RFP_30901-63626_Amendment_2_FINAL.pdf

RFP 30901-63626 Amendment 2

STATE OF TENNESSEE

TREASURY DEPARTMENT

REQUEST FOR PROPOSALS # 30901-63626

AMENDMENT # 2

FOR PENSION FILE DEATH MATCH AND OBITUARY

MATCH SERVICES FOR THE TENNESSEE

CONSOLIDATED RETIREMENT SYSTEM

DATE: September 23, 2025

RFP # 30901-63626 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(central time zone)

DATE

UPDATED

OR

CONFIRMED

1. RFP Issued August 26, 2025 CONFIRMED

2. Disability Accommodation Request Deadline 2:00 p.m. August 29, 2025 CONFIRMED

3. Pre-response Teleconference 10:00 a.m. September 3, 2025 CONFIRMED

4. Notice of Intent to Respond Deadline 2:00 p.m. September 4, 2025 CONFIRMED

5. Written “Questions & Comments” Deadline 2:00 p.m. September 12, 2025 CONFIRMED

6. State Response to Written “Questions & Comments” September 23, 2025 CONFIRMED

7. Technical Response and Cost Proposal Deadline 2:00 p.m. October 2, 2025 CONFIRMED

8. State Completion of Technical Response Evaluations October 13, 2025 CONFIRMED

9. State Schedules Respondent Oral Presentation (Respondent Finalists Only)

October 14, 2025 CONFIRMED

10. Respondent Oral Presentation (Respondent Finalists Only)

8:00 a.m. – 4:30 p.m.

October 20, 2025 – October 21, 2025

CONFIRMED

11. State Completion of Oral Presentation Evaluations

October 21, 2025 CONFIRMED

12. State Opening & Scoring of Cost Proposals (Finalists Only) October 21, 2025 CONFIRMED

13. Negotiations (Optional to the State) October 22, 2025 – October 23, 2025 CONFIRMED

14. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection October 29, 2025 CONFIRMED

15. End of Protest Period November 5, 2025 CONFIRMED

16. State sends contract to Contractor for signature November 6, 2025 CONFIRMED

17. Contractor Signature Deadline 2:00 p.m. November 13, 2025 CONFIRMED

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

QUESTION / COMMENT STATE RESPONSE

1. How does the State define an “exact match” versus a “probable match,” and are there minimum confidence thresholds for verification?

As provided in Section A.2.a. of the Pro Forma Contract (RFP Attachment 6.6), an “exact match” is an individual record where the social security number, last name, first name and date of birth data elements are exactly the same in the data file supplied by TCRS to the successful Respondent and in the data found in the Respondent’s database. It also includes an individual record that required Verification Services (as defined in Section A.2.g. of the Pro Forma Contract) to verify the accuracy of any non-matching data elements to meet the confidence level for an exact match as approved by TCRS. A “probable match” would be a record with matches to three or fewer of the data fields, but where the successful Respondent is still confident it is the TCRS member.

2. Are specific proprietary or non-proprietary data sources required (e.g., SSA Death Master File, state vital records), or may vendors propose alternatives?

As provided in Section A.3. of the Pro Forma Contract, the successful Respondent must maintain a computerized database of death information from proprietary and non-proprietary databases that will be used to perform the death match services. The proprietary and non-proprietary sources of data utilized in the Respondent’s Death Database must provide coverage to identify and report deaths occurring within all 50 states and the District of Columbia.

The database must include death information reported to the United States Social Security Administration, death information from the Office of Vital Statistics or similar office in each state willing to share their data with the Respondent, death information from obituary data compiled by the Respondent, and all the other entities and data sources described in the Respondent’s Response to the RFP (referred to as the “Sources”). The database must contain all deaths reported to such Sources in the areas of the nation and foreign countries as set forth in the Respondent’s Response to the RFP.

3. For the semi-annual inactive member file, will the State provide precise data field requirements, and should subcontractors validate only probable matches or also confirm non-matches?

The data elements for the file will be mutually agreed to by the successful Respondent and TCRS. The successful Respondent must provide TCRS with reports of exact match deaths and probable deaths of both TCRS’ Recipients and Inactives. The successful Respondent must also perform verification services by reviewing and researching obituary matches and probable matches to verify which of these are exact matches to TCRS’ Recipients and/or TCRS’ Inactive members.

4. For the semi-monthly Recipient reports, what is the expected delivery timeframe after receiving files from TCRS?

As provided in Section A.8 of the Pro Forma Contract, the successful Respondent must provide TCRS with the Death Match Search Reports within 48 hours of the Respondent’s receipt of TCRS’s file unless otherwise agreed to in writing by TCRS.

5. Regarding disaster recovery testing, what role will contractors or subcontractors be expected to play — simulation only or full test?

A full test. Per Section E.4.c.(2) of the Pro Forma Contract, a simulation would not provide verification to the same degree as a full test. The test would need to include restoration of data. A table-top exercise would not satisfy this requirement.

