Loading...
HomeMy WebLinkAbout20260175 Resolution Approve Sales Quote for Purchase of Two (2) Prisoner Transport Vehicles Pursuant to Colorado State Cooperative Pricing Agreement Award Terms and Conditions, and Authorize Assistant Controller to Sign Any Necessary Documents — Asbury Automotive Group, Inc., and LHM LFO, LLC, dba Larry H. Miller Ford Lakewood Whereas, the Board of County Commissioners of Weld County, Colorado, pursuant to Colorado statute and the Weld County Home Rule Charter, is vested with the authority of administering the affairs of Weld County, Colorado, and Whereas, on December 5, 2025, the Colorado Department of Personnel and Administration, State Purchasing and Contracts Office, awarded Asbury Automotive Group, Inc., and LHM LFO, LLC, dba Larry H. Miller Ford Lakewood, a State Cooperative Purchase Agreement, identified as #202635, and Whereas, the Weld County Department of Fleet Services desires to purchase new vehicles on behalf of the Sheriff's Office, procured through the Colorado State Cooperative Pricing Agreement #202635 Terms and Conditions, and Whereas, the Board has been presented with a Sales Quote for the Purchase of Two (2) Prisoner Transport Vehicles between the County of Weld, State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of the Department of Fleet Services, and Asbury Automotive Group, Inc., and LHM LFO, LLC, dba Larry H. Miller Ford Lakewood, and Whereas, the Weld County Purchasing Manager deemed Agreement #202635 to be in the best interest of Weld County, and after review, the Board deems it advisable to approve said purchase of vehicles further identified in said sales quote, a copy of which is attached hereto and incorporated herein by reference, and Now, therefore, be it resolved by the Board of County Commissioners of Weld County, Colorado, that the Sales Quote for the Purchase of Two (2) Prisoner Transport Vehicles Pursuant to the Colorado State Cooperative Pricing Agreement #202635, Pursuant to Colorado State Cooperative Pricing Agreement Award Terms and Conditions between the Colorado Department of Personnel and Administration, State Purchasing and Contracts Office, and Asbury Automotive Group, Inc., and LHM LFO, LLC, dba Larry H. Miller Ford Lakewood, in the amount of $105,340.00, be, and hereby is, approved. Be it further resolved by the Board that Chris D'Ovidio, Assistant Weld County Controller, be, and hereby is, authorized to sign any necessary documents. c c; Pv R . 'FT(os) 2026-0175 SO0047 ot-t \alp FT0005 Sales Quote for Purchase of Two (2) Prisoner Transport Vehicles Pursuant to Colorado State Cooperative Pricing Agreement Award Terms and Conditions —Asbury Automotive Group, Inc., and LHM LFO, LLC, dba Larry H. Miller Ford Lakewood Page 2 The Board of County Commissioners of Weld County, Colorado, approved the above and foregoing Resolution, on motion duly made and seconded, by the following vote on the 28th day of January, A.D., 2026: Scott K. James, Chair: Aye �.•■--.�,` i Jason S. Maxey, Pro-Tem: Aye �,� I /a Perry L. Buck: Aye I 'Iaf (10 Lynette Peppier: Aye Kevin D. Ross: Aye Ito „' ; . Approved as to Form: `•0 I Bruce Barker, County Attorney Attest: Esther E. Gesick, Clerk to the Board 2026-0175 SO0047 FT0005 Weld County Fleet Services Arid — 1399 17th Ave tritig Greeley, CO 80631-9596 G u ti Y Phone 970-400-3500 • www.weldgov.com January 15th, 2026 To: Board of County Commissioners From: David Springer Subject: Other Source Bids-QTY 2 Prisoner Transport SUV's. The Weld County Sheriff's Office requested two (2) Prisoner Transport SUVs in the approved 2026 budget. County Code Section 5-4-100 allows the County to participate in cooperative purchasing agreements. Colorado State Pricing Agreement number 202635 is one of those cooperative purchasing agreements. Fleet Services is recommending utilizing State Pricing Agreement number 202635 to procure this equipment. Therefore, the Weld County Fleet Department is recommending approval to purchase the two Prisoner Trasport SUV's as detailed in the attached quote for a total cost of$105,340.00. Sincerely, David Springer Director 2026-0175 500041 1/Z Z OOOS BOARD OF COUNTY COMMISSIONERS PASS-AROUND REVIEW PASS-AROUND TITLE: Cooperative Purchase -Qty 2 Prisoner Transport SUV's DEPARTMENT: Fleet Services DATE: 1/20/2026 PERSON REQUESTING: David Springer Brief description of the problem/issue: The Weld County Fleet Department is desiring to purchase two (2) Prisoner Transport SUV's to meet the 2026 budgeted vehicle needs for the Sheriffs Office. Weld County Code Section 5-4-100 titled Cooperative Purchasing allows the Board of County Commissioners to accept any of the state bids without rebidding the same goods/services at the discretion of the Board of County Commissioners or the Department of Purchasing Further, Weld County Code Section 5-4-80 is titled Expenditures Not Requiring a Procurement Process. Item 26 in this section identifies "items purchased from current state, federal, GSA or other cooperative contracts" are exempt and may be purchased directly from those sources. Weld County Purchasing Division has verified the quote from Larry H Miller Ford for the Prisoner Transport SUV's is consistent with the Colorado State Purchasing Participative Agreement #202635. Therefore, the Weld County Fleet Department is recommending approval to purchase the Prisoner Trasport SUV's as detailed in the attached quote for a total cost of$105,340.00. What options exist for the Board?The Board has the option to place the request on the BOCC meeting agenda or request a work session for this purchase. Consequences: If approved, Fleet Services will move forward with this purchase utilizing the cooperative purchasing agreement. Impacts: if denied, Fleet services will begin the formal bid process on this vehicle request. Costs (Current Fiscal Year 1 Ongoing or Subsequent Fiscal Years): $105,340.00 total. Recommendation: Fleet Services recommends the BOCC approve utilizing the Cooperative Purchasing Agreement to procure Qty 2 Prisoner Transport SUV's. Support Recommendation Schedule Place on BOCC Agenda Work Session Other/Comments: Perry L. Buck Scott K. James Ui a .-,1111 Jason S. Maxey V C( ,,Q,('1('lQ,(k Lynette Peppier V1L9 Kevin D. Ross V I\Gl J 1 Karla Ford From: Scott James Sent: Wednesday, January 21, 2026 7:12 AM To: Karla Ford Subject: Re: Please Reply - - Three PAs - Fleet - Vehicles I approve all three *** Sent from my iPhone - Pardon the brevity and type-o's *** Scott K. James Weld County Commissioner Office: 970-400-4200/Cell : 970-381-7496 P.O. Box 758, 1150 0 St., Greeley, CO 80632 IMPORTANT: This electronic transmission and any attached documents or other writings are intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. If you have received this communication in error, please immediately notify sender by return e-mail and destroy the communication. Any disclosure, copying, distribution or the taking of any action concerning the contents of this communication or any attachments by anyone other than the named recipient is strictly prohibited. From: Karla Ford <kford@weld.gov> Sent: Wednesday,January 21, 2026 9:08:55 AM To: Scott James<sjames@weld.gov>;Jason Maxey<jmaxey@weld.gov>; Kevin Ross<kross@weld.gov> Subject: Please Reply--Three PAs- Fleet-Vehicles There are three pa's from David Springer. Please let me know if you are ok with them going forward. If not, let me know which one you want more info on or a ws. Thank you. "a4 COUNTY,CO Karla Ford Office Manager& Executive Assistant Board of Weld County Commissioners Desk: 970-400-4200/970-400-4228 P.O. Box 758, 1150 O St., Greeley, CO 80632 Join Our Team IMPORTANT:This electronic transmission and any attached documents or other writings are intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. If you have received this communication in error, please immediately notify sender by return e-mail and destroy the communication. Any disclosure, copying, distribution or the taking of any action 1 Karla Ford From: Kevin Ross Sent: Wednesday, January 21, 2026 9:06 AM To: Karla Ford Subject: Re: Please Reply- -Three PAs - Fleet -Vehicles I approve Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android From: Karla Ford <kford@weld.gov> Sent: Wednesday,January 21, 2026 9:08:55 AM To:Scott James<sjames@weld.gov>;Jason Maxey<jmaxey@weld.gov>; Kevin Ross<kross@weld.gov> Subject: Please Reply--Three PAs- Fleet-Vehicles There are three pa's from David Springer. Please let me know if you are ok with them going forward. If not, let me know which one you want more info on or a ws. Thank you. .�G N Mna COUNTY,CO Karla Ford Office Manager& Executive Assistant Board of Weld County Commissioners Desk: 970-400-4200/970-400-4228 P.O. Box 758, 1150 0 St., Greeley, CO 80632 0E1000 Join Our Team IMPORTANT:This electronic transmission and any attached documents or other writings are intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. If you have received this communication in error, please immediately notify sender by return e-mail and destroy the communication.Any disclosure, copying,distribution or the taking of any action concerning the contents of this communication or any attachments by anyone other than the named recipient is strictly prohibited. From: David Springer<dspringer@weld.gov> Sent:Tuesday,January 20, 2026 5:00 PM To: Karla Ford <kford@weld.gov> Subject: Pass around Vehicles Karla, 1 Karla Ford Front: Jason Maxey Sent: Wednesday, January 21, 2026 9:07 AM To: Karla Ford; Scott James; Kevin Ross Subject: Re: Please Reply - - Three PAs - Fleet - Vehicles I approve all three Fleet pass arounds. Jason Get Outlook for Android From: Karla Ford <kford@weld.gov> Sent: Wednesday,January 21, 2026 9:08:55 AM To: Scott James<sjames@weld.gov>;Jason Maxey<jmaxey@weld.gov>; Kevin Ross<kross@weld.gov> Subject: Please Reply--Three PAs- Fleet-Vehicles There are three pa's from David Springer. Please let me know if you are ok with them going forward. If not, let me know which one you want more info on or a ws. Thank you. couuNNrv,,co Karla Ford Office Manager& Executive Assistant Board of Weld County Commissioners Desk: 970-400-4200/970-400-4228 P.O. Box 758, 1150 0 St., Greeley, CO 80632 0 ® o ® o Join Our Team IMPORTANT:This electronic transmission and any attached documents or other writings are intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. If you have received this communication in error, please immediately notify sender by return e-mail and destroy the communication.Any disclosure, copying,distribution or the taking of any action concerning the contents of this communication or any attachments by anyone other than the named recipient is strictly prohibited. From: David Springer<dspringer@weld.gov> Sent:Tuesday,January 20, 2026 5:00 PM To: Karla Ford<kford@weld.gov> Subject: Pass around Vehicles Karla, 1 COUE DESCRIPTION 6 MO 1/15/2026 Price WELD COUNTY - QE640 ATTN: DAVID SPRINGER SPA# 202635 K5 2026 FORD EXPEDITION - 'XL-SSV' - _ T _ _r . --4-1012r. g PICTURE IS SYMBOLIC ONLY:ISO DOES NOT RIPRESENT VEHICLE BID U1G 2026 FORD EXPEDITION'XL-SSV'-4WD SUV-5-PASSENGER 50,850.00 102A EQUIPMENT GROUP#102A MY Exterior Color: DARK MATTER GRAY 495.00 CE Interior Color: ULTRA DARK SPACE GRAY CLOTH SEATS: 2ND ROW BENCH N/C 998 ENGINE: 3.51 V6 ECOBOOST 44U TRANSMISSION: 10-SPEED AUTOMATIC 153 FRONT LICENSE PLATE BRACKET TOTAL VEHICLE UNIT PRICE 51,345.00 DEALER OPTIONS TINT DARKEST LEGAL TINT 200.00 KEYS THREE AIM KEYS 1,125.00 COMPLETE VEHICLE UNIT PRICE $ 52,670.00 EACH EXTENDED VEHICLE PRICE(QUANTITY 2 UNITS) $ 105,340.00 TOTAL 1/15/26,4:06 PM bidscolorado.com/co/portal.nsf/xpPriceAgreementRead.xsp?databaseName=CN=GSSBIDS3/O=CO_STATE!!co%5CPriceAwd.nsf... Agreement#: 202635 State of Colorado Price Agreement Classification: PERMISSIVE Status: Current Duration of Agreement: Period Covered: Options: Dec 5,2025 To Sep 30,2026 Option to Renew for 0 More Year(s) Category_ Vehicles Department of Personnel and Administration State Purchasing Office Commodity Code: 1525 Sherman St.,3rd Floor Commodity Vehicles-2026 Denver,CO 80203 Description: Amy Risley at (303)866-5663 email:amy.risley®state.co.us • Ordering/Contact Information Small Business: No Minority Owned: No Woman Owned: No Company: Asbury Automotive Group Doing Business As: LHM Ford Lakewood Contact: Michael Cross Contact Email: michael.cross@lhmauto.com Order Number: Toll Free/Cell Number: Fax: Payment Terms: Address: 11595 W 6th Ave F.O.B.: City,State,ZIP: Lakewood,CO Delivery: Quote Email: • How To Order/Agreement Prices 1.Find Price agreement attached 2.Find detail sheets attached Files: to application/pdf 595 KB LHM_Ford_SPA_202635.pdf Contract Status: -select- Vendor Insurance Certificate Expiration Dates Workers'Comp: General Liability: Other Insurance: Other Insurance Description: Not applicable Not applicable Not applicable Files: • Additional Attachments Files: I application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 36 KB K1 Small 4Dr 5 Pass 4x4 Ford Escape LHM Ford Lakewood.xlsx j i application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 38 KB K2 Medium 4Dr 5 Pass 4x4 Ford Explorer LHM Ford Lakewood.xlsx I application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 39 KB K3 ExLarge 4 Dr 4x4 Ford Expedition Max LHM Ford Lakewood.xlsx japplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet 37 KB K5 Large 4 Dr 5 Pass 4x4 Ford Expedition LHM Ford Lakewood.xlsx Conditions Of Agreement This Agreement results from the following solicitation: Number: Files: Amendments: Amendment Number: Amendment Effective On: Reason For Amendment: Amendment History: https://www.bidscolorado.com/co/portal.nsf/xpPriceAgreementRead.xsp?databaseName=CN=GSSBIDS3/O=CO_STATE!!co%5CPriceAwd.nsf8idocu... 1/2 LJUI.UJIIyI I CI IVCIUi e IL). I LJCUL.IrU-CLJCr-NOCU-OYr O-r LLJCLJMJ.74LJOU STATE OF COLORADO PRICE AGREEMENT COVER PAGE State Agency Contract Performance Beginning Date Department of Personnel and The later of the Effective Date or Administration, State Purchasing and December 4, 2025 Contracts Office Initial Contract Expiration Date Contractor September 30, 2026 Asbury Automotive Group Inc LHM LFO, Contract Authority LLC dba Larry H. Miller Ford Lakewood Authority to enter into this Contract exists Contract Number in 524-102-202, C.R.S. and 1 CCR 101-9 R- 202635 24-102-202-01 . This contract was awarded under solicitation Contract Purpose 2026 or newer vehicles Exhibits and Order of Precedence The following Exhibits and attachments are included with this Contract: 1 . Exhibit B - Statement of Work 2. Exhibit A - General Work Provisions 3. Exhibit C - Products and Price List 4. Exhibit D - Sample Option Letter 5. Exhibit E - PII Certification 6. Exhibit F - HIPAA BAA 7. Exhibit G - Information Technology Provision In the event of a conflict or inconsistency between this Contract and any Exhibit or attachment, such conflict or inconsistency shall be resolved by reference to the documents in the following order of priority: 1. Exhibit F, HIPAA BAA 2. Colorado Special Provisions in 518 of the main body of this Contract. 3. Exhibit G, Information Technology Provisions 4. The provisions of the other sections of the main body of this Contract. 5. Exhibit A- General Work Provisions 6. Exhibit B, Statement of Work. 7. Exhibit E, PII Certification. 8. Exhibit C- Products and Price List 9. Exhibit D, Sample Option Letter. Principal Representatives For the State: For Contractor: Amy Risley Michael Cross State Purchasing Et Contracts Office Larry H Miller Ford Lakewood 1525 Sherman St 5th floor 11595 W 6th Ave Denver, CO 80203 Amy.risley@state.co.us Lakwood, CO 80215 Michael.Cross@lhmauto.com Contract Number: 202635 Page 1 of 31 Version 052025 LULUDIyI I CI IVOIO t IL/. ILJGCl.Ir.7-CL/Cr-YOC.7-OYr O-r LLJCL/MIVYL/JU SIGNATURE PAGE THE PARTIES HERETO HAVE EXECUTED THIS CONTRACT Each person signing this Contract represents and warrants that he or she is duly authorized to execute this Contract and to bind the Party authorizing his or her signature. Contrator State of Colorado Asbury Automotive Group Inc LHM LFO, LLC Jared S. Polis, Governor dba Larry H. Miller Ford Lakewood Department of Personnel and Administration, State Purchasing and Contracts Office Tony Gherardini, Executive Director e--Signed by: litAktiN 44/6 p—DocuSigned by: `—COA rew Keadle, General Manager 'EtrUtitiillEtiapman, State Purchasing Manager Date: 12/3i2025 Date: 12/4/2025 State Chief Information Officer David Edinger, Chief Information Officer and Executive Director DocuSigned by: •3Ale7 9 giVils Date: 12/4/2025 State Contoller Robert Jaros, CPA, MBA, JD ,—/DocuSigned by: llW1A.14A. ea '-2A9C4ODF49BF4pi janda Carroll Effective Date: 12/5/2025 In accordance with S24-30-202, C.R.S., this Contract is not valid until signed and dated above by the State Controller or an authorized delegate. Contract Number: 202635 Page 2 of 31 Version 052025 UVI.UJII�II CI IVeiuje IU. IUC1IJ IF�-C UCr-YVLy-U41 U-I LUCUHJJYUJJ TABLE OF CONTENTS COVER PAGE 1 SIGNATURE PAGE 2 TABLE OF CONTENTS 3 CONTRACT PROVISIONS 4 1 .PARTI ES 4 2. COOPERATIVE PURCHASING 4 3. TERM AND EFFECTIVE DATE 4 4. DEFINITIONS 5 5. STATEMENT OF WORK 8 6. PAYMENTS TO CONTRACTOR 8 7. RESERVED 10 8. REPORTING- NOTIFICATION 10 9. CONTRACTOR RECORD 12 10. CONFIDENTIAL INFORMATION -STATE RECORDS 13 11 . CONFLICTS OF INTEREST 15 12. INSURANCE 15 13. BREACH 18 14. REMEDIES 18 15. DISPUTE RESOLUTION 20 16. NOTICES AND REPRESENTATIVES 21 17. RIGHTS IN WORK PRODUCT AND OTHER INFORMATION 22 18. STATEWIDE ONTRACT MANAGEMENT SYSTEM 23 19. GENERAL PROVISIONS 24 20. COLORADO SPECIAL PROVISIONS (COLORADO FISCAL RULE 3-3) 29 EXHIBIT A - GNERAL WORK PROVISIONS 1 EXHIBIT B, STATEMENT OF WORK 1 EXHIBIT C, PRODUCTS AND PRICE LIST 1 EXHIBIT D, SAMPLE OPTION LETTER 1 EXHIBIT E-PII CERTIFICATION - INDIVIDUAL 1 EXHIBIT E-PII CERTIFICATION - ORGANIZATION 2 EXHIBIT F - HIPAA BUSINESS ASSOCIATE AGREEMENT 1 EXHIBIT G - INFORMATION TECHNOLOGY PROVISIONS 1 Contract Number: 202635 Page 3 of 31 Version 052025 L UL.ubll lI CI IVOIuie IL/. IIJ CM, O-r LL/CL/MJ.74LJJ.7 PRICE AGREEMENT PROVISIONS 1. PARTIES This Contract is entered into by and between Contractor named on the Cover Page for this Contract (the "Contractor"), and the STATE OF COLORADO acting by and through the State agency named on the Cover Page for this Contract (the "State") for use by State agencies and other entities located in Colorado which are authorized by law to utilize State contracts. Contractor and the State agree to the terms and conditions in this Contract. 2. COOPERATIVE PURCHASING Agencies, political subdivisions and other entities (including cooperatives) authorized by the State's statutes to use State contracts may make purchases under this State Price Agreement as of its Effective Date. Issues of interpretation and eligibility for participation are solely within the authority of the Chief Procurement Officer. 3. TERM AND EFFECTIVE DATE A. Effective Date This Contract shall not be valid or enforceable until the Effective Date. The State shall not be bound by any provision of this Contract before the Effective Date, and shall have no obligation to pay Contractor for any Work performed or expense incurred before the Effective Date or after the expiration or sooner termination of this Contract. B. Initial Term The Parties' respective performances under this Contract shall commence on the Contract Performance Beginning Date shown on the Cover Page for this Contract and shall terminate on the Initial Contract Expiration Date shown on the Cover Page for this Contract (the "Initial Term") unless sooner terminated or further extended in accordance with the terms of this Contract. C. Extension Terms - State's Option i. The Parties may extend the Term of this Contract by written amendment executed by the Parties and approved by the State Controller prior to the termination of the Contract on September 30, 2026. ii. Continuation of this Contract beyond the initial term is not a right of the Contractor. The State may enter into an amendment to extend the Term when such extension is clearly in the best interest of the State. D. End of Term Extension If this Contract approaches the end of its Initial Term, or any Extension Term then in place, the State, at its discretion, upon written notice to Contractor as provided in S16, may unilaterally extend such Initial Term or Extension Term for a period not to exceed two months (an "End of Term Extension"), regardless of whether additional Extension Terms are available or not. The provisions of this Contract in effect when such notice is given shall remain in effect during the End Contract Number: 202635 Page 4 of 31 Version 052025 u tiuu JIIyi I CI iveiupe IL/. IL/COV I F J-CL/CI--YOL -OYI LI-f L L/LL/I1JVYL/J1 of Term Extension. The End of Term Extension shall automatically terminate upon execution of a replacement contract or modification extending term of this Contract. E. Order Term Orders may only be placed prior to the expiration or earlier termination of this Contract, but may have a delivery date or performance period that extends no longer than 280 calendar days following that expiration or earlier termination date. Regardless of whether this Contract has expired or has been terminated, the Contractor shall comply with all Orders that extend past the expiration or termination, as described in this section, and all requirements of this Contract necessary to complete all outstanding Orders shall survive the expiration or termination of this Contract until all such Orders are complete. F. Early Termination in the Public Interest The State is entering into this Contract to serve the public interest of the State of Colorado as determined by its Governor, General Assembly, or Courts. If this Contract ceases to further the public interest of the State, the State, in its discretion, may terminate this Contract in whole or in part. A determination that this Contract should be terminated in the public interest shall not be equivalent to a State right to terminate for convenience. This subsection shall not apply to a termination of this Contract by the State for Breach of Contract by Contractor, which shall be governed by §14.A.i. i. Method and Content The State shall notify Contractor of such termination in accordance with §16. The notice shall specify the effective date of the termination and whether it affects all or a portion of this Contract, and shall include, to the extent practicable, the public interest justification for the termination. ii. Obligations and Rights Upon receipt of a termination notice for termination in the public interest, Contractor shall be subject to the rights and obligations set forth in §14.B iii. Payments If the State terminates this Contract in the public interest, the Purchasing Entities shall pay Contractor according to their Orders with the Contractor. The sum of any and all payments shall not exceed the maximum amount payable to Contractor under each Order. 