State of Illinois Participating Contract v.26.1

The Parties to this Participating Addendum ( A Contract ) are the State of Illinois acting through the undersigned Agency (collectively the State) and the Vendor. This Contract, consisting of the signature page and numbered sections listed below and any attachments referenced in this Contract, constitute the entire contract between the Parties concerning the subject matter of the Contract, and in signing the Contract, the Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest attached hereto are true and accurate as of the date of the

Contract. This Contract supersedes all prior proposals, contracts and understandings between the Parties concerning the subject matter of the Contract. This Contract can be signed in multiple counterparts upon agreement of the Parties. Cooperative Contract means the agreement between the lead entity and the vendor as facilitated by the cooperative.

26-448DOIT-INFOT-P-97276

v.26.1

If additional space is necessary to provide subcontractor information, please attach an additional page.

This is an indefinite quantity Joint Purchase Master Contract.

The PA will have an initial term commencing upon execution and ending on 1/18/2029. the Master Agreement: Subscription-based Service up to then-current Master Agreement e date and extend to one year thereafter.

In no event will the maximum total term of the PA, including the initial term, any renewal terms, and any extensions, exceed ten (10) years.

Vendor shall not commence billable work in furtherance of the PA prior to final execution of the PA except when permitted pursuant to 30 ILCS 500/20-80.

Failure by either Party to perform its duties and obligations will be excused by unforeseeable circumstances beyond its reasonable control and not due to its negligence, including acts of nature, acts of terrorism, riots, labor disputes, fire, flood, explo Vendor non-performance due to a Force Majeure Event, Vendor must promptly notify the State in writing describing the Force Majeure Event, the expected duration of the inability to perform, and any action being taken to mitigate the effect of the event. During the period of non-performance, the Vendor shall explore all reasonable alternatives to fulfill the Contract. The State may terminate this Contract in whole or in part without penalty if performance does not resume within thirty (30) days of the declaration. This provision shall not excuse: (a) late delivery of goods specifically manufactured or sourced for this Contract, if such goods are readily obtainable from other sources in a timely manner; or

(b) any failure to implement disaster recovery or business continuity procedures where the implementation of such procedures would be reasonable, industry standard, or obligation to resume full performance when the Force Majeure Event no longer causes an inability to perform. If a Force Majeure Event causes a shortage of materials or resources, Vendor requirements first before any allocation to other customers.

Vendor affirms that it checks the criminal records of all applicants for felony convictions and misdemeanor convictions involving a violent act or threat of violence within five (5) years prior to employment, where permitted by law.

VENDOR

Vendor Name: Gartner Inc. Address (City/State/Zip): 56 Top Gallant Rd, Stamford, CT 06902-7700

Phone: +12399008432

Printed Name: Alexandra Canizales Email: americascontracts@gartner.com

Title: Asst Contracts Manager Date:

Signature:

STATE OF ILLINOIS

Purchasing Agency: Department of Innovation and Technology Phone: Click here to enter text.

Street Address: 120 W. Jefferson Email: ALL NOTICES TO: DoIT.PSVM@Illinois.gov and DoIT.GeneralCounsel@Illinois.gov

City, State ZIP: Springfield, IL 62702

Official Signature: Date:

Printed Name: Brandon Ragle

Secretary and State CIO

Legal Signature: Date:

Legal Printed Name: Mary Feagans

Chief Fiscal Officer

Fiscal Signature: Date:

Radhika Lakhani

General Counsel

26-448DOIT-INFOT-P-97276

warren.a.wilke Stamp

AGENCY USE ONLY NOT PART OF CONTRACTUAL PROVISIONS

Agency Reference #: R-304698

Project Title: Procurement Assistance and Supportive Services (PASS)

Contract #:

Procurement Method (IFB, RFP, Small Purchase, etc.): Cooperative

Participation BidBuy / Bulletin Reference #: B-52539

BidBuy / Bulletin Publication Date: 5/21/26

Award Code: M - Cooperative Participation Subcontractor Utilization? Yes No Subcontractor Disclosure? Yes No

Funding Source:

Obligation #:

Small Business Set-Aside? Yes No Percentage:

Minority Owned Business? Yes No Percentage: 11%

Women Owned Business? Yes No Percentage:

Persons with Disabilities Owned Business? Yes No Percentage:

Veteran Owned Small Business? Yes No Percentage:

Other Preferences?

