RFP-DAA-2016000062 Exhibit 1 - CDE personal services IT contract tempate 10-26-15.docx

Exhibit #1 Contract Management System # _______

PO DAA 2016-______

STATE OF COLORADO

Colorado Department of Education Contract with

TABLE OF CONTENTS

PARTIES

This contract, is entered into by and between the State of Colorado, for the use and benefit of the Colorado Department of Education, 201 East Colfax, Denver, Colorado 80203, hereinafter referred to as CDE, and ____________, __________ (address), hereinafter referred to as the Contractor. Contractor and the CDE hereby agree to the following terms and conditions.

EFFECTIVE DATE AND NOTICE OF NON-LIABILITY

This Contract shall not be effective or enforceable until it is approved and signed by the Colorado State Controller or designee (hereinafter called the Effective Date). The State shall not be liable to pay or reimburse Contractor for any performance hereunder including, but not limited to, costs or expenses incurred, or be bound by any provision hereof prior to the Effective Date.

RECITALS

Authority, Appropriation, and Approval Funds have been budgeted, appropriated and otherwise made available and a sufficient unencumbered balance thereof remains available for payment. Required approvals, clearance and coordination have been accomplished from and with appropriate agencies. The Contractor was selected in accordance with State law as a result of a sole source solicitation.

Consideration The Parties acknowledge that the mutual promises and covenants contained herein and other good and valuable consideration are sufficient and adequate to support this Contract.

Purpose The purpose of this contract is to ______________.

References All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits, or other attachments are references to sections, subsections, exhibits, or other attachments contained herein or incorporated as a part hereof, unless otherwise noted.

DEFINITIONS

The following terms as used herein shall be construed and interpreted as follows:

“Budget” means the budget for the Work described in this Contract and its Exhibits.

“Contract” means this Contract, its terms and conditions, attached exhibits, documents incorporated by reference under the terms of this Contract, and any future modifying agreements, exhibits, attachments or references incorporated herein pursuant to Colorado State law, Fiscal Rules, and State Controller Policies.

“Contract Funds” means funds available for payment by the State to Contractor pursuant to this Contract.

“Contract Term” means the Initial Term and the Renewal Term, if any, as provided in Section V.

“Covered Information” means Personally Identifiable Information (PII) and Student Data in any media or format that is created or provided by the State, a school district, a local education agency, a student, or the student’s parent or legal guardian to a Contractor in the course of the student’s, parent’s or legal guardian’s use of the Contractor’s web site, service or application for public school purposes; or is gathered by a Contractor from any source and contains student PII or Student Data.

“Criminal Justice Information (CJI) Data” means information collected by criminal justice agencies that is needed for the performance of their legally authorized, required function, which includes, but is not limited to, wanted person information; missing person information; unidentified person information; stolen property information; criminal history information; information compiled in the course of investigation of crimes that are known or believed on reasonable grounds to have occurred, including information on identifiable individuals; and information on identifiable individuals compiled in an effort to anticipate, prevent, or monitor possible criminal activity.

“Deliverable” means the outcome to be achieved or output to be provided, in the form of a tangible or intangible object that is produced as a result of Contractor’s Work that is intended to be delivered to the State by Contractor. Examples of Deliverables include, but are not limited to, report(s), document(s), server upgrade(s), software license(s), and may be composed of multiple smaller deliverables.

“Evaluation” means the process of examining Contractor’s Work and rating it based on criteria established in Section VI below.

“Exhibits” means the following documents attached hereto and incorporated by reference herein: Exhibit A, Attachment A.1 (Form of Deliverable Acceptance Form), Exhibit B (Form of Option Letter), Exhibit C (Form of Contractor Notification Statement), Exhibit D (Confidentiality of Taxpayer Information Certification), Exhibit E (HIPAA Business Associate Addendum), Attachment E.1 (HIPAA BAA Attachment). Comment by Bohm, Trish: Needs to be revised based on final exhibits

“Federal Tax Information (FTI) Data” means federal or state tax returns, return information, and such other tax-related information as may be protected by State and federal law.

“Fiscal Year” means the State’s fiscal year, which begins on July 1 of each calendar year and ends on June 30 of the following calendar year.

“Force Majeure” means failures or delays in performance by a Party due to causes beyond its reasonable control, including war, strikes, lockouts, fire, flood, storm, or other acts of God. Both Parties agree to use their best efforts to minimize the effects of such failures or delays.

