1. Referencing the State of Kansas contract, you will find this is an IDIQ contract. Which other contract type could have been used for this contract? What are the pro and cons of the contract type you identified?

2.Your paper should be no less than 1400 words . Be specific in your assessment by ensuring you include, why and how you would use the contract type you chose. Be sure to cite any sources or list references used to form your conclusion.

AD ASTRA PER ASPERA Office of Procurement and Contracts Kansas Phone: 785-298-2376 900 SW Jackson St., Room 451 South Fex: 785-298-7240 Topeka, KS 68612 Department of Administration www.admin.ks. govoffices/procurement-and-contracts Duane Goossen, Acting Secretary Laura Kelly, Governor CONTRACT AWARD Date of Award: May 01, 2019 Contract ID: 0000000000000000000046417 Event ID: EVT0006086 Replace Contract: 10713 and EVT0002480 Procurement Officer: Angela Brown Telephone: 785/296-7251 E-Mail Address: angela.brown@k Web Address: http://admin.ks.gov/offices/procurement-and-contracts Item: Information Technology Services Agency/Business Unit: Statewide - Optional Period of Contract: May 01, 2019 through January 31, 2024 With the option to renew for five (5) additional 12-month periods) Contractor: INFOJINI INC 10015 OLD COLUMBIA RD, SUITE B215 COLUMBIA, MD 21046 Vendor ID: 0000575248 FEIN: On file Contact Person: Sandee E-Mail: statebids@infojiniconsulting.com Cell Phone Number: 443-257-0086 Fax: 443-283-4249 Payment Terms: Net 30 Political Subdivisions: Pricing is available to the political subdivisions of the State of Kansas. Procurement Cards: Agencies may not use a P-Card for purchases from this contract. Administrative Fee: An Administrative Fee will be assessed against purchases from this contract. Awarded Groups: Groups 1, 2, 7, 8 and 9 The above referenced contract award was recently posted to Procurement and Contracts website. The document can be downloaded by going to the following website: http://www.da.ks.gov/purchontracts/Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 2 1. Terms and Conditions 1.1. 1.2. 1.3. 1.4. 1.5. 1.6. 1.7. 1.8. 1.9. Contract Documents In the event of a conflict in terms of language among the documents, the following order of precedence shall govern: . Form DA 146a; 0 written modifications to the executed contract; 0 written contract signed by the parties; . the Bid Event documents, including any and all amendments; and o Contractor's written offer submitted in response to the Bid Event as finalized. Captions The captions or headings in this contract are for reference only and do not define, describe, extend, or limit the scope or intent of this contract. Definitions A glossary of common procurement terms is available at http://admin.ks.gov/offices/procurement-and-contracts, under the "Procurement Forms" link. Contract Formation N0 contract shall be considered to have been entered into by the State until all statutorily required signatures and certifications have been rendered and a written contract has been signed by the contractor. Notices All notices, demands, requests, approvals, reports, instructions, consents or other communications (collectively "notices") that may be required or desired to be given by either party to the other shall be IN WRITING and addressed as follows: Kansas Procurement and Contracts 900 SW Jackson, Suite 451-South Topeka, Kansas 66612-1286 RE: Contract Number 46417 or to any other persons or addresses as may be designated by notice from one party to the other. Statutes Each and every provision of law and clause required by law to be inserted in the contract shall be deemed to be inserted herein and the contract shall be read and enforced as though it were included herein. lf through mistake or otherwise any such provision is not inserted, or is not correctly inserted, then on the application of either party the contract shall be amended to make such insertion or correction. Governing Law This contract shall be governed by the laws of the State of Kansas and shall be deemed executed in Topeka, Shawnee County, Kansas. Jurisdiction The parties shall bring any and all legal proceedings arising hereunder in the State of Kansas District Court of Shawnee County, unless otherwise specified and agreed upon by the State of Kansas. Contractor waives personal service of process, all defenses of lack of personal jurisdiction and forum non conveniens. The Eleventh Amendment of the United States Constitution is an inherent and incumbent protection with the State of Kansas and need not be reserved, but prudence requires the State to reiterate that nothing related to this Agreement shall be deemed a waiver of the Eleventh Amendment Mandatom Provisions The provisions found in Contractual Provisions Attachment (DA 146a) are incorporated by reference and made a part of this contract. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 3 1.10. Termination for Cause The Director of Purchases may terminate this contract, or any part of this contract, for cause under any one of the following circumstances: 0 the Contractor fails to make delivery of goods or services as specified in this contract; 0 the Contractor provides substandard quality or workmanship; o the Contractor fails to perform any of the provisions of this contract, or o the Contractor fails to make progress as to endanger performance of this contract in accordance with its terms. The Director of Purchases shall provide Contractor with written notice of the conditions endangering performance. If the Contractor fails to remedy the conditions within ten (10) days from the receipt of the notice (or such longer period as State may authorize in writing), the Director of Purchases shall issue the Contractor an order to stop work immediately. Receipt of the notice shall be presumed to have occurred within three (3) days of the date of the notice. 1.11. Termination for Convenience The Director of Purchases may terminate performance of work under this contract in whole or in part whenever, for any reason, the Director of Purchases shall determine that the termination is in the best interest of the State of Kansas. In the event that the Director of Purchases elects to terminate this contract pursuant to this provision, it shall provide the Contractor written notice at least 30 days prior to the termination date. The termination shall be effective as of the date specified in the notice. The Contractor shall continue to perform any part of the work that may have not been terminated by the notice. 1.12. R'ghts and Remedies If this contract is terminated, the State, in addition to any other rights provided for in this contract, may require the Contractor to transfer title and deliver to the State in the manner and to the extent directed, any completed materials. The State shall be obligated only for those services and materials rendered and accepted prior to the date of termination. In the event of termination, the Contractor shall receive payment prorated for that portion of the contract period services were provided to or goods were accepted by State subject to any offset by State for actual damages including loss of federal matching funds. The rights and remedies of the State provided for in this contract shall not be exclusive and are in addition to any other rights and remedies provided by law. 1.13. Antitrust If the Contractor elects not to proceed with performance under any such contract with the State, the Contractor assigns to the State all rights to and interests in any cause of action it has or may acquire under the anti-trust laws of the United States and the State of Kansas relating to the particular products or services purchased or acquired by the State pursuant to this contract. 