State of Illinois Chief Procurement Office for General Services Appendix S1 Minimum Logging Requirements V.26.1

Appendix S1 Minimum Logging Requirements

1. Input and Output Validation Events

1.1 The system shall log all input validation failures, including protocol violations, unacceptable encodings, malformed data, and invalid or out-of-range parameters.

1.2 The system shall log all output validation failures, including unexpected data structures, encoding mismatches, data type errors, or inconsistent record sets.

2. Authentication and Access Control

2.1 The system shall log all authentication attempts, including successes, failures, account lockouts, MFA challenges, and MFA failures.

2.2 The system shall log all authorization failures (ie. failed MFA, wrong password, account lockout, account disabled, etc.) and denied access attempts to protected resources or functions.

2.3 The system shall log all session management events, including session creation, termination, timeout, token anomalies, and any modification of session identifiers.

2.4 The system shall log all password reset actions including, but not limited to reset requests, reset completions, and failed reset attempts.

2.5 The system shall log all security related profile changes including, but not limited to MFA device added or remove, update to MFA type, MFA reset actions, and MFA type addition or change.

3. System and Application Events

3.1 The system shall log all application errors and exceptions, including syntax, logic, runtime, and unhandled errors.

3.2 The system shall log connectivity issues, third-party service failures, and file system errors.

3.3 The system shall log all virus or malware detections, blocked file uploads, and quarantine actions.

3.4 The system shall log all configuration changes to system, application, or security settings.

3.5 The system shall log all system and application startup, shutdown, restart, and logging service initialization events (start, stop, or pause).

4. Privileged and Administrative Activity

4.1 The system shall log all use of administrative or elevated privileges.

4.2 The system shall log the creation, modification, disabling, or deletion of user accounts or groups.

4.3 The system shall log changes to privileges, roles, tokens, access rights, or identity mappings.

4.4 The system shall log the use of system-level administrative functions, command execution, and high-risk application actions.

4.5 The system shall log access to or use of data-encrypting keys, including key creation, rotation, and destruction.

4.6 The system shall log the creation or deletion of system-level objects, datasets, or protected configuration files.

State of Illinois Chief Procurement Office for General Services Appendix S1 Minimum Logging Requirements V.26.1

5. Data Access and High-Risk Operations

5.1 The system shall log all access to sensitive or regulated State data, including financial, personal, or cardholder data.

5.2 The system shall log all data import, export, bulk transfer, or generation of system-level reports.

5.3 The system shall log all submission or upload of user-generated content, including files or attachments.

5.4 The system shall log application-initiated network connections or outbound data transmissions.

6. Legal and Consent Events

6.1 The system shall log acceptance of terms of use, privacy notices, data usage statements, disclaimers, or other legal agreements.

6.2 The system shall log all user opt-ins or consent for mobile device capabilities, personal data usage, marketing communications, or other regulated actions.

General Requirements

7. Timestamping

7.1 All logs shall include accurate timestamps synchronized to a reliable time source (e.g., NTP).

7.2 All timestamps shall use a consistent time standard across all systems.

8. Log Integrity

8.1 Logs shall be protected against unauthorized modification or deletion.

8.2 The system shall generate integrity controls (e.g., hashing, checksums) to detect tampering.

9. Correlation

9.1 Logs shall contain sufficient detail to support event reconstruction, including at minimum: user or service account ID, session ID, source IP address, event type, resource accessed, and action taken.

10. Retention

10.1 Logs shall be retained in accordance with the Security Policies and applicable laws or regulations.