“Goods” means tangible material acquired, produced, or delivered by Contractor either separately or in conjunction with the Services Contractor renders hereunder.

“Party” means the State or Contractor and “Parties” means both the State and Contractor.

“Health Insurance Portability and Accountability Act (HIPAA) Data” means any information, whether oral or recorded in any form or medium, that (i) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (ii) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (iii) identifies the individual or with respect to which there is reasonable basis to believe the information can be used to identify the individual. HIPAA Data includes, but is not necessarily limited to, protected health information as defined in 45 C.F.R. Section 160.103 and 45 C.F.R. Section 164.501.

“Incident” means an accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources of the State pursuant to C.R.S. Section 24-37.5-401 et seq. Incidents include, but are not limited to (i) successful attempts to gain unauthorized access to a State system or State Information regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State’s knowledge, instruction, or consent.

“Initial Term” means the Initial Term of this Contract as provided in Section V.A.

“Party” means the State or Contractor and “Parties” means both the State and Contractor.

“Payment Card Information (PCI) Data” means any data related to card holders’ names, credit card numbers, or other credit card information as may be protected by State and federal law.

“Personally Identifiable Information (PII) Data” means information about an individual collected by the State or any other governmental entity that could reasonably be used to identify such individual as defined in CRS § 24-72-501(2) and includes, but is not limited to, any combination of (i) first and last name, (ii) first name or first initial and last name, (iii) residence or other physical address, (iv) electronic mail address, (v) telephone number, (vi) birth date, (vii) credit card information, (viii) social security number, (ix) driver’s license number, (x) identification card number, or (xi) any other information that identifies an individual personally.

“Review” means examining Contractor’s Work to ensure that it is adequate, accurate, correct and in accordance with the criteria established in Section VI below.

“Services” means the required services to be performed by Contractor pursuant to this Contract.

“State Confidential Information” means all information, data, records, and documentary materials which are of a sensitive nature and belong to the State regardless of physical form or characteristics, including but not limited to any non-public State records, sensitive State data, protected State data, State personnel records, PII, FTI, PCI, and other information or data concerning individuals, which has been communicated, furnished, or disclosed by the State to Contractor. Notwithstanding the foregoing, State Confidential Information shall not include State Records.

“State Controller” means the Colorado State Controller or authorized designee of the Colorado State Controller.

“Student Data” means data that is collected and stored by CDE at the individual student level and is included in a student’s educational record and includes State-administered assessment results, including participation information, courses taken and completed, credits earned and other transcript information; course grades and grade point average; grade level and expected graduation year; degree, diploma credential attainment or other school exit information; attendance and mobility information between and within Colorado school districts; special education data and special education discipline reports limited to object information that is sufficient to produce the federal Title IV annual incident report; student gender, race, and ethnicity; and program participation information required by state or federal law.

“State Information” means the combination of State Confidential Information and State Records.

“State Records” means all information, data, records, and documentary materials which are not sensitive and belong to the State regardless of physical form or characteristics, including but not limited to any public State records, non-sensitive State data, and other information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished or disclosed by the State to Contractor which (i) is subject to disclosure pursuant to the Colorado Open Records Act, C.R.S. Sections 24-72-200.1, et seq.; (ii) is already known to Contractor without restrictions at the time of its disclosure by Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any State Confidential Information. Notwithstanding the foregoing, State Records shall not include State Confidential Information.

“Subcontractor” means any third party engaged by Contractor to aid in performance of Contractor’s obligations.

“Summary or De-identified Data” means data on public school students that has all identifiers enumerated in the definitions of PII and Student Data removed.

“Work” means the tasks and activities Contractor is required to perform to fulfill its obligations under this Contract, including the performance of the Services and delivery of the Goods.

“Work Product” means the tangible or intangible results of Contractor’s Work, including, but not limited to, software, research, reports, studies, data, photographs, negatives or other finished or unfinished documents, drawings, models, surveys, maps, materials, or work product of any type, including drafts.

TERM AND EARLY TERMINATION

A. Initial Term-Work Commencement The Parties’ respective performances under this Contract shall commence on the later of either the Effective Date or August 1, 2015. This Contract shall terminate on September 30, 2016, unless sooner terminated or further extended as specified elsewhere herein.

