Fresno City Council
September 25, 2025

Purchasing Agreement # 2021002786
Template revised on 10.1.19 Page 1 of 5
The Agreement to furnish certain goods and services described herein and in the documents referenced herein (“Goods and/or Services”) is made by and between The Regents of the University of California, a California public corporation (“UC”) on behalf of the University of California, and the supplier named below (“Supplier”). This Agreement is binding only if it is negotiated and executed by an authorized representative with the proper delegation of authority.

1. Statement of Work

Supplier agrees to perform the Services listed in the statement of work attached as Attachment A (“Statement of Work”) and any other documents referenced in the Incorporated Documents section herein, at the prices set forth in the Statement of Work and any other documents referenced in the Incorporated Documents section herein. Unless otherwise provided in the Agreement, UC will not be obligated to purchase a minimum amount of Goods and/or Services from Supplier.

2. Term of Agreement/Termination

a) The initial term of the Agreement will be from January 8, 2021 and through January 7, 2026 (Initial Term) and is subject to earlier termination as provided below. UC may renew the Agreement for five successive one - year periods (each, a Renewal Term), by providing Supplier with at least 30 calendar days’ written notice before the end of the Initial Term or any Renewal Term.

b) UC may terminate the Agreement for convenience by giving Supplier at least 30 calendar days' written notice.

c) UC or Supplier may terminate the Agreement for cause by giving the other party at least 30 days' notice to cure a breach of the Agreement (Cure Period). If the breaching party fails to cure the breach within the Cure Period, the non-breaching party may immediately terminate the Agreement.

3. Purchase Order; Advance Payments

Unless otherwise provided in the Agreement, Supplier may not begin providing Goods and/or Services until UC approves a Purchase Order for the Goods and/or Services.

4. Pricing, Invoicing Method, and Settlement Method and Terms

Refer to Statement of Work or Purchase Order for Pricing. For system-wide agreements, each UC Location will specify the Invoicing Method and Payment Options that will apply, taking into account the operational capabilities of Supplier and the UC Location. See UC’s Procure to Pay Standards http://www.ucop.edu/procurement- services/_files/Matrix%20for%20website.pdf for the options that will be considered. In the case of systemwide agreements, each UC Location will specify these terms in a Statement of Work or Purchase Order, as the case may be.]

For non-systemwide agreements, the Invoicing Method, and Settlement Method and Terms are addressed below.

DocuSign Envelope ID: 046E32D7-3C58-4A4D-81AE-40CCAE4358BE

Template revised on 10.1.19 Page 2 of 5
Invoicing Method
Notwithstanding the provisions of Article 3 of the Terms and Conditions of Purchase, Supplier will be required to use the following Invoicing Method:

All invoices must clearly indicate the following information:

California sales tax as a separate line item;
Shipping costs as a separate line item;
UC Purchase Order or Release Number;
Description, quantity, catalog number and manufacturer number of the item ordered; Net cost of each item;
Any pay/earned/dynamic discount;
Reference to original order number for all credit memos issued;

Supplier will submit invoices following the designated invoice method directly to UC Accounts Payable Departments at each UC Location, unless UC notifies the Supplier otherwise by amendment to the Agreement.

5. Notices

As provided in the UC Terms and Conditions of Purchase, notices may be given by email, which will be considered legal notice only if such communications include the following text in the Subject field: FORMAL LEGAL NOTICE – [insert, as the case may be, Supplier name or University of California]. If a physical format notice is required, it must be sent by overnight delivery or by certified mail with return receipt requested, at the addresses specified below.

To UC, regarding confirmed or suspected Breaches as defined under Appendix – Data Security:

Name David Rusting, Chief Information Security Officer
Phone 510-987-0086
Email [email protected]
Address 1111 Franklin St.

Oakland, CA 94607

To UC, regarding Breaches or Security Incidents as defined under Appendix – Business Associate:

Name Roslyn Martorano
Phone 510-987-0564
Email [email protected]
Address 1111 Franklin St.

Oakland, CA 94607

DocuSign Envelope ID: 046E32D7-3C58-4A4D-81AE-40CCAE4358BE Template revised on 10.1.19 Page 3 of 5
To UC, regarding contract issues not addressed above:

Name Sean Parker
Phone 805-451-1545
Email [email protected]
Address 1111 Franklin St.

Oakland, CA 94607
To Supplier:

Name Ammon Lesher
Phone 864-752-4545
Email [email protected]
Address

6. Intellectual Property, Copyright and Patents
/___/ The Goods and/or Services involve Work Made for Hire /_X_/ The Goods and/or Services do not involve Work Made for Hire

7. Patient Protection and Affordable Care Act (PPACA)
/___/ Because the Services involve temporary or supplementary staffing, they are subject to the PPACA warranties in the T&Cs.
/_X_/ The Services do not involve temporary or supplementary staffing, and they are not subject to the PPACA warranties in the T&Cs.

8. Prevailing Wages
/_X_/ Supplier is not required to pay prevailing wages when providing the Services.

9. Fair Wage/Fair Work
/___/ Supplier is not required to pay the UC Fair Wage (defined as $13 per hour as of 10/1/15, $14 per hour as of 10/1/16, and $15 per hour as of 10/1/17) when providing the Services.

10. Federally Funded Contracts, Grants, and Cooperative Agreements Not Applicable

11. Restriction Relating to Consulting Services or Similar Contracts – Follow-on Contracts
Please note a Supplier that is awarded a consulting services or similar contract cannot later submit a bid or be considered for 30 Patewood Drive, Suite 350
Greenville, SC 29615
DocuSign Envelope ID: 046E32D7-3C58-4A4D-81AE-40CCAE4358BE Template revised on 10.1.19 Page 4 of 5
any work “required, suggested, or otherwise deemed appropriate” as the end product of the Services ( see Public Contract Code Section 10515).

12. Insurance
Deliver the PDF version of the Certificate of Insurance to UC’s Buyer, by email with the following text in the Subject field:

CERTIFICATE OF INSURANCE – Gordian Group Inc.

13. Service-Specific and/or Goods-Specific Provisions
Not Applicable

14. Records about Individuals
Records created pursuant to the Agreement that contain personal information about individuals (including statements made by or about individuals) may become subject to the California Information Practices Act of 1977, which includes a right of access by the subject individual. While ownership of confidential or personal information about individuals is subject to negotiated agreement between UC and Supplier, records will normally become UC’s property, and subject to state law and UC policies governing privacy and access to files. When collecting the information, Supplier must inform the individual that the record is being made, and the purpose of the record. Use of recording devices in discussions with employees is permitted only as specified in the Statement of Work.

