RFP 0002-2026 CSU Dining Services_Attachments.pdf

CSU RFP 0002-2026

COPPIN STATE UNIVERSITY DINING SERVICES

DOCUMENT 2 of 2: ATTACHMENTS

Please refer to Section IV for required contents of the Technical Proposal.

Completion of these forms is not the entire Proposal.

Attachment A. Required Contract Provisions Page 1 of 15

ATTACHMENT A. REQUIRED CONTRACT PROVISIONS

1. ANTI-BRIBERY

The Offeror warrants that neither it nor any of its officer, directors, or partners not any of its employees who are directly involved in obtaining or performing contracts with any public body has been convicted of bribery, attempted bribery, or conspiracy to bribe under the laws of any state or of the federal government or has engaged in conduct since July 1, 1977, which would constitute bribery, attempted bribery, or conspiracy to bribe under the laws of any state or the federal government.

2. COMPLIANCE WITH LAWS

The Contractor hereby represents and warrants that:

a. It is qualified to do business in the State of Maryland (whether a domestic business or a foreign corporation subject to registration under the Corporations and Associations Article of the Maryland Annotated Code).and that it will take such action as, from time to time hereafter, may be necessary to remain so qualified;

b. It is not in arrears with respect to the payment of any moneys due and owing the State of Maryland, or any department or unit thereof, including but not limited to the payment of taxes and employee benefits, and that it shall not become so in arrears during the term of this Contract;

c. It shall comply with all federal, State, and local laws, regulations, and ordinances applicable to its activities and obligations under this Contract, including but not necessarily limited to: Maryland Building Codes, Americans with Disabilities Act, and the Maryland Occupational Safety and Health Act and related regulations; and

d. It shall obtain, at its expense, all licenses, permits, insurance, and governmental approvals, if any, necessary to the performance of its obligations under this Contract.

3. CONTRACTOR’S INVOICES

Contractor shall include its Taxpayer Identification Number on the face of each invoice billed to the University. If a Purchase Order document is issued, the Purchase Order Number must be included.

4. DELIVERY AND ACCEPTANCE

Delivery shall be made in accordance with the solicitation specifications. The University, in its sole discretion, may extend the time of performance for excusable delays due to unforeseeable causes beyond the Contractor's control. The University unilaterally may order in writing the suspension, delay, or interruption of performance hereunder. The University reserves the right to test any materials, equipment, supplies, or services delivered to determine if the specifications have been met.

Materials shall be delivered FOB to the point or points specified in the bid or proposal, on the date either agreed to in advance or specified in the bid or proposal. Any material that is defective or fails to meet the terms of the solicitation specifications may be rejected.

Rejected materials shall be promptly replaced. If Contractor fails to promptly replace rejected materials, the University reserves the right to purchase replacement materials in the open market. Contractor shall be liable for costs to replace materials incurred by the University which exceed the bid proposal price, including expenses such as, but not necessarily limited to, shipping and delivery, if any.

Attachment A. Required Contract Provisions Page 2 of 15

5. DISPUTES

Pending resolution of a claim, the Contractor shall proceed diligently with the performance of the contract in accordance with the procurement officer's decision.

6. DRUG AND ALOCOHOL FREE WORKPLACE

The contractor warrants that the contractor shall comply with COMAR 21.11.08 Drug and Alcohol Free Workplace, and that the contractor shall remain in compliance throughout the term of this purchase order.

7. INDEMNIFICATION

The University shall not assume any obligation to indemnify, hold harmless, or pay attorneys' fees that may arise from or in any way be associated with the performance or operation of this agreement.

8. INTELLECTUAL PROPERTY

Contractor agrees to indemnify and save harmless the University, its officers, agents and employees with respect to any claim, action, costs, or judgment for patent infringement, or trademark or copyright violation arising out of purchase of use of materials, supplies, equipment or services covered by this Contract.

9. MODIFICATIONS AND AMENDMENTS

This Contract may be amended with the consent of both parties. Amendments may not change significantly the scope of the Contract.

10. NON-DISCRIMINATION IN EMPLOYMENT

If awarded a contract pursuant to this solicitation, the Offeror agrees to (a) not to discriminate in any manner against an employee or applicant for employment because of race, color, religion, creed, age, sex, sexual orientation, general identification, marital status, national origin, ancestry, genetic information or any otherwise unlawful use of characteristics, or disability of a qualified individual with a disability unrelated in nature and extent so as to reasonably preclude the performance of the employment, or the individual’s refusal to submit to a genetic test or make available the results of a genetic test; (b) to include a provision similar to that contained in subsection (a) above in any underlying subcontract except a subcontract for standard commercial supplies or raw materials; and (c) to post and cause subcontractors to post in conspicuous places available to employees and applicants for employment, notices setting forth the substance of this clause.

11. NON-HIRING OF OFFICIALS AND EMPLOYEES

No official or employee of the State, as defined under General Provisions Article § 5-502 whose duties as such official or employee include matters relating to or affecting the subject matter of this contract shall, during the pendency or term of this contract and while serving as an official or employee of the State, become or be an employee of the contractor or any entity that is a subcontractor on this contract.

