Box Licenses Project No. MIA-ITS-26-002-DMS/ eMMA#:BPM057287

STATE OF MARYLAND

MARYLAND INSURANCE ADMINISTRATION

MANAGEMENT INFORMATION SYSTEMSUNIT

SMALL PROCUREMENT SOLICITATION

FOR

BOX LICENSES

MIA PROJECT NUMBER MIA-ITS-26-002-DMS/eMMA#:BPM057287

NOTICE TO OFFERORS

SMALL BUSINESS RESERVE PROCUREMENT

Solicitation Issue Date:

Procurement Officer:

Tuesday June 2, 2026

Eunice Kariuki Office Phone: (410) 468-2225 Fax: (410) 468-2396 e-mail: procurement.mia@maryland.gov

Closing Date and Time: Monday, June 08,2026 at 10.00 AM

NOTICE

Prospective Bidders who have obtained this document from eMaryland Marketplace Advantage, or who have received this document from a source other than the Procurement Officer, and who wish to assure receipt of any changes or additional materials related to this Solicitation, should submit their name and contact information directly to the Procurement Officer so that amendments to the Solicitation or other communications can be sent to them.

MARYLAND INSURANCE ADMINISTRATION

SMALL PROCUREMENT

BOX LICENSES

SOLICITATION NUMBER MIA-ITS-26-002-DMS /eMMA#:BPM057287

SCOPE OF WORK

The Maryland Insurance Administration (MIA) is the independent State agency which regulates the insurance industry in Maryland. The MIA is issuing this Solicitation under its small procurement authority and expects to award one (1) contract for a term of one (1) year with no option to renew.

A. BACKGROUND

A. The MIA intends to procure 130 Box licenses for the document management aspect of the Agency’s new Salesforce-based ITS System. Box offers a centralized platform to optimize operations, improve customer engagement, and align with MIA’s strategic needs. More specifically, Box’s document management system (DMS) provides secure storage for large files and enables seamless management of documents and workflow processes, while integrating effortlessly with tools such as Microsoft Office and Adobe Pro. This comprehensive solution fosters real-time collaboration, ensures scalability, and enhances accessibility, empowering MIA teams to operate securely and effectively within the ITS system.

B. The State Contract Monitor for this Solicitation and the resulting Contract shall be Kaushik Dutta , Chief Information Officer, MIA or his/her successor as named by the MIA. The State Contract Monitor may be contacted at:

MIA

200 St. Paul Place, Suite 2700 Baltimore, MD 21202 Phone: (410) 468 2059 (Office) , (443) 839 1080 (Cell) Email: kaushik.dutta@maryland.gov

C. DELIVERABLES REQUIRED

The successful Bidder shall furnish 130 Enterprise Advanced Box Licenses – Annual.

D. ADDITIONAL REQUIREMENTS

1. PROFESSIONAL QUALIFICATIONS.

a. Pursuant to §7-201 et seq. of the Corporations and Associations Article of the Annotated

Code of Maryland, corporations not incorporated in the State shall be registered with the State Department of Assessments and Taxation, 301 West Preston St., Baltimore, Maryland 21201, before doing any interstate or foreign business in this State. Before doing any intrastate business in this State, a foreign corporation shall qualify with the Department of Assessments and Taxation.

b. The successful Bidder shall:

i. have, at the time of proposal submission, and maintain for the duration of the

Contract, a letter of Authorization from the manufacturer, Box, Inc.. Bidder mailto:kaushik.dutta@maryland.gov shall submit evidence of such authorization, as appropriate, with its Bid Price Sheet.

ii. have, at the time of proposal submission, and maintain for the duration of the Contract Maryland Small Business Reserve (SBR) Certification.

2. PLACE AND TIME FOR DELIVERY. The successful Bidder shall deliver all goods required under the Contract to:

Kaushik Dutta, Chief Information Officer Maryland Insurance Administration

200 St. Paul Place, Suite 2700 Baltimore, MD 21202

3. HOURS OF WORK. The successful Bidder shall deliver all goods required under the Contract between the hours of _8.00 AM __ on or before___4.30PM__Eastern Standard Time, unless otherwise authorized in writing by the State Contract Monitor.

4. FORM OF ACKNOWLEDGEMENT. At the time of delivery, the Contractor may require the State to acknowledge receipt of such goods in writing but such signature does not waive any rights, nor constitute acceptance of goods as is by the State. The State must notify the Contractor in writing within 30 days of the date of delivery of any shortages, deficiencies, or defects in the goods.

Contractor shall arrange, at its expense, to retrieve deficient or defective goods, and shall deliver (a) replacement(s) within one week of such notice. For software and information technology equipment supplied without installation, the State may perform acceptance tests within 30 days of receipt prior to acceptance and payment for each item delivered. The State does not assume ownership for equipment, nor do warranty periods begin, until the MIA accepts the Contractor’s product and work as fully operational.