6. Beyond the published scoring categories, does the evaluation team prioritize accuracy of verification results over cost, or will both carry equal weight?

The technical proposal (comprised of the responses to RFP Attachment 6.2., Section B, RFP Attachment 6.2., Section C, and RFP Attachment 6.2., Section D) is worth 70 points and the cost proposal is worth 30 points. See e.g., Section 5.1 of the RFP. The evaluators score RFP responses based on these point assignments.

7. Has the State identified specific challenges with prior contractors that new vendors should address in their proposals?

TCRS believes the questions posed in the RFP will provide the information TCRS needs to effectively evaluate the proposals.

8. Does the State require a specific secure file transfer protocol (e.g., SFTP, HTTPS), or will this be negotiated?

TCRS will work with the successful Respondent on the specific secure file transfer protocol.

9. What is the required timeframe for data deletion after reporting, and will destruction verification (audit logs, certificates) be required?

As provided in Item A.13 of the mandatory requirements (RFP Attachment 6.2, Section A), the successful Respondent must delete the files within a time frame agreed upon between the Respondent and TCRS, which is typically under 30 days. Per NIST 800-88, destruction verification via certificates will be required.

10. Will the State pay on delivery of reports or according to a monthly/quarterly schedule?

See Items 7 and 8 below for amendments to Section C.3 of the Pro Forma Contract and to the Cost Proposal & Scoring Guide (RFP Attachment 6.3). NOTE: This modified Cost Proposal & Scoring Guide must be used.

11. Do subcontractors need to be pre-approved by the State at the time of proposal submission, or may they be added later with notice?

This is addressed in Section 4.4 of the RFP. In particular:

“4.4.2. If a Respondent intends to use subcontractors, the response to this RFP must specifically identify the scope and portions of the work each subcontractor will perform (refer to RFP Attachment 6.2., Section B, General Qualifications & Experience Item B.14.).

4.4.3. Subcontractors identified within a

response to this RFP will be deemed as approved by the State unless the State expressly disapproves one or more of the proposed subcontractors prior to signing the Contract.

4.4.4. After contract award, a Contractor may

only substitute an approved subcontractor at the discretion of the State and with the State’s prior, written approval.”

12. Must subcontractors be registered vendors with the State of Tennessee?

No. Section 4.4.5 of the RFP provides:

“Notwithstanding any State approval relating to subcontracts, the Respondent who is awarded a contract pursuant to this RFP will be the prime contractor and will be responsible for all work under the Contract”.

13. If a subcontractor had a resolved security breach more than three years ago, must it still be disclosed?

No.

14. Will all data handling be strictly limited to the continental U.S., or can offshore resources be used for non-data-related support functions (e.g., IT helpdesk)?

Item A.10 of the mandatory requirements (RFP Attachment 6.2, Section A) requires each Respondent to agree that “if awarded a contract pursuant to this RFP, the Respondent will maintain operations under the contract in the continental United States and certify that all TCRS data maintained or used in the course of providing the services under the contract will not leave the continental United States”.

Consequently, non-data related support is still “operations”, which would preclude the use of off-shore resources.

15. Beyond the standard data elements (SSN, First Name, Last Name, and Date of Birth), what additional data fields will TCRS provide to support death match verification services?

TCRS will work with the selected vendor for standard elements to be provided by TCRS.

With our previous vendor, in addition to the elements listed, we provided address (street address, city, state, and zip code), and beneficiary’s first and last name.

16. What data elements does TCRS currently provide to its existing death audit vendor? We aim to align our proposal as closely as possible with your current process.

See response to Question 15 above.

17. For probable (fuzzy) death match verification, does TCRS require outbound mailings to next of kin and collection of responses?

No. These are not a part of the services requested in this RFP.

18. What specific verification services are currently provided by TCRS’s death audit vendor, including data sources, matching methodologies, and any manual or automated validation processes?

TCRS does not have a current death audit vendor.

19. Historically, how many death matches—both confirmed and probable—are identified on average during each audit period for TCRS?

Understanding match volume will help us appropriately scale resources and estimate service costs.

TCRS’ previous vendor provided a weekly match file. An average of 90 death matches were contained in each file.

20. Can TCRS provide the current annual cost associated with death audit services for both the recipient and inactive files? This information will help us tailor a cost-effective proposal aligned with your budget and service expectations.

The last time we procured these services in 2020, the cost was approximately $100,000 in total per year.

21. What is reason that TCRS is moving away from their current provider?

See response to Question 18 above.

22. From your experience with your current vendor, is there particular functionality or features (outside of the requirements) that are important to TCRS or its users?

See response to Question 18 above.

23. While the requested contract period terms are 60 months, what is the average length of vendor relationships previously for TCRS with like vendors or for similar services?

The average contract term has been five years with prior vendors.

Technical & Scope

24. Can the State clarify expectations for semi-monthly vs. semi-annual reporting. ABL does weekly monitoring as our standard reporting;

will that be acceptable? It does not affect pricing.

