PARTICIPATING ADDENDUM CLOUD SOLUTIONS 2016-2026

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 1 of 44

Master Agreement #: AR2488

Contractor:

SHI INTERNATIONAL CORP.

Participating Entity: STATE OF TENNESSEE

The following products or services are included in this contract portfolio:

x All products and services listed in the SHI International NASPO Cloud Solutions program

catalogs/price lists.

Master Agreement Terms and Conditions:

1. Scope: This addendum covers Cloud Solutions led by the State of Utah for use by state

agencies and other entities located in Tennessee authorized by that State’s statutes to

utilize State contracts with the prior approval of the State’s Chief Procurement Official.

2. Participation: This NASPO ValuePoint Master Agreement may be used by all state

agencies, institutions of higher education, political subdivisions and other entities authorized

to use statewide contracts in the State of Tennessee. Issues of interpretation and eligibility

for participation are solely within the authority of the State Chief Procurement Official.

3. Access to Cloud Solutions Services Requires State CIO Approval: Unless otherwise

stipulated in this Participating Addendum, specific services accessed through the NASPO

ValuePoint cooperative Master Agreements for Cloud Solutions by state executive branch

agencies are subject to the authority and prior approval of the State Chief Information

Officer’s Office. The State Chief Information Officer means the individual designated by the

state Governor within the Executive Branch with enterprise-wide responsibilities for

leadership and management of information technology resources of a state.

4. Primary Contacts: The primary contact individuals for this Participating Addendum are as

follows (or their named successors):

Contractor

Name:

Elaine Williams

Address:

290 Davidson Avenue, Somerset, NJ 08873

Telephone:

(615) 691-2551

Fax:

(888) 764-8889

Email:

Elaine_williams@shi.com

Participating Entity

Name:

Simeon Ayton

Address:

312 Rosa L. Parks Avenue, Nashville, TN 37243

Telephone:

615 532-0110

Fax:

615 741-0684

Email:

Simeon.Ayton@tn.gov

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 2 of 44

5. PARTICIPATING ENTITY MODIFICATIONS OR ADDITIONS TO THE MASTER

AGREEMENT

These modifications or additions apply only to actions and relationships within the Participating

Entity.

Participating Entity must check one of the boxes below.

[ ] No changes to the terms and conditions of the Master Agreement are required.

[X] The following changes are modifying or supplementing the Master Agreement terms and

conditions.

This Participating Addendum with Tennessee State specific terms and conditions are attached

below as Attachments A, B, C, D, E, and F and in the event of a conflict, take precedence over

the NASPO Value Point Master Contract # AR2488 terms and conditions.

6. Subcontractors: All contactors, dealers, and resellers authorized in the State of Tennessee,

as shown on the dedicated Contractor (cooperative contract) website, are approved to

provide sales and service support to participants in the NASPO ValuePoint Master

Agreement. The contractor’s dealer participation will be in accordance with the terms and

conditions set forth in the aforementioned Master Agreement.

7. Orders: Any order placed by a Participating Entity or Purchasing Entity for a product and/or

service available from this Master Agreement shall be deemed to be a sale under (and

governed by the prices and other terms and conditions) of the Master Agreement unless the

parties to the order agree in writing that another contract or agreement applies to such

order.

IN WITNESS WHEREOF, the parties have executed this Addendum as of the date of execution

by both parties below.

Participating Entity:

Contractor: SHI International Corp

Signature:

Name:

Name: Kristina Mann

Title:

Title: Senior Lead Contracts Specialist

Date:

Date: 09/16/2020

[Additional signatures may be added if required by the Participating Entity]

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 3 of 44

For questions on executing a participating addendum, please contact:

NASPO ValuePoint

Cooperative Development Coordinator:

Shannon Berry

Telephone:

775-720-3404

Email:

[email protected]

Please email fully executed PDF copy of this document

[email protected]

to support documentation of participation and posting

in appropriate data bases.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 4 of 44

Attachment A

State of Tennessee

(“State,” “Participating Entity,” or “Purchasing Entity”)

NASPO ValuePoint Cloud Solutions 2016-2026

All references to “Contract” hereinbelow shall collectively

refer to the “Master Contract”, “Participating Addendum”,

and “Supplemental Terms and Conditions”

Supplemental Terms and Conditions

Standard Terms and Conditions

1. Required Approvals. The State is not bound by this Contract until it is duly approved by the

Parties and all appropriate State officials in accordance with applicable Tennessee laws and

regulations. Depending upon the specifics of this Contract, this may include approvals by the

Commissioner of Finance and Administration, the Commissioner of Human Resources, the

Comptroller of the Treasury, and the Chief Procurement Officer. Approvals shall be evidenced by

a signature or electronic approval.

2. Modification and Amendment. This Contract may be modified only by a written amendment

signed by all Parties and approved by all applicable State officials.

3. Subject to Funds Availability. The Contract is subject to the appropriation and availability of State

or federal funds. In the event that the funds are not appropriated or are otherwise unavailable,

the State reserves the right to terminate this Contract upon written notice to the Contractor. The

State’s exercise of its right to terminate this Contract shall not constitute a breach of Contract by

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 5 of 44

the State. Upon receipt of the written notice, the Contractor shall cease all work associated with

the Contract. If the State terminates this Contract due to lack of funds availability, the Contractor

shall be entitled to compensation for all “non-returnable” or “non-cancellable” goods, (“Special

Order”) and all conforming goods requested and accepted by the State and for all satisfactory

and authorized services completed as of the termination date. Should the State exercise its right

to terminate this Contract due to unavailability of funds, the Contractor shall have no right to

recover from the State any actual, general, special, incidental, consequential, or any other

damages of any description or amount.

4. Termination for Convenience. The State may terminate this Contract for convenience without

cause and for any reason. The State shall give the Contractor at least thirty (30) days written

notice before the termination date. The Contractor shall be entitled to compensation for all

Special Order goods and all conforming goods delivered and accepted by the State or for

satisfactory, authorized services completed as of the termination date. In no event shall the State

be liable to the Contractor for compensation for any goods not requested by the State or for any

services not requested by the State by the Contractor. In no event shall the State’s exercise of its

right to terminate this Contract for convenience relieve the Contractor of any liability to the State

for any damages or claims arising under this Contract.

5. Termination for Cause. If the Contractor fails to properly perform its obligations under this

Contract in a timely or proper manner, or if the Contractor materially violates any terms of this

Contract (“Breach Condition”),the State shall have the right to immediately terminate the Contract.

In the event of a Breach Condition, the State shall have all other remedies available under this

Contract, at law, or in equity..

6. Assignment and Subcontracting. The Contractor shall not assign this Contract or enter into a

subcontract for any of the goods or services provided under this Contract without the prior written

approval of the State. Notwithstanding any use of the approved subcontractors, the Contractor

shall be the prime contractor and responsible for compliance with all terms and conditions of this

Contract. The State reserves the right to request additional information or impose additional

terms and conditions before approving an assignment of this Contract in whole or in part or the

use of subcontractors in fulfilling the Contractor’s obligations under this Contract.

7. Conflicts of Interest. The Contractor warrants that no part of the Contractor’s compensation shall

be paid directly or indirectly to an employee or official of the State of Tennessee as wages,

compensation, or gifts in exchange for acting as an officer, agent, employee, subcontractor, or

consultant to the Contractor in connection with any work contemplated or performed under this

Contract.