4. DEFINITIONS The following terms shall be construed and interpreted as follows: A. "Breach of Contract" means the failure of a Party to perform any of its obligations in accordance with this Contract, in whole or in part or in a timely or satisfactory manner. The institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within 30 days after the institution of such Contract Number: 202635 Page 5 of 31 Version 052025 L/ULUJII,II CI iv elope IL). I L/L.7L,IFU-CIJCr-YOGJ-OYr O-r LL/CLIFJUYIJJ.7 proceeding, shall also constitute a breach. If Contractor is debarred or suspended under §24-109-105, C.R.S. at any time during the term of this Contract, then such debarment or suspension shall constitute a breach. B. "Business Day" means any day in which the State is open and conducting business, but shall not include Saturday, Sunday or any day on which the State observes one of the holidays listed in §24-11-101(1), C.R.S. C. "Ceiling Price" means the maximum price Contractor or a Subcontractor may charge for a Good or Service under this Contract D. "Chief Procurement Officer" means the individual to whom the Executive Director has delegated his or her authority pursuant to §24-102-202, C.R.S. to procure or supervise the procurement of all supplies and services needed by the State. E. "CJI" means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy, as amended and all Criminal Justice Records as defined under §24-72-302, C.R.S. F. "Contract" means this agreement, including all attached Exhibits, all documents incorporated by reference, all referenced statutes, rules and cited authorities, and any future modifications thereto. G. "Contract Funds" means the funds that have been appropriated, designated, encumbered, or otherwise made available for payment by the State under this Contract. H. "CORA" means the Colorado Open Records Act, §§24-72-200.1, et seq., C.R.S. I. "Deliverable" means the outcome to be achieved or output to be provided, in the form of a tangible object or software that is produced as a result of Contractor's Work that is intended to be delivered to the State by Contractor. J. "Effective Date" means the date on which this Contract is approved and signed by the Colorado State Controller or designee, as shown on the Signature Page for this Contract. K. "End of Term Extension" means the time period defined in §3.D. L. "Environmentally Preferable Products" means products that have a lesser or reduced adverse effect on human health and the environment when compared with competing products that serve the same purpose, as defined in §24-103-904, C.R.S M. "Exhibits" means the exhibits and attachments included with this Contract as shown on the Cover Page for this Contract. N. "Extension Term" means the time period defined in §3.C. 0. "Goods" means any movable material acquired, produced, or delivered by Contractor as set forth in this Contract and shall include any movable material acquired, produced, or delivered by Contractor in connection with the Services. Contract Number: 202635 Page 6 of 31 Version 052025 IJUI.UJIIy.I I CI IVelUpe ILJ. IL/CM-•I r.7-CJ r-'to -oyr O-r GL/CUNJUVLJJ.7 P. "Incident" means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, which are included as part of the Work, as described in §§24-37.5-401, et seq., C.R.S. Incidents include, without limitation, (i) successful attempts to gain unauthorized access to a State system or State Records regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State's knowledge, instruction, or consent. Q. "Initial Term" means the time period defined in S3.B. R. "Order" means any delivery order, purchase order, contract, agreement or other binding document used by a Purchasing Entity to order the Goods and Services described in this Contract from the Contractor, and shall include any modification to such a document S. "Party" means the State or Contractor, and "Parties" means both the State and Contractor. T. "PCI" means payment card information including any data related to credit card holders' names, credit card numbers, or other credit card information as may be protected by state or federal law. U. "PHI" means any protected health information, including, without limitation any information whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. PHI includes, but is not limited to, any information defined as Individually Identifiable Health Information by the federal Health Insurance Portability and Accountability Act. V. "PII" means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. PII includes, but is not limited to, all information defined as personally identifiable information in §§24-72-501 and 24-73-101, C.R.S. "PII" shall also mean "personal identifying information" as set forth at § 24-74-102, et. seq., C.R.S. W. "Purchasing Entity" means any entity or organization that has been authorized by the State to place Orders with the Contractor, and may include, without limitation, agencies of the State, institution of higher education within the State, political subdivisions of the State, authorized non-profit organizations and other authorized entities X. "Services" means the services to be performed by Contractor as set forth in this Contract, and shall include any services to be rendered by Contractor in Contract Number: 202635 Page 7 of 31 Version 052025 UUL UJI9I I CI IVCIUFJC ILJ. I LJGU,IrU-CVCr-YOCU-OYr G-r LL/CLll1JJYL OU connection with the Goods. Y. "State Confidential Information" means any and all State Records not subject to disclosure under CORA. State Confidential Information shall include, but is not limited to, PII, PHI, PCI, Tax Information, CJI, and State personnel records not subject to disclosure under CORA. State Confidential Information shall not include information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished, or disclosed by the State to Contractor which (i) is subject to disclosure pursuant to CORA; (ii) is already known to Contractor without restrictions at the time of its disclosure to Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any State Confidential Information. Z. "State Fiscal Rules" means the fiscal rules promulgated by the Colorado State Controller pursuant to S24-30-202(13)(a), C.R.S. AA. "State Fiscal Year" means a 12 month period beginning on July 1 of each calendar year and ending on June 30 of the following calendar year. If a single calendar year follows the term, then it means the State Fiscal Year ending in that calendar year. BB. "State Records" means any and all State data, information, and records, regardless of physical form, including, but not limited to, information subject to disclosure under CORA. CC. "Subcontractor" means any third party engaged by Contractor to aid in performance of the Work. DD. "Tax Information" means federal and State of Colorado tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation. Tax Information includes, but is not limited to all information defined as federal tax information in Internal Revenue Service Publication 1075. EE. "Work" means the Goods delivered and Services performed pursuant to this Contract. FF. "Work Product" means the tangible and intangible results of the Work, whether finished or unfinished, including drafts. Work Product includes, but is not limited to, documents, text, software (including source code), research, reports, proposals, specifications, plans, notes, studies, data, images, photographs, negatives, pictures, drawings, designs, models, surveys, maps, materials, ideas, concepts, know-how, and any other results of the Work. "Work Product" does not include any material that was developed prior to the Effective Date that is used, without modification, in the performance of the Work. Any other term used in this Contract that is defined in an Exhibit shall be construed and interpreted as defined in that Exhibit. 5. STATEMENT OF WORK Contract Number: 202635 Page 8 of 31 Version 052025 L/uuuwyi I CI IVCIupe I U . IL/COLJ I rU-CIJCr-YOCC-OYrD-r L L/CVPIJUYL/JJ Contractor shall complete the Work as described in this Contract and in accordance with the provisions of Exhibits A and B and any Order. The State shall have no liability to compensate Contractor for the delivery of any goods or the performance of any services that are not specifically set forth in this Contract. 6. PAYMENTS TO CONTRACTOR A. Payments Under Orders i. Each Purchasing Entity will make its own payments under any Order that it enters into. The State shall not be liable to Contractor for any payments due under any Order unless the State is a party to that Order. ii. Contractor shall allow the State and Purchasing Entities to use a procurement card or other credit card to make payments under any Order, in addition to any other payment procedure available to the State or Purchasing Entity. iii. The State shall not pay any amount to Contractor under this Contract unless the state issues an Order, at which time it shall pay Contractor in accordance with that Order. The State shall not be responsible for payment under any Order that is issued by a Purchasing Entity that is not the State, and the Contractor shall seek no payment or other compensation from the State for any Work performed under any Order issued by and Purchasing Entity that is not the State B. Payment Procedures i. Invoices a. Contractor shall invoice each Purchasing Entity in accordance with that Purchasing Entity's Order. Contractor shall not invoice the State under any Order unless the State is a party to that Order. Contractor shall allow 45 days for the State and Purchasing Entities to pay an invoice following the receipt of that invoice, unless the State or a Purchasing Entity specifically agrees to a shorter time in an Order. b. The acceptance of an invoice shall not constitute acceptance of any Work performed or Deliverables provided under this Contract or an applicable Order. ii. Discount and Delinquency Period Any applicable cash discount period or delinquency period for the amounts shown on an invoice shall begin on the date of the Purchasing Entity's approval of that invoice, or from the date of receipt of acceptable Goods or Services at the specified destination by an authorized Purchasing Entity representative, whichever is later iii. Payment Disputes Unless otherwise specified in an Order, if Contractor disputes any calculation, determination or amount of any payment, Contractor shall notify the Purchasing Entity that issued the relevant Order in writing of its dispute within 30 days following the earlier to occur of Contractor's receipt Contract Number: 202635 Page 9 of 31 Version 052025 LJULLUJIy1 I GI IVCIUf a IL). ILJC.7l.II-U-CVC1--YOCU-OYr C'r LL./CVMJ.741.OU of the payment or notification of the determination or calculation of the payment by the State. The Purchasing Entity will review the information presented by Contractor and may make changes to its determination based on this review. The calculation, determination or payment amount that results from the Purchasing Entity's review shall not be subject to additional dispute under this subsection. No payment subject to a dispute under this subsection shall be due until after the Purchasing Entity has concluded its review, and the Purchasing Entity shall not pay any interest on any amount during the period it is subject to dispute under this subsection.. iv. Available Funds-Contingency-Termination The State, acting as a Purchasing Entity, is prohibited by law from making commitments beyond the term of the current State Fiscal Year. Payment to Contractor beyond the current State Fiscal Year is contingent on the appropriation and continuing availability of Contract Funds in any subsequent year (as provided in the Colorado Special Provisions). If federal funds or funds from any other non-State funds constitute all or some of the Contract Funds the State's obligation to pay Contractor shall be contingent upon such non-State funding continuing to be made available for payment. Payments to be made pursuant to this Contract shall be made only from Contract Funds, and the State's liability for such payments shall be limited to the amount remaining of such Contract Funds. If State, federal or other funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may, upon written notice, terminate this Contract, in whole or in part, without incurring further liability. The State shall, however, remain obligated to pay for Services and Goods that are delivered and accepted prior to the effective date of notice of termination, and this termination shall otherwise be treated as if this Contract were terminated in the public interest as described in §3.F. 7. RESERVED 8. REPORTING - NOTIFICATION A. Volume Reporting The State will use a centralized method of tracking volume. Contractor shall provide a quarterly volume report to the State's primary contact identified in §5 of this Participating Addendum within 30 calendar days following the end of the State Fiscal Year quarter that the report covers. The quarterly volume report shall be submitted in a form as directed by the State, which may be modified by the State from time to time. The quarterly volume report shall contain, at a minimum, all of the following: i. A summary volume report that includes, but is not limited to, all of the following for the quarter that the report covers: a. The total spent by each type of Purchasing Entity under this Participating Addendum. b. The total of the list price of all items purchased by each type of Purchasing Entity under this Participating Addendum. Contract Number: 202635 Page 10 of 31 Version 052025 IJUUUJIyI I CI iveiupe ILJ. I L/CUIJ ra-CVCr--tofu-o•+r o-r UCvMo Jyvoa c. The total estimated price savings for each type of Purchasing Entity under this Participating Addendum, calculated as the total list price of all items purchased by each type of Purchasing Entity minus the total spent for that type of Purchasing Entity. d. The total paid through the use of a procurement card or credit card for each Purchasing Entity under this Participating Addendum. e. The total sales of environmentally preferable products, as defined in the State's Environmentally Preferable Purchasing Policy, for each Purchasing Entity under this Participating Addendum. f. The amount of the total administrative fee due to the State. g. Any additional summary information as requested by the State. ii. A detail report that includes, but is not limited to, all of the following for each sale that occurred during the quarter that the report covers: h. The name of the Purchasing Entity who the sale was made to. i. The date of the sale. j. A listing of each item purchased in the sale, including the name of the item, the quantity of the item, the unit price for the item, the extended price for the item calculated by multiplying the unit price by the quantity, the list price per unit for the item, the extended list price for the item calculated by multiplying the quantity by the list price, and the savings on the item calculated by subtracting the extended cost from the extended list price. k. Any other detail information as requested by the State. B. Additional Operational Reporting Upon request by the State, the Contractor shall provide operational reporting that includes all detailed and summary transaction, historical or payment information related to the State or any of the Participating Entities as requested by the State. The Contractor shall provide all such additional reports within 10 Business Days following the State's request for that information, unless the State agrees to a longer period of time in writing. C. Environmentally Preferable Product Reporting Upon request by the State, the Contractor shall provide detailed reporting on environmentally preferable products, as defined in the State's Environmentally Preferable Purchasing Policy, that are purchased or made available under this Participating Addendum. The scope and detail of such reports shall be agreed upon by the State and the Contractor. The Contractor shall provide all such additional reports within 10 Business Days following the State's request for that information, unless the State agrees to a longer period of time in writing. D. Litigation Reporting If Contractor is served with a pleading or other document in connection with an action before a court or other administrative decision making body, and such pleading or document relates to this Contract or may affect Contractor's ability Contract Number: 202635 Page 11 of 31 Version 052025 LRR.UJIyI I CI IVCIVfIC ILJ. ILIGUIJ Ir.7-GLJGr-YOC.7-OYr 1D-1-LUCUMJ.7YVJJ to perform its obligations under this Contract, Contractor shall, within 10 days after being served, notify the State of such action and deliver copies of such pleading or document to the State's Principal Representative identified on the Cover Page for this Contract. E. Performance Outside the State of Colorado or the United States, §24-102-206, C.R.S. To the extent not previously disclosed in accordance with §24-102-206, C.R.S., Contractor shall provide written notice to the State, in accordance with S16 and in a form designated by the State, within 20 days following the earlier to occur of Contractor's decision to perform Services outside of the State of Colorado or the United States, or its execution of an agreement with a Subcontractor to perform, Services outside the State of Colorado or the United States. Such notice shall specify the type of Services to be performed outside the State of Colorado or the United States and the reason why it is necessary or advantageous to perform such Services at such location or locations, and such notice shall be a public record. Knowing failure by Contractor to provide notice to the State under this section shall constitute a Breach of Contract. This section shall not apply if the Contract Funds include any federal funds. 9. CONTRACTOR RECORDS A. Maintenance Contractor shall maintain a file of all documents, records, communications, notes and other materials relating to the Work (the "Contractor Records"). Contractor Records shall include all documents, records, communications, notes and other materials maintained by Contractor that relate to any Work performed by Subcontractors, and Contractor shall maintain all records related to the Work performed by Subcontractors required to ensure proper performance of that Work. Contractor shall maintain Contractor Records until the last to occur of: (i) the date three years after the date this Contract expires or is terminated, (ii) final payment under this Contract is made, (iii) the resolution of any pending Contract matters, or (iv) if an audit is occurring, or Contractor has received notice that an audit is pending, the date such audit is completed and its findings have been resolved (the "Record Retention Period"). B. Inspection Contractor shall permit the State, the federal government, and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy and transcribe Contractor Records during the Record Retention Period. Contractor shall make Contractor Records available during normal business hours at Contractor's office or place of business, or at other mutually agreed upon times or locations, upon no fewer than two Business Days' notice from the State, unless the State determines that a shorter period of notice, or no notice, is necessary to protect the interests of the State. C. Monitoring The State, the federal government, and any other duly authorized agent of a governmental agency, in its discretion, may monitor Contractor's performance of Contract Number: 202635 Page 12 of 31 Version 052025 L)ULUJIyI I GI Iveiupe IV. I UGMa Ir.7-GVGr-YOGS-04r 17-1-LVCLAIJU4L/J' its obligations under this Contract using procedures as determined by the State. The State shall monitor Contractor's performance in a manner that does not unduly interfere with Contractor's performance of the Work. D. Final Audit Report Contractor shall promptly submit to the State a copy of any final audit report of an audit performed on Contractor's records that relates to or affects this Contract or the Work, whether the audit is conducted by Contractor or a third party. 