Treasury requirements for semi-monthly for the State’s Recipient file and semi-annual for the State’s Inactive file is to set the minimum requirement. See Items 7 and 8 below for amendments to Section C.3 of the Pro Forma Contract and to the Cost Proposal & Scoring Guide (RFP Attachment 6.3). NOTE: This modified Cost Proposal & Scoring Guide must be used.

Technical & Scope See response to Question 8 above.

25. What secure file transmission protocols are preferred (e.g., SFTP, API, secure portal), and are there specific encryption standards you require?

Technical & Scope

26. What constitutes a validated death for TCRS

(e.g., obituary confirmation, state vital record, SSA DMF, multi-source corroboration)?

See response to Question 1 above.

Data Privacy & Security

27. Regarding the certification about no breaches in the last 3 years, does this disqualification or restriction also apply to affiliated or parent companies that provide the same or similar services?

No.

Data Privacy & Security

28. For the 24-hour incident notification requirement, does TCRS have a preferred incident response framework we should align to?

No. The respondent can suggest a framework that TCRS can confirm.

Data Privacy & Security

29. Will TCRS provide a designated security point of contact?

The State Customer Care Center is the designated security point of contact. See Section E.4(a)(4) of the Pro Forma Contract.

Evaluation & Process

30. Will TCRS conduct a proof of concept / pilot to compare vendor file results side-by-side prior to award?

No.

Evaluation & Process

31. Will oral presentations be conducted virtually only? Does the one-hour limit include Q&A, or is Q&A in addition?

Yes, oral presentations will only be conducted virtually. Oral presentations will only be done by the top three (3) ranked Respondents. Each oral presentation will be limited to one hour, which includes questions from the evalutors.

Evaluation & Process

32. Will TCRS share the oral presentation scoring rubric or key evaluation criteria in advance?

The oral presentation evaluation criteria are in RFP Attachment 6.2., Technical Response & Evaluation Guide, Section D.

Cost & Contract

33. Will there be a Best and Final Offer (BAFO) stage? Are there any budget limitations or ceilings we should be aware of when preparing the Cost Proposal?

The State reserves the right (at its sole discretion) to request BAFOs. Since the State might not ask for BAFOs, it is important that each Respondent’s response contain the Respondent’s best terms and conditions from a technical and cost standpoint. The State respectfully declines to reveal whether there are any budget limitations or ceilings.

34. Re.1.1.2: Does the State have an estimate on the number of records typically searched on an ad-hoc basis?

For evaluation purposes only, respondents should assume 2 ad hoc reports per year with approximately 165,000 records.

36. Re.6.2.C.12.: Does the State consider the lack of a data element for the matching process a non-exact match and therefore require verification services?

See response to Question 1 above.

37. Re.6.2.C.12.: Does the State have a defined confidence threshold for when verified probable matches are deemed an exact match or is this up to the Respondent to outline and define in its methodology?

Each Respondent is required to explain in its response the different confidence levels utilized by the Respondent and what confidence level the Respondent corresponds to an exact match.

These levels are subject to State approval. See Section A.2.a of the Pro Forma Contract (RFP Attachment 6.6).

36. Can you further define question A.3. and who the references should come from and details you are looking for?

A.3. Provide two current positive credit references from vendors with which the Respondent has done business written in the form of standard business letters, signed, and dated within the past three

(3) months.

These vendors are companies that your firm uses to provide services to your firm, such as (by way of example) a company from whom you lease office space. The references should indicate that you make payments on time.

37. Would the State be amenable to adding the following provision to the Pro Forma Contract?

Licenses. Contractor hereby grants to the State a non-exclusive, nontransferable, restricted license to use Contractor’s services under the Contract solely for the State’s own internal business purposes.

The State respectfully declines in as much as this is not necessary. The Pro Forma contract makes clear that the State will only provide the successful Respondent information pertaining to individual TCRS members and their respective beneficiaries for death match purposes.

38. Would the State be amenable to adding the following provision to the Pro Forma Contract?

Permitted Use and Disclosure. The State authorizes Contractor to act as its designee to utilize commercial, credit, and/or government sources to verify or obtain information required to service a benefit plan or policy. In order to retrieve certain data to perform the services under the Contract, Contractor discloses State Data to Contractor’s affiliates and third-party data provider(s) and the State hereby consents to such disclosure.

*Contractor may enter State Data into a private AI tool, provided that Contractor shall not use such State Data to train a private AI tool and Contractor shall not provide the output of a private AI tool to the State without first undergoing review by Contractor personnel.

The State respectfully declines. The RFP and Pro Forma Contract make it clear that the successful Respondent will use the sources utilized in its death and obituary database as outlined in its response to the RFP.

The State respectfully declines in as much as the State is not requesting an AI tool that uses State data. If a company that has an AI tool (Al 38) becomes the successful vendor without bidding the AI tool as a part of its response to this RFP and thereafter wants the State to consider the tool after signing the Pro Forma Contract, then the successful vendor can approach the State. IF the AI tool is in the best interest of the State, the

COMMENT FROM VENDOR FOR ABOVE

SECTION:

Vendor does not use client data in public AI tools. We do not use client data to train any AI tools. However, we may use private AI tools internally to support our business.will not provide output of AI directly to the State.

