Contract #DPS00000

PH (10/2024) Page 1 of 20

Contractual Agreement Between the

Ohio Department of Public Safety/ Administration

And

Independent Contractor Name

Street Address City, State Zip Code

(XXX) XXX-XXXX

This agreement, hereinafter referred to as “Agreement”, is made by and between the Ohio Department of Public Safety / Administration, hereinafter referred to as “ODPS”, and Independent Contractor, hereinafter referred to as “the Independent Contractor”, and is subject to the following terms and conditions.

1. TERM: This Agreement is to be effective from receipt of a purchase order through January 7, 2027. If the term of this Agreement extends beyond a biennium, the Agreement will terminate on the last day of the current biennium. At that time, ODPS may renew this Agreement by addendum to the Independent Contractor no later than July 1, of the new biennium. The operating biennium expires June 30th of each odd-numbered calendar year.

RENEWAL: This Agreement may be renewed upon mutual agreement of both parties and may not exceed twenty-four (24) months, unless ODPS determines that additional renewal is necessary.

2. STATEMENT OF WORK:

A. The Independent Contractor shall undertake the work and activities described in the Scope of Work, labeled Exhibit 1, attached. Exhibits 1 and 2 are made a part of this Agreement and incorporated by reference, as if fully rewritten. The Independent Contractor shall perform the services under this Agreement in a professional, workman-like manner and to the satisfaction of the ODPS. The ODPS shall not hire, supervise, or pay any assistants to the Independent Contractor in its performance under this Agreement.

The ODPS shall not be required to provide any training to the Independent Contractor to enable it to complete work under this Agreement. The Independent Contractor shall furnish its own support staff, materials, tools, equipment, and other supplies necessary to complete the work under this Agreement, unless stated otherwise in ODPS Policy and / or Scope of Work.

Order of Priority: If there is an inconsistency between Exhibit 1 (Scope of Work) and any terms set forth in the body of the Agreement, the latter shall prevail.

B. The Independent Contractor declares that it is engaged as an independent business and shall furnish professional services performed according to applicable commercial standards. Neither the Independent Contractor nor its personnel shall, at any time or for any purpose under this Agreement, be considered as employees or agents of the ODPS or the State of Ohio. The Independent Contractor shall determine the hours required to perform the services to be provided under this Agreement, and retains discretion over its schedule when performing services on the premises of the ODPS, subject to the ODPS’s normal business hours and security requirements.

C. The Independent Contractor agrees to comply with all applicable federal, state, and local laws in performing the work under this Agreement. The Independent Contractor accepts full responsibility for the payment of all taxes, and the ODPS and the State of Ohio shall not be liable for any taxes under this Agreement.

D. The Independent Contractor shall perform the work under this Agreement and may subcontract without the

ODPS’s approval for the purchase of articles, supplies, components, or special mechanical services that do not involve the type of work or services which are to be performed by the Independent Contractor under this Agreement, but which are required for the Agreement’s satisfactory completion. The Independent Contractor is responsible for the expense of any and all work subcontracted. Neither this Agreement nor any rights, duties, or obligations described in this Agreement shall be assigned by either party without the prior express written consent of the other party.

PH (10/2024) Page 2 of 20

3. COMPENSATION:

A. The Independent Contractor will be compensated, not to exceed a total of a total AMOUNT SPELLED OUT dollars ($0000.00) for fiscal year 2026, for services performed according to this Agreement and the Scope of Work, attached. The State of Ohio is exempt from all state and local taxes and does not agree to pay any taxes. The ODPS will make payment to the Independent Contractor within thirty (30) days of receipt of an acceptable invoice. O.R.C. Section 126.30 applies to this Agreement and requires payment of interest on overdue payments. The interest rate shall be at the rate per calendar month which equals one-twelfth of the rate per annum prescribed by O.R.C. Section 5703.47.

