RHRFP2606 RFP1375 Modification and Exception Department Response.doc

ATTACHMENT 2 -- MODIFICATION AND EXCEPTION FORM TC "ATTACHMENT 2 -- MODIFICATION AND EXCEPTION FORM" \f C \l "1"

DEPARTMENT RESPONSE

RHRFP2606 / IPRO RFP1375 Technology Assessment - RHTP The determination of materiality will be made at the State’s sole discretion. Non-material modifications or exceptions may be negotiated with the apparent successful Offeror, at the discretion of the State, and as otherwise provided in RFP Section 2.3.4.

Note to Offeror: If the modification request was submitted during the Question period and a response of non-agreement was provided by the Department, do not submit again on this form.

Additionally, Gartner can agree to indemnify for the willful misconduct or negligence that causes property damage or personal injury caused by our team during the provision of services.

The Department declines this modification request.

Condition the 2nd limitation of indemnification to the “the misuse or modification.”

Condition the 3rd limitation of indemnification to include “or the failure to use corrections or enhancements made available by Contractor;”

Finally, add a 4th limitation of indemnification:

“4) Information direction, specification or materials provided by State.”

Add a Limitation of Liability clause with the following language:

“Neither party shall be liable for any consequential, indirect, special or incidental damages, such as damages for lost profits, business failure or loss arising out of use of the Deliverables or the Services, whether or not advised of the possibility of such damages. Except for liability for personal injury or death or for damage to property caused by the negligence or willful misconduct of Contractor or its employees, Contractor’s total liability arising out of this Agreement and the provision of the Services shall be limited to the fees paid by the State under the specific Statement of Work under which such liability arises.”

Gartner cannot agree to liability higher than fees paid for the services provided, A cap equal to the value of the engagement is standard for the industry. Increasing the cap significantly beyond the value of the engagement imposes too high a risk on Gartner compared to the value of the engagement.

The Department declines this modification request.

Replace Section 4.3.6 with the following language:

“ALL SERVICES ARE PROVIDED ON AN “AS IS” BASIS. CONTRACTOR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. THE INFORMATION IN THE DELIVERABLES HAS BEEN OBTAINED FROM SOURCES THAT CONTRACTOR BELIEVES TO BE RELIABLE. ALL DELIVERABLES SPEAK AS OF THE DATE OF DELIVERY TO THE STATE.”

The purpose and how Gartner consulting is used will vary from a client organization to another. Hence, Gartner provides the consulting deliverable on an “as is” basis, subject to the relevant SOW, and cannot confirm/warrant beforehand that the deliverable will be accurate and fit a particular purpose or internal strategy.

Gartner consulting deliverables equips client organizations with the information for their own decision-making process, but it should not be considered recommendations to pursue any course of action.

The Department declines this modification request.

Add the following as Section 4.3.9:

“The State warrants that Contractor’s use of any materials furnished by the State in connection with a Statement of Work does not infringe any copyright, trademark, trade secret or other right of any third party

Add language to the end of Section 4.5 that will protect the Contactor’s Preexisting IP and clarify that this agreement does not prevent Gartner from working with other Clients on similar engagements.

Replace Section 4.8.1 with the following:

“Contractor shall notify the State-designated contact(s) to State’s email or telephone within seventy-two (72) hours, if Contractor has confirmed that there is, a Security Incident or Data Breach impacting State’s data.”

Additionally replace the second subsection with the following:

“2) cooperate with the State by providing the State a summary report consisting of sufficient detail to enable State to comply with applicable legal and regulatory requirements resulting from such a security incident;”

72 hours provide Gartner’s Incident Response Team a greater opportunity to identify, contain, and remediate an incident swiftly.

Notification and reporting increase the administrative overhead of an incident and generally pull key resources away from the actionable phases of the incident response process.

Additionally, 72 hours of lead time generally provides the Incident Response Team with enough time to accurately assess and collect data on the incident. The incident response process is a fluid event and prone to rapid changes in conditions and facts. In a more compressed timeframe, there is a much higher likelihood that initially reported information may no longer be accurate or up to date and could lead to misinformed decisions being made based on incomplete facts.