B. Two (2) Month Extension The State, at its sole discretion upon written notice to Contractor as provided in Section XVI, may unilaterally extend the term of this Contract for a period not to exceed two (2) months if the Parties are negotiating a replacement Contract (and not merely seeking a term extension) at or near the end of any initial term or renewal term. The provisions of this Contract in effect when such notice is given, including, but not limited to prices, rates, and delivery requirements, shall remain in effect during the two (2) month extension. The two (2) month extension shall immediately terminate when and if a replacement Contract is approved and signed by the State Controller.

C. State’s Option to Extend The State may require continued performance for a period of four (4) Renewal Terms of one (1) year each beyond the Initial Term at the same rates and same terms specified in the Contract or as determined based on the number of participating libraries. The total duration of this Contract, including the exercise of any options under this clause, shall not exceed five years.

STATEMENT OF WORK

D. Contractor shall

INSERT SOW

E. Contractor shall not store any PII Data on Contractor’s servers and shall only store user credentials (library card and pin) as a cookie on the mobile device.

F. Completion Contractor shall complete the Work and its other obligations as described in this Contract and its Exhibits on or before the termination date of the Contract set forth in Section V.A. The State shall not be liable to compensate Contractor for any Work performed prior to the Effective Date or after the termination of this Contract.

G. Goods and Services Contractor shall procure Goods and Services necessary to complete the Work. Such procurement shall be accomplished using the Contract Funds available and shall not increase the maximum amount payable hereunder by the State.

Employees All persons employed by Contractor or Subcontractors to perform Work under this Contract shall be Contractor’s or Subcontractors’ employee(s) for all purposes hereunder and shall not be employees of the State for any purpose as a result of this Contract.

PAYMENTS TO CONTRACTOR

The State shall, in accordance with the provisions of this section, pay Contractor in the amounts and using the methods set forth below:

INSERT PAYMENT TERMS

H. Maximum Amount The maximum amount payable under this Contract to Contractor by the State is $_________ as determined by the State from available funds. Payments to Contractor are limited to the unpaid obligated balance of the Contract.

I. Payment Advance, Interim and Final Payments Any advance payment allowed under this Contract shall comply with State Fiscal Rules and be made in accordance with the provisions of this Contract or such Exhibit. Contractor shall initiate any payment requests by submitting invoices to the State in the form and manner set forth in approved by the State.

Interest The State shall fully pay each invoice within forty-five (45) days of receipt thereof if the amount invoiced represents performance by Contractor previously accepted by the State. Uncontested amounts not paid by the State within forty-five (45) days shall bear interest on the unpaid balance beginning on the forty-sixth (46th) day at a rate not to exceed one percent (1%) per month until paid in full; provided, however, that interest shall not accrue on unpaid amounts that are subject to a good faith dispute. Contractor shall invoice the State separately for accrued interest on delinquent amounts. The billing shall reference the delinquent payment, the number of day’s interest to be paid and the interest rate.

Available Funds-Contingency-Termination The State is prohibited by law from making commitments beyond the term of the State’s current fiscal year. Therefore, Contractor’s compensation beyond the State’s current Fiscal Year is contingent upon the continuing availability of State appropriations as provided in the Colorado Special Provisions. If federal funds are used to fund this Contract, in whole or in part, the State’s performance hereunder is contingent upon the continuing availability of such funds. Payments pursuant to this Contract shall be made only from available funds encumbered for this Contract and the State’s liability for such payments shall be limited to the amount remaining of such encumbered funds. If State or federal funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may terminate this Contract immediately, in whole or in part, without further liability in accordance with the provisions hereof.

Erroneous Payments At the State’s sole discretion, payments made to Contractor in error for any reason, including, but not limited to overpayments or improper payments, and unexpended or excess funds received by Contractor, may be recovered from Contractor by deduction from subsequent payments under this Contract or other contracts, grants or agreements between the State and Contractor or by other appropriate methods and collected as a debt due to the State. Such funds shall not be paid to any party other than the State.

J. Use of Funds Contract Funds shall be used only for eligible costs identified herein and/or in the Budget.

REPORTING – NOTIFICATION

Reports, Evaluations, and Reviews required under this Section VIII. shall be in accordance with the procedures of and in such form as prescribed by the State.

K. Performance, Progress, Personnel, and Funds State shall submit a report to the Contractor upon expiration or sooner termination of this Contract, containing an Evaluation and Review of Contractor’s performance and the final status of Contractor's obligations hereunder.

