Virginia Wildlife Magazine Fulfillment Services DWR Cloud Solution.docx

Exhibit X - CLOUD SERVICES additional Contract terms and conditions-Supplier is application owner

Table of Contents

Contract No. _________ Page ii

Exhibit x - cloud SERVICEs additional contract terms and conditions-SUPPLIER IS APPLICATION OWNER

These additional terms and conditions for provision of Software as a Service, as part of Supplier’s contractual obligations for an overall solution provided by the Supplier are in support of and incorporated herewith under Contract No. ___________. This Exhibit (“Exhibit”) sets forth additional terms and conditions under which Supplier shall provide such Licensed Services (“Licensed Services”) to DWR.

Definitions Acceptance Successful delivery and performance by the Supplier of its contractual commitments at the location(s) designated in the Contract, including completed and successful Acceptance testing in conformance with the requirements of the Contract.

Application The software programs in object code and other related data, including intellectual data, proprietary information and Documentation contained and applicable to Licensed Services hosted and supported by Supplier under the Contract, as described in Exhibit X of the Contract, including any Updates, enhancements, and replacements to the Application.

Application Users Application User(s) include employees of DWR), independent contractors engaged by DWR, or entities contracting with DWR for services. Application User(s) also include customers, suppliers, members of the general public, and other entities with whom DWR may find it necessary or desirable to process or communicate electronically in pursuit of its business.

Content Any data, including the selection, arrangement and organization of such data, entered, uploaded to the Application, or otherwise provided to Supplier by DWR or by any Application User, and any software and related documentation, from whatever source, provided by DWR or Application User to Supplier in connection with this Contract.

Customization Inventions, modifications, combinations, methods, formulae, techniques, processes, improvements, designs, computer programs, strategies, specific computer-related know-how, data and original works of authorship discovered, created or developed by Supplier for DWR in the performance of this Contract.

Licensed Services The operation of the Application and the necessary operating system software, hardware and utilities on Supplier’s host computer system, furnishing Supplier Product to Application Users, storing Content and making the Application, Content, and Supplier Product available to Application User(s) via the Web Site, as more fully described in Exhibit X.

Project Onset The period after the Licensed Services or “software-as-a-service” delivery model is deployed by Supplier but prior to the hosting of any Commonwealth of Virginia (COV) data or other Content by Supplier.

Supplier Product Supplier’s proprietary reports, information and data made available to DWR and its Application Users as part of the Licensed Services.

Update As applicable, any update, modification or new release of the Application, documentation or Supplier Product that Supplier makes generally available to its customers at no additional cost. Software Updates include patches, fixes, upgrades, enhancements, improvements, or access mode, including without limitation additional capabilities to or otherwise improve the functionality, increase the speed, efficiency, or base operation of the Application and Licensed Services.

VITA

Virginia Information Technologies Agency.

Web Site The Internet site operated by Supplier to provide access to the Application, with the Uniform Resource Locator (URL) specified in Exhibit X (or any successor URL(s)).

Term and Termination A. Scalability DWR may make a written request to increase or decrease the scope (e.g., number of USERIDs) of Licensed Services (“revised usage”) under a change order to the Contract. The revised usage shall be effective not more than one (1) business hour following the request. Pricing for the revised usage of Licensed Services shall be calculated as provided in the Pricing Schedule of the Contract and shall be prorated on a daily basis for remaining portion of the current monthly billing period. For purposes of this provision, a written notice may include an e-mail or the use of a Supplier-provided provisioning website by DWR designated administrator.

Description of Licensed Services During the term of this Contract, Supplier hereby agrees to host the Application(s) listed and described and specified in the Contract on servers owned, operated, housed, and maintained by Supplier and shall make such Application(s) available to DWR designated Application Users through the Internet. Supplier has acquired any and all license rights in the Application(s) necessary and appropriate for Supplier to provide the Licensed Services as obligated by the Contract.

Supplier hereby grants to DWR and its Application Users a non-exclusive, transferable, worldwide license to access and use by any method the Application during the term of the Contract. The license fee for the rights shall be as set forth in the Pricing Schedule of the Contract, and shall apply regardless of access mode.

DWR is an agency, as defined by §2.2-2006, or a legislative, judicial, or independent agency of the Commonwealth, or a board, commission, or other quasi-political entity of the Commonwealth of Virginia or other body referenced in Title 2.2 of the Code of Virginia, and the license shall be held by the Commonwealth.

