RFP S-40400-00011842 ATTACHMENT H - FCMS DRAFT MODEL CONTRACT.pdf

STATE OF OREGON

INFORMATION TECHNOLOGY SERVICES AGREEMENT

This Information Technology Services Agreement (this “Contract”) is entered into by and between the State of Oregon acting by and through the Oregon Public Defense Commission (“Agency” or “OPDS”), and_____, an __________ corporation (“Contractor”) and is effective as of the Effective Date (defined below).

RECITALS

A. Agency desires to engage a Contractor to provide services to implement, maintain, and host a technology solution to replace the OPDC’s legacy case management, time management, and billing management systems (the “Services” as defined below) to enable Agency to achieve specific business and Agency mission objectives defined in this Contract, including implementation and testing of the System (as defined below). To that end, Agency issued RFP #

B. Contractor is the successful proposer to the RFP and Agency desires Contractor to perform the Services.

C. Contractor desires to perform the Services for Agency.

AGREEMENT

In consideration of the foregoing recitals and the mutual terms and conditions set forth below, Agency and Contractor agree as follows:

1. DEFINITIONS.

“Acceptance” or “Accepted” means written confirmation by Agency that Contractor has completed a Deliverable according to the Acceptance Criteria. The term is distinct from “Final Acceptance.”

“Acceptance Criteria” means the criteria for accepting Deliverables required by this Contract, including but not limited to all specifications and requirements in the Statement of Work and Exhibit K, and compliance with the Performance Warranties set forth in Section 17.2.

“Agency Data” means all data and information that resides in the System, whether it is submitted to, directly or indirectly, or accessed by Contractor or Contractor Agents pursuant to Contractor’s performance hereunder. Agency Data includes without limitation Personal Information, including Personal Information contained in the System, data concerning Users, and information provided to Contractor by Agency related to the Services or to Agency or State information systems and operations.

“Agency Intellectual Property” means any intellectual property that is owned by Agency.

Agency Intellectual Property includes any derivative works and compilations of any Agency Intellectual Property.

“Agency Project Manager” means the person representing Agency who serves as Contractor’s primary point of contact for the Project.

“Application Services” means the Services Contractor provides by hosting and making the System available to Agency and Users, by providing the administrative support to the case management, time management, and billing management functionality required by the Contract, and by providing all maintenance and support for the System as required by this Contract. The Application Services are described in more detail in the Statement of Work.

“Authorized Representative” means a person representing a Party to this Contract who is authorized to make commitments and decisions on behalf of the Party regarding the performance of this Contract. Contractor’s Authorized Representative is the person so identified in Exhibit F. Agency’s Authorized Representative is the person so identified in Exhibit G.

“Business Days” means Monday through Friday, 8:00 a.m. to 5:00 p.m., Pacific Time, excluding State of Oregon holidays and business closure days.

“Calendar Days” mean contiguous days.

“Change Order” is defined in Section 13.3.

“Charges” means the amounts payable by Agency to Contractor pursuant to this Contract.

“Confidential Information” is defined in Section 15.1.

“Contract” means all terms and conditions herein, including documents incorporated by reference, and all Exhibits attached hereto.

“Contractor Agents” means the agents, subcontractors and representatives of Contractor and includes affiliates of Contractor. For purposes of the foregoing, Contractor’s affiliates are those entities that, directly or indirectly, control, are controlled by or are under common control with Contractor, where “control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities (or other ownership interest), by contract or otherwise.

“Contractor Intellectual Property” means any intellectual property that is owned by Contractor and contained in or necessary for the use of the Deliverables or Services. Contractor Intellectual Property includes Software owned by Contractor, Documentation, and derivative works and compilations of any Contractor Intellectual Property but does not include Contractor Licensed Technology.

“Contractor Licensed Technology” means the Software that Contractor generally licenses to third parties in the normal course of Contractor’s business that is the primary item of Software comprising the System. Contractor Licensed Technology is identified and described further on Exhibit H. Contractor Licensed Technology is not Contractor Intellectual Property.

“Contractor Staff” means the personnel of Contractor and Contractor Agents who provide the Services under this Contract.

“DAS” means the State of Oregon acting through its Department of Administrative Services.

“Data Error” means errors in System data caused by failures in data conversion or data migration, or failures caused by System processing. Data entry errors are not Data Errors.

“Defect” means a reproducible failure of the System to operate in accordance with the Service Levels, Acceptance Criteria, or System Requirements. Defect includes any missed, missing, or misinterpreted System Requirement, including those identified prior to Final Acceptance.

Defects fall into one of the following categories:

• Critical (Level1): The Defect affects critical System functionality or critical data. It does not have a workaround. Example: Unsuccessful installation, complete failure of a feature.

• High (Level 2): The Defect affects major System functionality or major data. It has a workaround but is not obvious and is difficult. Example: A feature is not functional from one module, but the task is doable if 10 complicated indirect steps are followed in another module/s.

