. Examination Delivery.

a. The Contractor shall administer examinations via computer-based testing using equipment provided by the Contractor at permanent, secure testing centers maintained and staffed by the Contractor.

b. The Contractor shall administer examinations in Memphis, Nashville, and Knoxville, Tennessee, Tuesday through Saturday, from 8:00 a.m. to 4:30 p.m. local time excluding Holidays.

c. The Contractor shall administer examinations in Johnson City, Chattanooga, and Jackson, Tennessee, as required by the Program.

A.5. Candidate Registration and Support.

The Contractor shall provide examination candidates with multiple registration and support options, including a toll-free telephone number, fax number, and online registration, including scheduling, and general inquiries. The Contractor shall maintain adequate staffing and procedures to respond to candidate inquiries and resolve questions in a responsible and timely manner, generally within five (5) Business Days of the request.

A.6. Scoring and Candidate Notifications.

a. The Contractor shall provide score reports to candidates immediately upon completion of the examination.

b. The Contractor shall provide written notification of examination scores to candidates immediately following the examination.

c. The Contractor shall provide failing candidates with diagnostic score reports that include performance analysis for each examination content area and the candidate’s relative performance level.

A.7. Reporting to the Program.

Following the administration of the NHIE, the Contractor shall securely transmit electronic score reports to the Program, upon request. These reports must include candidate names, Social Security numbers, and examination scores, formatted in a manner approved by the Program.

A.8. Rescoring and Duplicate Reports.

The Contractor shall provide examination re-scoring services and duplicate score reports upon request by examination candidates.

A.9. Examination Security and Quality Control.

a. The Contractor shall require candidates to present valid identification at the examination site for verification purposes prior to taking the examination.

b. The Contractor shall ensure that all examination materials are assembled, stored, and produced accurately and under secure conditions. The Contractor shall maintain and utilize industry-accepted examination security systems for both examination content and testing centers.

c. The Contractor shall monitor test sites to ensure effective and uniform operations, including staff training and oversight, in order to maintain consistent testing conditions and service quality.

d. The Contractor shall report any examination security breaches or violations to the Program within five (5) Business Days of discovery.

A.10. Data Analytics Reports.

The Contractor shall provide the following statistical and informational reports to the Program on a quarterly basis:

a. Candidate statistics, including pass/fail ratios, overall passing and failing percentage rates, and performance metrics for first-time examination candidates; and

b. Examination item statistics, including item-level analysis such as pass/fail ratios and other psychometric performance indicators.

A.11. Accessibility.

The Contractor shall make reasonable efforts to accommodate the needs of examination candidates with disabilities, in compliance with State and federal law, including, but not limited to, the ADA. The Contractor shall direct candidates to submit all requests for accommodations directly to the Contractor. The Contractor shall review and decide requests for accommodations in accordance with the ADA and its standard processes.

A.12. Technical Support.

The Contractor shall ensure that all technology used to administer the NHIE is fully operational and shall provide technical support to examinees as needed.

A.13. Legal Defensibility.

The Contractor shall ensure that all testing materials, records, and related data are timestamped, logged, and preserved in a manner that makes exam results legally defensible in the event of a challenge.

B. TERM OF CONTRACT:

This Contract shall be effective on December 1, 2026 (“Effective Date”), and extend for a period of sixty (60) months after the Effective Date (“Term”). The State shall have no obligation for goods or services provided by the Contractor prior to the Effective Date.

C. PAYMENT TERMS AND CONDITIONS:

C.1. There shall be no cost to the State for the performance of services under this Contract.

C.2. In consideration of the services provided by the Contractor, as set forth in Section A of this Contract, the Contractor shall charge and collect examination or re-examination fees from each candidate registered for examination or re-examination, in accordance with the following fee schedule. The fee schedule shall remain in effect for the Term of the Contract and shall not be subject to adjustment or escalation for any reason.

Service Description Amount (per compensable increment)

Administration of the National Home Inspector Examination

$________ per examination

Administration of the National Home Inspector Exam - Re-examination $________ per re-examination

C.3. The examination and re-examination fees collected by the Contractor shall constitute the entire compensation due to the Contractor for any and all obligations and services provided under this

Contract, regardless of difficulty, hours worked, materials or equipment required, and includes, but is not limited to, all applicable taxes, fees, overhead, profit, and all other direct and indirect costs incurred or to be incurred by the Contractor.

C.4. The Contractor shall accept Visa, MasterCard, Discover Card, American Express credit cards, and bank credit cards backed by any of these cards, as well as Visa and MasterCard debit cards when run as credit. The Contractor shall not transmit or store credit or debit card information. The solution used to accept and authorize credit card transactions shall be PCI Compliant.