10. CONFIDENTIAL INFORMATION-STATE RECORDS A. Confidentiality Contractor shall keep confidential, and cause all Subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Contractor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this Contract, permitted by law or approved in writing by the State. Contractor shall provide for the security of all State Confidential Information in accordance with all policies promulgated by the Colorado Office of Information Security and all applicable laws, rules, policies, publications, and guidelines. If Contractor or any of its Subcontractors will or may receive the following types of data, Contractor or its Subcontractors shall provide for the security of such data according to the following: (i) the most recently promulgated IRS Publication 1075 for all Tax Information and in accordance with the Safeguarding Requirements for Federal Tax Information attached to this Contract as an Exhibit, if applicable, (ii) the most recently updated PCI Data Security Standard from the PCI Security Standards Council for all PCI, (iii) the most recently issued version of the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy for all CJI, and (iv) the federal Health Insurance Portability and Accountability Act for all PHI and the HIPAA Business Associate Agreement attached to this Contract, if applicable. Contractor shall immediately forward any request or demand for State Records to the State's Principal Representative. B. Other Entity Access and Nondisclosure Agreements Contractor may provide State Records to its agents, employees, assigns and Subcontractors as necessary to perform the Work, but shall restrict access to State Confidential Information to those agents, employees, assigns and Subcontractors who require access to perform their obligations under this Contract. Contractor shall ensure all such agents, employees, assigns, and Subcontractors sign agreements containing nondisclosure provisions at least as protective as those in this Contract, and that the nondisclosure provisions are in force at all times the agent, employee, assign or Subcontractor has access to any State Confidential Information. Contractor shall provide copies of those signed nondisclosure provisions to the State upon execution of the nondisclosure provisions if requested by the State. C. Use, Security, and Retention Contract Number: 202635 Page 13 of 31 Version 052025 L/UVUJIIyI I CI IVQIUF/O IL/. I L/CUl..I FU-CI./CF-YOGJ-OYr O-1-LVGVMJJYVJJ Contractor shall use, hold, and maintain State Confidential Information in compliance with any and all applicable laws and regulations only in facilities located within the United States, and shall maintain a secure environment that ensures confidentiality of all State Confidential Information. Contractor shall provide the State with access, subject to Contractor's reasonable security requirements, for purposes of inspecting and monitoring access and use of State Confidential Information and evaluating security control effectiveness. Upon the expiration or termination of this Contract, Contractor shall return State Records provided to Contractor or destroy such State Records and certify to the State that it has done so, as directed by the State. If Contractor is prevented by law or regulation from returning or destroying State Confidential Information, Contractor warrants it will guarantee the confidentiality of, and cease to use, such State Confidential Information. D. Incident Notice and Remediation If Contractor becomes aware of any Incident, Contractor shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Contractor can establish that Contractor and its Subcontractors are not the cause or source of the Incident, Contractor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Contractor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State at no additional cost to the State. The State may adjust or direct modifications to this plan in its sole discretion, and Contractor shall make all modifications as directed by the State. If Contractor cannot produce its analysis and plan within the allotted time, the State, in its discretion, may perform such analysis and produce a remediation plan, and Contractor shall reimburse the State for the actual costs thereof. The State may, in its sole discretion and at Contractor's sole expense, require Contractor to engage the services of an independent, qualified, State-approved third party to conduct a security audit. Contractor shall provide the State with the results of such audit and evidence of Contractor's planned remediation in response to any negative findings. E. Data Protection and Handling Contractor shall ensure that all State Records and Work Product in the possession of Contractor or any Subcontractors are protected and handled in accordance with the requirements of this Contract, including the requirements of any Exhibits hereto, at all times. F. Safeguarding PII If Contractor or any of its Subcontractors will or may receive PII under this Contract, Contractor shall provide for the security of such PI I, in a manner and form acceptable to the State, including, without limitation, State non-disclosure requirements, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Contractor shall be a "Third-Party Contract Number: 202635 Page 14 of 31 Version 052025 IJUI,,UJIIy1 I GI!Veil/lie ILL IL/CJIJIrJ-CVCI--YOCU-OYt-O-1-LLICL/MJVYVJJ Service Provider" as defined in §24-73-103(1)(i), C.R.S. and shall maintain security procedures and practices consistent with §524-73-101 et seq., C.R.S. In addition, as set forth in § 24-74-102, et. seq., C.R.S., Contractor, including, but not limited to, Contractor's employees, agents and Subcontractors, agrees not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Contractor is given direct access to any State databases containing PII, Contractor shall execute, on behalf of itself and its employees, the certification attached hereto as an Exhibit on an annual basis Contractor's duty and obligation to certify as set forth in the attached Exhibit continue as long as Contractor has direct access to any State databases containing PII. If Contractor uses any Subcontractors to perform services requiring direct access to State databases containing PII, the Contractor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII. 11 . CONFLICTS OF INTEREST A. Actual Conflicts of Interest Contractor shall not engage in any business or activities, or maintain any relationships that conflict in any way with the full performance of the obligations of Contractor under this Contract. Such a conflict of interest would arise when a Contractor or Subcontractor's employee, officer or agent were to offer or provide any tangible personal benefit to an employee of the State, or any member of his or her immediate family or his or her partner, related to the award of, entry into or management or oversight of this Contract. B. Apparent Conflicts of Interest Contractor acknowledges that, with respect to this Contract, even the appearance of a conflict of interest shall be harmful to the State's interests. Absent the State's prior written approval, Contractor shall refrain from any practices, activities or relationships that reasonably appear to be in conflict with the full performance of Contractor's obligations under this Contract. C. Disclosure to the State If a conflict or the appearance of a conflict arises, or if Contractor is uncertain whether a conflict or the appearance of a conflict has arisen, Contractor shall submit to the State a disclosure statement setting forth the relevant details for the State's consideration. Failure to promptly submit a disclosure statement or to follow the State's direction in regard to the actual or apparent conflict constitutes a Breach of Contract. D. Acknowledgement Contractor acknowledges that all State employees are subject to the ethical principles described in §24-18-105, C.R.S. Contractor further acknowledges that State employees may be subject to the requirements of §24-18-105, C.R.S. with regard to this Contract. 12. INSURANCE Contract Number: 202635 Page 15 of 31 Version 052025 L/VI.UJIyII GII%elupe IL/ IL/CULy Ir.7-GL/Cr-YOCV-OYrO-1-LVCV/1JOYL/JJ Contractor shall obtain and maintain, and ensure that each Subcontractor shall obtain and maintain, insurance as specified in this section at all times during the term of this Contract. All insurance policies required by this Contract shall be issued by insurance companies as approved by the State. A. Workers' Compensation Workers' compensation insurance as required by state statute, and employers' liability insurance covering all Contractor or Subcontractor employees acting within the course and scope of their employment. B. General Liability Commercial general liability insurance covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: i. $1 ,000,000 each occurrence; ii. $1 ,000,000 general aggregate; iii. $1 ,000,000 products and completed operations aggregate; and iv. $50,000 any one fire. C. Automobile Liability Automobile liability insurance covering any auto (including owned, hired and non- owned autos) with a minimum limit of $1,000,000 each accident combined single limit. D. Garage Keepers Liability The Garage Keepers Liability Insurance must have a minimum of $1 ,000,000 per occurrence. E. Protected Information Liability insurance covering all civil, regulatory, and statutory damages, contractual damages, data breach management exposure, and all loss income or extra expense as a result of actual or alleged breach, violation or infringement of a right to privacy, consumer data protection law, confidentiality or other legal protection for personal information as well as State Confidential Information with minimum limits as follows: i. $1,000,000 each occurrence; and ii. $2,000,000 general aggregate. F. Professional Liability Insurance Professional liability insurance covering any damages caused by an error, omission or any negligent act with minimum limits as follows: i. $1,000,000 each occurrence; and ii. $1,000,000 general aggregate. G. Crime Insurance Contract Number: 202635 Page 16 of 31 Version 052025 L/UL.UJIIJ.II CIIVCIUpC ILO. I L/CMl,I FC-CUCFW0C.7-04f D-r LL1CL.lf1Jy4LJJ� Crime insurance including employee dishonesty coverage with minimum limits as follows: i. $1,000,000 each occurrence; and ii. $1,000,000 general aggregate. H. Additional Insured The State shall be named as additional insured on all commercial general liability policies (leases and construction contracts require additional insured coverage for completed operations) required of Contractor and Subcontractors. I. Primacy of Coverage Coverage required of Contractor and each Subcontractor shall be primary and noncontributory over any insurance or self-insurance program carried by Contractor or the State. J. Cancellation The above insurance policies shall include provisions preventing cancellation or non-renewal, except for cancellation based on non-payment of premiums, without at least 30 days prior notice to Contractor and Contractor shall forward such notice to the State in accordance with §16 within seven days of Contractor's receipt of such notice. K. Subrogation Waiver All insurance policies secured or maintained by Contractor or its Subcontractors in relation to this Contract shall include clauses stating that each carrier shall waive all rights of recovery under subrogation or otherwise against Contractor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers. L. Public Entities If Contractor is a "public entity" within the meaning of the Colorado Governmental Immunity Act, §524-10-101, et seq., C.R.S. (the "GIA"), Contractor shall maintain, in lieu of the liability insurance requirements stated above, at all times during the term of this Contract such liability insurance, by commercial policy or self-insurance, as is necessary to meet its liabilities under the GIA. If a Subcontractor is a public entity within the meaning of the GIA, Contractor shall ensure that the Subcontractor maintains at all times during the terms of this Contract, in lieu of the liability insurance requirements stated above, such liability insurance, by commercial policy or self-insurance, as is necessary to meet the Subcontractor's obligations under the GIA. M. Certificates Contractor shall provide to the State certificates evidencing Contractor's insurance coverage required in this Contract within seven Business Days following the Effective Date. Contractor shall provide to the State certificates evidencing Subcontractor insurance coverage required under this Contract within seven Business Days following the Effective Date, except that, if Contractor's subcontract is not in effect as of the Effective Date, Contractor shall provide to Contract Number: 202635 Page 17 of 31 Version 052025 ✓ul.0 DlyI I CI IVCIopt 11.J. I✓C.Ma Irv-c✓cr-Yocu-oYro-rc✓c✓MJ.7Y✓Ju the State certificates showing Subcontractor insurance coverage required under this Contract within seven Business Days following Contractor's execution of the subcontract. No later than 15 days before the expiration date of Contractor's or any Subcontractor's coverage, Contractor shall deliver to the State certificates of insurance evidencing renewals of coverage. At any other time during the term of this Contract, upon request by the State, Contractor shall, within seven Business Days following the request by the State, supply to the State evidence satisfactory to the State of compliance with the provisions of this section. 13. BREACH A. Breach of Contract In the event of a Breach of Contract, the aggrieved Party shall give written notice of breach to the other Party. If the notified Party does not cure the Breach of Contract, at its sole expense, within 30 days after the delivery of written notice, the Party may exercise any of the remedies as described in §14 for that Party. Notwithstanding any provision of this Contract to the contrary, the State, in its discretion, need not provide notice or a cure period and may immediately terminate this Contract in whole or in part or institute any other remedy in this Contract in order to protect the public interest of the State; or if Contractor is debarred or suspended under §24-109-105, C.R.S., the State, in its discretion, need not provide notice or cure period and may terminate this Contract in whole or in part or institute any other remedy in this Contract as of the date that the debarment or suspension takes effect. B. Breach of an Order In the event of a Breach of an Order, the Parties shall follow the applicable provisions of that Order. 14. REMEDIES A. State's Remedies If Contractor is in breach under any provision of this Contract and fails to cure such breach, the State, following the notice and cure period set forth in 513, shall have all of the remedies listed in this section in addition to all other remedies set forth in this Contract or at law. The State may exercise any or all of the remedies available to it, in its discretion, concurrently or consecutively. i. Termination for Breach In the event of Contractor's uncured breach, the State may terminate this entire Contract or any part of this Contract. Contractor shall continue performance of this Contract to the extent not terminated, if any. a. Obligations and Rights To the extent specified in any termination notice, Contractor shall not incur further obligations or render further performance past the effective date of such notice, and shall terminate outstanding orders and subcontracts with third parties. However, Contractor shall complete and deliver to the Purchasing Entities all Work not cancelled by the termination notice, and may incur obligations as necessary to do Contract Number: 202635 Page 18 of 31 Version 052025 LJuuublyII CI IVCIUpJC ILJ. ILJCUli I1-.7-CLJCr'YOCJ-041-D-r LLICLJ/1JJYLJJJ so within this Contract's terms. At the request of the State or any Purchasing Entity, Contractor shall assign to the Purchasing Entity all of Contractor's rights, title, and interest in and to such terminated orders or subcontracts. Upon termination, Contractor shall take timely, reasonable and necessary action to protect and preserve property in the possession of Contractor but in which the State or a Purchasing Entity has an interest. At the State's request, Contractor shall return materials owned by the State or a Purchasing Entity in Contractor's possession at the time of any termination. Contractor shall deliver all completed Work Product and all Work Product that was in the process of completion to the State or a Purchasing Entity at the State or Purchasing Entity's request. b. Payments Notwithstanding anything to the contrary, the Purchasing Entities shall only pay Contractor for accepted Work received as of the date of termination. If, after termination by the State, the State agrees that Contractor was not in breach or that Contractor's action or inaction was excusable, such termination shall be treated as a termination in the public interest, and the rights and obligations of the Parties shall be as if this Contract had been terminated in the public interest under S3.F. c. Damages and Withholding Notwithstanding any other remedial action by the State, Contractor shall remain liable to the State or appropriate Purchasing Entity for any damages sustained by the State or Purchasing Entity in connection with any breach by Contractor, and the Purchasing Entity may withhold payment to Contractor for the purpose of mitigating the Purchasing Entity's damages. A Purchasing Entity may withhold any amount that may be due Contractor as the Purchasing Entity deems necessary to protect itself against loss including, without limitation, loss as a result of outstanding liens and excess costs incurred by the Purchasing Entity in procuring from third parties replacement Work as cover. ii. Remedies Not Involving Termination The State, in its discretion, may exercise one or more of the following additional remedies: a. Suspend Performance Suspend Contractor's performance with respect to all or any portion of the Work pending corrective action as specified by the State without entitling Contractor to an adjustment in price or cost or an adjustment in the performance schedule. Contractor shall promptly cease performing Work and incurring costs in accordance with the State's directive, and neither the State nor any Purchasing Entity shall not be liable for costs incurred by Contractor after the suspension of performance. Contract Number: 202635 Page 19 of 31 Version 052025 LJUI:uJIy1I CI IVCIUFIC IL). IUCJ1..If y-CVr-'}ou-o.tr C-r LL./CL/MJ.74VJu b. Withhold Payment Withhold payment to Contractor until Contractor corrects its Work. c. Deny Payment Deny payment for Work not performed, or that due to Contractor's actions or inactions, cannot be performed or if they were performed are reasonably of no value to the State; provided, that any denial of payment shall be equal to the value of the obligations not performed. d. Removal Demand immediate removal of any of Contractor's employees, agents, or Subcontractors from the Work whom the State deems incompetent, careless, insubordinate, unsuitable, or otherwise unacceptable or whose continued relation to this Contract is deemed by the State to be contrary to the public interest or the State's best interest. e. Intellectual Property If any Work infringes, or if the State in its sole discretion determines that any Work is likely to infringe, a patent, copyright, trademark, trade secret or other intellectual property right, Contractor shall, at the option of and as approved by the State or Purchasing Entity(i) secure that right to use such Work for the State, Purchasing Entity and Contractor; (ii) replace the Work with noninfringing Work or modify the Work so that it becomes noninfringing; or, (iii) remove any infringing Work and refund the amount paid for such Work to the Purchasing Entity. B. Contractor's Remedies If the State is in breach of any provision of this Contract and does not cure such breach, Contractor, following the notice and cure period in §13 and the dispute resolution process in §15 shall have all remedies available at law and equity. If a Purchasing Entity is in breach of a provision of an Order, Contractor shall have all remedies available to it under that Order and available at law and equity. C. Purchasing Entity's Remedies i. If Contractor is in breach under any provision of an Order by a Purchasing Entity, the Purchasing Entity shall have all of the remedies listed in that Order, in addition to all other remedies available by law or equity. The Purchasing Entity may exercise any or all of the remedies available to it, in its discretion, concurrently or consecutively. ii. If a Purchasing Entity gives Contractor notice of breach or terminates an Order because of Contractor's breach of that Order, Contractor shall provide notice to the State of that breach or termination within five Business Days following Contractor's receipt of that notice of breach or termination 15. DISPUTE RESOLUTION A. Initial Resolution Contract Number: 202635 Page 20 of 31 Version 052025 L/UL.UJIIJ.I I CI IVCIUf1C IL/. I LJCML,IFU-CL/Cr-.10CU-OYr 0-1-LL/CL/fWJYUJJ Except as herein specifically provided otherwise, disputes concerning the performance of this Contract which cannot be resolved by the designated Contract representatives or through a dispute on an Order, as described in Exhibit A, shall be referred in writing to a senior departmental management staff member designated by the State and a senior manager designated by Contractor for resolution. B. Resolution of Controversies arising under this Contract If the initial resolution described above fails to resolve the dispute within 10 Business Days, Contractor shall submit any alleged breach of this Contract by the State to the Procurement Official of the State Purchasing and Contracts Office as described in §24-102-202(3), C.R.S. for resolution in accordance with the provisions of §24-106-109, C.R.S., and §§24-109-101 .1 through 24-109-505, C.R.S., (the "Resolution Statutes"), except that if Contractor wishes to challenge any decision rendered by the Procurement Official, Contractor's challenge shall be an appeal to the Executive Director of the Department of Personnel and Administration, or their delegate, under the Resolution Statutes before Contractor pursues any further action as permitted by such statutes. Except as otherwise stated in this Section, all requirements of the Resolution Statutes shall apply including, without limitation, time limitations. C. Resolution of Controversies arising under any Order made pursuant to this Contract Any dispute between Contractor and a Purchasing Entity concerning the performance of an Order shall be resolved under the dispute resolution processes as described in the applicable Order. If the Order does not describe a dispute resolution process, the dispute shall be resolved under the Purchasing Entity's dispute resolution statutes, policies, or other applicable regulations, or in a manner as agreed upon by the Purchasing Entity and Contractor. 