RFI Document.pdf

South Dakota Board of Regents 306 East Capitol Ave., Suite 200

Pierre, SD 57501

REQUEST FOR INFORMATION

RFI No. SDBOR 2025-01

RETAIL MANAGEMENT SOLUTION

I. BACKGROUND

The South Dakota Board of Regents (hereinafter “SDBOR”) has constitutional authority to govern the system of public higher education in the State of South Dakota. Supported by an Executive Director and staff, the Board provides leadership and sets policies for the programs and services delivered through its six universities and two special schools. The universities and special schools include:

Black Hills State University – Spearfish Dakota State University – Madison Northern State University – Aberdeen South Dakota School of Mines & Technology – Rapid City South Dakota State University – Brookings University of South Dakota – Vermillion School for the Blind and Visually Impaired – Aberdeen School for the Deaf – Sioux Falls South Dakota Board of Regents – Pierre

II. OVERVIEW

SDBOR is seeking proposals on a modern, cost effective, collegiate retail store management point-of-sale and inventory control system which provides robust course materials management, general merchandise management, and e-commerce capabilities.

III. CONTACT INFORMATION

The point of contact for this solicitation is:

Katy Hutchins South Dakota Board of Regents Program and Fiscal Analyst 306 E. Capital Ave., Ste 200 Pierre, SD 57501 605-773-3455

Katy.Hutchins@sdbor.edu

IV. SPECIFICATIONS

• The vendor must provide a complete POS system, E-commerce solution, software, setup, and training; and any other items required to operate a fully functional collegiate retail store.

• Preferred go-live date between June 1, 2025 – July 1, 2025.

• The vendor must provide technical support, updates, and service for the length of the contract.

• Accepted proposals will be evaluated using the following criteria o Initial Setup o Cost, including

Hardware & Onboarding fee Annual Fees o Course Materials o Data Security o POS Capabilities o E-Commerce Capabilities o Inventory Control o Support and Training o AR/AP o Ease of Use

V. RESPONSE

1) SDBOR is requesting a response that would provide the best fit for its requirements as described in this RFI. The response should include both technical and non-technical information that the SDBOR would use in understanding different types of retail management solutions available in the marketplace, and the requirements for implementing such a system.

Address minimum and optional capabilities as described in Section IV above.

2) Please provide your response to this RFI in pdf format by 2/14/25, by emailing katy.hutchins@sdbor.edu

VI. PRICING

Please provide a 3 and 5-year cost estimate to support our use of the proposed solution for the SD BOR system, including any implementation/integration costs.

VII. PRODUCT DEMONSTRATIONS

1) SDBOR may request product demonstrations based on the information received, therefore not all respondents may be invited to provide a demonstration. Demonstrations shall be online and allow multiple users to view the presentation.

2) Please provide three references (including contact information) for implementations completed within the last two years.

VIII. QUESTIONS

SDBOR requests all questions be submitted via email, no later than 1/22/2025, to katy.hutchins@sdbor.edu. Responses to all questions will be distributed to all who are interested. SDBOR reserves the right to reject or deny any requests(s) made by potential respondents. Impromptu, oral questions are permitted, but are only intended as general direction and will not represent official SDBOR position.

IX. USE OF INFORMATION

1) SDBOR, at its sole discretion, may or may not issue a related solicitation or issue multiple solicitations based on the responses to this RFI.

2) All material and information provided to SDBOR in response to this RFI shall upon receipt become the property of SDBOR and shall not be returned.

3) By submitting a response, the respondent agrees that SDBOR may copy the response for purposes of facilitating SDBOR’s review or use of the information. The respondent also acknowledges that such copying will not violate any copyrights, licenses, or other agreements with respect to the materials submitted in accordance with SDBOR’s intended use.

4) SDBOR is not responsible for any costs incurred by the respondent that are related to the preparation or delivery of the response, or any other activities of the respondent related to this

RFI.

X. ADDITIONAL QUESTIONS

1. PRINT

a. Does this system allow for used/new/rental/alternate pricing for print titles?

b. Is the software able to handle multiple ISBN’s – up to 5?

c. Can the information fields be modified/adjusted/added to or is it “as is”?

d. How does your system process wholesaler want lists?

e. How does your system process vendor returns?

f. Can your system import multiple wholesaler buyer’s guides?

g. Does your system recognize books with 979 prefixes?

h. Can images be attached to book records within system?

2. PRINT RENTALS

a. Does the software generate a list and/or file used to charge renters for non-returned rentals? Is it a manual process? Explain how this is handled.

b. How are publisher rentals tracked and maintained?

c. Can multiple rental sessions be active at the same time?

d. How can your software associate students to their rentals?

e. What options are available to secure rentals?

f. Does your system automatically generate emails for return reminders?

g. How are rentals accounted for in the SOH field?

h. Does your system generate serialized barcodes for rentals?

i. What reports are available for rentals?

j. Can rentals be returned at POS?

k. Does your system differentiate between publisher rentals and store rentals?

l. Does your system have the ability to have varying rental lengths?

m. Does your system allow an option for a late or non-return fee?