C.5. The Contractor shall be solely responsible for charging and collecting examination and re-examination fees from each candidate registered for examination. In no event shall the State be liable to the Contractor for any compensation due to the Contractor for providing the products and/or services set forth in Section A of this Contract.

D. MANDATORY TERMS AND CONDITIONS:

D.1. Required Approvals. The State is not bound by this Contract until it is duly approved by the Parties and all appropriate State officials in accordance with applicable Tennessee laws and regulations. Depending upon the specifics of this Contract, this may include approvals by the Commissioner of Finance and Administration, the Commissioner of Human Resources, the Comptroller of the Treasury, and the Chief Procurement Officer. Approvals shall be evidenced by a signature or electronic approval.

D.2. Communications and Contacts. All instructions, notices, consents, demands, or other communications required or contemplated by this Contract shall be in writing and shall be made by certified, first class mail, return receipt requested and postage prepaid, by overnight courier service with an asset tracking system, or by email or facsimile transmission with recipient confirmation. Any such communications, regardless of method of transmission, shall be addressed to the respective Party at the appropriate mailing address, facsimile number, or email address as stated below or any other address provided in writing by a Party.

The State:

Glenn Kopchak, Executive Director Department of Commerce and Insurance, Home Inspector Licensing Program 500 James Robertson Parkway

Nashville, TN 37243 Glenn.Kopchak@tn.gov Telephone # 615-741-9129

The Contractor:

[Contractor Contact Name & Title] [Contractor Name] [Address] [Email Address] Telephone # [Number] FAX # [Number]

All instructions, notices, consents, demands, or other communications shall be considered effectively given upon receipt or recipient confirmation as may be required.

D.3. Modification and Amendment. This Contract may be modified only by a written amendment signed by all Parties and approved by all applicable State officials.

mailto:Glenn.Kopchak@tn.gov

D.4. Termination for Convenience. The State may terminate this Contract for convenience without cause and for any reason. The State shall give the Contractor at least thirty (30) days written notice before the effective termination date. Upon such termination, the Contractor shall have no right to any actual general, special, incidental, consequential, or any other damages whatsoever of any description or amount.

D.5. Termination for Cause. If the Contractor fails to properly perform its obligations under this

Contract in a timely or proper manner, or if the Contractor materially violates any terms of this Contract (“Breach Condition”), the State shall have the right to immediately terminate the Contract. Notwithstanding the above, the Contractor shall not be relieved of liability to the State for damages sustained by virtue of any Breach Condition and the State may seek other remedies allowed at law or in equity for beach of this Contract.

D.6. Assignment and Subcontracting. The Contractor shall not assign this Contract or enter into a subcontract for any of the services performed under this Contract without obtaining the prior written approval of the State. Notwithstanding any use of approved subcontractors, the Contractor shall be the prime contractor and responsible for compliance with all terms and conditions of this Contract. The State reserves the right to request additional information or impose additional terms and conditions before approving an assignment of this Contract in whole or in part of the use of subcontractors in fulfilling the Contractor’s obligations under this Contract.

D.7. Conflicts of Interest. The Contractor warrants that no amount shall be paid directly or indirectly to an employee or official of the State of Tennessee as wages, compensation, or gifts in exchange for acting as an officer, agent, employee, subcontractor, or consultant to the Contractor in connection with any work contemplated or performed under this Contract.

The Contractor acknowledges, understands, and agrees that this Contract shall be null and void if the Contractor is, or within the past six (6) months has been, an employee of the State of Tennessee or if the Contractor is an entity in which a controlling interest is held by an individual who is, or within the past six (6) months has been, an employee of the State of Tennessee.

D.8. Nondiscrimination. The Contractor hereby agrees, warrants, and assures that no person shall be excluded from participation in, be denied benefits of, or be otherwise subjected to discrimination in the performance of this Contract or in the employment practices of the Contractor on the grounds of handicap or disability, age, race, creed, color, religion, sex, national origin, or any other classification protected by federal or state law. The Contractor shall, upon request, show proof of nondiscrimination and shall post in conspicuous places, available to all employees and applicants, notices of nondiscrimination.

