The Parties to this Contract are the State of Illinois acting through the undersigned Agency (the “State”) and Vendor. This Contract, consisting of the signature page and numbered sections listed below and any attachments referenced in this Contract, constitute the entire Contract between the Parties concerning the subject matter of the Contract, and in signing the Contract, the Vendor affirms that the Certifications and if applicable the Financial Disclosures and Conflicts of Interest attached hereto are true and accurate as of the date of the Vendor’s execution of the Contract. This Contract supersedes all prior proposals, contracts and understandings between the Parties concerning the subject matter of the Contract. This Contract can be signed in multiple counterparts upon agreement of the Parties.

Contract includes BidBuy Purchase Order? (The Agency answers this question prior to Contract filing.)

☐ Yes ☐ No Contract uses Illinois Procurement Gateway Certifications and Disclosures?

☐ Yes (IPG Certifications and Disclosures including IPG Active Registered Vendor Disclosure (formerly named Forms B)) ☐ No

1. DESCRIPTION OF SUPPLIES AND SERVICES

2. PRICING

3. TERM AND TERMINATION

4. STANDARD BUSINESS TERMS AND CONDITIONS

5. SUPPLEMENTAL PROVISIONS

6. ATTACHMENTS

In consideration of the mutual covenants and agreements contained in this Contract, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree to the terms and conditions set forth herein and have caused this Contract to be executed by their duly authorized representatives on the dates shown on the following CONTRACT SIGNATURES page.

STATE OF ILLINOIS

INFORMATION AND TECHNOLOGY CONTRACT

Illinois Department of Innovation and Technology SMS & Voice Multi-Factor Authentication

26-448DOIT-SEC44-B-52896

State of Illinois Chief Procurement Office for General Services Information and Technology Contract V.26.1

VENDOR

Email: Click here to enter text.

Date:

STATE OF ILLINOIS

Email: DoIT.ITPO.Communications@illinois.gov

Printed Name: Brandon Ragle

Official’s Title: Secretary, State CIO

Legal Printed Name: Radhika Lakhani

Legal’s Title: General Counsel

Fiscal’s Printed Name: Mary Feagans

Fiscal’s Title: Chief Fiscal Officer

State of Illinois IFB Contract: Description of Supplies and Services V. 14.1

AGENCY USE ONLY NOT PART OF CONTRACTUAL PROVISIONS

· Agency Reference #: 26-448DOIT-SEC44-R-307443

· Project Title: SMS & Voice Multi-Factor Authentication

· Contract #:

· Procurement Method (IFB, RFP, Small Purchase, etc.): IFB

· BidBuy / Bulletin Reference #: 26-448DOIT-SEC44-B-52896

· BidBuy / Bulletin Publication Date:

· Award Code:

· Subcontractor Utilization? |_| Yes |_|No Subcontractor Disclosure? |_| Yes |_|No

· Funding Source:

· Obligation #:

· Other Preferences?

State of Illinois Chief Procurement Office for General Services Information and Technology Contract V.26.1

1. DESCRIPTION OF SUPPLIES AND SERVICES

1.1. GOAL: The Illinois Department of Innovation and Technology (“DoIT,” “Agency,” or “State”) is establishing a contract with the Vendor to provide outbound Short Message Service (“SMS”) and automated Voice call delivery services (collectively, the “Messaging Service”) used to support multi‑factor authentication (MFA) for State systems and to support Agency‑authorized outbound notifications to end users. The Messaging Service will be made available for use by State-supported systems and operated in accordance with this Contract’s specifications, service levels, and statutory requirements.

In recent years, the State’s usage of outbound authentication messaging has averaged approximately 2.5 million SMS messages and 60,000 voice minutes per month. This information is provided for context to assist the Vendor in planning capacity, scalability, and pricing assumptions and does not constitute a guaranteed minimum or maximum volume.

1.2. SUPPLIES AND/OR SERVICES REQUIRED: The Vendor shall provide a fully managed Messaging Service that delivers outbound SMS messages and automated Voice calls required to support the State’s multi‑factor authentication processes and other Agency‑approved outbound notifications. The service shall operate reliably at the volumes required by the Agency and must support timely delivery of authentication codes and other messages initiated through the Agency’s Authentication Services Provider. The Vendor shall provide a fully documented and supported API that enables Agency applications to send SMS and Voice messages and shall furnish all technical materials, training, and assistance necessary for Agency staff to use and maintain the integration.

The Vendor shall:

1.2.1 Complete all work required to transition the Agency from its current messaging provider, including any configuration, testing, and coordination/ cooperation with Agency and Authentication Provider personnel. Vendor shall work with the Agency to develop a Statement of Work that will encompass the full transition, User Acceptance Testing and Go-Live of the new solution.

1.2.2 Provide technical and client support, complete training for staff including documentation and reference material, available in electronic format, for any solution.