Notwithstanding any other provision or other unilateral license terms which may be issued by Supplier after the Effective Date of the Contract, and irrespective of whether any such provisions have been proposed prior to or after the issuance of this Contract for Licensed Services, including access to the Application(s), or the fact that such other agreement may be presented to DWR or its Application Users at the time of accessing the Application(s) (“click wrap”), the terms and conditions set forth in this Contract and any amendments or modifications thereto shall supersede and govern licensing and use of all products and services hereunder.

Supplier Responsibilities

0. Standard Application Responsibilities Unless otherwise indicated in the requirements section of the Contract, Supplier shall acquire and maintain, at no charge to DWR, the hardware and software required to host the Application(s). The hardware and software on which the Application(s) is hosted will be maintained in good operating condition, consistent with or exceeding generally accepted industry practices and procedures. In addition:

i). Supplier shall maintain sufficient hardware capacity to satisfy the technical requirements and the bandwidth and required storage capacity indicated in the requirements section of the Contract.

ii). Supplier shall be responsible for all telecommunication connections from the server hosting the Application to the Internet.

iii). Supplier may collect user-specific data only as necessary to provide the Licensed Services authorized under the Contract. No information regarding DWR or any Application User shall be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall extend beyond the term of the Contract.

iv). The Application will be made available to DWR and its designated Application Users twenty-four (24) hours a day, seven (7) days a week (“Uptime”) less Excusable Downtime. For the purposes of this Contract, “Excusable Downtime” is defined as that period of time when the Licensed Services are not available to DWR or its Application Users due to scheduled network, hardware or service maintenance and/or upgrades. Except in cases of emergency, DWR shall be provided a two (2) business day advance notification of such maintenance and/or upgrade. In cases of emergency, Supplier will use its best efforts to notify DWR of a planned Downtime as soon as practicable. Maintenance or upgrades are not to exceed thirty-six (36) hours in duration in a single month and cannot occur Monday through Friday, between the hours of 6:00 a.m. and 8:00 p.m. Eastern Time.

v). Excusable Downtime shall not include (i) an electronic hardware failure, (ii) a failure in the Supplier’s Application, (iii) an electric utility failure at Supplier’s facility where the Application is hosted, or (iv) a network failure up to, but not including, the interconnection point of Supplier’s network to the public switched telephone network.

vi). Supplier guarantees the Application will be available for use at least ninety-nine percent (99%) of the total time during each month, excluding Excusable Downtime.

vii). If non-Excusable Downtime exceeds the parameters listed above, Supplier will credit to DWR the total recurring fees that would otherwise be owed by DWR under this Contract during the month of such failure. Such credit will be issued in the month immediately following the failure.

viii). Supplier shall be required to notify DWR in writing at least sixty (60) days prior to of any planned change(s) or Update(s) to the Application; its functionality; Content storage/ backup/disaster recovery, including physical location; security architecture, features or settings; terminations and/or replacement of any Supplier subcontractor. The planned changes or Updates include any change(s) that would potentially impact the secure and efficient use of the Application, as understood and agreed to between Supplier and DWR at Contract award. The purpose of this notice is to allow sufficient time for Supplier and DWR to discuss any technical/functional considerations and/or changes that would require action by the Commonwealth.

ix). Supplier is responsible for documenting and maintaining any Customizations made for operational use of the Application and/or for interoperability use with other systems or applications used by DWR and paid for solely by DWR. The associated technical data, code, documentation and other necessary information about such Customizations shall be provided by Supplier to DWR within ten (10) business days of the Customizations’ operational use. Suppler shall be required to routinely transfer knowledge regarding the Application and Licensed Services, including Updates and all material changes, to DWR in a reasonable manner to ensure proper and efficient use of Application and Licensed Services without degrading performance thereof.

x). Supplier agrees to work with DWR to ensure compliance with any approved security exceptions or other identified gaps or requirements provided to DWR in writing by VITA.

xi). Supplier shall not use any software, hardware or services which have been prohibited pursuant to § 2.2-5514 of the Code of Virginia.

xii. PLACEHOLDER: include any contractual requirements (not security exceptions) required by the Security Assessment approval. Comment by Adams, Stephanie (DWR): Xii must be replaced with any contractual requirements resulting from the COVRamp assessment. Security exceptions must never be included in this document or any other contract document.

In addition, and at no additional cost to DWR, Supplier shall provide access to additional Updates, features, and functionalities of the Application as are provided by Supplier to other customers of Supplier who require functionality similar to that of the Application provided to DWR. All such additional features and functionality, where reasonably necessary, shall be accompanied by updated Documentation, whether in hard copy format or distributed electronically via email or the Supplier website. Notwithstanding the provisions of this Section and except as agreed to in writing by DWR and Supplier, nothing in the Contract shall oblige Supplier to undertake any modifications to the Application, and all such modifications are at Supplier’s sole discretion whether suggested by an DWR or another party.