D.9. Prohibition of Illegal Immigrants. The requirements of Tennessee Code Ann. §12-3-309 addressing the use of illegal immigrants in the performance of any contract to supply goods or services to the state of Tennessee, shall be a material provision of this Contract, a breach of which shall be grounds for monetary and other penalties, up to and including termination of this Contract.

a. The Contractor hereby agrees that the Contractor shall not knowingly utilize the services of an illegal immigrant in the performance of this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant in the performance of this Contract. The Contractor shall reaffirm this attestation by submitting to the State a completed Attestation (accessible through the Edison Supplier Portal) and included at Attachment A, hereto, semi-annually during the Term. If the Contractor is a party to more than one contract with the State, the Contractor may submit one attestation that applies to all contracts with the State. All Contractor attestations shall be maintained by the Contractor and made available to State officials upon request.

b. Prior to the use of any subcontractor in the performance of this Contract, and semi-annually thereafter, during the Term, the Contractor shall obtain and retain a current, written attestation that the subcontractor shall not knowingly utilize the services of an illegal immigrant to perform work under this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant to perform work under this Contract. Attestations obtained from subcontractors shall be maintained by the Contractor and made available to State officials upon request.

c. The Contractor shall maintain records for all personnel used in the performance of this

Contract. Contractor’s records shall be subject to review and random inspection at any reasonable time upon reasonable notice by the State.

d. The Contractor understands and agrees that failure to comply with this section will be subject to the sanctions of Tennessee Code Ann. § 12-3-309 for acts or omissions occurring after its effective date. This law requires the Chief Procurement Officer to prohibit a contractor from contracting with, or submitting an offer, proposal, or bid to contract with the State of Tennessee to supply goods or services for a period of one year after a contractor is discovered to have knowingly used the services of illegal immigrants during the performance of this Contract.

e. For purposes of this Contract, "illegal immigrant" shall be defined as any person who is not either a United States citizen, a Lawful Permanent Resident, or a person whose physical presence in the United States is authorized or allowed by the federal Department of Homeland Security and who, under federal immigration laws and/or regulations, is authorized to be employed in the U.S. or is otherwise authorized to provide services under the Contract.

D.10. Records. The Contractor shall maintain documentation of services rendered under this Contract.

The books, records and documents of the Contractor, insofar as they relate to work performed under this Contract, shall be maintained for a period of five (5) full years from the final date of this Contract and shall be subject to audit, at any reasonable time and upon reasonable notice, by the State, the Comptroller of the Treasury, or their duly appointed representatives.

D.11. Monitoring. The Contractor’s activities conducted and records maintained pursuant to this

Contract shall be subject to monitoring and evaluation by the State, the Comptroller of the Treasury, or their duly appointed representatives.

D.12. Progress Reports. The Contractor shall submit brief, periodic, progress reports to the State as requested.

D.13. Strict Performance. Failure by any Party to this Contract to require, in any one or more cases, the strict performance of any of the terms, covenants, conditions, or provisions of this Contract shall not be construed as a waiver or relinquishment of any such term, covenant, condition, or provision. No term or condition of this Contract shall be held to be waived, modified, or deleted except by a written amendment signed by the Parties.

D.14. Independent Contractor. The Parties shall not act as employees, partners, joint venturers, or associates of one another. It is expressly acknowledged by the Parties that such Parties are independent contracting entities and that nothing in this Contract shall be construed to create an employer/employee relationship or to allow either to exercise control or direction over the manner or method by which the other transacts its business affairs or provides its usual services. The employees or agents of one party shall not be deemed or construed to be the employees or agents of the other party for any purpose whatsoever.

The Contractor, being an independent contractor and not an employee of the State, agrees to carry adequate public liability and other appropriate forms of insurance, including adequate public liability and other appropriate forms of insurance on the Contractor’s employees, and to pay all applicable taxes incident to this Contract.

D.15. Patient Protection and Affordable Care Act. The Contractor agrees that it will be responsible for compliance with the Patient Protection and Affordable Care Act (“PPACA”) with respect to itself and its employees, including any obligation to report health insurance coverage, provide health insurance coverage, or pay any financial assessment, tax, or penalty for not providing health insurance. The Contractor shall indemnify the State and hold it harmless from any costs to the State arising from Contractor’s failure to fulfill its PPACA responsibilities for itself or its employees.

D.16. State Liability. The State shall have no liability except as specifically provided in this Contract. In no event will the State be liable to the Contractor or any other party for any lost revenues, lost profits, loss of business, decrease in the value of any securities or cash position, time, goodwill, or any indirect, special, incidental, punitive, exemplary or consequential damages of any nature, whether based on warranty, contract, statute, regulation, tort (including but not limited to negligence), or any other legal theory that may arise under this Contract or otherwise.

