RFP 210000002538- SCHEDULES D, E AND F WITH EXHIBITS- 8-18-21.docx

Michigan.gov/MiProcurement Schedule D - CONTRACTOR HOSTED SOFTWARE AND SERVICES

1. Definitions. In addition to the definitions found in the Contract Terms, for the purposes of this Contract, the following terms have the following meanings:

“Authorized Users” means all Persons authorized by the State to access and use the Software under this Contract, subject to the maximum number of users specified in the applicable Statement of Work.

“Harmful Code” means any software, hardware or other technologies, devices or means, the purpose or effect of which is to: (a) permit unauthorized access to, or to destroy, disrupt, disable, encrypt, modify, copy, or otherwise harm or impede in any manner, any (i) computer, software, firmware, data, hardware, system or network, or (ii) any application or function of any of the foregoing or the integrity, use or operation of any data Processed thereby; or (b) prevent the State or any Authorized User from accessing or using the Services as intended by this Contract, and includes any virus, bug, trojan horse, worm, backdoor or other malicious computer code and any time bomb or drop dead device.

“Hosted Services” means the hosting, management and operation of the Operating Environment, Software, other services (including support and subcontracted services), and related resources for remote electronic access and use by the State and its Authorized Users, including any services and facilities related to disaster recovery obligations as described in one or more written, sequentially numbered, statements of work referencing this Contract, including all Specifications set forth in such statements of work, which, upon their execution will be attached as Schedule A to this Contract and by this reference are incorporated in and made a part of this Contract.

“Integration Testing” has the meaning set forth in Section 4.2(c).

“Open-Source Components” means any software component that is subject to any open-source copyright license agreement, including any GNU General Public License or GNU Library or Lesser Public License, or other obligation, restriction or license agreement that substantially conforms to the Open Source Definition as prescribed by the Open Source Initiative or otherwise may require disclosure or licensing to any third party of any source code with which such software component is used or compiled.

“Open-Source License” has the meaning set forth in Section 2.3.

“Operating Environment” means, collectively, the platform, environment and conditions on, in or under which the Software is intended to be installed and operate, as set forth in a Statement of Work, including such structural, functional and other features, conditions and components as hardware, operating software, system architecture, configuration, computing hardware, ancillary equipment, networking, software, firmware, databases, data, and electronic systems (including database management systems).

“Service Error” means any failure of any Hosted Service to be Available or otherwise perform in accordance with this Schedule.

“Specifications” means the specifications for the Software set forth in the applicable Statement of Work and, to the extent consistent with and not limiting of the foregoing, the Documentation.

“State Materials” means all materials and information, including documents, data, know-how, ideas, methodologies, specifications, software, content and technology, in any form or media, directly or indirectly provided or made available to Contractor by or on behalf of the State in connection with this Contract.

“Support Services” means the Software maintenance and support services Contractor is required to or otherwise does provide to the State pursuant to this Schedule D and Exhibit 1 to this Schedule D.

“Technical Specification” means, with respect to any Software, the document setting forth the technical specifications for such Software and included in the Statement of Work.

“User Data” means all data, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, processed, generated or output by any device, system or network by or on behalf of the State, including any and all works, inventions, data, analyses and other information and materials resulting from any use of the Software by or on behalf of the State under this Contract, except that User Data does not include the Software or data, information or content, including any GUI, audio, visual or digital or other display or output, that is generated automatically upon executing the Software without additional user input.

“Warranty Period” means the ninety (90) calendar-day period commencing on the date of the State's Acceptance of the Software.