State can then submit a waiver to its Strategic Technology Solutions team and, if approved, amend the contract.

39. Would the State be amenable to adding the following to the Pro Forma Contract?

Retention. Notwithstanding anything to the contrary in the Contract, Contractor may retain State Data pursuant to Contractor’s records retention, litigation hold, and data backup policies or compliance obligations; provided that such retained information is subject to confidentiality obligations of the Contract for so long as it is retained.

COMMENT FROM VENDOR FOR ABOVE

SECTION:

Vendor has independent obligations to retain data for several reasons. One example is to comply with audits by our data providers.

Another is, at our company, data is encrypted in backup files, and it is impracticable to bring such encrypted backup files live in order to destroy the data. In time, those files are securely overwritten. Note that this data is subject to the obligations of confidentiality for so long as it is retained.

The State respectfully declines. As provided in Section E.4.a(8) of the Pro Forma Contract, the successful respondent will be expected (upon termination of the Contract and in consultation with the State), to destroy all Confidential State Data it holds (including any copies such as backups) in accordance with the current version of National Institute of Standards and Technology (“NIST”) Special Publication 800-88. The successful respondent must provide a written confirmation of destruction to the State within ten business days after destruction.

40. Would the State be amenable to modifying the Pro Forma Contract as follows?

Termination by Contractor. Contractor may terminate the Contract (a) immediately upon notice to the State following a breach of the Contract by the State that is not cured within thirty (30) calendar days of receiving written notice of such breach from Contractor, or (b) if it becomes a violation of law for either Party to perform its obligations under the Contract.

SECTION:

Vendor requires termination rights if the State breaches the contract, or if it becomes a violation of law to perform under the agreement

See Item 3 below for an amendment to Section D.6 of the Pro Forma Contract.

41. Would the State be amendable to modifying the Pro Forma Contract as follows:

See Item 4 below for an amendment to Section D.32 of the Pro Forma Contract.

Contractor Insurance. Notwithstanding Section D.32. of the Contract, only Contractor’s CGL insurance shall (a) be on a primary and noncontributory basis; (b) be required to name the State as an additional insured; and (c) contain an endorsement for a waiver of subrogation in favor of the State.

The State acknowledges and approves that Contractor has insurance deductibles over fifty thousand dollars ($50,000).

COMMENT FROM VENDOR FOR ABOVE

SECTION:

Per Vendor’s insurance broker, we have requested primary and noncontributory language from our cyber and E&O insurance carriers in the past and the carriers will not accommodate. We are able to provide this language on our commercial general liability policy only. Further, we are only able to grant a waiver of subrogation and additional insured status on the commercial general liability policy.

42. Would the State be amenable to modifying the Pro Forma Contract as follows:

Disclaimer of Warranties. The State accepts all information “AS IS.” The State acknowledges and agrees that Contractor obtains data from third-party sources, which may or may not be completely thorough and accurate, and that Contractor does not make and hereby disclaims any warranty, express or implied, statutory or otherwise, with respect to Contractor’s services. Contractor does not guarantee or warrant the correctness, currentness, completeness, merchantability, or fitness for a particular purpose of the Services or information provided therein, including but not limited to those warranties that might be implied from a course of dealing, course of performance or trade usage. Due to the nature of public record information, the public records and commercially available data sources used in Contractor’s services may contain errors. Source data is sometimes reported or entered inaccurately, processed poorly or incorrectly, and is generally not free from defect. Contractor’s services are not the source of data, nor are they a comprehensive compilation of the data. Contractor’s services may contain links to third-party websites not under Contractor’s control or operation.

Contractor may provide any such links only as

The State respectfully declines in as much as this language is not necessary. The RFP and Pro Forma Contract make it clear that the successful vendor will obtain information from third-party sources, which might or might not be entirely accurate.

a convenience, and Contractor does not endorse, is not responsible for, and does not have control over the contents of any linked website or any link contained within a linked website. Use of third-party content on a linked website may be subject to such third-party’s terms and conditions. The State accepts all risk of clicking on a linked website and is solely responsible for its use of content contained on any such linked website. For certain Contractor’s services, Contractor’s personnel use proprietary methods to determine whether death data from multiple sources is relevant to a particular individual (“Death Matching”) and because of the inherent limitations in the data relied upon, Contractor shall not be responsible or liable for any inaccurate or incomplete Death Matching. Death Matching is an analysis attributable to Contractor and does not represent a finding or conclusion on behalf of Contractor’s data sources. The State shall not rely on Contractor for the accuracy or completeness of information supplied through the Contractor’s services. Before relying on any data, Contractor recommends that such data should be independently verified.

Contractor expressly disclaims that its services are, and no services shall be deemed to be, regulatory, compliance, legal, retirement fund/plan, ERISA or tax advice, counsel or opinion.

