STATE OF TENNESSEE

DEPARTMENT OF FINANCE & ADMINISTRATION, BENEFITS ADMINISTRATION

REQUEST FOR PROPOSALS #31786-00187

AMENDMENT #TWO

FOR ADMINISTRATIVE SERVICES ONLY TO

PERFORM AS THIRD-PARTY ADMINISTRATOR FOR

THE STATE’S THE TENNESSEE PLAN

DATE: October 30, 2025

RFP #31786-0087 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT TIME

(central time zone)

DATE

1. RFP Issued

September 23, 2025

2. Disability Accommodation Request Deadline 2:00 p.m. September 29, 2025

3. Pre-response Conference 1:00 p.m. September 30, 2025

4. Notice of Intent to Respond Deadline 2:00 p.m. October 1, 2025

5. Written “Questions & Comments” Deadline

NOTE: Submit written questions and comments on Appendix 7.6 the written questions and comments template.

2:00 p.m.

October 8, 2025

6. State Response to Written “Questions & Comments”

October 30, 2025

7. Written “Questions & Comments” Deadline

ROUND 2

NOTE: Respondents may submit no more than five (5) questions to the State in the 2 nd round of Written Questions and Comments

November 6, 2025

8. State Response to Written “Questions & Comments” Round 2

December 3, 2025

9. Response Deadline 2:00 p.m. December 10, 2025

10. State Completion of Technical Response Evaluations

January 15, 2026

11. State Opening & Scoring of Cost Proposals 2:00 p.m. January 16, 2026

12. Negotiations (Optional) 4:30 p.m. January 23-27, 2026

13. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

2:00 p.m.

February 26, 2026

14. End of Protest Period

March 5, 2026

15. State sends contract to Contractor for signature

March 6, 2026

16. Contractor Signature Deadline 2:00 p.m. March 13, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

RFP

SECTION

QUESTION / COMMENT STATE RESPONSE

3.2

Response

Delivery

1.

Regarding the Digital Media Submission, instructions state:

The Technical Response document should be in the form of one (1) digital document in “PDF” format properly recorded on its own otherwise blank USB flash drive or uploaded to our digital submission platform and should be clearly identified as the:

“RFP #3186-00187 TECHNICAL RESPONSE

ORIGINAL”

and one (1) digital copy of the Technical Response each in the form of one (1) digital document with separate individual corresponding appendices or exhibits in “PDF” format properly recorded on its own otherwise blank USB flash drive clearly labeled:

“RFP #3186-00187 TECHNICAL RESPONSE

COPY”

Please confirm there should be one digital copy of our Technical Response that contains Sections A, B, and C in one PDF, and each individual appendices should be uploaded as separate PDF documents.

Confirmed.

Section B –

General

Qualifications and

Experience

Items

2.

Item B.15 requests three references from three different persons, in accordance with instructions in Attachment 6.4.

Attachment 6.4 states:

• two (2) contracts Respondent currently services that are similar in size and scope to the services required by this RFP; and

▪ three (3) completed contracts that are similar in size and scope to the services required by this

RFP.

Please confirm that the State’s intent is for Respondent to provide a total of 5 references.

Secondly, how will Respondents be notified that the State has received the required number of references?

If the State were to receive more than the required number of references, will the first to arrive be the ones that are scored (in order of receipt)?

Respondents should provide reference questionnaires that represent the following requirements:

• two (2) contracts Respondent currently services that are similar in size and scope to the services required by this RFP; and

• three (3) completed contracts that are similar in size and scope to the services required by this

RFP.

References from at least three (3) different individuals are required to satisfy the requirements above, e.g., an individual may provide a reference about a completed project and another reference about a currently serviced account.

Respondents may contact the solicitation coordinator listed in the

RFP to confirm if references have been received.

The State will review the first five references received.

Section

A.11.e.2.

3. Please clarify what information Contractor is expected to maintain and where. We maintain data in our systems, but information is not “on-line”, except under our website, due to confidentiality. Also, please clarify what information the State is requesting to be updated monthly and will the State consider the detailed and summary history data in another format in lieu of being “on-line”, and at intervals other than monthly.

The Contractor is required to maintain under its Member website detailed claims history for inquiry by

Members. The claims history shall be updated in detail for online access and summary history may be provided through the Contractor’s reporting system. The Contractor shall comply with all federal and state regulations regarding the retention of data. The state does not agree with intervals other than monthly.