Please note the timer of reporting starts when the client is notified or aware of the incident. Meaning, we will inform them within 72 hours upon discovering a security incident impacting their data and then as they become aware, their timer of notifying their authority will start.

The Department declines this modification request.

Amend Section 4.12 to read:

“Contractor shall maintain reports of report data and reporting tools. Unless specified otherwise in the Contract, reports shall include latency statistics, system performance statistics, user access logs, user access IP address, user access history, security logs, and events logs for all State Data.”

Add the following language to the end of this section:

“Notwithstanding the foregoing Contractor will comply with the provisions of this Appendix C, to the extent they are consistent with Executive Orders 14151, 14173, 14398; FAR 52.222-90; and related EEOC and DOJ guidance (collectively, the “Federal Government’s DEI Rules”). To the extent any provision of this Agreement, or any obligation arising hereunder, is in conflict with the Federal Government’s DEI Rules, the Federal Government’s DEI Rules shall control.”

The reason for including this clause is to ensure that Gartner, as a federal contractor, remains in full compliance with the Federal Government’s DEI (Diversity, Equity, and Inclusion) requirements, including relevant Executive Orders, FAR 52.222-90, and guidance from the EEOC and DOJ.

These federal rules are binding on us and take precedence over any conflicting state or local requirements. Violating these federal requirements could expose us to significant legal risks, including potential claims under the False Claims Act, which could jeopardize our ability to continue working on public sector projects.

We want to be upfront about the rules we have to follow, and this clause helps prevent any accidental conflicts or misunderstandings. Our goal is to keep things transparent and make sure our work together continues smoothly and compliantly.

The Department declines the language in the modification request but has updated the spec document with other language.

Business Associate

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

Edits align to industry norms for engagements of this nature.

Edits do not reduce our insurance obligations Independent Contractor. Contractor’s status under the Contract shall be that of an independent contractor, and not that of an agent or employee. Contractor is solely liable for all labor, taxes, insurance, required bonding, and other expenses, except as specifically stated herein. Contractor shall exonerate, indemnify and hold the State harmless from and against and assume full responsibility for payment of all federal, state and local taxes or contributions imposed or required under unemployment insurance, social security, workman’s compensation and income tax laws with respect to Contractor or Contractor’s employees engaged in performance under the Contract.

Workers’ Compensation Insurance. Contractor shall maintain worker’s compensation insurance as required by law and shall provide certificate of same if requested by the State. Failure to provide a certificate of worker’s compensation insurance after reasonable advance written notice may result in termination of the Contract. Provision of workers’ compensation insurance by the State, if applicable, under this provision shall be in the name of the Contractor as employer and shall not alter the independent contractor status of Contractor under the Contract. Contractor must provide either a certificate of worker’s compensation insurance issued by a surety an insurer licensed to write worker’s compensation insurance in the state of Idaho, as evidence that the Contractor has in effect a current Idaho worker’s compensation insurance policy, or an extraterritorial certificate approved by the Idaho Industrial Commission from a state that has a current reciprocity agreement with the Idaho Industrial Commission.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Contractor's liability for damages to the Department for any cause or claims whatsoever is limited to six million dollars ($6,000,000.00) in the aggregate; provided, however, that the following shall not be subject to the foregoing limit: 1. Patent and copyright indemnity required under Section 1.10 of the Contract; 2. Claims for personal injury, including death; 3. Claims for damage to real property or tangible property arising from the Contractor's acts or omissions under this Agreement; and 4. Damages arising from the reckless or willful misconduct of the Contractor, its employees, its subcontractors, or its agents.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

4.3.4 Following acceptance and for the entire term of the Contract, including any renewal and extension terms (the “warranty period”), the pProperty shall perform in accordance with the acceptance criteria or specifications for such Property set forth in the Contract and shall perform in accordance with to all specific acceptance criteria claims and specifications for such Property provided in the Contract. Additionally, Contractor shall perform the services materially as described in the Contract.