12. PAYMENT OF STATE OBLIGATIONS

Unless a payment is unauthorized, deferred, delayed, or set-off under COMAR 21.02.07, Payments to the Contractor pursuant to this Contract shall be made no later than 30 days after the University’s receipt of a proper invoice from the Contractor.

Attachment A. Required Contract Provisions Page 3 of 15

The Contractor may be eligible to receive late payment interest at a rate of 9% per annum if:

(1) Contractor submits an invoice for the late payment interest within thirty days after the date of the State’s (or University’s) payment of the amount on which the interest accrued; and

(2) A contract claim has not been filed under State Finance and Procurement Article, Title 15, Subtitle 2, Annotated Code of Maryland.

The University) is not liable for interest:

(1) Accruing more than one year after the 31st days after the agency receives the proper invoice; or

(2) On any amount representing unpaid interest.

Charges for late payment of invoices are authorized only as prescribed by Title 15, Subtitle 1, of the State Finance and Procurement Article, Annotated Code of Maryland or by the Public Service Commission of Maryland with respect to regulated public utilities, as applicable.

13. POLICIES AND PROCEDURES

The USM Procurement Policies and Procedures in effect on the date of execution of this Contract are applicable to this Contract.

14. POLITICAL CONTRIBUTION DISCLOSURE

The Contractor shall comply with Election Law Article Title 14 Annotated Code of Maryland, which requires that every person that enters into a procurement contract with the State , a county, or a municipal corporation or other political subdivision of the State, during a calendar year in which the person receives a contract with a governmental entity in the amount of $200,000 or more, shall file with the State Board of Elections statements disclosing (a) any contributions made during the reporting period to a candidate for elective office in any primary or general election; and (b) the name of each candidate to whom one or more contribution in a cumulative amount of $500 or more were made during the reporting period. The statement shall be filed with the State Board of Elections

(a) before execution of a contract by the State (or University), a county, a municipal corporation or other political subdivision of the State, and shall cover the 24 months prior to when a contract was awarded; and (b) if the contribution is made after the execution of a contract, then twice a year, throughout the contract term, on or before (i) May 31, to cover the six (6) month period ending April 30; and (ii) November 30 to cover the six (6) month period ending October 31. Additional information is available on the State Board of Elections website: http://www.elections.state.md.us/campaign_finance/index.html

15. RETENTION OF RECORDS

The Contractor shall retain and maintain all records and documents relating to this Contract for three years after final payment by the State hereunder or any applicable statute of limitations, whichever is longer, and shall make them available for inspection and audit by authorized representatives of the State, including the procurement officer or designee, at all reasonable times.

16. SPECIFICATIONS

All materials, equipment, supplies or services shall conform to federal and State laws and http://www.elections.state.md.us/campaign_finance/index.html

Attachment A. Required Contract Provisions Page 4 of 15 regulations and to the specifications contained in the solicitation.

17. TAX EXEMPTION

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes, and transportation taxes. Exemption certificates shall be provided upon request. Where a Contractor is required to furnish and install material in the construction of improvement to real property in performance of the Contract, the Contractor shall pay the Maryland sales tax and the exemption does not apply.

If the Contractor’s price includes the cost of Contractor furnishing any other material, equipment, supplies, or other items in connection with the Contract, the Contractor shall pay the Maryland sales tax.

18. SUBCONTRACTING OR ASSIGNMENT

The benefits and obligations hereunder shall take effect and be binding upon the parties hereto and neither the contract nor the services to be performed thereunder shall be subcontracted, or assigned or otherwise disposed of, either in whole or in part, except with the prior written consent of the University.

19. MARYLAND LAW PREVAILS

This solicitation shall be construed, interpreted, and enforced according to the laws of the State of Maryland.

Contract-specific terms in USM Policy & Procedure

20. FINANCIAL DISCLOSURE

The Contractor shall comply with the provisions of Section 13-221 of the State Finance and Procurement Article of the Annotated Code of Maryland, which requires that every business that enters into contracts, leases, or other agreements with the State of Maryland or its agencies during a calendar year under which the business is to receive in the aggregate $200,000 or more, shall, within 30 days of the time when the aggregate value of these contracts, leases or other agreements reaches $200,000, file with the Secretary of State of Maryland certain specified information to include disclosure of beneficial ownership of the business.

21. TERMINATION FOR DEFAULT

If the Contractor fails to fulfill its obligation under this contract properly and on time, or otherwise violates any provision of the contract, the University may terminate the contract by written notice to the Contractor. The notice shall specify the acts or omissions relied upon as cause for termination. All finished or unfinished work provided by the Contractor shall, at the University's option, become the University's property. The University shall pay the Contractor fair and equitable compensation for satisfactory performance prior to receipt of notice of termination, less the amount of damages caused by Contractor's breach. If the damages are more than the compensation payable to the Contractor, the Contractor will remain liable after termination and the University can affirmatively collect damages. Termination hereunder, including the determination of the rights and obligations of the parties, shall be governed by the provisions of USM Procurement Policies and Procedures.