5. PAYMENT.

A. PAYMENT RATE. The Contractor shall specify a firm fixed price for all goods required under this Contract. This rate is all inclusive, and is not subject to adjustment because of variations in the Contractor’s cost.

B. PAYMENT METHOD. The Contractor shall, as part of the Contract, agree to and exercise the following method of payment. Contractor shall submit an invoice to the MIA within 30 days of delivery of goods, unless otherwise directed by the Contract Monitor. All invoices shall specify the Contractor’s name, address, federal taxpayer identification number, describe the goods delivered including quantity, if applicable, the firm fixed price for the Contract, and the total amount billed. The invoice shall be remitted by the 15th day of the calendar month immediately following the month during which services were performed. For example, work performed June 1, 2026 through June 30, 2026, shall be billed on or before July 15, 2026.

6. TIME FOR PERFORMANCE. The resulting Contract will be for a one (1) year term, with no option to renew.

7. QUESTIONS. The Procurement Officer will accept written questions from prospective Bidders.

Such questions will be answered as quickly as is reasonably practicable and appropriate.

Questions may be submitted by e-mail to the Procurement Officer at procurement.mia@maryland.gov. All questions should be submitted in a timely manner to the Procurement Officer only. The Procurement Officer shall, based on the availability of time to research and communicate an answer, decide whether an answer can be given before the proposal due date. Answers to all substantive questions that have not previously been answered, and are not clearly specific only to the requestor, will be distributed to all potential Bidders who are known to have received a copy of the solicitation.

E. ADDITIONAL TERMS

1. RIGHTS TO RECORDS. The Contractor agrees that all documents, software, and materials, including but not limited to, reports, workpapers, studies, computations and data prepared by the Contractor for purposes related to this Contract, or developed by the Contractor in connection with this Contract shall be the sole property of the Administration, and shall be available to the Administration at any time. The Administration shall have the right to use the same without restriction and without compensation to the Contractor other than that specifically provided by this Contract. Notwithstanding anything to the contrary in this Contract, Contractor shall have the right to retain a copy of all its workpapers and administrative records but shall not be entitled to use such documents except for the benefit of the State of Maryland or the Contractor’s internal record keeping requirements.

2. NONDISCLOSURE AND CONFIDENTIALITY OF PROPRIETARY INFORMATION. In accordance with the Insurance Article of the Annotated Code of Maryland, the MIA and the Contractor agree that all workpapers, working papers, recorded information, documents and copies thereof, and all other information written or oral, produced by, obtained by or disclosed to the MIA and the Contractor in the course of providing the services contemplated by this Agreement ("Proprietary Information") shall be forever given confidential treatment, shall not be subject to subpoena and shall not be made public by the MIA or the Contractor, except in accordance with the provisions of the Maryland Public Information Act or other applicable laws. Proprietary Information shall not include information which (1) is or becomes available to the public other than as a result of a disclosure by the Contractor or its representatives; (2) was or becomes available to the Contractor on a non-confidential basis from a source other than the MIA, the company filing the data, or their respective representatives, provided that such source is not known by the Contractor to be bound by a confidentiality agreement with or other contractual, legal or fiduciary obligation of confidentiality to the MIA; (3) is developed by the Contractor independently of any disclosures of information by the MIA. The Contractor shall not release any information concerning the services provided pursuant to the Contract or any part thereof to any member of the public, press, business entity, or any official body unless prior written consent is obtained from the MIA. The Contractor further agrees not to use such Proprietary Information for any purpose other than the provision of services as contemplated by the Contract. The Contractor agrees that damages would not be a sufficient remedy for any breach of the Contract or the provisions of any amendment by the Contractor or its representatives and, thus, that, in addition to all other remedies, the MIA shall be entitled to seek specific performance and injunctive or other equitable relief as a remedy for any such breach. The Contractor also agrees to waive, and to use its best efforts to cause its representatives to waive, any requirement for the securing or posting of any bond in connection with any such remedy.

The Contractor shall be permitted to disclose Proprietary Information only to the Contractor’s employees who will have need of such data or information in connection with the performance of this Agreement. The Contractor shall clearly instruct such employees not to violate the confidentiality provisions contained herein, and the Contractor shall take appropriate steps to ensure that such obligations are fulfilled.

