Wisconsin_DOA_2019-12-21_MA_(CSOD_sigs) - redacted.pdf

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 1 of 37

State of Wisconsin Contract Number: 505ENT-M20-CORNERSTONE-01 between

Cornerstone OnDemand, Inc.

And

State of Wisconsin

Department of Administration

I. Term

The term for this contract between the State of Wisconsin and Cornerstone is:

1. Initial Term: 12/31/2019 – 12/30/2022

2. Optional Renewal Terms:

a. Optional Renewal One: 12/31/2022 – 12/30/2023

b. Optional Renewal Two: 12/31/2023 – 12/30/2024

c. Optional Renewal Three: 12/31/2024 – 12/30/2025

d. Optional Renewal Four: 12/31/2025 – 12/30/2026

II. Order of Precedence

This Contract and the following documents incorporated by reference into the Contract constitute the entire agreement of the parties and supersedes all prior communications, representations or agreements between the parties, whether oral or written. This Contract may not be modified or amended except by mutual agreement of both parties in writing. Any conflict or inconsistency will be resolved by giving precedence in the following descending order:

1. The terms of this Contract.

2. Exhibit A – State of Wisconsin Software License Terms and Conditions

3. Exhibit B – State of Wisconsin Security Rider

4. Exhibit C – Cornerstone OnDemand – Master Agreement and Preferred Support

Package

5. Exhibit D – Cornerstone Order Form

6. Exhibit E – Statement of Work for Technical Projects and Educational Services

Scope

7. Exhibit F – Cornerstone Wisconsin Department of Administration Rate Card for

Cornerstone/eSkillz Products

8. Exhibit G – Minimum Desktop Requirements

III. Additional Terms and Conditions

1. Existing State of Wisconsin/Cornerstone Agreements

a. Cornerstone has existing agreements with the State of Wisconsin Agencies listed below. The State and Cornerstone agree the Agency populations will be migrated to the new Cornerstone-DOA Portal when appropriate. Expiration of any Agency contract before migration to the new Cornerstone-DOA portal

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 2 of 37 will not result in a loss of service, and the population of users under those contracts will be counted against the user population set forth in Exhibit D attached hereto. The State will not be entitled to a credit for the unused portion of the Agency Contract should migration occur prior to the expiration of any of the Agency contract(s).

i. Department of Corrections (DOC)

ii. Department of Transportation (DOT)

iii. Department of Children and Families (DCF)

iv. Department of Workforce Development (DWD)

v. Department of Employee Trust Funds (ETF)

2. Annual Review of Licensing

a. On an annual basis, the State of Wisconsin will lead a review of their current licensing usage with Cornerstone to determine if it is appropriate to increase the State’s licensing commitment for the upcoming year. Any increase to the licensing commitment will be mutually agreed to by both parties to this agreement. This clause does not impact the State’s commitment established in

Exhibit D, it merely provides the State an opportunity to increase its licensing commitment in the future.

3. Agency-specific Ordering

a. After State of Wisconsin receives approval from the Division of Personnel

Management (DPM) in the Department of Administration, an Agency may make direct purchases for products and users from Cornerstone in accordance with the rates established in Exhibit F to this contract.

State of Wisconsin

Department of Administration

Cornerstone OnDemand, Inc.

By: By:

Name: Chris Patton Name: Adam Miller

Title: DeputySecretary,DepartmentofAdministration Title:

CEO

Date: 12/27/2019 | 8:51 AM CST Date:

December 20, 2019

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 3 of 37

Exhibit A

Standard Software License Terms and Conditions

These Standard Software License Terms and Conditions (the “Addendum”) is between the State of Wisconsin ("State"), on behalf of itself and all State of Wisconsin Agencies ("State Agencies") and the University of Wisconsin System and Campuses ("Universities"), as represented by its

Department of Administration, located at 101 E Wilson Street, Madison, WI 53703, and

Cornerstone OnDemand (“Cornerstone”).

In the event of a conflict between the terms of the Master Agreement (attached as Exhibit C), linked terms or supplemental documents, such conflicting terms shall not take precedence over the terms of this Addendum. In no event will any linked terms or supplemental document alter or override any term of the Master Agreement, nor will it change fees, prices, or the method of computing any of the foregoing.