22. TERMINATION FOR CONVENIENCE

Upon written notice to the Contractor, the University may terminate this contract, in whole

Attachment A. Required Contract Provisions Page 5 of 15 or in part, whenever the University shall determine that such termination is in the best interest of the University. The University shall pay all reasonable costs incurred up to the date of termination and all reasonable costs associated with termination of the contract.

However, the Contractor may not be reimbursed for anticipatory profits. Termination hereunder, including the determination of the rights and obligations of the parties, shall be governed by the provisions of USM Procurement Policies and Procedures.

23. MANDATED CONTRACTOR REPORTING OF SUSPECTED CHILD ABUSE

AND NEGLECT

Maryland law contains mandatory reporting requirements for all individuals who suspect child abuse or neglect. Contractors performing work on campus also must comply with USM Board of Regents (BOR) VI-1.50 – Policy on the Reporting of Suspected Child Abuse & Neglect, as well as the University Procedures for Reporting Suspected Child Abuse and Neglect. The above-referenced USM/University Policy and Procedures are available in full at the following link: https://www.usmd.edu/regents/bylaws/SectionVI/ and are incorporated herein. The University reserves the right to terminate the contract if Contractor fails to comply with the above-referenced policy or procedures, or if, in the judgment of the University, termination is necessary to protect the safety and welfare of children who come into contact with the University community.

24. GRAMM-LEACH BLILEY ACT OF 1999

The Contractor agrees that in performing its obligations under this contract, the Contractor shall comply with all requirements of a non-affiliated third-party who receives a financial institution’s consumer or customer information, under the Gramm-Leach-Bliley Act of 1999 and applicable regulations thereto (the “GLB Act”), and other applicable federal and state consumer privacy acts, rules and regulations. Nonpublic personal information shall have the same meaning as that term is defined in the GLB Act.

a. The Contractor agrees to disclose such nonpublic personal information for the sole purpose of facilitating the Contractor’s performance of its duties and obligations under this contract and will not disclose such nonpublic personal information to any other party unless such disclosure is

(i) allowed by the GLB Act and consented to by the Customer, or

(ii) compelled by law, in which case the Contractor will provide notice of such disclosure to the Customer.

b. The Contractor represents and warrants that it will, for so long as it retains nonpublic personal information, implement and maintain in place the necessary information security policies and procedures for (i) protecting the confidentiality of such nonpublic person information, (ii) protecting against any anticipated threats or hazards to the security or integrity of such nonpublic personal information, and (iii) protecting against the unauthorized access to or use of such nonpublic personal information. These terms apply to all subcontractors employed by the Contractor who perform work under the scope of this agreement.

25. CONFIDENTIALITY; DISSEMINATION OF INFORMATION

Contractor shall not release any information related to services or performance of the services under this Contract, nor publish any final reports or documents without the prior written approval of the University. Contractor shall indemnify and hold harmless the State and the University, its officers, agents and employees from all harm which may be incurred by reason of dissemination, publication, distribution or circulation, in any https://www.usmd.edu/regents/bylaws/SectionVI/

Attachment A. Required Contract Provisions Page 6 of 15 manner whatsoever, of any information, data, documents, or materials pertaining in any way to this Contract by Contractor, its agents or employees.

26. DELAYS AND EXTENSIONS OF TIME

The Contractor agrees to prosecute the work continuously and diligently and no charges or claims for damages shall be made by it for any delays or hindrances from any cause whatsoever during the progress of any portion of the work specified in this Contract.

Time extensions will be granted only for excusable delays that arise from unforeseeable causes beyond the control and without the fault or negligence of the Contractor, including but not restricted to, acts of God, acts of the public enemy, acts of the State in either its sovereign or contractual capacity, acts of another Contractor in the performance of a contract with the State, fires, floods, epidemics, quarantine restrictions, strikes, freight embargoes, or delays of subcontractors or suppliers arising from unforeseeable causes beyond the control and without the fault or negligence of either the Contractor or the subcontractors or suppliers.

27. SUSPENSION OF WORK

The procurement officer unilaterally may order the Contractor in writing to suspend, delay, or interrupt all or any part of the work for such period of time as he may determine to be appropriate for the convenience of the University.

28. MULTI-YEAR CONTRACTS CONTINGENT UPON APPROPRIATIONS

If the General Assembly fails to appropriate funds or if funds are not otherwise made available for continued performance for any fiscal period of this Contract succeeding the first fiscal period, this Contract shall be canceled automatically as of the beginning of the fiscal year for which funds were not appropriated or otherwise made available; provided, however, that this will not affect either the University's rights or the Contractor's rights under any termination clause in this Contract. The effect of termination of the Contract hereunder will be to discharge both the Contractor and the University from future perfor-mance of the Contract, but not from their rights and obligations existing at the time of termination. The Contractor shall be reimbursed for the reasonable value of any non-recurring costs incurred but not amortized in the price of the Contract. The University shall notify the Contractor as soon as it has knowledge that funds may not be available for the continuation of this Contract for each succeeding fiscal period beyond the first.