D.17. Force Majeure. The obligations of the parties to this Contract are subject to prevention by causes beyond the parties’ control that could not be avoided by the exercise of due care including, but not limited to, natural disasters, riots, wars, epidemics, or any other similar cause.

D.18. State and Federal Compliance. The Contractor shall comply with all applicable State and Federal laws and regulations in the performance of this Contract.

D.19. Governing Law. This Contract shall be governed by and construed in accordance with the laws of the State of Tennessee, without regard to its conflict or choice of law rules. The Tennessee Claims Commission or the state or federal courts in Tennessee shall be the venue for all claims, disputes, or disagreements arising under this Contract. The Contractor acknowledges and agrees that any rights, claims, or remedies against the State of Tennessee or its employees arising under this Contract shall be subject to and limited to those rights and remedies available under Tennessee Code Ann. §§ 9-8-101-408.

D.20. Completeness. This Contract is complete and contains the entire understanding between the parties relating to the subject matter contained herein, including all the terms and conditions of the parties’ agreement. This Contract supersedes any and all prior understandings, representations, negotiations, and agreements between the parties relating hereto, whether written or oral.

D.21. Severability. If any terms and conditions of this Contract are held to be invalid or unenforceable as a matter of law, the other terms and conditions of this Contract shall not be affected and shall remain in full force and effect. The terms and conditions of this Contract are severable.

D.22. Headings. Section headings of this Contract are for reference purposes only and shall not be construed as part of this Contract.

D.23. Incorporation of Additional Documents. Each of the following documents is included as a part of this Contract by reference. In the event of a discrepancy or ambiguity regarding the Contractor’s duties, responsibilities, and performance of this Contract, these items shall govern in the order of precedence below:

a. any amendment to this Contract, with the latter in time controlling over any earlier amendments;

b. this Contract with any attachments or exhibits (excluding the items listed at subsections c.

through f., below), which includes Attachment A;

c. any clarifications of or addenda to the Contractor’s proposal seeking this Contract;

d. the State solicitation, as may be amended, requesting responses in competition for this Contract;

e. any technical specifications provided to proposers during the procurement process to award this

Contract; and

f. the Contractor’s response seeking this Contract.

D.24. Insurance. Contractor shall maintain insurance coverage as specified in this Section. The State reserves the right to amend or require additional insurance coverage, coverage amounts, and endorsements required under this Contract. Contractor’s failure to maintain or submit evidence of insurance coverage, as required, is a material breach of this Contract. If Contractor loses insurance coverage, fails to renew coverage, or for any reason becomes uninsured during the Term, Contractor shall immediately notify the State. All insurance companies providing coverage must be: (a) acceptable to the State; (b) authorized by the Tennessee Department of Commerce and Insurance (“TDCI”); and (c) rated A- / VII or better by A.M. Best. All coverages in which the State is required hereunder to be named as an additional insured must be on a primary basis and noncontributory with any other insurance or self-insurance carried by the State. Contractor agrees to name the State as an additional insured on any insurance policy with the exception of workers’ compensation (employer liability) and professional liability (errors and omissions) insurance. All policies must contain an endorsement for a waiver of subrogation in favor of the State. To the extent that Contractor is unable to obtain insurance coverage containing such a waiver, Contractor agrees to indemnify and hold harmless the State as well as its officers, agents, and employees from and against any and all subrogation claims, liabilities, losses, and causes of action which may arise, accrue, or result to any insurer who provides insurance coverage carried by Contractor, regardless of negligence. In any such claim or action brought against the State, the Contractor shall satisfy and indemnify the State for the amount of any settlement or final judgment, and the Contractor shall be responsible for all legal or other fees or expenses incurred by the State arising from any such claim. The State shall give the Contractor notice of any such claim or suit; however, the failure of the State to give such notice shall only relieve Contractor of its obligations under this Section to the extent Contractor can demonstrate actual prejudice arising from the State’s failure to give notice. This Section shall not grant the Contractor, through its attorneys, the right to represent the State of Tennessee in any legal matter, as provided in Tenn. Code Ann. § 8-6-106. Any deductible or self insured retention (“SIR”) over fifty thousand dollars ($50,000) must be approved by the State. The deductible or SIR and any premiums are the Contractor’s sole responsibility. The Contractor agrees that the insurance requirements specified in this Section do not reduce any liability the Contractor has assumed under this Contract including any indemnification or hold harmless requirements.