Section A13.f 4. Contractor will provide support data to support any agreed upon audits, however due to security reasons, the State may not access the Contracter's systems. Please confirm this edit is acceptable to the State.

The state does not agree.

Section

A.11.i.1

5. Is the State open to other standards? The Contractor has numerous systems and the unsuccessful attempt lock out logic can vary by system.

Please submit alternative contract language for the State to consider in

Round 2 written questions and comments.

Section

A.11.i.3

6. Please confirm that testing and audit can be based on Contractor’s methodology. As these systems support our entire book of business, we do not alter our methodology for each customer.

The State is willing to consider this change during contract award pursuant to RFP Section 5.3.6.

Section A.15.b 7. Other than claims surcharge filings that exist in other states, we are not aware of any tax filings we would

This is a standard clause in state contracts requiring contractors to be submit on behalf of one of our customers. What specific tax filings are being referred to in this section?

aware of and manage any federal or state taxes due, if applicable, as administrator for the plan. Pro forma contract section A.15.b. has been revised. See amendment item #3.

C. Payment

Terms and

Conditions

8.

Within item C.1, does the red text need to be completed?

In no event shall the maximum liability of the State under this Contract exceed Written Dollar Amount ($Number) (“Maximum Liability”). This Contract does not grant the Contractor any exclusive rights. The State does not guarantee that it will buy any minimum quantity of goods or services under this Contract. Subject to the terms and conditions of this Contract, the Contractor will only be paid for goods or services provided under this Contract after a purchase order is issued to Contractor by the State or as otherwise specified by this Contract.

See RFP Section 1.1.2. The maximum liability for the resulting contract will be determined through the best evaluated cost proposal and estimated cost associated with this service. C.1 will be completed before the Contract is signed by the State and the Contractor.

C. Payment

Terms and

Conditions

9.

Within item C.3.a, please confirm the date should be 2027.

The Contractor’s compensation shall be contingent upon the satisfactory provision of goods or services as set forth in Section A. Any implementation efforts and activities prior to services performed starting January 1, 2026, will be at no additional cost to the State.

Confirmed. See amendment item #4.

Section D.6 10. Is the state willing to restore the cure period that have been in prior contracts? Also, can termination for cause be solely for material breach of the Contract?

The State does not agree to revise

D.6.

Section D.19 11. Will the State indemnify the Contractor for the State’s material breach of the agreement, or the States design and operation of its Plan as these topics are outside the Contractors control and can create liability for the Contractor.

The State does not agree

In Section

E.a.(2)

12.

Is encryption using AES-256 acceptable? For security purposes, is the State willing to allow the Contractor to control access to the encryption keys, as they rotate regularly?

See answer to question #18.

Section E.3 13. Please provide some context how this would be interpreted in a claims service environment. It is possible that the Contractor may not have the capabilities to meet all the requests of the State; that is not an act of bad faith

The State agrees that all services must be clearly defined and but just business limitations. We agree all services must be listed in the Contact.

authorized within the Contract, and we do not expect or intend to request services that are not included.

Additionally, the State does not have a mechanism to pay for non-contracted services, which further reinforces the importance of adhering strictly to the agreed scope.

Section

E.5.a.4

14.

As Contractor, we have audit rights with our subcontractors. Please confirm if the Contractor audits of its subcontractors are sufficient.

The State does not agree.

Section

E.5.a.4

15. Since our information system is proprietary, would the State be willing to accept a virtual review of our controls.

The State does not agree.

D.32

Insurance

16.

D.32 – Will the State consider matching their Insurance language to their current contract, as follows?