1.14. Hold Harmless The Contractor shall indemnify the State against any and all loss or damage to the extent arising out of the Contractor's negligence in the performance of services under this contract and for infringement of any copyright or patent occurring in connection with or in any way incidental to or arising out of the occupancy, use, service, operations or performance of work under this contract. The State shall not be precluded from receiving the benefits of any insurance the Contractor may carry which provides for indemnification for any loss or damage to property in the Contractor's custody and control, where such loss or destruction is to state property. The Contractor shall do nothing to prejudice the State's right to recover against third parties for any loss, destruction or damage to State property. 1.15. Force Maieure The Contractor shall not be held liable if the failure to perform under this contract arises out of causes beyond the control of the Contractor. Causes may include, but are not limited to, acts of nature, fires, tornadoes, quarantine, strikes other than by Contractor's employees, and freight embargoes. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 4 1.16.Assignment The Contractor shall not assign, convey, encumber, or otherwise transfer its rights or duties under this contract without the prior written consent of the State. State may reasonably withhold consent for any reason. This contract may terminate for cause in the event of its assignment, conveyance, encumbrance or other transfer by the Contractor without the prior written consent of the State. 1.17. Third Party Beneficiaries This contract shall not be construed as providing an enforceable right to any third party. 1.18.Waiver Waiver of any breach of any provision in this contract shall not be a waiver of any prior or subsequent breach. Any waiver shall be in writing and any forbearance or indulgence in any other form or manner by State shall not constitute a waiver. 1.19. lniunctions Should Kansas be prevented or enjoined from proceeding with the acquisition before or after contract execution by reason of any litigation or other reason beyond the control of the State, Contractor shall not be entitled to make or assert claim for damage by reason of said delay. 1.20. Staff Qualifications The Contractor shall warrant that all persons assigned by it to the performance of this contract shall be employees of the Contractor (or specified Subcontractor) and shall be fully qualified to perform the work required. The Contractor shall include a similar provision in any contract with any Subcontractor selected to perform work under this contract. Failure of the Contractor to provide qualified staffing at the level required by the contract specifications may result in termination of this contract or damages. 1.21 . Subcontractors The Contractor shall be the sole source of contact for the contract. The State will not subcontract any work under the contract to any other firm and will not deal with any subcontractors. The Contractor is totally responsible for all actions and work performed by its subcontractors. All terms, conditions and requirements of the contract shall apply without qualification to any services performed or goods provided by any subcontractor. 1.22. Independent Contractor Both parties, in the performance of this contract, shall be acting in their individual capacity and not as agents, employees, partners, joint ventures or associates of one another. The employees or agents of one party shall not be construed to be the employees or agents of the other party for any purpose whatsoever. The Contractor accepts full responsibility for payment of unemployment insurance, workers compensation, social security, income tax deductions and any other taxes or payroll deductions required by law for its employees engaged in work authorized by this contract. 1.23. Worker Misclassification The Contractor and all lower tiered subcontractors under the Contractor shall properly classify workers as employees rather than independent contractors and treat them accordingly for purposes of workers' compensation insurance coverage, unemployment taxes, social security taxes, and income tax withholding. Failure to do so may result in contract termination. 1.24. Immigration and Reform Control Act of 1986 (IRCA) All contractors are expected to comply with the Immigration and Reform Control Act of 1986 (IRCA), as may be amended from time to time. This Act, with certain limitations, requires the verification of the employment status of all individuals who were hired on or after November 6, 1986, by the Contractor as well as any subcontractor or sub-contractors. The usual method of verification is through the Employment Verification (l-9) Form. The Contractor hereby certifies without exception that such Contractor has complied with all federal and state laws relating to immigration and reform. Any misrepresentation in this regard or any employment of persons 1.25. 1.26. 1.27. 1.28. 1.29. 1.30. 1.31. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 5 not authorized to work in the United States constitutes a material breach and, at the State's option, may subject the contract to termination for cause and any applicable damages. Unless provided otherwise herein, all contractors are expected to be able to produce for the State any documentation or other such evidence to verify Contractor's IRCA compliance with any provision, duty, certification or like item under the contract. Proof of Insurance Upon request, the Contractor shall present an affidavit of Worker's Compensation, Public Liability, and Property Damage Insurance to Procurement and Contracts. Conflict of Interest The Contractor shall not knowingly employ, during the period of this contract or any extensions to it, any professional personnel who are also in the employ of the State and providing services involving this contract or services similar in nature to the scope of this contract to the State. Furthermore, the Contractor shall not knowingly employ, during the period of this contract or any extensions to it, any state employee who has participated in the making of this contract until at least two years after his/her termination of employment with the State. Nondiscrimination and Workplace Safety The Contractor agrees to abide by all federal, state and local laws, and rules and regulations prohibiting discrimination in employment and controlling workplace safety. Any violations of applicable laws or rules or regulations may result in termination of this contract. Confidentiality The Contractor may have access to private or confidential data maintained by State to the extent necessary to carry out its responsibilities under this contract. Contractor must comply with all the requirements of the Kansas Open Records Act (K.S.A. 45-215 et seq.) in providing services under this contract. Contractor shall accept full responsibility for providing adequate supervision and training to its agents and employees to ensure compliance with the Act. No private or confidential data collected, maintained or used in the course of performance of this contract shall be disseminated by either party except as authorized by statute, either during the period of the