0. Ancillary Responsibilities Supplier shall, throughout the term of this Contract, make available such resources, including Supplier personnel, as are reasonably required to: (i) train designated DWR personnel in the use of the Application; (ii) develop modifications to the Application as agreed by DWR and Supplier in the Contract or any exhibit hereto or as agreed to by Supplier and DWR; and (iii) otherwise support the Application as provided under this Contract and any exhibits hereto or as agreed to between Supplier and DWR.

0. Subcontractors It is understood that Supplier may utilize subcontractors to provide integral components of the Licensed Services and Application; however, except for those so named at time of Contract award, Supplier shall not use new or replacement subcontractors to perform or provide integral components of the Licensed Services or Application during performance of this Contract without advance written notification to and approval by DWR.

Supplier is responsible for the performance of its subcontractors used in providing any portion of the Licensed Services or Application. Additionally, Supplier is responsible for its subcontractors’ compliance with the terms and conditions of this Contract.

If any part of this Contract is supported in whole or in part with federal funds, Supplier shall not subcontract any Services to any subcontractor that is a party excluded from Federal Procurement and Nonprocurement Programs. In no event shall Supplier subcontract with any subcontractor which is debarred by the Commonwealth of Virginia or which owes back taxes to the Commonwealth and has not made arrangements with the Commonwealth for payment of such back taxes.

DWR Responsibilities Unless otherwise agreed and as applicable, DWR or its Agent, or an Application User, will be responsible for input of Content into Supplier’s Application and DWR or its Agent will be responsible for keeping said Content current and accurate. Supplier will have no responsibility for assisting DWR in creating, modifying or inputting the Content, unless specified in this Contract.

If Supplier issues unique USERIDs and passwords to an Application User:

i). DWR is responsible for protecting said passwords and for any authorized and unauthorized use made of the passwords. DWR will fully cooperate with law enforcement authorities in the detection and prosecution of illegal activity related to unauthorized use of the Licensed Services.

ii). DWR shall have the right to add, activate, change access for, or disable USERIDs at its sole discretion. DWR shall designate administrators who will be authorized to add, activate, change access for or disable USERIDs.

iii). Upon notification by DWR of an Application User’s disabled access, Supplier shall remove access authorization by said Application User from its server within one (1) hour of receipt of such notification, ensuring that historical access audit details of such Application User shall not be deleted or lost. If Supplier fails to make such a removal of access, DWR shall not be held liable for any charges or damages incurred due to use of the unauthorized USERID.

iv). DWR and Application Users of this Contract agree to notify Supplier of any degradation, potential breach, or breach of the Content and Application privacy or security as soon as possible after discovery. DWR further agrees to provide Supplier the opportunity to participate in the investigation of the reported situation.

Content Privacy and Security Supplier shall provide a secure environment for Content and any hardware and software, including servers, network and data components provided by Supplier as part of its performance under this Contract. Supplier shall provide a secure environment for Content and any hardware and software in accordance with Commonwealth’s security standards located at: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/ in order to prevent unauthorized access to and use or modification of, and to protect, the Application and Content. Supplier agrees that all Content of DWR is intended solely for the business of DWR and is considered private data. Therefore, Supplier shall, at a minimum, implement the following procedures designed to protect the privacy and security of Content:

a) User identification and access controls designed to limit access to Content to Application Users in accordance with the principles of least privilege.

b) Supplier shall ensure that all personnel with physical or logical access to Content will receive industry standard annual security awareness training and all other training as required by Content owner, Commonwealth security standards, regulation, or law.

c) Supplier shall ensure that the Application and/or Licensed Services are capable of auditing the following events. Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.

d) Supplier shall ensure that the Application and/or Licensed Services are capable of auditing the following events, for Web applications. All administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes.

e) Supplier shall ensure that the Application and/or Licensed Services employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the Application and/or Licensed Services to support organizational processes for investigation, alerting and response to suspicious activities.

f) Supplier shall ensure that the Application and/or Licensed Services support exporting of log files to the Commonwealth for review and analysis.

g) Supplier shall ensure that the Application and/or Licensed Services are capable of maintaining all audit records in accordance with Commonwealth record retention policies found at the following URL: http://www.lva.virginia.gov/agencies/records/.

h) Provide evidence of a comprehensive continuous monitoring program encompassing all systems with access to Content.