D.32 Insurance. Contractor shall maintain insurance coverage as specified in this Section. The State reserves the right to amend or require additional insurance coverage, coverage amounts, and endorsements required under this Contract upon mutual agreement of both parties and just cause being shown. Contractor’s failure to maintain or submit evidence of insurance coverage, as required, is a material breach of this Contract. If

Contractor loses insurance coverage, fails to renew coverage, or for any reason becomes uninsured during the

Term, Contractor shall immediately

The State accepts the first proposed revision (which begins with, “…upon mutual…”). See amendment item #6.

notify the State. All insurance companies providing coverage must be: (a) acceptable to the State authorized by the Tennessee

Department of Commerce and

Insurance (“TDCI”); and (b) rated A- /

VII or better by A.M. Best. All coverage must be on a primary basis and noncontributory with any other insurance or self-insurance carried by the State. Contractor agrees to name the State as an additional insured and to provide a waiver of subrogation in favor of the State under on its

Commercial General Liability (“CGL”) insurance policy only any insurance policy with the exception of workers’ compensation (employer liability) and professional liability (errors and omissions) insurance. All policies must contain an endorsement for a waiver of subrogation in favor of the State. Any deductible or self insured retention

(“SIR”) over fifty thousand dollars

($50,000) must be approved by disclosed to the State. The deductible or SIR and any premiums are the

Contractor’s sole responsibility. The

Contractor agrees that the insurance requirements specified in this Section do not reduce any liability the

Contractor has assumed under this

Contract including any indemnification or hold harmless requirements.

The State accepts the removal of

“acceptable to the State.” See amendment item #6.

The State rejects the redlines (both the additions and strikethroughs) beginning with “and to provide…” and ending with “…in favor of the

State.”

The State accepts the substitution of

“disclosed to” for “approved by”. See amendment item #6.

NO CHANGE TO PARAGRAPH THAT BEGINS:

To achieve the required coverage amounts…

Contractor shall provide the State a certificate of insurance (“COI”) evidencing the coverages and amounts specified in this Section. The COI must be on a form approved by the TDCI (standard ACORD form preferred). The COI must list each insurer’s National Association of Insurance Commissioners (NAIC) number and be signed by an authorized representative of the insurer. The COI must list the State of Tennessee – CPO Risk Manager, 312 Rosa L. Parks Ave., 3rd floor Central Procurement Office, Nashville, TN 37243 as the certificate holder.

Contractor shall provide the COI ten (10) Business Days prior to the Effective Date and again thirty (30) calendar days before after renewal or replacement of coverage. Contractor shall provide the State evidence that all subcontractors maintain the required insurance or that subcontractors are included under the Contractor’s policy. At any time, the State may require Contractor to provide a valid

COI.

The Parties agree that failure to provide evidence of insurance coverage as required is a material breach of this Contract. If Contractor self-insures, then a COI will not be required to prove coverage. Instead, Contractor shall provide a certificate of self-insurance or a letter, on Contractor’s letterhead, detailing its coverage, policy amounts, and proof of funds to reasonably cover such expenses. The State reserves the right to require complete copies of all required insurance policies, including endorsements required by these specifications, at any time.

NO CHANGE TO THE PARAGRAPH THAT

BEGINS: The State agrees that it shall give written notice to the Contractor as soon as practicable

The insurance obligations under this Contract shall be : (1)—all the insurance coverage and policy limits carried by the Contractor; or (2)— the minimum insurance coverage requirements and policy limits shown in this Contract, whichever is greater. Any insurance proceeds in excess of or broader than the minimum required coverage and minimum required polity limits, which are applicable to a given loss, shall be available to the State. No representation is made that the minimum insurance requirements of the Contract are sufficient to cover the

The State rejects the substitution of

“after” for “before” in the third paragraph; however, the State would agree to revise the requirement so that a COI must be provided “within ten (10) calendar days of the renewal or replacement of coverage.” See amendment item #6.

The State rejects the strikethrough of the requirement to provide evidence of subcontractor coverages.

The State accepts the strikethrough of the sentence which begins, “The

State reserves the right to require complete…”, on the condition that it is replaced with the following: “The

State reserves the right to require relevant policy excerpts, including endorsements, at any time, as needed to check for compliance with the requirements of this Section.”

See amendment item #6.

The State accepts the redlines in the fifth paragraph. See amendment item #6.

obligations of the Contractor arising under this Contract. The Contractor shall obtain and maintain, at a minimum, the following insurance coverages and policy limits.

D.36

Prohibited

Contract

Terms

17.

Requesting a carve-out to the item below that allows us to assert rights as permitted under applicable law (e.g., if an exception has been created by the courts).

The prohibited contract terms and conditions enumerated in Tenn. Code Ann. § 12-3-515, shall be a material provision of this Contract. The Contractor acknowledges, understands, and agrees that the inclusion of a term or condition prohibited by Tenn. Code Ann. § 12-3-515, shall be null and void and the Contract shall be enforceable as if the Contract did not contain such term or condition.