contract or thereafter. Contractor agrees to return any or all data furnished by the State promptly at the request of State in whatever form it is maintained by Contractor. On the termination or expiration of this contract, Contractor shall not use any of such data or any material derived from the data for any purpose and, where so instructed by State, shall destroy or render it unreadable. HIPAA Confidentiality Per the Health Insurance Portability and Accountability Act (1996) (HIPAA), the agency is a covered entity under the act and therefore Contractor is not permitted to use or disclose health information in ways that the agency could not. This protection continues as long as the data is in the hands of the Contractor. The Contractor shall establish and maintain procedures and controls acceptable to the agency to protect the privacy of members' information. Unless the Contractor has the member's written consent, the Contractor shall not use any personally identifiable information obtained for any reason other than that mandated by this agreement. Environmental Protection The Contractor shall abide by all federal, state and local laws, and rules and regulations regarding the protection of the environment. The Contractor shall report any violations to the applicable governmental agency. A violation of applicable laws or rule or regulations may result in termination of this contract for cause. Care of State Property The Contractor shall be responsible for the proper care and custody of any state owned personal tangible property and real property furnished for Contractor's use in connection with the performance of this contract. The Contractor shall reimburse the State for such property's loss or damage caused by the Contractor, except for normal wear and tear. 1.32. 1.33. 1.34. 1.35. 1.36. 1.37. 1.38. 1.39. Contract lD: 0000000000000000000046417 Event ID: EVTOOO6086 Page 6 Prohibition of Gratuities Neither the Contractor nor any person, firm or corporation employed by the Contractor in the performance of this contract shall offer or give any gift, money or anything of value or any promise for future reward or compensation to any State employee at any time. Retention of Records Unless the State specifies in writing a different period of time, the Contractor agrees to preserve and make available at reasonable times all of its books, documents, papers, records and other evidence involving transactions related to this contract for a period of five (5) years from the date of the expiration or termination of this contract. Matters involving litigation shall be kept for one (1) year following the termination of litigation, including all appeals, if the litigation exceeds five (5) years. The Contractor agrees that authorized federal and state representatives, including but not limited to, personnel of the using agency; independent auditors acting on behalf of state and/or federal agencies shall have access to and the right to examine records during the contract period and during the five (5) year post contract period. Delivery of and access to the records shall be within five (5) business days at no cost to the state. Off-Shore Sourcing If, during the term of the contract, the Contractor or subcontractor plans to move work previously performed in the United States to a location outside of the United States, the Contractor shall immediately notify the Procurement and Contracts and the respective agency in writing, indicating the desired new location, the nature of the work to be moved and the percentage of work that would be relocated. The Director of Purchases, with the advice of the respective agency, must approve any changes prior to work being relocated. Failure to obtain the Director's approval may be grounds to terminate the contract for cause. On-Site Inspection Failure to adequately inspect the premises shall not relieve the Contractorfrom furnishing without additional cost to the State any materials, equipment, supplies or labor that may be required to carry out the intent of this Contract. Indefinite Quantity Contract This is an open-ended contract between the Contractor and the State to furnish an undetermined quantity of a good or service in a given period of time. The quantities ordered will be those actually required during the contract period, and the Contractor will deliver only such quantities as may be ordered. No guarantee of volume is made. An estimated quantity based on past history or other means may be used as a guide. Prices Prices shall remain firm for the entire contract period and subsequent renewals. Prices shall be net delivered, including all trade, quantity and cash discounts. Any price reductions available during the contract period shall be offered to the State of Kansas. Failure to provide available price reductions may result in termination of the contract for cause. Contract Price Statewide contracts are awarded by the Procurement and Contracts to take advantage of volume discount pricing for goods and services that have a recurring demand from one or more agencies. However, if a state agency locates a vendor that can provide the identical item at a lower price, a waiver to "buy off state contract" may be granted by the Procurement and Contracts. Payment Payment Terms are Net 30 days. Payment date and receipt of order date shall be based upon K.S.A. 75- 6403(b). This Statute requires state agencies to pay the full amount due for goods or services on or before the 30th calendar day after the date the agency receives such goods or services or the bill for the goods and services, whichever is later, unless other provisions for payment are agreed to in writing by the Contractor and the state agency. NOTE: If the 30th calendar day noted above falls on a Saturday, Sunday, or legal holiday, the following workday will become the required payment date. Payments shall not be made for costs or items not listed in this contract. 1.40. 1.41. 1.42. 1.43. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 7 Payment schedule shall be on a frequency mutually agreed upon by both the agency and the Contractor. Accounts Receivable Set-Off Program If, during the course of this contract the Contractor is found to owe a debt to the State of Kansas, a state agency, municipality, or the federal government, agency payments to the Contractor may be intercepted / setoff by the State of Kansas. Notice of the setoff action will be provided to the Contractor. Pursuant to K.S.A. 75- 6201 et seq, Contractor shall have the opportunity to challenge the validity of the debt. The Contractor shall credit the account of the agency making the payment in an amount equal to the funds intercepted. K.S.A. 75-6201 et seq. allows the Director of Accounts & Reports to setoff funds the State of Kansas owes Contractors against debts owed by the Contractors to the State of Kansas, state agencies, municipalities, or the federal government. Payments setoff in this manner constitute lawful payment for services or goods received. The Contractor benefits fully from the payment because its obligation is reduced by the amount subject to setoff. Federal, State and Local Taxes Unless otherwise specified, the contracted price shall include all applicable federal, state and local taxes. The Contractor shall pay all taxes lawfully imposed on it with respect to any product or service delivered in accordance with this Contract. The State of Kansas is exempt from state sales or use taxes and federal excise taxes for direct purchases. These