1.2.3 Schedule maintenance to minimize disruption to the State and its customer. Scheduled maintenance must be performed between 2:00 a.m. – 3:00 a.m. (CST) each Monday, or at such times as agreed to by State and Offeror, with no more than six (1) hour per week scheduled maintenance.

The Messaging Service shall:

1.2.4 Be compatible with Agency’s current Authentication Services Provider (Okta) so it can deliver a message that contains a code that can be used by end users to log into systems.

1.2.5 Submit messages to carriers within five (5) seconds of request, and will attempt redelivery three (3) times before reporting the failure to the Agency’s Authentication Services Provider (Okta) for resolution.

1.2.6 Include administrative, technical, and automated controls to prevent unauthorized use, detect and respond to suspected misuse of the messaging service; detect, alert, and respond to suspected misuse or anomalous activity; and provide the Agency with reporting and monitoring capabilities necessary to manage consumption and prevent unanticipated charges.

1.2.7 Include controls to prevent abuse of the service including, but not limited to, use of the Messaging Service by unauthorized individuals, use of service to communicate with numbers that result in additional charges, sending to blacklisted numbers, and volumetric related abuse.

1.2.8 Scale to support current and future messaging volumes and that all messaging activities comply with applicable laws, regulations, and State requirements, including but not limited to the Telephone Consumer Protection Act (TCPA), the CAN‑SPAM Act, the Illinois Automatic Telephone Dialers Act, and the Illinois Consumer Fraud and Deceptive Business Practices Act.

1.2.9 Host the Messaging Service in a Vendor‑maintained cloud environment that complies with all State of Illinois Cloud Security Requirements as detailed in the attached Cloud Hosting Appendix, and ensure that all components of the service, including associated data, are not stored, maintained, or accessed outside locations approved by the State.

1.2.10 Provide high availability, ensuring Messaging Service remains available for use at all times, including during times of scheduled maintenance.

1.2.11 Comply with the Illinois Information Technology Accessibility Act (“IITAA”) (see: http://www.illinois.gov/iwas ) as well as accessibility requirements that apply to Federal agencies under (the amended) Section 508 of the Rehabilitation Act of 1973. Offeror must test its system and courseware for such compliance. Should compliance with any provision of those standards (Section 508 and IITAA) not be practical or feasible, the vendor must identify and describe the problem and propose a solution acceptable to the State. Vendor must test its system for compliance with Section 508 requirements and IITAA and provide results of such testing to the State in advance of implementation of the system.

1.2.12 Treat the content of SMS messages as confidential, including considering the authentication code itself as a password which should be delivered to the recipient but not be logged nor displayed as part of the service.

For procurements conducted in BidBuy, the State may include in this Contract the BidBuy Purchase Order as it contains the agreed Supplies and/or Services.

1.3. SERVICE LEVEL AGREEMENT

1.3.1. Scope

This SLA applies to all SMS and automated Voice call delivery services (“Messaging Service”) provided under this Contract.

1.3.2. Service Availability & Performance

1.3.2.1. System Uptime Commitment

1.3.2.2. Performance Requirements

· Messages will be successfully delivered to recipients on the first attempt 95% of the time. “Successful delivery” is defined as the recipient receiving the code and successfully completing the multi-factor authentication step using the code which was provided via voice or SMS delivery.

· The Vendor shall maintain adequate network capacity to support expected volumes (currently averaging approximately 2.5 million SMS messages and 60,000 voice minutes per month).

1.3.3. Maintenance & Downtime Management

1.3.3.1. Scheduled Maintenance

Scheduled maintenance shall be performed between 2:00 a.m. and 3:00 a.m. CST each Monday, or at another time mutually agreed upon by the State and Vendor.

1.3.3.2. Unscheduled Downtime

1.3.4. Incident Management & Support

1.3.4.1. Support Tiers & Response Times

1.3.4.2. Escalation Procedures

1.3.5. Security & Compliance

1.3.5.1. Security Compliance

• The Vendor shall comply with all Security Requirements defined in this Contract, including but not limited to the requirements specified in the State Cloud Appendix in section 5.1 and the Contract’s Security Requirements in section 4.31. These obligations include mandatory State and Federal security, privacy, compliance, auditing, and hosting requirements applicable to the Messaging Service. Nothing in this SLA modifies or limits the Vendor’s responsibilities under those sections.

1.3.5.2. Disaster Recovery

• Disaster recovery testing must occur at least once per year, ensuring full system restoration within 2 hours of a catastrophic failure.

1.3.6. Penalties & Remedies

If the provider fails to meet SLA commitments, the following penalties apply:

· Downtime Penalties: Credits will be applied based on system unavailability beyond the 99.9% threshold.

· For each 0.1% below 99.9%, apply a service credit equal to 2% of monthly fees

· If uptime falls below 98%, apply an additional 10% penalty for that month

· First-Attempt Delivery Failure Penalties: Credits will be applied based on failure of recipients to successfully authenticate using code delivered in messages on the first attempt 95% of the time.