• Medium (Level 3): The Defect affects minor System functionality or non-critical data. It has an easy workaround. Example: A minor feature that is not functional in one module, but the same task is easily doable from another module.

• Low (Level 4): The Defect does not affect System functionality or data. It does not even need a workaround. It does not impact productivity or efficiency. It is merely an inconvenience. Example: Petty layout discrepancies, spelling/grammatical errors.

“Deliverables” means all items that Contractor is required to provide to Agency under this Contract, including Work Product.

“Delivery Schedule” means the section of the Statement of Work that sets forth the completion date of each Task and Milestone and the delivery date for each Deliverable.

“Documentation” means all documents, including documents that are Deliverables described in the Statement of Work, whether in written or electronic form, and which may include any and all operator’s and user’s manuals, training materials, guides, commentary, listings, requirements traceability matrices and other materials for use in conjunction with and for the operation of the System and its components and receipt of the Services that are to be delivered by Contractor under this Contract.

“Effective Date” means the date specified in Section 2 or the date on which this Contract is fully executed and approved according to applicable Laws, rules and regulations, whichever is later.

“Final Acceptance” is defined in Section 4.5.

“Governmental Approvals” means (i) all licenses, consents, permits, approvals and authorizations of any Governmental Authority, the granting of which is required by Law, including Regulatory Requirements, for a Party to consummate the transactions or provide or receive the Services contemplated by this Contract, or (ii) any notice required to be given to a Governmental Authority prior to a Party consummating the transactions or providing or receiving the Services contemplated by this Contract.

“Governmental Authority” means any federal, state, municipal, local, territorial, or other governmental department, agency, regulatory authority, judicial, legislative, or administrative body.

“Hardware” means the System hardware identified pursuant to Exhibit A, and all related Documentation, that Contractor will deliver to Agency pursuant to this Contract.

“Implementation Services” means the process of Contractor preparing and deploying the System or Application Services to the stated environment. Implementation Services include all Services required to provide and complete the System, and to prepare the Application Services for Agency’s use in a production capacity.

“Intellectual Property Rights” is defined in Section 18.2.

“Key Persons” means Contractor’s Authorized Representative, the Project Manager, and all other Contractor personnel designated as Key Persons in Exhibit F.

“Law” means any declaration, decree, directive, legislative enactment, statute, order, ordinance, regulation, rule or other binding restriction of or by any Governmental Authority.

“Maximum Not-To-Exceed Compensation” is defined in Section 12.1.

“Milestone” means the completion date for a specific group of Tasks or Deliverables identified as a Milestone in the Statement of Work.

“Parties” means Agency and Contractor.

“Party” means either Agency or Contractor.

“Personal Information” is defined in Section 8.3.

“Post Implementation Warranty Period” is defined in Section 4.6.1.

“Project Manager” means Contractor’s representative who manages the processes and coordinates the Services with Agency’s Authorized Representative to ensure delivery of the Deliverables and completion of Milestones. Contractor’s Project Manager is the person so identified in Exhibit F.

“Proposal” means Contractor’s proposal in response to the RFP.

“Retention Amount” is defined in Section 12.3.

“RFP” means the Request for Proposal #______________.

“Schedule of Deliverables” means that section of the SOW that describes each Task and Deliverable, and measurable attributes of each Task and Deliverable with identification of the Services that are associated with them. The Schedule of Deliverables may include the current, Accepted Project Schedule if the Project Schedule is made a part of the Contract through the change control process described in Section 13.2.

“Security Standards” means the technical standards and other requirements of the policies, Laws and guidance set forth in or referred to in Section 8.2.

“Services” means all effort to be expended by Contractor under the Contract, including but not limited to installation, configuration, implementation, ongoing access to the System, maintenance support, warranty services, and support. “Services” includes both Implementation Services and Application Services.

“Service Level Credits” means the payment credits set forth in this Contract for failure to meet or exceed Service Levels.

“Service Levels” means the standards of service set forth in Exhibit B that Contractor must attain in providing the Services.

“Service Locations” means the locations from which Contractor will provide the Services.

Service Locations includes the sites or facilities at which the System or its components are hosted, whether or not controlled by Contractor.

“Software” means an all-inclusive term which refers to any computer programs, routines, or subroutines supplied by the Contractor, including operating software, programming aids, application programs, and software products.

“State” means the State of Oregon.

“Statement of Work” or “SOW” means the documents that describe the Services that Contractor will provide under this Contract, including a Schedule of Deliverables, a Delivery Schedule, and any other items as agreed by the Parties and set forth in Exhibit A. The SOW includes Accepted Deliverables, including the Project Schedule, if specifically made a party thereof pursuant to the terms of this Contract.

“System” means the sum total of the Implementation Services, the Deliverables, the Contractor Licensed Technology, the Contractor Intellectual Property, the Third Party Intellectual Property the Software, the Hardware and the Documentation described in the Statement of Work that comprise the information system that Contractor will deliver, develop, install configure and implement, and maintain under this Contract.