taxes shall not be included in the contracted price. Upon request, the State shall provide to the Contractor a certificate of tax exemption. The State makes no representation as to the exemption from liability of any tax imposed by any governmental entity on the Contractor. Quarterly Reports The Contractor shall be required to file a quarterly report by each state agency or political subdivision making purchases under this contract. Reports are due no later than 30 days after the end of each calendar quarter and shall correlate with figures submitted as Administrative Fees (see below). Above referenced reports are to be filed with Procurement and Contracts Open Records Officer or his/her designee located at 900 SW Jackson, Ste. 451-South, Topeka, KS 66612-1286. Reports may also be required to be submitted to the specific using agency. Electronicfiles shall be emailed to the following e-mail address: reports@ks.gov, in Microsoft Excel or Microsoft Access Database format. The required reporting format may be found on Procurement and Contracts website at http://admin.ks.gov/offices/procurementand-contracts, under the "Procurement Forms" link. Report Types - Reports shall be available reflecting the following information. Agencies and Procurement and Contracts reserve the right to request additional information. 0 Sales Summary -- Report shall include a list of agencies and political subdivisions who have used the contract, a subtotal of sales to each agency or political subdivision, as well as a grand total of all sales. . Items Sold -- Report shall include a list of items sold to agencies and political subdivisions, indicating the contract price and using agency, a subtotal of sales to each agency or political subdivision, as well as a grand total of all sales. 0 Items Sold, by Agency - Same as above, except sorted by agency. Administrative Fee Contractor(s) must pay a .5% Administrative Fee on all purchases (including political subdivisions) made against this contract. The fee is to be included in the cost of the goods or services. The Administrative Fee is to be based upon the total dollars invoiced under the contract. The Administrative Fee shall be made in check form, payable to the "State of Kansas - Procurement and Contracts" and must be paid within 30 days following the end of each quarter. Fees paid under this mandate shall correlate with figures submitted on the quarterly reports. 1.44. Debarment of State Contractors Any Contractor who defaults on delivery or does not perform in a satisfactory manner as defined in this Agreement may be barred for up to a period of three (3) years, pursuant to K.S.A. 75-37,103, or have its work Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 8 evaluated for pre-qualification purposes. Contractor shall disclose any conviction orjudgment for a criminal or civil offense of any employee, individual or entity which controls a company or organization or will perform work under this Agreement that indicates a lack of business integrity or business honesty. This includes (1) conviction of a criminal offense as an incident to obtaining or attempting to obtain a public or private contract or subcontract or in the performance of such contract or subcontract; (2) conviction under state or federal statutes of embezzlement, theft, forgery, bribery, falsification or destruction of records, receiving stolen property; (3) conviction under state orfederal antitrust statutes; and (4) any other offense to be so serious and compelling as to affect responsibility as a state contractor. For the purpose of this section, an individual or entity shall be presumed to have control of a company or organization if the individual or entity directly or indirectly, or acting in concert with one or more individuals or entities, owns or controls 25 percent or more of its equity, or otherwise controls its management or policies. Failure to disclose an offense may result in the termination of the contract. 1.45. Materials and Workmanship The Contractor shall perform all work and furnish all supplies and materials, machinery, equipment, facilities, and means, necessary to complete all the work required by this Contract, within the time specified, in accordance with the provisions as specified. The Contractor shall be responsible for all work put in under these specifications and shall make good, repair and/or replace, at the Contractor's own expense, as may be necessary, any defective work, material, etc., if in the opinion of agency and/or Procurement and Contracts said issue is due to imperfection in material, design, workmanship or Contractor fault. 1.46. lndustg Standards If not otherwise provided, materials or work called for in this contract shall be furnished and performed in accordance with best established practice and standards recognized by the contracted industry and com ply with all codes and regulations which shall apply. 1.47. Implied Reguirements All products and services not specifically mentioned in this contract, but which are necessary to provide the functional capabilities described by the specifications, shall be included. 1.48. lnslgection The State reserves the right to reject, on arrival at destination, any items which do not conform with specification of the Contract. 1.49. Accegtance No contract provision or use of items by the State shall constitute acceptance or relieve the Contractor of liability in respect to any expressed or implied warranties. 1.50. Ownershig All data, forms, procedures, software, manuals, system descriptions and work flows developed or accumulated by the Contractor under this contract shall be owned by the using agency. The Contractor may not release any materials without the written approval of the using agency. 1.51. Information/Data Any and all information/data required to be provided at any time during the contract term shall be made available in a format as requested and/or approved by the State. 1.52. Certification of Materials Submitted The Bid document, together with the specifications set forth herein and all data submitted by the Contractor to support their response including brochures, manuals, and descriptions covering the operating characteristics of the item(s) proposed, shall become a part of the contract between the Contractor and the State of Kansas. Any written representation covering such matters as reliability of the item(s), the experience of other users, or warranties of performance shall be incorporated by reference into the contract. 1.53. Transition Assistance In the event of contract termination or expiration, Contractor shall provide all reasonable and necessary assistance to State to allow for a functional transition to another vendor. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 9 1.54. Integration This contract, in its final composite form, shall represent the entire agreement between the parties and shall supersede all prior negotiations, representations or agreements, either written or oral, between the parties relating to the subject matter hereof. This Agreement between the parties shall be independent of and have no effect on any other contracts of either party. 1.55. Modification This contract shall be modified only by the written agreement and approval of the parties. No alteration or variation of the terms and conditions of the contract shall be valid unless made in writing and signed by the parties. Every amendment shall specify the date on which its provisions shall be effective. 