1. Additional Terms. No “Shrink-Wrap,” “Click-Wrap” or other terms and conditions or Agreements (“Additional Terms”) unilaterally provided with any products or software hereunder shall be binding on the State, even if use of such products and software requires an affirmative “acceptance” of those “additional terms” before access is permitted. All such additional terms shall be of no force or effect and shall be deemed rejected by the State in entirety.

2. Antitrust Assignment. By entering into this Agreement, the Agreement conveys, sells, assigns and transfers to the State all rights, title and interest in and to all causes of action, claims and demands of whatever nature it may now have or hereafter acquire under the antitrust laws of the United States and the State, relating to the particular Goods or Services purchased or acquired by the State under this Agreement.

3. Applicable Law . This Agreement shall be governed by the Laws of the State of Wisconsin. Venue for all actions resulting from this contract will be Dane County, Wisconsin.

4. [Reserved]

5. [Reserved]

6. Authorized Third Parties. The State may exercise the rights granted in this Section either directly or indirectly through the services of its own employees, independent contractors or an outsourcing company, provided that such third parties agree (i) not to disclose or distribute any part of the Software, and (ii) maintain the confidentiality of the Software and (iii) otherwise violate Cornerstone’s proprietary rights therein; each at no additional cost. In no event shall the State enable a third party to access the Product that is known by the State to be a competitor of Cornerstone at the time that access is granted by the State.

7. Breach Not Waiver. A failure to exercise any right, or a delay in exercising any right, power or remedy hereunder on the part of either party shall not operate as a waiver thereof. Any express waiver shall be in writing and shall not affect any event or default other than the event or default specified in such waiver. A waiver of any covenant, term or condition contained herein shall not be construed as a waiver of any subsequent breach of the same covenant, term or condition. The making of any payment to the Agreement under this Agreement shall not constitute a waiver of

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 4 of 37 default, evidence of proper Agreement performance, or Acceptance of any defective item or work furnished by the Agreement.

8. Century Date Change. The Software shall process dates and time-based calculations accurately across centuries.

9. Compliance. With regard to the manufacture of Software and the provision of Services, Cornerstone shall at all times comply with and observe all applicable federal laws, ordinances and regulations to which it is subject; and with applicable State, and local laws, ordinances, and regulations for the location(s) where the Software is manufactured or where Services are performed, as applicable, that are not in conflict with federal law, that are in effect during the term of this Agreement.

10. Confidential, Proprietary, and Personally Identifiable Information. Cornerstone shall not use Confidential, Proprietary or Personally Identifiable Information (“Confidential Information”) for any purpose other than the limited purposes set forth in this Agreement, and all related and necessary actions taken in fulfillment of the obligations thereunder. The State agrees that, (a) it will not disclose any Confidential Information to Cornerstone except that which is necessary for the limited purposes set forth in the Agreement; (b) prior to disclosure, it will clearly mark all Confidential Information as such; and (c) it will not disclose or transmit any Personally Identifiable Information to Cornerstone without providing advance written notice of such disclosure or transmission. Cornerstone shall hold all Confidential Information in confidence, and shall not disclose such Confidential Information to any persons other than those directors, officers, employees, and agents (“Representatives”) who have a business-related need to have access to such Confidential Information in furtherance of the limited purposes described in this Agreement and who have been apprised of, and agree to maintain, the confidential nature of such information in accordance with the terms of this Agreement.

Cornerstone shall institute and maintain such security procedures as are commercially reasonable to maintain the confidentiality of the Confidential Information while in its possession or control including transportation, whether physically or electronically.

Cornerstone shall ensure that all indications of confidentiality contained on or included in any item of Confidential Information shall be reproduced by Cornerstone on any reproduction, modification, or translation of such Confidential Information. If requested by the State, Cornerstone shall make a reasonable effort to add a proprietary notice or indication of confidentiality to any tangible materials within its possession that contain Confidential

Information of the State, as directed by the State in writing.