15. Amendments to UC Terms and Conditions of Purchase
ARTICLE 7 – INTELLECTUAL PROPERTY, COPYRIGHT, PATENTS, AND DATA RIGHTS Section 7.B.1 includes additional language as follows:
“This provision shall not apply to any of the Goods and/or Services classified as Proprietary Information as set forth and defined in the JOC System License contained herein. The access, use and ownership of the Proprietary Information shall be exclusively governed by the terms of the JOC System License.”

16. Amendments to Appendix – Data Security
Not Applicable

17. Amendments to Appendix – Business Associate
Not Applicable

18. Not Used

19. Incorporated Documents
This Agreement and its Incorporated Documents contain the entire agreement between the Parties, in order of the below precedent, concerning its subject matter and shall supersede all prior or other agreements, oral and written declarations of intent and other legal arrangements (whether binding or non-binding) made by the Parties in respect thereof.
a. Gordian Group Inc. JOC Purchasing Agreement 2021002786 DocuSign Envelope ID: 046E32D7-3C58-4A4D-81AE-40CCAE4358BE Template revised on 10.1.19 Page 5 of 5
b. UC Terms and Conditions of Purchase - UC Required Terms Gordian Revisions c. UC Appendix – Data Security
d. UC Appendix - Business Associate (HIPAA)
e. Statement of Work – Attachment A
f. Gordian Pricing
g. Gordian UC Pricing
h. Gordian JOC System License
i. Gordian Value Add Planning Solutions Summary
j. Gordian ROPA Physical Assets Solution
k. Gordian Sightlines Strategic Capital Planning
l. Gordian Sightlines Space Utilization
m. Gordian Sightlines Sustainability Solutions

20. Entire Agreement
The Agreement and its Incorporated Documents contain the entire Agreement between the parties and supersede all prior written or oral agreements with respect to the subject matter herein.

This Agreement can only be signed by an authorized representative with the proper delegation of authority.

THE REGENTS OF THE Gordian Group Inc.

UNIVERSITY OF CALIFORNIA
________________________________ ___________________________________ (Signature) (Signature)
________________________________ ___________________________________ (Printed Name, Title) (Printed Name, Title)
________________________________ ____________________________________ (Date) (Date)
01/05/2021
Ammon T. Lesher
Lauren Friedman, Director, Design & Construction, Capital Programs DocuSign Envelope ID: 046E32D7-3C58-4A4D-81AE-40CCAE4358BE 1/8/2021
Terms and Conditions of Purchase

Revised 2/27/2020

ARTICLE 1 – GENERAL
The equipment, materials, or supplies (“Goods”) and/or services (“Services”) furnished by Supplier (together, the “Goods and Services”) and covered by the UC Purchase Order (“PO”) and/or other agreement (which, when combined with these Terms and Conditions and any other documents incorporated by reference, will constitute the “Agreement”) are governed by the terms and conditions set forth herein.

As used herein, the term "Supplier" includes Supplier and its sub-suppliers at any tier. As used herein, “UC” refers to The Regents of the University of California, a corporation described in California Constitution Art. IX, Sec. 9, on behalf of the UC Locations identified in the Agreement and/or the PO. UC and Supplier individually will be referred to as “Party” and collectively as “Parties.” Any defined terms not defined in these Terms and Conditions of Purchase will have the meaning ascribed to such term in any of the other documents incorporated in and constituting the Agreement. No other terms or conditions will be binding upon the Parties unless accepted by them in writing.

Written acceptance or shipment of all or any portion of the Goods, or the performance of all or any portion of the Services, covered by the Agreement, will constitute Supplier’s unqualified acceptance of all of the Agreement’s terms and conditions. The terms of any proposal referred to in the Agreement are included and made a part of the Agreement only to the extent the proposal specifies the Goods and/or Services ordered, the price therefor, and the delivery thereof, and then only to the extent that such terms are consistent with the terms and conditions of the Agreement.

ARTICLE 2 – TERM AND TERMINATION
A. As applicable, the term of the Agreement (“Initial Term”) will be stated in the Agreement. Following the Initial Term, the Agreement may be extended by written mutual agreement.

B. UC’s obligation to proceed is conditioned upon the appropriation of state, federal and other sources of funds not controlled by UC ("Funding"). UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation in the event that through no action or inaction on the part of UC, the Funding is withdrawn.

C. UC may, by written notice stating the extent and effective date thereof, terminate the Agreement for convenience in whole or in part, at any time. The effective date of such termination shall be consistent with any requirements for providing notice specified in the Agreement, or immediate if no such terms are set forth in the Agreement. As specified in the termination notice, UC will pay Supplier as full compensation the pro rata Agreement price for performance through the later of the date that (i) UC provided Supplier with notice of termination or (ii) Supplier’s provision of Goods and/or Services will terminate.

D. UC may by written notice terminate the Agreement for Supplier’s breach of the Agreement, in whole or in part, at any time, if Supplier refuses or fails to comply with the provisions of the Agreement, or so fails to make progress as to endanger performance and does not cure such failure within five (5) business days, or fails to supply the Goods and/or Services within the time specified or any written extension thereof. In such event, UC may purchase or otherwise secure Goods and/or Services and, except as otherwise provided herein, Supplier will be liable to UC for any excess costs UC incurs thereby.

E. UC’s Appendix – Data Security, Appendix – BAA, and/or Appendix – GDPR will control in the event that one or more appendices are incorporated into the Agreement and conflicts with the provisions of this Article.

ARTICLE 3 – PRICING, INVOICING METHOD, AND SETTLEMENT METHOD AND TERMS.

Pricing is set forth in the Agreement or Purchase Order, and the amount UC is charged and responsible for shall not exceed the amount specified in the Agreement unless UC has given prior written approval. Unless otherwise agreed in writing by UC, Supplier will use the invoicing method and payment settlement method (and will extend the terms applicable to such settlement method) set forth in UC’s Supplier Invoicing, Terms & Settlement Matrix. UC will pay Supplier, upon submission of acceptable invoices, for Goods and/or Services provided and accepted. Invoices must be itemized and reference the Agreement or Purchase Order number. UC will not pay shipping, packaging or handling expenses, unless specified in the Agreement or Purchase Order. Unless otherwise provided, freight is to be FOB destination. Any of Supplier’s expenses that UC agrees to reimburse will be reimbursed under UC’s Travel Policy, which may be found at http://www.ucop.edu/central-travel-management/resources/index.html. Where applicable, Supplier will pay all taxes imposed on Supplier in connection with its performance under the Agreement, including any federal, state and local income, sales, use, excise and other taxes or assessments. Notwithstanding any other provision to the contrary, UC will not be responsible for any fees, interest or surcharges Supplier wishes to impose.