COMMENT FROM VENDOR FOR ABOVE

SECTION:

The State will receive a death audit service called CertiDeath® ParagonTM. CertiDeath Paragon includes proprietary matching processes to include (1) record reviews, which involves comparison to additional information retrieved from Vendor’s third party data providers, and (2) provision of links to obituaries from public websites, such as a newspaper or funeral home. Vendor cannot be responsible for PL’s appropriate use of those other websites. For these reasons, the additional disclaimer is necessary.

43. Would the State be amenable to adding the following to the Pro Forma Contract?

(a)State Permissible Uses. The State certifies, represents and warrants that the State’s permissible use of Contractor’s services pursuant to 15 C.F.R. § 1110 et seq.

is *(b) a legitimate fraud prevention interest to

See Item 5 below for an amendment to Section A of the Pro Forma Contract.

detect and prevent fraud across its business and/or government activities, and the State shall comply with 15 C.F.R. § 1110 et seq.

Contractor’s services may include nonpublic personal information, which is governed by the privacy provisions of the Gramm-Leach- Bliley Act (15 U.S.C. § 6801 et seq.) and its implementing regulations (collectively, “GLBA”). The State certifies, represents and warrants that (i) it has the permissible use under the GLBA to use and/or obtain such information that is marked below (“GLBA Permissible Use”), (ii) it will only use such information for such purpose(s) selected below or, if applicable, for the purpose to which it has certified, and (iii) it will comply with the GLBA. The State’s GLBA permissible use is as follows: *(c) in complying with federal, state, or local laws, rules, and other applicable legal requirements. Contractor may perform reasonable reviews of the State’s compliance with the Contract by providing prior written notice to the State, and such reviews shall occur during the State’s normal business hours, at Contractor’s expense, and where required by a data provider, regulator, or other third-party.

COMMENT FROM VENDOR FOR ABOVE

SECTION:

*(a) These permissible uses are applicable because, in the CertiDeath Paragon services, Vendor will provide deaths from the Limited Access Death Master File, which requires the receiving entity (the State) to have a DMF permissible use. Vendor will also retrieve data that is regulated by the GLBA to perform additional verification in CertiDeath Paragon.

Use of GLBA-regulated data requires a GBLA permissible use.

*(b) Alternative: a legitimate business purpose pursuant to a [law] [governmental rule] [regulation] [fiduciary duty] (include those that apply).

* (c) Please insert one or more of the following:

To protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability.

For required institutional risk control programs, or for resolving customer disputes or inquiries.

Use by persons holding a legal or beneficial interest relating to the consumer.

Use by persons acting in a fiduciary or representative capacity on behalf of the consumer.

In complying with federal, state, or local laws, rules, and other applicable legal requirements.

To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978, to law enforcement agencies (including the Bureau of Consumer Financial Protection, a Federal function regulator, the Secretary of Treasury, a State insurance authority, or the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety.

The audit right is required by vendor’s data sources. Vendor receives unregulated data from our data sources and must be able to respond to an audit by those sources.

Typically, the audit is straightforward, such as confirming the legitimate business purpose for requesting the search. Usually, a client submits a screenshot confirming the information. The State would be able to redact information when responding to the audit. Note that this audit is at Vendor’s expense and during the State’s regular business hours.

44. Would the State be amenable to adding the following to the Pro Forma Contract?

Indemnification by the State. Except to the extent prohibited by applicable law, the State hereby agrees to protect, indemnify, defend, and hold harmless Contractor as well as its officers, agents, and personnel from and against any and all claims, liabilities, losses, causes of action, and costs (including attorneys’ fees and other litigation expenses) arising from or related to, or asserted by (a) data subjects or data owners, including but not limited to participants, pensioners, beneficiaries, policy owners, insureds, annuitants, plan sponsors, legal

The State respectfully declines. The State is prohibited by law (namely, by Tenn. Code Ann. § 12-3-515) from indemnifying, defending or holding harmless another party.

representatives, benefits administrators, or the State’s service providers; or (b) regulators or government authorities.

45. Would the State be amenable to adding the following to the Pro Forma Contract?

Contractor Information; Contractor IP.

Strict standards of confidentiality of records and information shall be maintained in accordance with the requirements of the Contract and applicable state and federal law.

All material, information, and data regardless of form, medium or method of communication, that the State will have access to, acquire, or is provided to the State by Contractor shall be regarded as confidential information of Contractor (“Contractor Information”).

Contractor grants the State a limited license to use the Contractor Information but only to perform its obligations under the Contract.

Nothing in this Section shall permit the State to disclose any Contractor Information, regardless of whether it has been disclosed or made available to the State due to intentional or negligent actions or inactions of agents of the Contractor or third parties. Contractor Information shall not be disclosed except as required under state or federal law or otherwise authorized in writing by Contractor.