The State rejects the proposed revision. The State cannot enter into contracts that contain prohibited terms as enumerated by Tenn. Code

Ann. § 12-3-515.

E.5

Information

Technology

Security

Requirements

18.

Requesting the following sentences be removed from E.5 Information Technology Security Requirements a.2.

The State shall control all access to encryption keys. The Contractor shall provide installation and maintenance support at no cost to the State.

The State does not agree. However, the State has revised the language in E.5.a(2). See amendment item #5.

E.5

Information

Technology

Security

Requirements

19.

Requesting the replacement below on item E.5 Information Technology Security Requirements a.5.

The Contractor shall allow the State, at its option, to perform Penetration Tests and Vulnerability Assessments on the Processing Environment.

REPLACE WITH:

The Contractor shall commission an independent third party to perform the risk assessment which must include penetration testing and vulnerability assessments.

The State has revised the language in E.5.a(5). See amendment item #5.

E.5

Information

Technology

Security

Requirements

20.

Please consider removing the red text from E.5 Information Technology Security Requirements b.4.

This phrase is not applicable to the proposed service delivery model.

(4) In the event of drive/media failure, if the drive/media is replaced, it remains with the State and it is the State’s responsibility to destroy the drive/media, or the Contractor shall provide written confirmation of the sanitization/destruction of data according to

NIST 800- 88.

Attachment E

– BAA

21. Will the State consider using a currently executed

BAA?

No. The BAA included in the pro forma contract will be included in the fully executed contract resulting from this RFP.

In Section

E.5.a.4 of the

Pro Forma

22. Please confirm that SOC corrective action plans can be based on Contractor’s methodology and requirements. As these systems support our entire book of business, we do not create corrective action plans for each customer.

The State does not agree.

In Section

E.5.a.5. of the

Pro Forma

23. As there are security issues with a customer performing penetration tests and vulnerably assessments on a Contractor processing environment, please confirm that the tests completed by Contractor and its vendor are sufficient.

See answer to question #19.

In Section

E.5.a.5. of the

Pro Forma

24. Would the State be open to modifying the notification period to 72 hours of confirmation since we need time to confirm unauthorized disclosure or access to State’s data.

The State does not agree.

In Section

E.5.a.7 of the

Pro Forma

25. As the State needs access to its data, we are happy to provide, please clarify the need for such information in one format and delivered at the same time. We store our data in different formats and different locations and is automatically disposed of based on legal requirements.

The State has revised language in

E.5.a(7). See amendment item #5.

In Section

E.5.a.8 of the

Pro Forma

26. We maintain data in accordance with our legal obligations and automatically destroyed. Will the State accept a certification from us that information will be destroyed in accordance with legal requirements?

The State agrees.

In Section

E.5.b.1 of the

Pro Forma

27. .

As we have extensive security policies and procedures for our entire book of business, please confirm that compliance with Contractor information security policies is sufficient.

In Section

E.5.c.1 of the

Pro Forma

28. Will the State accept RTO’s and RPO’s that vary based on data?

The State does not agree.

In Section

E.5.b.2 of the

Pro Forma

29. We conduct these tests with book of business data, please confirm that is sufficient.

In Section

E.5.b.2 of the

Pro Forma

30. Will the State be willing review an executive summary of Disaster Recovery testing confirming we have met RTO’s and RPO’s at the time the State conducts its audit.

Executive summaries may be provided for routine compliance reviews; however, full documentation must be made available to the State or its designee during audits or upon written request.

In Section

E.5.a.3 of the

Pro Forma

31. .

Please confirm that SOC audit and control objectives can be based on Contractor’s methodology. As these systems support our entire book of business, we do not alter our methodology for each customer.

3. Delete Pro Forma Contract Section A.15.b in its entirety and insert the following in its place.

b. The Contractor shall perform, if applicable, the administration of tax calculations, payments, and filing of appropriate IRS forms and any other required federal and/or state tax forms.

4. Delete Pro Forma Contract Section C.3.a in its entirety and insert the following in its

a. The Contractor’s compensation shall be contingent upon the satisfactory provision of goods or services as set forth in Section A. Any implementation efforts and activities prior to services performed starting January 1, 2027, will be at no additional cost to the State.