Terms and Conditions of Purchase

Revised 2/27/2020

ARTICLE 4 – INSPECTION.

The Goods and/or Services furnished will be exactly as specified in the Agreement, free from all defects in Supplier's performance, design, skill and materials, and, except as otherwise provided in the Agreement, will be subject to inspection and test by UC at all times and places.

If, prior to final acceptance, any Goods and/or Services furnished are found to be incomplete, or not as specified, UC may reject them, require Supplier to correct them at the sole cost of Supplier, or require provision of such Goods and/or Services at a reduction in price that is equitable under the circumstances. If Supplier is unable or refuses to correct such deficiencies within a time UC deems reasonable, UC may terminate the Agreement in whole or in part. Supplier will bear all risks as to rejected Goods and/or Services and, in addition to any costs for which Supplier may become liable to UC under other provisions of the Agreement, will reimburse UC for all transportation costs, other related costs incurred, or payments to Supplier in accordance with the terms of the Agreement for unaccepted Goods and/or Services and materials and supplies incidental thereto. Notwithstanding final acceptance and payment, Supplier will be liable for latent defects, fraud or such gross mistakes as amount to fraud.

ARTICLE 5 – ASSIGNED PERSONNEL; CHARACTER OF SERVICES
Supplier will provide the Services as an independent contractor and furnish all equipment, personnel and materiel sufficient to provide the Services expeditiously and efficiently, during as many hours per shift and shifts per week, and at such locations as UC may so require.

Supplier will devote only its best-qualified personnel to work under the Agreement. Should UC inform Supplier that anyone providing the Services is not working to this standard, Supplier will immediately remove such personnel from providing Services and he or she will not 0again, without UC’s written permission, be assigned to provide Services. At no time will Supplier or Supplier’s employees, sub-suppliers, agents, or assigns be considered employees of UC for any purpose, including but not limited to workers’ compensation provisions. Supplier shall not have the power nor right to bind or obligate UC, and Supplier shall not hold itself out as having such authority. Supplier shall be responsible to UC for all Services performed by Supplier’s employees, agents and subcontractors, including being responsible for ensuring payment of all unemployment, social security, payroll, contributions and other taxes with respect to such employees, agents and subcontractors.

ARTICLE 6 – WARRANTIES
In addition to the warranties set forth in Articles 11, 12, 17, 23, 24, 25 and 26 herein, Supplier makes the following warranties. Supplier acknowledges that failure to comply with any of the warranties in the Agreement will constitute a material breach of the Agreement and UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

A. General Warranties. Supplier represents, warrants and covenants that: (i) Supplier is free to enter into this Agreement and that Supplier is not, and will not become, during the Term, subject to any restrictions that might restrict or prohibit Supplier from performing the Services or providing the Goods ordered hereunder; (ii) Supplier will comply with all applicable laws, rules and regulations in performing Supplier’s obligations hereunder; (iii) the Goods and/or Services shall be rendered with promptness and diligence and shall be executed in a skilled manner by competent personnel, in accordance with the prevailing industry standards; and if UC Appendix Data Security is NOT included:(iv) Supplier has developed a business interruption and disaster recovery program and is executing such program to assess and reduce the extent to which Supplier’s hardware, software and embedded systems may be susceptible to errors or failures in various crisis (or force majeure) situations; (v) if Supplier uses electronic systems for creating, modifying, maintaining, archiving, retrieving or transmitting any records, including test results that are required by, or subject to inspection by an applicable regulatory authority, then Supplier represents and warrants that Supplier’s systems for electronic records are in compliance; and (vi) Supplier agrees that the Goods and/or Services furnished under the Agreement will be covered by the most favorable warranties Supplier gives to any customer for the same or substantially similar goods or services, or such other more favorable warranties as specified in the Agreement. The rights and remedies so provided are in addition to and do not limit any rights afforded to UC by any other article of the Agreement.

B. Permits and Licenses. Supplier agrees to procure all necessary permits or licenses and abide by all applicable laws, regulations and ordinances of the United States and of the state, territory and political subdivision or any other country in which the Goods and/or Services are provided.

C. Federal and State Water and Air Pollution Laws. Where applicable, Supplier warrants that it complies with the requirements in UC Business and Finance Bulletin BUS-56 (Materiel Management; Purchases from Entities Violating State or Federal Water or Air Pollution Terms and Conditions of Purchase

Revised 2/27/2020

Laws). Consistent with California Government Code 4477, these requirements do not permit UC to contract with entities in violation of Federal or State water or air pollution laws.

D. Web Accessibility Requirements. As applicable to the Supplies and/or Services being provided under the Agreement, Supplier warrants that:

1. It complies with California and federal disability laws and regulations; and

2. The Goods and/or Services will conform to the accessibility requirements of WCAG 2.0AA.

3. Supplier agrees to promptly respond to and resolve any complaint regarding accessibility of its Goods and/or Services; E. General Accessibility Requirements. Supplier warrants that:

1. It will comply with California and federal disability laws and regulations;

2. Supplier will promptly respond to remediate to any identified accessibility defects in the Goods and Services to conform to WCAG

2.0 AA; and

3. Supplier agrees to promptly respond to and use reasonable efforts to resolve and remediate any complaint regarding accessibility of its Goods and/or Services.

F. Warranty of Quiet Enjoyment. Supplier warrants that Supplier has the right of Quiet Enjoyment in, and conveys the right of Quiet Enjoyment to UC for UC’s use of, any and all intellectual property that will be needed for Supplier’s provision, and UC’s use of, the Goods and/or Services provided by Supplier under the Agreement.

G. California Child Abuse and Neglect Reporting Act ("CANRA"). Where applicable, Supplier warrants that it complies with CANRA.

H. Debarment and Suspension. Supplier warrants that it is not presently debarred, suspended, proposed for debarment, or declared ineligible for award of federal contracts or participation in federal assistance programs or activities.

I. UC Trademark Licensing Code of Conduct. If the Goods will bear UC’s name (including UC campus names, abbreviations of these names, UC logos, UC mascots, or UC seals) or other trademarks owned by UC, Supplier warrants that it holds a valid license from UC and complies with the Trademark Licensing Code of Conduct policy, available at http://policy.ucop.edu/doc/3000130/TrademarkLicensing.