The Contractor acknowledges, understands, and agrees that this Contract shall be null and void if

the Contractor is, or within the past six (6) months has been, an employee of the State of

Tennessee or if the Contractor is an entity in which a controlling interest is held by an individual

who is, or within the past six (6) months has been, an employee of the State of Tennessee.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 6 of 44

8. Nondiscrimination. The Contractor hereby agrees, warrants, and assures that no person shall be

excluded from participation in, be denied benefits of, or be otherwise subjected to discrimination

in the performance of this Contract or in the employment practices of the Contractor on the

grounds of handicap or disability, age, race, creed, color, religion, sex, national origin, or any

other classification protected by federal or state law. The Contractor shall, upon request, show

proof of nondiscrimination and shall post in conspicuous places, available to all employees and

applicants, notices of nondiscrimination.

9. Prohibition of Illegal Immigrants. The requirements of Tenn. Code Ann. § 12-3-309 addressing

the use of illegal immigrants in the performance of any contract to supply goods or services to the

state of Tennessee, shall be a material provision of this Contract, a breach of which shall be

grounds for monetary and other penalties, up to and including termination of this Contract.

a) The Contractor agrees that the Contractor shall not knowingly utilize the services of an

illegal immigrant in the performance of this Contract and shall not knowingly utilize the

services of any subcontractor who will utilize the services of an illegal immigrant in the

performance of this Contract. The Contractor shall reaffirm this attestation, in writing, by

submitting to the State a completed and signed copy of the document at Attachment D,

upon request during the Term. If the Contractor is a party to more than one contract with

the State, the Contractor may submit one attestation that applies to all contracts with the

State. All Contractor attestations shall be maintained by the Contractor and made

available to State officials upon request.

b) Prior to the use of any subcontractor in the performance of this Contract, and upon

request thereafter, during the Term, the Contractor shall obtain and retain a current,

written attestation that the subcontractor shall not knowingly utilize the services of an

illegal immigrant to perform work under this Contract and shall not knowingly utilize the

services of any subcontractor who will utilize the services of an illegal immigrant to

perform work under this Contract. Attestations obtained from subcontractors shall be

maintained by the Contractor and made available to State officials upon request.

c) The Contractor shall maintain records for all personnel used in the performance of this

Contract. Contractor’s records shall be subject to review and random inspection at any

reasonable time upon reasonable notice by the State.

d) The Contractor understands and agrees that failure to comply with this section will be

subject to the sanctions of Tenn. Code Ann. § 12-3-309 for acts or omissions occurring

after its effective date.

e) For purposes of this Contract, "illegal immigrant" shall be defined as any person who is

not: (i) a United States citizen; (ii) a Lawful Permanent Resident; (iii) a person whose

physical presence in the United States is authorized; (iv) allowed by the federal

Department of Homeland Security and who, under federal immigration laws or

regulations, is authorized to be employed in the U.S.; or (v) is otherwise authorized to

provide services under the Contract.

10. Records. The Contractor shall maintain documentation for all charges under this Contract. The

books, records, and documents of the Contractor, for work performed or money received under

this Contract, shall be maintained for a period of five (5) full years from the date of the final

payment and shall be subject to audit at any reasonable time and upon reasonable notice by the

State, the Comptroller of the Treasury, or their duly appointed representatives. The financial

statements shall be prepared in accordance with generally accepted accounting principles.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 7 of 44

11. Monitoring. The Contractor’s activities conducted and records maintained pursuant to this Contract

shall be subject to monitoring and evaluation by the State, the Comptroller of the Treasury, or their

duly appointed representatives.

12. Progress Reports. The Contractor shall submit brief, periodic, progress reports to the State as

requested.

13. Strict Performance. Failure by any Party to this Contract to require, in any one or more cases,

the strict performance of any of the terms, covenants, conditions, or provisions of this Contract

shall not be construed as a waiver or relinquishment of any term, covenant, condition, or

provision. No term or condition of this Contract shall be held to be waived, modified, or deleted

except by a written amendment signed by the Parties.

14. Limitation of State’s Liability. The State shall have no liability except as specifically provided in

this Contract. In no event will the State be liable to the Contractor or any other party for any lost

revenues, lost profits, loss of business, decrease in the value of any securities or cash position,

time, goodwill, or any indirect, special, incidental, punitive, exemplary or consequential damages

of any nature, whether based on warranty, contract, statute, regulation, tort (including but not

limited to negligence), or any other legal theory that may arise under this Contract or otherwise.

The State’s total liability under this Contract (including any exhibits, schedules, amendments or

other attachments to the Contract) or otherwise shall under no circumstances exceed the

Estimated Liability. This limitation of liability is cumulative and not per incident.

15. Limitation of Contractor’s Liability.

In accordance with Tenn. Code Ann. § 12-3-701, the

Contractor’s liability for all claims arising under this Contract shall be limited to an amount equal

to two (2) times the Estimated Liability amount detailed in Special Terms and Conditions Item 2

and as may be amended, PROVIDED THAT in no event shall this Section limit the liability of the

Contractor for: (i) intellectual property or any Contractor indemnity obligations for infringement for

third-party intellectual property rights; (ii) any claims covered by any specific provision in the

Contract providing for liquidated damages; or (iii) any claims for intentional torts, criminal acts,

fraudulent conduct, or acts or omissions that result in personal injuries or death. For clarity,

except as otherwise expressly set forth in this Section, Contractor’s indemnification obligations

and other remedies available under this Contract are subject to the limitations on liability set forth

in this Section.

16. Hold Harmless. The Contractor agrees to indemnify and hold harmless the State of Tennessee

as well as its officers, agents, and employees from and against any and all claims, liabilities,

losses, and causes of action which may arise, accrue, or result to any person, firm, corporation,

or other entity which may be injured or damaged as a result of acts, omissions, or negligence on

the part of the Contractor, its employees, or any person acting for or on its or their behalf relating

to this Contract. The Contractor further agrees it shall be liable for the reasonable cost of

attorneys’ fees, court costs, expert witness fees, and other litigation expenses for the State to

enforce the terms of this Contract.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 8 of 44

In the event of any suit or claim, the Parties shall give each other immediate notice and provide

all necessary assistance to respond. The failure of the State to give notice shall only relieve the

Contractor of its obligations under this Section to the extent that the Contractor can demonstrate

actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor,

through its attorneys, the right to represent the State in any legal matter, as the right to represent

the State is governed by Tenn. Code Ann. § 8-6-106.

17. Statewide Contract Reports. All reports shall be submitted electronically in Microsoft Excel format.

Reports shall include the ability to sort or summarize data in accordance with the Contract

Administrator's specifications. All reports shall be provided at no additional cost to the State.

a) Quarterly Reports: Contractor(s) will submit quarterly reports to the Contract Administrator no

later than ten (10) days after the end of the State's quarter (e.g. a fiscal year quarter 2 report

for October - December is due no later than January 10th). At the Contract Administrator's

sole discretion, the State may extend the time allowed to complete quarterly reports.

Quarterly reports shall provide statistical data on all purchases under this Contract by State

Agencies, including State Agencies of the judicial or legislative branch, local governmental

entities in the State of Tennessee, including but not limited to educational institutions, local

governmental authorities, quasi-governmental bodies ("Other Governmental Bodies"), and

certain not-for-profit entities under Tenn. Code Ann. § 33-2-1001. At minimum, the quarterly

report's statistical data shall be detailed and broken down by line item to include:

1. Edison contract number

2. Contract line item number

3. Invoice date

4. Invoice number

5. Supplier part number

6. Item or bundle description

7. Quantity purchased

8. Unit of measure

9. Unit of measure description

10. Name of State Agency, Other Governmental Body or not-for-profit entity

11. Identity of purchaser: State entity or non-State entity

12. State Agency location

13. Unit/Contract price per line item

14. List price as listed in supplier's catalog if catalog item

15. Subtotals for each category above

16. Grand totals for each category above

b) Diversity Business and Subcontractor Usage Reports: The Contractor shall submit monthly

reports of returns, credits, savings, net purchases, and percent of net purchases by

subcontractors, small business enterprises, and businesses owned by minorities, women,

persons with disabilities, and Tennessee service-disabled veterans. Such reports shall be

submitted to the State of Tennessee Governor's Office of Diversity Business Enterprise in the

TN Diversity Software available online at:

https://tn.diversitysoftware.com/FrontEnd/StartCertification.asp?TN=tn&XID=9810.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 9 of 44

c) Custom Reports: When requested by the State, the Contractor shall submit custom

reports to the Contract Administrator within thirty (30) days of the request.