5. Delete Pro Forma Contract Section E.5 in its entirety and insert the following in its

E.5 Information Technology Security Requirements (State Data, Audit, and Other Requirements).

a. The Contractor shall protect State Data as follows:

(1) The Contractor shall ensure that all State Data is housed in the continental

United States, inclusive of backup data. All State data must remain in the

United States, regardless of whether the data is processed, stored, in-transit, or at rest. Access to State data shall be limited to US- based (onshore) resources only.

All system and application administration must be performed in the continental

United States. Configuration or development of software and code is permitted outside of the United States. However, software applications designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary, which the U.S.

Secretary of Commerce acting pursuant to 15 CFR 7 has defined to include the

People’s Republic of China, among others are prohibited. Any testing of code outside of the United States must use fake data. A copy of production data may not be transmitted or used outside the United States.

(2) The Contractor shall encrypt Confidential State Data at rest and in transit using the current version of Federal Information Processing Standard (“FIPS”)

140-2 or 140-3 (or current applicable version) validated encryption technologies. The Contractor shall adhere to NIST and CIS cybersecurity practices to protect encryption keys, information systems, and data, including following NIST SP 800-57 for key management. Upon request, the Contractor must provide the State with a decrypted copy of the Confidential State Data and provide installation and maintenance support at no cost to the State.

(3) The Contractor and any Subcontractor used by the Contractor to host State data, including data center vendors, shall be subject to an annual engagement by a licensed CPA firm in accordance with the standards of the

American Institute of Certified Public Accountants (“AICPA”) for a System and

Organization Controls for service organizations (“SOC”) 2 Type 2 examination. The scope of the SOC 2 Type 2 examination engagement must include the Security, Availability, Confidentiality, and Processing Integrity

Trust Services Criteria. In addition, the Contractor services that are part of this Contract, including any processing or storage services, must be included in the scope of the SOC 2 Type 2 examination engagement(s).

(4) The Contractor must annually review its SOC 2 Type 2 examination reports.

Within 30 days of receipt of the examination report, or upon request from the

State or the Comptroller of the Treasury, the Contractor must provide the

State or the Comptroller of the Treasury a non- redacted copy of the

Contractor’s SOC 2 Type 2 examination report(s). The Contractor must review the annual SOC 2 Type 2 examination reports for each of its

Subcontractors and must also assist the State or Comptroller of the Treasury with obtaining a non-redacted copy of any SOC examination reports for each of its Subcontractors, including data centers used by the Contractor to host or process State data.

If the Contractor’s SOC 2 Type 2 examination report includes a modified opinion, meaning that the opinion is qualified, adverse, or disclaimed, the

Contractor must share the SOC report and the Contractor’s plan to address the modified opinion with the State or the Comptroller of the Treasury within

30 days of the Contractor’s receipt of the SOC report or upon request from the State or the Comptroller of the Treasury. If any Subcontractor(s) SOC 2

Type 2 examination report includes a modified opinion, the Contractor must assist the State or Comptroller of the Treasury with obtaining the

Subcontractor(s) SOC report and the Subcontractor(s) plan to address the modified opinion.

The Contractor must have a process for correcting control deficiencies that were identified in the SOC 2 Type 2 examination, including follow-up documentation providing evidence of such corrections. Within 30 days of receipt of the examination report, or upon request from the State or the

Comptroller of the Treasury, the Contractor must provide the State or the

Comptroller of the Treasury with a corrective action plan and evidence of correcting the control deficiencies. The Contractor must require each of its

Subcontractors, including data centers used by the Contractor to host State data, to have a process for correcting control deficiencies identified in their

SOC examination reports and must assist the State or Comptroller of the

Treasury with obtaining a corrective action plan and obtaining evidence of correcting control deficiencies identified in Subcontractor(s) SOC reports.

No additional funding shall be allocated for these examinations as they are included in the Maximum Liability of this Contract.

