PW1137-22 - Exhibit 1 - Sample Software as a Service Contract.pdf

Contract Number [##-####-##]

MARION COUNTY

SOFTWARE AS A SERVICE (SaaS) CONTRACT for [Project Title]

PARTIES

Marion County (County) 555 Court St. NE Salem, OR 97301

[Company] (Contractor) [Address]

[City, State ZIP]

RECITALS

The County issued a Request for Proposals (RFP) as Solicitation No. [###] on [date], and received proposals for the implementation of a [describe system] system utilizing the software as a service (SaaS) delivery model, subscription thereto, and support thereof. Upon evaluation of those proposals, the County determined that the services offered by Contractor most closely fulfilled the requirements stated in the RFP. The County now desires to engage Contractor to provide certain SaaS services, under the terms and conditions of this SaaS Contract (Contract).

AGREEMENT

SECTION 1: DEFINITIONS

Terms not defined elsewhere in this Contract have the following meanings:

“Acceptance” means the Deliverables have been completed, installed, and diagnostic tests have been performed to demonstrate, to the County’s satisfaction, that the Deliverables conform and operate according to the requirements of this Contract, applicable Documentation, Acceptance Criteria, and Contractor’s performance warranties.

“Acceptance Certificate” means a written instrument by which the County notifies Contractor that in the County’s sole discretion the Acceptance Criteria have either been met or waived, in whole or in part.

“Acceptance Criteria” means all specifications, functionality, and performance requirements as set forth in Section 7, Schedule 3.1, Contractor’s proposal, and Contractor’s performance warranties.

“Acceptance Test” means the evaluation and testing method, procedures, or both, that are used to determine whether or not a Deliverable requiring Acceptance Testing operates in accordance with the Acceptance Criteria. Acceptance Testing may occur in one or more phases, depending on the integration of contingent products, scalability, performance tuning or other measurable features or milestones.

“Breach of Security” has the same meaning as the term “Breach of Security” under the Oregon ID Theft Act and also includes: (i) any act or omission that compromises either the security, confidentiality, or integrity of Protected County Information or the physical, technical, administrative, or organizational safeguards put in place by Contractor (or put in place by the County should Contractor have access to the County Network) that relate to the protection of the security, confidentiality, or integrity of Protected County Information; and (ii) a breach or alleged breach of this Contract relating to such privacy and data security practices. Without limiting the foregoing, a compromise includes any unauthorized access to or disclosure or acquisition of Protected County Information.

“Contractor Intellectual Property” means any intellectual property that is owned by Contractor and contained in or necessary for the use, or optimal use, of the Deliverables.

Contractor Intellectual Property includes Documentation, Work Product, and derivative works and compilations of any Contractor Intellectual Property. Contractor Intellectual Property does not include COTS Software.

“Contractor Personnel” means any individuals Contractor assigns to provide Services, including without limitation Contractor’s employees, temporary personnel, contractors, subcontractors, and other third parties under Contractor’s control.

“COTS Software” means commercial off-the-shelf software that Contractor delivers to the County pursuant to the provision of Services.

“County Data” means all data created by or in any way originating with the County, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the County, whether such data or output is stored on the County’s hardware, Contractor’s hardware, or exists in any system owned, maintained, or otherwise controlled by the County or by Contractor.

“County Intellectual Property” means any intellectual property that is owned by the County, including but not limited to any derivative works and compilations of any County Intellectual Property.

“County Network” means the County's computer systems and data processing capabilities, programs, data storage and communication capabilities, and all related equipment and devices, including any public Wi-Fi or other network provided to the County's customers, tenants and guests.

“Deliverable(s)” means the Services, including Work Product, and all Software or other products that Contractor is required to deliver to the County under this Contract.

“Documentation” means all documents, including documents that are Deliverables described in the Contract and includes, but is not limited to, any and all operator’s and user’s manuals, training materials, guides, commentary, listings, requirements traceability matrices, and other materials for use in conjunction with and for the operation of products and Services that are to be delivered by Contractor under the Contract.

“Effective Date” means date this Contract becomes fully executed.

“Error” means any defect, problem, condition, bug, or other partial or complete inability of the Subscription Services to operate in accordance with the applicable specifications and Documentation.

“Final Acceptance” means the County has determined that a Deliverable requiring Acceptance Testing: (a) has met the Acceptance Criteria and the County has provided an Acceptance Certificate to Contractor; and (b) all Deliverables function and perform compatibly and without Error.

“Material Breach” means any breach of this Contract that (a) causes or may cause substantial harm to the non-breaching party; or (b) substantially deprives the non-breaching party of the benefit it reasonably expected under this Contract.

“Non-Subscription Services” means the services provided to the County by Contractor under the Contract that are not included in the definition of Subscription Services, together with all documentation provided by or otherwise required of Contractor for any of such services.