18. HIPAA Compliance. The State and Contractor shall comply with obligations under the Health

Insurance Portability and Accountability Act of 1996 (“HIPAA”), Health Information Technology for

Economic and Clinical Health (“HITECH”) Act and any other relevant laws and regulations

regarding privacy (collectively the “Privacy Rules”). The obligations set forth in this Section shall

survive the termination of this Contract.

a) Contractor warrants to the State that it is familiar with the requirements of the Privacy

Rules, and will comply with all applicable requirements in the course of this Contract.

b) Contractor warrants that it will cooperate with the State, including cooperation and

coordination with State privacy officials and other compliance officers required by the

Privacy Rules, in the course of performance of the Contract so that both parties will be in

compliance with the Privacy Rules.

c) The State and the Contractor will sign documents, including but not limited to business

associate agreements, as required by the Privacy Rules and that are reasonably

necessary to keep the State and Contractor in compliance with the Privacy Rules. This

provision shall not apply if information received or delivered by the parties under this

Contract is NOT “protected health information” as defined by the Privacy Rules, or if the

Privacy Rules permit the parties to receive or deliver the information without entering into

a business associate agreement or signing another document.

d) The Contractor will indemnify the State and hold it harmless for any violation by the

Contractor or its subcontractors of the Privacy Rules. This includes the costs of

responding to a breach of protected health information, the costs of responding to a

government enforcement action related to the breach, and any fines, penalties, or

damages paid by the State because of the violation.

19. Tennessee Consolidated Retirement System. Subject to statutory exceptions contained in Tenn.

Code Ann. §§ 8-36-801, et seq., the law governing the Tennessee Consolidated Retirement

System (“TCRS”), provides that if a retired member of TCRS, or of any superseded system

administered by TCRS, or of any local retirement fund established under Tenn. Code Ann. §§ 8-

35-101, et seq., accepts State employment, the member's retirement allowance is suspended

during the period of the employment. Accordingly and notwithstanding any provision of this

Contract to the contrary, the Contractor agrees that if it is later determined that the true nature of

the working relationship between the Contractor and the State under this Contract is that of

“employee/employer” and not that of an independent contractor, the Contractor, if a retired

member of TCRS, may be required to repay to TCRS the amount of retirement benefits the

Contractor received from TCRS during the Term.

20. Tennessee Department of Revenue Registration. The Contractor shall comply with all applicable

registration requirements contained in Tenn. Code Ann. §§ 67-6-601 – 608. Compliance with

applicable registration requirements is a material requirement of this Contract.

21. Debarment and Suspension. The Contractor certifies, to the best of its knowledge and belief, that

it, its current and future principals, its current and future subcontractors and their principals:

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 10 of 44

a) are not presently debarred, suspended, proposed for debarment, declared ineligible, or

voluntarily excluded from covered transactions by any federal or state department or

agency;

b) have not within a three (3) year period preceding this Contract been convicted of, or had

a civil judgment rendered against them from commission of fraud, or a criminal offense in

connection with obtaining, attempting to obtain, or performing a public (federal, state, or

local) transaction or grant under a public transaction; violation of federal or state antitrust

statutes or commission of embezzlement, theft, forgery, bribery, falsification, or

destruction of records, making false statements, or receiving stolen property;

c) are not presently indicted or otherwise criminally or civilly charged by a government entity

(federal, state, or local) with commission of any of the offenses detailed in section b. of

this certification; and

d) have not within a three (3) year period preceding this Contract had one or more public

transactions (federal, state, or local) terminated for cause or default.

The Contractor shall provide immediate written notice to the State if at any time it learns that

there was an earlier failure to disclose information or that due to changed circumstances, its

principals or the principals of its subcontractors are excluded, disqualified, or presently fall under

any of the prohibitions of sections a-d.

22. Force Majeure. “Force Majeure Event” means fire, flood, earthquake, elements of nature or acts

of God, wars, riots, civil disorders, rebellions or revolutions, acts of terrorism or any other similar

cause beyond the reasonable control of the Party except to the extent that the non-performing

Party is at fault in failing to prevent or causing the default or delay, and provided that the default

or delay cannot reasonably be circumvented by the non-performing Party through the use of

alternate sources, workaround plans or other means. A strike, lockout or labor dispute shall not

excuse either Party from its obligations under this Contract. Except as set forth in this Section,

any failure or delay by a Party in the performance of its obligations under this Contract arising

from a Force Majeure Event is not a default under this Contract or grounds for termination. The

non-performing Party will be excused from performing those obligations directly affected by the

Force Majeure Event, and only for as long as the Force Majeure Event continues, provided that

the Party continues to use diligent, good faith efforts to resume performance without delay. The

occurrence of a Force Majeure Event affecting Contractor’s representatives, suppliers,

subcontractors, customers or business apart from this Contract is not a Force Majeure Event

under this Contract. Contractor will promptly notify the State of any delay caused by a Force

Majeure Event (to be confirmed in a written notice to the State within one (1) day of the inception

of the delay) that a Force Majeure Event has occurred, and will describe in reasonable detail the

nature of the Force Majeure Event. If any Force Majeure Event results in a delay in Contractor’s

performance longer than thirty (30) days, the State may, upon notice to Contractor: (a) cease

payment of the fees for the affected obligations until Contractor resumes performance of the

affected obligations; or (b) immediately terminate this Contract or any purchase order, in whole or

in part, without further payment except for fees then due and payable. Contractor will not

increase its charges under this Contract or charge the State any fees other than those provided

for in this Contract as the result of a Force Majeure Event.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 11 of 44

23. Governing Law. This Contract shall be governed by and construed in accordance with the laws

of the State of Tennessee, without regard to its conflict or choice of law rules. The Tennessee

Claims Commission or the state or federal courts in Tennessee shall be the venue for all claims,

disputes, or disagreements arising under this Contract. The Contractor acknowledges and

agrees that any rights, claims, or remedies against the State of Tennessee or its employees

arising under this Contract shall be subject to and limited to those rights and remedies available

under Tenn. Code Ann. §§ 9-8-101 - 408.

24. Severability. If any terms and conditions of this Contract are held to be invalid or unenforceable

as a matter of law, the other terms and conditions of this Contract shall not be affected and shall

remain in full force and effect. The terms and conditions of this Contract are severable.

25. Headings. Section headings of this Contract are for reference purposes only and shall not be

construed as part of this Contract.

26. Incorporation of Additional Documents. Each of the following documents is included as a part of

this Contract by reference. In the event of a discrepancy or ambiguity regarding the Contractor’s

duties, responsibilities, and performance under this Contract, these items shall govern in order of

precedence below:

a. any amendment to this Contract, with the latter in time controlling over any earlier

amendments;

b. this Contract with any attachments or exhibits (excluding the items listed at subsections

c. through f., below);

c. any clarifications of or addenda to the Contractor’s proposal seeking this Contract;

d. the State solicitation, as may be amended, requesting responses in competition for this

Contract;

e. any technical specifications provided to proposers during the procurement process to

award this Contract; and

f. the Contractor’s response seeking this Contract.