Cornerstone shall maintain all Confidential Information for a period of three (3) years from the date of termination of this Agreement, and shall thereafter destroy said Confidential Information, or return it to the State as directed by the State in writing.

Cornerstone’s obligations as described in this section to not apply to information which is: (1) generally available to the public; (2) released by the State without restriction; (3) independently developed or acquired by Cornerstone; (4) known to Cornerstone prior to receipt from the State;

or (5) revealed pursuant to court order or process of law. Cornerstone will use reasonable efforts to give the State notice of such order prior to disclosure.

11. Viruses, Disabling Devices and Illicit Code. Cornerstone represents, warrants and covenants that it will not intentionally introduce into the licensed software and all software upgrades any

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 5 of 37 disabling devices or Induced Inhibiting Code (IIC) (as defined below), and Cornerstone shall not electronically repossess programs licensed to the State through remote command activation.

Cornerstone shall use all commercially reasonable measures to screen the licensed Software to avoid introducing any virus or other destructive programming that is designed (i) to permit unauthorized access or use by third parties to the software installed on the State’s systems, or (ii) to disable or damage the State’s systems. Cornerstone shall not intentionally insert into licensed Software any code or other device that would have the effect of disabling or otherwise shutting down all or any portion of the licensed Software based on the elapsing of a period of time, exceeding an authorized number of copies, advancement to a particular date or numbers or other similar self-destruct mechanisms (sometimes referred to as "time bombs," "time locks," or "drop dead" devices) or that would permit Cornerstone to access the licensed software to cause such disablement or impairment (sometimes referred to as a "trap door" device). Cornerstone shall not invoke such code or other device at any time, including upon expiration or termination of this Agreement for any reason. For the purpose of this section, a "Disabling Device" shall mean code intentionally embedded in a Program by Cornerstone for the sole purpose of partially or completely halting use of the Program on conditions set by Cornerstone. “IIC” is defined as any deliberately included application or system code that shall degrade performance, result in inaccurate data, deny accessibility, or adversely effect, in any way, programs or data or use of the system.

12. Disclosure. If a state public official (s. 19.42, Stats.) or an organization in which a state public official holds at least a 10% interest is a party to this Agreement, this contract is voidable by the state unless appropriate disclosure is made to the State of Wisconsin Ethics Board, 125 South Webster Street, Madison, Wisconsin 53702, [Telephone: (608) 266-8123].

13. Documents, Forms and/or Spreadsheets. Any documents, forms, and/or spreadsheets that are generated from the utilization of the functionality of the Software can be used by the State in its normal course of business, including but not limited to the State sharing such documents with its business partners and other third parties.

14. State Payment Offsets For Cornerstone’s Delinquency. The State shall offset payments made to the Cornerstone under this Agreement in an amount necessary to satisfy a certified or verifiable delinquent payment owed to the State or any state or local unit of government. The State also reserves the right to cancel this Agreement as provided in Section 6, Agreement Cancellation, if the delinquency is not satisfied by the offset or other means during the term of the Agreement.

15. Examination of Records. The State shall upon mutual agreement in advance, during normal business hours, generally within thirty (30) days of written request to Cornerstone (not to be unreasonably denied), have access to and the right to examine, audit, excerpt, transcribe, and copy, on Cornerstone premises, any of Cornerstone’s records directly related to invoices generated under this Agreement (“Records”). If the Records are on computer data storage media, Cornerstone shall provide copies of the data storage media or a computer printout of such if the State so requests. Any charges for copies of Records provided by Cornerstone shall not exceed the actual cost to Cornerstone. Cornerstone shall retain Records for three (3) years from the respective invoice date. This provision shall survive the termination or cancellation of this Agreement.

16. Illicit Code (Hidden Files). Cornerstone warrants that it shall not intentionally introduce any Induced Inhibiting Code (or IIC) or any other inhibitor data into the Software licensed under this Agreement. IIC is defined as any deliberately included application or system code that shall

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 6 of 37 degrade performance, result in inaccurate data, deny accessibility, or adversely effect, in any way, programs or data or use of the system. Cornerstone represents, warrants and covenants that it will not intentionally introduce into the licensed software or software upgrades any computer code that would disable the licensed software or impair in any way its operation based on the elapsing of a period of time, exceeding an authorized number of copies, advancement to a particular date or numbers or other similar self-destruct mechanisms (sometimes referred to as "time bombs," "time locks," or "drop dead" devices) or that would permit Cornerstone to access the licensed software to cause such disablement or impairment (sometimes referred to as a "trap door" device).