3. DIGITAL & IA

a. How are digital items set up so they can be sold at the register?

b. Can multiple digital durations be sold at the pos register: i.e., 180 days; 5 years, lifetime?

c. How many steps are involved with setting up digital items for resale?

d. Can digital content be sold on the e-commerce site? Varying durations of time?

e. Does the system have IA & EA management capabilities?

f. Can the software handle multiple ISBNs for the product?

g. Do students get immediate access to digital content when an order is placed or is access granted after the order has been processed?

h. Does your system integrate with Verba/Vitalsource?

i. How does your ecommerce site display IA titles?

4. General Merchandise

1. Does your system account for individual GM items purchased as part of a display?

2. How does your system associate different costs and prices associated with different variants?

3. How does your system account for item variants? i.e., size, color, etc.

4. When does your system adjust inventory after a POS sale, refund, or web order?

5. What reports does are available within your system?

6. Can custom reports be created by the store?

7. Can identical items have multiple vendors, multiple catalog numbers, multiple barcodes, and varying costs?

8. Can items be serialized?

9. What are your software capabilities for sales, promotions, events, coupons, etc.

10. Can you click on a specific item to view all related details?

11. What steps are involved in creating product variants?

12. How are products/product variants sent to the web?

13. What options are available for printing stickers for general merchandise?

14. Can your system create GM bundles & kits?

5. POS

1. Is the user able to add or change quantities after an item has been scanned?

2. Can item discounts be added after an item has been scanned?

3. Can the system run different sales/promotions (e-commerce and in-store) simultaneously/independently?

4. Is there an option to prompt or decline the receipt to print?

5. Are each item's product images available at the POS or inventory system level?

6. How are special orders handled within the POS system?

7. What kind of sales can be set up within the system? Can it handle buy one get one/ buy one get a percentage off / buy one get $ off / buy one get a different product for free (shirt get soda) etc.?

8. Can you access E-commerce orders at the POS?

9. Can coupons be used at the POS?

10. Are membership/ loyalty programs available within the pos/ecommerce system?

11. Can the system work offline when internet is not available?

12. Can gift cards currently in circulation be used or are proprietary gift cards required?

13. What types of payments can be accepted? cc, tap, google wallet, apple pay, transact (student ID card) etc.

14. Are there additional charges for specific payment types? i.e.

Watchman/Campus Guard

15. Can receipts be emailed to customers?

16. Does your system allow you to build a “quick menu” screen for select items?

Are there limits?

17. Can previous transactions be retrieved when needed?

18. Does your system allow for multiple users with multiple levels of security?

19. Does your system allow for multiple tenders within a single transaction?

20. Can receipts be customized?

21. Does your system allow suspension and later resumption of a transaction?

6. E-COMMERCE

1. Is HTML / coding required to maintain/modify the website?

2. Is E-commerce site part of the system or 3rd party? If 3rd party, what software is used?

3. Is an either/or choice option available between 2 course material items?

4. What kind of sales can be set up within the system? Can it handle buy one get one/ buy one get a percentage off / buy one get $ off / buy one get a different product for free (shirt get soda)?

5. If the Payment method is declined in e-commerce does the system allow the POS to complete the sale with a different tender?

6. Does your system allow communication between the e-commerce site and POS? i.e. Can you pull up an order from the e-commerce site and complete it in-store?

7. Can promotions/sales be made specifically for the e-commerce site?

8. Can coupons be used on the e-commerce site?

9. Do the e-commerce site order picking/packing list include the specific image of the item ordered?

10. Does the picking/packing list include both the vendor bar code and the system assigned SKU?

11. Is the site ADA-compliant? Explain

12. Is the site mobile-friendly? Explain

13. Are there multiple options available to customers for shipping? Explain

14. What type of communication is sent to customers as the order is received and processed? Can this communication be edited?

15. Can shipping tracking numbers be assigned to orders? Can they be communicated to the customer?

16. Can notes be added to individual titles and/or courses? Is there a character limit?

17. Are all established tenders accepted for ecommerce transactions? Can they be split?

18. Is there a report available for in-state orders by city they’re shipped to?

19. How often are web templates updated? Is there a charge to update?

20. Does your system feature a live chat option for customers?

7. INTEGRATIONS

1. Does your system integrate with Verba / Vital source?

2. Does your system integrate with any shipping software for ecommerce?

3. Does your system integrate with Banner? (live integration not currently used)

4. Does your system integrate with Blackboard/Transact?

5. If the system doesn’t interface with Transact, is there a way to associate a POS tender to an auxiliary device?

6. If your system is/can be integrated with other software programs, what are hey?

7. Are there any costs associated with any of the integrations?

8. Does your system integrate with the State of SD contracted credit card end-to-end processor Shift 4?

9. If your system does currently integrate with Shift 4, is your company willing to create the integration?

10. If Shift 4 is not an option for credit card processing, what company is used for end-to-end processing?

11. What other integrations might be available for consideration?

12. Will the system work with existing hardware, i.e. IBM, Toshiba, etc?

8. MISCELLANEOUS

1. If another system user creates modifications and creates custom reports, are they shared with all the users? Would there be an additional charge?