3. THIRD PARTY PATENTS, COPYRIGHTS, INTELLECTUAL PROPERTY. If the Contractor furnishes any design, device, material, process, or other item, which is covered by a patent or copyright or which is proprietary to or a trade secret of another, the Contractor shall obtain the necessary permission or license to permit the State to use such item or items. If any products furnished by the Contractor become, or in the Contractor's opinion are likely to become, the subject of a claim of infringement, the Contractor will, at its option and expense: (a) procure for the State the right to continue using the applicable item, (b) replace the product with a non-infringing product substantially complying with the item's specifications, or (c) modify the item so that it becomes non-infringing and performs in a substantially similar manner to the original item.

4. INDEMNIFICATION. The Contractor will defend or settle, at its own expense, any claim or suit against the State alleging that any such item furnished by the Contractor infringes any patent, trademark, copyright, or trade secret. If a third party claims that a product infringes that party’s patent, trademark, trade secret, or copyright, the Contractor will defend the State against that claim at Contractor’s expense and will pay all damages, costs and attorney fees that a court finally awards, provided the State (i) promptly notifies the Contractor in writing of the claim; and

(ii) cooperates with Contractor in the defense and any related settlement negotiations.

5. LOSS OF RECORDS. In the event of loss of any State data or records, where such loss is due to the intentional act or other action or omission in breach of the Agreement by Contractor or any of its subcontractors or agents, the Contractor shall be responsible for using commercially reasonable best efforts in recreating such lost data in the manner and on the schedule set by the Contract Monitor.

6. NONVISUAL ACCESS CLAUSE. The bidder warrants that the information technology offered under the bid: (1) provides equivalent access for effective use by both visual and nonvisual means; (2) will present information, including prompts used for interactive communications, in formats intended for both visual and nonvisual use; (3) if intended for use in a network, can be integrated into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired; and (4) is available, whenever possible, without modification for compatibility with software and hardware for nonvisual access. The bidder further warrants that the cost, if any, of modifying the information technology for compatibility with software and hardware used for nonvisual access will not increase the cost of the information technology by more than 5 percent. The phrase “equivalent access” means the ability to receive, use, and manipulate information and operate controls necessary to access and use information technology by nonvisual means. Examples of equivalent access include keyboard controls used for input and synthesized speech, Braille, or other audible or tactile means used for output.

7. Except to the extent such disclaimer is prohibited by law, and except as otherwise provided in this Agreement, there are no other warranties or conditions, including without limitation those of merchantability or fitness for a particular purpose, applicable to the services or work product.

8. For the avoidance of doubt, while MIA shall receive a license to use the Box DMS. Box and its applicable licensors shall own all rights, title and interest in and to all materials developed and/or delivered to MIA hereunder and all tools, libraries, know-how and expertise used to develop and deliver such materials and deliverables, but excluding any MIA Confidential Information, logos, trademarks or other intellectual property that may be included in such materials.

9. Nothing in this Agreement shall be deemed to create any agency or partnership between the MIA and Box, Inc., and neither party hereunder will have any authority to bind the other, to assume or create any obligation, to enter into an agreement, or to make any warranties or representations on behalf of the other.

10. TO THE EXTENT NOT PROHIBITED BY LAW, IN NO EVENT WILL EITHER PARTY OR ANY OF ITS AFFILIATES’ TOTAL AND CUMULATIVE LIABILITY, FOR ALL CLAIMS OF ANY NATURE ARISING OUT

OF THIS AGREEMENT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO BOX FOR THE SPECIFIC

USE OF THE BOX LICENSES GIVING RISE TO THE CLAIM IN THE TWELVE (12) MONTHS PRECEDING

THE EVENT FIRST GIVING RISE TO THE CLAIM UNDER THIS AGREEMENT. THE FOREGOING

LIMITATION DOES NOT LIMIT OR EXCLUDE ANY LIABILITY FOR: (A) DEATH OR PERSONAL INJURY

CAUSED BY NEGLIGENCE; OR (B) EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL

MISCONDUCT.

11. Please see the attached Information Technology (IT) Supplemental (Attachment C) for additional terms and conditions, which are incorporated by reference in the State Contract (Attachment A).

12. The Performing Entity shall be required to agree to the attached Data Use Agreement (Attachment D).

13. By submitting a Proposal in response to this solicitation, the Offeror, if selected for award, shall be deemed to have accepted the terms and conditions of this RFP, the IT Supplemental and the Contract, attached hereto as Attachment A – Sample Contract, and represents that the Performing Entity agrees to the terms and conditions of the required Data Use Agreement.

14. SMALL BUSINESS RESERVE PROCUREMENT NOTICE. This is a Small Business Reserve Procurement for which award will be limited to certified small business vendors. Only businesses that meet the statutory requirements set forth in State Finance and Procurement Article, §§ 14-501—14-505, Annotated Code of Maryland, and that are certified by the Department of General Services Small Business Reserve Program are eligible for award of a contract.