L. Litigation Reporting Within ten (10) days after being served with any pleading in a legal action filed with a court or administrative agency, related to this Contract or which may affect Contractor’s ability to perform its obligations hereunder, Contractor shall notify the State of such action and deliver copies of such pleadings to the State’s principal representative as identified herein. If the State’s principal representative is not then serving, such notice and copies shall be delivered to the Deputy Commissioner of CDE.

M. Performance Outside the State of Colorado and/or the United States [Not applicable if Contract Funds include any federal funds] Following the Effective Date, Contractor shall provide written notice to the State, in accordance with Section XVI (Notices and Representatives), within twenty (20) days of the earlier to occur of Grantee’s decision to perform, or its execution of an agreement with a Subcontractor to perform, Services outside the State of Colorado and/or the United States. Such notice shall specify the type of Services to be performed outside the State of Colorado and/or the United States and the reason why it is necessary or advantageous to perform such Services at such location or locations. All notices received by the State pursuant to this Section VIII.C shall be posted on the Colorado Department of Personnel & Administration’s website. Knowing failure by Contractor to provide notice to the State under this Section VIII.C shall constitute a material breach of this Contract.

N. Noncompliance Contractor’s failure to provide reports and notify the State in a timely manner in accordance with this Section may result in the delay of payment of funds and/or termination as provided under this Contract

O. Subcontracts Contractor, with the consent of the State, may enter into one or more written subcontracts for the performance of Contractor’s obligations under this Contract. Each subcontract shall comply with all applicable federal and state laws and provide that such subcontract shall be governed by the laws of the State of Colorado. Contractor shall notify the State immediately, in writing by certified mail, of any action or suit filed and prompt notice of any claim made against Contractor by any Subcontractor or vendor which in the reasonable opinion of Contractor may result in litigation related in any way to the Contract with the State. Contractor shall notify the State in writing, in accordance with Section XVI below, within ten days of discovering that a Subcontractor has been served with any pleading in a legal action filed with a court or administrative agency which may affect such Subcontractor’s ability to perform its obligations under a subcontract.

CONTRACTOR RECORDS

P. Maintenance Contractor shall make, keep, maintain, and allow inspection and monitoring by the State of a complete file of all records, documents, communications, notes and other written materials, electronic media files, and communications, pertaining in any manner to the Work or the delivery of Services or Goods hereunder. Contractor shall maintain such records until the last to occur of: (i) a period of three (3) years after the date this Contract expires or is sooner terminated, or (ii) final payment is made hereunder, or (iii) the resolution of any pending Contract matters, or (iv) if an audit is occurring, or Contractor has received notice that an audit is pending, until such audit has been completed and its findings have been resolved (collectively, the Record Retention Period).

Q. Inspection Contractor shall permit the State, the federal government and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy and/or transcribe Contractor's records related to this Contract during the Record Retention Period for a period of three (3) years following termination of this Contract or final payment hereunder, whichever is later, to assure compliance with the terms hereof or to evaluate performance hereunder. The State reserves the right to inspect the Work at all reasonable times and places during the term of this Contract, including any extensions or renewals. If the Work fails to conform with the requirements of this Contract, the State may require Contractor promptly to bring the Work into conformity with Contract requirements, at Contractor’s sole expense. If the Work cannot be brought into conformance by re-performance or other corrective measures, the State may require Contractor to take necessary action to ensure that future performance conforms to Contract requirements and exercise the remedies available under this Contract, at law or in equity, in lieu of or in conjunction with such corrective measures.

R. Monitoring Contractor shall permit the State, the federal government, and governmental agencies having jurisdiction, in their sole discretion, to monitor all activities conducted by Contractor pursuant to the terms of this Contract using any reasonable procedure, including, but not limited to: internal evaluation procedures, examination of program data, special analyses, on-site checking, formal audit examinations, or any other procedures. All monitoring controlled by the State shall be performed in a manner that shall not unduly interfere with Contractor’s performance hereunder.

S. Final Audit Report If an audit is performed on Contractor’s records for any fiscal year covering a portion of the term of this Contract, Contractor shall submit a copy of the final audit report to the State or its principal representative at the address specified herein. Contractor shall ensure the provisions of this paragraph apply to any subcontract related to performance under the Contract. Contractor shall, at Contractor’s sole expense, reconstruct any records not preserved or retained as required by this paragraph.