2. Is the system cloud-based?

3. Is there a limit to the number of accounts that can be set up and used? i.e. A/R, Voc-rehab, Student charge, etc.

4. Is everything within the software accessible from 1 screen?

5. What is the process for importing existing files into the system? i.e., vendors, items, issued gift cards, etc.

6. Is proprietary hardware required (i.e., computers, pos registers, printers etc.)?

Please provide a list of required hardware if applicable.

7. If proprietary hardware is not required, can you provide a list of recommended hardware for a fully functional POS system?

8. Is POS software touch screen capable?

9. Can you provide a list of schools that are using your system that interface with

Banner & Transact?

10. What is the typical Implementation time from start to finish to go live?

11. Can the software add/delete/show/hide alternate fields?

12. Can the software be accessed remotely for use at off-site locations? i.e., sports events, events not held in the store or on campus?

13. Can the system work offline?

14. Can information be uploaded/downloaded manually if software is not integrated with Banner?

15. How does your system take inventory?

16. Can varying tax rates be applied depending upon transaction details?

9. SUPPORT / TRAINING

1. What support services/ standards are available to users?

2. How many support staff are available?

3. Is support available during holidays, weekends, etc.?

4. What is the typical response time?

5. Is training and installation online or in person?

6. How much time does training take?

7. Are there costs associated with training and installation?

8. What types of support are offered? i.e., Phone, chat, email etc.?

10. ACCOUNTING

1. In invoicing – does the system show the color/sizing /catalog number etc.?

2. Is there a way to add the date of when an invoice has been entered?

3. Is there a way to have a scanned copy of the invoice show up in the system?

4. What are the accounting capabilities? Full package, 3rd party?

5. Is there an additional charge for any accounting features?

6. Can it handle multiple different AR charges i.e., Student charge, Voc rehab, Department, etc.

8. How does your system account for damaged products or discrepancies?

9. Does your system integrate with any accounting software? If so, which one(s)?

10. Does your system support inventory reporting at a variety of levels? i.e. Dept, Class, Category

11. Does your system support inventory valuation calculations at cost, retail, FIFO, LIFO, and average cost?

11. CUSTOMER INFORMATION

1. Can the system add alternate fields when needed? What will be required to do so?

2. Can the system import/export files? standard and custom files i.e... student info/ez charge import with set dollar amount, etc.

3. Are membership/loyalty programs available?

4. Is there a way to get the preferred name into the name field or pops up?

5. Does your system provide a minimum of 2 fields for student ID numbers?

6. Does your system provide a minimum of 3 fields for name, preferred name, & email?

7. What are the minimum required fields to create functional customer A/R records?

8. Can the system track customer transactions?

12. COST

1. How is the system priced? Per lane? per user? Per FTE? Per Year? Etc.

2. Is there a discount available for multiple locations?

3. Is there any contractual obligation regarding term length?

4. Is proprietary hardware required? If so, please provide details.

5. Is there a discount or reduced fee if a textbook module is not required?

13. SECURITY

1. Is an external annual third-party security audit conducted for the system?

2. Does your company currently partner with, or is it willing to partner with, our provider Shift4 for point-to-point encrypted credit card processing?

3. Does your system offer MFA and/or SSO for the following? If MFA is supported, what methods are used?

a. Store employees and administrators

b. Customers

4. Log Management: How are logs maintained in the system, and who is responsible for reviewing them?

5. Is your company compliant with PCI DSS 4.X or newer? When was this compliance obtained?

6. To address security inquiries, please provide the following documents. These documents may be reviewed during the demonstration to save time:

a. PCI Compliance Report/Form

b. Attestation of Compliance (AOC)

c. SOC 2 Report

d. HECVAT (or equivalent security assessment). If unavailable, specify what PII is collected and how it is stored.

e. GLBA compliance documentation

7. Does your system enforce role-based access control, limiting user access according to their organizational roles?

8. Does your system utilize data isolation techniques to prevent data leakage between different customers (tenants)?

9. How is data encrypted?

a. In transit: Does your system use Transport Layer Security (TLS) to encrypt all data transmitted between the POS terminal and the provider’s servers?

b. At rest: Is sensitive data, such as payment information and PII, encrypted when stored on your servers?

10. Does your company adhere to FERPA and PCI compliance requirements where applicable?

11. Does your company conduct background checks on employees?

12. Does your company maintain compliance with the most recent SOC 2 and

ISO 27001 standards throughout the term of the agreement? Is an SOC 2 assessment report available?