17. Indemnification. Cornerstone shall hold the State harmless and shall indemnify the State, its Agencies, officers and employees against any and all claims, suits, actions, liabilities and costs of any kind, including attorney's fees, for personal injury or damage to property arising from the acts or omissions of the Cornerstone, its agents, officer, employees or subcontractors.

18. Infringement Indemnification. To the best of Cornerstone’s knowledge, the State’s permitted use of the Licensed Software shall not infringe the intellectual property rights of any third party.

If a third party makes a claim against the State that any information, design, specification, instruction, software, data, or material (“Material”) furnished by Cornerstone and used by the State infringes its intellectual property rights, Cornerstone shall indemnify and at its own expense (including payment of attorney’s fees, expert fees and court costs) defend the State against any loss, cost, damage, liability or expense from any and all third party claims that the License Software infringes any patent, copyright, trade secret or other proprietary right of a third party and shall indemnify and hold harmless the State from any amounts assessed against them in a resulting judgment or amounts to settle such claims provided that the State does the following:

▪ notifies Cornerstone promptly in writing, not later than thirty (30) days after the State receives notice of the claim (or sooner if required by applicable law);

▪ gives Cornerstone sole control of the defense and any settlement negotiations; and

▪ gives Cornerstone the information, authority, and assistance the Provider needs to defend against or settle the claim.

▪ If Licensed Software is, or is likely to be, the subject of an infringement claim, or, Cornerstone believes or it is determined that any of the Material may have violated someone else’s intellectual property rights, Cornerstone, at its expense, shall choose to either (i) modify the Material to be non-infringing (while substantially preserving its utility or functionality) (ii) obtain a license to allow for the State’s continued use, or (iii) replace the Licensed Software with another system or components of comparable quality and functionality. If Cornerstone is unable to provide one of these remedies within forty-five

(45) days of notice of the claim (unless such period is extended by the State), Cornerstone shall have the right to terminate this Agreement and refund all unearned fees prepaid hereunder for the Licensed Software. Cornerstone shall not indemnify the State if the State alters the Material or uses it outside the scope of use identified in Cornerstone’s user documentation or if the State uses a version of the Materials which has been superseded, if the infringement claim could have been avoided by using an unaltered current version of the Material which was provided to the State provided Cornerstone has notified the State in writing that use of the current version would have avoided the claim. Cornerstone shall not indemnify the State to the extent that an infringement claim is based upon any information, design, specification, instruction, software, data, or material not furnished by

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 7 of 37

Cornerstone. Cornerstone shall not indemnify the State to the extent that an infringement claim is based upon the combination of any Material with any products or services not provided by Cornerstone. Cornerstone shall not indemnify the State to the extent that an infringement claim is based upon Third Party Programs that were not a part of any products required by Cornerstone. The remedies set forth in this section shall be exclusive with respect to any infringement claim hereunder.

19. Non-Appropriation of Funds . The State reserves the right to cancel this Agreement in whole or in part without penalty if the Legislature fails to appropriate funds necessary to complete the Agreement.

20. Notice and Change of Contact Information. In the event either Cornerstone or the State moves or updates contact information, the applicable party shall inform the other party of such changes in writing within ten (10) Business Days. The State shall not be held responsible for delays on payments on Purchase Orders delayed due to Cornerstone’s failure to provide such notice. Any notice required or permitted to be given shall be deemed to have been given on the date of delivery or three (3) Business Days after mailing by e-mail or postal service.

21. Refund of Credits. Within sixty (60) days of the State’s request, Cornerstone shall pay to the State any credits, if any, resulting from an order that the State determines cannot be applied to future invoices.