“Oregon ID Theft Act” means the Oregon Consumer Information Protection Act at ORS 646A.600 et seq.

“PCI Data” means all credit card and account information protected under PCI Security Standards.

“PCI Security Standards” means the payment card industry security standards developed and managed by the Payment Card Industry Security Standards Council (PCI SSC), including the PCI Data Security Standard (PCI DSS), Payment Application Data Security Standard (PA-DSS), and PIN Transaction Security (PTS) requirements.

“Personal Information” means consumer information or data as that term is used in ORS 646A.602(12), including but not limited to Social Security numbers.

“PHI” means Protected Health Information as defined in 45 C.F.R. § 160.103.

“Removable Media” means Removable data storage media, including without limitation portable or removable hard disks, floppy disks, USB memory drives, zip disks, optical disks, CDs, DVDs, digital film, memory cards (e.g. Secure Digital, Memory Sticks, CompactFlash, SmartMedia, MultiMediaCard, xD-Picture Card), and magnetic tape.

“SaaS Application” means mean the SaaS computer software described on Schedule 3.1 to which Contractor has granted the County access and use as part of the Subscription Services.

This includes any customization, other derivative works, upgrades, releases, fixes, or patches related to such software that Contractor develops or deploys during the term of this Contract, together with all Documentation provided by or otherwise required of Contractor for any of the software, customization, other derivative works, upgrades, releases, fixes, or patches.

“Services” means Subscription Services and Non-Subscription Services, collectively.

“Software” means the software identified in Schedule 3.1, including but not limited to the SaaS Application and COTS Software, and all related Documentation that Contractor will deliver to the County under this Contract.

“Subscription Services” means the County’s access to and use, and Contractor’s provision, of the SaaS Application and related services in accordance with the terms and conditions set forth in this Contract.

“Third Party Intellectual Property” means any intellectual property owned by parties other than the County or Contractor and contained in or necessary for the use of the Deliverables, including but not limited to COTS Software owned by third parties, and derivative works and compilations of any Third Party Intellectual Property.

“Upgrade” means a newer, better version, change, modification, or enhancement to the SaaS Application, and related Documentation, which Contractor makes available from time to time, which incorporates major new features or increases the core functionality of the SaaS Application and may be considered a new version. Upgrades may include error correction, bug fixes, additions to, or patches to the SaaS Application.

“Work Product” means every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know-how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registrable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor or Contractor’s subcontractors or agents (either alone or with others) under this Contract. Notwithstanding anything in the immediately preceding sentence to the contrary, Work Product does not include any County Intellectual Property, Contractor Intellectual Property, or Third Party Intellectual Property.

SECTION 2: TERM AND TERMINATION

2.1 Term

The term of this Contract is from the Effective Date until [date], unless sooner terminated under the provisions of this Contract. The parties may extend the term of this Contract provided that the total Contract term does not extend beyond [insert date or event].

2.2 Early Termination

This Contract may be terminated as follows:

2.2.1 County and Contractor, by mutual written agreement, may terminate this Contract at any time.

2.2.2 County in its sole discretion may terminate this Contract for any reason on 30 days written notice to Contractor.

2.2.3 Either County or Contractor may terminate this Contract in the event of a breach of the Contract by the other. Prior to such termination the party seeking termination shall give to the other party written notice of the breach and intent to terminate. If the party committing the breach has not entirely cured the breach within 15 days of the date of the notice, then the party giving the notice may terminate the Contract at any time thereafter by giving a written notice of termination.

2.2.4 Notwithstanding the previous subsection, County may terminate this Contract immediately by written notice to Contractor upon denial, suspension, revocation or non-renewal of any license, permit or certificate that Contractor must hold to provide services under this Contract.

2.3 Contractor Obligations Upon Termination

Upon any termination of this Contract:

2.3.1 Contractor will make available to the County a file or files containing all of the County’s Data in a format acceptable to the County, within 30 calendar days of termination;

2.3.2 upon the County’s request, Contractor must delete and destroy all of the County’s Data in a manner consistent with U.S. Department of Defense destruction procedures; and

2.3.3 Contractor shall not transfer any of the County’s Data to third parties.

SECTION 3: SERVICES

Unless expressly provided otherwise by this Contract, Contractor shall provide all labor, equipment, and materials necessary to perform the following Services:

3.1 Subscription Services

Contractor will provide to the County all required services set forth on the attached Schedule 3.1, including but not limited to access to and use of the SaaS Application, software and data hosting and storage, consulting, implementation, training, and helpdesk support services, in accordance with the service level requirements set forth on Schedule 3.1.

3.2 Non-Subscription Services

Contractor will provide to the County all required services set forth on the attached Schedule 3.2.