29. RESPONSIBILITY FOR CLAIMS AND LIABILITY

The Contractor shall be responsible for all damage to life and property due to its activities or those of its agents or employees, in connection with the services required under the contract. Further, it is expressly understood that the Contractor shall indemnify and save harmless the University, its officers, agents, and employees from and against all claims, suits, judgments, expenses, actions, damages and costs of every name and description, including reasonable attorney’s fees and litigation expenses arising out of or resulting from the negligent performance of the services of the Contractor under the contract.

30. SOFTWARE CONTRACTS

a. As specifically provided by § 21-104, Commercial Law Article, Annotated Code of Maryland, the parties agree that this contract shall not be governed by the Uniform Computer Information Transactions Act (UCITA), Title 21 of the Commercial Law Article of the Annotated Code of Maryland, as amended from time to time. This contract shall be governed by the common law of Maryland relating to written agreements, as well

Attachment A. Required Contract Provisions Page 7 of 15 as other statutory provisions, other than UCITA, which may apply, and shall be interpreted and enforced as if UCITA had never been adopted in Maryland.

b. Contractor agrees that as delivered to buyer, the software does not contain any program code, virus, worm, trap door, back door, timer or clock that would erase data or programming or otherwise cause the software to become inoperable, inaccessible, or incapable of being used in accordance with its user manuals, either automatically upon the occurrence of selected conditions, or manually on command of Contractor.

31. NON-VISUAL ACCESS CLAUSE

The bidder or offeror warrants that the information technology offered under this bid or proposal (1) provides equivalent access for effective use by both visual and nonvisual means; (2) will present information, including prompts used for interactive communications, in formats intended for both visual and nonvisual use; (3) if intended for use in a network, can be integrated into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired;

and (4) is available, whenever possible, without modification for compatibility with software and hardware for nonvisual access. The bidder or offeror further warrants that the costs, if any, of modifying the information technology for compatibility with software and hardware used for nonvisual access will not increase the cost of the information technology by more than 15 percent.

For purposes of this section, the phrase “equivalent access” means that the ability to receive, use and manipulate information and operate controls necessary to access and use information technology by nonvisual means. Examples of equivalent access include keyboard controls used for input and synthesized speech, Braille, or other audible or tactile means used for output.

32. OWNERSHIP OF DOCUMENTS AND MATERIALS

The Contractor agrees that all documents and materials including, but not limited to, reports, drawings, studies, specifications, estimates, maps, photographs, designs, graphics, mechanical, artwork, and computations prepared by or for it under the terms of the contract shall at any time during the performance of the services be made available to the University upon request by the University and shall become and remain the exclusive property of the University upon termination or completion of the services. The University shall have the right to use same without restriction or limitation and without compensation to the Contractor other than that provided by the contract. The University shall be the owner for purposes of copyright, patent or trademark registration.

33. FERPA

The Parties agree to maintain the privacy and security of personally identifiable educational records and health information and to prevent disclosure in compliance with Federal laws.

34. CONTRACT AFFIDAVIT

Contractor shall execute the Contract Affidavit required by the University which shall be in substantially the same form as the Maryland form at the time the contract is executed by the University.

35. CONTINGENT FEES

The Contractor warrants that it has not employed or retained any person, partnership, corporation, or other entity, other than a bona fide employee or agent working for the

Attachment A. Required Contract Provisions Page 8 of 15

Contractor, to solicit or secure this agreement, and that it has not paid or agreed to pay any person, partnership, corporation, or other entity, other than a bona fide employee or agent, any fee or any other consideration contingent on the making of this agreement.

36. LIQUIDATED DAMAGES

The Bidder/Offeror is advised that liquidated damages will apply in the event the Contractor fails to comply in good faith with the requirements of the MBE program and pertinent Contract provisions.

37. INSURANCE

The Contractor shall defend, indemnify and save harmless the State of Maryland, the University System of Maryland, Coppin State University, and each of their officers, employees and agents, from any and all claims, liability, losses and causes of actions which may arise out of the performance by the Contractor, employees or agents, of the work covered by this Contract.

a. The Contractor shall secure, pay the premiums for, and keep in force until the expiration of this Agreement, and any renewal thereof, adequate insurance as provided below, such insurance to specifically include liability assumed by the Contractor under this Agreement.

i. Commercial General Liability Insurance:

$2,000,000 each occurrence $2,000,000 personal injury $2,000,000 products/completed operations $2,000,000 general aggregated

ii. Workmen’s Compensation and Unemployment Insurance:

As required by the laws of the State of Maryland

iii. Property Damage Liability Insurance:

$2,000,000 each accident

iv. Automotive Insurance:

$1,000,000 Bodily injury liability insurance each person and $2,000,000 for each accident.