22. Recordkeeping and Record Retention. Cornerstone shall establish and maintain adequate records directly related to invoices generated under the Agreement. All expenditure records shall be kept in accordance with Generally Accepted Accounting Procedures (GAAP). All procedures shall be in accordance with applicable federal laws or ordinances to which Cornerstone is subject, and with applicable State and local laws or ordinances for the location where invoices are generated that are not in conflict with federal law.

23. Right to Copy User Documentation. The State shall have the right to make a reasonable number of copies of the User Documentation for its internal use, including, but not limited to duplication for disaster recovery purposes.

24. Right to Merge Product. The State shall have the right to use the Software in conjunction with, other software, programs, routines and subroutines developed or acquired by the State.

25. Sovereign Immunity. Nothing in this Agreement shall be construed to constitute a waiver of the State’s sovereign immunity under the Eleventh Amendment to the United States Constitution and Article IV, Section 27 of the Wisconsin Constitution.

26. Third Party Software. In the event Cornerstone provides any third party software to the State in connection with this Agreement, the following shall apply: (1) Cornerstone shall specifically identify in writing all Third Party Software associated with the Software, (2) Cornerstone shall attach written copies of all third party license agreements applicable to the State; and (3) Cornerstone warrants that (i) it has the right to license Third Party Software licensed to the State under this Agreement; (ii) to the best of Cornerstone's knowledge, the Third Party Software does not, and the use of the Third Party Software by the State as contemplated by this Agreement, will not infringe any intellectual property rights of any third party; and (iii) unless specifically provided otherwise herein, the State shall have no obligation to pay any third party fees, royalties, or other payments for the State’s use of any Third Party Software in accordance with the terms of this Agreement. Cornerstone shall support and maintain all such Third- Party Software to the same

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 8 of 37 extent as its Software. “Third Party Software” means a third party’s software offering which Cornerstone requires the State to use in order to access Cornerstone’s Software.

27. IRS Publication 1075: If applicable, Cornerstone and Cornerstone Personnel shall adhere to the requirements of IRS Publication 1075, particularly Exhibit 7 and the Safeguarding Agreement Language, including subsequent versions published by the IRS after the date of Agreement execution. Cornerstone hereby acknowledges and agrees that specific customers or Agencies may have additional requirements as a result of IRS Publication 1075. Cornerstone shall comply with such agency requirements. The parties agree IRS Publication 1075 will not apply unless and until the parties agree in writing on a plan to ensure compliance.

28. UCITA. The Uniform Computer Information Transactions Act does not apply to this Agreement.

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 9 of 37

Exhibit B

STATE OF WISCONSIN SECURITY RIDER

These terms shall supplement the Cornerstone OnDemand Master Agreement (also known as the “Corporate Subscriber Terms and Conditions”) . In the event of a conflict between the terms of this Exhibit A, “State of Wisconsin Security Rider” and the Master Agreement, Exhibit A, “State of Wisconsin Security Rider” shall control.

1. Definitions:

1.1 “Authorized Persons” means the Contractor’s employees, contractors, subcontractors or other agents who need to access the State’s Personal Data to enable the Contractor to perform the services required.

1.2 “Agency” or “State Agency” means an office, department, agency, institution of higher education, association, society or other body in the State of Wisconsin government created or authorized to be created by the State Constitution or any law, which is entitled to expend moneys appropriated by law, including the legislature and the courts, but not including an authority, as defined in Wis. Stat. s. 16.70(2).

1.3 “Contracting Agency” means the Agency entering into this Contract on behalf of the State.

1.4 “Contractor” means the Contractor and its employees, Subcontractors, agents and affiliates who are providing the services agreed to under the contract.

1.5 “Data Breach” means the unauthorized access that result in the use, disclosure or theft of the State’s unencrypted Personal Data.

1.6 [Reserved]

1.7 “Disabling Code” means computer instructions or programs, subroutines, code, instructions, data or functions, (including but not limited to viruses, worms, date bombs or time bombs), including but not limited to other programs, data storage, computer libraries and programs that self-replicate without manual intervention, instructions programmed to activate at a predetermined time or upon a specified event, and/or programs purporting to do a meaningful function but designed for a different function, that alter, destroy, inhibit, damage, interrupt, interfere with or hinder the operation of the software and/or State’s processing environment, the system in which it resides, or any other software or data on such system or any other system with which it is capable of communicating.