13. Does your system enforce a robust password policy, including password aging and strength requirements?

14. Do you offer a PCI-approved mobile POS solution?

15. Does your company require the use of third-party vendors (e.g., Watchman) that would take the company out of PCI scope?

16. Will your company sign the required Data Processing Agreement (DPA) provided by the State of South Dakota?

Please provide any/all features unique to your system if not already conveyed in the responses to questions above. In-depth product demonstrations may be required once RFPs are evaluated.

XI. Terms and Conditions

The Board of Regents may or may not seek to engage in a contract with a responding vendor to provide this software solution. Please review our terms and conditions that follow and state any clauses, in your response, that you will not be able to agree to and/or will require negotiations, and the reasoning behind those decisions.

As an entity of the State of South Dakota, the South Dakota Board of Regents, is subject to certain restrictions in the contracts clauses it can agree to. By providing access to the software product, Contractor specifically agrees the Terms in this Software Addendum supersede all conflicting terms contained in Contractor’s Terms and Conditions, EULA, Privacy Policy, etc.

The parties expressly agree that no effect shall be given to any terms or conditions of any EULA, click-through, click wrap, browse wrap or similar agreements not specifically referenced above that may be displayed when accessing the software.

INTELLECTUAL PROPERTY RIGHTS: Except as the Contractor provides a greater warranty in the Contractor’s documents referenced above, to the best of Contractor’s knowledge, the software does not infringe on the intellectual property rights of any third party.

UPTIME: Contractor shall use commercially reasonable efforts to ensure the software’s operation and availability 99.5% of the time, excluding advertised downtime periods, measured on a monthly basis throughout the term of the Agreement. Contractor shall use commercially reasonable efforts to provide forty-eight (48) hours advance notice to Customer in the event of any scheduled downtime. Contractor shall use commercially reasonable efforts to minimize any disruption, inaccessibility and/or inoperability of the software in connection with downtime. In the event Contractor fails to meet the 99.5% availability for two months in any twelve (12) month rolling measurement window due to reasons within their control, the Customer will, at its sole discretion, be able to terminate the agreement without penalty and receive a pro-rata refund of any unused portion of fees paid in advance calculated from the date notice was provided to the end of the pre-paid term.

GOVERNING LAW AND VENUE: The Agreement shall be governed by and construed in accordance with the laws of the State of South Dakota, without regard to any conflicts of law principles, decisional law, or statutory provision which would require or permit the application of another jurisdiction’s substantive law. Venue for any lawsuit pertaining to or affecting this Agreement shall be in the Circuit Court, third Judicial Circuit, Brookings County, South Dakota or Federal Court nearest Brookings County, South Dakota.

INDEMNIFICATION BY CONTRACTOR: Contractor agrees that any indemnification or hold harmless provision in the Agreement shall not require Customer to turn over control of defense or settlement to Contractor. Customer will provide reasonable cooperation and communication concerning the defense and settlement of any claim by a third party against Customer.

INDEMNIFICATION BY CUSTOMER: Contractor understands the laws and Constitution of the State of South Dakota prohibit Customer from indemnifying Contractor.

OWNERSHIP OF CUSTOMER DATA: Contractor hereby acknowledges and agrees that all Customer data, including user data, uploaded into or produced through the use of Contractor’s software belongs to and is the property of Customer. Customer data will not be used in any way, or disclosed to third parties, by Contractor without the written consent of Customer. Except Contractor is granted non-exclusive, non-transferable, royalty-free right to use, display, modify, transmit, and distribute the data to the extent required to ensure the software operates properly or to provide services associated with the software. Within thirty (30) days of expiration or termination of the Agreement, Contractor will return or securely destroy Customer Data.

PUBLIC INFORMATION: The Contractor acknowledges that Customer is bound by South Dakota open meetings and open records laws. It is therefore not a breach of this Agreement for Customer to take any action that Customer reasonably believes is necessary to comply with the South Dakota open records or open meetings laws. The Contractor agrees that the Agreement and any prices, fees and rates agreed to be paid by Customer under the Agreement are not confidential.

RECORDS INSPECTION AND RETENTION: The State, through any authorized representative, will have access to and the right to examine and copy all records, books, papers or documents related to services rendered under this Agreement. Consultant will retain all books and records related to the services performed for a period of not less than the greater of any applicable federal law retention requirement or three years following termination of this Agreement.

NO ARBITRATION: The Customer as an entity of the State of South Dakota is unable to waive sovereign immunity, as such any provision presented by Contractor requiring arbitration or any other binding nonjudicial process is void.

AMENDMENT: The Agreement and any documents incorporated into the Agreement, may not be amended except in writing, which writing shall be expressly identified as a part hereof, and be signed by an authorized representative of each of the parties hereto.