· If less than 95% of messages are delivered on the first attempt, a 2% credit will be applied per percentage point below the target.

· Performance Breaches

· If response times exceed agreed limits for three consecutive months, corrective action plans must be submitted. If average response time exceeds 2 seconds by more than 0.5 seconds, 1% of monthly fees per 0.5-second increment.

1.4. MILESTONES AND DELIVERABLES:

Milestones and deliverables for the Messaging Service will be established by the Agency and the Vendor as needed during implementation and throughout the term of the Contract. The Vendor shall complete all configuration and transition activities required to replace the Agency’s existing messaging provider and shall ensure full operational availability of the Messaging Service by the implementation date designated by the Agency. The Vendor shall provide all documentation, training, and technical materials necessary for successful integration with Agency systems, and shall furnish ongoing reporting, monitoring outputs, and service-related updates upon request. Additional deliverables or timeline requirements may be set by the Agency on a per‑project or per‑task basis once the Contract is in place.

The Vendor shall provide Quarterly SLA Performance Reports summarizing system availability, message delivery performance, incident activity, security‑related events, and any SLA deviations for the preceding quarter. These reports must be submitted to the State within thirty (30) calendar days after the end of each calendar quarter, unless otherwise agreed to in writing by the State.

• Data classification and system categorization submitted

• Information Security Risk Assessment process begins

• System Security Plan development begins

• System Security Plan submitted

• System Operation Controls report (SOC 2 type 2) submitted

• System Operation Controls report (SOC 2 type 2) approved

• Certify compliance with security Policies, Procedures, and Standards

• Certify adherence to minimum security baseline (NIST 800-53r5)

• Pre-activation configuration and testing begin

• Reporting and monitoring capabilities testing begins

• Reporting and monitoring capabilities testing complete

1.5. SUBCONTRACTING

Subcontractors are allowed.

1.5.1. Will subcontractors be utilized? |_| Yes |_| No

A subcontractor is a person or entity that enters into a contractual agreement with a total value of $100,000 or more with a person or entity who has a contract subject to the Illinois Procurement Code pursuant to which the person or entity provides some or all of the goods, services, real property, remuneration, or other monetary forms of consideration that are the subject of the primary State contract, including subleases from a lessee of a State contract.

All contracts with subcontractors where the annual value of the subcontract is greater than $50,000 must include Standard Illinois Certifications completed by the subcontractor.

1.5.2. Please identify below subcontracts with an annual value of $100,000 or more that will be utilized in the performance of this Contract, the names and addresses of the subcontractors, and a description of the work to be performed by each.

· Subcontractor Name: Click here to enter text Amount to Be Paid: Click here to enter text Address: Click here to enter text Description of Work: Click here to enter text

· Subcontractor Name: Click here to enter text Amount to Be Paid: Click here to enter text Address: Click here to enter text Description of Work: Click here to enter text If additional space is necessary to provide subcontractor information, please attach an additional page

1.5.3. All contracts with the subcontractors identified above must include the Standard Illinois Certifications completed.

1.5.4. If the annual value of any the subcontracts is more than $100,000, then Vendor must provide to the State the Financial Disclosures and Conflicts of Interest for that subcontractor.

1.5.5. If at any time during the term of this Contract, Vendor adds or changes any subcontractors, Vendor is required to promptly notify, in writing, the State Purchasing Officer or the Chief Procurement Officer of the names and addresses and the expected amount of money that each new or replaced subcontractor will receive pursuant to this Contract. Any subcontracts entered into prior to award of this Contract are done at the sole risk of Vendor and subcontractor(s).

1.6. SUCCESSOR VENDOR

|_| Yes |_| No Contract is for services subject to 30 ILCS 500/25-80. Heating and air conditioning service contracts, plumbing service contracts, and electrical service contracts are not subject to this requirement. Non-service contracts, construction contracts, qualification-based selection contracts, and professional and artistic services contracts are not subject to this requirement.

If yes is checked, then Vendor certifies:

(i) that it shall offer to assume the collective bargaining obligations of the prior employer, including any existing collective bargaining agreement with the bargaining representative of any existing collective bargaining unit or units performing substantially similar work to the services covered by the Contract subject to its bid or offer; and

(ii) that it shall offer employment to all employees currently employed in any existing bargaining unit who perform substantially similar work to the work that will be performed pursuant to this Contract.

1.7. WHERE SERVICES ARE TO BE PERFORMED: Unless otherwise disclosed in this section all services shall be performed in the United States. If Vendor performs the services purchased hereunder in another country in violation of this provision, such action may be deemed by the State as a breach of the Contract by Vendor.

Vendor shall disclose the locations where the services required shall be performed and the known or anticipated value of the services to be performed at each location. If Vendor received additional consideration in the evaluation based on work being performed in the United States, it shall be a breach of Contract if Vendor shifts any such work outside the United States.