1.8 “Individually Identifiable Health Information” means information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

1.9 [Reserved]

1.10 “Non-Public Data” means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the State because it contains information that is exempt by statute, ordinance or administrative rule from access by the public as public information.

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 10 of 37

1.11 “Personal Data” or “Personally Identified Information” or PII”, means an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if the element is not publicly available information and is not encrypted, redacted, or altered in any manner that renders the element unreadable: (a) the individual’s Social Security number; (b) the individual’s driver’s license number or state identification number; (c) the individual’s date of birth; (d) the number of the individual’s financial account, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual’s financial account; (e) the individual’s DNA profile; or (f) the individual’s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation, and any other information protected by state or federal law.

1.12 “Proprietary Information” means information, including a formula, pattern, compilation, program, device, method, technique or process to which all the following apply:

a. The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.

b. The information is the subject of efforts to maintain its secrecy that are reasonable under the circumstances.

1.13 “Protected Health Information” (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer.

1.14 “Public Information” means information that (i) is collected, assembled or maintained under a law or ordinance or in connection with the transaction of official business by a governmental body or for a governmental body; and (ii) the governmental body owns or to which it has a right of access.

1.15 “State” means the government of the State of Wisconsin, its employees and authorized representatives, including without limitation any department, agency, or other unit of the government of the State of Wisconsin.

1.16 “State Contact” means the person or persons designated in writing by the State to receive security incident or breach notification. [Identify DET resource]

1.7 “State Data” means All rights, title, and interest in items and materials originated or prepared specifically and exclusively for the State under the Contract shall be the exclusive property of the State including, but not limited to: data, commercials, media, tapes, labels, trademarks, ideas, terms, designs, patterns, music, models, devices, sets, drawings, props, specifications, designations, Reports, card decks, listings, and any intellectual property as is specifically and exclusively developed for the State from the time of payment.

All data provided by the State shall remain the property of the State. Contractor shall acquire no rights or licenses, including without limitation intellectual property rights or licenses, to use the data for its own purposes by virtue of this Contract or otherwise. Contractor may use the data provided by the State solely for the purposes of carrying out its obligations under this Contract and the administration and management of their respective services. Notwithstanding the above, usage data, storage utilization and similar statistical and consumption data relating to use of the services by the State is not the State’s

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 11 of 37 data/information and nothing in this Contract shall be construed as restricting Contractor’s rights or interest in such service usage data. State Data as defined herein shall be used solely for the purposes of carrying out its obligations under this Contract and not sold, shared or otherwise provided, directly or indirectly to a third party without the express written permission of the State.

All data stored by or accessed by the Contractor that is the result of any processing of State Data shall be the property of the State. The State shall have the ability to access the data except during downtime as may be provided in the SLA.

1.18 “Security Incident” means the actual unauthorized access to Personal Data or non-public data the Contractor believes could result in the use, disclosure or theft of the State’s unencrypted Personal Data or non-public data within the possession or control of the Contractor. A security incident may or may not turn into a data breach.

1.19 “Service Level Agreement” or (“SLA”) means Contractor’s written documentation that is subject to the terms and conditions in this document that unless otherwise agreed to includes but is not limited to

(1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities (which may be included under separate documentation), (4) security responsibilities and notice requirements, (5) how disputes are discovered and addressed, and (6) any remedies for performance failures.

1.20 “Software-as-a-Service” (SaaS) means the capability provided to the State to use the Contractor’s applications running on a hosted (or “cloud”) infrastructure. The applications are owned, delivered and managed remotely by one or more providers and accessible from various client devices through a thin-client interface such as a Web browser (e.g., Web-based email) or a program interface, all as set forth in Contractor’s documentation entitled “Minimum Desktop Requirements,” a current version of which is attached as Exhibit G and is subject to change upon prior written notice to the State. The provider delivers software based on one set of common code and data definitions that is consumed in a one-to-many model by all contracted customers at any time on a pay-for-use basis or as a subscription based on use metrics.