i) Provide evidence that the Application and/or Licensed Services adhere to a security baseline, which is based on least functionality.

j) Supplier shall ensure that all changes to proposed Application and/or Licensed Services are authorized according to change management policies.

k) Supplier agrees to maintain all metadata associated with any original Content submitted into the Application and/or Licensed Services by DWR for easy retrieval and access, using secure industry standard protocols, within a predefined period as specified in the Contract.

l) Supplier agrees to provide a secure method of exporting Content when requested.

m) Supplier shall ensure that the Content exported from the supplier’s Application or infrastructure is in an industry standard format that provides for interoperability and portability.

n) Supplier shall ensure that the Application and/or Licensed Services provides and maintains a backup of Content that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives, as specified in the Contract.

o) Supplier shall ensure that the Application and/or Licensed Services can store a backup of Content, at least daily, in an off-site “hardened” facility, located within the United States, maintaining the security of the Content.

p) Implement a contingency plan designed to maintain the access to the Application and/or Licensed Services and to prevent the unintended destruction or loss of Content. This plan should provide a predefined frequency, consistent with recovery time and recovery point objectives, as specified in the Contract, for disaster recovery and archival purposes of Content at a secure facility located within the United States.

q) Supplier shall partition, in aggregate for this contract, all Content submitted into the Application and/or Licensed Services by DWR in such a manner that it will not be impacted or forfeited due to E-discovery, search and seizure or other actions by third parties obtaining or attempting to obtain records, information or Content for reasons or activities that are not directly related to the business of DWR.

r) Service must support multi-factor authentication for access to any administrative portal and/or any remote administrative interface.

s) Supplier shall fully cooperate with Commonwealth incident response resources and all required law enforcement personnel for assistance in the handling and reporting of security incidents.

t) Supplier shall maintain an incident response program that implements incident handling for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes.

u) Incident response must have the capability to support automated mechanisms for supporting incident handling processes.

v) Supplier shall provide quarterly summary reports of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) events to: enterpriseservices@vita.virginia.gov

w) Supplier ensures that all Content is removed or destroyed in accordance with and/or exceeding the requirements of the Commonwealth Data Removal standard located at the following URL: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/.

x) Supplier shall support physical security measures, including securing all Content on a secure server, in locked data cabinets within a secure facility located within the United States.

y) Supplier shall ensure that access to facilities housing Content or supporting applications are restricted to only allow access to Supplier’s personnel and agents who have a need to know in connection with operation and support of the Application and/or Licensed Services.

z) Supplier shall ensure that notification is sent to DWR in writing thirty (30) days prior to its intention to replace or add any third-party that will be provided access to Content whether that access is provided by Supplier or Supplier’s subcontractors. The DWR may reject any additional or new third parties who may be provided access to Content.

aa) Supplier shall ensure that the Application and/or Licensed Services operating systems, middleware, applications, and interfaces will be scanned for vulnerabilities every 30 days and scanning reports be provided to DWR as required by Commonwealth security standards.

ab) Supplier shall cooperate with the Commonwealth to allow monthly vulnerability scans against all public-facing interfaces with access to Commonwealth data.

ac) Application and/or Licensed Services must have the capability to set affinity on tiered systems. Supplier ensures that no one hypervisor can host the application and the data storage.

ad) Supplier shall ensure that all Content is stored, processed and maintained within the United States at all times.

ae) Supplier shall report the exact geographic location of all Commonwealth data at all times if that Content is not stored in a Commonwealth facility. Supplier shall provide a report to confirm the exact geographic location of any Content not stored in a Commonwealth facility every 30 days.

af) Supplier shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state and local laws and regulations.

ag) Supplier shall ensure performance of an AICPA SOC-2 (Type 2) audit at least once annually of the Application’s environment. Upon request from DWR, Supplier shall provide a non-redacted copy of current AICPA SOC-2 (Type 2) audit. Supplier shall assist DWR in obtaining the current AICPA SOC-2 (Type 2) audit report from any third-party providing services to Supplier, if said third-party services involve the processing or storage of any Content. The Trust Service Principles that should be covered in the SOC -2 Type 2 are: Security, Availability, Processing Integrity, Privacy and Confidentiality.

ah) Supplier understands that DWR or a third-party audit organization is responsible for performing a security audit within 90 days after contract award to determine control gaps between the supplied audit and the Information Security Standard (SEC530). If no audit is supplied, a complete security controls audit utilizing SEC530 must be performed. Failure to do so may result in remedies being levied as provided in the terms and conditions of the contract.