3.3 Subscription Services Support; Error Resolution; Training; Downtime

3.3.1 Support

Contractor shall establish and maintain the organization and processes necessary to provide support and error-resolution services to the County. Contractor shall provide support and error-resolution services on a twenty-four (24) hours a day, seven (7) days a week basis via telephone from 8:00 a.m. to 6:00 p.m. PST, with ninety-eight percent (98%) of calls picked up within two (2) rings, and pager service in all other hours, with a call back within five (5) minutes.

3.3.2 Error Resolution

Severity Level and Response Times: Unless otherwise specified in Schedule 3.1 or Schedule 3.2, upon receipt of telephone or written notice from the County specifying a problem, and upon receipt of such additional information as Contractor may request, Contractor shall respond as described below to resolve reported and reproducible Errors in the Subscription Services or SaaS Application, so that the SaaS Application operates as specified in this Contract:

a. High Level Severity: A critical function is inoperative, and no work-around is available, or the user experience is such that either County or public end users are severely and negatively affected, or there are Errors or defects that cause data to be lost. Technical support will immediately initiate corrective actions and work beyond normal business hours as necessary to fix the problem. Initial response time to the escalated issue shall not exceed 30 minutes, and resolution time shall not exceed eight (8) business hours.

b. Medium Level Severity: A non-critical function or overall performance is materially impaired, or a critical function is impaired but a temporary work-around is available and can be easily communicated to functional users. Technical support will immediately initiate corrective actions and fix the problem as soon as possible during normal business hours. Response time shall not exceed two (2) hours following notification of the problem, and resolution time shall not exceed three (3) business days.

c. Low Level Severity: A problem arises which does not materially impair the County’s essential operations. Resolution time shall not exceed fifteen (15) calendar days; or if the next Upgrade is confirmed to correct the identified problem, and is scheduled to be released within thirty (30) days of the problem report, then that schedule may be used in lieu of the 15 day resolution period. Such an alternative must be confirmed in writing as an option to the County, and acknowledged as acceptable.

d. Information Request: The County initiates a support ticket to obtain information or assistance about product capabilities or installation configuration. Response time shall not exceed 15 business days.

3.3.3 Remedies

In the event that a support request of high or medium level severity is not resolved in the timelines agreed to in this section, the County shall send Contractor written notice of such failure to resolve a request. If such request is not resolved within thirty (30) days from the time of the County’s initial notice to Contractor of Contractor’s failure to resolve the request, then in addition to any other remedies to which the County may be entitled (including but not limited to the remedy set forth in the Breach of Contract Section below) the County may, at the County’s sole option, either:

a. continue using the Services until resolution is achieved;

b. require Contractor to replace the failed component; or

c. terminate use of the Services, in which case Contractor shall promptly refund to the County all costs including applicable fees paid by the County.

3.3.4 Training for Upgrades or Major Repairs

At the County’s request, Contractor shall provide at no additional cost to the County on-site or remote training for end users and for site/system County administrators in connection with Upgrades or major repairs that change the functional operation of the SaaS Application, whether such repair or alteration is a permanent or interim modification.

3.3.5 Downtime

Contractor will provide the County with a minimum of ten (10) business days' notice of planned downtime of the SaaS Application where such downtime may have an impact on the County’s operations by the County’s internal or external end users.

SECTION 4: COMPENSATION

4.1 Subscription Services

4.1.1 Annual Fee

Payment for the first annual Subscription Services fee, in the amount set forth on Schedule 3.1, shall be due after Final Acceptance and upon the date of first use of the SaaS Application by the County with public end users. Subsequent payments for the annual Subscription Services fee are due one year after such date and annually thereafter.

4.1.2 Adjustments

Contractor may request a rate adjustment no more frequently than annually for the ensuing one-year period beginning on the Effective Date of the Contract or on an anniversary of the Effective Date to reflect actual increases in Contractor’s cost to perform the Services, by submitting a written request with backup documentation establishing the actual increases in cost. In no event shall the rate adjustment be more than the percentage change during the preceding year in the Consumer Price Index for All Urban Consumers (CPI-U), US City Average, not seasonally adjusted, all items, published by the U.S. Department of Labor. Any request for a rate adjustment shall be submitted to the County no less than sixty (60) calendar days prior to the end of the term.

4.2 Non-Subscription Services

The County shall pay Contractor for satisfactorily complete Non-Subscription Services at the rates set forth on Schedule 3.2.

4.3 Reimbursable Expenses

OPTION 1: County will not reimburse Contractor for any expenses under this Contract.

OPTION 2: County will reimburse Contractor for the following expenses incurred only when the expenses are essential to the discharge of, and within the course and scope of, Contractor’s obligations under this Contract.

4.4 Annual Compensation Limit

The total compensation payable to Contractor for Services under this Contract shall not exceed $[Contract Value] without a written amendment signed by authorized representatives of both parties.