4.3.5 The Property provided by the Contractor is compatible with and will operate successfully in compliance with any environment, including software, infrastructure, web browser, and operating systems in conformance to the agreed-upon requirements for such compatibility and compliance specified in the Contract or agreed upon in writing by the parties, during the warranty period stated in Section 4.3.4. Incompatibility will include but not be limited to, the creation of errors in data, the loss of data, the inability to access data, and delays and stoppages in performance of work by Contractor or the State arising from the Property. In addition, the Property provided by Contractor under the Contract is free of malware or any other software inclusions such as backdoors, datamining capabilities, spyware, command and control, monitoring, or any other functionality or capability that may adversely impact the State’s ability to use the Property, and Contractor will use for the term of the Contract current industry standard security measures to prevent from entry, detect within, and remove from the Property any such malicious software.

4.3.6 The Property is fit for a particular purpose as detailed in the Contract.

4.3.7 Contractor shall provide maintain required Contractor provided technology licenses, maintenance, and updates in a timely manner for the duration of the Contract. Contractor shall not interfere with the State’s access to and use of the Property it acquires for delivery to the State pursuant to the performance of Services under the Contract.

4.3.8 Upon receipt of notification from the State during the warranty period stated above, reasonably describing the applicable compliance failure, Contractor shall immediately promptly repair or replace any aspect of the Property failing to comply with the specification and acceptance criteria set forth in the Contract for such Property. If Contractor fails to repair or replace any such aspect of the Property within the time frame to do so set forth in the Contract, or within the time frame otherwise agreed upon in writing by the parties, the State may, in its sole discretion and upon providing written notice to Contractor, act to repair or replace the Property, in whole or in part, in addition to any rights or remedies of the Stateand Contractor shall reimburse the State for all costs incurred by the State to repair or replace the Property.

Contractor shall have no obligation to make warranty modifications attributable to modifications of the Property other than by Contractor or its subcontractors, hardware or software that is supplied by a third party to the State; or hardware, software, networks or systems not a part of the Property

The Department declines this modification request.

The Department declines this modification request.

4.7.1 All Non-Public State Data shall be encrypted at rest and in transit with controlled access. Unless otherwise provided in the Contract, the Contractor is responsible for encryption of the Non-Public State Data. All encryption shall be consistent with validated cryptography standards such as the current standards in FIPS 140-2, Security Requirements for Cryptographic Modules, or the then-current NIST recommendation.

4.7.2 The State shall identify State Data it deems as Non-Public State Data to Contractor. The level of protection and encryption for all Non-Public State Data shall be identified in the Contract.

4.7.3 At no time shall any State Data or processes, that either belong to or are intended for the use of the State or its officers, agents, or employees, be copied, disclosed, or retained by Contractor or any party related to Contractor for subsequent use in any transaction that does not include the State except as otherwise required by law.

4.7.4 Contractor shall not use any information State Data collected in connection with the service provided under the Contract for any purpose other than fulfilling the service.

4.7.5 Data Location: Contractor shall provide its service to the State and its end users solely from data centers within the United States. Contractor shall not allow its personnel or subcontractors to store State Data on encrypted portable devices, except for devices that are used and kept only at its U.S. data centers. Each data center used by Contractor to support the Contract must be within a physical security perimeter to prevent unauthorized access, and physical entry controls must be in place so that only authorized personnel have access to State Data and State-written applications.

4.7.6 Contractor shall permit its staff to access State Data remotely only as required in connection with to providing technical support the services.

Except as otherwise expressly agreed in the Contract, nothing shall require Contractor to be responsible for the implementation and maintenance of any security controls concerning the equipment or information systems of the Agency.

The Department declines this modification request.

4.8.1 Contractor shall notify the State-designated contact(s) by telephone within twenty-four forty-eight (248) hours, unless shorter time is required by applicable law, if Contractor has confirmed that there is, or Contractor reasonably believes that there has been, a Security Incident or Data Breach. Contractor shall 1) immediately quarantine all State Data from external access if applicable based on the nature of the Security Incident or Data Breach; 2) cooperate with the State to investigate and resolve the Security Incident or Data Breach by making available information about the Security Incident or Data Breach reasonably requested by the State; 3) promptly implement remedial measures, if necessary; 4) for Data Breach, identify to the State, if the following is known by Contractor, the persons affected, their identities, and the State Data disclosed; and 5) document responsive actions taken related to the Security Incident or Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services under this Contract, if necessary.