B. The Independent Contractor will not submit more than one invoice for work performed within a 30-day period. In order to be considered a proper invoice, the Independent Contractor shall include on all invoices the proper vendor identification number, purchase order number, and total cost of services; attest that they are billing only one agency for the identified hours; and submit an original copy monthly to:

DPS Origin A77

Ohio Shared Services P.O. Box 182880

Columbus, Ohio 43218-2880 Fiscal3@dps.ohio.gov

C. Unless expressly provided for elsewhere in this Agreement, the Independent Contractor shall be responsible for and assume all office and business expenses that are incurred as a result of the performance of this Agreement.

4. AVAILABILITY OF FUNDS: The obligations of the ODPS under this Agreement are subject to the determination by the Director of Budget and Management that sufficient funds have been appropriated by the General Assembly to the ODPS for the purposes of this Agreement and to the certification of the availability of such funds by the Director as required by O.R.C. Section 126.07. The ODPS may suspend or terminate this Agreement if the General Assembly fails to appropriate funds or if federal grant funds are not available for any part of the work under this Agreement.

5. AUDITOR RECOVERY FINDING - O.R.C. Section 9.24: The Independent Contractor affirmatively represents and warrants to the ODPS that the Independent Contractor is not subject to a finding for recovery under O.R.C.

Section 9.24, or that the Independent Contractor has taken the appropriate remedial steps required under O.R.C.

Section 9.24, or otherwise qualifies under that section. The Independent Contractor agrees that if this representation and warranty is false, the Agreement shall be void ab initio as between the parties to this Agreement, and any funds paid by the ODPS hereunder shall be immediately repaid to the ODPS, or an action for recovery may be immediately commenced by the ODPS for recovery of said funds.

6. DEBARMENT: The Independent Contractor warrants that it is not currently subject to a finding by the Ohio Department of Administrative Services debarring the Independent Contractor from consideration for contract awards, and that Independent Contractor does not currently appear on any federal or State of Ohio debarment list. In the event that, during the course of this Agreement, the Independent Contractor is debarred from consideration for the contract awards by the Ohio Department of Administrative Services, or otherwise appears on any federal or State of Ohio debarment list, then the ODPS may terminate this Agreement immediately.

7. WORKERS’ COMPENSATION AND OTHER BENEFITS: The Independent Contractor and its employees shall be covered by workers' compensation coverage purchased and maintained by the Independent Contractor. In addition, the Independent Contractor should ensure that any subcontractors maintain workers' compensation insurance at all times during the term of this Agreement. Any workers' compensation claims filed by the Independent Contractor, or its employees or subcontractors, as a result of work performed under this Agreement is not covered under ODPS's workers' compensation insurance. The Independent Contractor is not entitled to any State employment benefits, including, but not limited to the Public Employees Retirement System of Ohio (OPERS), for work performed under this Agreement. The Independent Contractor acknowledges and agrees any individual providing personal services under this Agreement is not a public employee for purposes of Chapter 145 of the Revised Code.

PH (10/2024) Page 3 of 20

8. DRUG FREE WORKPLACE: The Independent Contractor certifies that to the best of his / her ability, all of his / her employees will not purchase, transfer, use, or possess illegal drugs or alcohol or abuse prescription drugs in any way while working on state property. Failure to comply may result in IMMEDIATE termination of this Agreement.

9. EQUAL OPPORTUNITY REQUIREMENTS:

A. The Independent Contractor, and any of its subcontractors, shall comply with the requirements under O.R.C. Section 125.111. The Independent Contractor, and any of its subcontractors, shall not discriminate against anyone because of race, color, religion, sex, age, disability, national origin, ancestry, or military status.

B. The Independent Contractor certifies that both the Independent Contractor and any of its subcontractors are in compliance with all applicable federal and state laws, as well as rules and regulations governing fair labor and employment practices.

C. The ODPS encourages both the Independent Contractor and any of its subcontractors to purchase goods and services from certified Minority Business Enterprise (MBE) and Encouraging Diversity Growth and Equity (EDGE) Independent Contractors.