The State does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

1.21 “Statement of Work” means a mutually executed document describing services to be performed by Contractor and delivered to the State and if any, the relevant terms and conditions associated therein.

1.22 “Subcontractor” means an entity that enters into an agreement with the Contractor for the purpose of providing Deliverables or rendering Services to the State.

1.23 “Work Center” means a charitable organization or nonprofit institution which is licensed under s.

104.07 and incorporated in this State or a unit of county government which is operated for the purpose of carrying out a program of rehabilitation for severely handicapped individuals and for providing the individuals with remunerative employment or other occupational rehabilitating activity of an educational or therapeutic nature, and which is engaged in the production of materials, supplies or equipment or the performance of contractual services in connection with which not less than 75% of the total hours of direct labor are performed by severely handicapped individuals.

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 12 of 37

2. Data Ownership: The State will own all right, title and interest in the State Data that is related tothe

Services provided by Corporate Subscriber Terms and Conditions. The Contractor shall not access State user accounts or State Data, except (1) during data center operations, (2) in response to service or technical issues, (3) as required by the express terms of Corporate Subscriber Terms and Conditions and/or SLA, or (4) at the State’s written request.

Contractor shall not collect, access, or use user-specific State Data except as strictly necessary to provide

Service to the State. No information regarding a State’s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of this

Contract.

3. Data Protection: Protection of personal privacy and data shall be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of State information at any time. To this end, the Contractor shall safeguard the confidentiality, integrity and availability of

State information and comply with the following conditions:

a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non-Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own Personal Data and Non-Public Data of similar kind.

b. All State Data obtained by the Contractor in the performance of this Contract shall remain the property of the State.

c. All Personal Data shall be encrypted at rest (subject to additional charge or no charge, however it is set forth in the Order) and in transit (at no additional charge) with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal

Data in transit. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of this

Contract.

d. Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest (at either a cost or no cost, however set forth in the Order) and in transit. The State shall identify data it deems as Non-Public Data to the Contractor. The level of protection and encryption for all Non-

Public Data shall be identified by the State shall be treated the same as all other data stored on the Software.

e. At no time shall any data or processes — that belong to theState or its officers, agents or employees — be copied, disclosed or retained by the Contractor or any party related to the

Contractor for subsequent use in any transaction that does not include the State.

f. The Contractor shall not use any information collected relating to the Services issued from this

Contract for any purpose other than fulfilling the Services.

4. Data Location: The Contractor shall provide its services to the State and its end users solely from data centers in the U.S. Storage of State Data at rest shall be located solely in data centers in the U.S. The

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 13 of 37

Contractor shall not allow its personnel or contractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The

Contractor shall permit its personnel and contractors to access State Data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a

Follow the Sun model, unless otherwise prohibited or provided in this Contract.

5. Security Incident or Data Breach Notification: The Contractor shall inform the State of any security incident without out reasonable delay and no later than 24 hours of a confirmed data breach. Such notice shall include, to the best of Contractor’s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown.

a. Incident Response: Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract.

Discussing security incidents with the State should be handled on an urgent, as part of

Contractor’s communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the State identified contact within 72 hours based on the standards set by NIST 800-61 without reasonable delay, or as defined in the SLA or Contractors System Security Plan (“SSP”).

c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any of the State’s content that is subject to applicable data breach notification law, the Contractor shall (1) within twenty-four (24) hours and without out reasonable delay notify the State, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner.

6. Personal Data Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor, including its third- party affiliates as applicable.

a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate State identified contact by email in accordance with the agreed upon security plan or security procedures of a verified security incident.

b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate State identified contact without undue delay and not later than 24 hours by email to named administrators, unless shorter time is required by applicable law, if it has confirmed that there is, or has been a data breach. The Contractor shall, (1) cooperate with the State as requested by the State to investigate and resolve the Data Breach; (2) promptly implement necessary remedial measures, if necessary, and; (3) document responsive actions taken related to the Data

Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Personal Data in transit (and, at rest, if the State purchases

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 14 of 37 encryption at rest) or otherwise, then, according to Wisconsin Statute 134.98, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $201 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute17 at the time of the data breach; and (5) complete all corrective actions as reasonably determined by

Contractor based on root cause.