(5) The Contractor must annually perform Penetration Tests and Vulnerability

Assessments against its Processing Environment per the NIST 800-115 definition. “Processing Environment” shall mean the combination of software and hardware on which the Application runs. “Application” shall mean the computer code that supports and accomplishes the State’s requirements as set forth in this Contract. “Penetration Tests” shall be in the form of attacks on the Contractor’s computer system, with the purpose of discovering security weaknesses which have the potential to gain access to the Processing

Environment’s features and data. The “Vulnerability Assessment” shall be designed and executed to define, identify, and classify the security holes

(vulnerabilities) in the Processing Environment. The Contractor shall commission an independent third party to perform the risk assessment which must include penetration testing and vulnerability assessments per NIST 800-

115 (covers VAPT). The Contractor shall provide a letter of attestation on its processing environment that penetration tests and vulnerability assessments has been performed on an annual basis and taken corrective action to evaluate and address any findings.

In the event of an unauthorized disclosure or unauthorized access to State data, the State Strategic Technology Solutions (STS) Security Incident

Response Team (SIRT) must be notified and engaged by calling the State

Customer Care Center (CCC) at 615-741-1001. Any such event must be reported by the Contractor within twenty-four (24) hours after the unauthorized disclosure has come to the attention of the Contractor.

(6) If a breach has been confirmed a fully un-modified third-party forensics report must be supplied to the State and through the STS SIRT. This report must include indicators of compromise (IOCs) as well as plan of actions for remediation and restoration. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures.

(7) Upon State request, the Contractor shall provide a decrypted copy of all

Confidential State Data in a format mutually agreed upon by the Contractor and the State.

(8) Upon termination of this Contract and in consultation with the State, the

Contractor shall destroy, and ensure all subcontractors shall destroy, all

Confidential State Data it holds (including any copies such as backups) in accordance with the current version of National Institute of Standards and

Technology (“NIST”) Special Publication 800-88. The Contractor shall provide a written confirmation of destruction to the State within ten (10) business days after destruction.

b. Minimum Requirements

(1) The Contractor and all data centers used by the Contractor to host

State data, including those of all Subcontractors, must comply with the State’s Enterprise Information Security Policies as amended periodically. The State’s Enterprise Information Security Policies document is found at the following URL:

https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html.

(2) The Contractor agrees to maintain the Application so that it will run on a current, manufacturer-supported Operating System. “Operating

System” shall mean the software that supports a computer's basic functions, such as scheduling tasks, executing applications, and controlling peripherals.

(3) If the Application requires middleware or database software, Contractor shall maintain middleware and database software versions that are always fully compatible with current versions of the Operating

System and Application to ensure that security vulnerabilities are not introduced.

(4) In the event of drive/media failure, if the drive/media is replaced, it remains with the State and it is the State’s responsibility to destroy the drive/media, or the Contractor shall provide written confirmation of the sanitization/destruction of data according to NIST 800- 88.

c. Business Continuity Requirements. The Contractor shall maintain set(s) of documents, instructions, and procedures which enable the Contractor to respond to accidents, disasters, emergencies, or threats without any stoppage or hindrance in its key operations (“Business Continuity

Requirements”). Business Continuity Requirements shall include:

(1) “Disaster Recovery Capabilities” refer to the actions the Contractor takes to meet the Recovery Point and Recovery Time Objectives defined below.

Disaster Recovery Capabilities shall meet the following objectives:

https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html

i. Recovery Point Objective (“RPO”). The RPO is defined as the maximum targeted period in which data might be lost from an IT service due to a major incident

Twenty-four (24) hours

ii. Recovery Time Objective (“RTO”). The RTO is defined as the targeted duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity:

Seventy-two (72) hours

(2) The Contractor and the Subcontractor(s) shall maintain a documented

Disaster Recovery plan and shall share this document with the State when requested. The Contractor and the Subcontractor(s) shall perform at least one

Disaster Recovery Test every three hundred sixty-five (365) days. A “Disaster

Recovery Test” shall mean the process of verifying the success of the restoration procedures that are executed after a critical IT failure or disruption occurs. The Disaster Recovery Test shall use actual State Data Sets that mirror production data, and success shall be defined as the Contractor verifying that the Contractor can meet the State’s RPO and RTO requirements. A “Data Set” is defined as a collection of related sets of information that is composed of separate elements but can be manipulated as a unit by a computer. The Contractor shall provide written confirmation to the

State after each Disaster Recovery Test that its Disaster Recovery

Capabilities meet the RPO and RTO requirements.