1.56. Severability If any provision of this contract is determined by a court of competentjurisdiction to be invalid or unenforceable to any extent, the remainder of this contract shall not be affected and each provision of this contract shall be enforced to the fullest extent permitted by law. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 10 2. Specifications 2.1. Background: 2.1.1. 2.1.2. 2.1.3. 2.1.4. The State of Kansas often needs independent professional expertise and Integrated Technology Services (ITS) for information technology projects. This contract is with pre-qualified contractors for Integrated Technology Services grouped by areas of expertise. Work shall be offered competitively to contractors within each group on an as needed basis by State agencies in the form of Task Orders (TO). This contract will be utilized for fixed-bid task orders, not staff augmentation. The State to date has identified twelve groups or categories of need that will be addressed over time using the processes described herein. Vendor Refresh: The State reserves the right to allow for re-release of this RFP on a periodic basis to "refresh" the pool of vendors providing services for bid under this contract. This will allow for a more comprehensive up-to-date pool of available vendors from which to choose when task orders are let. To this end, please be advised that this Request for Proposal may be re-released, at the State's discretion, throughout the contract period. **** Current contract vendors selected during either the initial solicitation, or subsequent solicitations, will not be required to resubmit proposals to subsequent releases; however, vendors may update their original response at the time of re-release if changes have occurred. **** There shall be no guaranteed minimum or maximum work to any one Contractor from this contract. It is the intent of the state to offer most ITS work through this RFP, but the state reserves the right to offer ITS work through other RFP's. 2.2. SPECIAL PROVISIONS 2.2.1. 2.2.2. 2.2.3. If terms and conditions need to be added and they conflict with the negotiated terms and conditions of the contract document, the State of Kansas Terms and Conditions will control. Subcontractors: A Contractor may use subcontractors when responding to Task Order Requests. However, note that to become a Contractor a Vendor must first convince the evaluation committee and PNC that the Vendor is among the top respondents for the group. If a Vendor is unable to mount an effective initial proposal without subcontractors, then those must be shown in the proposal, and the State may then rely on those consistently appearing as resources (without substitution) in subsequent Task Order Responses. Le. a Vendor relying on subcontractors to build a credible initial response will probably be competing at a disadvantage. Any entity (person, partnership, LLC, Corporation, etc.) other than the contractor or contractor's employees, used by the contractor to fulfill its obligations under a contract would be a subcontractor. Definitions \"Authorized Persons" means (i) Authorized Employees; and (ii) Contractor, subcontractors, agents, outsourcers and auditors to this Agreement who have a need to know or otherwise access any Restricted Use Information that enables Contractor to perform its obligations under this Agreement, and who are bound in writing by confidentiality obligations sufficient to protect Restricted Use Information in accordance with the terms and conditions of this Agreement. \"Restricted Use Information\" means information provided to Contractor by or at the direction of the State, or to which access was provided to Contractor by or at the direction of the State, in the course of Contractor's performance under this Agreement that: (i) identifies or can be used to identify an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers); or (ii) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, biometric or health data, answers to security questions and other personal identifiers). \"Security Breach\" means (i) any act or omission that materially compromises either the security, confidentiality or integrity of Restricted Use Information or the physical, technical, administrative or organizational safeguards put in place by Contractor (or any Authorized Persons) that relate to the protection of the security, confidentiality or integrity of Restricted Use Information, or (ii) receipt of a Contract ID: 0000000000000000000046417 Event ID: EVT0006086 Page 11 complaint in relation to the privacy practices of the Contractor (or any Authorized Persons) or a breach or alleged breach of this Agreement relating to such privacy practices. 2.2.4. Standard of Care 2.2.4.1. 2.2.4.2. 2.2.4.3. Contractor acknowledges and agrees that, in the course of its engagement by the State, the Contractor may receive or have access to Restricted Use Information. The Contractor shall comply with the terms and conditions set forth in this Agreement in its collection, receipt, transmission, storage, disposal, use and disclosure of such Restricted Use Information and be responsible for the unauthorized collection, receipt, transmission, access, storage, disposal, use and disclosure of Restricted Use Information under its control or in its possession by all Authorized Persons. Contractor shall be responsible for, and remain liable to, the State for the actions and omissions of all Authorized Persons that are not Authorized Employees concerning the treatment of Restricted Use Information as if they were Contractor's own actions and omissions. Restricted Use Information is deemed to be Confidential Information of the State and is not Confidential Information of the Contractor. In the event of a conflict or inconsistency between this provision and other provisions of this Agreement, the terms and conditions set forth in this provision shall govern and control. In recognition of the foregoing, Contractor agrees and covenants that it shall: 2.2.4.3.1. keep and maintain all Restricted Use Information in strict confidence, using such degree of care as is appropriate to avoid unauthorized access, use or disclosure; 2.2.4.3.2. use and disclose Restricted Use Information solely and exclusively for the purposes for which the Restricted Use Information, or access to it, is provided pursuant to the terms and conditions of this Agreement, and not use, sell, rent, transfer, distribute, or otherwise disclose or make available Restricted Use Information for Contractor's own purposes or for the benefit of anyone other than the State, in each case, without the State's prior written consent; and 2.2.4.3.3. not, directly or indirectly, disclose Restricted Use Information to any person other than its 2.2.4.4. Authorized Employees/Authorized Persons, including any subcontractors, agents, outsourcers or auditors (an \"Unauthorized Third Party\"), without express written consent from the State unless and to the extent required by Government Authorities or as otherwise, to the extent expressly required, by applicable law, in which case, Contractor shall 2.2.4.3.3.1. notify the State before such disclosure or as soon thereafter as reasonably possible; 2.2.4.3.3.2. be responsible for and remain liable to the State for the actions and omissions of such Unauthorized Third Party concerning the treatment of such Restricted Use Information as if they were Contractor's own actions and omissions; and 2.2.4.3.3.3. require the Unauthorized Third Party that has access to Restricted Use Information to execute a written agreement agreeing to comply with the terms and conditions of this Agreement relating to the treatment of Restricted Use Information. Insurance Requirements. The Contractor shall procure and maintain insurance against claims for injuries to persons, which may arise from, or in connection to, the fulfillment of this Agreement, by the Contractor, its agents, representatives, employees, or Subcontractors. The insurance shall be secured by the Contractor, at the Contractor's expense, and maintained in force, at all times during the term of this Agreement, and, for any claims-made (as opposed to occurrence-based) policies, for a period of not less than two (2) years thereafter. 