· Location where services will be performed: Click here to enter text Value of services performed at this location: Click here to enter text

2. PRICING

2.1 FORMAT OF PRICING:

2.1.1 Pricing for this Contract shall be as follows.

2.2 TYPE OF PRICING: The Illinois Office of the Comptroller requires the State to indicate whether the Contract price is firm or estimated at the time it is submitted for obligation. The total price of this Contract is firm.

2.3 EXPENSES ALLOWED: Expenses are not allowed.

2.4 VENDOR’S PRICING: Vendor’s pricing is located in the Items Tab in the BidBuy Purchase Order. The State includes in this contract the BidBuy Purchase Order as it contains the agreed pricing.

2.5 RENEWAL COMPENSATION: If the contract is renewed, the price shall be at the same rate as the final year of the initial contract term, unless a different compensation or formula for determining the renewal compensation is stated in this section.

After the initial 3-year contract term, there is an option for a 2-year renewal.

Agency Formula for Determining Renewal Compensation will be based upon CPI and determined as follows:

2.5.1 One upward price adjustment may be applied no more frequently than once during any given one-year period during the renewal term. Such adjustment shall be based on the Consumer Price Index for All Urban Consumers as posted by the U.S. Bureau of Labor Statistics.

The below equation shall be used to calculate the allowable price increase:

A= B * (1 + ((C-D)/D))

A- New Price B- Base Price at Bid C- Published CPI at the time of requested adjustment D- CPI value at Bid Opening date

2.5.2 All adjustment requests shall be made in writing. Vendor shall not be entitled to apply an upward price adjustment without first obtaining approval of such request from the Department of Innovation and Technology Information Technology Procurement Office (ITPO).

2.5.3 In the event a downward adjustment is warranted, the State reserves the right to adjust once during any given twelve (12) month period for this decrease. It will be the responsibility of the vendor to notify ITPO of any such decrease.

2.5.4 No further adjustments will be made once the maximum allowable adjustment has been calculated for the given one year period.

2.5.5 An economic adjustment which is not based on the CPI may be requested by the Vendor or the State to the price of all Contract Line Items. The State may, in its sole discretion, accept an equitable adjustment in the Contract terms or pricing if pricing or availability of supply is affected by extreme and unforeseen volatility in the marketplace, that is, by circumstances that satisfy all the following criteria: (1) the volatility is due to causes wholly beyond the Vendor’s control, (2) the volatility affects the marketplace or industry, not just the particular Contract source of supply, (3) the effect on pricing or availability of supply is substantial, (4) the volatility so affects the Vendor that continued performance of the Contract would result in a substantial loss and (5) No price adjustment will be approved to compensate a vendor for inefficiency or for errors or omissions in judgment or for additional profit or overhead of any kind.

2.5.6 Requested adjustments shall include the contract number, item number, line number, bid price and requested price adjustment.

2.5.7 In all cases, the vendor must file a claim in writing for such adjustment prior to the services being performed or delivery of items. In any event, the claim for such adjustment will not apply to release orders provided prior to the date the ITPO approved the economic adjustment request.

2.5.8 If the Vendor has unresolved complaints filed against it for non-delivery of or poor-quality service, its request may be denied until such time as all past complaints are resolved to the satisfaction of the State.

MAXIMUM AMOUNT: The total payments under this Contract and all renewal options shall not exceed $Click here to enter text without a formal amendment.

Information and Technology Contract V. 26.1

3. TERM AND TERMINATION

3.1 TERM OF THIS CONTRACT: This contract will have an initial term commencing upon execution for three (3) years. In no event will the maximum total term of the contract, including the initial term, any renewal terms, and any extensions, exceed ten (10) years.

For procurements conducted in BidBuy, the State may include in this Contract the BidBuy Purchase Order as it contains the agreed term.

3.1.1 In no event will the total term of this Contract, including the initial term, any renewal terms and any extensions, exceed (ten) 10 years pursuant to 30 ILCS 500/20-60.

3.1.2 Vendor shall not commence billable work in furtherance of the Contract prior to final execution of the Contract except when permitted pursuant to 30 ILCS 500/20-80.

3.1.3 In the event of a termination for cause of an order against this Contract, the State will be entitled to a pro-rata refund in the amount of the unused portion of any prepaid fees as determined by the State under the terminated order calculated as of the effective date of termination.

3.2 RENEWAL:

3.2.1. Any renewal is subject to the same terms and conditions as the original Contract unless otherwise provided in the pricing section. The State may renew this Contract for any or all of the option periods specified, may exercise any of the renewal options early, and may exercise more than one option at a time based on continuing need and favorable market conditions, when in the best interest of the State. The Contract may neither renew automatically nor renew solely at Vendor’s option.

3.2.2. Pricing for the renewal term(s), or the formula for determining price, is shown in the pricing section of this Contract.