2. Hosted Software License Grant and Source Code Escrow

1.1 Contractor License Grant. Contractor hereby grants to the State, exercisable by and through its Authorized Users, a nonexclusive, royalty-free, irrevocable (except as provided herein) right and license during the Term and such additional periods, if any, as Contractor is required to perform Services under this Contract or any Statement of Work, to:

1. access and use the Hosted Services, including in operation with other software, hardware, systems, networks and services, for the State’s business purposes, including for Processing State Data;

1. generate, print, copy, upload, download, store and otherwise Process all GUI, audio, visual, digital and other output, displays and other content as may result from any access to or use of the Hosted Services;

1. prepare, reproduce, print, download and use a reasonable number of copies of the Specifications and Documentation for any use of the Hosted Services under this Contract; and

1. access and use the Hosted Services for all such non-production uses and applications as may be necessary or useful for the effective use of the Hosted Services hereunder, including for purposes of analysis, development, configuration, integration, testing, training, maintenance, support and repair, which access and use will be without charge and not included for any purpose in any calculation of the State’s or its Authorized Users’ use of the Hosted Services, including for purposes of assessing any Fees or other consideration payable to Contractor or determining any excess use of the Hosted Services as described in Section 2.2.

1.2 License Restrictions. The State will not: (a) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer or otherwise make the Hosted Services available to any third party, except as expressly permitted by this Contract or in any Statement of Work; or (b) use or authorize the use of the Hosted Services or Documentation in any manner or for any purpose that is unlawful under applicable Law.

1.3 Use. The State will pay Contractor the corresponding Fees set forth in the Statement of Work for all Authorized Users access and use of the Hosted Services or Software. Such Fees will be Contractor’s sole and exclusive remedy for use of the Hosted Services or Software, including any excess use.

1.4 Open-Source Licenses. For Contractor Hosted Software only (and not for the provision of Software-as-a-Service), any use hereunder of Open-Source Components shall be governed by, and subject to, the terms and conditions of the applicable open-source license (“Open-Source License”). Contractor shall identify and describe in an exhibit to the Statement of Work each of the Approved Open-Source Components of the Software, and include an exhibit attaching all applicable Open-Source Software Licenses or identifying the URL where these licenses are publicly available.

1.5 Source Code Escrow. The parties may enter into a separate intellectual property escrow agreement. Such escrow agreement will govern all aspects of Source Code escrow and release. Contractor hereby grants the State a license to use, reproduce, and create derivative works from the deposit material, provided the State may not distribute or sublicense the deposit material or make any use of it whatsoever except for such internal use as is necessary to maintain and support the Software. Copies of the deposit material created or transferred pursuant to this Contract are licensed, not sold, and the State receives no title to or ownership of any copy or of the deposit material itself. The deposit material constitutes Confidential Information of Contractor pursuant to Section 38.a of this Contract (provided no provision of Section 38.e calling for return of Confidential Information before termination of this Contract will apply to the deposit material).

3. Hosted Services Testing and Acceptance.

3.1 Hosted Service Preparation. Promptly upon the parties’ execution of a Statement of Work, Contractor will take all steps necessary to make the Hosted Services procured thereunder ready and available for the State’s use in accordance with the Statement of Work and this Contract, including any applicable milestone date or dates set forth in such Statement of Work.

3.2 Testing and Acceptance.

(a) When Contractor notifies the State in writing that the Hosted Services are ready for use in a production environment, the State will have thirty (30) days (or such other period as may be agreed upon by the Parties in writing) from receipt of the notice to test the Hosted Services to determine whether they comply in all material respects with the requirements of this Contract and the Specifications.

(b) Upon completion of the State’s testing, the State will notify Contractor of its acceptance (“Accept” or “Acceptance”) or, if it has identified any noncompliance with the Specifications, rejection (“Reject” or “Rejection”) of the Hosted Services. If the State Rejects the Hosted Services, the State will provide a written list of items that must be corrected. On receipt of the State’s notice, Contractor will promptly commence, at no additional cost or charge to the State, all reasonable efforts to complete, as quickly as possible and in any event within twenty (20) days (or such other period as may be agreed upon by the Parties in writing) from receipt of the State’s notice, such necessary corrections, repairs and modifications to the Hosted Services to bring them into full compliance with the Specifications.