The State shall take all necessary steps to safeguard the confidentiality of such Contractor Information in conformance with the requirements of the Contract and with applicable state and federal law. Contractor maintains all right, title, and interest to and in all of its software, source code, object code, systems, services, data, Death Matching processes and results therefrom made in its applications or systems or confirmed through Contractor’s business processes, and forms of deliverables (including but not limited to all components, modifications and derivations thereof) that Contractors offers to its customers generally (“Contractor IP”), and Contractor expressly reserves all rights not expressly granted to the State in the Contract.

To the extent Contractor IP is incorporated into a deliverable provided to the State, Contractor hereby grants the State a nontransferable, nonsublicenseable, fully paid up, limited license to use Contractor IP solely for internal business purposes and subject to the Contract. As long as the State maintains Contractor Information or Contractor IP, the

The State respectfully declines in as much as the State is not requesting access to any intellectual property or confidential information belonging to respondents.

obligations set forth in this Section shall survive the termination of the Contract.

COMMENT FROM VENDOR FOR ABOVE

SECTION:

Vendor’s confidential information and intellectual property must be protected when made available to the State.

46. Would the State be amenable to adding the following to the Pro Forma Contract?

No Third-Party Beneficiaries. The Contract will inure to the benefit of and be binding upon the Parties, and their respective successors and permitted assigns, and no other person or entity (including but not limited to any other person or entity with a direct or indirect interest in any pension, annuity, insurance policy, benefit plan, or other similar plans or policies) will have any right, remedy or obligation under the Contract. The Parties agree that participants, pensioners, beneficiaries, policy owners, insureds, annuitants, legal representatives, benefits administrators, and any other similar persons or entities are not third-party beneficiaries to the Contract, and that neither Party will claim such to be a third-party beneficiary.

See Item 6 below for an amendment to Section A of the Pro Forma Contract.

47. Would the State be amenable to modifying the Pro Forma Contract as follows:

Security.

a) Notwithstanding Section E.3. of the

Contract, the State shall not be permitted to test or physical or virtually inspect Contractor’s general and application controls; provided that, upon request, Contractor shall provide its SOC 2 Type 2 report for the State’s review.

b) Notwithstanding Section E.4.a(2) of the Contract, Contractor (i) uses NIST approved encryption standards, and (ii) controls encryption keys for its clients.

Upon request, Contractor shall destroy the State’s unique encryption keys.

c) Notwithstanding Section E.4.a(3) of the Contract, the scope of Contractor’s SOC 2 Type 2 examination engagement includes the Security, Availability, and Confidentiality Trust Services Criteria.

The State respectfully declines.

SECTION:

Vendor does not allow clients to perform testing on our systems. Instead, we can provide a copy of our SOC report.

48. Would the State be amendable to modifying the Pro Forma Contract as follows:

Miscellaneous. The following sections of this Amendment survive any termination of the Contract: 1, 3, 6, 7, 8, 9, 10 and 12. If any provision of the Contract shall be held by a court of competent jurisdiction to be contrary to law, invalid or otherwise unenforceable, such provision shall be changed and interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law, and in any event the remaining provisions of the Contract shall remain in full force and effect. The headings in the Contract are inserted for reference and convenience only and shall not enter into the interpretation thereof.

The State respectfully declines. Severability is already addressed in Section D.28 of the Pro Forma Contact and headings in the contract are addressed in Section D.29 of the Pro Forma Contract.

3. Delete Section D.6. of the Pro Forma Contract (RFP Attachment 6.6) in its entirety and insert the following in its place (any sentence or paragraph containing revised or new text is highlighted):

D.6. Termination for Cause. If the Contractor a Party (“Breaching Party”) fails to properly perform its obligations under this Contract, or if a Party in a timely or proper manner, or if the Contractor materially violates any terms of this Contract (“Breach Condition”),the other Party (“Non-breaching Party”) may provide written notice to the Breaching Party specifying the Breach Condition. If within thirty (30) days of notice, the Breaching Party has not cured the Breach Condition, the Non-breaching Party may terminate the Contract. In the event the Non-breaching Party is the State, the State may withhold payments in excess of compensation for completed services or provided goods. The Breaching Party shall not be relieved of liability to the Non-breaching Party for damages sustained by virtue of any breach of this Contract, and the Non-breaching Party may seek other remedies allowed at law or in equity for breach of this Contract.

State shall have the right to immediately terminate the Contract and withhold payments in excess of compensation for completed services or provided goods. Notwithstanding the above, the Contractor shall not be relieved of liability to the State for damages sustained by virtue of any Breach Condition and the State may seek other remedies allowed at law or in equity for breach of this Contract.

4. Delete Section D.32. of the Pro Forma Contract (RFP Attachment 6.6) in its entirety and insert the following in its place (any sentence or paragraph containing revised or new text is highlighted):

D.32. Insurance. Contractor shall maintain insurance coverage as specified in this Section. The State reserves the right to amend or require additional insurance coverage, coverage amounts, and endorsements required under this Contract. Contractor’s failure to maintain or submit evidence of insurance coverage, as required, is a material breach of this Contract. If Contractor loses insurance coverage, fails to renew coverage, or for any reason becomes uninsured during the Term, Contractor shall immediately notify the State. All insurance companies providing coverage must be: (a) acceptable to the State; (b) authorized by the Tennessee Department of Commerce and Insurance (“TDCI”); and (c) rated A- / VII or better by A.M. Best.