“System Change Warranty Period” is defined in Section 4.6.2.

“System Requirements” means the functional and technical requirements and specifications and Accepted design documents for the System, including those that are set forth in Exhibit K.

“Task” means an activity that Contractor is required to perform under this Contract.

“User” means any person who accesses or uses the System or Application Services including, without limitation, (1) an employee, subcontractor or agent of the State who uses the System in the course of employment with the State or the provision of services to or related to the activities of the case management, time management, and billing management functionality , or (2) an individual or entity not employed by OPDS or DAS who uses the Application Services.

“Third Party Intellectual Property” means any intellectual property owned by parties other than Agency or Contractor. Third Party Intellectual Property includes Software owned by Third Parties, and derivative works and compilations of any Third Party Intellectual Property.

“Warranty Period” means one of the time periods that begins and ends on the dates specified in Section 4.6.

“Work Product” means everything that is specifically made, conceived, discovered, or reduced to practice by Contractor or Contractor Agents (either alone or with others) pursuant to the Contract, including every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection). Notwithstanding anything in the immediately preceding sentence to the contrary, Work Product is not Agency Intellectual Property, Contractor Licensed Technology, Contractor Intellectual Property, or Third Party Intellectual Property.

2. TERM.

The Effective Date of this Contract is _________, or the date on which this Contract is fully executed and approved according to applicable Law, whichever is later. This Contract terminates on the later of the end of the Transition Period, or _____, whichever is later, unless otherwise terminated earlier or extended in accordance with its terms. Notwithstanding the foregoing, the term for any License or Maintenance and Support Agreements attached hereto is as specified in those agreements, unless otherwise terminated in accordance with the terms of those agreements or this Contract.

3. COOPERATION; APPROVALS

3.1. Cooperation with Third Parties. To the extent that Agency performs any services itself or retains a third party to do so, Contractor will to the extent reasonably necessary for Agency or such third party to perform such services performed by Agency or such third party or to interface with the Services:

3.1.1. cooperate with Agency and such third parties, including by providing access to design characteristics of the System to the extent required to facilitate interoperability;

3.1.2. provide any information regarding the operating environment, system constraints, protocol, interfaces, architecture and other operating parameters of the System reasonably required by Agency or the third party to perform the services; and

3.1.3. provide any reasonable interface resources (including equipment or Software) (subject to the final paragraph of this Section) necessary to enable Equipment used by Contractor to perform the Services to interface or be compatible with Agency or State systems or the systems of such third party;

Contractor will provide such cooperation, information and resources at no additional cost to Agency if such cooperation, information and resources can be provided by Contractor using the then-existing resources used to provide the Services under this Contract without adversely affecting Contractor’s ability to provide the Services in accordance with the Delivery Schedule and Service Levels set forth in this Contract. But if such assistance requires additional resources beyond those used to provide the Services under this Contract or if using such resources would adversely affect Contractor’s ability to provide the Services in accordance with the Delivery Schedule and Service Levels in this Contract, Contractor will notify Agency of such requirement or effect, demonstrate that additional resources are needed or that using such resources would adversely affect Contractor’s ability to provide the Services in accordance with the Delivery Schedule and Service Levels and, upon Agency’s approval, provide such additional resources on terms agreed to in a Change Order entered into pursuant to Section 13.

3.2. Governmental Approvals and Consents. Each Party will, at its own expense, obtain and maintain any Governmental Approvals that it is required to obtain to either provide or receive the Services, and will cooperate with the other Party’s obtaining the Governmental Approvals that such other Party is required to obtain pursuant to this Section. This Section shall not relieve Contractor from its obligation to perform in accordance with the terms of this Contract Services for which Agency must seek a Governmental Approval.

4. SCOPE OF SERVICES.

4.1. Performance and Delivery.

4.1.1. Responsibilities of Contractor. Contractor shall perform the Services as set forth in the Statement of Work, in accordance with the current, Accepted Project Schedule, the Service levels, and the standards and methodologies set forth in the Statement of Work and elsewhere in this Contract. Contractor agrees to perform the Services employing a methodology that conforms to the standards established by the Project Management Institute (PMI) as described in the Project Management Body of Knowledge (PMBOK), Seventh Edition (PMBOK Guide, ANSI/PMI 99-001-2021), and any subsequent versions of those standards, supplemented by standards set forth in ISO 12207 as well as standards established by DAS for quality assurance and quality management services. DAS’ policies are found online at:

http://www.oregon.gov/DAS/CIO/ITIP/Pages/IT_Investment_Oversight.aspx, and may be updated from time to time.

4.1.2. If the Statement of Work requires the Contractor provide Hardware, Contractor shall deliver any Hardware to the Agency F.O.B. destination, to the destination specified by Agency, and according to the delivery schedule approved by Agency.