(c) If any corrective measures are required under Section 3.2(b), upon completion of all such measures, Contractor will notify the State in writing and the process set forth in Section 3.2(a) and Section 3.2(b) will be repeated; provided that if the State determines that the Hosted Services, as revised, still do not comply in all material respects with the Specifications, the State may, in its sole discretion:

(i) require the Contractor to repeat the correction, repair and modification process set forth in Section 3.2(b) at no additional cost or charge to the State; or

(ii) terminate any and all of the relevant Statement of Work, this Contract and any other Statements of Work hereunder.

(d) The parties will repeat the foregoing procedure until the State Accepts the Hosted Services or elects to terminate the relevant Statement of Work as provided in Section 3.2(c)(ii) above. If the State so terminates the relevant Statement of Work, Contractor must refund to the State all sums previously paid to Contractor under such Statement of Work within ten (10) Business Days of the State’s written notice of termination, and the State will be relieved of all obligations thereunder.

4. Support Services.

1.1 Maintenance and Support Services. Contractor will provide Hosted Service maintenance and support services (collectively, “Support Services”) in accordance with the provisions set forth in this Schedule D and in the Service Level Agreement, attached as Exhibit 1 to this Schedule D(the “Support Services and Service Level Agreement”).

1.2 Maintenance Services. Contractor will provide Hosted Service maintenance and support services (collectively, “Software Support Services”) in accordance with the provisions of this Schedule D, including Exhibit 1 to this Schedule D. The Software Support Services are included in the Services, and Contractor may not assess any additional fees, costs or charges for such Software Support Services. Contractor will continuously maintain the Hosted Services to optimize Availability that meets or exceeds the Availability Requirement as defined in Exhibit 1 to this Schedule D. Such maintenance services include providing to the State and its Authorized Users:

(a) all updates, bug fixes, enhancements, new releases, new versions and other improvements to the Hosted Services, including the Software, that Contractor provides at no additional charge to its other similarly situated customers; and

(b) all such services and repairs as are required to maintain the Hosted Services or are ancillary, necessary or otherwise related to the State’s or its Authorized Users’ access to or use of the Hosted Services, so that the Hosted Services operate properly in accordance with the Contract and this Schedule D.

5. Support Service Responsibilities. Contractor will:

(a) correct all Service Errors in accordance with the Support Service Level Requirements as defined in Exhibit 1 to this Schedule D, including by providing defect repair, programming corrections and remedial programming;

(b) provide unlimited telephone support between the hours of 7 am and 7 pm, EST;

(c) provide unlimited online support 24 hours a day, seven days a week;

(d) provide online access to technical support bulletins and other user support information and forums, to the full extent Contractor makes such resources available to its other customers; and

(e) respond to and Resolve Support Requests as specified in Exhibit 1 to this Schedule D.

6. Software and Service Warranties.

6.1 Contractor represents and warrants to the State that:

(a) Contractor has, and throughout the Term and any additional periods during which Contractor does or is required to perform the Services, including Hosted Services, will have, the unconditional and irrevocable right, power and authority, including all permits and licenses required, to provide the Services and grant and perform all rights and licenses granted or required to be granted by it under this Contract;

(b) neither Contractor’s grant of the rights or licenses hereunder nor its performance of any Services or other obligations under this Contract does or at any time will: (i) conflict with or violate any applicable law, including any law relating to data privacy, data security or personal information; (ii) require the consent, approval or authorization of any governmental or regulatory authority or other third party; or (iii) require the provision of any payment or other consideration by the State or any Authorized User to any third party, and Contractor shall promptly notify the State in writing if it becomes aware of any change in any applicable law that would preclude Contractor’s performance of its material obligations hereunder;

(c) as accessed and used by the State or any Authorized User in accordance with this Contract and the Specifications, the Hosted Services, Documentation and all other Services and materials provided by Contractor under this Contract will not infringe, misappropriate or otherwise violate any Intellectual Property Right or other right of any third party;