For the purposes of a Small Business Reserve Procurement, a small business is a for-profit business, other than a broker, that meets the following criteria:

A. It is independently owned and operated;

B. It is not a subsidiary of another business;

C. It is not dominant in its field of operation; and

D. Either:

(1) With respect to employees:

(a) Its wholesale operations did not employ more than 50 persons in its most recently completed 3 fiscal years;

(b) Its retail operations did not employ more than 25 persons in its most recently completed 3 fiscal years;

(c) Its manufacturing operations did not employ more than 100 persons in its most recently completed 3 fiscal years;

(d) Its service operations did not employ more than 100 persons in its most recently completed 3 fiscal years;

(e) Its construction operations did not employ more than 50 persons in its most recently completed 3 fiscal years; and

(f) The architectural and engineering services of the business did not employ more than 100 persons in its most recently completed 3 fiscal years; or

(2) With respect to gross sales:

(a) The gross sales of its wholesale operations did not exceed an average of $4,000,000 in its most recently completed 3 fiscal years;

(b) The gross sales of its retail operations did not exceed an average of $3,000,000 in its most recently completed 3 fiscal years;

(c) The gross sales of its manufacturing operations did not exceed an average of $2,000,000 in its most recently completed 3 fiscal years;

(d) The gross sales of its service operations did not exceed an average of $10,000,000 in its most recently completed 3 fiscal years;

(e) The gross sales of its construction operations did not exceed an average of $7,000,000 in its most recently completed 3 fiscal years; and

(f) The gross sales of its architectural and engineering operations did not exceed an average of $4,500,000 in its most recently completed 3 fiscal years.

Note: If a business has not existed for 3 years, the employment and gross sales average or averages shall be the average for each year or part of a year during which the business has been in existence.

Further information on the certification process is available at eMaryland Marketplace.

F. BID REQUIREMENTS AND BASIS FOR AWARD

1. PROPOSAL FORMAT. Under separate cover, the Offeror shall submit a Technical Proposal and Financial Proposal that meet the requirements specified below.

a. Technical Proposal. The Offeror shall submit a Technical Proposal that:

i. clearly indicates its intent to comply with the requirements of this Solicitation, the IT Supplemental, and Data Use Agreement.

ii. identifies in the transmittal cover letter any exceptions to this RFP or the

Contract and shall specify what language is sought to be added or deleted, as applicable, and include as an attachment in PDF form, any proposed licensing or other supplemental agreement(s). Supplemental agreements referenced by URL address or other link shall not be considered by the State; a PDF of the proposed document must be submitted with the Technical Proposal. All exceptions will be taken into consideration when evaluating the Offeror’s Proposal. The State reserves the right to accept or reject any exceptions.

Exceptions to terms and conditions, including requirements, may result in having the Proposal determined to be unacceptable or classified as not reasonably susceptible of being selected for award or the Offeror determined to be not responsible; and

iii. includes a copy of its Letter of Authorization from Box, Inc.

iv. No pricing information may be included in the Technical Proposal.

b. Financial Proposal. The Bidder shall submit:

i. a Financial Proposal Sheet using the attached form (Attachment B). The form shall be completed in its entirety and may not be altered. The Offeror should specify a single firm fixed price which will be the price paid for all licenses required under the Contract. Financial Proposal Forms that are incomplete, inaccurate, or are made on forms that have been altered, may be determined to be not reasonably susceptible of being selected for award and the Proposal rejected; and

ii. the Offeror shall include with its Financial Proposal a copy of the MSRP provided by Box, Inc.

2. SUBMISSION REQUIREMENTS.

i. Each proposal shall be submitted to the Procurement Officer by the date and time specified under “Closing Date and Time” on the solicitation cover page.

ii. Electronic submissions will be accepted. If electronic submissions are authorized, electronic copies will be deemed to be an original.

iii. Delivery method. Proposals shall be submitted electronically to the Procurement

Officer by submitting your response in e-Maryland Marketplace Advantage (eMMA).

The Technical Proposal and the Financial Proposal shall each be submitted separately.

3. MULTIPLE PROPOSALS. Multiple and alternative Proposals will not be accepted.

4. BEST AND FINAL OFFERS. When in the best interest of the State, the Procurement Officer may permit Offerors who have submitted responsive Proposals to revise their initial Proposals and submit, in writing, best and final offers.

5. BASIS OF AWARD. In accordance with COMAR 21.05.07.06D, this Contract will be awarded to the Offeror whose Proposal is determined to be most advantageous to the State.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.