4.5 Invoicing, Payment Terms

Contractor shall invoice the County annually in advance for charges due and payable for Subscription Services, and no more frequently than monthly in arrears for charges due and payable for Non-Subscription Services. The County shall pay approved invoices within thirty

(30) days of receipt of invoice. Contractor shall include the Contract number provided by the County on all requests for payments and shall submit invoices to:

Marion County Attn: [insert Dept Name] Department, [NAME]

[Address] Salem, OR 9730X

SECTION 5: NOTICE

Except as otherwise expressly provided in this contract, any communications between the parties hereto or notices to be given hereunder shall be given in writing, to Contractor or County at the address or number set forth below or to such other addresses or numbers as either party may hereafter indicate in writing. Delivery may be by personal delivery, or mailing the same, postage prepaid.

5.1 Any communication or notice by personal delivery shall be deemed delivered when actually given to the designated person or representative.

5.2 Any communication or notice mailed shall be deemed delivered five (5) days after mailing. Any notice under this Contract shall be mailed by first class postage delivered to:

To Contractor:

[name] [address] [city, state zip]

To County:

Procurement & Contracts Manager 555 Court Street NE, Suite 4247 Salem, OR 97301

SECTION 6: CONTRACT PERSONNEL

6.1 Project Managers

All correspondence related to the Services shall be directed to the Project Manager for the party to whom the correspondence or notice is intended. Whenever this Contract requires the consent of a party, the consent must be given in writing by the Project Manager or the Project Manager's designee. Any change in Contractor’s project manager must comply with the Key Persons Section of this Contract.

County Project Manager:

[Name] Phone: [###-###-####] e-mail: [email address]

Contractor Project Manager:

[Name] Phone: [###-###-####] Email: [email address]

6.2 Key Persons

Contractor acknowledges and agrees that the County selected Contractor in part due to, and is entering into this Contract in part because of, the special qualifications of certain “Key Persons” identified below in this section. Under this Contract, the County is engaging the expertise, experience, judgment, and personal attention of such Key Persons. Neither Contractor nor any of the Key Persons shall delegate performance of the management powers and responsibilities such Key Person is required to provide under this Contract to another employee of Contractor unless the County provides written consent to such delegation. Contractor shall not re-assign or transfer a Key Person to other duties or positions such that the Key Person is no longer available to provide the County with such Key Person’s services unless the County provides written consent to such reassignment or transfer. In the event Contractor requests the County to consent to a delegation, reassignment, or transfer of a Key Person, or in the event the Key Person is no longer employed by Contractor, the County may interview and review the qualifications of the substitute personnel prior to providing the County’s consent or rejecting such replacement. Any such replacement shall have substantially equivalent or better qualifications than the Key Person being replaced. Contractor shall not charge the County and the County shall not pay for any replacement personnel while such replacement acquires the necessary orientation to proceed with the Services. Any substitute personnel approved by the County shall thereafter be deemed a Key Person for purposes of this Contract.

Name Position

[name] [position]

6.3 Contractor's Staff

Contractor shall provide adequate staff to complete the Services in the time frames set forth in this Contract. In the event that a Contractor employee assigned to perform Services for the County under this Contract is subsequently found to be unqualified or reasonably determined by the County not to perform Services in a professional manner, the County shall notify Contractor of the details regarding such conduct and Contractor shall either remove such employee from all responsibilities hereunder or promptly seek a resolution under the Dispute Resolution Section.

SECTION 7: ACCEPTANCE TESTING

7.1 Right to Perform Acceptance Testing

Prior to accepting the Deliverables, the County may perform Acceptance Testing. Contractor shall cooperate with the County in the development of Acceptance Criteria and the Acceptance Test plan that shall codify and set forth the location, date, and other specifications of Acceptance Testing. Acceptance Criteria and the Acceptance Test plan for Subscription Services shall be incorporated into the attached Schedule 3.1.

7.2 Procedure and Timetable

Unless otherwise specified:

7.2.1 The County shall commence Acceptance Testing no later than fifteen (15) days after test launch of the SaaS Application;

7.2.2 Contractor shall provide, at no additional cost, reasonable and appropriate support, assistance, and consultation regarding the Deliverables in order to facilitate Acceptance Testing; and

7.2.3 Acceptance Testing shall not exceed thirty (30) days, and the County will make all reasonable efforts to complete Acceptance Testing within the time period specified. If Acceptance Testing is successful, the County shall issue an Acceptance Certificate substantially in the form attached as Schedule 7.2.3.

7.3 Failure of Acceptance Test

The County will notify Contractor if a Deliverable or a portion of a Deliverable fails to pass an Acceptance Test, and will specify in reasonable detail the identified failures. After the County’s notification, Contractor shall correct the Deliverable, or the affected portion, within ten (10) days and will notify the County that the correction has been completed. After Contractor’s correction notification, the County shall perform a second Acceptance Test. If a Deliverable or a portion of a Deliverable fails to pass the second Acceptance Test, the County shall notify Contractor in writing, and the County may, in its sole discretion:

a. terminate the Contract with no further liability;

b. require Contractor to replace the Deliverable or defective portion of the Deliverable at no additional cost to the County;

c. require Contractor to make further corrections to prepare for retesting again;

d. accept the Deliverable at a reduced cost to be negotiated between the parties; or

e. issue an Acceptance Certificate entitled “Acceptance with Exception(s).”