ai) Supplier shall ensure that external connections incorporated into the Application and/or Licensed Services have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Supplier.

aj) Supplier shall ensure that the Application and/or Licensed Services will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through.

ak) Supplier shall ensure that the Application and/or Licensed Services will use industry standard encryption techniques to protect Content that is transmitted or stored on behalf of the Commonwealth. Supplier shall ensure that the Application will provide for the Commonwealth to maintain exclusive control of all encryption keying material.

al) Supplier shall ensure that they will apply all security updates to their systems as required by Commonwealth security standards. For third-party hosted systems, updates should be installed in compliance with SEC530. Please refer to the following link for the above mentioned Commonwealth security standard: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/.

am) Supplier shall ensure that they will utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to Content.

an) Supplier shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files from the software vendor.

ao) Within fifteen (15) business days after the expiration or termination of this Contract, Supplier shall confirm in writing to DWR that all Content has been removed from all systems where the Content resided during performance of this Contract in a manner that complies with and/or exceeds the Commonwealth Data Removal standard located at the following URL: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/. The written confirmation shall include (i) sufficient detail describing the processes and procedures used in removing the Content, (ii) information about the locations of where it was removed from within the Application and storage and other locations, and (ii) the date the removals were performed. All metadata, in its original form, shall be returned to DWR.

ap) Regular training for Supplier personnel regarding the security and data recovery programs referenced in this Section.

aq) Regular testing of the systems and procedures outlined in this Section; and

ar) Supplier agrees to provide written notice within 24 hours to DWR of all incidents that threaten or could potentially threaten the security of the Commonwealth's Content and/or DWR use of the Licensed Services. This notice is required to allow the Commonwealth to commence any necessary internal actions to remediate such incident, which may include a temporary suspension of use of the Licensed Service by DWR, as directed by the CIO. If a suspension of use becomes necessary, the Supplier further agrees not to impose any penalty on DWR or the Commonwealth.

as) Audit controls that record and monitor Application and Licensed Services activity continuously.

at) Should Supplier fail to perform in compliance with any provision of this Section, DWR may provide Supplier with a written notice to cure. Supplier shall have fifteen (15) days to cure its noncompliance, or with agreement from DWR and VITA, in its governance role, may request a reasonable extension for time to cure providing DWR, and a copy to VITA at: enterpriseservices@vita.virginia.gov, with a written plan of action to cure. If Suppler fails to cure, DWR may deem Supplier in breach and/or default of the Contract and may immediately terminate the Contract, in whole or in part. Upon such termination, neither the Commonwealth, nor DWR, nor VITA shall have any future liability except DWR will be responsible for deliverables accepted by DWR and Licensed Services rendered to DWR by Supplier. In the event of such termination, Supplier shall accept return of any deliverable that was not accepted by DWR, and Supplier shall refund any monies paid by DWR for such deliverable and for any unused, remaining term paid for in advance by DWR for the Licensed Services up to the date of such termination. Supplier agrees that DWR may pursue all remedies provided under law in the event of a breach or threatened breach of this Section, including reprocurement or transition costs or injunctive or other equitable relief.

Proprietary Rights

0. Supplier’s Proprietary Rights Except as otherwise stated herein, the Licensed Services (including without limitation, the Application and Updates, and Supplier Product, except to the extent that Supplier Product contains Content) and Documentation are the sole and exclusive property of Supplier and its licensors. All modifications, enhancements, Updates, and translations of the Licensed Services shall be deemed a part thereof.

0. DWR Requirements and License Restrictions Except as otherwise provided in this Contract or as provided by law:

i). DWR will use commercially reasonable efforts to ensure that Application Users comply with all of the terms and conditions hereof;

ii). DWR shall not reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from any of the software comprising or in any way making up a part of the Application;

iii). DWR shall not directly or indirectly copy or reproduce all or any part of the Application, whether electronically, mechanically or otherwise, in any form including, but not limited to, the copying of presentation, style or organization, without prior written permission from Supplier; provided, however, DWR may reproduce and distribute any Application output generated from the DWR Content, and an Application User may reproduce and distribute any Application output generated pursuant to the permissions set forth in the Contract;

iv). DWR shall not rent, lease, sublicense, resell for profit, loan, distribute, network or modify the Application or Supplier Product or any component thereof, provided as part of the Licensed Services, except as otherwise authorized by Supplier. However, DWR may reproduce and distribute any Application output (e.g., reports) generated by DWR using the Application, and an Application User may reproduce and distribute any reports or output generated by the Application User using the Application and pursuant to the permissions in the Contract;