6. Delete Pro Forma Contract Section D.32 in its entirety and insert the following in its

D.32 Insurance. Contractor shall maintain insurance coverage as specified in this Section. The State reserves the right to amend or require additional insurance coverage, coverage amounts, and endorsements required under this Contract upon mutual agreement of both parties and just cause being shown.

Contractor’s failure to maintain or submit evidence of insurance coverage, as required, is a material breach of this Contract. If Contractor loses insurance coverage, fails to renew coverage, or for any reason becomes uninsured during the Term, Contractor shall immediately notify the State. All insurance companies providing coverage must be: (a) authorized by the Tennessee

Department of Commerce and Insurance (“TDCI”); and (b) rated A- / VII or better by A.M. Best. All coverage must be on a primary basis and noncontributory with any other insurance or self-insurance carried by the State. Contractor agrees to name the State as an additional insured on any insurance policy with the exception of workers’ compensation (employer liability) and professional liability (errors and omissions) insurance. All policies must contain an endorsement for a waiver of subrogation in favor of the State.

Any deductible or self insured retention (“SIR”) over fifty thousand dollars ($50,000) must be disclosed to the State. The deductible or SIR and any premiums are the Contractor’s sole responsibility. The Contractor agrees that the insurance requirements specified in this Section do not reduce any liability the Contractor has assumed under this Contract including any indemnification or hold harmless requirements.

To achieve the required coverage amounts, a combination of an otherwise deficient specific policy and an umbrella policy with an aggregate meeting or exceeding the required coverage amounts is acceptable. For example: If the required policy limit under this Contract is for two million dollars ($2,000,000) in coverage, acceptable coverage would include a specific policy covering one million dollars ($1,000,000) combined with an umbrella policy for an additional one million dollars ($1,000,000). If the deficient underlying policy is for a coverage area without aggregate limits (generally Automobile Liability and Employers’ Liability Accident), Contractor shall provide a copy of the umbrella insurance policy documents to ensure that no aggregate limit applies to the umbrella policy for that coverage area. In the event that an umbrella policy is being provided to achieve any required coverage amounts, the umbrella policy shall be accompanied by an endorsement at least as broad as the Insurance Services Office, Inc. (also known as “ISO”) “Noncontributory—Other Insurance Condition” endorsement or shall be written on a policy form that addresses both the primary and noncontributory basis of the umbrella policy if the State is otherwise named as an additional insured.

Contractor shall provide the State a certificate of insurance (“COI”) evidencing the coverages and amounts specified in this Section. The COI must be on a form approved by the TDCI (standard ACORD form preferred). The COI must list each insurer’s National Association of Insurance Commissioners (NAIC) number and be signed by an authorized representative of the insurer. The COI must list the State of Tennessee – CPO Risk Manager, 312 Rosa L. Parks Ave., 3rd floor Central Procurement Office, Nashville, TN 37243 as the certificate holder. Contractor shall provide the COI ten (10) Business Days prior to the Effective Date and again within ten (10) calendar days of the renewal or replacement of coverage. Contractor shall provide the State evidence that all subcontractors maintain the required insurance or that subcontractors are included under the Contractor’s policy. At any time, the State may require Contractor to provide a valid COI.

The Parties agree that failure to provide evidence of insurance coverage as required is a material breach of this Contract. If Contractor self-insures, then a COI will not be required to prove coverage. Instead, Contractor shall provide a certificate of self-insurance or a letter, on Contractor’s letterhead, detailing its coverage, policy amounts, and proof of funds to reasonably cover such expenses.

The State agrees that it shall give written notice to the Contractor as soon as practicable after the State becomes aware of any claim asserted or made against the State, but in no event later than thirty (30) calendar days after the State becomes aware of such claim. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor or its insurer, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann.

§ 8-6-106.

The insurance obligations under this Contract shall be: the minimum insurance coverage requirements and policy limits shown in this Contract. No representation is made that the minimum insurance requirements of the Contract are sufficient to cover the obligations of the Contractor arising under this Contract. The Contractor shall obtain and maintain, at a minimum, the following insurance coverages and policy limits.

a. Commercial General Liability (“CGL”) Insurance

1) The Contractor shall maintain CGL, which shall be written on an ISO Form CG 00 01 occurrence form (or a substitute form providing equivalent coverage) and shall cover liability arising from property damage, premises and operations products and completed operations, bodily injury, personal and advertising injury, and liability assumed under an insured contract (including the tort liability of another assumed in a business contract).