7.4 Acceptance with Exception(s)

If the County issues an “Acceptance with Exception(s)” the County will list the exception(s) and the expected date for Contractor’s correction. If exceptions are corrected by the listed date(s) the County will commence further Acceptance Testing of the Deliverable or affected portion(s). If the system passes the Acceptance Tests, the County will issue an Acceptance Certificate.

7.5 Failure of Test

If a Deliverable fails a second Acceptance Test (or in the event of a single Acceptance Test, the Test) in no event shall there be an increase to the original price agreed to by the parties for the Deliverable.

7.6 County Acceptance of Failure

If the County elects to accept the Deliverable even with a failure(s), then the County may request that Contractor issue a refund to the County in an amount equal to a percentage of the full fee value of the Deliverable that the parties mutually determine represents the loss of functionality of the Deliverable.

7.7 Revocation of Acceptance

The County may revoke Acceptance if a defect in the Deliverable constitutes a Material Breach of this Contract and the County granted a conditional Acceptance based on Contractor’s commitment to correct the defect within a reasonable period of time, but it has not been so corrected. The County may also revoke Acceptance if the County accepted the Deliverable without discovery of the defect, and the Acceptance was reasonably induced by Contractor’s assurances or by the difficulty of discovery of the defect before Acceptance. Revocation is effective only if it occurs within a reasonable time after the County discovers or should have discovered the reasons for revocation.

7.8 Termination Based on Failure of Acceptance

If the Deliverable fails to pass the Acceptance Test(s), the County may terminate this Contract.

Contractor shall refund all costs paid for the Deliverable in U.S. Dollars within fifteen (15) calendar days. The refund shall be in cash or its equivalent and not in the form of future credits from Contractor.

7.9 No Waiver

Acceptance shall not relieve Contractor from its responsibility under any warranty. Payment for a Deliverable does not constitute Acceptance nor does it constitute a waiver of any warranty applicable to the County.

SECTION 8: RIGHT TO USE, OWNERSHIP AND LICENSE

8.1 Right to Use

Contractor grants the County an unlimited, transferable, non-exclusive right to access and use the Services.

8.2 License

Contractor retains ownership of all Contractor Intellectual Property that Contractor delivers to the County pursuant to the Services performed. Contractor grants the County a license to use all other Contractor Intellectual Property. Unless otherwise stated in this Contract, Contractor grants the County a non-exclusive, irrevocable, royalty-free, world-wide license to use, copy, display, distribute, transmit and prepare derivative works of Contractor Intellectual Property, and to authorize others to do the same on the County’s behalf.

8.3 Work Product

Contractor owns all Work Product. Contractor grants the County a non-exclusive, irrevocable, royalty-free, world-wide license to use, copy, display, distribute, transmit and prepare derivative works of Work Product, and to authorize others to do the same on the County’s behalf.

8.4 Third Party Intellectual Property

Contractor shall secure on the County’s behalf, in the name of the County and subject to the County’s approval, a license to Third Party Intellectual Property sufficient to provide the Services and fulfill the business objectives identified in this Contract, and to authorize others to do the same on the County’s behalf.

8.5 County Data and County Intellectual Property

The County owns all County Data and County Intellectual Property provided to Contractor under the Contract. The County grants Contractor a non-exclusive, royalty-free, world-wide license to use, copy, display, distribute, transmit, and prepare derivative works of County Data and County Intellectual Property and background information only to fulfill the purposes of this Contract.

The County’s license to Contractor is limited to the term and confidentiality obligations of this Contract.

8.6 No Other Rights

Except as expressly set forth in this Contract, nothing shall be construed as granting to or conferring upon Contractor any right, title, or interest in any County Intellectual Property that is now owned or subsequently owned by the County. Except as expressly set forth in this Contract, nothing shall be construed as granting to or conferring upon the County any right, title, or interest in any Contractor Intellectual Property that is now owned or subsequently owned by Contractor.