2.2.4.4.1. Minimum Coverage. Errors and Omissions, or Professional Liability Insurance, or Insurance by any other name, covering the following: 2.2.4.4.1.1. All acts, errors, omissions, negligence, infringement of intellectual property (except patent and trade secret) in an amount not less than $1,000,000 per occurrence, and as an annual aggregate. 2.2.4.4.1.2. Network security and privacy risks, including, but not limited to, unauthorized access, failure of security, breach of privacy, wrongful disclosure, collection, or other negligence in the handling of confidential information, related regulatory defense, and penalties in an amount not less than $1,000,000 per occurrence, and as an annual aggregate. 2.2.4.4.1.3. Data breach expenses, in an amount based on the number of Restricted Use Information records: 1 through 3000 records minimum coverage of $400,000 per occurrence; 3001 through 100,000 records minimum coverage of $1,000,000 per occurrence; 100,001 through 1,000,000 records minimum coverage of $5,000,000 Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 12 per occurrence or greater than 1,000,000 records minimum coverage of $10,000,000 per occurrence, and payable, whether incurred by the State or the Contractor; for and on behalf of the State, including, but not limited to: State notification, whether or not required by law; Forensic investigations; Public relations and crisis management fees; and Credit or identity monitoring, or similar remediation services. The policy shall affirm coverage for contingent bodily injury and property damage arising from the failure of the Contractor's technology services, or an error, or omission, in the content of, and information from, the Contractor. If a sub-limit applies to any element of the coverage, the certificate of insurance must specify the coverage section and the amount of the sub-limit. 2.2.4.4.2. Other Provisions. Unless explicitly waived by the State, the insurance policies shall contain, or be endorsed to contain, the following provisions: 2.2.4.4.2.1. The Contractor's insurance coverage shall be the primary and contributory. Any insurance or self-insurance maintained by the Department for its officers, agents, and employees shall be in excess of the Provider's insurance and shall not contribute to it. 2.2.4.4.2.2. The Contractor's insurance shall apply separately to each insured against whom claim is made or suit is brought, except with respect to the limits of the insurer's liability. 2.2.4.4.2.3. The Contractor shall furnish the State with certificates of insurance, and with those endorsements, if any, affecting coverage, required by these Insurance Requirements. The certificates and endorsements for each insurance policy are to be signed by a person authorized by the insurer to bind coverage on its behalf. All certificates and endorsements are to be received and approved by the State before this Agreement commences. The State reserves the right to require complete, certified copies of all required insurance policies at any time. 2.2.4.4.2.4. All policies should contain a revised cancellation clause allowing thirty (30) days' notice to the State in the event of cancellation for any reason, including nonpayment. 2.2.4.4.2.5. The State will not grant the Contractor, or any sub-contractor of the Contractor, \"Additional Insured\" status and the State will not grant any Contractor a \"Waiver of Subrogation\". 2.2.5. Compliance 2.2.5.1. 2.2.5.2. 2.2.5.3. 2.2.5.4. Contractor represents and warrants that its collection, access, use, storage, disposal and disclosure of Restricted Use Information does and will comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations and directives. Without limiting Contractor's obligations under paragraph (4.3.11.1) of this provision, Contractor shall implement administrative, physical and technical safeguards to protect Restricted Use Information that are no less rigorous than accepted industry practices (including the FIPS 140-2 Federal Information Processing Standards, the Information Technology Library (ITIL) standards, the Control Objectives for Information and related Technology (COBIT) standards, the NIST 800- 53v4 National Institute of Standards and Technology or other applicable industry standards for information security), and shall ensure that all such safeguards, including the manner in which Restricted Use Information is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws, as well as the terms and conditions of this Agreement. If, in the course of its engagement by the State, Contractor has access to or will collect, access, use, store, process, dispose of or disclose credit, debit or other payment cardholder information, Contractor shall at all times remain in compliance with the Payment Card Industry Data Security Standard (\"PCI DSS") requirements, including remaining aware at all times of changes to the PCI D88 and promptly implementing all procedures and practices as may be necessary to remain in compliance with the PCI DSS, in each case, at Contractor's sole cost and expense. At a minimum, Contractor's safeguards for the protection of Restricted Use Information shall include: 2.2.5.4.1. limiting access of Restricted Use Information to Authorized Persons. Securing business facilities, data centers, paper files, servers, back-up systems and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability. 2.2.5.4.2. implementing network, device application, database and platform security 2.2.5.4.3. securing information transmission, storage and disposal. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 13 22.5.4.4. implementing authentication and access controls within media, applications, operating systems and equipment 2.2.5.4.5. encrypting Restricted Use Information stored on any mobile media. 2.2.5.4.6. encrypting Restricted Use Information transmitted over public or wireless networks 2.2.5.4.7. strictly segregating Restricted Use Information from information of Contractor or its other customers so that Restricted Use Information is not commingled with any other types of information 2.2.5.4.8. implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law 2.2.5.4.9. providing appropriate privacy and information security training to Contractor's Authorized Persons. 2.2.5.5. During the term of each Authorized Person's employment by the Contractor, Contractor shall at all times cause such Authorized Persons to abide strictly by Contractor's obligations under this Agreement and Contractor's standard policies and procedures. Contractor further agrees that it shall maintain a disciplinary process to address any unauthorized access, use or disclosure of Restricted Use Information by any of Contractor's officers, partners, principals, employees, agents or contractors. Upon the States written request, Contractor shall promptly identify for the State in writing all Authorized Persons as of the date of such request. 