27. Iran Divestment Act. The requirements of Tenn. Code Ann. § 12-12-101, et seq., addressing

contracting with persons as defined at Tenn. Code Ann. §12-12-103(5) that engage in investment

activities in Iran, shall be a material provision of this Contract. The Contractor certifies, under

penalty of perjury, that to the best of its knowledge and belief that it is not on the list created

pursuant to Tenn. Code Ann. § 12-12-106.

28. Major Procurement Contract Sales and Use Tax. Pursuant to Tenn. Code Ann. § 4-39-102 and

to the extent applicable, the Contractor and the Contractor’s subcontractors shall remit sales and

use taxes on the sales of goods or services that are made by the Contractor or the Contractor’s

subcontractors and that are subject to tax.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 12 of 44

29. Confidentiality of Records. Strict standards of confidentiality of records and information shall be

maintained in accordance with applicable state and federal law. All material and information,

regardless of form, medium or method of communication, provided to the Contractor by the State

or acquired by the Contractor on behalf of the State that is regarded as confidential under state or

federal law shall be regarded as “Confidential Information.” Nothing in this Section shall permit

Contractor to disclose any Confidential Information, regardless of whether it has been disclosed

or made available to the Contractor due to intentional or negligent actions or inactions of agents

of the State or third parties. Confidential Information shall not be disclosed except as required or

permitted under state or federal law. Contractor shall take all necessary steps to safeguard the

confidentiality of such material or information in conformance with applicable state and federal

law.

Special Terms and Conditions

1. Conflicting Terms and Conditions. Should any of these special terms and conditions conflict with

any other terms and conditions of this Contract, the special terms and conditions shall be

subordinate to the Contract’s other terms and conditions.

2. Estimated Liability. The total purchases of any goods or services under the Contract are not

known. The State estimates the purchases during the Term shall be twenty-five million dollars

($25,000,000) (“Estimated Liability”). This Contract does not grant the Contractor any exclusive

rights. The State does not guarantee that it will buy any minimum quantity of goods or services

under this Contract. Subject to the terms and conditions of this Contract, the Contractor will only

be paid for goods or services provided under this Contract after a purchase order is issued to

Contractor by the State or as otherwise specified by this Contract.

3. Travel Compensation. The Contractor shall not be compensated or reimbursed for travel time,

travel expenses, meals, or lodging.

4. Invoice Requirements. The Contractor shall invoice the State only for goods delivered and

accepted by the State or services satisfactorily provided at the amounts stipulated above.

Contractor shall invoice each State user agency (“Customer”) directly, and that agency shall pay

the vendor directly, with the funds coming from that agency’s budget. Contractor shall submit

invoices and necessary supporting documentation, no more frequently than once a month, and

no later than thirty (30) days after goods or services have been provided to the following address:

State Agency Billing Address, as set forth in the applicable order

a. Each invoice, on Contractor’s letterhead, shall clearly and accurately detail all of the

following information (calculations must be extended and totaled correctly):

(1) Invoice number (assigned by the Contractor);

(2) Invoice date;

(3) Contract number (assigned by the State);

(4) Customer account name: State Agency & Division Name;

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 13 of 44

(5) Customer account number (assigned by the Contractor to the above-referenced

Customer);

(6) Contractor name;

(7) Contractor Tennessee Edison registration ID number;

(8) Contractor contact for invoice questions (name, phone, or email);

(9) Contractor remittance address;

(10) Description of delivered goods or services provided and invoiced, including

identifying information as applicable;

(11) Number of delivered or completed units, increments, hours, or days as applicable, of

each good or service invoiced;

(12) Applicable payment methodology of each good or service invoiced;

(13) Amount due for each compensable unit of good or service; and

(14) Total amount due for the invoice period.

b. Contractor’s invoices shall:

(1) Only include charges for goods delivered or services provided as described in herein

and in accordance with payment terms and conditions;

(2) Only be submitted for goods delivered or services completed and shall not include

any charge for future goods to be delivered or services to be performed;

(3) Not include Contractor’s taxes, which includes without limitation Contractor’s sales

and use tax, excise taxes, franchise taxes, real or personal property taxes, or income

taxes; and

(4) Include shipping or delivery charges only as authorized in this Contract.

c. The timeframe for payment (or any discounts) begins only when the State is in

receipt of an invoice that meets the minimum requirements herein.

5. Prerequisite Documentation. The Contractor shall not invoice the State under this Contract until

the State has received the following, properly completed documentation.

a. The Contractor shall complete, sign, and present to the State the "Authorization

Agreement for Automatic Deposit Form" provided by the State. By doing so, the

Contractor acknowledges and agrees that, once this form is received by the State,

payments to the Contractor, under this or any other contract the Contractor has with the

State of Tennessee, may be made by ACH; and

c. The Contractor shall complete, sign, and return to the State the State-provided W-9 form.

The taxpayer identification number on the W-9 form must be the same as the

Contractor's Federal Employer Identification Number or Social Security Number

referenced in the Contractor’s Edison registration information.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 14 of 44

6. State Ownership of Goods. The State shall have ownership, right, title, and interest in all goods

provided by Contractor under this Contract including full rights to use the goods and transfer title

in the goods to any third parties.

7. Intellectual Property Indemnity. The Contractor agrees to indemnify and hold harmless the State

of Tennessee as well as its officers, agents, and employees from and against any and all claims

or suits which may be brought against the State concerning or arising out of any claim of an

alleged patent, copyright, trade secret or other intellectual property infringement. In any such

claim or action brought against the State, the Contractor shall satisfy and indemnify the State for

the amount of any settlement or final judgment, and the Contractor shall be responsible for all

legal or other fees or expenses incurred by the State arising from any such claim. The State shall

give the Contractor notice of any such claim or suit, however, the failure of the State to give such

notice shall only relieve Contractor of its obligations under this Section to the extent Contractor

can demonstrate actual prejudice arising from the State’s failure to give notice. This Section shall

not grant the Contractor, through its attorneys, the right to represent the State of Tennessee in

any legal matter, as provided in Tenn. Code Ann. § 8-6-106.

8. Additional lines, items, or options. At its sole discretion, the State may make written requests to

the Contractor to add lines, items, or options that are needed and within the Scope but were not

included in the original Contract. Such lines, items, or options will be added to the Contract

through a Memorandum of Understanding (“MOU”), not an amendment.

a. After the Contractor receives a written request to add lines, items, or options, the Contractor

shall have ten (10) business days to respond with a written proposal. The Contractor’s written

proposal shall include:

(1) The effect, if any, of adding the lines, items, or options on the other goods or services

required under the Contract;

(2) Any pricing related to the new lines, items, or options;

(3) The expected effective date for the availability of the new lines, items, or options; and

(4) Any additional information requested by the State.

b. The State may negotiate the terms of the Contractor’s proposal by requesting revisions to the

proposal.

c. To indicate acceptance of a proposal, the State will sign it. The signed proposal shall

constitute a MOU between the Parties, and the lines, items, or options shall be incorporated

into the Contract as if set forth verbatim.

d. Only after a MOU has been executed shall the Contractor perform or deliver the new lines,

items, or options.

9. Software License Warranty. Contractor grants a license to the State to use all Contractor owned

software provided under this Contract in the course of the State’s business and purposes. All

third-party owned software shall be subject to the terms and conditions of the third-party owned

software license.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 15 of 44

10. Software Support and Maintenance Warranty. Contractor shall provide to the State all software

upgrades, modifications, bug fixes, or other improvements in its software provided to the

Contractor from the OEM, that it makes generally available to its customers.