To achieve the required coverage amounts, a combination of an otherwise deficient specific policy and an umbrella policy with an aggregate meeting or exceeding the required coverage amounts is acceptable. For example: If the required policy limit under this Contract is for two million dollars ($2,000,000) in coverage, acceptable coverage would include a specific policy covering one million dollars ($1,000,000) combined with an umbrella policy for an additional one million dollars ($1,000,000). If the deficient underlying policy is for a coverage area without aggregate limits (generally Automobile Liability and Employers’ Liability Accident), Contractor shall provide a copy of the umbrella insurance policy documents to ensure that no aggregate limit applies to the umbrella policy for that coverage area. In the event that an umbrella policy is being provided to achieve any required coverage amounts, the umbrella policy shall be accompanied by an endorsement at least as broad as the Insurance Services Office, Inc. (also known as “ISO”) “Noncontributory—Other Insurance Condition” endorsement or shall be written on a policy form that addresses both the primary and noncontributory basis of the umbrella policy if the State is otherwise named as an additional insured.

Contractor shall provide the State a certificate of insurance (“COI”) evidencing the coverages and amounts specified in this Section. The COI must be on a form approved by the TDCI (standard ACORD form preferred). The COI must list each insurer’s National Association of Insurance Commissioners (NAIC) number and be signed by an authorized representative of the insurer. The COI must list the State of Tennessee – CPO Risk Manager, 312 Rosa L. Parks Ave., 3rd floor

Central Procurement Office, Nashville, TN 37243 as the certificate holder. Contractor shall provide the COI ten (10) business days prior to the Effective Date and again thirty (30) calendar days before renewal or replacement of coverage. Contractor shall provide the State evidence that all subcontractors maintain the required insurance or that subcontractors are included under the Contractor’s policy. At any time, the State may require Contractor to provide a valid COI.

The Parties agree that failure to provide evidence of insurance coverage as required is a material breach of this Contract. If Contractor self-insures, then a COI will not be required to prove coverage. Instead Contractor shall provide a certificate of self-insurance or a letter, on Contractor’s letterhead, detailing its coverage, policy amounts, and proof of funds to reasonably cover such expenses. The State reserves the right to require complete copies of all required insurance policies, including endorsements required by these specifications, at any time.

The State agrees that it shall give written notice to the Contractor as soon as practicable after the State becomes aware of any claim asserted or made against the State, but in no event later than thirty (30) calendar days after the State becomes aware of such claim. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor or its insurer, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann.

§ 8-6-106.

The insurance obligations under this Contract shall be: (1)—all the insurance coverage and policy limits carried by the Contractor; or (2)—the minimum insurance coverage requirements and policy limits shown in this Contract; whichever is greater. Any insurance proceeds in excess of or broader than the minimum required coverage and minimum required policy limits, which are applicable to a given loss, shall be available to the State. No representation is made that the minimum insurance requirements of the Contract are sufficient to cover the obligations of the Contractor arising under this Contract. The Contractor shall obtain and maintain, at a minimum, the following insurance coverages and policy limits.

a. Commercial General Liability (“CGL”) Insurance

1) The Contractor shall maintain CGL, which shall be written on an ISO Form CG 00 01 occurrence form (or a substitute form providing equivalent coverage) and shall cover liability arising from property damage, premises and operations products and completed operations, bodily injury, personal and advertising injury, and liability assumed under an insured contract (including the tort liability of another assumed in a business contract).

2) The Contractor shall maintain single limits not less than one million dollars ($1,000,000) per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this policy or location of occurrence or the general aggregate limit shall be twice the required occurrence limit.

b. Workers’ Compensation and Employer Liability Insurance

1) For Contractors statutorily required to carry workers’ compensation and employer liability insurance, the Contractor shall maintain:

i. Workers’ compensation and employer liability insurance in the amounts required by appropriate state statutes.

2) If the Contractor certifies that it is exempt from the requirements of Tenn. Code Ann. §§ 50-6-101 – 103, then the Contractor shall furnish written proof of such exemption for one or more of the following reasons:

i. The Contractor employs fewer than five (5) employees;

ii. The Contractor is a sole proprietor;

iii. The Contractor is in the construction business or trades with no employees;

iv. The Contractor is in the coal mining industry with no employees;

v. The Contractor is a state or local government; or

vi. The Contractor self-insures its workers’ compensation and is in compliance with the TDCI rules and Tenn. Code Ann. § 50-6-405.

c. Automobile Liability Insurance

1) The Contractor shall maintain automobile liability insurance which shall cover liability arising out of any automobile (including owned, leased, hired, and non-owned automobiles).