(d) there is no settled, pending or, to Contractor’s knowledge as of the Effective Date, threatened action, and it has not received any written, oral or other notice of any action (including in the form of any offer to obtain a license): (i) alleging that any access to or use of the Services, Hosted Services, or Software does or would infringe, misappropriate or otherwise violate any Intellectual Property Right of any third party; (ii) challenging Contractor’s ownership of, or right to use or license, any software or other materials used or required to be used in connection with the performance or receipt of the Services, or alleging any adverse right, title or interest with respect thereto; or (iii) that, if decided unfavorably to Contractor, would reasonably be expected to have an actual or potential adverse effect on its ability to perform the Services, including Hosted Services, or its other obligations under this Contract, and it has no knowledge after reasonable investigation of any factual, legal or other reasonable basis for any such litigation, claim or proceeding;

(e) the Software, Services (including Hosted Services) will in all material respects conform to and perform in accordance with the Specifications and all requirements of this Contract, including the Availability and Availability Requirement provisions set forth in Exhibit 1 to this Schedule D;

(f) all Specifications are, and will be continually updated and maintained so that they continue to be, current, complete and accurate and so that they do and will continue to fully describe the Hosted Services in all material respects such that at no time during the Term or any additional periods during which Contractor does or is required to perform the Services will the Hosted Services have any material undocumented feature;

(g) the Contractor Systems and Services (including Hosted Services) are and will remain free of Harmful Code;

(h) Contractor will not advertise through the Hosted Services (whether with adware, banners, buttons or other forms of online advertising) or link to external web sites that are not approved in writing by the State;

(i) Contractor will perform all Services in a timely, professional and workmanlike manner with a level of care, skill, practice and judgment consistent with generally recognized industry standards and practices for similar services, using personnel with the requisite skill, experience and qualifications, and will devote adequate resources to meet Contractor’s obligations (including the Availability Requirement and Support Service Level Requirements) under this Contract;

(j) During the term of this Contract, any audit rights contained in any third-party software license agreement or end user license agreement for third-party software incorporated in or otherwise used in conjunction with the Services, will apply solely to Contractor’s (or its subcontractors) facilities and systems that host the Services (including any disaster recovery site), and regardless of anything to the contrary contained in any third-party software license agreement or end user license agreement, third-party software providers will have no audit rights whatsoever against State systems or networks; and

(k) Contractor acknowledges that the State cannot indemnify any third parties, including but not limited to any third-party software providers that provide software that will be incorporated in or otherwise used in conjunction with the Services, and that notwithstanding anything to the contrary contained in any third-party software license agreement or end user license agreement, the State will not indemnify any third-party software provider for any reason whatsoever.

7. DISCLAIMER. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS CONTRACT, CONTRACTOR HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE UNDER OR IN CONNECTION WITH THIS CONTRACT OR ANY SUBJECT MATTER HEREOF.

8.

Schedule D - eXHIBIT 1 - SUPPORT SERVICES AND SERVICE LEVEL AGREEMENT FOR HOSTED SERVICES

1. Definitions. For purposes of this Exhibit 1 to Schedule D, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Section 1 shall have the respective meanings given to them in the Contract or its associated respective Schedules.

“Actual Uptime” means the total minutes in the Service Period that the Hosted Services are Available.

“Availability” has the meaning set forth in Section 3(a).

“Availability Requirement” has the meaning set forth in Section 3(a).

“Available” has the meaning set forth in Section 3(a).

“Contractor Service Manager” has the meaning set forth in Section 2.1.

“Corrective Action Plan” has the meaning set forth in Section 4.3.

“Critical Service Error” has the meaning set forth in Section 4.

“Exceptions” has the meaning set forth in Section 3.2.

“Force Majeure Event” has the meaning set forth in Section 5.1.

“High Service Error” has the meaning set forth in Section 4.

“Hosted Services” has the meaning set forth in Schedule E.

“Low Service Error” has the meaning set forth in Section 4.

“Medium Service Error” has the meaning set forth in Section 4.

“Resolve” has the meaning set forth in Section 4.1(a).

“Scheduled Downtime” has the meaning set forth in Section 3.3.

“Scheduled Uptime” means the total minutes in the Service Period.

“Service Availability Credits” has the meaning set forth in Section 3.6(a).