INSURANCE: The Contractor, at all times during the term of the Agreement, shall obtain and maintain in force insurance coverage for the types and with the limits as follows:

(A) Commercial General Liability Insurance: The Contractor shall maintain occurrence based commercial general liability insurance or equivalent form with a limit of not less than $1,000,000 for each occurrence. If such insurance contains a general aggregate limit, it shall apply separately to this Agreement or be no less than two times the occurrence limit.

Such insurance shall include South Dakota State employees as additional insureds in the event a claim, lawsuit, or other proceeding is filed against a State employee as a result of the services provided pursuant to this Agreement.

(B) Worker’s Compensation Insurance: The Contractor shall procure and maintain worker’s compensation and employers’ liability insurance as required by South Dakota law.

Before beginning work under this Agreement, if requested by Customer, the Contractor shall furnish Customer with properly executed Certificates of Insurance which shall clearly evidence all insurance required in this Agreement and which provide that such insurance may not be cancelled, except on 30 days’ prior written notice to Customer. The Contractor shall furnish copies of insurance policies if requested by Customer.

REPORTING: Contractor agrees to report to Customer any event encountered in the course of performance of this Agreement which results in injury to the person or property of third parties, or which may otherwise subject the Contractor or Customer to liability. Contractor shall report any such event to Customer immediately upon discovery. The Contractor ’s obligation under this section shall only be to report the occurrence of any event to Customer and to make any other report provided for by their duties or applicable law. Contractor ’s obligation to the report shall not require disclosure of any information subject to privilege or confidentiality under law (e.g., attorney-client communications). Reporting to Customer under this section shall not excuse or satisfy any obligation of Contractor to report any event to law enforcement or other entities under the requirements of any applicable law.

FUNDING OUT/AVAILABILITY OF APPROPRIATED FUNDS/NON-APPROPRIATION:

The Agreement depends upon the continued availability of appropriated funds and expenditure authority from the Legislature for this purpose. If for any reason the Legislature fails to appropriate funds or grant expenditure authority, or funds become unavailable by operation of law or federal funds reductions, the Agreement will be terminated by Customer. Termination for any of these reasons is not a default by Customer nor does it give rise to a claim against Customer.

ANTI-KICKBACK LAW: By agreeing to this binding Agreement, the parties certify that they have not paid kickbacks directly or indirectly to anyone for the purpose of obtaining this Agreement and agree to cooperate fully with any U.S. agency investigating a possible violation of anti-kickback laws. Furthermore, Contractor recognizes their duties under the U.S. Foreign Corrupt Practices Act, which makes it unlawful for certain persons and entities to make payments to foreign government officials and agrees to comply with all such provisions.

COMPLIANCE WITH APPLICABLE LAWS: Contractor will comply with all federal, state and local laws, regulations, ordinances, guidelines, permits and requirements applicable to providing services pursuant to this Agreement, and will be solely responsible for obtaining current information on such requirements.

NON-DELEGATION/SUBCONTRACTORS: Contractor may not use subcontractors to perform the services described herein without the express prior written consent of Customer. Contractor will include provisions in its subcontracts requiring its subcontractors to comply with the applicable provisions of this Agreement, to indemnify Customer, and to provide insurance coverage for the benefit of Customer in a manner consistent with this Agreement. Contractor will cause its subcontractors, agents, and employees to comply, with applicable federal, state and local laws, regulations, ordinance, guidelines, permits and requirements and will adopt such review and inspection procedures as are necessary to assure such compliance.

DEBARMENT, SUSPENSION, AND INELIGIBILITY PROVISION: Contractor certifies that neither Contractor nor its principals are presently debarred, suspended, proposed for debarment or suspension, or declared ineligible from participating in transactions by the federal government or any state or local government department or agency. Contractor further agrees that it will immediately notify Customer if during the term of this Agreement Contractor or its principals become subject to debarment, suspension or ineligibility from participating in transactions by the federal government, or by any state or local government department or agency.

NOTICE OF COMMUNICATION: Any notice or other communication required under this Agreement shall be in writing and sent to the address set forth above. Notice shall be given by and to [Contact Name] on behalf of Customer, and by [Contact Name] on behalf of Contractor, or such authorized designees as either party may from time to time designate in writing. Notices or communications to or between the parties shall be deemed to have been delivered when mailed by first class mail, provided that notice of default or termination shall be sent by registered or certified mail, or, if personally delivered, when received by such party. Notices from Customer will be provided in English, and any interpretation or translation is the responsibility of Contractor . The parties agree that in the event of any discrepancy between the English version and the non-English version of any notices, communications, or terms of this Agreement, the English version shall prevail.