SECTION 9: CONFIDENTIALITY AND INFORMATION SECURITY

9.1 Protected County Information

Protected County Information includes all non-public data and information, in written or other tangible form and in electronic or non-tangible form, whether or not designated as confidential, which is provided by the County to the Contractor or which the Contractor obtains as a result of performing this Contract, including without limitation: (a) all proprietary information of the County; (b) all information secured physically or logically through encryption or other technology; (c) all individual information, including name, address, email address, passwords, account numbers, financial information, demographic data, marketing data, credit data, or any other identification data; (d) Personal Information; (e) all information relating to a County employee’s compensation, benefits, employment history, performance, and other personally identifiable employee information; (f) PCI Data; (g) all information provided to the County by third parties which the County is obligated to keep confidential; (h) all information concerning the County’s research, engineering and development activities, data processing research and methods, marketing, merchandising, price data, cost data, suppliers and vendors, customers;

tenants and guests; (i) any other data which is made available to Contractor through the County Network and the operability and functionality of the County Network; (j) all information that reflects use of or interactions with a County Business Service, including without limitation its web sites, information concerning computer search paths, any profiles created or general usage data, cookies, tags or beacons; (k) any data otherwise submitted in the process of registering for a County Business Service, including its web sites and any data submitted during the course of using a County Business Service, including its web sites; (l) all information which is required to be kept confidential or secure by federal, state or local law, statute, regulation or ordinance, (m) all information that the County treats as confidential; and (n) all information that Contractor should reasonably know is confidential.

Notwithstanding subsection (i) immediately above, Protected County Information excludes any information that: (a) is or becomes part of the public domain through no act or failure to act on the part of Contractor; (b) is furnished to Contractor by a third party without restriction on disclosure, where such third party obtained such information and the right to disclose it to the receiving party without violation of any rights which the County may have in such information;

or (c) has been independently developed by Contractor, before or after the execution of this Contract, without violation of any rights which the County may have in such information

9.1.1 Nondisclosure; Use; Security Precautions

With respect to Protected County Information, Contractor shall:

a. not disclose, distribute, share, or otherwise transfer it, directly or indirectly, to any third party except as expressly provided in this Contract or as the County may expressly consent in writing;

b. use Protected County Information only in compliance with: (i) this Contract; (ii) the County’s then-current privacy policies; and (iii)all applicable laws (including without limitation applicable policies and laws related to spamming, privacy, and consumer protection);

c. use Protected County Information only as required to perform this Contract;

d. hold and maintain it in trust and confidence for the County’s benefit;

e. not copy, transmit, reproduce, summarize, quote or make any commercial or other use of it, except for the County’s benefit;

f. inform all persons having access to it of the confidential nature thereof and of Contractor’s obligations hereunder; and

g. take reasonable security precautions and such other actions as may be necessary to ensure that there is no use or disclosure of it in violation of this Contract.

9.1.2 Compelled Disclosures

To the extent required by applicable law or by lawful order or requirement of a court or governmental authority having competent jurisdiction over Contractor, Contractor may disclose Protected County Information in accordance with such law or order or requirement, subject to the following conditions: As soon as possible after becoming aware of such law, order or requirement and prior to disclosing Protected County Information pursuant thereto, Contractor will so notify the County in writing and, if possible, Contractor will provide the County notice not less than five (5) business days prior to the required disclosure. Contractor will use reasonable efforts not to release Protected County Information pending the outcome of any measures taken by the County to contest, otherwise oppose or seek to limit such disclosure by Contractor and any subsequent disclosure or use of Protected County Information that may result from such disclosure. Contractor will cooperate with and provide assistance to the County regarding such measures. Notwithstanding any such compelled disclosure by Contractor, such compelled disclosure will not otherwise affect Contractor’s obligations hereunder with respect to Protected County Information so disclosed.

[BUYER: Remove the following subsection entitled “Protection of Personal Information under the Oregon ID Theft Act” if Contractor Personnel will not perform any Services relating to Personal Information for or on behalf of the County. Consult with the IT Security Analyst as needed to determine applicability.

9.1.3 Protection of Personal Information under the Oregon ID Theft Act Contractor shall comply with all data protection obligations of the Oregon ID Theft Act, including the encryption of Personal Information in transit and at rest using the following standards:

File Transmission and Encryption: Contractor will consult with County IT staff to approve an appropriate method for transmission and encryption of one or more source files containing Personal Information (each, a “Source File”) to and/or from the County or any other recipient. At minimum, the approved method of transmission and encryption of Source Files will consist of: encryption in transit (e.g. secure file transfer protocol), encryption at rest (e.g.

PGP); and the use of strongest feasible industry-standard non-deprecated encryption ciphers.

a. Wireless Networks Personal Information shall be encrypted when transmitted over any wireless network.

b. Data Storage

• Internet-facing Systems. Personal Information shall be encrypted when stored on any equipment or a device capable of communicating by means of the internet through a modem or other device using an applicable data protocol, such as TCP/IP or similar communications protocol. Source Files and other files containing Personal Information shall be removed as soon as possible.

• Portable and Mobile Devices. Personal Information shall not be stored on any Portable device (e.g. laptop or tablet) or any mobile device (e.g., smartphone or e-reader).