2.2.5.6. Upon the States written request, Contractor shall provide a network diagram that outlines Contractor's information technology network infrastructure and all equipment used in to fulfill obligations of this Agreement, including, without limitation: 2.2.5.6.1. connectivity to the State and all third parties who may access Contractor's network to the extent the network contains Restricted Use Information 2.2.5.6.2. all network connections including remote access services and wireless connectivity 2.2.5.6.3. all access control devices (for example, firewall, packet filters, intrusion detection and access-list routers) 2.2.5.6.4. all back-up or redundant servers 2.2.5.6.5. permitted access through each network connection. 2.2.5.7. Upon the States declaration of any of the following federally regulated or controlled data, Contractor agrees to comply with all additional applicable compliance requirements. 2.2.5.7.1. Federal Tax Information (FTI). This data classification applies to information provided to the State directly from the Internal Revenue Service (IRS). The FTI data classification has extensive compliance requirements; these requirements are detailed in IRS Publication 1075, this publication and supporting documents can found at: https://www.irs.gov/Qrivacy- disclosure/safeguardsprogram. NOTE: Any agreement that directly or may indirectly include access to data subject to this classification, must include Exhibit 7 of IRS Publication 1075. The Exhibit 7 language can also be found at https://oits.ks.gov/info-security/policy. 2.2.5.7.2. Social Security Information (SSA). This data classification applies to information provided to the State directly from the SSA or from the State Transfer Component (STC). The SSA data classification has common cybersecurity compliance requirements, however the publication detailing these requirements is not publicly available. Upon contract award this publication will be provided. NOTE: Any agreement that directly or may indirectly include access to data subject to this classification, must include the language provided by the SSA, which is provided at https://oits.ks.gov/info-security/policy. 2.2.5.7.3. Office of Child Support Enforcement (OCSE) Requirements for National Directory of New Hires (NDNH). This data classification applies to information provided to the State directly from the IRS. The OCSE or NDNH data classification requires that any agreement that directly or may indirectly include access to data subject to this classification, must include specific language that can be found at https://oits.ks.gov/info-security/policy. 2.2.5.7.4. Health Information Portability Accountability Act (HIPAA). This data classification applies to information declared as Personal Healthcare Information (PHI) by the State. The HIPAA data classification requires that any agreement that directly or may indirectly include access to PHI requires a Business Associate Agreement (BAA). The BAA must be incorporated and agreed to prior to execution of the agreement. 2.2.5.7.5. Kansas Criminal Justice Information Systems (KCJIS). This data classification applies to information declared as Criminal Justice Information (CJI) by the State. The CJI data classification requires that any agreement that directly or may indirectly include access to CJI requires Security Addendum addressing CJI. Pursuant to Title 28 of the Code of Federal Regulations: 20.33 Dissemination of criminal history record information. a) Criminal history Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 14 record information contained in the Interstate Identification Index (Ill) System and the Fingerprint Identification Records System (FIRS) may be made available: 1) To criminal justice agencies for criminal justice purposes, which purposes include the screening of employees or applicants for employment hired by criminal justice agencies. 2) To noncriminal justice governmental agencies performing criminal justice dispatching functions or data processing/information services for criminal justice agencies; and 3) To private contractors pursuant to a specific agreement with an agency identified in paragraphs (a)(1) or (a)(6) of this section and for the purpose of providing services for the administration of criminal justice pursuant to that agreement. The agreement must incorporate a security addendum approved by the Attorney General of the United States, which shall specifically authorize access to criminal history record information, limit the use of the information to the purposes for which it is provided, ensure the security and confidentiality of the information consistent with these regulations, provide for sanctions, and contain such other provisions as the Attorney General may require. The power and authority of the Attorney General hereunder shall be exercised by the FBI Director (or the Director's designee). KCJIS policy and regulatory requirements can be found at https://c'isaudit.khp.ksgov/launchpad/c'isdocs/docs.cgi?cat id=10. 2.2.5.7.6. Kansas Information Technology Executive Committee (ITEC) and State Policies. Regardless 2.2.5.8. of data classification, Contractor agrees to comply with all applicable ITEC and State policies. When policies, agreements, regulation or law are in conflict, the more stringent requirement applies. ITEC Policies can be found at https://oits.ks.gov/kito/itec/itec-golicies. Compliance Oversight. Upon the States written request, to confirm Contractor's compliance with this Agreement, as well as any applicable laws, regulations and industry standards, Contractor grants the State or, upon the States election, a third party on the States behalf, permission to perform an assessment, audit, examination or review of all controls in Contractor's or Authorized Person's physical and/or technical environment in relation to all the State Information being handled and/or services being provided to the State pursuant to this Agreement. Contractor shall fully cooperate with such assessment by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that processes, stores or transports State Information for the State pursuant to this Agreement. In addition, upon the States written request, Contractor shall provide the State with the results of any audit by or on behalf of Contractor performed that assesses the effectiveness of Contractor's information security program as relevant to the security and confidentiality of State Information shared during the course of this Agreement. 2.2.6. Information Security Management 2.2.6.1. 2.2.6.2. 2.2.6.3. Offshore sourcing either directly or through subcontractors, or agents for technology services, technology support services, data storage or data processing of any kind is prohibited without written consent of the State. Return or destruction of State Information. At any time during the term of this Agreement at the States written request or upon the termination or expiration of this Agreement for any reason, Contractor shall, and shall instruct all Authorized Persons to, promptly return to the State all copies, whether in written, electronic or other form or media, of State Information in its possession or the possession of such Authorized Persons, or securely dispose of all such copies, and certify in writing to the State that such State Information has been returned to the State or disposed of securely. Contractor shall comply with all reasonable directions provided by the State with respect to the return or disposal of Personal Information. Security breach 2.2.6.3.1. Service Providershall: 2.2.6.3.1.1. Provide the State with the name and contact information for an employee of Contractor who shall serve as the State's primary security contact and shall be available to assist the State twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a Security Breach; 2.2.6.3.1.2. Provide notification in accordance with all applicable federal regulatory compliance requirements and notify the State of a Security Breach as soon as practicable, but no later than twenty-four (24) hours after Contractor becomes aware of it. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 15 22.6.3.2. Immediately following Contractor's notification to the State of a Security Breach, the parties shall coordinate with each other to investigate the Security Breach. Contractor agrees to reasonably cooperate with the State in the handling of the matter, including, without limitation: 2.2.6.3.2.1. Assisting with any investigation; 2.2.6.3.2.2. Providing the State or the States agent with physical access to the facilities and operations affected; 2.2.6.323. Facilitating interviews with Contractor's employees and others involved in the matter; and 2.2.6.324. Making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or as otherwise reasonably required by the State. 2.2.6.3.3. Contractor shall take reasonable steps to/use best efforts to immediately remedy any Security Breach and prevent any further Security Breach at Contractor's expense in accordance with applicable privacy rights, laws, regulations and standards. Contractor shall reimburse the State for reasonable costs incurred by the State in responding to, and mitigating damages caused by, any Security Breach, including all costs of notice and/or remediation. 2.2.6.3.4. Contractor agrees that it shall not inform any third party of any Security Breach without first obtaining the States prior written consent, other than to inform a complainant that the matter has been forwarded to the States legal counsel. Further, Contractor agrees that the State shall have the sole right to determine: 2.2.6.3.4.1. Whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or othenNise in the States discretion; and 2.2.6.3.4.2. The contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation. 2.2.6.3.5. Contractor agrees to reasonably cooperate at its own expense with the State in any litigation or other formal action deemed reasonably necessary by the State to protect its rights relating to the use, disclosure, protection and maintenance of State Information. 2.2.6.3.6. In the event of any Security Breach, Contractor shall promptly use its reasonable efforts to 2.2.6.4. prevent a recurrence of any such Security Breach. Contractor shall maintain during the term of the agreement, a security policy that explicitly addresses and provides guidance to employees and non-employee workers to ensure the confidentiality, integrity and availability of information and systems maintained or processed by Service Provider. The policies shall be approved by senior management and contain penalties or sanctions for non-compliance. The Contractor's security policy shall provide a framework for information security management within its overall organization. That policy must have an explicit section on the handling and management of customer data. Explicit procedures must exist that describe how customer data is to be managed, including disposal and destruction of data after its useful life. 2.2.7. Personnel Screening 2.2.7.1. 2.2.7.2. 2.2.7.3. 2.2.7.4. 2.2.7.5. Contractor shall ensure that written confidentiality agreements are signed by all employees, non- employee workers, consultants, agents, temporary workers and other persons, such as third-party vendors and subcontractors, who may have access to State data, systems, networks or facilities. Contractor shall perform pre-employment screening for all employees, non-employee workers, consultants, temporary workers and other persons, such as vendors, hired or engaged after the date of this agreement and who may provide services to or for the State. The screening process must incorporate a list of disqualifiers, which must be positively adjudicated before unsupervised access to State data, systems, networks or facilities is authorized. A copy of adjudication disposition shall be maintained in personnel files. A copy of the Contractor's list of disqualifiers shall be provided to the State. The State retains the right to reject any of the Contractor's Authorized Persons whose abilities and qualifications, in the Statesjudgment, are not appropriate for the performance of this Agreement. 2.2.7.6. 2.2.7.7. 2.2.7.8. Contract ID: 0000000000000000000046417 Event ID: EVTOOO6086 Page 16 In considering the Contractor's employees' abilities and qualifications, the State shall act reasonably and in good faith. During the course of this Agreement, the State reserves the right to require the Contractor to reassign or otherwise remove any of its employees found unacceptable by the State. In considering the Contractor's employees' abilities and qualifications, the State shall act reasonably and in good faith. In signing this Agreement, the Contractor certifies to the best of its knowledge and belief that it, and all persons associated with this Agreement, including any Authorized Persons, including persons or corporations who have critical influence on or control over this Agreement, are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation by any Federal or State department or agency. During the course of this Agreement, the State reserves the right to request a background check on any of the Contractor's Authorized Persons that are in any way involved in the performance of this Agreement 2.2.8. Cybersecurity Awareness Training. All employees, non-employee workers, consultants, temporary workers and other persons, such as third-party vendors and subcontractors who may have access to State data, systems, networks, or facilities shall be made aware of, and be required to adhere to, the security policies of the Contractor and have training in security practices including the handling of sensitive or confidential State information. 2.2.9. Remote Access. Employee remote access solutions must technically prevent the export of data of, Contractor's customers, or such customers' customers to the person's local computer situated outside the Contractor's facilities and must make use of multifactor authentication. 2.2.10. Storage of Data on Mobile Devices 2.2.10.1. 2.2.10.2. 2.2.10.3. 2.2.10.4. 2.2.10.5. No Contractor or State data storage devices that may contain State data are permitted to leave Contractor's facility without written permission from the State. Use of personal electronic devices to fulfill the obligations of this agreement is prohibited without written consent of the State. No storage devices not belonging to the Contractor shall be allowed access to such data. \"Storage device" includes, but is not limited to, laptop computers, flash drives, MP3 players, camera phones, or other electronic devices with storage capability. If any storage device, laptop or other mobile hardware contains data, such data shall be encrypted with a minimum 256-bit encryption key length. Suspected loss or theft of any device which may contain State data, must be reported immediately by Authorized Persons to the Contra