10. CONFLICT OF INTEREST: The Independent Contractor shall not have any interest, direct or indirect, which is incompatible or in conflict with the carrying out of the terms of this Agreement.

11. CAMPAIGN CONTRIBUTIONS: The Independent Contractor hereby certifies that all applicable parties listed in Division (I) or (J) of O.R.C. Section 3517.13 are in full compliance with Divisions (I) and (J) of O.R.C. Section 3517.13.

12. OHIO ETHICS CLAUSE: Independent Contractor agrees to abide by all provisions of the Ohio Ethic’s Law, including O.R.C. 102.02, O.R.C. 102.03, O.R.C. 102.04 and O.R.C. 2921.42.

Pursuant to O.R.C. 102.03(A)(1) no present or former public official or employee shall, during public employment or service or for twelve months thereafter, represent a client or act in a representative capacity for any person on any matter in which the public official or employee personally participated as a public official or employee through decision, approval, recommendation, the rendering of advice, investigation, or other substantial exercise of administrative discretion.

Per O.R.C. 102.04 (D): The Independent Contractor affirms by his / her signature that:

(a) He / She is not elected or appointed to an office of or employed by the General Assembly or any department, division, institution, instrumentality, board, commission, or bureau of the State, excluding the Courts, OR

(b) The Independent Contractor affirms by his / her signature that he / she is a public official appointed to a non-elective office or is a public employee, but, is exempt from the provisions of O.R.C. 102.04

(A) or (B) because,

1. The Independent Contractor is supplying the good and / or services which are subject of the agreement to an agency other than the one with which he / she serves; AND

2. The Independent Contractor has filed the required statements with the following agencies:

a. The appropriate ethics commission; AND

b. The public agency with which he / she serves; AND

c. The public agency to whom the goods and / or services will be provided.

13. OPEN TRADE: Pursuant to O.R.C. 9.76 (B), Vendor warrants that the vendor is not boycotting any jurisdiction with whom the State of Ohio can enjoy open trade, including Israel, and will not do so during the term of this Agreement.

PH (10/2024) Page 4 of 20

14. EXECUTIVE ORDERS 2019-12D AND 2022-02D: The Independent Contractor affirms that it read and understands Executive Order 2019-12D, and agrees to abide by its requirements in the performance of this Agreement. The Independent Contractor agrees not to perform any services required under this Agreement outside of the United States. The Independent Contractor further agrees not to send, take, access, test, maintain, back-up, store, or remotely make available State data outside of the United States unless a duly signed waiver has been obtained from the State.

The Independent Contractor further affirms that it read, understands, and agrees to abide by Executive Order 2022-02D, which prohibits Ohio state agencies from purchasing from or investing in Russian institutions and/or companies. The Independent Contractor thus agrees that it will: a) disclose its principal business location(s) to ODPS during the provision of goods and services under this Agreement; and b) disclose the principal business location(s) of all

Sub-contractors that are providing goods and services (whether directly or indirectly) under the Agreement.

The Independent Contractor agrees to complete the Contractor/Subcontractor Affirmation and Disclosure Form that is attached to this Agreement. If any of the locations disclosed on the Affirmation and Disclosure Form change during the performance of this Agreement, the Independent Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

A. Termination, Sanction, Damages:

If Independent Contractor or any of its subcontractors perform services under this Agreement outside of the United States, or if the Independent Contractor otherwise violates the requirements of Executive Orders 2019-12D or 2022-02D, the performance of such services shall be treated as a material breach of the Agreement. The State is not obligated to pay and shall not pay for such services.

If Independent Contractor or any of its subcontractors perform services under this Agreement outside of the United States, Independent Contractor shall immediately return to the State all funds paid for those services. The State may also recover from the Independent Contractor all costs associated with any corrective action the State may undertake, including but not limited to an audit or a risk analysis, as a result of the Independent Contractor performing services outside the United States.