Title for the Hardware will pass to the State of Oregon for each piece of Hardware on the date of Final Acceptance. During the period that Hardware is in transit, and until the Hardware is tendered to enable Agency to take delivery of the Hardware, Contractor and its insurers, if any, relieve the Agency and the State of Oregon of the responsibility for all risk of loss of, or damage to, the Hardware. Thereafter, all risk of loss of, or damage to, the Hardware will be borne by the State.

4.2. Responsibilities of Agency. If this Contract requires Agency to provide any resources, and Agency fails to provide the requisite quality or quantity of such resources, or fails to provide such resources in a timely manner for a period that does not exceed thirty Calendar Days, Contractor's sole remedy is an extension of the applicable delivery dates corresponding to the delay caused by Agency. If Agency's failure to provide such http://www.oregon.gov/DAS/CIO/ITIP/Pages/IT_Investment_Oversight.aspx resources exceeds thirty Calendar Days and Contractor can show to the reasonable satisfaction of Agency, that the Agency's failure has resulted in an unavoidable increase in the cost of the Services then Contractor may propose a Change Order in accordance with Section 13.2 to add to the Charges a reasonable amount to compensate Contractor for such increased costs. Contractor's right to delay applicable delivery dates or recover for increased costs may be exercised only if Contractor provides Agency with reasonable notice of Agency's failure and Contractor uses commercially reasonable efforts to perform notwithstanding Agency's failure to perform.

4.3. Delivery and Review of Deliverables.

4.3.1. Contractor shall deliver Deliverables and complete Tasks and Milestones as set forth in the Statement of Work by no later than the date or dates set for delivery in the Statement of Work. Delivery dates, both critical and non-critical, are set forth in the Statement of Work and are subject to Agency performing its responsibilities in a timely manner.

4.3.2. Contractor shall provide written notice to Agency upon delivery of a completed Deliverable to Agency. By no later than (i) fifteen Business Days after receipt of such notice, or (ii) the date set forth for Agency’s review in the current Accepted Project Schedule, Agency will determine whether the Deliverable meets Acceptance Criteria. With respect to any Deliverables that are susceptible to Acceptance Testing, Agency will conduct interim Acceptance Testing as set forth in the Statement of Work. If Agency determines that the Deliverable meets the Acceptance Criteria in all material respects Agency will notify Contractor of Agency’s Acceptance in writing.

4.3.3. If the Agency determines that a Deliverable does not meet the Acceptance Criteria in all material respects, Agency will notify Contractor in writing of Agency’s rejection of the Deliverable, and describe in reasonable detail in such notice the Agency’s basis for rejection of the Deliverable. Upon receipt of notice of non-acceptance, Contractor shall, within a fifteen Business Day period, modify or improve the Deliverable at Contractor’s expense so that the Deliverable meets, in all material respects, the Acceptance Criteria, and notify the Agency in writing that it has completed such modifications or improvements and re-tender the Deliverable to Agency. Agency will thereafter review the modified or improved Deliverable within fifteen Business Days of receipt of the Contractor's delivery of the Deliverable. Failure of the Deliverable to meet the Acceptance Criteria in all material respects after the second submission will constitute a default by Contractor. In the event of such default, Agency may either (i) notify Contractor of such default and instruct Contractor to modify or improve the Deliverables as set forth in this Section 4.3.3, or (ii) notify Contractor of such default and pursue its remedies for default under Section 21 of this Contract.

4.4. Acceptance Testing. Contractor and Agency shall conduct acceptance testing of the System and any upgrades, enhancements or modifications to the System as set forth in the Statement of Work.

4.5. Final Acceptance. “Final Acceptance” of the System will occur when the following events have occurred or conditions exist:

4.5.1. Contractor has completed the Implementation Services, and Agency has notified Contractor that the System meets all Acceptance Criteria and that all Acceptance Tests required pursuant to the SOW have been successfully completed for the System;

4.5.2. The System is stable, complete, and operating correctly as specified in the SOW, without Level 1 Defects, Level 2 Defects, or Level 3 Defects;

4.5.3. Contractor has delivered, and Agency has Accepted, a System Security Plan that complies with the requirements of Exhibit L;

4.5.4. Agency has received any Governmental Approvals required by Law to use the System and the Application Services for their intended purpose;

4.5.5. All Documentation is complete, inventoried, and Accepted by the Agency.

Contractor shall provide all text Documentation both in hard copy and in an electronic format as specified in the Statement of Work; and

4.5.6. Contractor has completed and Agency has Accepted Deliverables for User Training, Technical Training and other knowledge transfer and organizational change management activities as specified in SOW.

4.6. Warranty Period.

4.6.1. Post-Implementation Warranty Period. Contractor warrants the System for a period of three hundred and sixty-five Calendar Days following Final Acceptance (the “Post Implementation Warranty Period”). During the Post-Implementation Warranty Period, Contractor shall, at no additional charge to Agency, furnish such materials and Services necessary to correct any Defects in the System that prevent the System from meeting the Acceptance Criteria, Service Levels or Contract warranties. Contractor shall cure Defects discovered during the Post- Implementation Warranty Period that prevent the System from meeting the Acceptance Criteria, Service Levels or Contract warranties.