4.8.2 Unless otherwise stipulated in the Contract, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Non-Public State Data or otherwise prevent its release as reasonably determined by the State, Contractor shall bear reimburse the State the State’s reasonable out-of-pocket costs associated with 1) the investigation and resolution of the Data Breach; 2) notifications to individuals, regulators, and others required by federal and state laws or as otherwise agreed in writing to by the State and Contractor; 3) a credit monitoring service (from a nationally recognized supplier of such services) required by state or federal law or as otherwise agreed to by the State and Contractor; 4) a website or a toll-free number and call center for affected individuals required by federal and state laws for up to ninety (90) days, all of (1) through (4) not to exceed the average per record per person cost calculated for Data Breaches in the United States (as of January 2019, $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and 5) complete all corrective actions as reasonably determined by Contractor based on root cause, with all such liability being subject to the limitation of liability in Section 1.30.

4.8.3 Incident Response: Contractor may need to communicate with outside parties regarding a Security Incident or Data Breach, which may include contacting law enforcement, fielding media inquiries, and seeking external expertise as mutually agreed upon between the State and Contractor in writing reasonably necessary, defined by law, or contained in the Contract. Discussing Security Incidents with the State must be handles on an urgent as needed basis, as part of Contractor’s communication and mitigation processes as mutually agreed upon between the State and Contractor in writing, defined by law or as delineated in the Contract.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

The Department declines this modification request.

At any time, Department can decrease funding, recover funding, or terminate a Contract if Contractor fails to perform the requirements of the Contract as provided for herein. The Contract may also otherwise be terminated for convenience to the extent authorized by law, if Department determines the Contract no longer effectuates program goals or priorities.

For Department to Contract continuation funding for subsequent periods, Contractor must also demonstrate satisfactory progress compliance with the applicable specifications as set forth in the statement of work . Satisfactory progress Compliance with the specifications includes but is not limited to progress in implementing initiatives approved by CMS in the approved Department application and outlined in this Contract the applicable statement of work. Progress will be measured both qualitatively and quantitatively. Department will use a combination of data submitted in the quarterly and annual progress reports and written and verbal updates from the Contractor to assess such progress

The Department declines this modification request.

If Contractor is placed on a non-compliance action plan and/or receives notification of potential enforcement action during the period of performance, Contractor might not receive additional funding for the next twelve (12)-month budget period(s), based on their progress in addressing required corrective actions. Department will also consider if a Contractor is placed on a Corrective Action Plan to address audit findings.

If Department determines Contractor is not using Contract funds in a manner consistent with the description in the approved Department application as outlined in the statement of work pursuant to this Contract (a “violation of agreement”), Department may withhold, reduce, or recover award payments exercise remedies as set forth herein. Violations of agreement include, but are not limited to:

2.1 Using funds in a manner inconsistent with activities described in the approved Department application and outlined in this Contract, on activities explicitly limited or prohibited, and/or on activities not approved by Department.

2.2 Not investing funds in a way that broadly affects Contractor’s rural areas and residents in a positive manner.

2.3 Failure to submit required reporting as described in the Contract Reports section.

2.4 Failure to follow through on other actions included in the approved Department application and outlined in this Contract.

Improperly managing or using Contract funds, including fraud, waste, abuse, and criminal activity

The Department declines this modification request.

3.1 Significant problems include issues or barriers that may cause Contractor to miss milestones described in Contract or failure to implement this program as described in the Contract.

3.2 Department may elect to shall allow Contractor an opportunity to take appropriate remedies which may include Contractor accepting specific Contract conditions, technical assistance, and/or adhering to a non-compliance action plan within a timeframe and manner determined by Department.

3.3 If Contractor fails to meet the terms of any non-compliance action plan within the designated timeframe, Department may terminate the cooperative agreement.

If the Contractor’s actions endanger the public health and welfare, the Department may immediately terminate the Contract agreement without the opportunity for corrective action

The Department declines this modification request.

Appendix D – Riders

Insurance

Each Occurrence Claim – three million dollars ($3,000,000)

Network Security / Privacy Liability – three million dollars ($3,000,000)

Breach Response/ Notification Sublimit – A minimum limit of fifty percent (50%) of the policy aggregate

Technology Professional E&O – three million dollars ($3,000,000). (Only applicable for Contractors supplying Information Technology [IT] consulting services).