EXPORT CONTROLS PROVISION: Contractor understands that Customer’s right to furnish U.S. information or technology, or the direct product thereof, is subject to the continuing approval of U.S. Governmental authorities. Contractor acknowledges that it is familiar with U.S.

laws and regulations concerning the export or re-export of U.S. information and technology, or the direct product thereof, to unauthorized destinations and persons and Contractor agrees to abide by all such regulations in respect of all information or technology supplied by State under this Agreement. Contractor further agrees not to export, directly or indirectly, Customer’s technology or information to any restricted or prohibited destination under applicable U.S.

regulations unless a request to do so has been submitted by State and until such request is approved in writing by the appropriate U.S. Government Agency.

INDEPENDENT CONTRACTOR: While performing services hereunder, Consultant is an independent contractor and not an officer, agent, or employee of the State. Unless explicitly authorized herein, Consultant will not use State equipment, supplies or facilities. Consultant is solely responsible for the withholding and payment of applicable income and Social Security taxes due and owing from money received under this contract.

NON-DISCRIMINATION: The parties agree not to discriminate or harass individuals on the basis of sex, race, color, creed, national origin, ancestry, citizenship, gender, gender identification, transgender, sexual orientation, religion, age, disability, genetic information or U.S. veteran status or any other status that may become protected under U.S. and South Dakota law against discrimination.

SEVERABILITY: In the event that any court of competent jurisdiction shall hold any provision of this Agreement unenforceable or invalid, such holding shall not invalidate or render unenforceable any other provision hereof.

Contractor agrees not to export technology or information provided by Customer under Agreement without the prior written consent of Customer.

Data Processing Addendum This Data Processing Addendum (“Addendum”) is a part of the South Dakota State Board of Regents / “Enter Agreement here” (“Agreement”) and is hereby incorporated into the Agreement by and between “Enter Contractor Name Here”. (“Contractor”) and South Dakota Board of Regents (“Customer”). It is applicable in those situations where the Contractor provides goods or services which necessitate that the Contractor create, obtain, transmit, use, maintain, process, or dispose of Customer Data (as defined in the Definitions Section of this Addendum) in order to fulfill its obligation to the Customer and is incorporated in full by this reference.

This Addendum sets forth the terms and conditions pursuant to which Customer Data will be protected by the Contractor during the term of the Agreement and after its termination.

STANDARD PROVISIONS:

1. DEFINITIONS

a. “End User” means an individual authorized by the Customer to access and use the Services provided by the Contractor under this Addendum.

b. “Protected Customer Data” includes all data defined as Highly Sensitive, Sensitive, or Internal Use data that is not intentionally made generally available by the Customer on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and patient, student, personnel data, and other personally identifiable information (“PII”) protected by law or policy.

c. “Securely Destroy” means taking actions that render data written on physical (e.g., hardcopy, microfiche, etc.) or electronic media unrecoverable by both ordinary and extraordinary means.

These actions must meet or exceed those sections of the National Institute of Standards and Technology (NIST) SP 800-88, REV 1 guidelines relevant to data categorized as high security.

d. “Security Breach” means the unauthorized access, use or disclosure that compromises or threatens to compromise the confidentiality, integrity, or availability of Customer Data or systems, and also specifically includes the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder.

e. “Services” means any goods or services acquired by the Customer from the Contractor.

f. “Customer Data” includes Protected Customer Data and any other information that is created, possessed or used by the Customer or is intentionally made generally available by the Customer on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and patient, student, and personnel data.

g. "Audit Trail" means a chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to final result.

h. “Multi Factor Authentication” means the provision of a portion of the Services under which two or more factors for verification are required of Customer’s end users’ identity in connection with such end users’ use of Customer Data software applications or services. The factors for authentications can be defined as something you know (e.g., a password), something you have (e.g., a hardware code generator), and something you are (e.g., a fingerprint).

2. RIGHTS AND LICENSE IN AND TO THE CUSTOMER DATA

The parties agree that as between them, all rights including all intellectual property rights in and to Customer Data shall remain the exclusive property of the Customer, and Contractor has a limited, nonexclusive license to use these data as provided in this agreement solely for the purpose of performing its obligations hereunder. This Addendum does not give a party any rights, implied or otherwise, to the other’s data, content, or intellectual property, except as expressly stated in the Agreement.

3. DATA PRIVACY

a. Contractor will use Customer Data only for the purpose of fulfilling its duties under Agreement and will not share such data with or disclose it to any third party without the prior written consent of the Customer, except as required by this agreement or as otherwise required by law.

b. Protected Customer Data will not be stored outside the United States without prior written consent from the Customer.

c. Contractor will provide access to Customer Data only to its employees and subcontractors who need to access the data to fulfill Contractor obligations under this agreement. Contractor will ensure that employees and subcontractors who perform work under this agreement have read, understood, and received appropriate instruction as to how to comply with the data protection provisions of this Addendum. Contractor will ensure that its employees and approved subcontractors fulfilling this agreement comply with this agreements’ requirements.

d. The following provision applies only if Contractor will have access to the Customer’s education records as defined under the Family Educational Rights and Privacy Act (FERPA):

The Contractor acknowledges that for the purposes of this agreement it will be designated as a “school official” with “legitimate educational interests” in the Customer education records, as those terms have been defined under FERPA and its implementing regulations, and the Contractor agrees to abide by the limitations and requirements imposed on school officials. The Contractor shall also maintain the confidentiality of student records in accordance with the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) (“FERPA”).