The State may, at any time after the breach, terminate the Agreement, upon written notice to the Independent Contractor. The State may recover all accounting, administrative, legal and other expenses reasonably necessary for the preparation of the termination of the Agreement and costs associated with the acquisition of substitute services from a third party.

If the State determines that actual and direct damages are uncertain or difficult to ascertain, the State in its sole discretion may recover a payment of liquidated damages in the amount of one percent (1%) of the value of the Agreement.

The State, in its sole discretion, may provide written notice to Independent Contractor of a breach and permit the Independent Contractor to cure the breach. Such cure period shall be no longer than twenty-one

(21) calendar days. During the cure period, the State may buy substitute services from a third party and recover from the Independent Contractor any costs associated with acquiring those substitute services.

Notwithstanding the State permitting a period of time to cure the breach or the Independent Contractor’s cure of the breach, the State does not waive any of its rights and remedies provided the State in this Agreement, including but not limited to recovery of funds paid for services the Independent Contractor performed outside of the United States or in violation of Executive Orders 2019-12D and/or 2022-02D, costs associated with corrective action, or liquidated damages.

B. Assignment / Delegation:

The Independent Contractor will not assign any of its rights, nor delegate any of its duties and responsibilities under this Agreement, without prior written consent of the State. Any assignment or delegation not consented to may be deemed void by the State.

PH (10/2024) Page 5 of 20

15. WORK FOR MULTIPLE STATE AGENCIES: The Independent Contractor attests that they are not a party to a current agreement, nor shall they enter into any other contracts, agreements, or renewals, to perform substantially identical work for the State of Ohio such that the work product contemplated under this contract duplicates the work done or to be done under the other contracts, without the approval of ODPS and the other contracting entity.

16. RESPONSIBILITY FOR CLAIMS: The Independent Contractor agrees to indemnify and hold the ODPS harmless from any and all claims for personal injury or property damage resulting from the fault or negligence of the Independent Contractor and from claims for wages or overtime compensation due its employees in rendering services under this Agreement, including payment of all costs in defense of any claim made under the Fair Labor Standards Act or any other federal or state law. In no event shall either party be liable to the other party for indirect, consequential, incidental, special, or punitive damages, or lost profits.

17. OWNERSHIP:

A. Any and all written, electronic, or multimedia documents, presentations, reports, studies, deliverables, and / or software developed under this Agreement (hereinafter referred to under this Section as “Deliverables”) shall become the property of the ODPS. The ODPS, and any person, agency, or instrumentality providing financial assistance for the work performed under this Agreement shall have an unrestricted right to reproduce, distribute, modify, maintain, and use the Deliverables. The Independent Contractor shall not obtain copyright, patent, or other proprietary protection for the Deliverables without the written approval of the ODPS, except that the Independent Contractor shall reserve its rights in all methods, pre-existing work, software, and data used to prepare the Deliverables. The Independent Contractor shall not include in any Deliverables any copyrighted matter, unless the copyright owner and any person, agency, or instrumentality providing financial assistance for the work performed under this Agreement gives prior written approval to use such copyrighted matter in the manner provided under this Agreement. The Independent Contractor must identify in writing, prior to the start of work under this Agreement, any and all proprietary, copyrighted, and / or patented materials it intends to use.

B. The Independent Contractor agrees that all Deliverables may be made freely available to the general public to the extent required by law.

C. This Section shall survive the termination of this Agreement and may be enforced by the ODPS in any court of competent jurisdiction.

18. GOVERNING CLAUSE: This Agreement and any claims arising out of this Agreement shall be governed by the laws of the State of Ohio. If any provision under this Agreement is later determined to be invalid or unenforceable, the remainder of this Agreement shall not be affected by such determination.

19. SUSPENSION AND TERMINATION:

A. The Independent Contractor or the ODPS may suspend or terminate this Agreement, with or without cause, by providing thirty (30) days written notice to the other party.