• Backup Files. Backup files containing Personal Information that are transported or stored outside of Contractor’s control shall be encrypted. END SECTION]

[BUYER: Remove the following subsection entitled “Protection of PCI Data”, and the PCI-related definitions above, if Contractor Personnel will not perform any Services relating to credit card processing by or on behalf of the County. Consult with IT Security Analyst as needed to determine applicability.

9.1.4 Protection of PCI Data

Contractor acknowledges that Contractor is responsible for the security of County PCI Data to the extent that: (i) Contractor possesses or otherwise stores, processes, or transmits County PCI Data on the County’s behalf; or (ii) Contractor could impact the security of the County’s cardholder data environment. Contractor represents and warrants that Contractor understands all requirements for handling County PCI Data in compliance with PCI Security Standards. Contractor shall comply with all such requirements. Contractor will achieve and maintain PCI DSS compliance against the current version of the PCI DSS and will deliver to the County, when requested, a current attestation of such compliance issued by a PCI Qualified Security Assessor. END SECTION]

[BUYER: Remove the following subsection entitled “Protection of Protected Health Information under the Health Insurance Portability and Accountability Act” if Contractor Personnel will not perform any Services relating to PHI for or on behalf of the County. Consult with the IT Security Analyst as needed to determine applicability.

9.1.5 Protection of Protected Health Information under the Health Insurance Portability and Accountability Act Contractor acknowledges that Contractor is responsible for the security of County PHI Data to the extent that: (i) Contractor possesses or otherwise stores, processes, or transmits County PHI Data on the County’s behalf; or (ii) Contractor could impact the security of the County’s PHI data environment. Contractor represents and warrants that Contractor understands all requirements for handling County PHI Data in compliance with the HIPAA Privacy Rule.

Contractor shall comply with all such requirements. Contractor will achieve and maintain HIPAA compliance, when requested, a current attestation of such compliance issued by a HIPAA Qualified Assessor. END SECTION]

9.1.6 Breach of Security Reporting and Remediation

In the event of a Breach of Security that applies to Protected County Information, Contractor shall immediately report the Breach of Security to the County project manager and cooperate closely with the County in the investigation, reporting, remediation and resolution of the Breach of Security. Contractor shall comply with the breach reporting obligations of the Oregon ID Theft Act and all applicable federal or state privacy or data protection statutes, rules, or regulations governing the County and the Services; provided, however, that prior to giving notice under the Oregon ID Theft Act or any other applicable reporting requirement, Contractor shall first notify the County’s project manager under this Contract, and in any event, Contractor’s notice to the County shall occur within 24 hours of Contractor’s discovery of the breach. The County must approve the form of any notices sent by the Contractor to affected individuals or to the public.

Contractor will also promptly report to the County project manager (but in no event more than twenty-four (24) hours after the occurrence) any Breach of Security or unauthorized access to Contractor’s systems that Contractor detects or becomes aware of, whether or not such breach rises to a reportable level under the Oregon ID Theft Act or any other applicable reporting requirement, and whether or not the breach resulted in the loss of Protected County Information. Reportable incidents under this subsection include, without limitation, instances in which an individual accesses Contractor’s systems in excess of the individual’s user rights, or uses the systems inappropriately.

Reports under this subsection must be made by telephone and subsequently via e-mail and any other delivery requirement for giving notices under the Contract. The report shall include the approximate date and time of the occurrence and a summary of the relevant facts, including a description of measures being taken to address the occurrence.

Contractor will use diligent efforts to remedy any Breach of Security that applies to Protected County Information or other breach of security or unauthorized access in a timely manner, and will deliver to the County a root cause assessment and future incident mitigation plan with regard to any such breaches or unauthorized access.

9.1.7 No Retention

Contractor will not gather, store, log, archive, use or otherwise retain any Protected County Information for any period longer than necessary for Contractor to fulfill its obligations under this Contract. As soon as Contractor no longer needs to retain Protected County Information in order to perform its duties under this Contract, Contractor will promptly return or destroy or erase all originals and copies of such Protected County Information in accordance with Section 9.4.

[BUYER: Remove the following Section entitled “USE OF THE COUNTY NETWORK” if Contractor will not have any County Network user accounts. Consult with the IT Security Analyst as needed to determine applicability.

9.2 Use of the County Network

9.2.1 Access; Use

All access by Contractor to the County Network, and all password and login information, is subject to the County’s access guidelines and may be set forth in a County network access policy provided to Contractor. The County does not warrant that the County Network will be operational, and the fact that the County Network is not operational at any given time shall not constitute a defense to Contractor's nonperformance; provided, however, that delay in delivery of any Services will be excused by a period of time equal to the time during which the County Network is non-operational, to the extent that such delay was caused solely by Contractor's inability to access the County Network. Contractor releases and discharges the County from all liability of any nature whatsoever arising out of Contractor's use of or reliance on the County Network.