“Service Level Credits” has the meaning set forth in Section 4.2.

“Service Level Failure” means a failure to perform the Software Support Services fully in compliance with the Support Service Level Requirements.

“Service Period” has the meaning set forth in Section 3(a).

“Software” has the meaning set forth in the Contract.

“Software Support Services” has the meaning set forth in Section 4.1.

“State Service Manager” has the meaning set forth in Section 2.2.

“State Systems” means the information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems) and networks, of the State or any of its designees.

“Support Request” has the meaning set forth in Section 4.

“Support Service Level Requirements” has the meaning set forth in Section 4.

2. Personnel

2.1 Contractor Personnel for the Hosted Services. Contractor will appoint a Contractor employee to serve as a primary contact with respect to the Services who will have the authority to act on behalf of Contractor in matters pertaining to the receipt and processing of Support Requests and the Software Support Services (the “Contractor Service Manager”). The Contractor Service Manager will be considered Key Personnel under the Contract.

2.2 State Service Manager for the Hosted Services. The State will appoint and, in its reasonable discretion, replace, a State employee to serve as the primary contact with respect to the Services who will have the authority to act on behalf of the State in matters pertaining to the Software Support Services, including the submission and processing of Support Requests (the “State Service Manager”).

3. Service Availability and Service Availability Credits.

3.1 Availability Requirement. Contractor will make the Hosted Services Available, as measured over the course of each calendar month during the Term and any additional periods during which Contractor does or is required to perform any Hosted Services (each such calendar month, a “Service Period”), at least 99.98% of the time, excluding only the time the Hosted Services are not Available solely as a result of one or more Exceptions (the “Availability Requirement”). “Available” means the Hosted Services are available and operable for access and use by the State and its Authorized Users over the Internet in material conformity with the Contract. “Availability” has a correlative meaning. The Hosted Services are not considered Available in the event of a material performance degradation or inoperability of the Hosted Services, in whole or in part. The Availability Requirement will be calculated for the Service Period as follows: (Actual Uptime – Total Minutes in Service Period Hosted Services are not Available Due to an Exception) ÷ (Scheduled Uptime – Total Minutes in Service Period Hosted Services are not Available Due to an Exception) x 100 = Availability.

3.2 Exceptions. No period of Hosted Service degradation or inoperability will be included in calculating Availability to the extent that such downtime or degradation is due to any of the following (“Exceptions”):

(a) failures of the State’s or its Authorized Users’ internet connectivity;

(b) Scheduled Downtime as set forth in Section 3.3.

3.3 Scheduled Downtime. Contractor must notify the State at least twenty-four (24) hours in advance of all scheduled outages of the Hosted Services in whole or in part (“Scheduled Downtime”). All such scheduled outages will: (a) last no longer than five (5) hours; (b) be scheduled between the hours of 12:00 a.m. and 5:00 a.m., Eastern Time; and (c) occur no more frequently than once per week; provided that Contractor may request the State to approve extensions of Scheduled Downtime above five (5) hours, and such approval by the State may not be unreasonably withheld or delayed.

3.4 Software Response Time. Software response time, defined as the interval from the time the end user sends a transaction to the time a visual confirmation of transaction completion is received, must be less than two (2) seconds for 98% of all transactions. Unacceptable response times shall be considered to make the Software unavailable and will count against the Availability Requirement.

3.5 Service Availability Reports. Within thirty (30) days after the end of each Service Period, Contractor will provide to the State a report describing the Availability and other performance of the Hosted Services during that calendar month as compared to the Availability Requirement. The report must be in electronic or such other form as the State may approve in writing and shall include, at a minimum: (a) the actual performance of the Hosted Services relative to the Availability Requirement; and (b) if Hosted Service performance has failed in any respect to meet or exceed the Availability Requirement during the reporting period, a description in sufficient detail to inform the State of the cause of such failure and the corrective actions the Contractor has taken and will take to ensure that the Availability Requirement are fully met.