J. Outsourcing (Public Contract Code section 12147) Compliance. Supplier warrants that if the Agreement will displace UC employees, no funds paid under the Agreement will be used to train workers who are located outside of the United States, or plan to relocate outside the United States as part of the Agreement. Additionally, Supplier warrants that no work will be performed under the Agreement with workers outside the United States, except as described in Supplier’s bid. If Supplier or its sub-supplier performs the Agreement with workers outside the United States during the life of the Agreement and Supplier did not describe such work in its bid, Supplier acknowledges and agrees that (i) UC may terminate the Agreement without further obligation for noncompliance, and (ii) Supplier will forfeit to UC the amount UC paid for the percentage of work that was performed with workers outside the United States and not described in Supplier’s bid.

ARTICLE 7 – INTELLECTUAL PROPERTY, COPYRIGHT, PATENTS, AND DATA RIGHTS A. Goods and/or Services Involving Work Made for Hire.

1. Unless UC indicates that the Goods and/or Services do not involve work made for hire, Supplier acknowledges and agrees that any deliverables provided to UC by Supplier in the performance of the Agreement, and any intellectual property rights therein, (hereinafter the "Deliverables") will be owned by UC. The Deliverables will be considered "work made for hire" under U.S. copyright law and all right, title, and interest to and in such Deliverables including, but not limited to, any and all copyrights or trademarks, will be owned by UC. In the event that it is determined that UC is not the owner of such Deliverables under the "work made for hire" doctrine of U.S. copyright law, Supplier hereby irrevocably assigns to UC all right, title, and interest to and in such Deliverables and any copyrights or trademarks thereto.

2. The Deliverables must be new and original. Supplier must not use any pre-existing copyrightable or trademarked images, writings, or other proprietary materials (hereinafter "Pre-Existing Materials") in the Deliverables without UC’s prior written permission. In the event that Supplier uses any Pre-Existing Materials in the Deliverables in which Supplier has an ownership interest, UC is hereby granted, and will have, a non-exclusive, royalty-free, irrevocable, perpetual, paid-up, worldwide license (with the right to sublicense) to make, have made, copy, modify, make derivative works of, use, perform, display publicly, sell, and otherwise distribute such Pre-Existing Materials in connection with the Deliverables.

Terms and Conditions of Purchase

Revised 2/27/2020

3. Whenever any invention or discovery is made or conceived by Supplier in the course of or in connection with the Agreement, Supplier will promptly furnish UC with complete information with respect thereto and UC will have the sole power to determine whether and where a patent application will be filed and to determine the disposition of title to and all rights under any application or patent that may result.

4. Supplier is specifically subject to an obligation to, and hereby does, assign all right, title and interest in any such intellectual property rights to UC as well as all right, title and interest in tangible research products embodying any such inventions whether the inventions are patentable or not. Supplier agrees to promptly execute any additional documents or forms that UC may require in order to effectuate such assignment.

B. Goods and/or Services Not Involving Work Made for Hire.

1. If the Goods and/or Services do not involve work made for hire, and in the event that Supplier uses any Pre-Existing Materials in the Deliverables in which Supplier has an ownership interest, UC is hereby granted, and will have, a non-exclusive, royalty-free, irrevocable, perpetual, paid-up, worldwide license (with the right to sublicense) to make, have made, copy, modify, make derivative works of, use, perform, display publicly, sell, and otherwise distribute such Pre-Existing Materials in connection with the Deliverables. This provision shall not apply to any of the Goods and/or Services classified as Proprietary Information as set forth and defined in the JOC System License contained herein. The access, use and ownership of the Proprietary Information shall be exclusively governed by the terms of the JOC System License.

2. The Deliverables must be new and original. Supplier must not use any Pre-Existing Materials in the Deliverables without UC’s prior written permission.

3. Whenever any invention or discovery is made or conceived by Supplier in the course of or in connection with the Agreement, Supplier will promptly furnish UC complete information with respect thereto and UC will have the sole power to determine whether and where a patent application will be filed and to determine the disposition of title to and all rights under any application or patent that may result.

4. Supplier is specifically subject to an obligation to, and hereby does, assign all right, title and interest in any such intellectual property rights to UC as well as all right, title and interest in tangible research products embodying any such inventions whether the inventions are patentable or not. Supplier agrees to promptly execute any additional documents or forms that UC may require in order to effectuate such assignment.

C. General. Should the Goods and/or Services become, or in Supplier’s opinion be likely to become, the subject of a claim of infringement of any patent, copyright, trademark, trade name, trade secret, or other proprietary or contractual right of any third party, Supplier will provide written notice to UC of the circumstances giving rise to such claim or likely claim. In the event that UC receives notice of a claim of infringement or is made a party to or is threatened with being made a party to any claim of infringement related to the Goods and/or Services, UC will provide Supplier with notice of such claim or threat. Following receipt of such notice, Supplier will either (at Supplier’s sole election) (i) procure for UC the right to continue to use the affected portion of the Goods and/or Services, or (ii) replace or otherwise modify the affected portion of the Goods and/or Services to make them non-infringing, or obtain a reasonable substitute product for the affected portion of the Goods and/or Services, provided that any replacement, modification or substitution under this paragraph does not effect a material change in the Goods and/or Services’ functionality. If none of the foregoing options is reasonably acceptable to UC, UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

D. UC Rights to Institutional Information. Institutional Information shall belong exclusively to UC and unless expressly provided, this Agreement shall not be construed as conferring on Supplier any patent, copyright, trademark, license right or trade secret owned or obtained by UC. Any right for Supplier to use Institutional Information is solely provided on a non-exclusive basis, and only to the extent required for Supplier to provide the Goods or Services under the Agreement. As used herein, “Institutional Information” means any information or data created, received, and/or collected by UC or on its behalf, including but not limited to application logs, metadata and data derived from such data.