2) The Contractor shall maintain bodily injury/property damage with a limit not less than one million dollars ($1,000,000) per occurrence or combined single limit.

d. Cyber Liability Insurance

1) The Contractor shall maintain cyber liability insurance in an amount not less than five million dollars ($5,000,000) per occurrence or claim and five million dollars ($5,000,000) annual aggregate. Such insurance shall be sufficiently broad to respond to the Contractor’s duties and obligations under this Contract, and shall include coverage for all acts, claims, errors, omissions, negligence, and infringement of intellectual property (including copyright, patent and trade secret) related to network security and privacy risks, including but not limited to unauthorized access, failure of security, information theft, damage to destruction of or alteration of electronic information, breach of privacy perils, wrongful disclosure and release of private information, collection, or other negligence in the handling of confidential information, and including coverage for related regulatory fines, defenses, and penalties.

2) Such coverage shall include data breach response expenses, in an amount not less than five million dollars ($5,000,000) and payable whether incurred by the State or Contractor, including but not limited to consumer notification, whether or not required by law, computer forensic investigations, public relations and crisis management firm fees, credit file or identity monitoring or remediation services and expenses in the performance of services for the State or on behalf of the State hereunder.

D.25. Hold Harmless. The Contractor agrees to indemnify and hold harmless the State of Tennessee as well as its officers, agents, and employees from and against any and all claims, liabilities, losses, and causes of action which may arise, accrue, or result to any person, firm, corporation, or other entity which may be injured or damaged as a result of acts, omissions, or negligence on the part of the Contractor, its employees, or any person acting for or on its or their behalf relating to this Contract. The Contractor further agrees it shall be liable for the reasonable cost of attorneys’ fees, court costs, expert witness fees, and other litigation expenses for the State to enforce the terms of this Contract.

In the event of any suit or claim, the Parties shall give each other immediate notice and provide all necessary assistance to respond. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann. § 8-6-106.

D.26. HIPAA Compliance. The State and Contractor shall comply with obligations under the Health

Insurance Portability and Accountability Act of 1996 (“HIPAA”), Health Information Technology for Economic and Clinical Health (“HITECH”) Act and any other relevant laws and regulations regarding privacy (collectively the “Privacy Rules”). The obligations set forth in this section shall survive the termination of the Contract.

a. Contractor warrants to the State that it is familiar with the requirements of the Privacy

Rules, and will comply with all applicable requirements in the course of this Contract.

b. Contractor warrants that it will cooperate with the State, including cooperation and coordination with State privacy officials and other compliance officers required by the Privacy Rules, in the course of performance of the Contract so that both parties will be in compliance with the Privacy Rules.

c. The State and the Contractor will sign documents, including but not limited to business associate agreements, as required by the Privacy Rules and that are reasonably necessary to keep the State and Contractor in compliance with the Privacy Rules. This provision shall not apply if information received or delivered by the parties under this Contract is NOT “protected health information” as defined by the Privacy Rules, or if the Privacy Rules permit the parties to receive or deliver the information without entering into a business associate agreement or signing another such document.

d. The Contractor will indemnify the State and hold it harmless for any violation by the

Contractor or its subcontractors of the Privacy Rules. This includes the costs of responding to a breach of protected health information, the costs of responding to a government enforcement action related to the breach, and any fines, penalties, or damages paid by the State because of the violation.

D.27. Tennessee Department of Revenue Registration. The Contractor shall comply with all applicable registration requirements contained in Tenn. Code Ann. § 67-6-601 – 608. Compliance with applicable registration requirements is a material requirement of this Contract.

D.28. Debarment and Suspension. The Contractor certifies, to the best of its knowledge and belief, that it, its current and future principals, its current and future subcontractors and their principals:

a. are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from covered transactions by any federal or state department or agency;

b. have not within a three (3) year period preceding this Contract been convicted of, or had a civil judgment rendered against them from commission of fraud, or a criminal offence in connection with obtaining, attempting to obtain, or performing a public (federal, state, or local) transaction or grant under a public transaction; violation of federal or state antitrust statutes or commission of embezzlement, theft, forgery, bribery, falsification, or destruction of records, making false statements, or receiving stolen property;

c. are not presently indicted or otherwise criminally or civilly charged by a government entity

(federal, state, or local) with commission of any of the offenses detailed in section b. of this certification; and

d. have not within a three (3) year period preceding this Contract had one or more public transactions (federal, state, or local) terminated for cause or default.

The Contractor shall provide immediate written notice to the State if at any time it learns that there was an earlier failure to disclose information or that due to changed circumstances, its principals or the principals of its subcontractors are excluded, disqualified, or presently fall under any of the prohibitions of sections a-d.

D.29. Prohibited Contract Terms. The prohibited contract terms and conditions enumerated in Tenn.