16. NOTICES AND REPRESENTATIVES Each individual identified as a Principal Representative on the Cover Page for this Contract shall be the principal representative of the designating Party. All notices required or permitted to be given under this Contract shall be in writing, and shall be delivered (A) by hand with receipt required, (B) by certified or registered mail to such Party's principal representative at the address set forth below or (C) as an email with read receipt requested to the principal representative at the email address, if any, set forth on the Cover Page for this Contract. If a Party delivers a notice to another through email and the email is undeliverable, then, unless the Party has been provided with an alternate email contact, the Party delivering the notice shall deliver the notice by hand with receipt required or by certified or registered mail to such Party's principal representative at the address set forth on the Cover Page for this Contract. Either Party may change its principal representative or principal representative contact information, or may designate specific other individuals to receive certain types of notices in addition to or in lieu of a principal representative by notice submitted in accordance with this section without a formal amendment to this Contract. Unless otherwise provided in this Contract, notices shall be effective upon delivery of the written notice. Contract Number: 202635 Page 21 of 31 Version 052025 IJUI.UJIyII CI iveiu a ILJ. IIJCUL.Ir'-CL./Cr-YOJ-o.tr O-r LL./ LJMJ.741./Jy 17. RIGHTS IN WORK PRODUCT AND OTHER INFORMATION A. Work Product Contractor assigns to the Purchasing Entity and its successors and assigns, the entire right, title, and interest in and to all causes of action, either in law or in equity, for past, present, or future infringement of intellectual property rights related to the Work Product and all works based on, derived from, or incorporating the Work Product under an Order. Whether or not Contractor is under contract with the State at the time, Contractor shall execute applications, assignments, and other documents, and shall render all other reasonable assistance requested by the State, to enable the State to secure patents, copyrights, licenses and other intellectual property rights related to the Work Product. To the extent that Work Product would fall under the definition of "works made for hire" under 17 U.S.C.S. §101, the Parties intend the Work Product to be a work made for hire. i. Copyrights To the extent that the Work Product (or any portion of the Work Product) would not be considered works made for hire under applicable law, Contractor hereby assigns to the Purchasing Entity, the entire right, title, and interest in and to copyrights in all Work Product and all works based upon, derived from, or incorporating the Work Product; all copyright applications, registrations, extensions, or renewals relating to all Work Product and all works based upon, derived from, or incorporating the Work Product; and all moral rights or similar rights with respect to the Work Product throughout the world. To the extent that Contractor cannot make any of the assignments required by this section, Contractor hereby grants to the Purchasing Entity a perpetual, irrevocable, royalty-free license to use, modify, copy, publish, display, perform, transfer, distribute, sell, and create derivative works of the Work Product created under that Purchasing Entity's Order, and all works based upon, derived from, or incorporating the Work Product by all means and methods and in any format now known or invented in the future. The Purchasing Entity may assign and license its rights under this license. ii. Patents In addition, Contractor grants to the Purchasing Entity (and to recipients of Work Product distributed by or on behalf of the Purchasing Entity) a perpetual, worldwide, no-charge, royalty-free, irrevocable patent license to make, have made, use, distribute, sell, offer for sale, import, transfer, and otherwise utilize, operate, modify and propagate the contents of the Work Product created under an Order. Such license applies only to those patent claims licensable by Contractor that are necessarily infringed by the Work Product alone, or by the combination of the Work Product with anything else used by the Purchasing Entity. iii. Assignments and Assistance Whether or not Contractor is under contract with the State at the time, Contractor shall execute applications, assignments, and other documents, Contract Number: 202635 Page 22 of 31 Version 052025 L/OI.OJiyi CI IveuIJpe ILL ILL L.Ir.7-CLICr-YOGJ-0Y1-0-1-LVCVMJUYVJU and shall render all other reasonable assistance requested by the Purchasing Entity, to enable the Purchasing Entity to secure patents, copyrights, licenses and other intellectual property rights related to the Work Product created under an Order. To the extent that Work Product would fall under the definition of "works made for hire" under 17 U.S.C.S. §101, the Parties intend the Work Product to be a work made for hire. Contractor assigns to the Purchasing Entity and its successors and assigns, the entire right, title, and interest in and to all causes of action, either in law or in equity, for past, present, or future infringement of intellectual property rights related to the Work Product and all works based on, derived from, or incorporating the Work Product. B. Exclusive Property of the State Except to the extent specifically provided elsewhere in this Contract, all State Records, documents, text, software (including source code), research, reports, proposals, specifications, plans, notes, studies, data, images, photographs, negatives, pictures, drawings, designs, models, surveys, maps, materials, ideas, concepts, know-how, and information provided by or on behalf of the State to Contractor are the exclusive property of the State (collectively, "State Materials"). Contractor shall not use, willingly allow, cause or permit Work Product or State Materials to be used for any purpose other than the performance of Contractor's obligations in this Contract without the prior written consent of the State. Upon termination of this Contract for any reason, Contractor shall provide all Work Product and State Materials to the State in a form and manner as directed by the State. C. Exclusive Property of Contractor Contractor retains the exclusive rights, title, and ownership to any and all pre- existing materials owned or licensed to Contractor including, but not limited to, all pre-existing software, licensed products, associated source code, machine code, text images, audio and/or video, and third-party materials, delivered by Contractor under the Contract, whether incorporated in a Deliverable or necessary to use a Deliverable (collectively, "Contractor Property"). Contractor Property shall be licensed to the State as set forth in this Contract or a State approved license agreement: (i) entered into as exhibits to this Contract; (ii) obtained by the State from the applicable third-party vendor; or (iii) in the case of open source software, the license terms set forth in the applicable open source license agreement. 18. STATEWIDE CONTRACT MANAGEMENT SYSTEM If the maximum amount payable to Contractor under this Contract is $100,000 or greater, either on the Effective Date or at any time thereafter, this section shall apply. Contractor agrees to be governed by and comply with the provisions of §524- 106-103, 24-102-206, 24-106-106, and 24-106-107, C.R.S. regarding the monitoring of vendor performance and the reporting of contract performance information in the State's contract management system ("Contract Management System" or "CMS"). Contractor's performance shall be subject to evaluation and review in accordance with the terms and conditions of this Contract, Colorado statutes governing CMS, and Contract Number: 202635 Page 23 of 31 Version 052025 LJVI.UJIIy.II CIIVCIUpC IL/. ILIGUL..Ir.7-GLlC r-YUC.7-o4r O-r LLJCLJ/1J.7YLJJU State Fiscal Rules and State Controller Policies. 19. GENERAL PROVISIONS A. Assignment Contractor's rights and obligations under this Contract are personal and may not be transferred or assigned without the prior, written consent of the State. Any attempt at assignment or transfer without such consent shall be void. Any assignment or transfer of Contractor's rights and obligations approved by the State shall be subject to the provisions of this Contract. B. Subcontracts Contractor shall not enter into any subcontract in connection with its obligations under this Contract without the prior, written approval of the State. Contractor shall submit to the State a copy of each such subcontract upon request by the State. All subcontracts entered into by Contractor in connection with this Contract shall comply with all applicable federal and state laws and regulations, shall provide that they are governed by the laws of the State of Colorado, and shall be subject to all provisions of this Contract. C. Binding Effect Except as otherwise provided in §19.A, all provisions of this Contract, including the benefits and burdens, shall extend to and be binding upon the Parties' respective successors and assigns. D. Authority Each Party represents and warrants to the other that the execution and delivery of this Contract and the performance of such Party's obligations have been duly authorized. E. Captions and References The captions and headings in this Contract are for convenience of reference only, and shall not be used to interpret, define, or limit its provisions. All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits or other attachments, are references to sections, subsections, exhibits or other attachments contained herein or incorporated as a part hereof, unless otherwise noted. F. Counterparts This Contract may be executed in multiple, identical, original counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement. G. Entire Understanding This Contract represents the complete integration of all understandings between the Parties related to the Work, and all prior representations and understandings related to the Work, oral or written, are merged into this Contract. Prior or contemporaneous additions, deletions, or other changes to this Contract shall not have any force or effect whatsoever, unless embodied herein. Contract Number: 202635 Page 24 of 31 Version 052025 LAJUUJIy1 I CI IVelUFle IL'. I UGJV IFU-CVCr WOCU-OYr O-1-LLJCLJ/1JUYLJOU H. Digital Signatures If any signatory signs this Contract using a digital signature in accordance with the Colorado State Controller Contract, Grant and Purchase Order Policies regarding the use of digital signatures issued under the State Fiscal Rules, then any agreement or consent to use digital signatures within the electronic system through which that signatory signed shall be incorporated into this Contract by reference. I. Modification Except as otherwise provided in this Contract, any modification to this Contract shall only be effective if agreed to in a formal amendment to this Contract, properly executed and approved in accordance with applicable Colorado State law and State Fiscal Rules. Modifications permitted under this Contract, other than contract amendments, shall conform to the policies issued by the Colorado State Controller. J. Statutes, Regulations, Fiscal Rules, and Other Authority Any reference in this Contract to a statute, regulation, State Fiscal Rule, fiscal policy or other authority shall be interpreted to refer to such authority then current, as may have been changed or amended since the Effective Date of this Contract. K. External Terms and Conditions Notwithstanding anything to the contrary herein, the State shall not be subject to any provision included in any terms, conditions, or agreements appearing on Contractor's or a Subcontractor's website or any provision incorporated into any click-through or online agreements related to the Work unless that provision is specifically referenced in this Contract. L. Severability The invalidity or unenforceability of any provision of this Contract shall not affect the validity or enforceability of any other provision of this Contract, which shall remain in full force and effect, provided that the Parties can continue to perform their obligations under this Contract in accordance with the intent of this Contract. M. Survival of Certain Contract Terms Any provision of this Contract that imposes an obligation on a Party after termination or expiration of this Contract shall survive the termination or expiration of this Contract and shall be enforceable by the other Party. N. Taxes The State is exempt from federal excise taxes under I.R.C. Chapter 32 (26 U.S.C., Subtitle D, Ch. 32) (Federal Excise Tax Exemption Certificate of Registry No. 84- 730123K) and from State and local government sales and use taxes under 5539- 26-704(1 ), et seq., C.R.S. (Colorado Sales Tax Exemption Identification Number 98-02565). The State shall not be liable for the payment of any excise, sales, or use taxes, regardless of whether any political subdivision of the state imposes Contract Number: 202635 Page 25 of 31 Version 052025 UVUUJIy1I CI IVCIVE a II-. IUL ..IrU-CUGr-YOGV-VYr O-rGUCUMJVYUJV such taxes on Contractor. Contractor shall be solely responsible for any exemptions from the collection of excise, sales or use taxes that Contractor may wish to have in place in connection with this Contract. Contractor shall honor any tax exemption that any Purchasing Entity has, and shall not charge any Purchasing Entity any excise, sales, or use taxes from which that Purchasing Entity is exempt 0. Third Party Beneficiaries Except for Purchasing Entities and the Parties' respective successors and assigns described in S 19.A, this Contract does not and is not intended to confer any rights or remedies upon any person or entity other than the Parties. Enforcement of this Contract and all rights and obligations hereunder are reserved solely to the Parties. Any services or benefits which third parties receive as a result of this Contract are incidental to this Contract, and do not create any rights for such third parties. P. Waiver A Party's failure or delay in exercising any right, power, or privilege under this Contract, whether explicit or by lack of enforcement, shall not operate as a waiver, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise of such right, power, or privilege. Q. CORA Disclosure To the extent not prohibited by federal law, this Contract and the performance measures and standards required under S24-106-107, C.R.S., if any, are subject to public release through the CORA. R. Standard and Manner of Performance Contractor shall perform its obligations under this Contract in accordance with the highest standards of care, skill and diligence in Contractor's industry, trade, or profession. S. Licenses, Permits, and Other Authorizations i. Contractor shall secure, prior to the Effective Date, and maintain at all times during the term of this Contract, at its sole expense, all licenses, certifications, permits, and other authorizations, including all documentation from Colorado's Secretary of State necessary to demonstrate that Contractor is authorized to do business in the State, required to perform its obligations under this Contract, and shall ensure that all employees, agents and Subcontractors secure and maintain at all times during the term of their employment, agency or subcontract, all licenses, certifications, permits and other authorizations required to perform their obligations in relation to this Contract. Contract Number: 202635 Page 26 of 31 Version 052025 LJUUUJIy.1 I CI IVCIUf/C IL). I LJLJIL If' -CL G1-W0CJ-0Y1-O-f LVCLJ/1JUY L./UV ii. Contractor, if a foreign corporation or other foreign entity transacting business in the State of Colorado, shall obtain prior to the Effective Date, and maintain at all times during the term of this Contract, at its sole expense, a certificate of authority to transact business in the State of Colorado ad designate a registered agent in Colorado to accept service of process. T. Indemnification i. General Indemnification Contractor shall indemnify, save, and hold harmless the State, its employees, agents and assignees (the "Indemnified Parties"), against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys' fees and related costs) incurred by any of the Indemnified Parties in relation to any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees in connection with this Contract. ii. Confidential Information Indemnification Disclosure or use of State Confidential Information by Contractor in violation of this Contract may be cause for legal action by third parties against Contractor, the State, or their respective agents. Contractor shall indemnify, save, and hold harmless the Indemnified Parties, against any and all claims, damages, liabilities, losses, costs, expenses (including attorneys' fees and costs) incurred by the State in relation to any act or omission by Contractor, or its employees, agents, assigns, or Subcontractors in violation of this Contract. iii. Intellectual Property Indemnification Contractor shall indemnify, save, and hold harmless the Indemnified Parties, against any and all costs, expenses, claims, damages, liabilities, and other amounts (including attorneys' fees and costs) incurred by the Indemnified Parties in relation to any claim that any Deliverable, Good or Service, software, or Work Product provided by Contractor under this Contract (collectively, "IP Deliverables"), or the use thereof, infringes a patent, copyright, trademark, trade secret, or any other intellectual property right. Contractor's obligations hereunder shall not extend to the combination of any IP Deliverables provided by Contractor with any other product, system, or method, unless the other product, system, or method is (a) provided by Contractor or Contractor's subsidiaries or affiliates; (b) specified by Contractor to work with the IP Deliverables; (c) reasonably required in order to use the IP Deliverables in its intended manner and the infringement could not have been avoided by substituting another reasonably available product, system, or method capable of performing the same function; or (d) is reasonably expected to be used in combination with the IP Deliverables. iv. Accessibility Indemnification Contract Number: 202635 Page 27 of 31 Version 052025 UUI.UJIIy1I CI IVCIUpe IIJ. IUG.7l.Ir.7-GI.lGr-4o Cu-oYr o-rLUCVMJyYVJ.7 Contractor shall indemnify, save, and hold harmless the state, its employees, agents and assignees (collectively, the "Indemnified Parties"), against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys' fees and related costs) incurred by any of the Indemnified Parties in relation to Contractor's failure to comply with §§24-85-101, et