9.2.2 Notice to Terminate Network User Accounts

To enable the County to timely terminate access to the County Network by former users, Contractor will notify the County IT Helpdesk by e-mail (appropriate email address for Help Desk) within 24 hours from any event after which an individual Contractor Personnel no longer requires access to the County Network, including without limitation: (i) any separation of employment (including without limitation termination, layoff, and resignation);

or (ii) any removal from or completion of duties requiring access to the County Network.

9.2.3 Use of Third-Party Software

Contractor understands that the County must perform due diligence before allowing individuals other than County employees to use the County Network; and in particular, before allowing non-employees to access software products which have been licensed to the County by third parties. Contractor further understands that, in the event that Contractor Personnel use the County Network, the County must know which software products they will be using on the County Network, so that the County can ensure that such use is authorized under agreements with third party software licensors. Contractor will provide the County with a list of the third party software products, if any, that Contractor believes it must use on the County Network in order to perform the Services. Upon receiving such information from Contractor the County will inform Contractor whether or not the County has the right to authorize such use. END SECTION]

[BUYER: Remove the following Section entitled “REMOTE ACCESS TO THE COUNTY NETWORK; OFF-SITE STORAGE OF PROTECTED COUNTY INFORMATION” if no Contractor Personnel will remotely access the County Network and Contractor will not store Protected County Information on Contractor systems. If instead either remote network access or remote storage of Protected County Information will occur, then retain this Section in full.

9.3 Remote Access to the County Network; Off-Site Storage of Protected County Information

9.3.1 Minimum Standards

This section sets forth information security procedures to be established by Contractor before the Effective Date of this Contract and maintained throughout the term of engagement.

These procedures are in addition to the requirements of the Contract and present a minimum standard only. However, it is Contractor’s sole obligation to: (i) implement appropriate measures to secure its systems and data, including Protected County Information, against internal and external threats and risks; and (ii) continuously review and revise those measures to address ongoing threats and risks. Failure to comply with the minimum standards set forth in this section will constitute a material, non-curable breach of the Contract by Contractor, entitling the County, in addition to and cumulative of all other remedies available to it at law, in equity, or under the Contract, to immediately terminate the Contract.

9.3.2 Unauthorized Access to the County Network or Protected County Information Contractor shall not access, and shall not permit Contractor Personnel, to access the County Network or Protected County Information without the County’s express written authorization. The County may revoke such written authorization subsequently at any time in its sole discretion. Further, any access shall be consistent with, and in no case exceed the scope of, any such authorization given by the County. All County-authorized connectivity or attempted connectivity to the County Network or Protected County Information shall be only through the County’s security gateways and/or firewalls, and in conformity with applicable County security policies.

9.3.3 Contractor Information Security Policy

Contractor shall establish and maintain a formal, documented, mandated, Contractor-wide information security program, including security policies, standards and procedures (collectively “Contractor’s Information Security Policy”). Contractor must communicate Contractor’s Information Security Policy to all Contractor Personnel in a relevant, accessible, and understandable form, and regularly review and evaluate it to ensure its operational effectiveness, compliance with all applicable laws and regulations, and to address new threats and risks.

9.3.4 Communications and Operational Management

Contractor shall: (i) monitor and manage all of its information processing facilities, including without limitation implementing operational procedures, change management and incident response procedures; (ii) deploy adequate back-up facilities to ensure that essential business information can be promptly recovered in the event of a disaster or media failure; and (iii) ensure its operating procedures will be adequately documented and designed to protect information, computer media, and data from theft and unauthorized access.

9.3.5 Removable Media

Except in the context of Contractor’s routine back-ups or as otherwise specifically authorized by the County in writing, Contractor shall institute strict physical and logical security controls to prevent transfer of Protected County Information to any form of Removable Media. Additional Removable Media requirements are set forth in the following subsection.

9.3.6 Data Control; Media Disposal and Servicing

Protected County Information: (i) may only be made available and accessible to those parties explicitly authorized under the Contract or otherwise expressly by the County in writing; (ii) if transferred across the Internet, any wireless network (e.g., cellular, 802.11x, or similar technology), or other public or shared networks, must be protected using appropriate cryptography as designated or approved by the County in writing; and (iii) if transferred using Removable Media must be sent via a bonded courier or protected using cryptography designated or approved by the County in writing. The foregoing requirements shall apply to back-up data stored by Contractor at off-site facilities. In the event any hardware, storage media, or Removable Media must be disposed of or sent off-site for servicing, Contractor shall ensure all Protected County Information has been “scrubbed” from such hardware and/or media using methods at least as protective as the DoD 5220-22-M Standard unless otherwise approved in writing by the County.

9.3.7 Contractor Facilities Security

Contractor facilities that process Protected County Information will be housed in secure areas and protected by perimeter security (e.g., appropriate alarm systems, the use of guards and entry badges, video surveillance, staff egress searches) that provide a physically secure environment from unauthorized access, damage, and interference.