3.6 Remedies for Service Availability Failures.

(a) If the actual Availability of the Hosted Services is less than the Availability Requirement for any Service Period, such failure will constitute a Service Error for which Contractor will issue to the State the following credits on the fees payable for Hosted Services provided during the Service Period (“Service Availability Credits”):

(b) Any Service Availability Credits due under this Section 3.6 will be applied in accordance with payment terms of the Contract.

(c) If the actual Availability of the Hosted Services is less than the Availability Requirement in any two (2) of four (4) consecutive Service Periods, then, in addition to all other remedies available to the State, the State may terminate the Contract on written notice to Contractor with no liability, obligation or penalty to the State by reason of such termination.

3.7 Service Monitoring and Management. Contractor will continuously monitor and manage the Hosted Services to optimize Availability that meets or exceeds the Availability Requirement. Such monitoring and management includes:

(a) proactively monitoring on a twenty-four (24) hour by seven (7) day basis all Hosted Service functions, servers, firewall and other components of Hosted Service security;

(b) if such monitoring identifies, or Contractor otherwise becomes aware of, any circumstance that is reasonably likely to threaten the Availability of the Hosted Service, taking all necessary and reasonable remedial measures to promptly eliminate such threat and ensure full Availability; and

(c) if Contractor receives knowledge that the Hosted Service or any Hosted Service function or component is not Available (including by written notice from the State pursuant to the procedures set forth herein):

(d) confirming (or disconfirming) the outage by a direct check of the associated facility or facilities;

(e) if Contractor’s facility check in accordance with clause (i) above confirms a Hosted Service outage in whole or in part: (A) notifying the State in writing pursuant to the procedures set forth herein that an outage has occurred, providing such details as may be available, including a Contractor trouble ticket number, if appropriate, and time of outage; and (B) working all problems causing and caused by the outage until they are Resolved as Critical Service Errors in accordance with the Support Request Classification set forth in Section 4, or, if determined to be an internet provider problem, open a trouble ticket with the internet provider; and

(f) notifying the State that Contractor has fully corrected the outage and any related problems, along with any pertinent findings or action taken to close the trouble ticket.

4. Support Service Level Requirements.

Contractor will correct all Service Errors and respond to and Resolve all Support Requests in accordance with the required times and other terms and conditions set forth in this Section 4 (“Support Service Level Requirements”), and the Contract.

4.1 Support Requests. The State will classify its requests for Service Error corrections in accordance with the descriptions set forth in the chart below (each a “Support Request”). The State Service Manager will notify Contractor of Support Requests by email, telephone or such other means as the parties may hereafter agree to in writing.

Any Service Error Comprising or Causing any of the Following Events or Effects

· System down or operating in materially degraded state;

· Data integrity at risk;

· Declared a Critical Support Request by the State; or

· Widespread access interruptions.

· Data entry or access is materially impaired on a limited basis.

(a) Response and Resolution Time Service Levels. Response and Resolution times will be measured from the time Contractor receives a Support Request until the respective times Contractor has (i) responded to, in the case of response time and (ii) Resolved such Support Request, in the case of Resolution time. “Resolve” (including “Resolved”, “Resolution” and correlative capitalized terms) means that, as to any Service Error, Contractor has provided the State the corresponding Service Error correction and the State has confirmed such correction and its acceptance thereof. Contractor will respond to and Resolve all Service Errors within the following times based on the severity of the Service Error:

(Required Response Time) Service Level Metric (Required Resolution Time)

(b) Escalation. With respect to any Critical Service Error Support Request, until such Support Request is Resolved, Contractor will escalate that Support Request within sixty (60) minutes of the receipt of such Support Request by the appropriate Contractor support personnel, including, as applicable, the Contractor Service Manager and Contractor’s management or engineering personnel, as appropriate.

4.2 Support Service Level Credits. Failure to achieve any of the Support Service Level Requirements for Critical and High Service Errors will constitute a Service Level Failure for which Contractor will issue to the State the corresponding service credits set forth in Section 4.1(a) (“Service Level Credits”) in accordance with payment terms set forth in the Contract.