seq., C.R.S., or the Accessibility Standards for Individuals with a Disability as established by the Office of Information Technology pursuant to Section §24-85-103 (2.5), C.R.S. U. Accessibility i. Contractor shall comply with the Accessibility Standards for Individuals with a Disability, as adopted by the Office of Information Technology pursuant to §24-85-103, C.R.S. ii. The State shall require that the Contractor's compliance with the Accessibility Standards for Individuals with a Disability adopted by the Office of Information Technology pursuant to §24-85-103, C.R.S. is determined and tested by a qualified third party selected by the State. The State may ask Contractor to review the selection of the third party. Contractor shall be responsible for all costs associated with the third-party vendor's assessment. If Contractor is not in compliance as determined by the third-party vendor, at the State's request and at the State's discretion, Contractor shall promptly take all necessary actions to come into compliance using a State-approved vendor, at no additional cost to the State. V. Use of Artificial Intelligence Systems a. All capitalized terms in this Section, not otherwise defined in this Agreement, are defined in §§6-01-1701, et seq., C.R.S., the Parties agree to comply with the provisions of §§6-01-1701, et seq., C.R.S., regarding Consumer Protections in Interactions with Artificial Intelligence Systems. These include, but are not limited to: i. Developer duty to avoid algorithmic discrimination, including documentation requirements; ii. Deployer duty to avoid algorithmic discrimination including a risk management framework for artificial intelligence; and iii. Disclosure of an Artificial Intelligence System to Consumer. Contract Number: 202635 Page 28 of 31 Version 052025 L/ul.0 JI II CI IVCIOLM IU. ILJGUL•I1-.7-GVGr-YOCU-OYr o-r LL1CVMJC.FL/OJ b. The Parties are obligated to take extra precautions with High-Risk Artificial Intelligence Systems, which are any that, when deployed, make or are a substantial factor in making a Consequential Decision. i. Advance Approval for High-Risk Al Usage. Contractor shall obtain prior written approval from the State before utilizing High Risk Artificial Intelligence technologies in the provision of Services under this contract and purchasing instruments entered into pursuant to this Contract. Contractor shall clearly identify in writing the specific High-Risk Artificial Intelligence technologies to be employed, their intended functions, their potential impact on service delivery, and the benefit to the State. ii. High-Risk Artificial Intelligence Systems Training Data Usage. Contractor shall not employ State Confidential Information to train High-Risk Artificial Intelligence Systems without obtaining prior written approval from the State. The intended usage of such data for High-Risk Artificial Intelligence Systems training must align with existing data usage rights, and Contractor shall ensure that data privacy and security are maintained throughout the process. Specifically, all PII, PHI, FTI, CJI, and PCI data must be managed as specified in the main body of this Contract and in any data management exhibits attached to this Contract. No data used for High-Risk Artificial Intelligence Systems training may be stored outside of the United States without prior written approval of the State. 20. COLORADO SPECIAL PROVISIONS (COLORADO FISCAL RULE 3-3) These Special Provisions apply to all contracts except where noted in italics. A. STATUTORY APPROVAL. §24-30-202(1), C.R.S. This Contract shall not be valid until it has been approved by the Colorado State Controller or designee. If this Contract is for a Major Information Technology Project, as defined in §24-37.5-102(2.6), C.R.S., then this Contract shall not be valid until it has been approved by the State's Chief Information Officer or designee. B. FUND AVAILABILITY. §24-30-202(5.5), C.R.S. Financial obligations of the State payable after the current State Fiscal Year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available. C. GOVERNMENTAL IMMUNITY. Contract Number: 202635 Page 29 of 31 Version 052025 L/UUUJIIJ.I I CI II/CIL/L/C IL/. IL/GUIJ IrU-GL/Gr-YOCU-OYr G-r 41-/CL/HJ.7YL/JJ Liability for claims for injuries to persons or property arising from the negligence of the State, its departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the Colorado Governmental Immunity Act, S24-10-101, et seq., C.R.S.; the Federal Tort Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C. 1346(b), and the State's risk management statutes, SS24-30-1501, et seq. C.R.S. No term or condition of this Contract shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, contained in these statutes. D. INDEPENDENT CONTRACTOR. Contractor shall perform its duties hereunder as an independent contractor and not as an employee. Neither Contractor nor any agent or employee of Contractor shall be deemed to be an agent or employee of the State. Contractor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Contractor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Contractor or any of its agents or employees. Contractor shall pay when due all applicable employment taxes and income taxes and local head taxes incurred pursuant to this Contract. Contractor shall (i) provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law, (ii) provide proof thereof when requested by the State, and (iii) be solely responsible for its acts and those of its employees and agents. E. COMPLIANCE WITH LAW. Contractor shall comply with all applicable federal and State laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices. F. CHOICE OF LAW, JURISDICTION, AND VENUE. Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this Contract. Any provision included or incorporated herein by reference which conflicts with said laws, rules, and regulations shall be null and void. All suits or actions related to this Contract shall be filed and proceedings held in the State of Colorado and exclusive venue shall be in the City and County of Denver. G. PROHIBITED TERMS. Any term included in this Contract that requires the State to indemnify or hold Contractor harmless; requires the State to agree to binding arbitration; limits Contractor's liability for damages resulting from death, bodily injury, or damage to tangible property; or that conflicts with this provision in any way shall be void ab initio. Nothing in this Contract shall be construed as a waiver of any provision of S24-106-109, C.R.S. H. SOFTWARE PIRACY PROHIBITION. State or other public funds payable under this Contract shall not be used for the Contract Number: 202635 Page 30 of 31 Version 052025 L/uuuJly1 I C I IVCIupe U . I L/CJIJ I IU-CL/CF-YOCU-OYr O-rLUCL/-WVYL/OV acquisition, operation, or maintenance of computer software in violation of federal copyright laws or applicable licensing restrictions. Contractor hereby certifies and warrants that, during the term of this Contract and any extensions, Contractor has and shall maintain in place appropriate systems and controls to prevent such improper use of public funds. If the State determines that Contractor is in violation of this provision, the State may exercise any remedy available at law or in equity or under this Contract, including, without limitation, immediate termination of this Contract and any remedy consistent with federal copyright laws or applicable licensing restrictions. I. EMPLOYEE FINANCIAL INTEREST/CONFLICT OF INTEREST. 5524-18-201 and 24-50-507, C.R.S. The signatories aver that to their knowledge, no employee of the State has any personal or beneficial interest whatsoever in the service or property described in this Contract. Contractor has no interest and shall not acquire any interest, direct or indirect, that would conflict in any manner or degree with the performance of Contractor's services and Contractor shall not employ any person having such known interests. J. VENDOR OFFSET AND ERRONEOUS PAYMENTS. §524-30-202(1) and 24-30-202.4, C.R.S. [Not applicable to intergovernmental agreements] Subject to §24-30- 202.4(3.5), C.R.S., the State Controller may withhold payment under the State's vendor offset intercept system for debts owed to State agencies for: (i) unpaid child support debts or child support arrearages; (ii) unpaid balances of tax, accrued interest, or other charges specified in §539-21-101, et seq., C.R.S.; (iii) unpaid loans due to the Student Loan Division of the Department of Higher Education; (iv) amounts required to be paid to the Unemployment Compensation Fund; and (v) other unpaid debts owing to the State as a result of final agency determination or judicial action. The State may also recover, at the State's discretion, payments made to Contractor in error for any reason, including, but not limited to, overpayments or improper payments, and unexpended or excess funds received by Contractor by deduction from subsequent payments under this Contract, deduction from any payment due under any other contracts, grants or agreements between the State and Contractor, or by any other appropriate method for collecting debts owed to the State. Contract Number: 202635 Page 31 of 31 Version 052025 LIuLu IIyi I CI IVGIVpC IL/. IL/C.71..Ir.7-CVGI--YOCV-ONr G-r LL/CL//1JUYL/JU EXHIBIT A- GENERAL WORK PROVISIONS 1. CONTRACTOR PERSONNEL A. Contractor personnel shall work cooperatively with State and Purchasing Entity staff to ensure the completion of the Work. B. COLORADO REVISED STATUTES, 24-109-105 (2) A PERSON MAY BE DEBARRED FOR ANY OF THE FOLLOWING REASONS: (d) Willful material failure to perform in accordance with the terms of one or more contracts, following notice of such failure, or a history of material failure to perform, or of materially unsatisfactory performance of, one or more contracts. C. KEY PERSONNEL Contractor shall designate people to hold the following specific personnel positions: i. Primary Point of Contract - The Primary Point of Contract shall be responsible for all of the following: a. Serving as the individual responsible for addressing all questions and concerns for the State and Purchasing Entities, unless an Order specifies another point of contact for that Order. b. Ensuring the completion of all Work in accordance with the Contract's requirements. This includes, but is not limited to, ensuring the accuracy, timeliness and completeness of all Work. c. Overseeing all other personnel and ensuring proper staffing levels throughout the term of the Contract. ii. Quarterly Volume Reporting Lead - The Quarterly Volume Reporting Lead shall be responsible for all of the following: a. Ensuring the completeness and accuracy of the Quarterly Volume Reports described in this Exhibit A. b. Ensuring the final submission of the Quarterly Volume Reports described in this Exhibit A by the appropriate due date for that report. c. Reports must be submitted via e-mail to Amy Risley at: Amy.Risley@state.co.us 2. ORDERING AND ORDER FULFILLMENT A. Ordering Contractor shall provide a complete and accurate Internal Revenue Service form W9 to the State prior to accepting an Order from any Purchasing Entity. Upon a request by a Purchasing Entity, Contractor shall provide a complete and accurate Internal Revenue Service form W9 to that Purchasing Entity. Exhibit A Page 1 of 9 L/VI.UJIIJ.lI CI tvelu./C ILI. IL/Cyl!IrJ-CIJCF-'1OCU-O4rD-r LL/CU/14L/J.7 i. The State and Each Purchasing Entity may complete an Order in accordance with its own rules and policies, as available to Contractor, using the appropriate documentation for that organization to issue an Order. a. Contractor shall communicate directly with each Purchasing Entity related to that Purchasing Entity's Orders. ii. Contractor shall ensure that all Orders it accepts have the proper information contained in them for Contractor to be able to comply with all reporting requirements of this Contract. iii. If Contractor provides for Ordering through an internet-based portal or electronic catalog, Contractor shall maintain all of Contractor's necessary hardware, software, backup-capacity and network connections required to operate that internet-based portal or electronic catalog. a. Contractor's internet-based portal and electronic catalogs shall clearly designate that they are part of this Contract and shall have a link to the State's price agreement web location, as determined by the State. Contractor shall ensure that all Environmentally Preferable Products are clearly listed on internet-based portal and electronic catalogs. b. If Contractor provides an internet-based portal or electronic catalog, Contractor shall also provide paper catalogs or catalogs on other digital media to each Purchasing Entity upon request by that Purchasing Entity. c. If Contractor's catalog will be either hosted on or accessed through the State's eCommerce system, then Contractor shall comply with all policies, procedures and directions from the State in relation to hosting its catalog on or making its catalog accessible through that system. Contractor shall ensure that all information made available through the State's eCommerce system is accurate and complies with this Contract.. B. Marketing i. If Contractor desires to distribute any materials, notices or literature with the intent to market the Goods or Services ("Marketing Materials"), Contractor shall deliver all such Marketing Materials to the State for review and approval prior to distributing any such materials to a Purchasing Entity. a. The State will review submitted Marketing Materials and may approve, deny or request changes to any Marketing Materials in its sole discretion. If the State requests changes, Contractor may make those changes or may choose to rescind its submission for review and approval. b. Contractor shall not distribute any marketing materials to any Purchasing Entity prior to receiving the State's approval of those Marketing Materials. ii. The State shall not be responsible for maintaining any mailing lists or creating, printing, mailing or distributing any of Contractor's Exhibit A Page 2 of 9 LJLJLUJIIJ.I I CI IVCIUfJC IL3. ILJCM-•IrU-CLJGr-40CU-04r 0-1-4 Li CLJMOUVLJJJ Marketing Materials, though the State may distribute Marketing Materials in its sole discretion. C. Additional Terms i. Any additional terms and conditions on any invoice, statement, Contractor time sheet, website, electronic license or use agreement or any other form, including, without limitation, terms regarding indemnification, limitation of liability, cancellation fees, choice of law and binding arbitration shall be void and unenforceable except to the extent that they are specifically included in this Contract or an Order. The signature of any employee of a Purchasing Entity on any such form shall be effective to establish receipt of Goods or completion of Services and shall not make any term of that form enforceable. 3. DATES AND CONFIRMATIONS REQUIRED A. For each vehicle ordered, vendors shall complete and return the "Contractor's Confirmation of 2026 Vehicle Production for SFM" form Exhibit 3 (from Bid Specifications) to SFM or "Contractor's Confirmation of 2026 Vehicle Production for Aurora" Exhibit 5 (from Bid Specifications, or other entity Exhibit 5a (from Bid Specifications) to the Purchasing Entity as soon as it is available, but no later than five (5)working days after notification from the manufacturer. This form shall include the following information: i. Date Contractor received SFM or Purchasing Entity Purchase Order (PO) ii. Manufacturer's Factory Order # and date received iii. Manufacturer's Factory Production Date iv. Estimated date of delivery to SFM or Purchasing Entity FOR STATE OF COLORADO AWARDS: AWARDED DEALER MUST SUBMIT STATUS CODE REPORT (NOTIFICATIONS) VIA EMAIL TO SFM AND PUBLIC SAFETY WITH UPDATES ON AND INCLUDING; BUILD PROGRESS, UPFIT PROGRESS; DELIVERY AND ETA'S; DELAYS , ETC. REPORTS MUST BE EMAILED EVERY MONTH STARTING AFTER CONFIRMATION OF PURCHASE ORDER. EMAILS MUST BE SENT TO: Terry.Sisneros@state.co.us B. OEM Confirmation The Contractor shall notify SFM or the Purchasing Entity no later than 10 business days after the receipt of the Purchase Order if they have not received the OEM confirmation. The Contractor shall inform SFM immediately by phone and in writing via email, USPS, or fax, when the contractor is aware or suspects that there is a problem with an order or a production date from the factory. The dealer shall demonstrate to the State of Colorado all efforts made to secure vehicles. Exhibit A Page 3 of 9 VUI.0 JI91 I CI IV I pC IV. I L/C`JL,IrU-CLJGr'YOCU-0.1ro-rLUCL/PAQUYwy i. If Contractor is unable to provide a vehicle, the State reserves the right to cancel any pending order(s) and/or the State Price Agreement and award a State Price Agreement to the next lowest Bidder or to conduct another bid, or exercise other remedies such as the Uniform Commercial Code (UCC) to acquire vehicles in a timely manner. Unless otherwise approved by SFM or other Purchasing Entities, all model year 2026 or newer vehicles ordered request to be delivered and invoiced no later than September 30, 2026. See 52 D Order Terms. C. Delivery of Goods and Performance of Services i. Contractor shall provide all Goods and perform all Services described in each Order. ii. Unless specifically agreed to otherwise in an Order, Contractor shall deliver all Goods under an Order in good, working and undamaged condition. All Goods shall be free on board ("F.O.B.") destination to the location specified in the Order. iii. If a Good in an Order is out of stock, Contractor may only provide a substitute Good if it has notified the Purchasing Entity for that Order, in writing, that the Good is out of stock and has received the Purchasing Entity's approval to provide the substitute Good. Purchasing Entities may request additional information comparing the substitute Good with the original Good in the Purchasing Entity's sole discretion D. Inspection and Acceptance v. Goods delivered to a Purchasing Entity under an Order shall not be deemed accepted prior to that Purchasing Entity inspecting the Goods in accordance with the Order and accepting those Goods. vi. Services provided to a Purchasing Entity under an Order shall not be deemed completed until that Purchasing Entity has reviewed the Services, ensured that all Services were completed in accordance with the Order and have been accepted by the Purchasing Entity. E. Ordering Support i. Contractor shall provide the State and each Purchasing Entity with the contact information for the individual or individuals within Contractor's organization who are assigned to handle questions and resolve problems that Purchasing Entity may have in relation to the Work or an Order. a. Contractor shall make personnel available from 8:00 a.m. to 5:00 p.m. Mountain Time, as adjusted for daylight savings time, at a minimum, each Business Day as necessary to handle questions and resolve problems received by Contractor. Exhibit A Page 4 of 9 L/UVUDIIJ.II CI IVCIUFe IL). IL/C.7L.Ir.7- L/Cr-4o CJ-o-fr O-r LL/CL/MJuYL'JJ b. Contractor shall make all of these individuals available by phone (both through a local number and a toll-free number), fax and email at all times that the individual is available to handle questions and resolve problems received by Contractor. c. Contractor shall provide all of these individuals with the ability to access the account information and other information relating to the State or Purchasing Entities to be able to respond to questions and resolve problems relating to any Order, including, without limitation, the status of Orders, delivery, back-orders, pricing, discounts, product availability, product information, and accounts and billing. ii. Contractor shall provide all training to Purchasing Entities necessary for those Purchasing Entities to place Orders and properly use the Goods and Services, as requested by Ordering Entities. iii. Training on placing Orders shall include, without limitation, training on aspects of ordering, online ordering, product delivery, product returns, and Contractor's customer service processes, as requested by the Purchasing Entity. a. Training on properly using the Goods and Services shall include, without limitation, training and providing information on energy efficiency of Goods, new features, opportunities for manufacturer/certified set up and training, Environmentally Preferable Products, and other services or options that are offered or available related to the Goods and Services, as requested by the Purchasing Entity. F. Order Disputes, Termination and Resolution i. If a dispute related to an Order arises between Contractor and a Purchasing Entity, Contractor shall meet with the Purchasing Entity to attempt to resolve the issue. If Contractor is unable to resolve the issue with the Purchasing Entity, then Contractor may request assistance from the State by submitting a request in writing, which includes the pertinent information about the dispute and the assistance sought by Contractor, in accordance with Error! Reference source not found. of the main body of this Contract. Nothing in this section shall be interpreted as limiting the rights or obligations of Contractor, the State or any Purchasing Entity under this Contractor of any Order. ii. Purchasing Entities may terminate an Order if it determines that Contractor was in breach of that Order. Termination of an Order shall not automatically terminate any other Order or this Contract. iii. If a Purchasing Entity gives Contractor notice of breach or terminates an Order because of Contractor's breach of that Order, Contractor shall provide notice to the State of that breach or termination with Exhibit A Page 5 of 9 uut..0 lyii CI We11.4./C IU. I LJG.7l.lr.7-GIJCrWOC,-OYr 0'FGVC1-//1JUNVJU the Purchasing Entity within 5 Business Days following Contractor's receipt of that notice of breach or termination. 