v). DWR shall only use the Application and Supplier Product in the normal course of business, in connection with, and as part of, the Licensed Services;

vi). DWR shall not attempt to gain unauthorized access to the Application or Licensed Services, other user accounts, computer systems or networks connected to the Licensed Services;

vii). DWR shall not remove, obscure or alter Supplier’s proprietary notices, disclaimers, trademarks, or other proprietary rights notices of any kind affixed or contained in the Application or Licensed Services or any written or electronic report, output or result generated in connection with the Licensed Services;

viii). DWR shall take reasonable care not to, and shall not intentionally or knowingly, use the Application to post, transmit, distribute, store or destroy any information: (i) in violation of any applicable law, statute, ordinance or regulation; (ii) in a manner that shall infringe the intellectual property rights of others; (iii) that is defamatory or trade libelous, or (iv) that contains any Computer Viruses;

ix). DWR shall not use the Application or Licensed Services for any illegal, obscene, offensive or immoral purpose.

0. DWR Proprietary Rights Except as otherwise stated herein and with the exception of any applicable third-party rights, Content and any Customizations made for DWR operation of the Application or for interoperability with other DWR systems or applications paid for by DWR, are and shall remain the sole and exclusive property of DWR, including all applicable rights to patents, copyrights, trademarks, trade secrets or other proprietary property rights thereto. Additionally, all right, title and interest in and to any Content or Customizations relating to DWR business shall remain the property of DWR, whether or not supplied to Supplier or uploaded into the Application. Nothing in this Contract shall be construed as conveying any rights or interest in Content or Customizations to Supplier. Upon termination of the Contract, Supplier agrees to either provide the Content and Customizations to DWR, or, at DWR request, certify in writing that said Content and Customizations in all formats, have been destroyed.

Cloud Exit Assistance Upon execution of this Contract, Supplier and DWR will develop an exit plan (“Exit Plan”) detailing each party’s respective tasks for the orderly transition and migration of all Content stored by Supplier pursuant to the Contract to DWR archive and/or to a system or application maintained by DWR.

At a minimum, the Exit Plan must provide that within 30 days of the expiration or termination of this Contract for any reason, Supplier shall return all Content in its possession provided to Supplier by DWR and/or its Application Users and stored by the Application on behalf of DWR to the DWR in a format accessible without the use of Supplier’s Application. Supplier’s failure to do so will constitute a material breach of this Contract and DWR may exercise all available rights and remedies under law and equity, in addition to any remedies set forth in this Contract.

In addition, at DWR option, Supplier shall continue to provide Licensed Services for up to six (6) months after the date of expiration or termination of the Contract in order to facilitate DWR transition to another service model or provider. Supplier shall also provide such reasonable assistance as may be requested by DWR and agrees such assistance will not be unreasonably withheld. Supplier shall perform such assistance at the hourly rate or a charge agreed upon by Supplier and DWR. In the event of a termination for breach by Supplier, Supplier shall provide the transition assistance at no charge or fee to DWR.

Commencement and Acceptance of Licensed Services

0. Licensed Services Commencement Date The Supplier shall begin delivery of Licensed Services on the date requested by DWR and agreed to by the Supplier in the Contract. DWR may delay the Licensed Services commencement date by notifying the Supplier at least ten (10) days before the scheduled Licensed Services commencement date.

0. Acceptance The Application shall be deemed accepted when DWR reasonably determines that DWR and its Application Users can successfully access and use all functionalities of the Application which Supplier is required to provide to such Users. DWR agrees to complete Acceptance testing within thirty (30) days after receiving written notice from Supplier of the ability of DWR and its Application Users to access the Application, or within such other period as set forth in the Contract. Supplier agrees to provide to DWR such assistance and advice as DWR may reasonably require, at no additional cost, during such Acceptance testing, other than pre-approved travel expenses incurred which will be reimbursable by DWR at the then current per diem amounts set forth by the Virginia Department of Accounts and published at: http://www.doa.virginia.gov/ or a successor URL(s). DWR shall provide to Supplier written notice of Acceptance upon completion of successful Acceptance testing. Should DWR fail to provide Supplier written notice of successful or unsuccessful Acceptance testing within five (5) business days following the Acceptance testing period, the Service shall be deemed Accepted.