ATTACHMENT A

STATE OF MARYLAND

MARYLAND INSURANCE ADMINISTRATION

SMALL PROCUREMENT CONTRACT

BOX LICENSES

PROJECT No. MIA-ITS-26-002-DMS / eMMA#:BPM057287_

This Contract (the “Contract”) is made by and between the State of Maryland, acting through the Maryland Insurance Administration (the “MIA”), located at 200 St. Paul Place Suite 2700, Baltimore, Maryland 21202, and __________________________________________________________________(the “Contractor), located at _________________________________________________________________.

In consideration of the promises and the covenants herein contained, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. Scope of Work. Contractor shall provide the services or goods as described in the solicitation document and the Contractor’s proposal/quote, which are incorporated by reference and attached hereto as Exhibits A and C, respectively. Contractor’s performance shall be in accordance with the terms and conditions of this Contract, and Exhibits A and B. If there are any inconsistencies between this Contract and Exhibits A through C, the terms of this Contract shall control. If there is any conflict among the Exhibits, the following order of precedence shall determine the prevailing provision.

a. Exhibit A – Solicitation No. ______________________, dated _________.

b. Exhibit B- IT Supplemental, dated ________________________________.

c. Exhibit C – Contractor’s Proposal/quote, dated ______________________.

2. Contract Term. The Contract term shall be for a period of one (1) year, commencing ___________________________ and concluding at 11:59 pm on ___________________.

3. Compensation and Method of Payment.

a. Compensation. Contractor shall be paid in accordance with the terms of the Contractor’s Proposal (Exhibit B) for all work satisfactorily performed. Payment is conditioned upon approval of the invoice by the State Contract Monitor, who shall determine in his/her sole discretion whether performance is satisfactory. The total compensation for services to be rendered by the Contractor shall not exceed $_______________.

b. Invoices. Invoices shall include the Contractor’s name, address, taxpayer identification number, MIA Contract Number, the date of the invoice, a description of services rendered or goods delivered, the dates of service or delivery, itemized fees, and a total amount due. Invoices shall be submitted to the Contract Monitor within 30 days after the date services are delivered or completed for approval.

c. Time for Payment. The MIA shall pay the Contractor no later than thirty days after the Agency receives a proper invoice from the Contractor which is approved by the State Contract Monitor.

Charges for late payment of invoices, other than as prescribed by Title 15, Subtitle 1, State

Finance and Procurement Article, Maryland Code, are prohibited.

4. Tax Identification Number. The Contractor's federal tax Identification (Employer Identification or Social Security, as applicable) number is __________________________.

5. Procurement Officer. The Procurement Officer shall be responsible for all matters related to the interpretation of this Contract. The Procurement Officer for this Contract is Eunice Kariuki, or her successor as named by the MIA. Notices shall be submitted to the Procurement Officer at procurement.mia@maryland.gov or by mail to Procurement Unit, Maryland Insurance Administration, 200 St. Paul Place, Suite 2700, Baltimore, MD 21202.

6. Contract Monitor. The State Contract Monitor shall be responsible for overseeing the Contractor’s performance required under the Contract and approving invoices. The State Contract Monitor for this Contract shall be Kaushik Dutta or his/her successor as designated by the MIA.

7. Disputes. Disputes arising under this Contract shall be governed by State Finance and Procurement Article, Title 15, Subtitle 2, Part III, Annotated Code of Maryland, and by COMAR

21.10 Administrative and Civil Remedies. Pending resolution of a dispute, the Contractor shall continue to perform this Contract, as directed by the Procurement Officer.

8. Termination for Convenience. The State may terminate this Contract, in whole or in part, without showing cause upon prior written notification to the Contractor specifying the extent and the effective date of the termination. The State will pay all reasonable costs associated with this Contract that the Contractor has incurred up to the date of termination, and all reasonable costs associated with termination of the Contract. However, the Contractor may not be reimbursed for any anticipatory profits that have not been earned up to the date of termination.

Termination hereunder, including the determination of the rights and obligations of the parties, shall be governed by the provisions of COMAR 21.07.01.12(A)(2).

9. Termination for Default. Termination for Default. If the Contractor does not fulfill obligations under this Contract properly and on time or otherwise violates any provision of this Contract, the Department or Agency may terminate the Contract by giving the Contractor written notice of termination. The notice shall specify the acts or omissions relied upon as cause for termination. The State may, at its option, take possession of all finished or unfinished work provided by the Contractor and use such work pursuant to the licensing terms in the MIA Solicitation. The State shall pay the Contractor fair and equitable compensation for satisfactory performance prior to receipt of notice of termination, less the amount of damages caused by the Contract breach. If the damages are more than the compensation payable to the Contractor, the Contractor will remain liable after termination and the State can affirmatively collect damages. Termination under this paragraph does not relieve the Contractor from liability for any damages caused to the State. Termination hereunder, including the rights and obligations of the parties, shall be governed by the provisions of COMAR 21.07.01.11B.