CONFIDENTIAL INFORMATION-STATE RECORDS

Contractor shall comply with and shall cause each of its Subcontractors and any other party performing Work under this Contract to comply with the provisions of this Section if it becomes privy to State Information in connection with its performance.

T. Confidentiality Contractor shall comply with all laws and regulations concerning confidentiality of State Confidential Information. Any request or demand by a third party for State Information in the possession of Contractor shall be immediately forwarded to the State’s principal representative.

U. Notification Contractor shall provide its agents, employees, Subcontractors, and assigns who may come into contact with State Information with a written explanation of the confidentiality requirements herein, to which they are subject, before permitting them to access such State Information.

V. Use, Security, and Retention State Information of any kind shall be stored, processed, or transferred only in or to facilities located within the United States, and shall not be distributed or sold to any third party, retained in any files or otherwise, or used by Contractor or its agents in any way, except as authorized by this Contract, by law, or approved in writing by the State. Contractor shall provide and maintain a secure environment that ensures confidentiality of all State Confidential Information wherever located. Neither Contractor nor its Subcontractors shall have any rights to use or access any CDE or other State agency data or information, except with the prior approval of the State.

W. Protection Contractor is responsible for the protection and security of all State Information provided to it by the State. If Contractor provides physical or logical storage, processing or transmission of, or retains, stores, or is given, State Information, Contractor shall, and shall cause its Subcontractors to, (i) provide physical and logical protection for all related hardware, software, applications, and data that meet or exceed industry standards and requirements as set forth in this Contract; (ii) maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), and annual security testing; (iii) comply with State and federal regulations and guidelines related to overall security, confidentiality, integrity, availability, and auditing; (iv) ensure that security is not compromised by unauthorized access to computers, program, software, databases, or other electronic environments; and (v) shall promptly report all Incidents to a representative of CDE. Contractor shall provide the State with access, subject to Contractor’s reasonable access security requirements, seven (7) days a week, twenty-four (24) hours a day, for the purpose of inspecting and monitoring access and use of State Information, maintaining State systems, and evaluating physical and logical security control effectiveness.

X. Compliance Contractor shall review, on a semi-annual basis, all OIS policies and procedures which OIS has promulgated pursuant to C.R.S. Sections 24-37.5-401 through 406 and 8 C.C.R. Section 1501-5 and posted at http://oit.state.co.us/ois, to ensure compliance with the standards and guidelines published therein. Contractor shall cooperate, and shall cause its Subcontractors to cooperate, with the performance of security audit and penetration tests by OIS or its designee.

Background Checks Contractor shall perform, and shall cause its Subcontractors to perform, in a form reasonably acceptable to the State, current background checks on all of its respective employees and agents performing services or having access to State Information provided under this Contract. A background check performed within thirty (30) days prior to the date such employee or agent begins performance or obtains access to State Information shall be deemed to be current.

Delivery and Support The State, in its sole discretion, may securely deliver State Information directly to the facility where such data is used to perform the Work. State Information is not to be maintained or forwarded to or from any other facility or location except for the authorized and approved purposes of backup and disaster recovery purposes.

Incident Notice If Contractor becomes aware of an Incident involving any State Information, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, if any. Unless Contractor can establish that Contractor or any of its Subcontractors is not the cause or source of the Incident, Contractor shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident.

Incident Remediation Contractor shall be responsible for determining the cause of an Incident, and for producing a remediation plan to reduce the risk of incurring a similar type of breach in the future. Contractor shall present its analysis and remediation plan to the State within ten (10) days of notifying the State of an Incident. The State reserves the right to adjust this plan, in its sole discretion. If Contractor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Contractor shall reimburse the State for the reasonable costs thereof.

Incident Liability Disclosure of State Information by Contractor or any Subcontractor for any reason may be cause for legal action by third parties against Contractor, the State, or their respective agents. Contractor shall indemnify, save, and hold harmless the State, its employees, and agents against any and all claims, damages, liability, and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees pursuant to this Section X. Notwithstanding any other provision of this Contract, Contractor shall be liable to the State for all consequential and incident damages arising from an Incident caused by Contractor or its Subcontractors.