All coverage must be on a primary basis and noncontributory with any other insurance or self-insurance carried by the State. Contractor agrees to name include the State as an additional insured on any insurance policy with the exception of workers’ compensation (employer liability), and professional liability (errors and omissions), or crime insurance. All policies, except cyber, must contain an endorsement or policy wording for a waiver of subrogation in favor of the State.

However, the State shall be named a loss payee on the Contractor’s crime policy. Any deductible or self-insured retention (“SIR”) over fifty thousand dollars ($50,000) must be disclosed to approved by the State. The deductible or SIR and any premiums are the Contractor’s sole responsibility. The Contractor agrees that the insurance requirements specified in this Section do not reduce any liability the Contractor has assumed under this Contract including any indemnification or hold harmless requirements.

To achieve the required coverage amounts, a combination of an otherwise deficient specific policy and an umbrella policy with an aggregate meeting or exceeding the required coverage amounts is acceptable. For example: If the required policy limit under this Contract is for two million dollars ($2,000,000) in coverage, acceptable coverage would include a specific policy covering one million dollars ($1,000,000) combined with an umbrella policy for an additional one million dollars ($1,000,000). If the deficient underlying policy is for a coverage area without aggregate limits (generally Automobile Liability and Employers’ Liability Accident), Contractor shall provide a copy of the umbrella insurance policy documents to ensure that no aggregate limit applies to the umbrella policy for that coverage area. In the event that an umbrella policy is being provided to achieve any required coverage amounts, the umbrella policy shall be accompanied by an endorsement at least as broad as the Insurance Services Office, Inc. (also known as “ISO”) “Noncontributory—Other Insurance Condition” endorsement or shall be written on a policy form that addresses both the primary and noncontributory basis of the umbrella policy if the State is otherwise named as an additional insured.

Contractor shall provide the State a certificate of insurance (“COI”) evidencing the coverages and amounts specified in this Section. The COI must be on a form approved by the TDCI (standard ACORD form preferred). The COI must list each insurer’s National Association of Insurance Commissioners (NAIC) number and be signed by an authorized representative of the insurer. The COI must list the State of Tennessee – CPO Risk Manager, 312 Rosa L. Parks Ave., 3rd floor Central Procurement Office, Nashville, TN 37243 as the certificate holder. Contractor shall provide the COI ten (10) business days prior to the Effective Date and shall endeavor to provide it again thirty (30) calendar days on before the date of renewal or replacement of coverage, but no later than seven (7) business days after the renewal or replacement of coverage before renewal or replacement of coverage. Contractor shall provide the State evidence that all subcontractors maintain the required insurance or that subcontractors are included under the Contractor’s policy.

At any time, the State may require Contractor to provide a valid COI. The Parties agree that failure to provide evidence of insurance coverage as required is a material breach of this Contract. If Contractor self-insures, then a COI will not be required to prove coverage. Instead, Contractor shall provide a certificate of self-insurance or a letter, on Contractor’s letterhead, detailing its coverage, policy amounts, and proof of funds to reasonably cover such expenses.

The State reserves the right to require The Contractor shall permit the State to review complete copies of all required insurance policies, including endorsements required by these specifications, at any time.

The State agrees that it shall give written notice to the Contractor as soon as practicable after the State becomes aware of any claim asserted or made against the State, but in no event later than thirty (30) calendar days after the State becomes aware of such claim. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor or its insurer, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann.

§ 8-6-106.

The insurance obligations under this Contract shall be: (1)—all the insurance coverage and policy limits carried by the Contractor; or (2)—the minimum insurance coverage requirements and policy limits shown in this Contract; whichever is greater. Any insurance proceeds in excess of or broader than the minimum required coverage and minimum required policy limits, which are applicable to a given loss, shall be available to the State. No representation is made that the minimum insurance requirements of the Contract are sufficient to cover the obligations of the Contractor arising under this Contract. The Contractor shall obtain and maintain, at a minimum, the following insurance coverages and policy limits.

a. Commercial General Liability (“CGL”) Insurance

1) The Contractor shall maintain CGL, which shall be written on an ISO Form CG 00 01 occurrence form (or a substitute form providing equivalent coverage) and shall cover liability arising from property damage, premises and operations products and completed operations, bodily injury, personal and advertising injury, and liability assumed under an insured contract (including the tort liability of another assumed in a business contract).