10. Termination for Nonappropriation. If funds are not appropriated or otherwise made available to support continuation in any fiscal year succeeding the first fiscal year, this Contract shall be terminated automatically as of the beginning of the fiscal year for which funds are not available.

The Contractor may not recover anticipatory profits or costs incurred after termination.

11. Maryland Law Prevails. The law of Maryland shall govern the interpretation and enforcement of this Contract.

12. Anti-Bribery. The Contractor certifies that, to the Contractor’s best knowledge, neither the Contractor; nor (if the Contractor is a corporation or partnership) any of its officers, directors, partners or controlling stockholders; nor any employee of the Contractor who is directly involved in the business’s contracting activities, has been convicted of bribery, attempted bribery, or conspiracy to bribe under the laws of any state or of the United States.

13. Nondiscrimination. The Contractor shall comply with the nondiscrimination provisions of federal and Maryland law. The Contractor shall also comply with the provisions concerning Commercial Nondiscrimination set out in State Finance and Procurement Article, Title 19, Annotated Code of Maryland.

14. Compliance with Laws. The Contractor hereby represents and warrants that it:

a. is qualified to do business in the State and that it will take such action as, from time to time hereafter, may be necessary to remain so qualified;

b. is not in arrears with respect to the payment of any monies due and owing the State, or any department or unit thereof, including but not limited to the payment of taxes and employee benefits, and that it shall not become so in arrears during the term of this Contract;

c. shall comply with all federal, State and local laws, regulations, and ordinances applicable to its activities and obligations under this Contract; and

d. shall obtain, at its expense, all licenses, permits, insurance, and governmental approvals, if any, necessary to the performance of its obligations under this Contract.

15. Modifications. This Contract may be amended only with the written consent of both parties.

Amendments may not significantly alter the scope of the Contract or significantly increase the Contract price.

16. Responsibility for Performance. The State acknowledges that certain deliverables may be provided by or through the software manufacturer or a third-party service provider (each, a "Performing Entity"). Notwithstanding the foregoing, Contractor remains primarily and fully responsible to the State for the satisfactory performance of all services and the fulfillment of all obligations under this Contract.

17. Mandatory Flow-Down. The Contractor shall incorporate the following provisions in the State Contract, and the listed documents which are incorporated by reference in the State Contract, either by reference or explicit inclusion, into any subcontract, purchase order, statement of work, or agreement with a Performing Entity:

A. MIA Solicitation, dated June 1, 2026;

B. State Contract Sections 1, 3, and 10 through 16; and C. the IT Supplemental in full; and D. the Data Use Agreement.

IN WITNESS WHEREOF, the Parties have executed this Contract as of this ____day of ________, 2026.

(Insert Contractor name) MARYLAND INSURANCE ADMINISTRATION

BY:________________________________ BY:____________________________________

Marie Grant, Commissioner or her Designee

Name

Title

For Contractor:

Witnessed by

(signature) (print name)

Reviewed for legal sufficiency as of this ____ day of ____________, 2026.

(signature) Assistant Attorney General

ATTACHMENT B

MARYLAND INSURANCE ADMINISTRATION

SMALL PROCUREMENT

FINANCIAL PROPOSAL

PRICE SHEET

BOX LICENSES

PROJECT No. MIA-ITS-26-002-DMS/ eMMA#:BPM057287 _

The Contractor must specify a firm fixed price. This form must be completed in its entirety and may not be altered in any way. A proposal may be determined not reasonably susceptible of being selected for award, and the proposal rejected if the form is altered in any way, incomplete, or not properly completed.

BASIS OF AWARD:

TOTAL FIRM FIXED PRICE for 130 Licenses:

Firm Name: ________________________________________________

Contractor’s Representative: _____________________________________

Signature: __________________________________________________

Date: _______________________________________________________

Federal Tax I.D. # _____________________________________________

Attachment C IT Supplemental

Information Technology (IT) Supplemental

Negotiated IT Supplemental# MIA/ITS-26-003S-DMS Revised Date: May 22, 2026

Negotiated May 22, 2026

This supplemental contains additional requirements under Section 2 of the solicitation.

1.1 Deliverables

A. For every consulting services deliverable defined in the applicable SOW, the Contractor shall request the Contract Monitor confirm receipt of that deliverable by sending an e-mail identifying the deliverable name and date of receipt.

B. A standard deliverable review cycle for consulting services deliverables will be elaborated and agreed-upon between the State and the Contractor under a SOW. This review process is entered into when the Contractor completes a deliverable.