End-of-Agreement Data Handling Upon request by the State made before or within sixty (60) days after the effective date of termination of the Contract, Contractor will make available to the State a complete and secure (i.e. encrypted and appropriately authenticated) download file of all data, including, but not limited to, all State Information, schema and transformation definitions, or delimited text files with documented, detailed schema definitions along with attachments in its native format. The Parties agree that on the termination of the provision of data processing services, Contractor shall, at the choice of the State, return all State Information provided by the State to Contractor, and the copies thereof, to the State, or Contractor shall destroy all such State Information and certify to the State that it has done so. If legislation imposed upon Contractor prevents it from returning or destroying all or part of the State Information provided by the State to Contractor, Contractor warrants that it will guarantee the confidentiality of all State Information provided by the State to Contractor and will not actively process such data anymore.

Disposition of Data The State retains the right to use the established operational services to access and retrieve State Information stored on Contractor’s infrastructure at its sole discretion. Contractor and Subcontractor warrant that upon request of the State or of the supervisory authority, Contractor will submit its data processing facilities for an audit of the measures referred to in Section X.D. The State reserves all right, title, and interest, including all intellectual property and proprietary rights, in and to system data, State Information, and all related data and content.

Safeguarding PII Data If Contractor or any of its Subcontractors will or may receive PII Data under this Contract, Contractor shall provide for the security of such PII Data, in a form acceptable to the State, including, without limitation, non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Contractor shall take full responsibility for the security of all PII Data in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure or loss thereof.

Safeguarding FTI Data If Contractor or any of its Subcontractors will or may receive FTI Data under this Contract, Contractor shall provide for the security of the FTI Data, in a form acceptable to the State and in accordance with State and federal law and the Confidentiality of Taxpayer Information Certification which is attached hereto and incorporated herein by this reference as Exhibit D. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Contractor’s or its Subcontractor’s obligations under this Contract, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications, and inspections. Contractor shall comply with the requirements of IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, revised and effective January 1, 2014, found at: http://www.irs.gov/pub/irs-pdf/p1075.pdf and incorporated herein by this reference.

Safeguarding PCI Data If Contractor or any of its Subcontractors will or may receive PCI Data under this Contract, Contractor shall provide for the security of the PCI Data, in accordance with PCI Data Security Standard (DSS) 1.1. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Contractor’s or Subcontractor’s obligations under this Contract, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications, and inspections.

Safeguarding CJI Data If Contractor or any of its Subcontractors will or may receive CJI Data under this Contract, Contractor shall provide for the security of CJI Data in accordance with the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services (CJIS) Security Policy, Version 5.3, dated 8/4/2014, found online at: http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center and incorporated herein by this reference.

Safeguarding HIPAA Data If Contractor or any of its Subcontractors will or may receive HIPAA Data under this Contract, Contractor shall provide for the security of the HIPAA Data in accordance with the provisions of the State HIPAA Business Associate Addendum.

Data Security Assurances Strong access control must be in place. All data must be at a minimum protected with a complex password, workstations and other data processing devices must automatically lock when not in use, and must be manually locked when left unattended. Passwords must be confidential and sharing of passwords is prohibited, must not be written down or stored in an insecure location, and periodically changed and not reused or a reasonable time period.

Unused and terminated user accounts must be disabled and/or deleted immediately; account inactivity must be periodically assessed for potential stale accounts.

Care must be exercised in inadvertently sharing data on display screens, during demonstrations or presentations, or when sharing screen shots for troubleshooting or other purposes.

Systems must be in place for logging and monitoring access and use of data.

At a minimum, annual intrusion penetration/vulnerability testing will be implemented.

Laptop/mobile device password locks and full disk/storage encryption are required.

Data at rest on central computing systems must be encrypted; any backup, backup media, removable media, tape or other copies must also be encrypted, and not used to transport data.

Mandatory annual Security awareness training on how to handle PII is required.

Appropriate endpoint security anti-virus and anti-malware software must be installed and maintained on computers accessing or processing PII.

Transmitting data must occur via a secure method such as Secure File Transfer Protocol (SFTP) or comparable and never sent via email or transported on removable media.

Physical security in buildings housing PII, along with controlled physical access to buildings and/or data centers.

Ability to suppress small N-sizes for aggregated student data reports is required.

After prescribed use is concluded, data disposal policies must apply for cleaning up all data. This includes secure scrubbing and securely overwriting data from storage, or physically destroying the storage media.