Code Ann. § 12-3-515, shall be a material provision of this Contract. The Contractor acknowledges, understands, and agrees that the inclusion of a term or condition prohibited by Tenn. Code Ann. § 12-3-515, shall be null and void and the Contract shall be enforceable as if the Contract did not contain such term or condition.

D.30. Information Technology Security Requirements (State Data, Audit, and Other Requirements).

a. “State Data” is any and all data that can be accessed, processed, generated, including derivative works, stored, or hosted by the Contractor in performance of this Contract.” The Contractor shall protect State Data as follows:

1) The Contractor shall ensure that all State Data is housed in the continental United States, inclusive of backup data. All State Data must remain in the United States, regardless of whether the data is processed, stored, in-transit, or at rest. Access to State Data shall be limited to US-based (onshore) resources only.

All system and application administration must be performed in the continental United States.

Configuration or development of software and code is permitted outside of the United States.

However, software applications designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary, which the U.S. Secretary of Commerce acting pursuant to 15 C.F.R. § 7 has defined to include the People’s Republic of China, among others are prohibited. Any testing of code outside of the United States must use fake data. A copy of production data may not be transmitted or used outside the United States.

2) The Contractor shall encrypt State Data at rest and in transit using the current version of

Federal Information Processing Standard (“FIPS”) 140-2 or 140-3 (or current applicable version) validated encryption technologies. The State shall control all access to encryption keys. The Contractor shall provide installation and maintenance support at no cost to the State.

3) The Contractor shall maintain, obtain, or undergo the following third-party information security certification(s), authorization(s), examination(s), assessments, or audit(s) for both the Contractor and the Contractor’s processing environment containing State Data. The Contractor shall ensure that each certification, authorization, examination, or assessment remains current and valid throughout the term of the Contract.

i. ISO/IEC 27001:2022 Certification – The Contractor and Contractor’s processing environment containing State Data shall be currently compliant with the most recent version of the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 27001:2022 standards. Annual surveillance and recertification audits shall be performed by a certification body accredited by the ANSI-ASQ National Accreditation Board

(ANAB);

ii. FedRAMP Authorization - The Contractor and Contractor’s processing environment containing State Data shall maintain an active Federal Risk and Authorization Management Program (FedRAMP) Moderate or higher Authorization to Operate as issued by a federal agency or the FedRAMP Program Management Office;

iii. GovRAMP Authorization - The Contractor and Contractor’s processing environment containing State Data shall maintain authorization by the Government Risk and Authorization Management Program (GovRAMP) and undergo an annual audit performed by a GovRAMP-approved Third Party Assessment Organization (3PAO);

iv. SOC 2 Type II Examination - The Contractor and Contractor’s processing environment containing State Data shall be subject to an annual engagement by a CPA firm in accordance with the standards of the American Institute of Certified Public Accountants (AICPA) for a System and Organization Controls for service organizations (SOC) Type II examination that includes the Security, Availability, and Confidentiality Trust Services Criteria;

v. HITRUST Certification - The Contractor and Contractor’s processing environment containing State Data shall maintain a current HITRUST risk-based 2-year (r2) validated assessment issued under the HITRUST Common Security Framework and performed by an authorized HITRUST External Assessor Organization; or

vi. NIST Audit - The Contractor and Contractor’s processing environment containing State Data shall undergo an annual independent audit assessing compliance with the privacy and security controls established in the National Institute of Standards and Technology (NIST) Special Publication 800-53. The audit shall be conducted by a qualified independent assessor, which may include a reputable CPA firm, cybersecurity firm, or other organization with demonstrated expertise in assessing NIST control compliance. The audit must evaluate compliance with the security controls defined in the NIST Special Publication 800-53B moderate-impact security control baseline or a higher-impact baseline.

4) Upon request by the State or the Comptroller of the Treasury, and within thirty (30) days of completion or receipt of any certification, authorization, examination, assessment, or audit required under Contract Section D.30,a.3) the Contractor shall provide the State or the Comptroller of the Treasury with the following documentation and deliverables. The Contractor shall ensure that all documentation remains current, complete, and accurate throughout the term of the Contract.

i. ISO/IEC 27001:2022 Certification

1) The ISO/IEC 27001:2022 assessment report in its entirety;

2) The certification letter issued by the accredited certification body;

3) The Statement of Applicability (SOA) in its entirety, including specific clauses, control categories, control objectives, and implemented controls;

4) A written disclosure and rationale for all controls listed as “excluded” in the SOA; and