1.1.1 Deliverable Acceptance

Reserved

1.1.2 Minimum Deliverable Quality

Reserved

1.1.3 Deliverable Descriptions/Acceptance Criteria

Reserved.

1.2 Contractor-Supplied Hardware, Software, and Materials

A. Cloud based applications shall be accessible from various client devices through a thin client interface such as a Web browser or a program interface.

B. The Contractor may, to the extent required to perform services under the Contract, operate in MIA’s production environment upon authorization to operate (ATO) from the State.

C. In regard to consulting services, Contractor warrants that: (a) Contractor and any Contractor personnel, that provides and performs consulting services hereunder has the necessary knowledge, skills, experience, qualifications, and resources to provide and perform the consulting services; and (b) the consulting services will be performed for and delivered to the State in a professional and workmanlike manner. In addition to any remedy that may be available under the State of Maryland’s dispute resolution process set forth in State Finance and Procurement Article, Title 15, Subtitle 2 and the Code of Maryland Regulations (COMAR) 21.10, and if through no fault or delay of the State the consulting services do not conform to the foregoing warranty, and the State notifies Consultant in writing within thirty (30) days of Consultant’s delivery of the consulting services, Consultant will re-perform the non-conforming portions of the consulting services at no cost to the State.

1.3 Product Requirements

A. Bidders/Offerors proposing to resell services of another entity must be authorized by such other entity.

B. No international storage or processing for State Data: Bidders/Offerors are advised that any processing or storage of data outside of the continental U.S. is strictly prohibited. Refer to section 1.6.2 for more detailed description.

C. Reserved.

D. Any terms of use or other agreement applicable to the Bidder’s/Offeror's proposed services must be contained in the Bidder’s/Offeror’s Technical Proposal. The State is not subject to any terms of use or other agreement applicable to the Bidder’s/Offeror’s proposed services unless the same are explicitly agreed to by the State during the Proposal evaluation process.

E. The State does not recognize and is not subject to any auto-renewal of services provision that may be contained or provided for in any Contractor agreements.

1.4 Required Project Policies, Guidelines and Methodologies

The Contractor must comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically, including, but not limited to the MIA’s Information Technology Security Policy (Attachment C) and the following:

Reference Regulations, Policies, Guidelines and Methodologies

A https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx

B https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx https://doit.maryland.gov/policies/ci/Pages/default.aspx https://doit.maryland.gov/policies/ci/Documents/MD-POL-205-01-Data-Protection-and-Privacy-Policy.pdf https://doit.maryland.gov/policies/ci/Documents/MD-POL-209-01-Incident- Response-Policy.pdf https://doit.maryland.gov/policies/ci/Pages/prohibited-offshore-resources-personnel-contractors.aspx https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-state-governments.aspx

C https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory- Standards.aspx

D https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx

E The Contractor shall follow project management methodologies consistent with the most recent edition of the Project Management Institute’s Project Management Body of Knowledge Guide.

https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx https://doit.maryland.gov/policies/ci/Pages/default.aspx https://doit.maryland.gov/policies/ci/Documents/MD-POL-205-01-Data-Protection-and-Privacy-Policy.pdf https://doit.maryland.gov/policies/ci/Documents/MD-POL-205-01-Data-Protection-and-Privacy-Policy.pdf https://doit.maryland.gov/policies/ci/Documents/MD-POL-209-01-Incident-Response-Policy.pdf https://doit.maryland.gov/policies/ci/Documents/MD-POL-209-01-Incident-Response-Policy.pdf https://doit.maryland.gov/policies/ci/Pages/prohibited-offshore-resources-personnel-contractors.aspx https://doit.maryland.gov/policies/ci/Pages/prohibited-offshore-resources-personnel-contractors.aspx https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx

F Hardware and Software hardening procedures by Center for Internet Security (CIS) guides https://www.cisecurity.org/ or Security Requirements Guides (SRG) http://www.nist.gov

G

Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-3:

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards

H Purchasing and Recycling Electronic Products https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

1.5 Disaster Recovery and Data

1.5.1 Redundancy, Data Backup and Disaster Recovery

A. Unless specified otherwise, throughout the Contract term, the Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other Confidential Information, Contractor’s processing capability and the availability of hosted services. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

B. The Contractor shall have robust contingency and disaster recovery (DR) plans in place to minimize disruption of the services provided under the Contract in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall take all reasonable steps to ensure that the manufacturer maintains a DR site during the contract term.

2) The DR site shall be at least 100 miles from the same disaster that affects the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

C. The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within 24 hours from notification, with a recovery point objective of one hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

D. The Contractor shall test the contingency/DR plans at least annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

E. Such contingency and DR plans shall be available for the State to inspect and practically test at any reasonable time.