B. Any violations or breach of the terms stated herein, by the Independent Contractor, shall provide the ODPS with the option of canceling this Agreement in its entirety, or withholding payment until such time as the violation or breach is remedied. Such option shall in no way limit or exclude any other remedies available to the ODPS.

C. If either party fails to perform any of the requirements of this Agreement, or is in violation of a specific provision of this Agreement, then the non-breaching party may suspend or terminate this Agreement if the breaching party fails to cure its non- performance or violation within ten (10) business days following delivery of written notice of the breach. In the case of late payment by ODPS, however, the Independent Contractor may not suspend or terminate this Agreement unless the payment is more than sixty (60) days past due, and O.R.C. Section 126.30 shall apply.

PH (10/2024) Page 6 of 20

D. If this Agreement is suspended or terminated, the Independent Contractor shall cease work on the suspended or terminated activities, suspend or terminate all subcontractors relating to the suspended or terminated activities, take all necessary or appropriate steps to limit disbursement and minimize cost, and, if requested by the ODPS, furnish a report describing the status of all work under this Agreement, including results and conclusions accomplished, and such other matters as the ODPS may require. The requirements in this paragraph shall occur in accordance with the following:

1. If the Agreement is suspended or terminated by the ODPS, the requirements in Paragraph

19. D. of this Agreement shall commence upon the date the Independent Contractor receives notice of suspension or termination.

2. If the Agreement is suspended or terminated by the Independent Contractor, the requirements in Paragraph 19. D. of this Agreement shall commence upon the date the Independent Contractor sends notice of suspension or termination.

E. If this Agreement is suspended or terminated, the Independent Contractor, upon submission of a proper invoice, shall be entitled to compensation which shall be calculated by the ODPS according to Paragraph 3 of this Agreement for the work performed prior to the date on which the Independent Contractor either receives notice of termination or suspension or sends notice of suspension or termination, whichever is applicable, less any funds previously paid by, or on behalf of, the ODPS.

Regardless of which party terminates the Agreement, any payments made by the ODPS in which services have not been rendered by the Independent Contractor shall be prorated and returned to the ODPS. Such payment(s) must be sent to the ODPS within thirty (30) days of the date on which the Independent Contractor either receives notice of termination or suspension or sends notice of suspension or termination, whichever is applicable. The ODPS shall not be liable for any further claims.

20. ACKNOWLEDGEMENT AND NON-DISCLOSURE AGREEMENT: Independent Contractor agrees to have each individual to perform work under this Agreement sign the Contractor Acknowledgement and Non- Disclosure Agreement, before that individual begins such work.

21. ENFORCEMENT OF RIGHTS: The failure of ODPS to act with respect to a breach of this Agreement by

Independent Contractor or others does not constitute a waiver and shall not limit ODPS’ rights with respect to such breach or any subsequent breaches.

22. BACKGROUND CHECK: A routine background check, at ODPS expense, may be performed on the

Independent Contractor for assignment to this Agreement. The Independent Contractor may be required to complete a “Background Information Form” furnished by the ODPS. Failure to pass the background check will result in immediate dismissal.

23. ANTITRUST ASSIGNMENT: The Independent Contractor assigns to the ODPS all State and Federal antitrust claims and causes of action that relate to all goods and services provided for in this Agreement. Additionally, the State of Ohio will not pay excess charges resulting from antitrust violations by the Independent Contractor’s suppliers and subcontractors.

24. RECORD KEEPING: During the performance of this Agreement and for a period of three (3) years after its completion, the Independent Contractor shall maintain auditable records of all charges pertaining to this Agreement and shall make such records available to the ODPS, upon request and at such times as are commercially reasonable.