11. Extraneous Terms and Conditions. Contractor shall fill all orders submitted by the State under

this Contract. No purchase order, invoice, or other documents associated with any sales, orders,

or supply of any good or service under this Contract shall contain any terms or conditions other

than as set forth in the Contract. Any such extraneous terms and conditions shall be void, invalid

and unenforceable against the State. Any refusal by Contractor to supply any goods or services

under this Contract conditioned upon the State submitting to any extraneous terms and conditions

shall be a material breach of the Contract and constitute an act of bad faith by Contractor.

12. Comptroller Audit Requirements

a. Upon reasonable notice and at any reasonable time, the Contractor and

Subcontractor(s) agree to allow the State, the Comptroller of the Treasury, or their

duly appointed representatives to perform information technology control audits of

the Contractor and all Subcontractors used by the Contractor. Contractor will

maintain and cause its Subcontractors to maintain a complete audit trail of all

transactions and activities in connection with this Contract. Contractor will provide

to the State, the Comptroller of the Treasury, or their duly appointed

representatives access to Contractor and Subcontractor(s) personnel for the

purpose of performing the information technology control audit.

The information technology control audit may include a review of general controls

and application controls. General controls are the policies and procedures that

apply to all or a large segment of the Contractor’s or Subcontractor’s information

systems and applications and include controls over security management, access

controls, configuration management, segregation of duties, and contingency

planning. Application controls are directly related to the application and help

ensure that transactions are complete, accurate, valid, confidential, and available.

The audit shall include the Contractor’s and Subcontractor’s compliance with the

State’s Enterprise Information Security Policies and all applicable requirements,

laws, regulations or policies.

The audit may include interviews with technical and management personnel,

physical inspection of controls, and review of paper or electronic documentation.

For any audit issues identified, the Contractor and Subcontractor(s) shall provide a

corrective action plan to the State within 30 days from the Contractor or

Subcontractor receiving the audit report.

Each party shall bear its own expenses incurred while conducting the information

technology controls audit.

b. For any Software as a Service (SaaS), Infrastructure as a Service (IaaS), or

Platform as a Service (PaaS) models provided by the Contractor where the State

will use the Subcontractor’s applications or data centers to store or process State

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 16 of 44

financial or other data the Subcontractor shall be subject to an annual System and

Organization Controls (SOC) 2 Type 2 examination engagement or a SOC 1 Type 2

examination engagement by a qualified and reputable CPA firm in accordance with

the standards of the American Institute of Certified Public Accountants.

The scope of the SOC 2 Type 2 examination for SaaS models must include the

security, availability, confidentiality, and processing integrity Trust Services Criteria.

The scope of the SOC 2 Type 2 examination for IaaS and PaaS models must

include the security, availability, and confidentiality Trust Services Criteria. The

scope of the SOC 1 Type 2 examination must include a review of internal control

over financial reporting that is relevant to the Subcontractor’s scope of work.

The Contractor shall assist the State with obtaining a complete, unredacted version

of the SOC 1 Type 2 examination report and SOC 2 Type 2 examination report

upon request from the State. For any examination issues or exceptions described

in the SOC 1 Type 2 examination report or SOC 2 Type 2 examination report, upon

request from the State, the Contractor shall assist the State with obtaining

corrective action plans from the Subcontractor that describe how the Subcontractor

will correct the issues or exceptions.

In the event the CPA firm issues a modified opinion on the SOC examination report,

meaning that the opinion is qualified, adverse, or disclaimed, the Contractor will

assist the State with obtaining in writing the Subcontractor’s plan to correct the

issues that caused the modified opinion. The Contractor must assist the State with

having the Subcontractor demonstrate to the State that the issues have been

corrected prior to the commencement of the next scheduled SOC examination.

If the scope of the most recent SOC examination report does not include all of the

current State fiscal year, upon request from the State, the Contractor must provide

assistance to the State with obtaining a letter from the Subcontractor stating

whether the Subcontractor made any material changes to their control environment

since the prior SOC examination and, if so, whether the changes, in the opinion of

the Subcontractor, would negatively affect the auditor’s opinion in the most recent

SOC examination report.

No additional funding shall be allocated for these audits as they are included in the

Estimated Liability of this Contract.

The State and Comptroller of the Treasury must approve any exceptions to this

requirement.

13. Contractor Hosted Services Confidential Data, Audit, and Other Requirements.

The following provisions shall only apply if an order expressly says that they apply to such

order.

a. “Confidential State Data” is defined as data deemed confidential by State or Federal

statute or regulation. The Contractor shall protect Confidential State Data as

follows:

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 17 of 44

(1) The Contractor shall ensure that all Confidential State Data is housed in the

continental United States, inclusive of backup data.

(2) The Contractor shall encrypt Confidential State Data at rest and in transit using

the current version of Federal Information Processing Standard (“FIPS”) 140 -2

validated encryption technologies.

(3) The Contractor and the Contractor’s processing environment containing

Confidential State Data shall either (1) be in accordance with at least one of the

following security standards: (i) International Standards Organization (“ISO”)

27001; (ii) Federal Risk and Authorization Management Program (“FedRAMP”);

or (2) be subject to an annual engagement by a CPA firm in accordance with

the standards of the American Institute of Certified Public Accountants

(“AICPA”) for a System and Organization Controls for service organizations

(“SOC”) Type II audit. The State shall approve the SOC audit control

objectives. The Contractor shall provide proof of current ISO certification or

FedRAMP authorization for the Contractor and Subcontractor(s), or provide the

State with the Contractor’s and Subcontractor’s annual SOC Type II audit report

within 30 days from when the CPA firm provides the audit report to the

Contractor or Subcontractor. The Contractor shall submit corrective action

plans to the State for any issues included in the audit report within 30 days after

the CPA firm provides the audit report to the Contractor or Subcontractor.

If the scope of the most recent SOC audit report does not include all of the

current State fiscal year, upon request from the State, the Contractor must

provide to the State a letter from the Contractor or Subcontractor stating

whether the Contractor or Subcontractor made any material changes to their

control environment since the prior audit and, if so, whether the changes, in the

opinion of the Contractor or Subcontractor, would negatively affect the auditor’s

opinion in the most recent audit report.

No additional funding shall be allocated for these certifications, authorizations,

or audits as these are included in the Estimated Liability of this Contract.

Contractor shall meet all applicable requirements of the most current version of

Internal Revenue Service Publication 1075.

Contractor shall meet requirements of current version of Minimum Acceptable

Risk Standards for Exchanges (“MARS-E”) controls.

(a) If the order will involve CJIS data, FTI data, then the following shall apply in

lieu of section 14.a.(3):

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 18 of 44

The Contractor shall maintain a Security Management Certification from the

Federal Risk and Authorization Management Program (“FedRAMP”). A

“Security Management Certification” shall mean written confirmation fr om

FedRAMP that FedRAMP has assessed the Contractor’s information

technology Infrastructure, using a standardized approach to security

assessment, authorization, and continuous monitoring for cloud products

and services, and has certified that the Contractor meets FedRAMP

standards. Information technology “Infrastructure” shall mean the

Contractor’s entire collection of hardware, software, networks, data centers,

facilities and related equipment used to develop, test, operate, monitor,

manage and/or support information technology services. The Contractor

shall provide proof of current certification annually and upon State request.

No additional funding shall be allocated for these certifications,

authorizations, or audits as these are included in the Estimated Liability of

this Contract.

(b) If the order will contain FTI data, the following sentence also applies to

section 14.a.(3)(a) (FedRAMP) language above:

Contractor shall meet all applicable requirements of the most current

version of Internal Revenue Service Publication 1075.

section 14.a.(3)(a) language above:

Contractor shall meet requirements of current version of Minimum

Acceptable Risk Standards for Exchanges (“MARS-E”) controls.