ARTICLE 8 – INDEMNITY AND LIABILITY
To the fullest extent permitted by law, Supplier will defend, indemnify, and hold harmless UC, its officers, employees, and agents, from and against all losses, expenses (including, without limitation, reasonable attorneys' fees and costs), damages, and liabilities of any kind resulting from or arising out of the Agreement, including the performance hereunder of Supplier, its officers, employees, agents, sub-suppliers, or Terms and Conditions of Purchase

Revised 2/27/2020

anyone directly or indirectly employed by Supplier, or any person or persons under Supplier's direction and control, provided such losses, expenses, damages and liabilities are due or claimed to be due to the acts or omissions of Supplier, its officers, employees, agents, subsuppliers, or anyone directly or indirectly employed by Supplier, or any person or persons under Supplier's direction and control. UC agrees to provide Supplier with prompt notice of any such claim or action and to permit Supplier to defend any claim or action, and that UC will cooperate fully in such defense. UC retains the right to participate in the defense against any such claim or action, and the right to consent to any settlement, which consent will not unreasonably be withheld.

In the event Appendix DS applies to this Agreement, Supplier shall reimburse or otherwise be responsible for any costs, fines or penalties imposed against UC as a result of Supplier’s Breach of Institutional Information and/or failure to cooperate with UC’s response to such Breach. As used herein, “Breach” means: (1) any disclosure of Institutional Information to an unauthorized party or in an unlawful manner; (2) unauthorized or unlawful acquisition of information that compromises the security, confidentiality or integrity of Institutional Information and/or IT Resources; and (3) the acquisition, access, use, or disclosure of Protected Health Information or medical information in a manner not permitted under the Health Insurance Portability and Accountability Act (HIPAA) or California law. “IT Resources” means IT infrastructure, cloud services, software, and/or hardware with computing and/or networking capability that is Supplier owned/managed, or UC-owned, or a personally owned device that stores Institutional Information, is connected to UC systems, is connected to UC networks, or is used for UC business.

ARTICLE 9 – INSURANCE
Supplier, at its sole cost and expense, will insure its activities in connection with providing the Goods and/or Services and obtain, keep in force, and maintain the following insurance with the minimum limits set forth below, unless UC specifies otherwise: A. Commercial Form General Liability Insurance (contractual liability included) with limits as follows:

1. Each Occurrence $ 1,000,000

2. Products/Completed Operations Aggregate $ 2,000,000

3. Personal and Advertising Injury $ 1,000,000

4. General Aggregate $ 2,000,000
B. Business Automobile Liability Insurance for owned, scheduled, non-owned, or hired automobiles with a combined single limit of not less than one million dollars ($1,000,000) per occurrence. (Required only if Supplier drives on UC premises or transports UC employees, officers, invitees, or agents in the course of supplying the Goods and/or Services to UC.) C. If applicable, Professional Liability Insurance with a limit of two million dollars ($2,000,000) per occurrence or claim with an aggregate of not less than two million dollars ($2,000,000). If this insurance is written on a claims-made form, it will continue for three years following termination of the Agreement. The insurance will have a retroactive date of placement prior to or coinciding with the effective date of the Agreement.

D. Workers' Compensation as required by applicable state law and Employer’s Liability with limits of one million dollars ($1,000,000) per occurrence. Workers' Compensation as required by applicable state law and Employer’s Liability with limits of one million dollars ($1,000,000) per occurrence.

E. If applicable, Supplier Fidelity Bond or Crime coverage for the dishonest acts of its employees in a minimum amount of one million dollars ($1,000,000). Supplier will endorse such policy to include a “Regents of the University of California Coverage” or “Joint Payee Coverage” endorsement. UC and, if so requested, UC’s officers, employees, agents and sub-suppliers will be named as "Loss Payee, as Their Interest May Appear” in such Fidelity Bond.

F. In the event Appendix DS applies to this Agreement, Supplier, at its sole cost and expense, will obtain, keep in force, and maintain one or more insurance policies that provide coverage for technology, professional liability, data protection, and/or cyber liability. Typically referred to as Privacy, Technology and Data Security Liability, Cyber Liability, or Technology Professional Liability insurance, it will cover liabilities for financial loss due to the acts, omissions, or intentional misconduct of Supplier, its officers, employees, agents, subsuppliers, or anyone directly or indirectly employed by Supplier, or any person or persons under Supplier’s direction and control, in connection with the performance of this Agreement, as well as all Supplier costs, including damages it is obligated to pay UC or any third party, that are associated with any confirmed or suspected Breach or compromise of Institutional Information. In some cases, Professional Liability policies may include some coverage for data breaches or loss of Institutional Information. Regardless of the type of policy(ies) in place, such coverage will include without limitation: (i) costs to notify parties whose data were lost or compromised; (ii) costs to provide credit monitoring and credit restoration services to parties whose data were lost or compromised; (iii) costs associated with third party claims arising from the confirmed or suspected Breach or loss of Institutional Information, including Terms and Conditions of Purchase

Revised 2/27/2020

litigation costs and settlement costs; (iv) any investigation, enforcement, fines and penalties, or similar miscellaneous costs; and (v) any payment made to a third party as a result of extortion related to a confirmed or suspected Breach. The following insurance coverage is based on the highest Protection Level Classification of Institutional Information identified in Exhibit 1 to Appendix DS:

1. P1 - This insurance policy must have minimum limits of $500,000 each occurrence and $500,000 in the aggregate.

2. P2 - This insurance policy must have minimum limits of $1,000,000 each occurrence and $1,000,000 in the aggregate.

3. P3 and P4, less than 70,000 records - this insurance policy must have minimum limits of $5,000,000 each occurrence and $5,000,000 in the aggregate.

4. P3 and P4, 70,000 or more records - this insurance policy must have minimum limits of $10,000,000 each occurrence and $10,000,000 in the aggregate.

Protection Level Classifications are defined in the UC Systemwide Information Security Classification of Information and IT Resources:
https://security.ucop.edu/policies/institutional-information-and-it-resource-classification.html G. Additional other insurance in such amounts as may be reasonably required by UC against other insurable risks relating to performance.

If the above insurance is written on a claims-made form, it will continue for three years following termination of the Agreement. The insurance will have a retroactive date of placement prior to or coinciding with the effective date of the Agreement. If the above insurance coverage is modified, changed or cancelled, Supplier will provide UC with not less than fifteen (15) days’ advance written notice of such modification, change, or cancellation, and will promptly obtain replacement coverage that complies with this Article.

I. The coverages referred to under A and B of this Article must include UC as an additional insured. It is understood that the coverage and limits referred to under A, B and C of this Article will not in any way limit Supplier’s liability. Supplier will furnish UC with certificates of insurance (and the relevant endorsement pages) evidencing compliance with all requirements prior to commencing work under the Agreement. Such certificates will:

1. Indicate that The Regents of the University of California has been endorsed as an additional insured for the coverage referred to under A and B of this Article. This provision will only apply in proportion to and to the extent of the negligent acts or omissions of Supplier, its officers, agents, or employees.