25. FORCE MAJEURE: If the State or Independent Contractor is unable to perform any part of its obligations under this Agreement by reason of force majeure, the party will be excused from its obligations, to the extent that its performance is prevented by force majeure, for the duration of the event. The party must remedy with all reasonable dispatch the cause preventing it from carrying out its obligations under this Agreement. The term “force majeure” means without limitation: acts of God, such as epidemics, lightning, earthquakes, fires, storms, hurricanes, tornadoes, floods, washouts, droughts, any other severe weather, or explosions; restraint of government and people; war; strikes; and other like events or any other cause that could be not reasonably foreseen in the exercise of ordinary care, and that is beyond the reasonable control of the party.

PH (10/2024) Page 7 of 20

26. CONFIDENTIALITY: Independent Contractor understands and acknowledges that ODPS is a government agency of the State of Ohio and as such is subject to Ohio Public Records law. Independent Contractor understands and agrees that in the event that any provision included in Independent Contractor’s offer or quote, or any other provisions applicable or incorporated into this Agreement conflict with the Ohio Public Records law, Ohio Public Records law will govern and this agreement will have no effect.

27. CHANGE OR MODIFICATION: This Agreement constitutes the entire agreement between the parties on the subject matter of this Agreement. This Agreement supersedes all prior agreements, understandings, or representations, whether oral or written, concerning the subject matter of this Agreement. Any changes or modifications of this Agreement shall be made and agreed to in writing and signed by the ODPS Director. The provisions outlined in these Terms and Conditions shall take priority over any inconsistent or conflicting provisions included in the Independent Contractor’s offer or quote, or any other provisions applicable to or incorporated into this Agreement.

28. CONTRACTORS PAID WITH FEDERAL FUNDS BY NON-FEDERAL ENTITY: If the Contractor will be paid

(whether in whole or in part) by ODPS with federal funds, the Contractor hereby affirms that it read, fully understands, and agrees to comply with all of the provisions set forth in the attached “Addendum for Contractors Paid with Federal Funds,” which is hereby incorporated by reference. In addition, such Contractor agrees to complete and return the 44 C.F.R. Part 18 - “Certification Regarding Lobbying” that is included in the Addendum.

29. DATA PRIVACY AND SECURITY: Contractor agrees to comply, and assume responsibility for compliance by its officers, employees, subcontractors, and agents, with the requirements set forth in the “Data Security and Privacy Terms,” which are labeled as Exhibit # 2 and both attached it and incorporated into the Agreement by reference.

Contractor must annually submit to ODPS a Service Organization Control Type 2 (“SOC2”) certification. The SOC2 audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within thirty (30) days of Contractor’s receipt of its audit results or by January 31st of each year, whichever date is first. The SOC2 certification must be sent to DataPrivacy-SOC2@dps.ohio.gov.

If contracted services involve credit card processing, PCI Service Level One certification from a PCI Counsel certified independent assessor must be provided.

IN WITNESS THEREOF the parties have executed this Agreement as of the day and year first written below.

Independent Contractor’s Signature D. Andrew Wilson, Director (Independent Contractor’s Typed Name) Ohio Department of Public Safety

Printed Name

Date: Date:

mailto:DataPrivacy-SOC2@dps.ohio.gov

PH (10/2024) Page 8 of 20

STANDARD AFFIRMATION AND DISCLOSURE FORM

EXECUTIVE ORDERS 2019-12D AND 2022-02D

State of Ohio's Response to Russia's Unjust War on the Country of Ukraine

AFFIRMATION AND DISCLOSURE FORM

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

The Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate "Not Applicable" in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

PH (10/2024) Page 9 of 20

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Contractor also affirms, understands and agrees that Contractor and its subcontractors are under a duty to disclose to the State any change or shift in location of services performed by Contractor or its subcontractors before, during and after execution of any contract with the State. Contractor agrees it shall so notify the State immediately of any such change or shift in location of its services.

The State has the right to immediately terminate the contract, unless a duly signed waiver from the State has been attained by the Contractor to perform the services outside the United States.