The Contractor shall maintain single limits not less than one million dollars ($1,000,000) per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this policy or location of occurrence or the general aggregate limit shall be twice the required occurrence limit.

b. Workers’ Compensation and Employer Liability Insurance

1) For Contractors statutorily required to carry workers’ compensation and employer liability insurance, the Contractor shall maintain:

i. Workers’ compensation in an amount not less than one million dollars ($1,000,000) including employer liability of one million dollars ($1,000,000) per accident for bodily injury by accident, one million dollars ($1,000,000) policy limit by disease, and one million dollars ($1,000,000) per employee for bodily injury by disease.

2) If the Contractor certifies that it is exempt from the requirements of Tenn. Code

Ann. §§ 50-6-101 – 103, then the Contractor shall furnish written proof of such exemption for one or more of the following reasons:

i. The Contractor employs fewer than five (5) employees;

ii. The Contractor is a sole proprietor;

iii. The Contractor is in the construction business or trades with no employees;

iv. The Contractor is in the coal mining industry with no employees;

v. The Contractor is a state or local government; or

vi. The Contractor self-insures its workers’ compensation and is in compliance with the TDCI rules and Tenn. Code Ann. § 50-6-405.

c. Automobile Liability Insurance

1) The Contractor shall maintain automobile liability insurance which shall cover liability arising out of any automobile (including owned, leased, hired, and non-owned automobiles).

2) The Contractor shall maintain bodily injury/property damage with a limit not less than one million dollars ($1,000,000) per occurrence or combined single limit.

d. Professional Liability Insurance

1) Professional liability insurance shall be written on an occurrence basis or on a claims-made basis. If this coverage is written on a claims-made basis, then:

i. The retroactive date must be shown, and must be on or before the earlier of the Effective Date of the Contract or the beginning of Contract work or provision of goods and services;

ii. Insurance must be maintained, and evidence of insurance must be provided for at least five (5) full years from the date of the final Contract payment; and

iii. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date on or prior to the Contract Effective Date, the Contractor must purchase “extended reporting” or “tail coverage” for a minimum of five (5) full years from the date of the final Contract payment.

2) Any professional liability insurance policy shall have a limit not less than one million dollars ($1,000,000) per claim and two million dollars ($2,000,000) in the aggregate; and

3) If the Contract involves the provision of services by medical professionals, a policy limit not less than three million ($3,000,000) per claim and three million dollars ($3,000,000) in the aggregate for medical malpractice insurance.

e. Technology Professional Liability (Errors & Omissions)/Cyber Liability Insurance

1) The Contractor shall maintain technology professional liability (errors & omissions)/cyber liability insurance appropriate to the Contractor’s profession in an amount not less than ten million dollars ($10,000,000) per occurrence or claim and ten million dollars ($10,000,000) annual aggregate, covering all acts, claims, errors, omissions, negligence, infringement of intellectual property (including copyright, patent and trade secret); network security and privacy risks, including but not limited to unauthorized access, failure of security, information theft, damage to destruction of or alteration of electronic information, breach of privacy perils, wrongful disclosure and release of private information, collection, or other negligence in the handling of confidential information, and including coverage for related regulatory fines, defenses, and penalties.

2) Such coverage shall include data breach response expenses, in an amount not less than ten million dollars ($10,000,000) and payable whether incurred by the State or Contractor, including but not limited to consumer notification, whether or not required by law, computer forensic investigations, public relations and crisis management firm fees, credit file or identity monitoring or remediation services and expenses in the performance of services for the State or on behalf of the State hereunder.

f. Crime Insurance

1) The Contractor shall maintain crime insurance, which shall be written on a “loss sustained form” or “loss discovered form” providing coverage for third party fidelity, including cyber theft and extortion. The policy must allow for reporting of circumstances or incidents that may give rise to future claims, include an extended reporting period of no less than two (2) years with respect to events which occurred but were not reported during the term of the policy, and not contain a condition requiring an arrest or conviction.

2) Any crime insurance policy shall have a limit not less than one million dollars

($1,000,000) per claim and one million dollars ($1,000,000) in the aggregate.

Any crime insurance policy shall contain a Social Engineering Fraud Endorsement with a limit of not less than two hundred and fifty thousand dollars ($250,000). This insurance may be written on a claims-made basis, but in the event that coverage is cancelled or non-renewed, the Contractor shall purchase an extended reporting or “tail coverage” of at least two (2) years after the Term.

5. Add the following to Section A of the Pro Forma Contract (RFP Attachment 6.6):

A.20. Permissible Uses. The State certifies, represents and warrants that the State’s permissible use of Contractor’s services pursuant to 15 C.F.R. § 1110 et seq. is a legitimate fraud prevention interest to detect and prevent fraud across its business and/or government activities, and the State shall comply with 15 C.F.R. § 1110 et seq., if and as applicable. The Contractor’s services may include nonpublic personal information, which is governed by the privacy provisions of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and its implementing regulations (collectively, “GLBA”). The State certifies, represents and warrants that (i) it has the permissible use under the GLBA to use and/or obtain such information, i.e., in complying with federal, state, or local laws, rules, and other applicable legal requirements (“GLBA Permissible Use”), (ii) it will only use such information for such purpose, and (iii) it will comply with the GLBA, if and as applicable.