2. Include a provision that the coverage will be primary and will not participate with or be excess over any valid and collectible insurance or program of self-insurance carried or maintained by UC.

ARTICLE 10 – USE OF UC NAME AND TRADEMARKS
Supplier will not use the UC name, abbreviation of the UC name, trade names and/or trademarks (i.e., logos and seals) or any derivation thereof, in any form or manner in advertisements, reports, or other information released to the public, or place the UC name, abbreviations, trade names and/or trademarks or any derivation thereof on any consumer goods, products, or services for sale or distribution to the public, without UC’s prior written approval. Supplier agrees to comply at all times with California Education Code Section 92000.

ARTICLE 11 – FEDERAL FUNDS
Supplier who supplies Goods and/or Services certifies and represents its compliance with the following clauses, as applicable. Supplier shall promptly notify UC of any change of status with regard to these certifications and representations. These certifications and representations are material statements upon which UC will rely.

A. For commercial transactions involving funds on a federal contract (federal awards governed by the FAR), the following provisions apply, as applicable:

1. FAR 52.203-13, Contractor Code of Business Ethics and Conduct;

2. FAR 52.203-17, Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights;

3. FAR 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements;

4. FAR 52.219-8, Utilization of Small Business Concerns;

5. FAR 52.222-17, Non-displacement of Qualified Workers;

6. FAR 52.222-21, Prohibition of Segregated Facilities;

7. FAR 52.222-26, Equal Opportunity;

8. FAR 52.222-35, Equal Opportunity for Veterans;
Terms and Conditions of Purchase

Revised 2/27/2020

9. FAR 52.222-36, Equal Opportunity for Workers with Disabilities;

10. FAR 52.222-37, Employment Reports on Veterans;

11. FAR 52.222-40, Notification of Employee Rights Under the National Labor Relations Act;

12. FAR 52.222-41, Service Contract Labor Standards;

13. FAR 52.222-50, Combating Trafficking in Persons;

14. FAR 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment - Requirements;

15. FAR 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services - Requirements;

16. FAR 52.222-54, Employment Eligibility Verification;

17. FAR 52.222-55, Minimum Wages Under Executive Order 13658;

18. FAR 52.222-62, Paid Sick Leave under Executive Order 13706;

19. FAR 52.224-3, Privacy Training;

20. FAR 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations;

21. FAR 52.233-1, Disputes; and

22. FAR 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels.

B. For non-commercial transactions involving funds on a federal contract, the UC Appendix titled ‘Federal Government Contracts Special terms and Conditions (Non-Commercial Items or Services)’ and located at www.ucop.edu/procurement- services/policiesforms/index.html is hereby incorporated herein by this reference.

C. For transactions involving funds on a federal grant or cooperative agreement (federal awards governed by eCFR Title 2, Subtitle A, Chapter II, Part 200) the following provisions apply, as applicable:

1. Rights to Inventions. If Supplier is a small business firm or nonprofit organization, and is providing experimental, development, or research work under this transaction, Supplier must comply with the requirements of 3 CFR Part 401, “Rights to Inventions Made by nonprofit Organizations and Small Business Firms Under Government Grants, Contracts, and Cooperative Agreements”.

2. Clean Air Act. Supplier agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).

3. Byrd Anti-Lobbying. Supplier certifies that it will not, and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352.

4. Procurement of Recovered Materials. If Supplier is a state agency or agency of a political subdivision of a state, then Supplier must comply with section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act.

D. In these provisions, the term "contractor" as used therein will refer to Supplier, and the terms “Government” or “Contracting Officer” as used therein will refer to UC. Where a purchase of items is for fulfillment of a specific U.S. Government prime or subcontract, additional information and/or terms and conditions may be included in an attached supplement. By submitting an invoice to UC, Supplier is representing to UC that, at the time of submission:

1. Neither Supplier nor its principals are presently debarred, suspended, or proposed for debarment by the U.S. government (see FAR 52.209-6);

2. Supplier has filed all compliance reports required by the Equal Opportunity clause (see FAR 52.222-22); and

3. Any Supplier representations to UC about U.S. Small Business Administration or state and local classifications, including but not limited to size standards, ownership, and control, are accurate and complete.

4. Byrd Anti-Lobbying. Supplier certifies that it will not, and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or Terms and Conditions of Purchase

Revised 2/27/2020

employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352.

ARTICLE 12 – EQUAL OPPORTUNITY AFFIRMATIVE ACTION
Supplier will abide by the requirements set forth in Executive Orders 11246 and 11375. Where applicable, Supplier will comply with 41 CFR §§ 60-1.4(a), 60-300.5(a) and 60-741.5(a), incorporated by reference with this statement: “This contractor and subcontractor shall abide by the requirements of 41 CFR §§ 60-1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity, or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability.” With respect to activities occurring in the State of California, Supplier agrees to adhere to the California Fair Employment and Housing Act. Supplier will provide UC on request a breakdown of its labor force by groups as specified by UC, and will discuss with UC its policies and practices relating to its affirmative action programs. Supplier will not maintain or provide facilities for employees at any establishment under its control that are segregated on a basis prohibited by federal law. Separate or single-user restrooms and necessary dressing or sleeping areas must be provided, however, to ensure privacy.

ARTICLE 13 – LIENS
Supplier agrees that upon UC’s request, Supplier will submit a sworn statement setting forth the work performed or material furnished by sub-suppliers and material men, and the amount due and to become due to each, and that before the final payment called for under the Agreement, will upon UC’s request submit to UC a complete set of vouchers showing what payments have been made for such work performed or material furnished. Supplier will promptly notify UC in writing, of any claims, demands, causes of action, liens or suits brought to its attention that arise out of the Agreement. UC will not make final payment until Supplier, if required, delivers to UC a complete release of all liens arising out of the Agreement, or receipts in full in lieu thereof, as UC may require, and if required in either case, an affidavit that as far as it has knowledge or information, the receipts include all the labor and materials for which a lien could be filed; but Supplier may, if any sub-supplier refuses to furnish a release or receipt in full, furnish a bond satisfactory to UC to indemnify it against any claim by lien or otherwise. If any lien or claim remains unsatisfied after all payments are made, Supplier will refund to UC all monies that UC may be compelled to pay in discharging such lien or claim, including all costs and reasonable attorneys' fees.