4.3 Corrective Action Plan. If two or more Critical Service Errors occur in any thirty (30) day period during (a) the Term or (b) any additional periods during which Contractor does or is required to perform any Hosted Services, Contractor will promptly investigate the root causes of these Service Errors and provide to the State within five (5) Business Days of its receipt of notice of the second such Support Request an analysis of such root causes and a proposed written corrective action plan for the State’s review, comment and approval, which, subject to and upon the State’s written approval, shall be a part of, and by this reference is incorporated in, the Contract as the parties’ corrective action plan (the “Corrective Action Plan”). The Corrective Action Plan must include, at a minimum: (a) Contractor’s commitment to the State to devote the appropriate time, skilled personnel, systems support and equipment and other resources necessary to Resolve and prevent any further occurrences of the Service Errors giving rise to such Support Requests; (b) a strategy for developing any programming, software updates, fixes, patches, etc. necessary to remedy, and prevent any further occurrences of, such Service Errors; and (c) time frames for implementing the Corrective Action Plan. There will be no additional charge for Contractor’s preparation or implementation of the Corrective Action Plan in the time frames and manner set forth therein.

5. Force Majeure.

5.1 Force Majeure Events. Subject to Section 5.3, neither party will be liable or responsible to the other party, or be deemed to have defaulted under or breached the Contract, for any failure or delay in fulfilling or performing any term hereof, when and to the extent such failure or delay is caused by: acts of God, flood, fire or explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of the Contract, national or regional emergency, or any passage of law or governmental order, rule, regulation or direction, or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition (each of the foregoing, a “Force Majeure Event”), in each case provided that: (a) such event is outside the reasonable control of the affected party; (b) the affected party gives prompt written notice to the other party, stating the period of time the occurrence is expected to continue; (c) the affected party uses diligent efforts to end the failure or delay and minimize the effects of such Force Majeure Event.

5.2 State Performance; Termination. In the event of a Force Majeure Event affecting Contractor’s performance under the Contract, the State may suspend its performance hereunder until such time as Contractor resumes performance. The State may terminate the Contract by written notice to Contractor if a Force Majeure Event affecting Contractor’s performance hereunder continues substantially uninterrupted for a period of five (5) Business Days or more. Unless the State terminates the Contract pursuant to the preceding sentence, any date specifically designated for Contractor’s performance under the Contract will automatically be extended for a period up to the duration of the Force Majeure Event.

5.3 Exclusions; Non-suspended Obligations. Notwithstanding the foregoing or any other provisions of the Contract or this Schedule:

(a) in no event will any of the following be considered a Force Majeure Event:

(i) shutdowns, disruptions or malfunctions of Contractor Systems or any of Contractor’s telecommunication or internet services other than as a result of general and widespread internet or telecommunications failures that are not limited to the Contractor Systems; or

(ii) the delay or failure of any Contractor Personnel to perform any obligation of Contractor hereunder unless such delay or failure to perform is itself by reason of a Force Majeure Event.

Schedule E - dATA SECURITY REQUIREMENTS Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means the Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosted Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures “SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule.

Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Hosted Services who has sufficient knowledge of the security of the Hosted Services and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Representatives comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at:

https://www.michigan.gov/dtmb/0,5552,7-358-82547_56579_56755---,00.html Acceptable Use Policy. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Policy, see ents/dtmb/1340.00.01_Acceptable_Use_of_Information_Technology_Standard_458958_7.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Policy before accessing State systems. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State systems if the State determines a violation has occurred.

Protection of the State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause pursuant to Section 15.1 of the Contract;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely hosted, supported, administered, accessed, and backed up in a data center(s) that resides in the continental United States, and minimally meets Uptime Institute Tier 3 standards (www.uptimeinstitute.com), or its equivalent;

5.4 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.5 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

5.6 take all reasonable measures to:

1. secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “hackers” and others who may seek, without authorization, to disrupt, damage, modify, access or otherwise use Contractor Systems or the information found therein; and

1. prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the State Data;

5.7 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 256 bits or higher;

5.8 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML), Open Authentication (OAuth) or comparable State approved mechanisms;

5.9 ensure the Hosted Services implements NIST compliant multi-factor authentication for privileged/administrative and other identified access.