$2,000,000_ Property damage liability insurance for each accident.

b. All policies for liability protections, bodily injury or property damage (except for professional liability insurance) must specifically name on its face, CSU as an additional insured as respects to operations under the contract and premises occupied by the Contractor provided, however, with respect to the Contractor’s liability for bodily injury or property damage, such insurance shall cover and not exclude Contractor’s liability for injury to the property of CSU and to the persons or property of employees, students, faculty members, agents, officers, regents, invitees or guests of CSU.

c. Each insurance policy shall contain the following endorsements: “It is understood and agreed that the Insurance Company shall notify in writing the CSU Procurement Officer forty-five days in advance of the effective date of any reduction in or cancellation of this policy”. A certificate of each policy of insurance shall be furnished to the Procurement Officer. With the exception of Worker’s Compensation, upon the request of the Procurement Officer a certified true copy of each policy of insurance, including the above endorsement manually countersigned by an authorized representative of the insurance company, shall be furnished to the Procurement Officer. A certificate of insurance for Worker’s Compensation together with a properly executed endorsement for cancellation notice shall also be furnished. Following the notice of Contract award, the requested

Attachment A. Required Contract Provisions Page 9 of 15

Certificates and Policies shall be delivered as directed by the Procurement Officer.

Notices of policy changes shall be furnished to the Procurement Officer.

d. All required insurance coverage must be acquired from insurers allowed to do business in the State of Maryland and acceptable to CSU. The insurers must have a policyholders’ rating of “A-“ or better, and a financial size of “Class VII” or better in the latest edition of Best’s Insurance Reports.

In addition to satisfying Institution’s standard insurance requirements, Contractor shall obtain and carry the following:

e. Network Security & Privacy Liability (also known as Cyber Liability) insurance with limits not less than $3,000,000 for liability and damages resulting from any misuse, misappropriation, unauthorized disclosure or other breach of private information and personally identifiable information, arising from Contractor’s performance of services.

Such damages shall include notification costs and/or forensics costs, fines, penalties, and related damages.

f. In cases where personally identifiable information (“PII”), personal health information (“PHI”), electronic personal health information (“ePHI”), electronic medical records (“EMR”), or FERPA Data are involved, insurance is required with limits not less than $5,000,000 for liability and damages resulting from any misuse, misappropriation, unauthorized disclosure or other breach of private information and personally identifiable information, arising from Contractor’s performance of services. Such damages shall include notification costs and/or forensics costs, fines, penalties, and related damages.

g. This requirement may be satisfied by a stand-alone policy or via Professional Liability/ Technology Errors & Omissions insurance policy. If Network Security & Privacy Liability is included in Contractor’s Professional Liability insurance policy, the Network Security & Privacy Liability insurance, including its applicable limit, must be specifically evidenced on the Certificate of Insurance.

38. PERFORMANCE BOND

The successful offeror shall be required to submit a performance bond in the amount of $1,000,000 and shall renew the bond at the beginning of each contract year. The bond shall be in the form included as Attachment I; information regarding other forms of security allowed under the USM Board of Regents Procurement Policies and Procedures will be provided upon request to the Procurement Officer.

39. ETHICS

This Agreement is cancelable in the event of a violation of the Maryland Public Ethics Law by the Contractor or any University employee in connection with this Agreement.

40. I-9 REQUIREMENT

Contractor warrants and represents that it is currently in compliance, and that during the term of the contract it will remain in compliance, with the Immigration Reform and Control Act of 1986, and that it will obtain original valid employment verification documentation from all its employees on a timely basis as required by law and regulation.

This requirement also applies to all subcontractors hired by Contractor.

41. LOCAL CONDITIONS COVERING WORK

The Contractor shall cooperate with those on the premises to prevent the entrance and exit of all workers and/or others whose presence is forbidden or undesirable and in bringing, Attachment A. Required Contract Provisions Page 10 of 15 storing or removal of all materials, equipment, to observe all rules and regulations in force on the grounds to avoid unnecessary dust or accumulated debris or the undue interference with the convenience, sanitation or routine of the University and to prevent the loss of, or damage to the property of the University and/or its employees.

42. PATENTS, COPYRIGHTS AND TRADE SECRETS

a. If the Contractor furnishes any design, device, material, process or other item which is covered by a patent or copyright or which is proprietary to or a trade secret of another, Contractor shall obtain the necessary permission or license to use such item.

b. Contractor will defend or settle, at its own expense, any claim or suit against the State alleging that any such item furnished by Contractor infringes any patent, trademark, copyright, or trade secret. Contractor also will pay all damages and costs that by final judgment may be assessed against the State due to such infringement and all attorneys’ fees and litigation expenses reasonably incurred by the State to defend against such a claim or suit. The obligations of this paragraph are in addition to those stated in paragraph c.

c. If any products furnished by Contractor become, or in Contractor's opinion are likely to become, the subject of a claim of infringement, Contractor will, at its option: (1) procure for the State the right to continue using the applicable item; (2) replace the product with a non-infringing product substantially complying with the item's specifications; or

(3) modify the item so it becomes non-infringing and performs in a substantially similar manner to the original item.