ARTICLE 14 – PREMISES WHERE SERVICES ARE PROVIDED
A. Cleaning Up. Supplier will at all times keep UC premises where the Services are performed and adjoining premises free from accumulations of waste material or rubbish caused by its employees or work of any of its sub-suppliers, and, at the completion of the Services; will remove all rubbish from and about the premises and all its tools, scaffolding, and surplus materials, and will leave the premises "broom clean" or its equivalent, unless more exactly specified. In case of dispute between Supplier and its sub-suppliers as to responsibility for the removal of the rubbish, or if it is not promptly removed, UC may remove the rubbish and charge the cost to Supplier.

B. Environmental, Safety, Health and Fire Protection. Supplier will take all reasonable precautions in providing the Goods and Services to protect the health and safety of UC employees and members of the public and to minimize danger from all hazards to life and property, and will comply with all applicable environmental protection, health, safety, and fire protection regulations and requirements (including reporting requirements). In the event that Supplier fails to comply with such regulations and requirements, UC may, without prejudice to any other legal or contractual rights of UC, issue an order stopping all or any part of the provision of the Goods and/or Services; thereafter a start order for resumption of providing the Goods and/or Services may be issued at UC’s discretion.

Supplier will not be entitled to make a claim for extension of time or for compensation or damages by reason of or in connection with such stoppage. Supplier will have sole responsibility for the safety of all persons employed by Supplier and its sub-suppliers on UC premises, or any other person who enters upon UC premises for reasons relating to the Agreement. Supplier will at all times maintain good order among its employees and all other persons who come onto UC's premises at Supplier's request and will not engage any unfit or unskilled person to provide the Goods and/or Services. Supplier will confine its employees and all other persons who come onto UC's premises at Supplier's request or for reasons relating to the Agreement and its equipment to that portion of UC's premises where the Services are to be provided or to roads leading to and from such work sites, and to any other area which UC may permit Terms and Conditions of Purchase

Revised 2/27/2020

Supplier to use. Supplier will take all reasonable measures and precautions at all times to prevent injuries to or the death of any of its employees or any other person who enters upon UC premises at Supplier’s request. Such measures and precautions will include, but will not be limited to, all safeguards and warnings necessary to protect workers and others against any conditions on the premises that could be dangerous and to prevent accidents of any kind whenever the Goods and/or Services are being provided in proximity to any moving or operating machinery, equipment or facilities, whether such machinery, equipment or facilities are the property of or are being operated by, Supplier, its sub-suppliers, UC or other persons. To the extent compliance is required, Supplier will comply with all relevant UC safety rules and regulations when on UC premises.

C. Tobacco-free Campus. UC is a tobacco-free institution. Use of cigarettes, cigars, oral tobacco, electronic cigarettes and all other tobacco products is prohibited on all UC owned or leased sites.

ARTICLE 15 – LIABILITY FOR UC - FURNISHED PROPERTY
Supplier assumes complete liability for any materials UC furnishes to Supplier in connection with the Agreement and Supplier agrees to pay for any UC materials Supplier damages or otherwise is not able to account for to UC's satisfaction. UC furnishing to Supplier any materials in connection with the Agreement will not, unless otherwise expressly provided in writing by UC, be construed to vest title thereto in Supplier.

ARTICLE 16 – COOPERATION
Supplier and its sub-suppliers, if any, will cooperate with UC and other suppliers and will so provide the Services that other cooperating suppliers will not be hindered, delayed or interfered with in the progress of their work, and so that all of such work will be a finished and complete job of its kind.

ARTICLE 17 – ADDITIONAL TERMS APPLICABLE TO THE FURNISHING OF GOODS The terms in this Article have special application to the furnishing of Goods:

A. Price Decreases. Supplier agrees immediately to notify UC of any price decreases from its suppliers, and to pass through to UC any price decreases.

B. Declared Valuation of Shipments. Except as otherwise provided in the Agreement, all shipments by Supplier under the Agreement for UC's account will be made at the maximum declared value applicable to the lowest transportation rate or classification and the bill of lading will so note.

C. Title. Title to the Goods purchased under the Agreement will pass directly from Supplier to UC at the f.o.b. point shown, or as otherwise specified in the Agreement, subject to UC’s right to reject upon inspection.

D. Changes. Notwithstanding the terms in Article 34, Amendments, UC may make changes within the general scope of the Agreement in drawings and specifications for specially manufactured Goods, place of delivery, method of shipment or packing of the Agreement by giving notice to Supplier and subsequently confirming such changes in writing. If such changes affect the cost of or the time required for performance of the Agreement, UC and Supplier will agree upon an equitable adjustment in the price and/or delivery terms.

Supplier may not make changes without UC’s written approval. Any claim of Supplier for an adjustment under the Agreement must be made in writing within thirty (30) days from the date Supplier receives notice of such change unless UC waives this condition in writing. Nothing in the Agreement will excuse Supplier from proceeding with performance of the Agreement as changed hereunder.

Supplier may not alter or misbrand, within the meaning of the applicable Federal and State laws, the Goods furnished.

E. Forced, Convict and Indentured Labor. Supplier warrants that no foreign-made Goods furnished to UC pursuant to the Agreement will be produced in whole or in part by forced labor, convict labor, or indentured labor under penal sanction. If UC determines that Supplier knew or should have known that it was breaching this warranty, UC may, in addition to terminating the Agreement, remove Supplier from consideration for UC contracts for a period not to exceed one year. This warranty is in addition to any applicable warranties in Articles 6 and 11.

F. Export Control. Supplier agrees to provide UC (the contact listed on the Purchase Order) with written notification that identifies the export-controlled Goods and such Goods’ export classification if any of the Goods is export-controlled under the International Traffic in Arms Regulations (ITAR) (22 CFR §§ 120-130), the Export Administration Regulations (15 CFR §§ 730-774) 500 or 600 series, or controlled on a military strategic goods list. Supplier agrees to provide UC (the contact listed on the Purchase Order) with written Terms and Conditions of Purchase

17 Revised 2/27/2020

notification if Supplier will be providing information necessary for the operation, installation (including on-site installation), maintenance (checking), repair, overhaul, and refurbishing of the Goods that is beyond a standard user manual (i.e. ”Use” technology as defined under the EAR 15 CFR § 772.1), or “Technical Data” (as defined under the ITAR 22 CFR § 120.10).