Security Accreditation Process. Throughout the Term, Contractor will assist the State, at no additional cost, with its Security Accreditation Process, which includes the development, completion and on-going maintenance of a system security plan (SSP) using the State’s automated governance, risk and compliance (GRC) platform, which requires Contractor to submit evidence, upon request from the State, in order to validate Contractor’s security controls within two weeks of the State’s request. On an annual basis, or as otherwise required by the State such as for significant changes, re-assessment of the system’s controls will be required to receive and maintain authority to operate (ATO). All identified risks from the SSP will be remediated through a Plan of Action and Milestones (POAM) process with remediation time frames based on the risk level of the identified risk. For all findings associated with the Contractor’s solution, at no additional cost, Contractor will be required to create or assist with the creation of State approved POAMs and perform related remediation activities. The State will make any decisions on acceptable risk, Contractor may request risk acceptance, supported by compensating controls, however only the State may formally accept risk. Failure to comply with this section will be deemed a material breach of the Contract.

Unauthorized Access. Contractor may not access, and shall not permit any access to, State systems, in whole or in part, whether through the Hosted Services or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

Security Audits.

1.1 During the Term, Contractor will maintain complete and accurate records of its data protection practices, IT security controls, and the security logs relating to State Data, including but not limited to any backup, disaster recovery or other policies, practices or procedures relating to the State Data and any other information relevant to its compliance with this Contract.

1.2 Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Services and from time to time during the term of this Contract. The State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program. If the State chooses to perform an on-site audit, Contractor will, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Hosted Services and their housing facilities and operating environments.

1.3 During the Term, Contractor will, when requested by the State, provide a copy of Contractor’s or Hosting Provider’s FedRAMP System Security Plan(s) or SOC 2 Type 2 report(s) to the State within two weeks of the State’s request. The System Security Plan and SSAE audit reports will be recognized as Contractor’s Confidential Information.

1.4 With respect to State Data, Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

1.5 The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section 8.

Application Scanning. During the Term, Contractor must, at its sole cost and expense, scan all Contractor provided applications, and must analyze, remediate and validate all vulnerabilities identified by the scans as required by the State Secure Web Application and other applicable PSPs.

Contractor’s application scanning and remediation must include each of the following types of scans and activities:

9.1 Dynamic Application Security Testing (DAST) – Scanning interactive application for vulnerabilities, analysis, remediation, and validation (may include Interactive Application Security Testing (IAST).

(a) Contractor must either a) grant the State the right to dynamically scan a deployed version of the Software; or b) in lieu of the State performing the scan, Contractor must dynamically scan a deployed version of the Software using a State approved application scanning tool and provide the State a vulnerabilities assessment after Contractor has completed such scan. These scans and assessments i) must be completed and provided to the State quarterly (dates to be provided by the State) and for each major release; and ii) scans must be completed in a non-production environment with verifiable matching source code and supporting infrastructure configurations or the actual production environment.

9.2 Static Application Security Testing (SAST) - Scanning Source Code for vulnerabilities, analysis, remediation, and validation.

(a) For Contractor provided applications, Contractor, at its sole expense, must provide resources to complete static application source code scanning, including the analysis, remediation and validation of vulnerabilities identified by application Source Code scans. These scans must be completed for all Source Code initially, for all updated Source Code, and for all Source Code for each major release and Contractor must provide the State a vulnerability assessment after Contractor has completed the required scans.

9.3 Software Composition Analysis (SCA) – Third Party and/or Open Source Scanning for vulnerabilities, analysis, remediation, and validation.

(a) For Software that includes third party and open source software, all included third party and open source software must be documented and the source supplier must be monitored by the Contractor for notification of identified vulnerabilities and remediation. SCA scans may be included as part of SAST and DAST scanning or employ the use of an SCA tool to meet the scanning requirements.