7. Notification of Legal Requests: The Contractor shall contact the State upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the State’s data under this Contract, or which in any way might reasonably require access to the data of the State. The

Contractor shall not respond to subpoenas, service of process and other legal requests related to the

State without first notifying and obtaining the approval of the State, unless prohibited by law from providing such notice.

8. Termination and Suspension of Service:

8.1. In the event of a termination of the Contract, the Contractor shall implement an orderly return of the State’s data as set forth in Section 6(d) of the Master Agreement and perform the subsequent secure disposal of the State’s data per NIST 800-88 Revision 1.

8.2. During any period of service suspension not resulting in termination, the Contractor shall not take any action to intentionally erase or otherwise dispose of any of the State’s data, as detailed in section 8.3 below.

8.3. In the event of termination of any services or Contract in entirety, the Contractor shall not take any action to intentionally erase the State’s data for a period of:

• 15 days after the effective date of termination, if the termination is in accordance with the contract period or if the termination is for convenience

• 15 days after the effective date of termination, if the termination is for cause

After such period, the Contractor shall have no obligation to maintain or provide any State Data and shall thereafter, unless legally prohibited, delete all State Data in its systems or otherwise in its possession or under its control per NIST 800-88 Revision 1.

8.4. The State shall be entitled to any post termination assistance generally made available with respect to the services; unless a unique data retrieval arrangement has been established as part of an SLA. The termination assistance Contractor agrees to make available for the State is up to six (6) months of termination assistance at the costs set forth in the Order in effect immediately prior to expiration/termination, and for all other services at Contractor’s then-current rates.

8.5. Upon termination of the Services or the Contract in its entirety, unless legally prohibited, Contractor shall securely dispose of all State Data in all its forms, in its systems or otherwise in its possession or under its control including but not limited to disk, CD/ DVD, backup tape and

DocuSign Envelope ID: A045ED13-2388-4095-AA94-842A7234ACD9 DocuSign Envelope ID: 219EE03E-41FE-40F6-81C0-C37B67FE5673 DocuSign Envelope ID: A40E48AC-73BA-4CAE-A21F-639470692D64

Agreement number: 00032657.0 Page 15 of 37 paper, unless stipulated otherwise by the State. State Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the State upon request.

9. Background Checks: Upon the request of the State or prior to the effective date of this Contract, the

Contractor shall conduct criminal background checks. If an employee has a criminal record, Contractor shall determine whether the criminal history is related to the employee’s ability to successfully perform their job duties. When determining whether the employee should be disqualified due to a criminal record, Contractor shall consider certain mitigating factors,. These factors will be evaluated along with any other relevant circumstances . The Contractor shall promote and maintain an awareness of the importance of securing the State’s information among the Contractor’s employees and agents. If any of the stated personnel providing services is not acceptable to the State in its sole opinion as a result of the background or criminal history investigation, the State, in its sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate t any related service

Contract.

10. Access to Security Logs and Reports: The Contractor shall provide reports to the Statein a format as specified in the SLA or as otherwise agreed to by both the Contractor and the State. Reports shall include latency statistics, user access, user access IP address, user access history and security logs (with redactions for Contractor and other client confidential information or trade secrets) for all public jurisdiction files related to this Contract.

11. Contract Audit: The Contractor shall allow the State to audit conformance to the Contract terms in accordance with this Section 11. The State may perform this audit or contract with a third party at its discretion and at the State’s expense.

The State or its authorized representatives at a time, scope and cost to be mutually agreed and no more than once per year except following a data breach or as otherwise required by Wisconsin law will have full and complete access during normal business hours and upon reasonable notice, to perform an operational audit of the Contractor’s performance of the Services, and related books and records pertaining to any sums to be paid hereunder or facts relative to any claim against the Contractor which may be chargeable to The State or its property. The Contractor shall provide the State and its authorized representatives with such information and assistance as needed to perform the audits.

12. Data Center Audit: The Contractor shall perform an…