3.2.3. The State reserves the right to renew for a total of two (2) years in any one of the following manners:

3.2.3.1 One renewal covering the entire renewal allowance;

3.2.3.2 Individual one-year renewals up to and including the entire renewal allowance; or

3.2.3.3 Any combination of full or partial year renewals up to and including the entire renewal allowance.

3.3 TERMINATION FOR CAUSE: The State may terminate this Contract, in whole or in part, immediately upon notice to Vendor if: (a) the State determines that the actions or inactions of Vendor, its agents, employees, or subcontractors have caused, or reasonably could cause, jeopardy to health, safety, or property, or (b) Vendor has notified the State that it is unable or unwilling to perform the Contract.

If Vendor fails to perform to the State’s satisfaction any material requirement of this Contract, is in violation of a material provision of this Contract, or the State determines that Vendor lacks the financial resources to perform the Contract, the State shall provide written notice to Vendor to cure the problem identified within the period of time specified in the State’s written notice. If not cured by that date the State may either: (a) immediately terminate the Contract without additional written notice or (b) enforce the terms and conditions of the Contract. Additional causes allowing for termination under this section include but are not limited to: failure to perform the services or deliver the goods within the time specified; failure to perform any other material requirement; failure to make sufficient progress so as to endanger performance; or any other breach of Contract. Vendor shall not be entitled to any anticipated profits or unearned compensation as a result of a termination for cause.

For termination due to any of the causes contained in this Section, the State retains its rights to seek any available legal or equitable remedies and damages. In the event the State covers a resulting loss by contracting with an alternate vendor, Vendor shall be liable for any difference in cost between this Contract price and the replacement price for the remaining term, as well as any other damages, including delay damages. Vendor shall be liable to the State for all reasonable costs incurred by the State in enforcing any provision of this Contract, including attorneys’ fees.

However, if, after termination, a court of competent jurisdiction determines that Vendor’s actions were excusable under this Contract, then the rights and obligations of the Parties shall be the same as if the termination had been issued as a Termination for Convenience. The State may, in its sole discretion and for its sole benefit, elect to exercise this right if it determines that it is in the best interest of the State.

3.4 TERMINATION FOR CONVENIENCE: The State may, for its convenience and with thirty (30) days’ prior written notice to Vendor, terminate this Contract in whole or in part and without payment of any penalty or incurring any further obligation to Vendor.

Upon submission of invoices and proof of claim, Vendor shall be entitled to compensation for supplies and services provided in compliance with this Contract up to and including the date of termination.

3.5 OTHER TERMINATION: The State may also terminate, in whole or in part, this Contract without advance notice pursuant to Section 3.7.

3.6 SUSPENSION: The State may also suspend, in whole or in part, this Contract without advance notice pursuant to Section 3.7.

3.7 AVAILABILITY OF APPROPRIATION: This Contract is contingent upon and subject to the availability of funds. The State, at its sole option, may terminate or suspend this Contract, in whole or in part, without penalty or further payment being required, if (1) the Illinois General Assembly or the federal funding source fails to make an appropriation sufficient to pay such obligation, or if funds needed are insufficient for any reason (30 ILCS 500/20-60), (2) the Governor or the Agency reserves funds, or (3) the Agency determines, in its sole discretion or as directed by the Office of the Governor, that a reduction is necessary or advisable based upon actual or projected budgetary considerations or available funds for payment. Vendor will be notified in writing of the failure of appropriation or of a reduction or decrease and the Agency’s election to terminate or suspend, in whole or in part, as soon as practicable. Any suspension or termination pursuant to this section will be effective upon the date of the written notice unless otherwise indicated.

Information and Technology Contract V.26.1

4. STANDARD BUSINESS TERMS AND CONDITIONS

4.1 PAYMENT TERMS AND CONDITIONS:

4.1.1 Payment: All payments, including late payment charges, will be paid in accordance with the State Prompt Payment Act and rules. 30 ILCS 540; 74 III. Adm. Code 900. This shall be Vendor’s sole remedy for late payments by the State. Payment terms contained on Vendor’s invoices shall have no force or effect.

4.1.2 Minority Contractor Initiative: Any Vendor awarded a contract of $1,000 or more under Section 20-10, 20-15, 20-25 or 20-30 of the Illinois Procurement Code (30 ILCS 500) is required to pay a fee of $15. The Comptroller shall deduct the fee from the first check issued to Vendor under the Contract and deposit the fee in the Comptroller’s Administrative Fund. 15 ILCS 405/23.9.

4.1.3 No Work Prior to Execution: The State will not pay for supplies provided or services rendered, including related expenses, incurred prior to the execution of this Contract by the Parties even if the effective date of the Contract is prior to execution.

4.1.4 Prevailing Wage: As a condition of receiving payment Vendor must (i) be in compliance with the Contract, (ii) pay its employees prevailing wages when required by law, (iii) pay its suppliers and subcontractors according to the terms of their respective contracts, and (iv) provide lien waivers to the State upon request. Examples of prevailing wage categories include public works, printing, janitorial, window washing, building and grounds services, site technician services, natural resource services, security guard and food services. The prevailing wages are revised by the Illinois Department of Labor and are available on the Illinois Department of Labor’s official website, which shall be deemed proper notification of any rate changes under this subsection. Vendor is responsible for contacting the Illinois Department of Labor at 217-782-6206 or (http://labor.illinois.gov) to ensure understanding of prevailing wage requirements.