Confidential student records and information (“Student Information”) includes hard copy, and any other format or medium, student education record information and personally identifiable information contained therein as defined by FERPA. Contractor/Vendor agrees to abide by the limitations on re-disclosure of personally identifiable information from education records set forth by FERPA and with the terms set forth herein. 34 CFR 99.33(a)(2) states that the officers, employees, and agents of a party that receives Student Information may use the information only for the purpose(s) for which the disclosure was made. Contractor shall not use or disclose Student Information received from or on behalf of Customer (or its students) except as permitted or required by the Agreement, as required by law, or as otherwise authorized in writing by Customer. Contractor agrees not to use Student Information for any purpose other than the purpose for which the disclosure was made. Upon termination, cancellation, expiration or conclusion of the Agreement, Contractor shall return all Student Information to Customer or, if return is not feasible, destroy all Student Information. Contractor shall develop, implement, maintain and use appropriate administrative, technical and physical security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted Student Information received from, or on behalf of Customer or its students. Contractor will immediately notify Customer of any Security Breach of Student Information.

Notification will be provided via email to ‘breach@sdbor.edu’ and additional contacts as defined on the ordering document.

e. HEALTH PATIENT PARTICIPANT INFORMATION: If the Contractor, through work with one the Customer’s designated hybrid “health care component”, will receive, create, or come into non-incidental contact with individually identifiable health information of Customer Health and Counseling Clinic patients “Protected Health Information” (“PHI”) as that term is defined in regulations under the Health Insurance Portability and Accountability Act of 1996 ( “HIPAA”), at 45 C.F.R. Part 160.103 a Customer required Business Associate Addendum applies in addition to this Data Processing Addendum. Where noted herein, certain sections of the Business Associate Addendum replace sections of this Data Processing Addendum as regards PHI.

4. DATA SECURITY, INTEGRITY, AND CONFIDENTIALITY

a. Contractor will take reasonable measures, including audit trail, to protect Customer Data to ensure the integrity and availability of Customer Data against deterioration or degradation of data quality and authenticity. The Contractor will be responsible during the term of the Agreement, unless otherwise specified elsewhere in this Addendum, for converting and migrating electronic data as often as necessary so that information is not lost due to hardware, software, or media obsolescence or deterioration.

b. Contractor will store and process Customer Data in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, and audit trail, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will ensure the confidentiality, integrity and availability of Customer Data, and be no less protective than those used to secure Contractor’s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. Without limiting the foregoing, Contractor warrants that all electronic Customer Data will be encrypted in transmission (including via web interface) in accordance with latest version of standards equivalent to National Institute of Standards and Technology 800-175B.

c. If the Contractor stores, transmits, or processes Protected Customer Data as part of the Agreement, the Contractor/Vendor warrants that the information will be stored in accordance with latest version of National Institute of Standards and Technology Special Publication 800- 171 or the International Organization for Standardization and the International Electrotechnical Commission 27002 (ISO/IEC 27002).

d. Contractor will use industry-standard and up-to-date security tools, technologies, and techniques in providing Services under the Agreement.

e. Customer requires the use of Multi Factor Authentication to strengthen access security to Customer Data. Contractor agrees to conform to the use of Multi Factor Authentication software and to keep dependent software updated to support Multi Factor Authentication.

5. EMPLOYEE BACKGROUND CHECKS AND QUALIFICATIONS

a. Contractor shall ensure that its employees who will have potential access to Customer Data https://csrc.nist.gov/publications/sp have passed reasonable and appropriate background screening and possess the qualifications and training to comply with the terms of this Addendum. Contractor will be checked against federal and state debarment, sanctions, and other exclusions lists, will disclose to Customer any known debarments, sanctions, or exclusions, warrants that Contractor and its employees and subcontractors are not currently debarred, sanctioned, or excluded from performing this agreement, and consents to checking against the same lists.

6. SECURITY BREACH

a. Response. Upon becoming aware of a Security Breach, or of circumstances that are reasonably understood to suggest an actual or suspected Security Breach of Customer Data, Contractor will immediately notify the Customer consistent with applicable state or federal laws, fully investigate the incident, and cooperate fully with the Customer’s and/or Customer’s agents investigation of and response to the incident. Except as otherwise required by law, Contractor will not provide notice of an actual or suspected Security Breach directly to individuals whose Personally Identifiable Information was involved, regulatory agencies, or other entities, without prior written permission from the Customer.

b. Liability. If Contractor must under this agreement create, obtain, transmit, use, maintain, process, or dispose of Protected Customer Data, the following provisions apply:

1. In addition to any other remedies available to the Customer under law or equity, Contractor will reimburse the Customer in full for all costs incurred by the Customer or its agents in investigation and remediation of any Security Breach caused by Contractor, including but not limited to providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other entities as required by law or contract; providing one year’s credit monitoring to the affected individuals if the Protected Customer Data exposed during the breach could be used to commit financial identity theft; and the payment of legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Breach.