Devices used to copy or scan hard copies of data must have encrypted storage and have storage devices appropriately scrubbed when equipment is retired. Hard copy containing PPI is discouraged and must be physically secured, not left unattended, and physically destroyed.

All data processing systems, servers, laptops, PCs, and mobile devices must be regularly scanned and have all security patches applied in a timely manner.

Data stored in cloud based systems must be protected in the same manner as local data, as described throughout this document. Use of free cloud based services is prohibited, and secondary encryption must be used as appropriate to protect data in cloud storage.

Cloud environments, when employed, must be fully documented and open to CDE inspection and verification.

Access to cloud based computing environments is only permitted via restricted access, by VPN or least privileged access lists, and never accessible directly via the Internet.

Transparency Requirements A Contractor that operates an internet website, an on-line service, including cloud computing services, an on-line application or a mobile application that uses, creates or acquires Covered Information shall not knowingly engage in any of the following activities with respect to its web site, service or application:

24. Engage in targeted advertising of students on the Contractor's web site, service or application, or target advertising on any other web site, service or application when the targeting of the advertising is based upon any information, including Covered Information and persistent unique identifiers, that the Contractor has acquired because of the student's or parent's use of that Contractor's web site, service or application.

Use Covered Information, including persistent unique identifiers, created or gathered by the Contractor's web site, service or application, to amass a profile about a public school student, except in furtherance of a public school purpose as determined by the State.

Sell Covered Information, including PII to any third party.

Disclose Covered Information to any party unless the disclosure is:

Reasonably necessary in furtherance of a public school purpose of the web site, service or application and the recipient of the Covered Information contractually agrees to comply with the requirements herein and to not further disclose the Covered Information, Required by state or federal law, Necessary to respond to or participate in a judicial or administrative proceeding, To protect the safety of users or security of the Contractor's website, service or application, or

To the extent required by law, to provide Covered Information to law enforcement agencies or for an investigation of a matter of public safety.

Contractor may not gather or use Covered Information from any source unless it has demonstrated a specific legitimate educational purpose for doing so and the use has been expressly authorized by the Department in the Contract.

Contractor must agree to delete Student Data at the request of a School District or Local Educational Agency.

Contractor acknowledges that the State will post this Contract to the Department's website and post a privacy score based on the Department's determination of the Contractor's privacy and security protections for Covered Information, with such criteria to include whether Contractor has signed the Student Privacy Pledge, whether Contractor has agreed to all of the Privacy and Security protections in the Department's Policy for Privacy and Security in Third Party Contracts, and the number of complaints received by the Department concerning Contractor's collection or use of Covered Information.

Contractor agrees to provide transparency to parents, school districts and the public about its collection and use of Covered Information including:

Post on Contractor's website contact information for the Contractor or Subcontractor that collects or generates Covered Information, Post on the Contractor's website the types of Covered Information that is collected or generated by the Contractor, its Subcontractors or disclosed to a third party and how the Contractor shares and uses the Covered Information, Post on the Contractor's website the educational purpose(s) for which the Covered Information is used, Post on the Contractor's website its policies and procedures regarding retention and disposal of Covered Information, Upon request, provide a school district or local education agency with information about the specific data elements that are collected or generated by the Contractor, the Contractor's security policies and any other data that is merged with Covered Information that it collects or generates, Provide notice on its website to the public before making changes to its privacy policies, Facilitate student's and parents' access to and correction of Covered Information, Respond to the Department when an interested party reports an alleged violation of privacy or security laws or the provisions of this Contract, and

Post on the Contractor's website whether or not the Contractor has signed the Student Privacy Pledge posted at studentprivacypledge.org.

CONFLICTS OF INTEREST

Contractor acknowledges that with respect to this Contract, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Contractor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Contractor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Contractor is uncertain as to such, Contractor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction in regard to the actual or apparent conflict constitutes a breach of this Contract.

REPRESENTATIONS AND WARRANTIES

Contractor makes the following specific representations and warranties, each of which was relied on by the State in entering into this Contract.

Y. Standard and Manner of Performance Contractor shall perform its obligations hereunder in accordance with the highest standards of care, skill and diligence in Contractor’s industry, trade, or profession and in the sequence and manner set forth in this Contract.