4.1.5 Federal Funding: This Contract may be partially or totally funded with Federal funds. If Federal funds are expected to be used, then the percentage of the good/service paid using Federal funds and the total Federal funds expected to be used will be provided to the awarded Vendor in the notice of intent to award.

4.1.6 Invoicing: By submitting an invoice, Vendor certifies that the supplies or services provided meet all requirements of this Contract, and the amount billed and expenses incurred are as allowed in this Contract. Invoices for supplies purchased, services performed, and expenses incurred through June 30 of any year must be submitted to the State no later than July 31 of that year; otherwise, Vendor may have to seek payment through the Illinois Court of Claims. 30 ILCS 105/25. All invoices are subject to statutory offset. 30 ILCS 210.

4.1.6.1 Vendor shall not bill for any taxes unless accompanied by proof that the State is subject to the tax. If necessary, Vendor may request the applicable Agency’s Illinois tax exemption number and federal tax exemption information.

4.1.6.2 Vendor shall invoice at the completion of the Contract unless invoicing is tied in this Contract to milestones, deliverables, or other invoicing requirements agreed to in the Contract.

4.1.6.3 Vendor shall issue invoices separately for each order, with each invoice corresponding to a single order. Charges for multiple orders may not be combined into a single invoice.

Send invoices to:

For procurements conducted in BidBuy, the Agency may include in this Contract the BidBuy Purchase Order as it contains the Bill To address.

4.2 ASSIGNMENT: This Contract may not be assigned or transferred in whole or in part by Vendor without the prior written consent of the State.

4.3 SUBCONTRACTING: For purposes of this section, subcontractors are those with contracts with an annual value exceeding the small purchase maximum established under 30 ILCS 500/20-20 , and who are specifically hired to perform all or part of the work covered by this Contract. Vendor must receive prior written approval before use of any subcontractors in the performance of this Contract. Vendor shall describe, in an attachment if not already provided, the names and addresses of all authorized subcontractors to be utilized by Vendor in the performance of this Contract, together with a description of the work to be performed by the subcontractor and the anticipated amount of money that each subcontractor is expected to receive pursuant to this Contract. If required, Vendor shall provide a copy of any subcontracts within fifteen (15) days after execution of this Contract. All subcontracts must include the same certifications that Vendor must make as a condition of this Contract. Vendor shall include in each subcontract the Standard Illinois Certifications form available from the State. If at any time during the term of this Contract, Vendor adds or changes any subcontractors, then Vendor must promptly notify, by written amendment to this Contract, the State Purchasing Officer or the Chief Procurement Officer of the names and addresses, the expected amount of money that each new or replaced subcontractor will receive pursuant to this Contract, and the general type of work to be performed. 30 ILCS 500/20-120.

4.3.1 Vendor shall be fully responsible for the performance of any subcontractors. Vendor shall supervise and guarantee the work of its subcontractors and shall ensure that all subcontractors comply with all requirements of this Contract just as if they were Vendor’s own employees. If a subcontractor fails to perform or violates any Contract requirement, Vendor shall promptly remedy the issue (including, if necessary, by replacing the subcontractor). Vendor shall be liable for any acts, omissions, or breaches by its subcontractors or agents to the same extent as if performed by Vendor. The State’s approval of any subcontractor does not relieve Vendor of its obligations under this Contract.

4.4 AUDIT/RETENTION OF RECORDS: Vendor and its subcontractors shall maintain books and records relating to the performance of the Contract or subcontract and necessary to support amounts charged to the State pursuant the Contract or subcontract. Books and records, including information stored in databases or other computer systems, shall be maintained by Vendor for a period of three (3) years from the later of the date of final payment under the Contract or completion of the Contract, and by the subcontractor for a period of three (3) years from the later of final payment under the term or completion of the subcontract. If Federal funds are used to pay Contract costs, Vendor and its subcontractors must retain their respective records for five (5) years. Books and records required to be maintained under this section shall be available for review or audit by representatives of: the procuring Agency, the Auditor General, the Executive Inspector General, the Chief Procurement Officer, State of Illinois internal auditors or other governmental entities with monitoring authority, upon reasonable notice and during normal business hours. Vendor and its subcontractors shall cooperate fully with any such audit and with any investigation conducted by any of these entities. Failure to maintain books and records required by this section shall establish a presumption in favor of the State for the recovery of any funds paid by the State under this Contract or any subcontract for which adequate books and records are not available to support the purported disbursement. Vendor or subcontractors shall not impose a charge for audit or examination of Vendor’s or subcontractors’ books and records. 30 ILCS 500/20-65. Vendor and its subcontractors shall upon reasonable notice appear before and respond to requests for information from the Illinois Works Review Panel. 30 ILCS 559/20-25(d).