1.5.2 Data Ownership and Access

https://www.cisecurity.org/ http://www.nist.gov/ https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

A. As set forth in the Contract, State data and Confidential Information disclosed by the State is the property of the State. The purchasing State agency is considered the custodian of all State data. The use, access, and distribution of all data shall comply with the requirements of the Data Use Agreement (Attachment Y) when agreed by the parties.

B. The Contractor may not access State data other than as necessary to perform the services under this Contract or as required by applicable law or regulation.

C. The Contractor shall limit access to and use of State data to Contractor Personnel whose responsibilities require such access or use and shall train such Contractor Personnel on the confidentiality obligations.

D. At no time shall any data be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State, except as otherwise authorized in writing by the State or required by applicable law or regulation.

E. The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services or for improving the services.

F. Provisions in Section 1.5.1-1.5.2 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Section 1.5.1-1.5.2 (or the substance thereof) in all subcontracts.

1.6 Security Requirements

The following requirements are applicable to the Contract:

1. Employee Identification.

The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

2. Criminal Background Check

The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

Where legally permitted and in accordance with local law and custom, Contractor and Performing Entity shall perform the following background checks for any personnel who may have access to State Data in the course of performing services in connection with the State Contract:

(a) For US-based employees, on hire, Contractor’s background checks include: SSN Trace, Criminal County and Federal Search (7-Year Address History), Multi-State Instant Criminal Check, Nationwide Sex Offender Registry Check, OFAC Check, OIG/GSA Combined Search, and Education Verification. Contractor also uses E-Verify and confirms employment eligibility via the Form I-9 for all employees.

(b) For Subprocessors, Contractor’s policy is to require Subprocessors to perform background checks for their personnel who may have access to State Data in the course of performing services for Contractor in accordance with applicable local laws and customs, to the extent related directly to the Box Service. However, in all instances, subprocessors must complete a criminal background check for any personnel who may have access to State Data, and such background check must include, at minimum: SSN Trace, Criminal County and Federal Search (7-Year Address History), Multi-State Instant Criminal Check, Nationwide Sex Offender Registry Check, OFAC Check, OIG/GSA Combined Search, and Education Verification. Contractor also uses E-Verify and confirms employment eligibility via the Form I-9 for all employees.

(c) The Contractor shall securely maintain a copy of any report resulting from the actual criminal background check and shall provide the Contract Monitor with certification of completion of the required criminal background check described above for each required Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check. The State reserves the right to request a copy of such report.

(d) Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check.

Decisions of the Contract Monitor as to acceptability of a candidate are final.

(e) Contractor Personnel that would have access to systems supporting the State or to State data who have been convicted of a felony or convicted of a crime involving telecommunications and electronics or convicted within the past five (5) years of a misdemeanor involving fraud, burglary or theft, violence, a crime involving telecommunications and electronics, or abuse of public funds or bribery of a public official shall not be permitted to work on the Contract.

1.6.1 Information Technology Security

A. Contractors shall comply with and adhere to the State IT Security Manual, Policies and Standards, and the MIA’s Information Technology Security Policy. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: Policies & Guidance - Department of Information Technology. The MIA agrees to accept FedRamp certification as evidence of meeting the minimum standards set forth in the State’s policies and provides the MIA with a copy of such certification along with its SOC 2 Type 2 Report (See Section 1.6.6 for additional information for SOC 2 Requirements).

https://doit.maryland.gov/policies/Pages/default.aspx https://doit.maryland.gov/policies/Pages/default.aspx

Negotiated IT Supplemental# MIA/ITS-26-003S-DMS Revised Date: May 22, 2026

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State as directed and coordinated with the Contract Monitor.

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 1.6.5)

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws applicable to Contractor’s provision of the services as well as the terms and conditions of the Contract; and

3) Ensure compliance with all federal, State, and local laws, rules and regulations concerning security of Information Systems and Information Technology to the extent applicable to Contractor’s provision of the services.

1.6.2 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract according to a written security policy (“Security Plan”) no less rigorous than that of the State and using best practices that comply with an accepted industry standard, such as the NIST cybersecurity framework.

1) The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract. Such Security Plan shall be provided to the State for its review with solicitation response. If awarded a contract, the Security Plan shall be provided on an annual basis or whenever updates are made.

2) Upon request, the Contractor shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

3) Reserved.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls during the Contract Term (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not utilized in test or training environment(s).

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides, Security Technical Implementation Guides (STIG), or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is logically separated from non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise agreed in writing, the Contractor is responsible for the encryption of all Sensitive Data.

5) Apply data encryption to all State data when the data is in transit over untrusted network segments.

6) Utilize encryption algorithms for encrypting data that comply with current Federal Information Processing Standards (FIPS), “Security Requirements for…