4.6.2. System Change Warranty Period. Contractor shall warrant System changes that modify or enhance the System following Final Acceptance, and that are not Defect corrections, for a period of ninety Calendar Days following Acceptance of the implemented System change (the “System Change Warranty Period”). Contractor shall, at no additional charge to Agency, furnish such materials and Services necessary to correct any Defects relating to the System change that prevent the System from meeting the Acceptance Criteria and Contract warranties. Contractor shall cure Defects discovered during the System Change Warranty Period that prevent the System from meeting the Acceptance Criteria and Contract warranties.

4.7. Ongoing Application Services. Contractor shall provide Agency and its end users the Application Services as set forth in this Contract, including the SOW. Application Services include, without limitation, the following:

4.7.1. Availability Services. Contractor shall make the System available to Users.

4.7.2. Maintenance and Support. Contractor shall maintain the Application Services and provide updates and enhancements to the System and Services as set forth in the System Maintenance and Support Agreement attached hereto as Exhibit J.

4.7.3. Technology Refresh. It is Contractor’s intent to provide Agency with Application Services that meet or exceed industry standards for the duration of the Contract.

As such, subject to the terms and conditions of this Contract, Contractor shall use commercially reasonable efforts to upgrade the Application Services to support new technologies, and services during the Contract term consistent with upgrades provided to other customers. Contractor may upgrade the Software or Hardware and implement new technologies to better serve Agency and its end users, provided that (i) such actions by Contractor do not impair Agency's rights hereunder or result in any interference with Agency operations at the time of any upgrade; (ii) such actions do not cause the System to function other than as set forth in this Contract or not in accordance with the Service Levels set forth in this Contract, and (iii) such actions by Contractor are undertaken in accordance with and are governed by the terms of this Contract. In the event that Contractor’s upgrading of Hardware or Software or deployment of new technologies would involve changes or interference with Agency’s operations or Agency equipment or facilities used to access the Application, then Contractor shall request Agency's prior written approval, which Agency will not unreasonably withhold, condition or delay. Any change that changes the System Requirements or affects the functionality of the System or end user experience must be made pursuant to a Change Order entered into pursuant to Section 13.

5. PERFORMANCE METRICS AND SERVICE LEVELS.

5.1. Service Levels. Contractor agrees to provide the Services in accordance with the Service Levels set forth in Exhibit B.

5.2. Failure to Perform.

5.2.1. If Contractor fails to meet a Service Level, Contractor shall (i) investigate, assemble and preserve pertinent information with respect to, and report on the causes of, the failure, including performing a root cause analysis of the failure; (ii) advise Agency, as and to the extent requested by Agency, of the status of remedial efforts being undertaken with respect to such failure; (iii) minimize the impact of and correct the causes of the failure and begin meeting the Service Level; and (iv) take appropriate preventive measures so that the failure does not recur.

5.2.2. Contractor shall provide the Service Level Credits specified in Exhibit B if the System or Services fail to meet the Service Levels. This Section does not limit Agency’s rights with respect to the events upon which Agency may rely as a basis for Agency seeking remedies for Contractor’s default.

5.3. Measurement and Monitoring Tools. Contractor shall utilize the necessary measurement and monitoring tools and procedures required to measure and report Contractor’s performance of the Services against the applicable Service Levels. Such measurement and monitoring must permit reporting at a level of detail sufficient to verify compliance with the Service Levels, and is subject to audit by Agency. Contractor shall provide Agency with information and access to such tools and procedures, for purposes of auditing and verification.

6. TRANSITION SERVICES.

6.1. Transition Services. Contractor shall provide transition services in accordance with the Transition Plan (as defined in Section 6.2 below) to support a responsible and secure transition of Services and Agency Data to another service provider or to Agency upon expiration or termination of this Contract (“Transition Services”).

6.1.1. Upon receipt of a notice prior to expiration of this Contract that Agency will engage Contractor’s Transition Services, or receipt of notice of termination and notwithstanding the reason for termination (whether for cause or without cause and whether by Contractor or Agency, and whether for all or some Services), Contractor shall continue to provide Services and shall provide Transition Services as described in the Transition Plan (defined below) for the period set in the notice and in the subsequent Transition Plan (the “Transition Period”).

6.1.2. Contractor may charge Agency for Services other than Transition Services in accordance with the terms of the Contract, and for Transition Services as set forth in the Transition Plan. Contractor may not, under any circumstances withhold Transition Services, but at Contractor’s request Agency will pay in advance for Transition Services and any Services performed during the Transition Period if either or both of the following conditions exist:

6.1.2.1. Agency is not up-to-date with its undisputed payment obligations at the commencement of the Transition Period;

6.1.2.2. Agency fails to pay all undisputed invoices during the Transition Period in accordance with its obligations referenced in this Section 6.