43. RESPONSIBILITY FOR DAMAGE

a. The Contractor shall repair and restore to its original condition any equipment, materials or surfaces damaged by its operations.

b. The Contractor shall be entirely responsible for any loss or damage to its own materials, supplies, and equipment, and to the personal property of its employees while they are in the building.

c. The Contractor shall be solely responsible for any damage to the building or its contents for any loss or damage to any property belonging to the University or the University employees when such loss or damage may be attributable to their actions or negligence or the actions or negligence of their employees.

44. SET-OFF

The University may deduct from and set off against any amounts due and payable to the Contractor any back-charges or damages sustained by the University by virtue of any breach of the contract by the Contractor or by virtue of the failure or refusal of the Contractor to perform the services or any part of the services in a satisfactory manner.

Nothing herein shall be construed to relieve the Contractor of liability for additional costs resulting from a failure to satisfactorily perform the services.

45. USE OF CONTRACTOR'S FORMS NOT BINDING ON STATE

a. Except as provided in b., the use or execution by the State of any forms, orders, agreements, or other documents of any kind, other than the contract documents, used pursuant to or in the administration of any contract awarded by the State to Contractor, shall not bind the State to any of the terms and conditions contained therein except those provisions:

Attachment A. Required Contract Provisions Page 11 of 15

(1) generally describing, for the purposes of ordering: Equipment or services to be provided, locations, quantities, delivery or installation dates, and, to the extent consistent with the contract documents, prices; and

(2) not otherwise inconsistent with the contract documents.

b. Any such form, order, agreement or other document shall not vary, modify, or amend the terms and provisions of the contract documents, notwithstanding any provision to the contrary in such document, unless all of the following conditions are met:

(1) the document expressly refers to the particular document and provision of the contract documents being modified and plainly and conspicuously identifies any modification thereto as a modification:

(2) the document is executed on behalf of the State by the procurement officer;

and

(3) execution of the document is approved by the procurement authority whose approval is required by law.

46. PROMPT PAYMENT OF SUBCONTRACTORS

a. This contract and all subcontracts issued under this contract are subject to the provisions of State Finance and Procurement Article, §15-226, Annotated Code of Maryland.

References to “undisputed amount”, “prime contractor”, “contractor” and “subcontractor” have the meanings stated in Section 6.2 a-d herein have the meanings state in COMAR 21.10.08.01.

b. A contractor shall promptly pay its subcontractors an undisputed amount to which a subcontractor is entitled for work performed under this contract within 10 calendar days after the contractor receives a progress payment or final payment for work under this contract.

c. If a contractor fails to make payment within the period prescribed in b., a subcontractor may request a remedy in accordance with COMAR 21.10.08.

d. A contractor shall include in its subcontracts for work under the contract, wording that incorporates the provisions, duties, and obligations of 6.1 a-d: State Finance and Procurement Article, §15-226, Annotated Code of Maryland; and COMAR 21.10.08.

47. CREDIT CARD DATA (PCI–DSS COMPLIANCE)

a. Contractor acknowledges that it is responsible for the security of cardholder data to the extent that Contractor possesses or otherwise stores, processes, or transmits cardholder data on behalf of Institution, or to the extent that Contractor can impact or affect the security of the cardholder data environment. Furthermore, Contractor agrees not to introduce, import, or store credit card data within Institution’s network, thus triggering a requirement for PCI compliance within Institution’s general network.

b. Contractor affirms that, as of the effective date of the Contract, Contractor and any third- party provider with whom Contractor subcontracts in connection with the Contract (“Contractor’s Third-Party Provider”) has complied with all applicable PCI requirements, is considered compliant with the Payment Card Industry Data Security Standard (“PCI DSS”), and has performed the necessary steps to validate Contractor’s, and, as applicable, Contractor’s Third-Party Provider’s, compliance with the PCI DSS. Furthermore, Attachment A. Required Contract Provisions Page 12 of 15

Contractor affirms that in any performance hereunder Contractor and Contractor’s Third- Party Provider shall remain compliant with all laws and regulations applicable to the provision of the services, including payment and PCI-related services or solutions.

c. Contractor agrees to supply the status of Contractor’s, and Contractor’s Third-Party Provider’s, PCI DSS compliance to Institution, and evidence of its most recent validation of compliance, upon execution of the Contract and at least annually thereafter.

d. Contractor will immediately notify Institution if Contractor learns that Contractor, or Contractor’s Third-Party Provider, is no longer PCI DSS compliant, and will immediately inform Institution of the steps Contractor is taking to remediate the non- compliance status. In no event should Contractor’s notification to Institution be later than seven (7) calendar days after Contractor learns Contractor or Contractor’s Third- Party Provider is no longer PCI DSS compliant.

e. Institution may terminate the Contract immediately without penalty upon notice to the Contractor in the event Contractor, or Contractor’s Third-Party Provider, fails to maintain compliance with the PCI DSS or fails to maintain the confidentiality or integrity of any cardholder data.