4. VOLUME AND OPERATIONAL REPORTING A. Volume Reporting i. The State will use a centralized method of tracking volume. Contractor shall populate a Quarterly Volume Report, using the format as specified by the State, for each State Fiscal Year Quarter that contains, at a minimum, all of the following: a. A summary volume report that includes, but is not limited to, all of the following for the quarter that the report covers: b. The total spent by each type of Purchasing Entity under this Contract. c. The total of the list cost of all items purchased by each type of Purchasing Entity under this Contract. d. The total estimated cost savings for each type of Purchasing Entity under this Contract, calculated as the total list cost minus the total spent for that Purchasing Entity. e. The total paid through the use of a procurement card or credit card for each Purchasing Entity under this Contract. f. The total sales of Environmentally Preferable Products, as defined in the State's Environmentally Preferable Purchasing Policy, for each Purchasing Entity under this Contract. g. Any additional summary information as requested by the State. h. A detail report that includes, but is not limited to, all of the following for each sale that occurred during the quarter that the report covers: • The name of the Purchasing Entity who the sale was made to. • The date of the sale. • A listing of each item purchased in the sale, including the name of the item, the quantity of the item, the unit price for the item, the extended cost for the item calculated by multiplying the unit price by the quantity, the list price per unit for the item, the extended list cost for the item calculated by multiplying the quantity by the list price, and the savings on the item calculated by subtracting the extended cost from the extended list cost. • Any other detail information as requested by the State. Exhibit A Page 6 of 9 LJUUUJIIJ.II CI IVCIUpC IU I L/CJl'IFU-CL1Cr-40CV-O4r 0-1-41-lCL MOV4LJJV ii. Contractor shall deliver a Quarterly Volume Report to the State's representative as identified in Section 17 of the Contract on a quarterly basis. a. DELIVERABLE: Quarterly Volume Report b. DUE: Quarterly, within 30 calendar days following the end of the State Fiscal Year quarter that the report covers. iii. If any due date for a Quarterly Volume Report falls on a day that is not a Business Day, then the due date shall be automatically extended to the next Business Day, unless otherwise directed by the State. iv. All data and information contained in a Quarterly Volume Report shall be the property of the State and shall not be considered proprietary. B. Additional Operational Reporting i. Upon request by the State, the Contractor shall develop and deliver to the State Ad-Hoc Operational Reports that include all detailed and summary transaction, historical or payment information related to the State or any of the Purchasing Entities as requested by the State. a. DELIVERABLE: Ad-Hoc Operational Reports b. DUE: Within 10 Business Days following the State's request for that information, unless the State agrees to a longer period of time in writing. 5. PERIODIC BUSINESS REVIEWS A. The State may schedule periodic business reviews to review Contractor's performance under this Contract. B. Contractor shall ensure personnel assigned to the Contract are available for these meetings with the State as scheduled by the State. C. Contractor's key personnel designated in the main body of this Price Agreement shall be available for all regularly scheduled meetings between Contractor and the State, unless the State has granted prior, written approval otherwise. 6. CLOSEOUT PERIOD A. This Contract shall have a Closeout Period that begins 30 days prior to the expiration of this Contract and continues until the State has determined that all Work has been completed. i. During the Closeout Period, Contractor shall complete all of the following, as directed by the State: a. Provide to the State, or any other contractor at the State's direction, all reports, data, systems, Deliverables and other information reasonably necessary for the State to ensure Contractor's completion of the Work, as determined by the State. b. Notify any Subcontractors of the termination of the Contract, as directed by the State. Exhibit A Page 7 of 9 UUUUJI911 CI IVGIUpC ILJ. I LJCUIJ IrC-CLJCr-YOGU-OYr17-r LUC LJf1JV'iVJU c. Remove all references to the State's price agreement from its websites, materials and other documentation, and inform entities that contact Contractor that it no longer has a price agreement with the State. ii. The Closeout Period may extend past the termination of the Contract. The State will perform a closeout review to ensure that Contractor has completed all requirements of the Closeout Period. If Contractor has not completed all of the requirements of the Closeout Period by the date of the termination of the Contract, then any incomplete requirements shall survive termination of the Contract. 7. PRICING A. Price Lists i. The State may publish any pricing information under this Contract, including, without limitation the pricing shown on Exhibit C, Price List, on the State's website and any other website as the State determines is necessary or efficient to facilitate the use of this Contract by Purchasing Entities. ii. If Contractor modifies any of its prices in accordance with §B, or discontinues any item shown on the existing pricing information, Contractor shall provide updated pricing information to the State for the State to publish. B. Price Modifications i. Price Increases a. Contractor may request an increase in the prices listed in Exhibit C by submitting its request to the State in writing for the as described in the main body of this Contract. Requests for increases in prices are limited as follows: b. Contractor may not submit a request for a price increase to the State later than June 30, 2026. c. The State may approve or deny any request for a price increase based on the information provided by Contractor and other circumstances in its sole discretion. d. If the State approves a price increase, that price increase shall not take effect unless it is included in this Contract. e. Contractor may only begin using the increased prices in Orders that are issued following the effective date of the modification that increases the prices. For Orders placed prior to a price increase that are in effect at the time of the price increase, Contractor shall only charge the Purchasing Entity the prices that were in effect at the time the Order was placed. f. If the State does not approve a price increase, or Contractor increases its prices without submitting a request to the State, then those increased prices shall be void in any Order in which they are used and Contractor shall fulfill the Order Exhibit A Page 8 of 9 LJUI.Ubl9.11 CI IVCIUF.IC IL). I LJCUL.I FU-Cl/Cr-40CV-041-0-f GL./GL,FWV41./J.0 at the existing rates approved by the State under this Contract. Contractor's use of rates in any Order that exceed those approved by the State under this Contract shall be a material breach of this Contract. ii. Price Decreases and Ceiling Prices a. Contractor may decrease its prices shown in Exhibit C at any time by providing written notice to the State. b. The prices listed in Exhibit C are Ceiling Prices, and Contractor may offer lower prices to Purchasing Entities, and Purchasing Entities may negotiate lower prices with Contractor, without the review or approval of the State. Contractor shall not allow a Subcontractor to charge an amount greater than the Ceiling Price for any Order. Exhibit A Page 9 of 9 L/UI.UJIIy.I I CI IVGIUpe IL/. IL/CUL/IrU-CL/CF-4OCJ-O'fr C-r LL/CL/MJVYL/Jy EXHIBIT B, STATEMENT OF WORK 1. GOODS AND/OR SERVICES Contractor shall provide 2026 or newer model year vehicles. 2. SPECIFICATIONS A. At a minimum all vehicles ordered shall include manufacturer standard new vehicle equipment for 2026 model year or newer fleet vehicles. Vehicles that do not meet current Federal emission standards but are "covered" with Department of Energy credits will not be accepted. B. Vehicle options shall be provided as factory installed under the terms of the full, factory-backed, bumper-to-bumper warranty. Contractor installed options are not permitted unless pre-approved by the State or Purchasing Entity in writing. If a Contractor substitutes an Original Equipment Manufacturer (OEM) option with a non- OEM option, the State or Purchasing Entity may return the vehicle for a correctly equipped vehicle any time after the non-OEM option is discovered. The State or Purchasing Entity may also require the Contractor to reimburse the State or Purchasing Entity for all expenses and fees related to the repair of a non-OEM option that fails within the standard warranty period. C. In the event that OEM is unable to deliver ordered vehicle(s) within the model year ordered, State Fleet Management ("SFM") or the Purchasing Entity reserves the right to select and accept as non-conforming goods such dealer stock unit(s) (as close to original specifications as possible) as they are available. With respect to such non- conforming goods, SFM or the Purchasing Entity will be invoiced at the Price as listed in Exhibit C; this will only apply to vehicles ordered prior to build-out/factory fleet close dates and considered within normal and acceptable ordering and build out time frames. Vehicles ordered after the last order date has been announced by the OEM will not be subject to this clause. D. For each vehicle ordered, Contractor will provide an approved form by the Purchasing Entity that will include the following information: i. Date Contractor received SFM or Purchasing Entity Order ii. Manufacturer's Factory Order # and date received iii. Manufacturer's Factory Production Date iv. Estimated date of delivery to SFM or Purchasing Entity E. The projected delivery time shall be 90-200 days from order placement. 3. OTHER PROJECT REQUIREMENTS A. Clean Fuel Fleet Program - Clean fuel vehicles provided shall include a full factory warranty and be serviceable by any Factory Authorized Dealer. Exhibit B Page 1 of 6 L uV.OJIIJ.I I CI IVCIVpC ILI. I LJCt_,I rU-CLJCr-VOCt-OYr C-FLIJCIJ/,OtYtJOU B. Alternative Fuels - Alternative fuel vehicles provided shall include a full factory warranty and be serviceable by any Factory Authorized Dealer. Dealer installed conversions are NOT acceptable unless they are part of an OEM-/Dealer- certified program and On-Board- Diagnostics (OBD) II/III compatible. Such vehicles shall be specifically designed to operate on alternative fuel as their primary fuel. Information for Dealers authorized to repair and service alternative fuel vehicles ("AFVs"), if different from all OEM dealers, shall be provided by Contractor. C. Hybrid and Electric Vehicles - Vehicles offered shall include a full factory warranty and be serviceable by any Factory Authorized Dealer. D. Tires - Tires provided on vehicles shall be all season/mud and snow radials or open-side-lug all terrain tires when specified. Closed-lug design tires are NOT acceptable for an all-terrain tire option. E. All vehicles delivered to any Purchasing Entity must be a road ready vehicle unless prior written notification has been made. F. Warranty - The States minimum standard warranty period for all 2026 or newer vehicles shall be 3 years or 36,000 miles and shall cover each ordered vehicle inclusive of all options and accessories. G. Conditions of Contract - If Contractor is unable to provide a vehicle, the State reserves the right to cancel any pending order(s) and/or the State Price Agreement and award a State Price Agreement to the next lowest bidding Contractor or to conduct another bid, or exercise other remedies. H. Due to State budget conditions, SFM cannot accept any vehicles prior to March 1, 2026 unless authorized by SFM. Contractors shall make all deliveries after this date. The exceptions to this condition are: Public Safety, Undercover and Patrol vehicles and vehicles that may have Federal Grant funding or Agency Funding. Additionally, Purchasing Entities may elect to accept their vehicles earlier and/or later than SFM. Contractors will work directly with Purchasing Entities to ensure all dates are met. I. If a model year change occurs during the contract period, or if the awarded vendor will allow, 2027 model year vehicles may be sold under the terms, conditions, and prices of this State Price Agreement. Model year substitutions MUST be approved in writing by SFM or Purchasing Entity. Exhibit B Page 2 of 6 LJuI:ubIy1 I GI IVCIuF1C IL). ILJC.7L..Ir.7-GLJGr-40C.7-O4r 17-1-4L/CLJMJ.74LJJ.7 J. Contractor shall notify SFM within five (5) business days in writing of any mid-year model changes including discontinuations, mid-year introductions, etc., as related to Exhibit C Vehicle and Price List. K. Compliance Standards - Vehicles delivered shall be in full compliance with all applicable federal and state laws, rules and standards regarding construction and performance. This includes, but is not limited t o the Federal Motor Vehicle Safety Standards (FMVSS), EPA emission level requirements, and state noise standards. L. Delivery Requirements - Vehicles shall be delivered under the terms and conditions and the resulting State Price Agreements completed as a result of the bid solicitation and shall be of the same make, model, and equipment level as bid. Substitutions will not be allowed. The SFM Vehicle Body Codes listed in Exhibit 1 of the bid specifications indicate the vehicle types, size and sample representative models designated/used by SFM. The Gross Vehicle Weight Rating (GVWR) for the vehicles bid shall meet or exceed the minimum GVWR when specified in the standard specifications. Vehicles are to be delivered complete with all manufacturer standard new vehicle equipment and must be in compliance with the 2026 or newer Vehicle Specifications for each body code and requested optional items as listed on the SFM or Purchasing Entity purchase order. SFM and any Purchasing Entity reserve the right to return a vehicle after acceptance that is not complete according to the 2026 or newer Vehicle Specifications for each body code and the right to rescind any purchase order, if a vehicle delivered and accepted is subsequently discovered to be non- conforming. The Contractor shall promptly bring any non-conforming vehicle into conformity with the above mentioned Vehicle Specifications or accept return of vehicle and reimburse any monies paid by the State or Purchasing Entity. M. Delivery Compliance for State Fleet Management and Purchasing Entity - The following requirements apply to vehicles at time of delivery to SFM or the Purchasing Entity. i. Contractors shall bring the following items in the SFM or Purchasing Entity office at the time of scheduled delivery (all documents shall be typed): (a) The Contractor's invoice with a typed Vehicle Identification Number (VIN), the State or Ordering Purchase Order Number, and the Dealer Stock Number. (b) The manufacturer's window sticker with price and option info (Contractor shall not leave the sticker on the vehicle door glass). Exhibit B Page 3 of 6 LJVI.0 JIyI I GI IVCIi.41C IL). I LJCM.•Ir.7-cvCr-YOGU-o'iro-rcL/GL,MJJ4vJJ (c) The manufacturer's "Certificate of Origin" with a typed assignment as follows (there shall be no corrections): 1001 East 62nd Ave Denver, CO 80216 (d) The Application for Title and the Bill of Sale (if used for odometer disclosure). (e) Two sets of keys plus the key code (usually on a sticker or tag) needed for key duplication. (f) A weight slip and VIN slip and VIN Verification shall be provided whenever a body has been modified (i.e., hi-cube vans, box trucks and buses and stake beds, etc.). ii. Contractors shall leave the following items in the vehicle at the time of scheduled delivery: (a) The owner's manual visible on the front seat. (b) The Dealer Stock Number on the windshield. (c) A sixty (60) day permit shall be attached in the rear window of the vehicle. (d) Vehicles shall be washed, HAVE LICENSE PLATE BRACKETS AND SCREWS INSTALLED ON THE VEHICLE, be serviced and in standard "make ready" condition (i.e. prepared for immediate use including no less than a one-quarter (1/4) tank reading of fuel and full tanks of Diesel Emission Fluid when equipped with DEF tanks). Note: Vehicles utilizing the following fuel types must be delivered with no less than Y4 tank of fuel: CNG, diesel, propane, etc. Vehicles equipped with DEF tanks must be delivered with full fuel tanks, or vehicles will be refused. (e) SFM or the Purchasing Entity shall make a cursory visual check of each delivered vehicle's condition and options to expedite the delivery process. Should any problems be found after delivery, SFM or the Purchasing Entity shall up to four (4) weeks to inspect and reject the vehicle while it is still on their lot. If rejected, the Contractor shall retrieve the vehicle within one (1) business day of notification via email for correction/repairs, and then shall redeliver the vehicle as soon as the repairs are complete. The dealer shall expedite repairs to its maximum capability, so as not to cause financial hardship to the State or Purchasing Entity. N. Delivery Terms and Compliance for Institutions of Higher Education, Political Subdivisions and Non-Profits - All institutions of Higher Education, Political Subdivisions and Registered Non-Profits must specify on the Purchase Order or commitment document all delivery terms and conditions that apply. Delivery Exhibit B Page 4 of 6 LIUI.OIyI I CI Ivelupe IV. I UC'L,I r.7-GVCr-YOCJ-04r O-f GVCVMOUYUJJ instructions to the institutions of higher education, cities, counties or other Purchasing Entities are to be similar to State delivery instructions. i. The State's terms are FOB destination with freight included to destinations in the Metropolitan Denver area (7 county areas to include: Denver, Adams, Arapahoe, Boulder, Douglas, Broomfield and Jefferson). Deliveries outside of the 7-county area are FOB destination with freight added, which shall be pre-negotiated in writing between Purchasing Entity and Contractor. ii. Any Purchasing Entity may arrange to pick up a vehicle from the awarded Contractor at no additional charge. iii. Contractor is expected to comply with delivery instructions issued by Institutions of Higher Education, Political Subdivisions and Non-Profits. Any changes or clarifications must be negotiated and agreed to by the applicable Institution of Higher Education, Political Subdivision, or Non- Profit. iv. The State Procurement Administrator managing the State Price Agreement should be notified immediately of any issues related to the delivery of vehicles. 