2) The Contractor shall maintain single limits not less than one million dollars ($1,000,000) per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this policy or location of occurrence or the general aggregate limit shall be twice the required occurrence limit.

b. Workers’ Compensation and Employer Liability Insurance

1) For Contractors statutorily required to carry workers’ compensation and employer liability insurance, the Contractor shall maintain:

i. Workers’ compensations and employer’s liability insurance in the amounts required by appropriate state statutes.

2) If the Contractor certifies that it is exempt from the requirements of Tenn. Code Ann. §§ 50-6-101 – 103, then the Contractor shall furnish written proof of such exemption for one or more of the following reasons:

i. The Contractor employs fewer than five (5) employees;

ii. The Contractor is a sole proprietor;

iii. The Contractor is in the construction business or trades with no employees;

iv. The Contractor is in the coal mining industry with no employees;

v. The Contractor is a state or local government; or

vi. The Contractor self-insures its workers’ compensation and is in compliance with the TDCI rules and Tenn. Code Ann. § 50-6-405.

c. Professional Liability Insurance

1) Professional liability insurance shall be written on an occurrence basis or on a claims-made basis. If this coverage is written on a claims-made basis, then:

i. The retroactive date must be shown, and must be on or before the earlier of the Effective Date of the Contract or the beginning of Contract work or provision of goods and services;

ii. Insurance must be maintained and evidence of insurance must be provided for at least five (5) full years from the date of the final Contract payment;

and

iii. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date on or prior to the Contract Effective Date, the Contractor must purchase “extended reporting” or “tail coverage” for a minimum of five (5) full years from the date of the final Contract payment.

2) Any professional liability insurance policy shall have a limit not less than one million dollars ($1,000,000) per claim and two million dollars ($2,000,000) in the aggregate; and

3) If the Contract involves the provision of services by medical professionals, a policy limit not less than three million ($3,000,000) per claim and three million dollars ($3,000,000) in the aggregate for medical malpractice insurance.

Cyber Liability Insurance:

d. Cyber Liability Insurance

1) The Contractor shall maintain technology professional liability

(errors & omissions)/cyber liability insurance appropriate to the Contractor’s profession in an amount not less than ten million dollars ($10,000,000) per occurrence or claim and ten million dollars ($10,000,000) annual aggregate, covering all acts, claims, errors, omissions, negligence, infringement of intellectual property (including copyright, patent and trade secret); network security and privacy risks, including but not limited to unauthorized access, failure of security, information theft, damage to destruction of or alteration of electronic information, breach of privacy perils, wrongful disclosure and release of private information, collection, or other negligence in the handling of confidential information, and including coverage for related regulatory fines, defenses, and penalties.

2) Such coverage shall include data breach response expenses, in an amount not less than ten million dollars ($10,000,000) and payable whether incurred by the State or Contractor, including but not limited to consumer notification, whether or not required by law, computer forensic investigations, public relations and crisis management firm fees, credit file or identity monitoring or remediation services and expenses in the performance of services for the State or on behalf of the State hereunder.

7. Delete Pro Forma Contract Section A.9.s in its entirety and insert the following in its

Within 45 days of the contract effective date, the Contractor shall provide the State with a copy of all Contractor and subcontractor online terms and conditions or online service agreements that are presented to Members when they access online accounts, services or programs being delivered pursuant to this agreement. The

Contractor and all subcontractors shall ensure that such terms and conditions and online service agreements do not conflict with the terms of this agreement, Tennessee law, or federal law. Any terms and conditions and online service agreements that conflict with the terms of this agreement shall be deemed void and of no effect. Prior to Go-Live, the Contractor and all subcontractors shall revise, edit, and/or add disclaimers to the terms and conditions and online service agreements as requested by the State. Thereafter, if the online terms and conditions or online service agreements are revised the Contractor agrees to provide the State with a copy of the proposed changes at least sixty (60) Business Days prior to the new effective date and will adopt State revisions prior to their posting/implementation.

8. Delete RFP #31786-00187 in its entirety, and replace with RFP #31786-00187, Release #2. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted.

9. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.