6.1.3. If during the Transition Period Contractor believes Agency is not in compliance with the foregoing conditions, Contractor shall give Agency written notice of such noncompliance and Agency will have 15 Business Days, or such longer period to which the Parties may agree, to either make an advance payment of Services for the one-month period following the date of Contractor’s notice, or pay any undisputed invoices. If Agency fails to do one of the foregoing, Contractor may end the Transition Period and move to the Wind-Down Phase described below.

6.1.4. Following receipt of the notice of termination (whether or not Contractor or Agency initiated the termination), Contractor shall not, without Agency’s prior written consent, which will not be unreasonably withheld, transfer, reassign, or otherwise redeploy any Contractor Staff from providing Services under this Contract.

6.2. Transition Plan. Contractor and Agency will outline a Transition Plan, which Agency may request either pursuant to a notice of termination or in anticipation of the Contract terminating in accordance with its terms. Contractor shall deliver a detailed Transition Plan within 15 Business Days of Agency’s written request, or otherwise within a timeframe agreed upon by the Parties, for Agency review. The proposed Transition Plan will describe the nature and extent of Contractor’s Transition Services and detail the transfer of Services and Agency Data, but must not reduce Contractor’s obligation under this Contract to provide all Services during the Transition Period. The Transition Period will commence on the start date set forth in the Transition Plan agreed to by the Parties; provided, however, if Contractor does not deliver an acceptable Transition Plan within the timeframe set forth above, then Contractor will provide Transition Services in accordance with a draft Transition Plan created by Agency until the final Transition Plan is agreed to by the Parties. The Transition Plan must address at least:

6.2.1.1. The respective Tasks and Deliverables to be completed by each Party in connection with the Transition Services;

6.2.1.2. A schedule pursuant to which such Tasks and Deliverables will be completed; and

6.2.1.3. A schedule identifying Charges (if any) related to each Task and Deliverable. This schedule may include Transition Services the cost of which will be included in the then current Charges for the Services. If the Parties agree Transition Services require new or additional Services that cause an increase in the Charges, the Transition Plan will be agreed to by the Parties in the form of a Contract amendment.

6.2.2. The Parties shall each perform their respective obligations under the Transition Plan and will cooperate in good faith with each other in connection with their obligations under this Section. If the Transition Period extends beyond the Contract term, the provisions of this Contract will remain in effect for the duration of the Transition Period and will apply to all Services and Transition Services provided by Contractor during such period.

6.3. Performance of Transition Services. Contractor shall complete the Transition Services without causing any unnecessary interruption of or adverse impact on the Services.

Without limiting the generality of the aforementioned obligations during the Transition Period, Contractor shall:

6.3.1. Cooperate with Agency and any Agency-designated provider by promptly taking all steps required to assist Agency in completing the Transition related to the Services it had previously performed and Deliverables previously delivered.

6.3.2. Provide Agency and any Agency-designated provider with all information regarding the Services and Deliverables that these Parties will need to perform the Transition and following the Transition. This includes data conversions and interface specifications.

6.3.3. Promptly and orderly conclude all Services as Agency may direct. This may include the documentation of work in progress and other measures to provide an orderly transition to Agency and any Agency-designated provider.

6.4. Wind-Down. Upon the later of (i) the termination of this Contract or (ii) termination of the Transition Period, Contractor will cease to perform Services, and Agency will pay Contractor all undisputed amounts payable to Contractor for Deliverables and Services delivered and pre-approved expenses incurred through the end of the Contract or Transition Period, provided, however, when such termination is due to the breach or bankruptcy of Contractor, Agency will not be required to pay any amounts claimed by Contractor to be due until Agency determines what, if any, setoffs are required and the remedies owed to Agency are either agreed upon by Contractor through a settlement or ordered by a court of competent authority.

7. AGENCY DATA

7.1. Ownership of Agency Data. All Agency Data is, or will be, and will remain the property of Agency. Without Agency’s approval (in its sole discretion), Agency Data will not be,

(i) used by Contractor or Contractor Agents other than in connection with providing the Services, (ii) disclosed (except as otherwise permitted by Section 15), sold, assigned, leased or otherwise provided to third parties by Contractor or Contractor Agents or (iii) commercially exploited by or on behalf of Contractor or Contractor Agents. Contractor hereby irrevocably assigns, transfers and conveys, and will cause Contractor Agents to assign, transfer and convey, to Agency without further consideration all of its and their right, title and interest in and to Agency Data. Upon request by Agency, Contractor will execute and deliver, and will cause Contractor Agents to execute and deliver, any documents that may be necessary or desirable under any Law to preserve, or enable Agency to enforce, its rights with respect to Agency Data.