4.5 CONTINUING PERFORMANCE: Time is of the essence with respect to Vendor’s performance of this Contract. Vendor shall continue to perform its obligations while any dispute concerning the Contract is being resolved unless otherwise directed by the State.

4.6 NO WAIVER OF RIGHTS: Except as specifically waived in writing, failure by a Party to exercise or enforce a right does not waive that Party’s right to exercise or enforce that or other rights in the future.

4.7 FORCE MAJEURE: Failure by either Party to perform its duties and obligations will be excused by unforeseeable circumstances beyond its reasonable control and not due to its negligence, including acts of nature, acts of terrorism, riots, labor disputes, fire, flood, explosion, and governmental prohibition (a “Force Majeure Event”). In the event of Vendor non-performance due to a Force Majeure Event, Vendor must promptly notify the State in writing describing the Force Majeure Event, the expected duration of the inability to perform, and any action being taken to mitigate the effect of the event. During the period of non-performance, the Vendor shall explore all reasonable alternatives to fulfill the Contract. The State may terminate this Contract in whole or in part without penalty if performance does not resume within thirty (30) days of the declaration. This provision shall not excuse: (a) late delivery of goods specifically manufactured or sourced for this Contract, if such goods are readily obtainable from other sources in a timely manner; or (b) any failure to implement disaster recovery or business continuity procedures where the implementation of such procedures would be reasonable, industry standard, or otherwise required by this Contract. This provision does not excuse Vendor’s obligation to resume full performance when the Force Majeure Event no longer causes an inability to perform. If a Force Majeure Event causes a shortage of materials or resources, Vendor will allocate any available materials or resources to meet the State’s requirements first before any allocation to other customers.

4.8 CONFIDENTIAL INFORMATION: Each Party to this Contract, including its agents and subcontractors, may have or gain access to confidential data or information owned or maintained by the other Party in the course of carrying out its responsibilities under this Contract. Vendor shall presume all information received from the State or to which it gains access pursuant to this Contract is confidential. Vendor information, unless clearly marked as confidential and exempt from disclosure under the Illinois Freedom of Information Act (“FOIA”) (5 ILCS 140), shall be considered public. Unless otherwise agreed by the Parties, and then only upon receipt of the State’s prior written consent, Vendor and its subcontractors shall not access or attain any personally identifiable information or sensitive information on or from the State’s systems, and Vendor agrees that any such information is the confidential information of the State. In any event, Vendor shall implement and maintain reasonable security measures to protect any and all data, information, and records disclosed by the State under this Contract from unauthorized access, acquisition, destruction, use, modification, or disclosure. No confidential data collected, maintained, or used in the course of performance of this Contract shall be disseminated except as authorized by law and with the written consent of the disclosing Party, either during the period of this Contract or thereafter. The receiving Party must return any and all data collected, maintained, created or used in the course of the performance of this Contract, in a non-proprietary, readily usable format, promptly at the end of this Contract, or earlier at the request of the disclosing Party, or notify the disclosing Party in writing of its destruction. The foregoing obligations shall not apply to confidential data or information lawfully in the receiving Party’s possession prior to its acquisition from the disclosing Party; received in good faith from a third Party not subject to any confidentiality obligation to the disclosing Party; now is or later becomes publicly known through no breach of confidentiality obligation by the receiving Party; or that is independently developed by the receiving Party without the use or benefit of the disclosing Party’s confidential information.

4.9 USE AND OWNERSHIP: The parties shall respectively retain any pre-existing intellectual property ownership rights (“Preexisting I.P.”) in effect at the time of Contract execution. However, any work product created under this Contract (“Work Product”) will be the State’s sole property if: (1) it is developed using the State’s equipment, supplies, facilities, or trade secrets; or (2) it results from Vendor’s work for the State under this Contract. Vendor shall not incorporate any of its Preexisting I.P. into Work Product, except as specifically agreed to by the parties in this Contract.

4.9.1 WORK FOR HIRE: To the extent permissible under applicable law, Work Product will be considered work made for hire pursuant to the U.S. Copyright Act, 17 U.S.C. §§ 101 et seq., and any foreign equivalent thereof.

4.9.2 ASSIGNMENT OF RIGHTS: Where Work Product contains no Vendor Preexisting I.P., to the extent if any that the State still does not own full right, title, and interest in and to the Work Product, Vendor hereby assigns to the State all of its ownership, right, title, and interest in and to all Work Product, without limitation.

4.9.3 MORAL RIGHTS: In addition to the foregoing transfers and allocations of rights, Vendor hereby irrevocably transfers and assigns to the State any and all “moral rights” Vendor may have in or with respect to the Work Product, excluding any Vendor Preexisting I.P. Vendor also hereby forever waives and agrees that it shall never, including after Contract termination, assert any moral right with respect to the Work Product. “Moral rights” include any rights to claim authorship of or credit on a work of authorship, to object to or prevent the modification or destruction of a work of authorship, or to withdraw from circulation or control the publication or distribution of a work of authorship, and any similar right, existing under judicial or statutory law of any country or subdivision of a country, or under any treaty, regardless of whether or not such right is described as a “moral right.”