48. SECURITY AND DATA PROTOCOLS

a. Contractor shall support SAML2/Shibboleth or shall provide another method of multi-factor authentication (“MFA”), which alternate method must be acceptable to Institution.

b. Contractor represents and warrants that all Institution Data shall be stored on servers within the United States. Contractor shall notify Institution in writing not less than one hundred and eighty (180) days in advance of any changes in the location of Institution Data if, as a result of the change, Institution Data will be stored outside of the United States.

c. Contractor agrees that any transfer of Institution Data between Institution and the Contractor, or within Contractor’s computing environment, will take place using then-current industry standard encryption protocols.

d. Contractor certifies that Institution Data will be stored, maintained, and transferred in an encrypted format using at least then-current industry standard encryption practices.

e. Contractor will substantially comply with Open Web Application Security Project (“OWASP”) Secure Coding Practices or similar industry secure coding practices.

f. Institution shall have the right at all times for any reason whatsoever in its sole discretion, including for purposes of discovery of electronically stored information, to access, retrieve, collect, search, copy and/or remove any or all Institution Data at any time.

Contractor will aid such access, retrieval, collection, searching, copying and/or removal immediately upon receipt of a written request from Institution.

g. Maryland Law on Protection of Personally Identifiable Information: As required by Md. Code Ann., State Government Article, Title 10, Subtitle 13 (“Protection of Information by Government Agencies”), and Md. Code Ann., State Government Article, §10-13A-03 (“Protection of Personally Identifiable Information by Public Institutions of Higher Education”), Contractor will maintain privacy and security governance programs that conform with the law and support the security and privacy programs of the Institution.

h. International Data Privacy Law Compliance: If any Institution Data created, hosted, maintained, stored, processed, or accessed by or otherwise made available to Contractor pursuant to the Contract is subject to international data privacy laws, including but not

Attachment A. Required Contract Provisions Page 13 of 15 limited to the EU General Data Protection Regulation, Contractor agrees that it will execute the then-current version of any regulatorily-required standard contractual clauses pursuant to such laws.

49. THIRD PARTY REPORTS

a. Institution requires that Contractor provide assurances that Contractor has established and continuously maintains Appropriate Measures in its handling of Institution Data.

b. Contractor shall make available a report of a third-party review by a recognized independent audit organization. Such report must be submitted upon granting of the Contract; upon renewal of the Contract; and at other times if requested by Institution.

Examples of acceptable control assessment reports include (but are not limited to): 1) AICPA SOC2/Type2 2) ISO 27001/2 Certification 3) FedRAMP Authorization

c. If Contractor does not have the reports specified in Section 6(b), then Contractor must submit a Higher Education Cloud Vendor Assessment Tool (“HECVAT”) upon execution of the Contract, upon renewal of the Contract, and at other times if requested. If, in its sole discretion, Institution believes that Contractor’s HECVAT responses do not comply with Appropriate Measures, such non-compliance will be considered a material breach of the Agreement.

d. If Contractor fails to provide any reports required by this Section on the anniversary of the Contract’s effective date, such reports shall be provided to Institution within thirty (30) days of Contractor’s receipt of a written request.

e. Unless waived or amended by the Institution in writing, Contractor shall perform a formal penetration test on an annual basis. Contractor shall make the results of such tests available to Institution each year on the anniversary of the effective date of the Contract.

1) If Contractor fails to provide the penetration test results on the anniversary of the Contract’s effective date, such results shall be provided to Institution within thirty (30) days of Contractor’s receipt of a written request.

2) If a penetration test results in a negative finding, then Contractor shall re-perform penetration tests at Contractor’s expense until the negative finding is resolved.

3) A penetration test means “the process of using approved, qualified personnel to conduct real-world attacks against a system so as to identify and correct security weaknesses before they are discovered and exploited by others.”

4) This penetration test must be performed at Contractor’s expense by a third-party. The identity of the third party will be disclosed to Institution upon request.

50. SECURITY INCIDENT

a. If Contractor becomes aware of a Security Incident, Contractor will notify the Institution within 48 hours of the time Contractor becomes aware the Security Incident occurred. The notice to the institution shall include: 1) the nature and scope of the incident and the affected records or data; and 2) steps that Contractor has taken to mitigate any further incidents and prevent further incidents.

b. If the Contractor becomes aware that a Security Breach has occurred, Contractor will provide notice of the Security Breach to the institution within 48 hours of the time the Contractor

Attachment A. Required Contract Provisions Page 14 of 15

51. ACCESSIBILITY

For Information and Communications Technology (ICT), Contractor must ensure that products or services provided under the contract conform to the W3C Web Content Accessibility Guidelines, version (WCAG) 2.2 at conformance levels A and AA, Section 508 and applicable accessibility standards identified in a fully completed Supplier Accessibility Statement (to be provided by the University upon request) Contractor will provide to the University.