5) Evidence that annual surveillance and recertification audits were performed by a certification body accredited by the ANSI-ASQ National Accreditation Board.

ii.FedRAMP Authorization

1) The FedRAMP Authorization Letter (Authorization to Operate);

2) The System Security Plan in its entirety;

3) The Security Assessment Plan;

4) The Security Assessment Report in its entirety prepared by the FedRAMP-approved Third-Party Assessment Organization; and

5) The current Plan of Action and Milestones documenting all known control weaknesses and remediation status, which the Contractor shall maintain or cause to maintain in a current and accurate state throughout the term of the Contract.

iii. GovRAMP Authorization

1) The GovRAMP Authorization Letter or equivalent documentation issued by the GovRAMP Program Office;

2) The System Security Plan in its entirety;

3) The Security Assessment Plan;

4) The Security Assessment Report in its entirety prepared by the GovRAMP-approved Third-Party Assessment Organization; and

5) The current Plan of Action and Milestones documenting all known control weaknesses and remediation status, which the Contractor shall maintain or cause to maintain in a current and accurate state throughout the term of the Contract.

iv. SOC 2 Type II Examination

1) The SOC 2 Type II examination report in its entirety;

2) A corrective action plan describing each identified deficiency, planned remediation steps, and anticipated completion dates; and

3) If any SOC examination report for the Contractor or any Subcontractor supporting this Contract includes a modified opinion, meaning the opinion is qualified, adverse, or disclaimed, the Contractor shall notify the State of the modified opinion within thirty (30) days of receipt and provide the Contractor’s plan of corrective action.

v. HITRUST Certification

1) The current HITRUST assessment report in its entirety;

2) The HITRUST Certification Letter for the current [r2] Validated Assessment, issued by HITRUST Alliance after validation by an Authorized HITRUST External Assessor Organization, the letter must show assessment type, scope, and certification dates;

and

3) A corrective action plan describing each identified deficiency, planned remediation steps, and anticipated completion dates.

vi. NIST Audit

1) The audit report in its entirety;

2) A corrective action plan describing each identified deficiency, planned remediation steps, and anticipated completion dates.

Upon request by the State or the Comptroller of the Treasury, the Contractor shall also provide current Subcontractor certifications, reports, and related deliverables pertaining to services provided under this Contract within thirty (30) days. If any certification, authorization, examination, or assessment required under this Contract for any Subcontractor supporting this Contract lapses, expires, is suspended, or is revoked, the Contractor shall notify the State in writing within five (5) business days of learning of the status change and provide: (i) the effective date and reason; (ii) the services and State Data affected; and (iii) the Contractor’s corrective action plan and interim risk mitigations.

No additional funding shall be allocated for these examinations as they are included in the Maximum Liability of this Contract.

5) The Contractor must annually perform Penetration Tests and Vulnerability Assessments against its Processing Environment per the NIST 800-115 definition. “Processing Environment” shall mean the combination of software and hardware on which the Application runs. “Application” shall mean the computer code that supports and accomplishes the State’s requirements as set forth in this Contract. “Penetration Tests” shall be in the form of attacks on the Contractor’s computer system, with the purpose of discovering security weaknesses which have the potential to gain access to the Processing Environment’s features and data.

The “Vulnerability Assessment” shall be designed and executed to define, identify, and classify the security holes (vulnerabilities) in the Processing Environment. The Contractor shall allow the State, at its option, to perform Penetration Tests and Vulnerability Assessments on the Processing Environment. The Contractor shall provide a letter of attestation on its processing environment that penetration tests and vulnerability assessments has been performed on an annual basis and taken corrective action to evaluate and address any findings.

In the event of an unauthorized disclosure or unauthorized access to State Data, the State Strategic Technology Solutions (STS) Security Incident Response Team (SIRT) must be notified and engaged by calling the State Customer Care Center (CCC) at 615-741-1001.

Any such event must be reported by the Contractor within twenty-four (24) hours after the unauthorized disclosure has come to the attention of the Contractor.

6) If a breach has been confirmed a fully un-modified third-party forensics report must be supplied to the State and through the STS SIRT. This report must include indicators of compromise (IOCs) as well as plan of actions for remediation and restoration. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures.

7) Upon State request, the Contractor shall provide a copy of all State Data it holds. The

Contractor shall provide such data on media and in a format determined by the State.

8) Upon termination of this Contract and in consultation with the State, the Contractor shall destroy, and ensure all subcontractors shall destroy, all State Data it holds (including any copies such as backups) in accordance with the current version of National Institute of Standards and Technology (“NIST”) Special Publication 800-88.