0. Cure Period If during the Acceptance test period, DWR is unable to access the licensed functionalities of the Application, Supplier shall provide DWR with such access, and DWR Application Users with their required access, within seven (7) days of written notice of inability to access, or as otherwise agreed between DWR and Supplier in the Contract. Should Supplier fail to provide access to the licensed functionalities of the Application, DWR may, in its sole discretion: (i) reject the Application in its entirety and recover amounts previously paid hereunder; (ii) issue a “partial Acceptance” of the Application access with an equitable adjustment in the price to account for such deficiency; or (iii) conditionally accept the applicable Application access while reserving its right to revoke Acceptance if timely correction is not forthcoming.

If DWR and its Application Users are unable to access the licensed functionalities of the Application after a second set of acceptance tests, Supplier shall be deemed in default of the Contract. In the event of such default, DWR may, at its sole discretion, terminate the Contract, in whole or in part, for the Licensed Services to be provided thereunder by Supplier.

Records and Audit Supplier shall maintain accurate records and other evidence pertaining to the costs and expenses for all Licensed Services performed/delivered under this Contract in support of its charges invoiced to DWR. The records will be to the extent and in such detail as will properly reflect all direct and indirect costs associated with the Contract. In addition, Supplier shall maintain accurate records of the Licensed Services, including but not limited to, the “Uptime” and “Downtime” as set forth in the Supplier Responsibilities Section. DWR shall have the right, at any reasonable time during regular business hours after giving reasonable advance notice, to inspect and audit the records applicable to the Contract. Supplier shall preserve such records for three (3) years after termination/completion of the Licensed Services agreed to under this Contract.

Application and Licensed Services Support At any time during the term of this Contract, Supplier shall provide the following Application Services (including unlimited telephonic support and all necessary travel and labor) without additional charge to DWR in order to ensure DWR and its Application Users are able to access and use the Application in accordance with the requirements of the Contract.

0. Coverage Twenty-four (24) hours per day, seven (7) days a week, Supplier provide to DWR all reasonably necessary telephone or written consultation requested by DWR in connection with use, problems and operation of the Application.

0. Service Levels Within one (1) hour after a request from DWR or VITA, in its governance role, Supplier will respond to such request for support of Licensed Services regarding the Application and Licensed Services, including Application, Supplier Product and documentation in accordance with the procedures identified in Attachment B, Table of Service Levels, Response and Resolution Times and Escalation Procedures for Licensed Services. In each case, DWR may describe the problem by telephone or electronic mail or via a web site provided by Supplier. Supplier shall use its best efforts/commercially reasonable efforts to meet Response Time and Resolution Time.

The level of severity (e.g., 1, 2, 3), shall be defined by DWR.

0. Application Evolution Should Supplier merge or splinter the Application previously provided to DWR, such action on the part of Supplier shall not in any way result in DWR being charged additional license or support fees in order to access the Application, to enable its Application Users to access the Application, or to receive enhancements, releases, upgrades or support for the Application.

Service Levels and Remedies

0. Availability Supplier’s failure to make the Licensed Services Available to DWR and its Application Users at least 99% of the time in any given month during the term of the Contract, excluding scheduled maintenance or excusable downtime, shall be deemed a service level default (“Service Level Default”) and DWR may obtain the non-exclusive remedies set forth in Attachment A, Table of Service Levels and Remedies for Licensed Services. For purposes of this Contract, “Available” means that DWR and its Application Users are able to access all features and functions of the Application and Licensed Services required by DWR, including but not limited to the Application and Supplier Product.

In the event DWR is eligible for a 100% Service Level Credit under this Section during any given month of the term the Contract, DWR may terminate the Contract without penalty upon written notice to Supplier and, in addition to the remedies available under this Section, receive any additional remedies set forth in the Contract.

Credits shall be applied against the next invoice. In the event a Service Level Default occurs after DWR has given notice of termination pursuant to the Term and Termination section of this Contract or due to non-appropriation of funds, or DWR has made final payment to Supplier for the Application and Licensed Services and no further invoices shall issue as a result, Supplier shall refund to DWR the amount of the appropriate Service Level Credit due for the period of default.

0. Provisioning Incremental adds, access authorizations, moves or reductions, including disabled access updates, in the scope of the Licensed Service (e.g., USERIDs), shall be completed within one (1) business hour of a written request (including e-mail or submission to Supplier’s provisioning website) from DWR designated administrator. In the event that provisioning is not made available within one (1) business hour of the request, a credit for the incremental amount of the revision shall be applied against the next invoice for 1/30th of the corresponding pro-rated amount.

0. Reporting Requirements

(i) Monthly Reports:

By the 5th of each calendar month during the term of this Contract, Supplier shall provide DWR with the following written monthly reports:

(a) Service Level Performance Report - a report that contains information with respect to the performance of the Application and Licensed Services. Such report, unless otherwise agreed upon by the parties, shall be in conformity with the reporting Supplier provides to its other customers utilizing an application and licensed services identical or similar to the Application and Licensed Services provided to DWR.