On behalf of the Contractor, I acknowledge that I am duly authorized to execute this Affirmation and Disclosure Form and have read and understand that this form is a part of any Contract that Contractor may enter into with the State and is incorporated therein.

Independent Contractor’s Signature

Printed Name

Date:

PH (10/2024) Page 10 of 20

Exhibit 1

Scope of Work

Independent Contractor shall provide fourteen (14) SmartSheet Licenses for a total of:

PH (10/2024) Page 11 of 20

Exhibit 2

DATA SECURITY AND PRIVACY TERMS

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms apply to all work, services, and personnel across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with these Terms as they apply to the services being provided to the State. The Contractor is responsible for maintaining information security in any environments under the Contractor’s management in accordance with these Terms.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contract means the contract entered into between the Contractor and the State to which these Terms are attached and/or incorporated.

2. Contract Data means State Data that the Contractor has access to, transmits, processes, possesses, creates or stores in providing services to the State.

3. Contractor means the person or entity with whom the State has entered into the Contract and, for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

4. Personally Identifiable Information as defined in the Ohio Revised Code means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics.

5. Security Event is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds that does not adversely impact or potentially impact Contract Data or information systems.

6. Security Incident means there is successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

7. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Confidential Data. All State Data is and will remain the property of the State and, unless specifically provided otherwise in the Contract, Contractor acquires no right, title, or interest in or to State Data.

8. Confidential Data means any type of data that is required to be protected by law or regulation, is intended for confidential use, and may not be copied or removed from the State’s operational control without authorized permission. Confidential Data includes data that, if compromised, may result in loss of life, serious injury, or other harm to an individual or group, or disruption to critical State operations. Confidential Data is included in the definition of Confidential Information in the Contract.

Confidential Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

PH (10/2024) Page 12 of 20

B. Student information under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45 CFR

Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards (PCI DSS);

G. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

9. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

At a minimum, the Contractor must maintain the security of Contract Data in accordance with the moderate level security baseline of the current published version of the National Institute of Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (NIST 800- 53). In the alternative, the Contractor may maintain the security of Contract Data in accordance with International Organization for Standardization 27001 (ISO 27001) if the Contractor implements the additional necessary controls to achieve compliance with the requirements of NIST 800-53. Hereinafter, references in these Terms to “NIST 800- 53" means both of the frameworks defined in this paragraph.

The Contractor must implement the information security policies, standards, and capabilities set forth in the Contract, support the State’s adherence to the State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards.

If the Contractor accesses the State’s facilities or networks, or provides products, solutions, or services that will be implemented or integrated in the State’s controlled environment, the Contractor must ensure its products, solutions, or services comply with State IT Security Polices and Standards, as appropriate (available at the link provided above in the definition of State IT Security Policies and Standards).

The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per the State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of Contract Data

The Contractor must maintain an information security program made up of policies, procedures, technical and organizational safeguards, and training designed to protect Contract Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect Contract Data, the Contractor must use due diligence to ensure that computer and telecommunications systems and services involved in storing, using, or transmitting Contract Data are https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

PH (10/2024) Page 13 of 20 secure and prevent Contract Data from unauthorized disclosure, modification, use, or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding Contract Data in addition to the confidentiality requirements in the Contract:

A. Assume all Contract Data is both confidential and critical for State operations.

B. Maintain, in confidence, Contract Data it may obtain, maintain, process, or otherwise receive from or through the State during the term of the Contract and pursuant to the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any Contract Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and subcontractors to sell, rent, lease, or disclose, any Contract Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of Contract Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to Contract Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of Contract Data.

G. Ensure that the Contractor’s internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of Contract Data, and periodically review and update these policies, plans, and procedures as needed.

All Contract Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations, ensuring physical and environmental protection controls are implemented as defined in State IT Security Policy 2100-15, and be handled in accordance with the requirements of these Terms at all Contractor locations. All Contract Data that is not classified as public by the State must be encrypted at rest and while in transit utilizing industry standards that meet Federal Information Processing Standards (FIPS) validated algorithms and comply with State IT Security Policy IT- 14, Securing Confidential Data.