(4) The Contractor must annually perform Penetration Tests and Vulnerability

Assessments against its Processing Environment. “Processing Environment”

shall mean the combination of software and hardware on which the Application

runs. “Application” shall mean the computer code that supports and

accomplishes the State’s requirements as set forth in this Contract. “Penetration

Tests” shall be in the form of attacks on the Contractor’s computer system, with

the purpose of discovering security weaknesses which have the potential to

gain access to the Processing Environment’s features and data. The

“Vulnerability Assessment” shall be designed and executed to define, identify,

and classify the security holes (vulnerabilities) in the Processing Environment.

The Contractor shall allow the State, at its option, to perform Penetration Tests

and Vulnerability Assessments on the Processing Environment.

(5) Upon State request, the Contractor shall provide a copy of all Confidential State

Data it holds. The Contractor shall provide such data on media and in a format

determined by the State.

(6) Upon termination of this Contract and in consultation with the State, the

Contractor shall destroy all Confidential State Data it holds (including any

copies such as backups) in accordance with the current version of National

Institute of Standards and Technology (“NIST”) Special Publication 800-88. The

Contractor shall provide a written confirmation of destruction to the State within

ten (10) business days after destruction.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 19 of 44

(7) If the order will involve PCI data, the following shall apply:

Contractor shall be certified to host Payment Card Industry (“PCI”) data in

accordance with the current version of PCI DSS (“Data Security Standard”),

maintained by the PCI Security Standards Council.

b. Minimum Requirements

(1) The Contractor and all data centers used by the Contractor to host State data,

including those of all Subcontractors, must comply with the State’s Enterprise

Information Security Policies as amended periodically. The State’s Enterprise

Information Security Policies document is found at the following URL:

https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-

solutions/sts-security-policies.html.

(2) The Contractor agrees to maintain the Application so that it will run on a

current, manufacturer-supported Operating System. “Operating System” shall

mean the software that supports a computer's basic functions, such as

scheduling tasks, executing applications, and controlling peripherals.

(3) If the Application requires middleware or database software, Contractor shall

maintain middleware and database software versions that are at all times fully

compatible with current versions of the Operating System and Application to

ensure that security vulnerabilities are not introduced.

c. Business Continuity Requirements. The Contractor shall maintain set(s) of

documents, instructions, and procedures which enable the Contractor to respond to

accidents, disasters, emergencies, or threats without any stoppage or hindrance in

its key operations (“Business Continuity Requirements”). Business Continuity

Requirements shall include:

1. “Disaster Recovery Capabilities” refer to the actions the Contractor

takes to meet the Recovery Point and Recovery Time Objectives

defined below. Disaster Recovery Capabilities shall meet the

following objectives:

i. Recovery Point Objective (“RPO”). The RPO is defined as

the maximum targeted period in which data might be lost

from an IT service due to a major incident: The applicable

RPO will be defined in each Order.

ii. Recovery Time Objective (“RTO”). The RTO is defined as

the targeted duration of time and a service level within which

a business process must be restored after a disaster (or

disruption) in order to avoid unacceptable consequences

associated with a break in business continuity: The

applicable RTO will be defined in each Order.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 20 of 44

2. The Contractor and the Subcontractor(s) shall perform at least one

Disaster Recovery Test every three hundred sixty-five (365) days. A

“Disaster Recovery Test” shall mean the process of verifying the

success of the restoration procedures that are executed after a

critical IT failure or disruption occurs. The Disaster Recovery Test

shall use actual State Data Sets that mirror production data, and

success shall be defined as the Contractor verifying that the

Contractor can meet the State’s RPO and RTO requirements. A

“Data Set” is defined as a collection of related sets of information

that is composed of separate elements but can be manipulated as a

unit by a computer. The Contractor shall provide written confirmation

to the State after each Disaster Recovery Test that its Disaster

Recovery Capabilities meet the RPO and RTO requirements.

3. The Contractor shall have the ability to provide base level protection

against Layer 3 and Layer 4 Distributed Denial of Service volume

based and protocol attacks such as SYN, UDP, and ICMP floods,

DNS amplification and reflection attacks.

4. The contractor shall have the ability to provide addition mitigation

against Layer 7 Distributed Denial of Service attacks such as HTTP

floods, WordPress XML-RPV Floods and Slowloris attacks.

d. In the event of a cyber breach, the Contractor will allow the State to communicate

directly with the Contractor’s technical staff and any forensics experts who are

assisting the Contractor with the breach analysis.

14. Prohibited Advertising or Marketing. The Contractor shall not suggest or imply in advertising or

marketing materials that Contractor's goods or services are endorsed by the State. The

restrictions on Contractor advertising or marketing materials under this Section shall survive the

termination of this Contract.

15. Public Accountability. If the Contractor is subject to Tenn. Code Ann. §§ 8-4-401, et seq., or if

this Contract involves the provision of services to citizens by the Contractor on behalf of the

State, the Contractor agrees to establish a system through which recipients of services may

present grievances about Contractor’s operation of the service program. The Contractor shall

also display in a prominent place, located near the passageway through which the public enters

in order to receive contract-supported services, a sign at least eleven inches (11") in height and

seventeen inches (17") in width stating the following:

NOTICE: THIS AGENCY IS A RECIPIENT OF TAXPAYER FUNDING. IF YOU OBSERVE AN

AGENCY DIRECTOR OR EMPLOYEE ENGAGING IN ANY ACTIVITY THAT YOU CONSIDER

TO BE ILLEGAL, IMPROPER, OR WASTEFUL, PLEASE CALL THE STATE COMPTROLLER’S

TOLL-FREE HOTLINE: 1-800-232-5454

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 21 of 44

The sign shall be of the form prescribed by the Comptroller of the Treasury. The contracting state

agency shall request copies of the sign from the Comptroller of the Treasury and provide signs to

contractors.

16. Contractor Commitment to Diversity. The Contractor shall comply with and make reasonable

business efforts to exceed the commitment to diversity represented by the Contractor’s Response

to this Participating Addendum (Attachment E) and resulting in this Contract.

The Contractor shall assist the State in monitoring the Contractor’s performance of this

commitment by providing, as requested, a monthly report of participation in the performance of

this Contract by small business enterprises and businesses owned by minorities, women, service-

disabled veterans, and persons with disabilities. Such reports shall be provided to the State of

Tennessee Governor's Office of Diversity Business Enterprise in the TN Diversity Software

available online at:

https://tn.diversitysoftware.com/FrontEnd/StartCertification.asp?TN=tn&XID=9810

17. Unencumbered Personnel. The Contractor shall not restrict its employees, agents,

subcontractors or principals who perform services for the State under this Contract from

performing the same or similar services for the State after the termination of this Contract, either

as a State employee, an independent contractor, or an employee, agent, subcontractor or

principal of another contractor with the State.

18. Personally Identifiable Information. While performing its obligations under this Contract,

Contractor may have access to Personally Identifiable Information held by the State (“PII”). For

the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is

defined in Title V of the Gramm-Leach-Bliley Act of 1999 or any successor federal statute, and

the rules and regulations thereunder, all as may be amended or supplemented from time to time

(“GLBA”) and personally identifiable information and other data protected under any other

applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal

information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would

cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its

employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII

only as necessary to carry out those specific aspects of the purpose for which the PII was

disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii)

implement and maintain appropriate technical and organizational measures regarding information

security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or

hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII.

Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or

any of its employees, agents and representatives in breach of this Contract; and (2) of any

disclosure of any PII to Contractor or its employees, agents and representatives where the

purpose of such disclosure is not known to Contractor or its employees, agents and

representatives. The State reserves the right to review Contractor's policies and procedures

used to maintain the security and confidentiality of PII and Contractor shall, and cause its

employees, agents and representatives to, comply with all reasonable requests or directions from

the State to enable the State to verify or ensure that Contractor is in full compliance with its

obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or

at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall

immediately return to the State any and all PII which it has received under this Contract and shall

destroy all records of such PII.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 22 of 44

The Contractor shall report to the State any instances of unauthorized access to or potential

disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to

the Contractor’s attention. Any such report shall be made by the Contractor within twenty-four

(24) hours after the Unauthorized Disclosure has come to the attention of the Contractor.

Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The

Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for

individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the

cost of notification to all individuals affected by the Unauthorized Disclosure, including individual

letters and public notice. The remedies set forth in this Section are not exclusive and are in

addition to any claims or remedies available to this State under this Contract or otherwise

available at law. The obligations set forth in this Section shall survive the termination of this

Contract.

19. Statewide Contract. This Contract establishes a source or sources of supply for all Tennessee

State Agencies. “Tennessee State Agency” refers to the various departments, institutions,

boards, commissions, and agencies of the executive branch of government of the State of

Tennessee with exceptions as addressed in Tenn. Comp. R. & Regs. 0690-03-01-.01. The

Contractor shall provide all goods or services and deliverables as required by this Contract to all

Tennessee State Agencies. The Contractor shall make this Contract available to the following

entities, who are authorized to and who may purchase off of this Statewide Contract (“Authorized

Users”):

a. all Tennessee State governmental entities (this includes the legislative branch; judicial

branch; and, commissions and boards of the State outside of the executive branch of

government);

b. Tennessee local governmental agencies;

c. members of the University of Tennessee or Tennessee Board of Regents systems;

d. any private nonprofit institution of higher education chartered in Tennessee; and,

e. any corporation which is exempted from taxation under 26 U.S.C. Section 501(c) (3), as

amended, and which contracts with the Department of Mental Health and Substance

Abuse to provide services to the public (Tenn. Code Ann. § 33-2-1001).

These Authorized Users may utilize this Contract by purchasing directly from the Contractor

according to their own procurement policies and procedures. The State is not responsible or

liable for the transactions between the Contractor and Authorized Users.

20. Survival. The terms, provisions, representations, and warranties contained in this Contract which

by their sense and context are intended to survive the performance and termination of this

Contract, shall so survive the completion of performance and termination of this Contract.

21. Inspection and Acceptance. The State shall have the right to inspect all goods or services

provided by Contractor under this Contract. If, upon inspection, the State determines that the

goods or services are Defective, the State shall notify Contractor, and Contractor shall re-deliver

the goods or provide the services at no additional cost to the State. If after a period of thirty (30)

days following delivery of goods or performance of services the State does not provide a notice of

any Defects, the goods or services shall be deemed to have been accepted by the State.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 23 of 44

22. Term of Participating Addendum. This Contract shall be effective on 9/21/2020 (“Effective Date”)

and extend for a period of thirty-six (36) months after the Effective Date (“Term”). The State shall

have no obligation for goods or services provided by the Contractor prior to the Effective Date.

23. Renewal Options. This Contract may be renewed upon satisfactory completion of the Term. The

State reserves the right to execute up to two (2) renewal options under the same terms and

conditions for a period not to exceed twelve (12) months each by the State, at the State's sole

option. In no event, however, shall the maximum Term, including all renewals or extensions,

exceed a total of sixty (60) months.

24. Participating Addendum Term Extension. The State may extend the Term an additional period of

time, not to exceed one hundred-eighty (180) days beyond the expiration date of this Contract,

under the same terms and conditions, at the State’s sole option. In no event, however, shall the

maximum Term, including all renewals or extensions, exceed a total of sixty (60) months.

25. Warranty. Contractor represents and warrants that the term of the warranty (“Warranty Period”)

shall be the greater of the Term of this Contract or any other warranty generally offered by

Contractor, its suppliers, or manufacturers to customers of its goods or services. The goods or

services provided under this Contract shall conform to the terms and conditions of this Contract

throughout the Warranty Period. Any nonconformance of the goods or services to the terms and

conditions of this Contract shall constitute a “Defect” and shall be considered “Defective.” If

Contractor receives notice of a Defect during the Warranty Period, then Contractor shall correct

the Defect, at no additional charge.

Contractor represents and warrants that the State is authorized to possess and use all

equipment, materials, software, and deliverables provided under this Contract.

Contractor represents and warrants that all goods or services provided under this Contract shall

be provided in a timely and professional manner, by qualified and skilled individuals, and in

conformity with standards generally accepted in Contractor’s industry.

If Contractor fails to provide the goods or services as warranted, then Contractor will re-provide

the goods or services at no additional charge. If Contractor is unable or unwilling to re-provide

the goods or services as warranted, then the State shall be entitled to recover the fees paid to

Contractor for the Defective goods or services. Any exercise of the State’s rights under this

Section shall not prejudice the State’s rights to seek any other remedies available under this

Contract or applicable law.

26. State and Federal Compliance. The Contractor shall comply with all State and federal laws and

regulations applicable to Contractor in the Contractor’s performance of this Contract.

27. Nondiscrimination. The Contractor hereby agrees, warrants, and assures that no person shall be

excluded from participation in, be denied benefits of, or be otherwise subjected to discrimination

in the performance of this Contract or in the employment practices of the Contractor on the basis

of any classification protected by federal, Tennessee State constitutional, or statutory law. The

Contractor shall, upon request, show proof of such nondiscrimination and shall post in

conspicuous places, available to all employees and applicants, notices of nondiscrimination.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 24 of 44

28. Administrative Fees. The Contractor shall pay the State an Administrative Fee of one (1) percent

(1.0% or 0.01) in accordance with the Terms and Conditions of the Master Agreement no later

than 60 days following the end of each calendar quarter. The State’s Administrative Fee shall be

submitted quarterly and is based on sales of products and services (less any charges for taxes or

shipping).

Period End Admin Fee Due

March 31 May 31

June 30 August 31

September 30 November 30

December 31 February 28

The administrative fee shall be submitted to the following address:

Ron Plumb, Director of Financial Management

Department of General Services

W.R. Snodgrass TN. Tower 24th Floor

312 Rosa L. Parks Avenue

Nashville, TN 37243

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 25 of 44

ATTACHMENT B

FEDERALLY MANDATED REQUIREMENTS FOR SERVICES CONTRACTS WITH

ACCESS TO FEDERAL TAX RETURN INFORMATION

Federal Tax Information (“FTI”) includes return or return information received directly from the

IRS or obtained through an authorized secondary source, such as Social Security

Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the

Fiscal Service (BFS), or Centers for Medicare and Medicaid Services (CMS), or another entity

acting on behalf of the IRS pursuant to an IRC 6103(p)(2)(B) Agreement. FTI includes any

information created by the recipient that is derived from federal return or return information

received from the IRS or obtained through a secondary source.

CONTRACT LANGUAGE FOR GENERAL SERVICES

I. PERFORMANCE

In performance of this Contract, the Contractor agrees to comply with and assume responsibility

for compliance by his or her employees with the following requirements:

(1) All work will be performed under the supervision of the Contractor or the Contractor's

responsible employees.

(2) The Contractor and the Contractor’s employees with access to or who use FTI must

meet the background check requirements defined in IRS Publication 1075.

(3) Any Federal tax returns or return information (hereafter referred to as returns or return

information) made available shall be used only for the purpose of carrying out the

provisions of this Contract. Information contained in such material shall be treated as

confidential and shall not be divulged or made known in any manner to any person

except as may be necessary in the performance of this Contract. Inspection by or

disclosure to anyone other than an officer or employee of the Contractor is prohibited.