2. In addition to any other insurance coverage required by another contract/agreement with the Customer, the Contractor will for the duration of the term of the Agreement, maintain commercially reasonable Cyber Liability coverage with insurance companies that hold at least an A- financial rating with A.M. Best Company. In no event, should the Contractor construe these minimum required limits to be their limit of liability to the Customer.

3. The Customer must be named as an Additional Insured on the Cyber Liability Insurance, and the proper name is “South Dakota Board of Regents, and the State of South Dakota, their officers, employees and agents.” Upon the Customer’s request, the Contractor will provide a Certificate of Insurance.

7. RESPONSE TO LEGAL ORDERS, DEMANDS OR REQUESTS FOR DATA

a. Except as otherwise expressly prohibited by law, Contractor will:

• immediately notify the Customer of Contractor’s receipt of any subpoenas, warrants, or other legal orders, demands or requests seeking Customer Data;

• consult with the Customer regarding its response;

• cooperate with the Customer’s reasonable requests in connection with efforts by the Customer to intervene and quash or modify the legal order, demand or request; and

• provide the Customer with a copy of its response.

b. If the Customer receives a subpoena, warrant, or other legal order, demand or request (including public records requests) seeking Customer Data maintained by Contractor, the Customer will promptly provide a copy to Contractor. Contractor will promptly supply the Customer with copies of data required for the Customer to respond in a timely manner and will cooperate with the Customer’s reasonable requests in connection with its response.

8. DATA TRANSFER UPON TERMINATION OR EXPIRATION

a. Upon termination or expiration of the Agreement, Contractor will ensure that all Customer Data are securely returned or destroyed as directed by the Customer in its sole discretion.

Transfer to the Customer or a third party designated by the Customer shall occur within a reasonable period of time, and without significant interruption in service. Contractor shall ensure that such transfer/migration uses facilities and methods that are compatible with the relevant systems of the Customer or its transferee, and to the extent technologically feasible, that the Customer will have reasonable access to Customer Data during the transition.

b. Upon termination or expiration of the Agreement, and after any requested transfer of data is complete, Contractor must Securely Destroy all data in its possession and in the possession of any subcontractors or agents to which the Contractor/Vendor might have transferred Customer data. The Contractor/ agrees to provide documentation of data destruction to the Customer.

c. Contractor will notify the Customer of impending cessation of its business and any contingency plans. This includes immediate transfer of any previously escrowed assets and data and providing the Customer access to Contractor’s facilities to remove and destroy Customer-owned assets and data. Contractor shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the Customer. Contractor will also provide a full inventory and configuration of servers, routers, other hardware, and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the Customer. Contractor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and effect on the Customer, all such work to be coordinated and performed in advance of the formal, final transition date.

9. AUDITS

a. The Customer reserves the right in its sole discretion to perform audits of Contractor at the Customer’s expense to ensure compliance with the terms of this agreement. The Contractor shall reasonably cooperate in the performance of such audits. This provision applies to all agreements under which the Contractor must create, obtain, transmit, use, maintain, process, or dispose of Customer Data.

b. Contractor is and will remain in compliance with the most recent SOC-2 and ISO 27001 standards throughout the term of this Agreement. Upon Client’s written request, Contractor will provide Customer with access to Contractor’s most recent copy of:

(i) the completed SOC-2 Type II audit report,

(ii) its public ISO 27001 certificate and non-public Statement of Applicability

(iii) the results of completed penetration testing of the Service

c. If the Contractor must under the Agreement create, access, obtain, transmit, use, maintain, process, or dispose of Protected Customer Data or financial or business data which has been identified to the Contractor as having the potential to affect the accuracy of the Customer’s financial statements, Contractor will at its expense conduct or have conducted, at least annually,

• security audit by a third party with audit scope and objectives deemed sufficient by the Customer, which attests the Contractor’s security policies, procedures, and controls;

• vulnerability scan by a third party of Contractor’s electronic systems and facilities that are used in any way to deliver electronic services under this agreement; and

• formal penetration test by a third party of Contractor’s electronic systems and facilities that are used in any way to deliver electronic services under this agreement.

d. The Contractor will provide the Customer, upon request, the results of the above audits, scans and tests, and will promptly modify its security measures as needed based on those results in order to meet its obligations under the Agreement. The Customer may require, at Customer expense, the Contractor to perform additional audits and tests, the results of which will be provided promptly to the Customer.

10. COMPLIANCE

a. Contractor will comply with all applicable laws and industry standards in performing services under the Agreement.