(b) System/Application Patching Compliance Report – a report that illustrates that the supplier has installed security relevant software and firmware updates within 30 days of the release of the updates. .

(c) Scanning Reports (OS, Middleware, Applications and Interfaces) Report – a report that illustrates vulnerability scanning of Cloud Service Providers Operating Systems/infrastructure, databases and web applications(d) Geographic Locations of Data Being Hosted Report – a report that illustrates the location of Commonwealth data

(ii) Quarterly Reports:

By the 5th day of the first month of a calendar quarter, during the term of this Contract, Supplier shall provide the Virginia Information Technologies Agency (VITA) with the following written quarterly report

(a) Summary Report of Intrusion Detection Scans and Intrusion Prevention Scans – a report that demonstrates that supplier protects Commonwealth data with intrusion monitoring tools from unauthorized access, modification and deletion.

Supplier shall submit a copy of each report to VITA at: enterpriseservices@vita.virginia.gov.

Representatives of Supplier and DWR, and VITA at its option, shall meet as often as may be reasonably requested by either party, but no less often than once each calendar quarter during the term of this Contract, to review Supplier’s performance of Licensed Services and the performance of the Application and to discuss technical plans, financial matters, system performance, service levels and any other matters related to the above required reports and to this Contract in general that may be reasonably requested by either Supplier or DWR or VITA. Supplier shall notify VITA of such meetings by email to: enterpriseservices@vita.virginia.gov. DWR or VITA may independently audit the report at its expense no more than two (2) times annually.

Failure to submit the required reports will place Supplier in breach of Contract and the Contract may be immediately terminated by the DWR or VITA, in its governance role, and the Supplier/Application will be removed from the Approved Application List.

0. Failure to Meet Service Level Commitments In the event that such Application fails to meet the Service Levels specified herein, Supplier will: (i) promptly replace the Application with an Application that conforms to this Contract and such specifications; (ii) repair the Application, at Supplier’s expense, so that it conforms to this Contract and such specifications; or (iii) refund to DWR all fees paid for the Application and the Licensed Services after the failure of the Application to meet the Service Levels. In the event Supplier fails to comply with these remedies, DWR may exercise all available rights and remedies under law and equity.

0. Escalation Procedures [To be provided by Supplier.] Cyber Security Liability Insurance In addition to other insurance coverage requirements in the Contract, Supplier shall carry Cyber Security Liability insurance coverage in the amount of $5,000,000 per occurrence.

Escrow Agreement

0. Application Escrow Agreement Comment by Adams, Stephanie (DWR): If Supplier is not providing custom built source code for the Application, delete the provision below and replace with this language: “Supplier is providing a General Use or COTS Application and no custom built source code is authorized under this Contract. Therefore, Application Escrow is not required.” If the Supplier will provide custom built source code for the Application, keep the provision below.]]

Supplier must submit Supplier’s Application Escrow Agreement as part of Supplier’s proposal.

Supplier must provide an executed copy of the Application Escrow Agreement prior to execution of the contract or purchase order(s) Supplier shall maintain copies of all Application source code and related technical and user Documentation, in English, in an escrow account, and shall maintain with Escrow Agent the executed agreement attached hereto as Exhibit C-1 (Application Escrow Agreement).

DWR acknowledges that, prior to the Effective Date of this Contract, Supplier delivered to DWR and DWR received a copy of the executed Application Escrow Agreement naming the Commonwealth of Virginia as a third party beneficiary. DWR has reviewed Application Escrow Agreement to ensure that such Application Escrow Agreement does not impose upon the Commonwealth any requirements other than administrative responsibilities necessary for the operation of the Application Escrow Agreement. If events give rise to a need for the Escrow Agent to release escrowed materials to the Commonwealth, the Commonwealth’s sole responsibility shall be to request the release of such materials from the Escrow Agent. Supplier agrees to notify DWR in writing not less than thirty (30) calendar days prior to termination or any modification of the Application Escrow Agreement. .

Supplier warrants that the information and materials to be kept in escrow in a media safe environment for the benefit of the Commonwealth pursuant to the Application Escrow Agreement are specifically identified and listed in Attachment A to the Application Escrow Agreement and include the most current version used by DWR of:

i). the source code for the Application software and all future releases, ii). identification of the development/support technology stack, including but not limited to, every software tool, driver, script, app, etc.