To the extent that the Contractor’s products or services fail to meet accessibility standards, the Contractor shall describe, by using the Accessibility Roadmap (to be provided by the University upon request), its plan for Contractor’s products' or services' conformance to the aforementioned accessibility standards. Contractor will support the University in providing equally effective alternate access for non-conforming products or services by providing alternate access workarounds until such time the product is fully conformant to any applicable accessibility standards identified in the Accessibility Roadmap and WCAG

2.2 A&AA and Section 508.

Contractor agrees to use commercially reasonable efforts to promptly respond to and resolve complaints regarding accessibility of its products or services. Failure to comply with the terms of this section shall constitute a breach of the contract and the University may terminate the contract in its sole discretion. Failure to exercise its termination rights under this section does not constitute a waiver of those rights.

For non-web based EITs, Contractor warrants that the products or services to be provided under this contract comply with the accessibility requirements of section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d), and its implementing regulations set forth at Title 36, Code of Federal Regulations, Part 1194. Contractor agrees to promptly respond to and resolve any complaint regarding accessibility of its products or services. Contractor further agrees to indemnify and hold harmless University from any claims arising out of its failure to comply with the aforesaid requirements. Failure to comply with these requirements shall constitute a breach and be grounds for termination of the Contract.

52. CONTINUOUS PERFORMANCE OF KEY PERSONNEL

a. Key Personnel shall be available to perform Contract requirements as of the NTP Date.

b. Key Personnel shall perform continuously for the duration of the Contract, or such lesser duration as specified in the Proposal. Key Personnel may not be removed by the Consultant from working under the Contract without the prior written approval of the University.

c. Substitution of Personnel

Substitution Prior to and Within 30 Days After Contract Execution Prior to Contract execution or within thirty (30) days after Contract execution, the Offeror may not substitute proposed Key Personnel except under the following circumstances (a) for actual full-time personnel employed directly by the Offeror: the vacancy occurs due to the sudden termination, resignation, or approved leave of absence due to an Extraordinary Personal Event, or the death of such personnel; and (b) for any temporary staff, subcontractors or 1099 contractors: the vacancy occurs due to an Incapacitating event or the death of such personnel. To qualify for such substitution, the Offeror must demonstrate to the CSU's satisfaction the event necessitating substitution. Proposed substitutions shall be of equal caliber or higher, in the CSU's sole discretion. Proposed substitutes deemed

Attachment A. Required Contract Provisions Page 15 of 15 by the University to be less qualified than the originally proposed individual may be grounds for pre-award disqualification or post-award termination

d. Consultant Personnel General Substitution Provisions

1) The Consultant shall submit a substitution request to the Contract Monitor at least fifteen (15) days prior to the intended date of change. A substitution may not occur unless and until the Contract Monitor approves the substitution in writing.

2) The Consultant shall demonstrate to the University’s satisfaction that the proposed substitute has qualifications at least equal to those of the Consultant Personnel proposed to be replaced.

3) The Consultant shall provide the Contract Monitor with a substitution request that shall include:

i. A detailed explanation of the reason(s) for the substitution request;

ii. The resume of the proposed substitute;

iii. Evidence of any required credentials.

4) The University may request additional information concerning the proposed substitution and may interview the proposed substitute personnel prior to deciding whether to approve the substitution request.

5) The University will notify the Consultant in writing of: (i) the acceptance or denial, or

(ii) contingent or temporary approval for a specified time limit, of the requested substitution. The University will not unreasonably withhold approval of a proposed Consultant Personnel replacement.

Attachment B. Bid Proposal Affidavit effective date: July 2024 Page 1 of 6

ATTACHMENT B. BID/PROPOSAL AFFIDAVIT

A. AUTHORITY

I hereby affirm that I, (name of affiant) am the (title) and duly authorized representative of

(name of business entity) and that I possess the legal authority to make this affidavit on behalf of the business for which I am acting.

A. CERTIFICATION REGARDING COMMERCIAL NONDISCRIMINATION

The undersigned Bidder/Offeror hereby certifies and agrees that the following information is correct: In preparing its Bid/Proposal on this project, the Bidder/Offeror has considered all Bid/Proposals submitted from qualified, potential subcontractors and suppliers, and has not engaged in “discrimination” as defined in § 19-103 of the State Finance and Procurement Article of the Annotated Code of Maryland. “Discrimination” means any disadvantage, difference, distinction, or preference in the solicitation, selection, hiring, or commercial treatment of a vendor, subcontractor, or commercial customer on the basis of race, color, religion, ancestry, or national origin, sex, age, marital status, sexual orientation, sexual identity, genetic information or an individual’s refusal to submit to a genetic test or make available the results of a genetic test, disability, or any otherwise unlawful use of characteristics regarding the vendor’s, supplier’s, or commercial customer’s employees or owners.

“Discrimination” also includes retaliating against any person or other entity for reporting any incident of “discrimination”. Without limiting any other provision of the solicitation on this project, it is understood that, if the certification is false, such false certification constitutes grounds for the State to reject the Bid/Proposal submitted by the Bidder/Offeror on this project, and terminate any contract awarded based on the Bid/Proposal.

As part of its Bid/Proposal, the Bidder/Offeror herewith…