4.9.4 BACKUP LICENSE: To the extent, if any, that (i) the Parties agree in this Contract to allow Work Product to incorporate any Vendor Preexisting I.P., or (ii) to the extent the above assignment provision otherwise does not provide the State with full ownership, right, title, and interest in and to the Work Product, Vendor hereby grants the State a perpetual, irrevocable, fully paid, royalty-free, worldwide license to use, reproduce, create derivative works from, and publicly display and publicly perform the Work Product. Vendor grants this license under copyright, patent, and all other applicable forms of intellectual property law.

4.10 (A) INDEMNIFICATION: Vendor shall indemnify and hold harmless the State, its agencies, officers, employees, agents, and volunteers (collectively, "Indemnified Parties") from any and all liabilities, losses, damages, claims, demands, costs, settlements, judgments, and expenses (including attorneys’ fees and expenses, whether in-house or contracted) that the Indemnified Parties may incur related to:

(a) any breach or violation by Vendor of any of its certifications, representations, warranties, covenants, or agreements;

(b) any act, activity, or omission of Vendor or any of its employees, representatives, subcontractors, or agents; or

(c) any actual or alleged death or injury to any person, damage to any real or personal property, or any other damage, harm, or loss claimed to result in whole or in part from negligent or wrongful acts or omissions of the Vendor, its employees, representatives, subcontractors, or agents;

(d) any actual or alleged claim that the products or services provided under this Contract infringe, misappropriate, or otherwise violate any intellectual property rights (including but not limited to patent, copyright, trade secret, or trademark rights) of a third party.

Vendor shall also defend (subject to the consent of the Office of the Attorney General (“OAG”)) the State against any and all third-party claims related to this Contract. In accordance with Article VIII, Section 1(a) and (b) of the Constitution of the State of Illinois and 1973 Illinois Attorney General Opinion 78, the State may not indemnify private parties absent express statutory authority permitting the indemnification.

(B) LIMITATION OF LIABILITY:

(1) Damage Cap. Vendor’s entire liability to the State for all claims arising under or related to this Contract will not exceed five (5) times the total sum paid and payable to Vendor under this Contract (the “Damage Cap”). The Damage Cap is cumulative for all claims and not per incident.

(2) Consequential Damages. Neither Party to this Contract will be liable to the other for any indirect, special, consequential or punitive damages (“Consequential Damages Exclusion”).

(3) Unlimited Liability. Neither the Damage Cap nor the Consequential Damages Exclusion will apply to any of the following:

(i) Vendor’s obligations under section 4.10(A), 4.10.1, 4.10.2, and 4.10.3;

(ii) Infringement of rights in intellectual property;

(iii) Gross negligence, willful misconduct, or fraud;

(iv) Bodily injury, death, or damage to property;

(v) Data breach, loss, or corruption; and

(vi) Intentional repudiation of contract.

4.10.1 ADDITIONAL VENDOR OBLIGATIONS: In the event any actual or alleged claim that the products or services provided under this Contract violate any intellectual property rights, Vendor shall, at its own expense, promptly: (a) secure for the State the right to continue using the affected product, software or service; (b) replace or modify the affected product, software or service to make it non-infringing, provided such modification or replacement does not materially degrade any functionality; or (c) subject to the State’s consent, refund or forego: (i) the purchase price, if a product; or (ii) if a license fee or service, the fees paid or due to be paid for every month remaining in the term following the date after which the State ceases use of that software or service.

4.10.2 DATA BREACH PREVENTION, NOTICE, AND REMEDIATION: To the extent related to or in furtherance of the Vendor’s performance under this Contract, Vendor shall ensure the security, storage, and integrity of the State’s content, data, computers, networks, and systems (which may include the use of encryption technology to protect the State’s content and data including personally identifiable information and sensitive information) from unauthorized access. Vendor shall implement and maintain all appropriate safeguards to prevent unauthorized disclosure of, access to, or use of State data and any personally identifiable and sensitive information. For purposes of this Section, unauthorized disclosure of, access to, or use of data or personally identifiable or sensitive information is defined as a “Data Incident.”

In the event Vendor becomes aware of or suspects a Data Incident, Vendor shall: (1) promptly, and in no event greater than 24 hours (unless required to give notification earlier by law or State policy), give notice to the State of that Data Incident; and (2) provide the State with daily updates, or as requested by the State, regarding findings and actions to resolve the Data Incident to the State’s satisfaction. Notifications shall be sent via email to DoIT.Security@illinois.gov, with the subject line: “Breach Notification” as it relates to Data Incidents.

If the Data Incident results from Vendor’s…