0. Quotation of Vehicles for Institutions of Higher Education, Political Subdivisions and Non-Profits - At the request of a political subdivision, Contractor shall begin all vehicle quotes with the State Awarded Standard Vehicle Base Price. Vehicle quotes that begin with a Contractor MSRP or quotes that cannot provide a pricing breakdown that includes the awarded Standard Vehicle Base Price will not be considered valid. Contractors shall include on any, quotation requested by a political subdivision, the OEM Model number and any OEM codes for all specifications, accessories, and up-fits, when an OEM code is available. P. Legislative Changes - The State reserves the right to amend this contract in response to Colorado legislative changes that affect this program. Q. Invoicing and Payment - The Contractor shall send all invoices to SFM or the Purchasing Entity as instructed on the Purchase Order. Invoices shall include the corresponding Purchase Order number. Invoices are not to be sent to the State Purchasing Et Contracts Office. R. Sex Offender Registration Information Requirements - Contractor must comply with the following laws in order to have employees on-site at a State of Colorado facility: Exhibit B Page 5 of 6 LJUlAIJR,I I CI ivetupe IL). I UCM,If U-CLJCf--40CU-04f D-f GLJCLJMJ4LJJV Colorado Revised Statutes, Title 16-22-103, et.seq. Code of Federal Regulations, 34 CFR 668.46 Jeanne Clery Act 20 USC 1092 (f) T. Name or Address Changes - Contractor must notify the State of any changes to the Contractor's name or address within fifteen business days of change. U. Invoicing - State Purchasing Entities are Colorado PERA affiliated employers. In the event billable personal services are performed by the Contractor, pursuant to Colorado SB06-235 and CRS §24-51-1101(2), the Contractor must notify in writing (email is acceptable) the State Purchasing Entity's representative listed on the Order within fifteen (15) calendar days from the date of receipt of any Order if the services provided or to be provided were or will be performed by a PERA retiree (as defined at CRS §24-51-101). (THE REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.) Exhibit B Page 6 of 6 L)vLu u lI CI IVCIUpe IL). ILlCUl.r If V-C1-/Cr-N0CU-0Y1-0-1-LIJCUHJ.7YUJU EXHIBIT C, PRODCUTS AND PRICE LIST Detail Sheets on Price Agreement website Body Code Body Code Description Make Model Base Price K1 Pass Util Small, 4X4 Ford Escape, LOW Ford Escape $27,710 Pass Util Medium, 4X4 (5 Pass) Ford Explorer K2 LOW Ford Explorer $36,050 Pass Util Large, 4X4 (9 Pass) Ford Expedition Expedition K3 Max LOW Ford Max $56,050 K5 Pass Util Large 4X4 Ford Expedition LOW Ford Expedition $50,850 Exhibit C Page 1 of 1 LJUL:UJIIJ.I I GI IVCIUpe IL/. I L/GtlL,I1-U-GLJG1--'iOCU-041-1D-1-LL/GVHOV4L./JJ EXHIBIT D, SAMPLE OPTION LETTER State Agency Contract Performance Beginning Date Insert Department's or IHE's Full Legal Name Month Day, Year Contractor Current Contract Expiration Date Insert Contractor's Full Legal Name Month Day,Year Option Letter Number Current Contract Maximum Amount Insert the Option Number(e.g. "1" for the first Initial Term option) State Fiscal Year 20xx: $0.00 Original Contract Number Extension Terms Insert CMS number or Other Contract Number of State Fiscal Year 20xx: $0.00 the Original Contract State Fiscal Year 20xx: $0.00 Option Contract Number State Fiscal Year 20xx: $0.00 Insert CMS number or Other Contract Number of State Fiscal Year 20xx: $0.00 this Option Total for All State Fiscal Years: $0.00 1. OPTIONS: A. Option to extend for an Extension Term B. Option to change the quantity of Goods under the Contract C. Option to change the quantity of Services under the Contract D. Option to modify Contract rates E. Option to initiate next phase of the Contract 2. REQUIRED PROVISIONS: A. For use with Option 1(A) In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option for an additional term, beginning Insert start date and ending on the current contract expiration date shown above, at the rates stated in the Original Contract, as amended. B. For use with Options 1(B and C) In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option to Increase/Decrease the quantity of the Goods/Services or both at the rates stated in the Original Contract, as amended. C. For use with Option 1(D) In accordance with Section(s)Number of the Original Contract referenced above, the State hereby exercises its option to modify the Contract rates specified in Exhibit/Section Number/Letter. The Contract rates attached to this Option Letter replace the rates in the Original Contract as of the Option Effective Date of this Option Letter. D. For use with Option 1(E) In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option to initiate Phase indicate which Phase: 2, 3, 4, etc., which shall begin on Insert start date and end on Insert ending date at the cost/price specified in Section Number. Exhibit D Page 1 of 2 Uu..UDlyuI CIIVCILye IL/. u J ..,Iry-CUCr-YOC.7-OYr 0-r LUCU/1JVYL/J.7 E. For use with all Options that modify the Contract Maximum Amount The Contract Maximum Amount table on the Contract's Signature and Cover Page is hereby deleted and replaced with the Current Contract Maximum Amount table shown above. 3. OPTION EFFECTIVE DATE: The effective date of this Option Letter is upon approval of the State Controller or Month Day, Year, whichever is later. STATE OF COLORADO STATE CONTROLLER Jared S. Polis, Governor Robert Jaros,CPA,MBA,JD INSERT: Name of Agency or IHE INSERT: Name&Title of Head of Agency or IHE By: Name&Title of Person Signing for Agency or IHE By: Name of Agency or IHE Delegate-Please delete if contract will be routed to OSC for approval Date: Option Effective Date: In accordance with §24-30-202, C.R.S., this Option is not valid until signed and dated above by the State Controller or an authorized delegate. Exhibit D Page 2 of 2 LJUL.ublyl I GI IVCItipe ILJ. IL/CJId Ir.7-CLOCI--YOC.7-OYr O-r LLJGLJMJUYL/J.7 EXHIBIT E-PII CERTIFICATION - INDIVIDUAL STATE OF COLORADO THIRD PARTY INDIVIDUAL CERTIFICATION FOR ACCESS TO PII THROUGH A DATABASE OR AUTOMATED NETWORK Pursuant to § 24-74-105, C.R.S., I hereby certify under the penalty of perjury that I have not and will not use or disclose any Personal Identifying Information, as defined by § 24-74-102(1), C.R.S., for the purpose of investigating for, participating in, cooperating with, or assisting Federal Immigration Enforcement, including the enforcement of civil immigration laws, and the Illegal Immigration and Immigrant Responsibility Act, which is codified at 8 U.S.C. §§ 1325 and 1326, unless required to do so to comply with Federal or State law, or to comply with a court-issued subpoena, warrant or order. Signature: Printed Name: Date: Exhibit E Page 1 of 2 IJul.uDuyuI Ciiveiupe IL). IUCUL.11-U-CLlCr-4o CU-oYro-rLUCUHJV.+L/J.7 EXHIBIT E-PII CERTIFICATION - ORGANIZATION STATE OF COLORADO THIRD PARTY ENTITY/ORGANIZATION CERTIFICATION FOR ACCESS TO PII THROUGH A DATABASE OR AUTOMATED NETWORK Pursuant to § 24-74-105, C.R.S., I, , on behalf of (legal name of entity/organization) (the "Organization"), hereby certify under the penalty of perjury that the Organization has not and will not use or disclose any Personal Identifying Information, as defined by § 24-74-102(1), C.R.S., for the purpose of investigating for, participating in, cooperating with, or assisting Federal Immigration Enforcement, including the enforcement of civil immigration laws, and the Illegal Immigration and Immigrant Responsibility Act, which is codified at 8 U.S.C. §§ 1325 and 1326, unless required to do so to comply with Federal or State law, or to comply with a court-issued subpoena, warrant or order. I hereby represent and certify that I have full legal authority to execute this certification on behalf of the Organization. Signature: Printed Name: Title: Date: Exhibit E Page 2 of 2 IJUUUDII,II CIIVCIUpC IL). IIJCM,IrU-CL/CF-YOCU-OYr D'r LLJCL/MJ.`IYIJJU EXHIBIT F - HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement("Agreement")between the State and Contractor is agreed to in connection with, and as an exhibit to, the Contract. For purposes of this Agreement, the State is referred to as "Covered Entity"and the Contractor is referred to as "Business Associate". Unless the context clearly requires a distinction between the Contract and this Agreement, all references to "Contract" shall include this Agreement. 1. Purpose Covered Entity wishes to disclose information to Business Associate,which may include Protected Health Information("PHI"). The Parties intend to protect the privacy and security of the disclosed PHI in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub. L.No. 104-191 (1996) as amended by the Health Information Technology for Economic and Clinical Health Act("HITECH Act") enacted under the American Recovery and Reinvestment Act of 2009 ("ARRA")Pub. L. No. 111-5 (2009), implementing regulations promulgated by the U.S. Department of Health and Human Services at 45 C.F.R. Parts 160, 162 and 164 (the"HIPAA Rules") and other applicable laws, as amended. Prior to the disclosure of PHI, Covered Entity is required to enter into an agreement with Business Associate containing specific requirements as set forth in,but not limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal Regulations("C.F.R.") and all other applicable laws and regulations, all as may be amended. 2. Definitions The following terms used in this Agreement shall have the same meanings as in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary,Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor,Unsecured Protected Health Information, and Use. The following terms used in this Agreement shall have the meanings set forth below: A. Business Associate. "Business Associate"shall have the same meaning as the term "business associate"at 45 C.F.R. 160.103, and shall refer to Contractor. B. Covered Entity. "Covered Entity" shall have the same meaning as the term"covered entity" at 45 C.F.R. 160.103, and shall refer to the State. C. Information Technology and Information Security. "Information Technology"and "Information Security" shall have the same meanings as the terms "information technology" and"information security",respectively, in §24-37.5-102, C.R.S. Capitalized terms used herein and not otherwise defined herein or in the HIPAA Rules shall have the meanings ascribed to them in the Contract. 3. Obligations and Activities of Business Associate A. Permitted Uses and Disclosures. i. Business Associate shall use and disclose PHI only to accomplish Business Associate's obligations under the Contract. ii. To the extent Business Associate carries out one or more of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply Exhibit F Page 1 of 1 ✓uuuDIyII CI iveuupe I✓. I✓Gill,Ir.7-G✓CF-YOCC-OYt-O-1-G✓C✓MJUY✓J.7 with any and all requirements of Subpart E that apply to Covered Entity in the performance of such obligation. iii. Business Associate may disclose PHI to carry out the legal responsibilities of Business Associate, provided, that the disclosure is Required by Law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that: a. the information will remain confidential and will be used or disclosed only as Required by Law or for the purpose for which Business Associate originally disclosed the information to that person, and; b. the person notifies Business Associate of any Breach involving PHI of which it is aware. iv. Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity. Business Associate may de-identify any or all PHI created or received by Business Associate under this Agreement, provided the de- identification conforms to the requirements of the HIPAA Rules. B. Minimum Necessary. Business Associate, its Subcontractors and agents, shall access, use, and disclose only the minimum amount of PHI necessary to accomplish the objectives of the Contract, in accordance with the Minimum Necessary Requirements of the HIPAA Rules including, but not limited to, 45 C.F.R. 164.502(b) and 164.514(d). C. Impermissible Uses and Disclosures. i. Business Associate shall not disclose the PHI of Covered Entity to another covered entity without the written authorization of Covered Entity. ii. Business Associate shall not share, use, disclose or make available any Covered Entity PHI in any form via any medium with or to any person or entity beyond the boundaries or jurisdiction of the United States without express written authorization from Covered Entity. D. Business Associate's Subcontractors. i. Business Associate shall, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors who create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to safeguarding PHI. ii. Business Associate shall provide to Covered Entity, on Covered Entity's request, a list of Subcontractors who have entered into any such agreement with Business Associate. iii. Business Associate shall provide to Covered Entity, on Covered Entity's request, copies of any such agreements Business Associate has entered into with Subcontractors. E. Access to System. If Business Associate needs access to a Covered Entity Information Technology system to Exhibit F Page 2 of 1 L/UI:UJly1 I GI IVCIUfJC IL/. IL/CUL.I r.7-CL CI--40CV-041 0-1-LLlCL/MJ54L/JU comply with its obligations under the Contract or this Agreement, Business Associate shall request, review, and comply with any and all policies applicable to Covered Entity regarding such system including, but not limited to, any policies promulgated by the Office of Information Technology and available at http://oit.state.co.us/about/policies. F. Access to PHI. Business Associate shall, within ten days of receiving a written request from Covered Entity, make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. 164.524. G. Amendment of PHI. i. Business Associate shall within ten days of receiving a written request from Covered Entity make any amendment to PHI in a Designated Record Set as directed by or agreed to by Covered Entity pursuant to 45 C.F.R. 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. 164.526. ii. Business Associate shall promptly forward to Covered Entity any request for amendment of PHI that Business Associate receives directly from an Individual. H. Accounting Rights. Business Associate shall, within ten days of receiving a written request from Covered Entity, maintain and make available to Covered Entity the information necessary for Covered Entity to satisfy its obligations to provide an accounting of Disclosure under 45 C.F.R. 164.528. I. Restrictions and Confidential Communications. i. Business Associate shall restrict the Use or Disclosure of an Individual's PHI within ten days of notice from Covered Entity of: a. a restriction on Use or Disclosure of PHI pursuant to 45 C.F.R. 164.522; or b. a request for confidential communication of PHI pursuant to 45 C.F.R. 164.522. ii. Business Associate shall not respond directly to an Individual's requests to restrict the Use or Disclosure of PHI or to send all communication of PHI to an alternate address. iii. Business Associate shall refer such requests to Covered Entity so that Covered Entity can coordinate and prepare a timely response to the requesting Individual and provide direction to Business Associate. J. Governmental Access to Records. Business Associate shall make its facilities, internal practices, books, records, and other sources of information, including PHI, available to the Secretary for purposes of determining compliance with the HIPAA Rules in accordance with 45 C.F.R. 160.310. K. Audit, Inspection and Enforcement. i. Business Associate shall obtain and update at least annually a written assessment performed by an independent third party reasonably acceptable to Covered Entity, which evaluates the Information Security of the applications, infrastructure, and processes that interact with the Covered Entity data Business Associate receives, manipulates, stores and distributes. Upon request by Covered Entity, Business Exhibit F Page 3 of 1 1JUl:UD11J.1 I GI IVCIUpe ILJ. ILJG.7lJ Ir.7-GLJr'YOGu-oYrl7-r LLJGLJMJ.7YLJJy Associate shall provide to Covered Entity the executive summary of the assessment. ii. Business Associate, upon the request of Covered Entity, shall fully cooperate with Covered Entity's efforts to audit Business Associate's compliance with applicable HIPAA Rules. If, through audit or inspection, Covered Entity determines that Business Associate's conduct would result in violation of the HIPAA Rules or is in violation of the Contract or this Agreement, Business Associate shall promptly remedy any such violation and shall certify completion of its remedy in writing to Covered Entity. L. Appropriate Safeguards. i. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to prevent use or disclosure of PHI other than as provided in this Agreement. ii. Business Associate shall safeguard the PHI from tampering and unauthorized disclosures. iii. Business Associate shall maintain the confidentiality of passwords and other data required for accessing this information. iv. Business Associate shall extend protection beyond the initial information obtained from Covered Entity to any databases or collections of PHI containing information derived from the PHI. The provisions of this section shall be in force unless PHI is de- identified in conformance to the requirements of the HIPAA Rules. M. Safeguard During Transmission. i. Business Associate shall use reasonable and appropriate safeguards including, without limitation, Information Security measures to ensure that all transmissions of PHI are authorized and to prevent use or disclosure of PHI other than as provided for by this Agreement. ii. Business Associate shall not transmit PHI over the internet or any other insecure or open communication channel unless the PHI is encrypted or otherwise safeguarded with a FIPS-compliant encryption algorithm. N. Reporting of Improper Use or Disclosure and Notification of Breach. i. Business Associate shall, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under §24-73-103, C.R.S. ii. Such notice shall include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. iii. Business Associate shall, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify Covered Entity of such incident. iv. Business Associate shall have the burden of demonstrating that all notifications were Exhibit F Page 4 of 1 1-11JI:UDIIy1I GI IVeivye IL). IL/GUlr I r.7-GUGr WOy-04f o-fcucuMJ.7YVJ.7 made as required, including evidence demonstrating the necessity of any delay. O. Business Associate's Insurance and Notification Costs. i. Business Associate shall bear all costs of a Breach response including, without limitation, notifications, and shall maintain insurance to cover: a. loss of PHI data; b. Breach notification requirements specified in HIPAA Rules and in §24-73-103, C.R.S.; and c. claims based upon alleged violations of privacy rights through improper use or disclosure of PHI. ii. All such policies shall meet or exceed the minimum insurance requirements of the Contract or otherwise as may be approved by Covered Entity (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured status, and notice of cancellation). iii. Business Associate shall provide Covered Entity a point of contact who possesses relevant Information Security knowledge and is accessible 24 hours per day, 7 days per week to assist with incident handling. iv. Business Associate, to the extent practicable, shall mitigate any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this Agreement. P. Subcontractors and Breaches. i. Business Associate shall enter into a written agreement with each of its Subcontractors and agents, who create, receive, maintain, or transmit PHI on behalf of Business Associate. The agreements shall require such Subcontractors and agents to report to Business Associate any use or disclosure of PHI not provided for by this Agreement, including Security Incidents and Breaches of Unsecured Protected Health Information, on the first day such Subcontractor or agent knows or should have known of the Breach as required by 45 C.F.R. 164.410. ii. Business Associate shall notify Covered Entity of any such report and shall provide copies of any such agreements to Covered Entity on request. Q. Data Ownership. i. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI. ii. Upon request by Covered Entity, Business Associate immediately shall provide Covered Entity with any keys to decrypt information that the Business Association has encrypted and maintains in encrypted form, or shall provide such information in unencrypted usable form. R. Retention of PHI. Except upon termination of this Agreement as provided in Section 5, below, Business Associate and its Subcontractors or agents shall retain all PHI throughout the term of this Agreement, and shall continue to maintain the accounting of disclosures required under Exhibit F Page 5 of 1 UUI.UJII9.I I GI IVCIUFIO IL). I UGJI,I rJ-GVGr-YOCJ-OYt-G'r41-/CL./MJJYVJJ Section 3.H, above, for a period of six years. 4. Obligations of Covered Entity A. Safeguards During Transmission. Covered Entity shall be responsible for using appropriate safeguards including encryption of PHI, to maintain and ensure the confidentiality, integrity, and security of PHI transmitted pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules. B. Notice of Changes. i. Covered Entity maintains a copy of its Notice of Privacy Practices on its website. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission to use or disclose PHI, to the extent that it may affect Business Associate's permitted or required uses or disclosures. ii. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. 164.522, to the extent that it may affect Business Associate's permitted use or disclosure of PHI. 5. Termination A. Breach. i. In addition to any Contract provision regarding remedies for breach, Covered Entity shall have the right, in the event of a breach by Business Associate of any provision of this Agreement, to terminate immediately the Contract, or this Agreement, or both. ii. Subject to any directions from Covered Entity, upon termination of the Contract, this Agreement, or both, Business Associate shall take timely, reasonable, and necessary action to protect and preserve property in the possession of Business Associate in which Covered Entity has an interest. B. Effect of Termination. i. Upon termination of this Agreement for any reason, Business Associate, at the option of Covered Entity, shall return or destroy all PHI that Business Associate, its agents, or its Subcontractors maintain in any form, and shall not retain any copies of such PHI. ii. If Covered Entity directs Business Associate to destroy the PHI, Business Associate shall certify in writing to Covered Entity that such PHI has been destroyed. iii. If Business Associate believes that returning or destroying the PHI is not feasible, Business Associate shall promptly provide Covered Entity with notice of the conditions making return or destruction infeasible. Business Associate shall continue to extend the protections of Section 3 of this Agreement to such PHI, and shall limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. 