Z. Legal Authority – Contractor Signatory Contractor warrants that it possesses the legal authority to enter into this Contract and that it has taken all actions required by its procedures, and by-laws, and/or applicable laws to exercise that authority, and to lawfully authorize its undersigned signatory to execute this Contract, or any part thereof, and to bind Contractor to its terms. If requested by the State, Contractor shall provide the State with proof of Contractor’s authority to enter into this Contract within fifteen (15) days of receiving such request.

AA. Licenses, Permits, Etc.

Contractor represents and warrants that as of the Effective Date it has, and that at all times during the term hereof it shall have and maintain, at its sole expense, all licenses, certifications, approvals, insurance, permits, and other authorizations required by law to perform its obligations hereunder. Contractor warrants that it shall maintain all necessary licenses, certifications, approvals, insurance, permits, and other authorizations required to properly perform this Contract, without reimbursement by the State or other adjustment in Contract Funds. Additionally, all employees, agents, and Subcontractors of Contractor performing Services under this Contract shall hold all required licenses or certifications, if any, to perform their responsibilities. Contractor, if a foreign corporation or other foreign entity transacting business in the State of Colorado, further warrants that it currently has obtained and shall maintain any applicable certificate of authority to transact business in the State of Colorado and has designated a registered agent in Colorado to accept service of process. Any revocation, withdrawal or non-renewal of licenses, certifications, approvals, insurance, permits or any such similar requirements necessary for Contractor to properly perform the terms of this Contract is a material breach by Contractor and constitutes grounds for termination of this Contract.

INSURANCE

Contractor and its Subcontractors shall obtain and maintain insurance as specified in this section at all times during the term of this Contract. All policies evidencing the insurance coverage required hereunder shall be issued by insurance companies satisfactory to Contractor and the State.

AB. Contractor Public Entities If Contractor is a "public entity" within the meaning of the Colorado Governmental Immunity Act, C.R.S. Section 24-10-101, et seq., as amended (the “GIA”), then Contractor shall maintain at all times during the term of this Contract such liability insurance, by commercial policy or self-insurance, as is necessary to meet its liabilities under the GIA. Contractor shall show proof of such insurance satisfactory to the State, if requested by the State. Contractor shall require each contract with a Subcontractor that is a public entity, to include the insurance requirements necessary to meet such Subcontractor’s liabilities under the GIA.

Non-Public Entities If Contractor is not a "public entity" within the meaning of the GIA, Contractor shall obtain and maintain during the term of this Contract insurance coverage and policies meeting the same requirements set forth in Section XIII.B with respect to subcontractors that are not "public entities".

1. Contractors – Subcontractors Contractor shall require each contract with subcontractors other than those that are public entities, providing Goods or Services in connection with this Contract, to include insurance requirements substantially similar to the following:

28. Worker’s Compensation Worker’s Compensation Insurance as required by State statute, and Employer’s Liability Insurance covering all of Contractor or subcontractor employees acting within the course and scope of their employment.

General Liability Commercial General Liability Insurance written on ISO occurrence form CG 00 01 10/93 or equivalent, covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: (a) $1,000,000 each occurrence; (b) $1,000,000 general aggregate; (c) $1,000,000 products and completed operations aggregate; and (d) $50,000 any one fire.

If any aggregate limit is reduced below $1,000,000 because of claims made or paid, subcontractor shall immediately obtain additional insurance to restore the full aggregate limit and furnish to Contractor a certificate or other document satisfactory to Contractor showing compliance with this provision.

Automobile Liability Automobile Liability Insurance covering any auto (including owned, hired and non-owned autos) with a minimum limit of $1,000,000 each accident combined single limit.

Professional Liability Contractor agrees to maintain in full force and effect a Professional Liability Insurance Policy in the minimum amount of $1,000,000 per occurrence and $1,000,000 in the aggregate, written on an occurrence form that provides coverage for its work undertaken pursuant to this Contract. If a policy written on an occurrence form is not commercially available, the claims-made policy shall remain in effect for the duration of this State Contract and for at least two (2) years beyond the completion and acceptance of the Work under this Contract, or, alternatively, a two (2) year extended reporting period must be purchased.

Cyber Privacy Liability Contractor agrees to maintain Cyber Privacy Insurance for claims and losses with respect to network, internet (cloud) or other data disclosure risks (such as data breaches, releases of confidential information, unauthorized access/use of information, and identity theft) with minimum limits of not less than $1,000,000 per occurrence and $2,000,000 aggregate.

Additional…