The Contractor must defend, indemnify, and hold harmless the State of Idaho, its agencies, directors and employees for all third party claims resulting from Contractor’s wrongful acts or omissions committed in the performance of, or failure to perform, all services under the agreement, including, without limitation, claims, demand and any other payments related to electronic or physical security, breaches of confidentiality and invasion of or breaches of privacy.

The Contractor must provide either a certificate of workers compensation insurance issued by a surety an insurer licensed to write Workers Compensation Insurance in the State of Idaho, as evidence that the Contractor has in effect a current Idaho workers compensation insurance policy, or an extraterritorial certificate approved by the Idaho Industrial Commission from a state that has a current reciprocity agreement with the Idaho Industrial Commission.

If coverage is not available on an occurrence basis, coverage must be provided on a claims-made basis. For claims made policies the retroactive date, if applicable, must be shown and must be before the date of the Contract or the beginning of Contract work; insurance must be maintained and evidence of insurance must be provided for at least three (3) years after completion of the Contract of work; if coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date prior to the contract effective date, the Contractor must purchase “extended reporting” coverage for a minimum of three (3) years after completion of Contract work.

State of Idaho as Additional Insured: The commercial general liability insurance coverage required for performance of the Contract shall include the State of Idaho, the (agency) and its divisions, officers and employees as additional insured, but only with respect to the Contractor's activities to be performed under this Contract.

The Contractor must provide proof of the State of Idaho, the (agency) and its divisions, officers and employees being additional insured by providing blanket form endorsements to the commercial general liability insurance policy showing evidencing the State of Idaho, the (agency) and its divisions, officers and employees as additional insured. The endorsements must also show the policy numbers and the policy effective dates.

If a commercial general liability insurance policy provides for automatically endorsing additional insured when required by Contract, then, in that case, the Contractor must provide proof of the State of Idaho, the (agency) and its divisions, officers and employees being additional insured by providing copies of the policy pages that clearly identify the blanket endorsement.

Notice of Cancellation or Change: Contractor shall ensure that should any of the above described policies be cancelled before the expiration date thereof, or if there is a material change resulting in noncompliance with these insurance requirements, potential exhaustion of aggregate limits or intent not to renew insurance coverage(s), that written notice will be delivered to the Division of Purchasing (if the Contract was issued by the Division) or to the Purchasing Activity (contracting state agency) in accordance with the policy provisions.

Contractor shall request that all policies of insurance are endorsed to read that any failure to comply with the reporting provisions of this insurance, except for the potential exhaustion of aggregate limits, shall not affect the coverage(s) provided to the State of Idaho, and its divisions, officers and employees.

Acceptable Insurers and Deductibles: Insurance coverage required under the Contract shall be obtained from insurers rated A-VII or better in the latest Bests Rating Guide and in good standing and authorized to transact business in Idaho. The Contractor shall be financially responsible for all deductibles, self-insured retention's and/or self-insurance included hereunder. The additional insured coverage provided by such policy will be primary to any coverage of the State on or related to the contract and shall provide that the insurance afforded applies separately to each insured against whom a claim is made, except with respect to the limits or limitation of liability.

Waiver of Subrogation: All policies except for Cyber Liability and Technology Errors and Omissions Liability shall contain waivers of subrogation. The Contractor waives all rights against the State and its officers, employees, and agents for recovery of damages to the extent these damages are covered by the required policies. Policies may contain deductibles but such deductibles will not be deducted from any damages due to the State.

Prior to performing any services, the Contractor must provide an ACORD Certificate of Insurance (ACORD 25) to the Department. The Contractor is also required to maintain current certificates on file with the Department and to provide updated certificates upon request. Failure to provide the required certificates of insurance after reasonable advance written request shall constitute a default under this Contract and upon such failure the Department may, at its option, terminate the Contract. Insurance required by this section must be policies or contracts of insurance issued by insurers approved by the Department. Should any of above described policies be cancelled before the expiration date thereof, notice must be delivered in accordance with the policy provision.

The Department accepts this modification request.

The spec document has been updated.