(4) All returns and return information will be accounted for upon receipt and properly stored

before, during, and after processing. In addition, all related output and products will be

given the same level of protection as required for the source material.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 26 of 44

(5) No work involving returns and return information furnished under this Contract will be

subcontracted without prior written approval of the IRS.

(6) The Contractor will maintain a list of employees authorized access. Such list will be

provided to the State and, upon request, to the IRS reviewing office.

(7) The State will have the right to void the Contract if the Contractor fails to provide the

safeguards described above.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of any person to whom returns or return information is or may

be disclosed shall be notified in writing by such person that returns or return information

disclosed to such officer or employee can be used only for a purpose and to the extent

authorized herein, and that further disclosure of any such returns or return information

for a purpose or to an extent unauthorized herein constitutes a felony punishable upon

conviction by a fine of as much as $5,000 or imprisonment for as long as five years, or

both, together with the costs of prosecution. Such person shall also notify each such

officer and employee that any such unauthorized future disclosure of returns or return

information may also result in an award of civil damages against the officer or employee

in an amount not less than $1,000 with respect to each instance of unauthorized

disclosure. These penalties are prescribed by IRCs 7213 and 7431 and set forth at 26

CFR 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or may

be disclosed shall be notified in writing by such person that any return or return

information made available in any format shall be used only for the purpose of carrying

out the provisions of this Contract. Information contained in such material shall be

treated as confidential and shall not be divulged or made known in any manner to any

person except as may be necessary in the performance of this Contract. Inspection by or

disclosure to anyone without an official need-to-know constitutes a criminal

misdemeanor punishable upon conviction by a fine of as much as $1,000 or

imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such

person shall also notify each such officer and employee that any such unauthorized

inspection or disclosure of returns or return information may also result in an award of

civil damages against the officer or employee in an amount equal to the sum of the

greater of $1,000 for each act of unauthorized inspection or disclosure with respect to

which such defendant is found liable or the sum of the actual damages sustained by the

plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a

willful inspection or disclosure which is the result of gross negligence, punitive damages,

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 27 of 44

plus the costs of the action. The penalties are prescribed by IRCs 7213A and 7431 and

set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the Contractor to inform its officers and employees of

the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a.

Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to Contractors by 5 U.S.C.

552a(m)(1), provides that any officer or employee of a Contractor, who by virtue of

his/her employment or official position, has possession of or access to State records

which contain individually identifiable information, the disclosure of which is prohibited by

the Privacy Act or regulations established thereunder, and who knowing that disclosure

of the specific material is so prohibited, willfully discloses the material in any manner to

any person or entity not entitled to receive it, shall be guilty of a misdemeanor and fined

not more than $5,000.

(4) Granting a Contractor access to FTI must be preceded by certifying that each individual

understands the State’s security policy and procedures for safeguarding IRS information.

Contractors must maintain their authorization to access FTI through annual

recertification. The initial certification and recertification must be documented and placed

in the State's files for review. As part of the certification and at least annually afterwards,

Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see

Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for

Unauthorized Disclosure. The training provided before the initial certification and

annually thereafter must also cover the incident response policy and procedure for

reporting unauthorized disclosures and data breaches. (See Section 10) For both the

initial certification and the annual certification, the Contractor must sign, either with ink or

electronic signature, a confidentiality statement certifying their understanding of the

security requirements.

III. INSPECTION

The IRS and the State, with 24 hour notice, shall have the right to send its inspectors

into the offices and plants of the Contractor to inspect facilities and operations

performing any work with FTI under this Contract for compliance with requirements

defined in IRS Publication 1075. The right of inspection shall include the use of manual

and/or automated scanning tools to perform compliance and vulnerability assessments

of information technology (IT) assets that access, store, process or transmit FTI. On the

basis of such inspection, corrective actions may be required in cases where the

Contractor is found to be noncompliant with Contract safeguards.

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 28 of 44

ATTACHMENT C

FEDERALLY MANDATED REQUIREMENTS FOR TECHNOLOGYSERVICES

CONTRACTS WITH ACCESS TO FEDERAL TAX RETURN INFORMATION

Federal Tax Information (“FTI”) includes return or return information received directly from the

IRS or obtained through an authorized secondary source, such as Social Security

Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the

Fiscal Service (BFS), or Centers for Medicare and Medicaid Services (CMS), or another entity

acting on behalf of the IRS pursuant to an IRC 6103(p)(2)(B) Agreement. FTI includes any

information created by the recipient that is derived from federal return or return information

received from the IRS or obtained through a secondary source.

CONTRACT LANGUAGE FOR TECHNOLOGY SERVICES

I. PERFORMANCE

In performance of this Contract, the Contractor agrees to comply with and assume responsibility

for compliance by his or her employees with the following requirements:

(1) All work will be done under the supervision of the Contractor or the Contractor's

employees.

(2) The Contractor and the Contractor’s employees with access to or who use FTI must

meet the background check requirements defined in IRS Publication 1075.

(3) Any return or return information made available in any format shall be used only for the

purpose of carrying out the provisions of this Contract. Information contained in such

material will be treated as confidential and will not be divulged or made known in any

manner to any person except as may be necessary in the performance of this Contract.

Disclosure to anyone other than an officer or employee of the Contractor will be

prohibited.

(4) All returns and return information will be accounted for upon receipt and properly stored

before, during, and after processing. In addition, all related output will be given the same

level of protection as required for the source material.

(5) The contractor certifies that the data processed during the performance of this contract

will be completely purged from all data storage components of his or her computer

facility, and no output will be retained by the contractor at the time the work is

completed. If immediate purging of all data storage components is not possible, the

contractor certifies that any IRS data remaining in any storage component will be

safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the

processing of IRS data will be given to the agency or his or her designee. When this is

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 29 of 44

not possible, the contractor will be responsible for the destruction of the spoilage or any

intermediate hard copy printouts, and will provide the agency or his or her designee with

a statement containing the date of destruction, description of material destroyed, and the

method used.

(7) All computer systems receiving, processing, storing or transmitting FTI must meet the

requirements defined in IRS Publication 1075. To meet functional and assurance

requirements, the security features of the environment must provide for the managerial,

operational, and technical controls. All security features must be available and activated

to protect against unauthorized use of and access to Federal Tax Information.

(8) No work involving Federal Tax Information furnished under this Contract will be

subcontracted without prior written approval of the IRS.

(9) The Contractor will maintain a list of employees authorized access. Such list will be

provided to the State and, upon request, to the IRS reviewing office.

(10) The State will have the right to void the Contract if the Contractor fails to provide the

safeguards described above.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of any person to whom returns or return information is or may

be disclosed will be notified in writing by such person that returns or return information

disclosed to such officer or employee can be used only for a purpose and to the extent

authorized herein, and that further disclosure of any such returns or return information

for a purpose or to an extent unauthorized herein constitutes a felony punishable upon

conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or

both, together with the costs of prosecution. Such person shall also notify each such

officer and employee that any such unauthorized further disclosure of returns or return

information may also result in an award of civil damages against the officer or employee

in an amount not less than $1,000 with respect to each instance of unauthorized

disclosure. These penalties are prescribed by IRCs 7213 and 7431 and set forth at 26

CFR 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or may

be disclosed shall be notified in writing by such person that any return or return

information made available in any format shall be used only for the purpose of carrying

out the provisions of this Contract. Information contained in such material shall be

treated as confidential and shall not be divulged or made known in any manner to any

person except as may be necessary in the performance of the Contract. Inspection by or

disclosure to anyone without an official need-to-know constitutes a criminal

misdemeanor punishable upon conviction by a fine of as much as $1,000 or

NASPO ValuePoint

PARTICIPATING ADDENDUM

CLOUD SOLUTIONS 2016-2026

Lead by the State of Utah

Page 30 of 44