If the Contractor will be accessing, processing, transmitting, possessing, creating, or storing Confidential Data, the State may require additional documentation from the Contractor and/or input to complete State documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq. (FISMA 2014) requirements and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

The Contractor’s information security program must be designed to protect Contract Data by implementing an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of Contract Data.

B. Protection against anticipated threats or hazards to the security or integrity of Contract Data.

C. Protection against unauthorized access to, disclosure of, or use of Contract Data.

D. Giving access to Contract Data only to those individual employees, officers, agents, and subcontractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperating with any attempt by the State to monitor compliance with the foregoing obligations as reasonably

PH (10/2024) Page 14 of 20 requested by the State.

F. Promptly destroying or returning to the State, in a format designated by the State, all Contract Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract. Notwithstanding the foregoing, the Contractor may keep a copy of the Contract Data to comply with contractual, legal, or record keeping obligations, and any such retained Contract Data is subject to the requirements of this Contract for so long as the Contractor has the Contract Data in its possession.

G. Maintaining appropriate and effective business continuity and disaster recovery plans to ensure resiliency of

Contract Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered Contract Data and Confidential Information under this Contract.

The Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, must promptly remediate vulnerabilities, and/or provide the State with patches to address the vulnerabilities at no cost to the State. The Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), the Contractor warrants that its software is free from viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of Contract Data is permitted as set forth in the Contract. Additionally, disclosure of Contract Data is also permitted when required by applicable law, regulation, court order, or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Confidential Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State within 24 hours of receipt of the order or request in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also cooperate in the State’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the State.

If, in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Contractor may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. If the Contractor provides a solution, service, or product hosted by the Contractor or a cloud provider, the Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation

PH (10/2024) Page 15 of 20

Engagements (SSAE) No. 18, Service Organization Control 2 Type 2 (SOC 2 Type 2). At any point during the term of the Contract and if not already obtained, the Contractor may obtain and must thereafter maintain StateRAMP or FedRAMP authorization in lieu of a SOC 2 Type 2 audit.

B. If Contractor provides a solution, service, or product hosted by the Contractor or a cloud provider that completes a financial duty on behalf of the State, the Contractor must obtain an annual audit of the services being provided under this Contract that meets the AICPA SSAE No. 18, Service Organization Control 1 Type 2 (SOC 1 Type 2).

C. The SOC 1 Type 2 and SOC 2 Type 2 audits will be completed at the sole expense of the Contractor and the results must be provided to the State within 30 days of the Contractor’s receipt of its audit results each year by emailing the results to Compliance@das.ohio.gov. The results of the audits provided to the State are considered Confidential Information under the Contract.

D. When required by law, rule, or regulation, or if the Contractor does not obtain or obtains an adverse opinion on the SOC 2 Type 2 audit described above, the State may, at any time in its sole discretion, elect to perform a security and data protection audit. This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will provide its request in writing and will work with the Contractor to schedule time to conduct the audit.

E. At no cost to the State, the Contractor must remedy material issues, material weaknesses, or other items identified in each audit as they pertain to the services provided under this Contract.

6. Background Investigations of Contractor Personnel

Any person who (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or

(c) has been convicted of a felony may not perform certain services under the Contract.

The Contractor must conduct background investigations on Contractor personnel that may have access to Contract Data. The State may conduct background investigations on Contractor personnel that have or may have access to Confidential Data, critical infrastructure systems, or when required by law, rule, or regulation. The State will conduct initial background investigations on Contractor personnel who will have access to FTI and/or CJI that must be favorably adjudicated before being permitted to access the FTI and/or CJI, and ongoing background investigations every five years thereafter for personnel who already have access to FTI and/or CJI.

If any Contractor personnel refuses to have a background investigation completed or has an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the Contract Data.

7. Security Incidents and Events

A. Categories Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one…