7.2. Return of Data. Subject to any specific data or file retention obligations set forth in the Contract, upon request by Agency at any time during the term of the Contract and upon expiration or termination of this Contract, Contractor will (i) within 30 Calendar Days of such request or expiration or termination of this Contract, return to Agency, in the format and on the media requested by Agency, all or any part of Agency Data and

(ii) use commercially reasonable efforts to erase or destroy all or any part of Agency Data in Contractor’s possession, in each case to the extent so requested by Agency.

Agency Data that Contractor retains in accordance with the terms of this contract or that Contractor is unable to erase or destroy using commercially reasonable efforts pursuant to the previous sentence will continue to be subject to the provisions of this Section.

8. INFORMATION SECURITY

8.1. Physical Safety, Environmental and Security Procedures. Contractor will maintain and enforce at the Contractor Service Locations Contractor’s standard physical safety, environmental and security procedures applicable to and in effect for such Contractor Service Location that are at least equal to the Security Standards. Contractor will comply with all the rules and regulations established by Agency for access to and activities in and around premises controlled by Agency.

8.2. Information Security Standards.

8.2.1. Contractor acknowledges that Agency has established, and during the Term may amend in accordance with Section 8.2.2, minimum levels of security for Agency Data and other Confidential Information of Agency or Users residing in or accessed by the System.

8.2.2. Agency’s information security policies as of the Effective Date are set forth in the documents referenced in Section 8.2.4. Agency will have the right to amend these security policies on 30 days’ notice to Contractor or such shorter notice period as required in order to comply with Law. If Agency amends such security policies, Contractor will implement such amendments in the provision of the Services and the Parties will engage in the change control procedures set forth in Section 13 to address the cost of, and to document any technical or operational changes associated with or resulting from such amended policies.

8.2.3. Contractor will, and will cause each member of the Contractor Staff to, comply with Agency’s information security policies at all Service Locations, whether Agency premises or Contractor premises, to which they have access in connection with the performance of Services hereunder.

8.2.4. In addition to the standards established by the Information Security Policies described in Section 8.2.2, Contractor shall implement and maintain the System and provide Services in compliance with the following:

8.2.4.1. The HIPAA Security Rule set forth at 45 CFR Part 160 and Subparts A and C of Part 164;

8.2.4.2. All statutes, rules, regulations, and codes related to the handling of Criminal History Record Information (CHRI) pursuant to Title 28 CFR Section

906.2 and the Security and Management Control Outsourcing Standard requirements, including the CJIS Security policy found at:

https://www.fbi.gov/file-repository/cjis_security_policy_v5- 9_20200601.pdf/view and Exhibit N, incorporated herein by reference;

8.2.4.3. Data Classification. Contractor shall assume that Agency Data contains information that has been classified as Level 4 Information under the State of Oregon’s Information Asset Classification policy, available online at https://www.oregon.gov/das/Policies/107-004-050.pdf. Contractor certifies the Services provide the appropriate level of protection for Level 4 Information;

8.2.4.4. Oregon’s Statewide Information Security Standards, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx, including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53;

8.2.4.5. Section 6103 of the Internal Revenue Code and guidance issued by the Internal Revenue Service with respect to compliance thereof, including IRS Publication 1075 or its replacement, as amended from time to time;

8.2.4.6. The Family Educational Rights and Privacy Act (FERPA) (20 USC §1232g;

34 CFR Part 99);

8.2.4.7. Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx;

8.2.4.8. Statewide Cloud Computing policy:

http://www.oregon.gov/das/policies/107-004-150.pdf;

8.2.4.9. OPDS Information Security Policies and Standards (Policy 7-5 through Policy 7-235);

8.2.4.10. The Oregon Consumer Information Protection Act (ORS 646A.600 et seq.); and

8.2.4.11. Any additional standards set forth in Exhibit L.

8.3. Identity Theft. In the performance of this Contract, Contractor may have possession or access to documents, records or items that contain “Personal Information” as that term is used in ORS 646A.602(12), including social security numbers. Prior to the receipt of, and during the period in which Contractor has possession of or access to, any Personal Information, Contractor shall have and maintain a formal written information security program that provides safeguards to protect Personal Information from loss, theft, and disclosure to unauthorized persons, as required by the Oregon Consumer Information Protection Act, ORS 646A.600-646A.628.

8.3.1. In addition to and without limiting the generality of Sections 8.1 and 8.2, Contractor shall not breach or permit breach of the security of any Personal Information that is contained in any document, record, compilation of information or other item to which Contractor receives access, possession, custody or control under this Contract. Contractor shall not disclose, or otherwise permit access of any nature, to any unauthorized person, of any such Personal Information.

Contractor shall not use, distribute or dispose of any Personal Information other than expressly permitted by Agency, required by applicable Law, or required by an order of a tribunal having competent jurisdiction.

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx http://www.oregon.gov/das/policies/107-004-150.pdf

8.3.2. Contractor shall promptly report to the Agency any breach of security, use, disclosure, theft, loss, or other unauthorized access of any document, record, compilation of information or other item that contains Personal Information to which the Contractor receives access, possession, custody or control in the performance of this Contract.