6. Injunctive Relief Covered Entity and Business Associate agree that irreparable damage would occur in the event Business Associate or any of its Subcontractors or agents use or disclosure of PHI in violation of Exhibit F Page 6 of 1 L/ul:ublyl I GI I VCIui a IL). IUG.7L IrU-GL/Gr WOC.7-041-O-r LLlCUMJUYL/JU this Agreement, the HIPAA Rules or any applicable law. Covered Entity and Business Associate further agree that money damages would not provide an adequate remedy for such Breach. Accordingly, Covered Entity and Business Associate agree that Covered Entity shall be entitled to injunctive relief, specific performance, and other equitable relief to prevent or restrain any Breach or threatened Breach of and to enforce specifically the terms and provisions of this Agreement. 7. Limitation of Liability Any provision in the Contract limiting Contractor's liability shall not apply to Business Associate's liability under this Agreement, which shall not be limited. 8. Disclaimer Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement or the HIPAA Rules will be adequate or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all decisions made and actions taken by Business Associate regarding the safeguarding of PHI. 9. Certification Covered Entity has a legal obligation under HIPAA Rules to certify as to Business Associate's Information Security practices. Covered Entity or its authorized agent or contractor shall have the right to examine Business Associate's facilities, systems, procedures, and records, at Covered Entity's expense, if Covered Entity determines that examination is necessary to certify that Business Associate's Information Security safeguards comply with the HIPAA Rules or this Agreement. 10. Amendment A. Amendment to Comply with Law. The Parties acknowledge that state and federal laws and regulations relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide procedures to ensure compliance with such developments. i. In the event of any change to state or federal laws and regulations relating to data security and privacy affecting this Agreement, the Parties shall take such action as is necessary to implement the changes to the standards and requirements of HIPAA, the HIPAA Rules and other applicable rules relating to the confidentiality, integrity, availability and security of PHI with respect to this Agreement. ii. Business Associate shall provide to Covered Entity written assurance satisfactory to Covered Entity that Business Associate shall adequately safeguard all PHI, and obtain written assurance satisfactory to Covered Entity from Business Associate's Subcontractors and agents that they shall adequately safeguard all PHI. iii. Upon the request of either Party, the other Party promptly shall negotiate in good faith the terms of an amendment to the Contract embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, or other applicable rules. iv. Covered Entity may terminate this Agreement upon 30 days' prior written notice in the event that: Exhibit F Page 7 of 1 u.Ju u IIyII CI IVCIVpe IL/. IL/CUI,IrU-GL/Cr-YOCJ-OYrO-rLVGVP1JUYL/JU a. Business Associate does not promptly enter into negotiations to amend the Contract and this Agreement when requested by Covered Entity pursuant to this Section; or b. Business Associate does not enter into an amendment to the Contract and this Agreement, which provides assurances regarding the safeguarding of PHI sufficient, in Covered Entity's sole discretion, to satisfy the standards and requirements of the HIPAA,the HIPAA Rules and applicable law. B. Amendment of Appendix. The Appendix to this Agreement may be modified or amended by the mutual written agreement of the Parties, without amendment of this Agreement. Any modified or amended Appendix agreed to in writing by the Parties shall supersede and replace any prior version of the Appendix. 11.Assistance in Litigation or Administrative Proceedings Covered Entity shall provide written notice to Business Associate if litigation or administrative proceeding is commenced against Covered Entity, its directors, officers, or employees, based on a claimed violation by Business Associate of HIPAA, the HIPAA Rules or other laws relating to security and privacy or PHI. Upon receipt of such notice and to the extent requested by Covered Entity, Business Associate shall, and shall cause its employees, Subcontractors, or agents assisting Business Associate in the performance of its obligations under the Contract to, assist Covered Entity in the defense of such litigation or proceedings. Business Associate shall, and shall cause its employees, Subcontractor's and agents to,provide assistance, to Covered Entity,which may include testifying as a witness at such proceedings. Business Associate or any of its employees, Subcontractors or agents shall not be required to provide such assistance if Business Associate is a named adverse party. 12. Interpretation and Order of Precedence Any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules. In the event of an inconsistency between the Contract and this Agreement,this Agreement shall control. This Agreement supersedes and replaces any previous, separately executed HIPAA business associate agreement between the Parties. 13. Survival Provisions of this Agreement requiring continued performance, compliance, or effect after termination shall survive termination of this contract or this agreement and shall be enforceable by Covered Entity. Exhibit F Page 8 of 1 LJu1.ubly11 CI IVCIupC ILi ILJCUL.Irc-CUGr-YOC7-0Yr O'rGUCUMJ.7'fNJ.7 APPENDIX TO HIPAA BUSINESS ASSOCIATE AGREEMENT This Appendix("Appendix")to the HIPAA Business Associate Agreement("Agreement") is s an appendix to the Contract and the Agreement. For the purposes of this Appendix, defined terms shall have the meanings ascribed to them in the Agreement and the Contract. Unless the context clearly requires a distinction between the Contract, the Agreement, and this Appendix, all references to "Contract"or"Agreement" shall include this Appendix. 1. Purpose This Appendix sets forth additional terms to the Agreement. Any sub-section of this Appendix marked as "Reserved" shall be construed as setting forth no additional terms. 2. Additional Terms A. Additional Permitted Uses. In addition to those purposes set forth in the Agreement, Business Associate may use PHI for the following additional purposes: i. Reserved. B. Additional Permitted Disclosures. In addition to those purposes set forth in the Agreement, Business Associate may disclose PHI for the following additional purposes: i. Reserved. C. Approved Subcontractors. Covered Entity agrees that the following Subcontractors or agents of Business Associate may receive PHI under the Agreement: i. Reserved. D. Definition of Receipt of PHI. Business Associate's receipt of PHI under this Contract shall be deemed to occur, and Business Associate's obligations under the Agreement shall commence, as follows: i. Reserved. E. Additional Restrictions on Business Associate. Business Associate agrees to comply with the following additional restrictions on Business Associate's use and disclosure of PHI under the Contract: i. Reserved. F. Additional Terms. Business Associate agrees to comply with the following additional terms under the Agreement: i. Reserved. Exhibit F Page 1 of 1 LJVI.UDIIJ.II CI IVCIUiJC IL/. ILJCM..Ir.7-CL/Cr-YOCV-OYr O-r GLICL/HJ.7YL OU EXHIBIT G- INFORMATION TECHNOLOGY PROVISIONS This Exhibit regarding Information Technology Provisions (the "Exhibit") is an essential part of the agreement between the State and Contractor as described in the Contract to which this IT Exhibit is attached. Unless the context clearly requires a distinction between the Contract and this IT Exhibit, all references to "Contract" shall include this IT Exhibit. If there is language in the main body of this Contract or any other Exhibit referencing "Force Majeure," or anything substantially similar to Force Majeure, this IT Exhibit shall not be subject to the "Force Majeure" language. The provisions of this IT Exhibit are of vital importance to the State and the security of the State. 1. PROTECTION OF SYSTEM DATA A. In addition to the requirements of the main body of this Contract, if Contractor or any Subcontractor is given access to State Information Technology resources or State Records by the State or its agents in connection with Contractor's performance under the Contract, Contractor shall protect such Information Technology resources and State Records in accordance with this Exhibit. All provisions of this Exhibit that refer to Contractor shall apply equally to any Subcontractor performing work in connection with the Contract. B. The terms of this Exhibit shall apply to the extent that Contractor's obligations under this Contract include the provision of Information Technology goods or services to the State. Information Technology is computer-based equipment and related services designed for the storage, manipulation, and retrieval of data, and includes, without limitation: i. Any technology, equipment, or related services described in 524-37.5-102(2), C.R.S., and any related Work or Deliverables; ii. The creation, use, processing, disclosure, transmission, or disposal of State Records, including any data or code, in electronic form; and iii. Other existing or emerging technology, equipment, or related services that may require knowledge and expertise in Information Technology. C. Contractor shall, and shall cause its Subcontractors to meet all of the following: i. Provide physical and logical protection for all hardware, software, applications, and data that meets or exceeds industry standards and the requirements of this Contract. ii. Maintain network, system, and application security, which includes, but is not Exhibit G I)u.0 IIy.II CI IVCIVpe ILL. IL GUL.Ir0-CLlGF-YOCU-OYr 17-1-GL/CL!/1J.7YL OU iii. limited to, network firewalls, intrusion detection (host and network), annual security testing, and improvements or enhancements consistent with evolving industry standards. iv. Comply with State and federal rules and regulations related to overall security, privacy, confidentiality, integrity, availability, and auditing. v. Provide that security is not compromised by unauthorized access to workspaces, computers, networks, software, databases, or other physical or electronic environments. vi. Promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the State's Office of Information Security ("OIS"). vii. Comply with all rules, policies, procedures, and standards issued by the Governor's Office of Information Technology ("OIT"), including change management, project lifecycle methodology and governance, technical standards, documentation, and other requirements posted at https://oit.colorado.gov/standards-policies-guides/technical-standards- policies D. Subject to Contractor's reasonable access security requirements and upon reasonable prior notice, Contractor shall provide the State with scheduled access for the purpose of inspecting and monitoring access and use of State Records, maintaining State systems, and evaluating physical and logical security control effectiveness. F. Contractor shall perform current background checks in a form reasonably acceptable to the State on all of its respective employees and agents performing services or having access to State Records provided under this Contract, including any Subcontractors or the employees of Subcontractors. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to State Records shall be deemed to be current. i. Upon request, Contractor shall provide notice to a designated representative for the State indicating that background checks have been performed. Such notice will inform the State of any action taken in response to such background checks, including any decisions not to take action in response to negative information revealed by a background check. ii. If Contractor will have access to Federal Tax Information under the Contract, Contractor shall agree to the State's requirements regarding Safeguarding Requirements for Federal Tax Information and shall comply with the background check requirements defined in IRS Publication 1075 and 524-50- 1002, C.R.S. 2. DATA HANDLING A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. H. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor's employees or agents, without the prior express written Exhibit G UUI.UJIIyI I CI IVCIUpe II.J. I L/GUIJ IFC-CIJCI-WOCU-OYt-17-1-LLJCLJMJJYUJU consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State's request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor's provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State's ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor's infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. 3. DELIVERY AND ACCEPTANCE A. Contractor shall provide and maintain a quality assurance system acceptable to the State for any Work under this Contract and shall provide to the State only such Work that have been inspected and found to conform to the specifications identified in this Contract and any applicable solicitation, bid, offer, or proposal from which this Contract results. B. Contractor's delivery of any Work to the State shall constitute certification that such Work has been determined to conform to the applicable specifications, and Contractor shall make records of such quality assurance available to the State upon request during the term of the Contract or at any time within three years following expiration or termination of the Contract. C. For any Work other than the purchase or license of commercially available goods or software, acceptance of the Work shall require affirmative written communication from the State to the Contractor that such Work has been accepted by the State. Such communication shall be provided within a reasonable time period from the delivery of the Work and shall not be unreasonably delayed or withheld. Acceptance by the State shall be final, except in cases of Contractor's failure to conduct proper quality assurance, Exhibit G 1-/ULUJIy1 I GI IVCIUpe IL. I UCUI,I FU-GVG1--,FOG.7-041-D-rz VCVMJ.74IJJ.7 latent defects that could not reasonably have been detected upon delivery, or Contractor's gross negligence or willful misconduct. 4. WARRANTY A. Notwithstanding the acceptance of any Work, or the payment of any invoice for such Work or Deliverable, Contractor warrants that any Work provided by Contractor under this Contract shall be free from material defects and shall function in material accordance with the applicable specifications. Contractor warrants that any Work shall be, at the time of delivery, free from any harmful or malicious code, including without limitation viruses, malware, spyware, ransomware, or other similar function designed to interfere with or damage the normal operation of Information Technology resources. Contractor's warranties under this section shall apply to any defects or material nonconformities discovered within 180 days following delivery of any Work. B. Upon notice during the warranty term of any defect or material nonconformity, Contractor shall submit to the State in writing within 10 business days of the notice one or more recommendations for corrective action with sufficient documentation for the State to ascertain the feasibility, risks, and impacts of each recommendation. The State's remedy for such defect or material non-conformity shall be: i. Contractor shall re-perform, repair, or replace such Work in accordance with any recommendation chosen by the State. Contractor shall deliver, at no additional cost to the State, all documentation required under the Contract as applicable to the corrected Work; or ii. Contractor shall refund to the State all amounts paid for such Work, as well as pay to the State any additional amounts reasonably necessary for the State to procure alternative goods or services of substantially equivalent capability, function, and performance. C. Any Work delivered to the State as a remedy under this section shall be subject to the same quality assurance, acceptance, and warranty requirements as the original Work. The duration of the warranty for any replacement or corrected Work shall run from the date of the corrected or replacement Work. 5. COMPLIANCE A. In addition to the compliance obligations imposed by the main body of the Contract, Contractor shall comply with: i. All Colorado Office of Information Security (OIS) policies and procedures which OIS has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical- standards-policies ii. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any specifically incorporated industry standards or guidelines, as applicable based on the classification of the data relevant to Contractor's performance under the Contract. Such obligations may arise from: a. Health Information Portability and Accountability Act (HIPAA) b. IRS Publication 1075 c. Payment Card Industry Data Security Standard (PCI-DSS) Exhibit G LJu.0 Iyil CIIveiupe ILJ. ILJC.7li IFU-CLJCF-YOG.7-OYt-C-f GL./GLJP1J.7YVJU d. FBI Criminal Justice Information Service Security Addendum e. CMS Minimum Acceptable Risk Standards for Exchanges f. Electronic Information Exchange Security Requirements and Procedures For State and Local Agencies Exchanging Electronic Information With The Social Security Administration B. Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor's performance under the Contract. C. Contractor shall allow the State reasonable access and shall provide the State with information reasonably required to assess Contractor's compliance. Such access and information shall include: i. An annual SOC2 Type II audit including, at a minimum, the Trust Principles of Security, Confidentiality, and Availability, or an alternative audit recommended by OIS; or iii. The performance of security audit and penetration tests, as requested by OIS. D. To the extent Contractor controls or maintains information systems used in connection with State Records, Contractor will provide OIS with the results of all security assessment activities when conducted on such information systems, including any code-level vulnerability scans, application level risk assessments, and other security assessment activities as required by this Contract or reasonably requested by OIS. Contractor will make reasonable efforts to remediate any vulnerabilities or will request a security exception from the State. The State will work with Contractor and 015 to prepare any requests for exceptions from the security requirements described in this Contract and its Exhibits, including mitigating controls and other factors, and OIS will consider such requests in accordance with their policies and procedures referenced herein. 6. TRANSITION OF SERVICES Upon request by the State prior to expiration or earlier termination of this Contract or any Services provided in this Contract, Contractor shall provide reasonable and necessary assistance to accomplish a complete transition of the Services from Contractor to the State or any replacement provider designated solely by the State without any interruption of or adverse impact on the Services. Contractor shall cooperate fully with the State or any successor provider and shall promptly take all steps required to assist in effecting a complete transition of the Services designated by the State. All services related to such transition shall be performed at no additional cost beyond what would be paid for the Services in this Contract. 7. LICENSE OR USE AUDIT RIGHTS A. To the extent that Contractor, through this Contract or otherwise as related to the subject matter of this Contract, has granted to the State any license or otherwise limited permission to use any Contractor Property, the terms of this section shall apply. B. Contractor shall have the right, at any time during and throughout the Contract Term, but not more than once per Fiscal Year, to request via written notice in accordance with Exhibit G LAJUUDIylI CI IVCIUF/C ILL I LJC.71-•lrU-CLJCr-YOC.7-0Y1-O-r LLJCUMJCYLJJU the notice provisions of the Contract that the State audit its use of and certify as to its compliance with any applicable license or use restrictions and limitations contained in this Contract (an "Audit Request"). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Contractor ("Audit Certification") within 120 days following the State's receipt of the Audit Request. C. If upon receipt of the State's Audit Certification, the Parties reasonably determine that: (i) the State's use of licenses, use of software, use of programs, or any other use during the audit period exceeded the use restrictions and limitations contained in this Contract ("Overuse") and (ii) the State would have been or is then required to purchase additional maintenance and/or services ("Maintenance"), Contractor shall provide written notice to the State in accordance with the notice provisions of the Contract identifying any Overuse or required Maintenance and request that the State bring its use into compliance with such use restrictions and limitations Exhibit G Hello