8.3.3. Contractor shall require the compliance by Contractor Staff and Contractor Agents with this Section.

8.4. Notification; Control of Required Notices. In the event Contractor or Contractor Agents discover or are notified of a breach or potential breach of security relating to Agency Data, or a failure to comply with the Security Standards Contractor will promptly but in any event within one calendar day (i) notify the Agency Authorized Representative of such breach or potential breach and (ii) if the applicable Agency Data was in the possession of Contractor or Contractor Agents at the time of such breach or potential breach, Contractor will (a) investigate and remedy the technical causes and technical effects within the scope of the Services of the breach or potential breach and (b) provide Agency with a written root cause analysis of the breach and the specific steps that Contractor will take to prevent the recurrence of the breach or potential breach.

For the avoidance of doubt, in the event that Agency determines that any such breach or potential breach of security involving Agency Data for which notification to Agency customers or employees or any other individual or entity is required by Law, Agency will have sole control over the timing, content, and method of such notification, subject to Contractor’s obligations under applicable Law.

8.5. System Security Plan. As part of the Services, Contractor shall develop a System Security Plan as described in Exhibit L.

9. DISASTER RECOVERY AND FORCE MAJEUR

9.1. Disaster Recovery and Business Continuity Plans. Contractor will implement and maintain disaster recovery plans and business continuity plans for the System at Service Locations consistent with industry standards and practices of tier one providers providing similar services. Contractor will (i) periodically update and test the operability of any applicable recovery plan (at least once during every 12-month period), (ii) confirm to Agency upon completion of each such test (or such other time as reasonably requested by Agency) that each such plan is fully operational and (iii) implement each such plan upon the occurrence of a disaster (as such term is defined in the applicable recovery plan). In addition to the foregoing obligations:

9.1.1. Contractor will perform any specific obligations in respect of disaster recovery and business continuity set forth elsewhere in this Contract.

9.1.2. Contractor will reinstate the Services within the recovery time objectives set forth in Exhibit B upon the occurrence of a disaster.

9.1.3. In the event of a disaster, Contractor will not increase its Charges under this Contract or charge Agency any fees in addition to such Charges.

9.2. Force Majeure. If and to the extent that a Party’s performance of any of its obligations pursuant to this Contract is prevented, hindered or delayed by fire, flood, earthquake, elements of nature or acts of God, acts of war, terrorism, riots, civil disorders, rebellions or revolutions, pandemic, epidemic, or any other similar cause beyond the reasonable control of such Party (each, a “Force Majeure Event”), and such non-performance, hindrance or delay could not have been prevented by reasonable precautions, then the non-performing, hindered or delayed Party will be excused for such non-performance, hindrance or delay, as applicable, of those obligations affected by the Force Majeure Event for as long as such Force Majeure Event continues and such Party continues to use commercially reasonable efforts to recommence performance whenever and to whatever extent possible without delay, including through the use of alternate sources, workaround plans or other means. The Party whose performance is prevented, hindered or delayed by a Force Majeure Event will immediately notify the other Party of the occurrence of the Force Majeure Event and describe in reasonable detail the nature of the Force Majeure Event. The occurrence of a Force Majeure Event does not excuse, limit or otherwise affect Contractor’s obligation to provide either normal recovery procedures or any other disaster recovery services described in Section 9.1.

9.3. No Payment for Unperformed Services. Nothing in this Section 9 will limit Agency’s obligation to pay any Charges; provided, however, that if Contractor fails to provide the Services in accordance with this Contract due to the occurrence of a Force Majeure Event, the Charges will be adjusted in a manner such that Agency is not responsible for the payment of any Charges for Services that Contractor fails to provide.

9.4. Allocation of Resources. Whenever a Force Majeure Event or a disaster causes Contractor to allocate limited resources between or among Contractor’s customers, Contractor will not provide to any other customers of Contractor priority over Agency.

In no event will Contractor redeploy or reassign any Key Personnel to another account in the event of a Force Majeure Event or a disaster without Agency’s prior consent.

10. CONTRACTOR’S PERSONNEL.

10.1. Key Persons. Contractor acknowledges and agrees that Agency selected Contractor, and is entering into this Contract, because of the special qualifications of Contractor's Key Persons identified in Exhibit F. Contractor's Key Persons shall not delegate performance of their powers and responsibilities they are required to provide under this Contract to another Contractor employee(s) without first obtaining the written consent of the Agency. Further, Contractor shall not re-assign or transfer a Key Person to other duties or positions such that the Key Person is no longer available to provide the Agency with the required expertise, experience, judgment, and personal attention, without first obtaining Agency's written consent to such re-assignment or transfer, which Agency will not unreasonably withhold or delay. Notwithstanding the foregoing, Contractor may replace Key Persons without Agency’s consent in the event any Key Persons are no longer available due to circumstances beyond Contractor’s reasonable control, such as death, illness, or termination of employment with

Contractor. In the event Contractor…