ARTICLE 18 – CONFLICT OF INTEREST
Supplier affirms that, to the best of Supplier’s knowledge, no UC employee who has participated in UC’s decision-making concerning the Agreement has an “economic interest” in the Agreement or Supplier. A UC employee’s “economic interest” means:

A. An investment worth $2,000 or more in Supplier or its affiliate; B. A position as director, officer, partner, trustee, employee or manager of Supplier or its affiliate; C. Receipt during the past 12 months of $500 in income or $440 in gifts from Supplier or its affiliate; or D. A personal financial benefit from the Agreement in the amount of $250 or more.

In the event of a change in these economic interests, Supplier will provide written notice to UC within thirty (30) days after such change, noting such changes. Supplier will not be in a reporting relationship to a UC employee who is a near relative, nor will a near relative be in a decision making position with respect to Supplier.

ARTICLE 19 – AUDIT REQUIREMENTS
The Agreement, and any pertinent records involving transactions relating to this Agreement, is subject to the examination and audit of the Auditor General of the State of California or Comptroller General of the United States or designated Federal authority for a period of up to five (5) years after final payment under the Agreement. UC, and if the underlying grant, cooperative agreement or federal contract so provides, the other contracting Party or grantor (and if that be the United States or an instrumentality thereof, then the Comptroller General of the United States) will have access to and the right to examine Supplier’s pertinent books, documents, papers, and records involving transactions and work related to the Agreement until the expiration of five (5) years after final payment under the Agreement. The examination and audit will be confined to those matters connected with the performance of the Agreement, including the costs of administering the Agreement.

ARTICLE 20 – PROHIBITION ON UNAUTHORIZED USE OR DISCLOSURE OF INSTITUTIONAL INFORMATION A. Prohibition on Access, Use and Disclosure of Institutional Information. Supplier will not access, use or disclose Institutional Information, other than to carry out the purposes for which UC disclosed the Institutional Information to Supplier, except as required by applicable law, or as otherwise authorized in writing by UC prior to Supplier’s disclosure. Supplier shall have the limited right to disclose Institutional Information to Supplier’s employees provided that: (i) Supplier shall disclose only such Institutional Information as is necessary for the Supplier to perform its obligations under this Agreement, and (ii) Supplier informs such employees of the obligations governing the access, use and disclosure of Institutional Information prior to Supplier’s disclosure. Supplier shall be liable for any breach of this Agreement by its employees. For avoidance of doubt, this provision prohibits Supplier from using for its own benefit Institutional Information and any information derived therefrom. For the avoidance of doubt, the sale of Institutional Information is expressly prohibited.

B. Compliance with Applicable Laws and Industry Best Practices. Supplier agrees to comply with all applicable state, federal, and foreign laws, as well as industry best practices, governing the collection, access, use, disclosure, safeguarding and destruction of Institutional Information. Supplier agrees to protect the privacy and security of Institutional Information according to all applicable laws and industry best practices, and no less rigorously than it protects its own information, but in no case less than reasonable care.

C. Confidential Institutional Information. Supplier agrees to hold UC’s Confidential Institutional Information, and any information derived therefrom, in strict confidence. Confidential Institutional Information shall be defined as any Institutional Information which is (i) marked as “Confidential” at the time of disclosure; (ii) if disclosed orally, identified at the time of such oral disclosure as confidential, and reduced to writing as “Confidential” within thirty (30) days of such oral disclosure; and (iii) if not marked as “Confidential,” information that would be considered by a reasonable person in the relevant field to be confidential given its content and the circumstances of its disclosure. Confidential Information will not be considered confidential to the extent that: (i) Supplier can demonstrate by written records was known to Supplier prior to the effective date of the Agreement; (ii) is currently in, or in the future Terms and Conditions of Purchase

17 Revised 2/27/2020

enters, the public domain other than through a breach of the Agreement or through other acts or omissions of Supplier; (iii) is obtained lawfully from a third party; or (iv) is disclosed under the California Public Records Act or legal process. For the avoidance of doubt, as applicable to Supplier’s Services, Confidential Institutional Information may include any information that identifies or is capable of identifying a specific individual, including but not limited to: 1. Personally identifiable information,

2. Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HIPAA regulations (including, but not limited to 45 C.F.R. § 160.103),

3. Medical information as defined by California Civil Code § 56.05,

4. Cardholder data,

5. Student records, or

6. Individual financial information that is subject to laws restricting the use and disclosure of such information, including but not limited to:
a. Article 1, Section 1 of the California Constitution; the California Information Practices Act (Civil Code § 1798 et seq.); b. The federal Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801(b) and 6805(b)(2)); c. The federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g); d. The federal Fair and Accurate Credit Transactions Act (15 U.S.C. § 1601 et seq.); e. The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq), and f. Applicable international privacy laws, including, but not limited to the General Data Protection Regulation.

D. Required Disclosures of Institutional Information. If Supplier is required by a court of competent jurisdiction or an administrative body to disclose Institutional Information, Supplier will notify UC in writing immediately upon receiving notice of such requirement and prior to any such disclosure (unless Supplier is prohibited by law from doing so), to give UC an opportunity to oppose or otherwise respond to such disclosure. To the extent Supplier still required to disclose Institutional Information, Supplier will furnish only that portion that is legally required and will exercise all reasonable efforts to obtain reliable assurance that confidential treatment will be afforded to any Confidential Institutional Information.

E. No Offshoring. Supplier’s transmission, transportation or storage of Institutional Information outside the United States, or access of Institutional Information from outside the United States, is prohibited except with prior written authorization by UC.

F. Conflict in Terms. UC’s Appendix – Data Security, Appendix – BAA, and/or Appendix GDPR will control in the event that one or more appendices is incorporated into the Agreement and conflicts with the provisions of this Article.

G. Acknowledgement. Supplier acknowledges that remedies at law would be inadequate to protect UC against any actual or threatened breach of this Section by Supplier, and, without prejudice to any other rights and remedies otherwise available to UC, Supplier agrees to the granting of injunctive relief in UC’s favor without proof of actual damages.

ARTICLE 21 – UC WHISTLEBLOWER POLICY
UC is committed to conducting its affairs in compliance with the law, and has established a process for reporting and investigating suspected improper governmental activities. Please visit http://www.ucop.edu/uc-whistleblower/ for more information.

ARTICLE 22 – SUSTAINABLE PROCUREMENT GUIDELINES
Supplier will conduct business using environmentally, socially, and economically sustainable products and services (defined as products and services with a lesser or reduced effect on human health and the environment, and which generate benefits to the University as well as to society and the economy, while remaining within the carrying capacity of the environment), to the maximum possible extent consistent with the Agreement, and with the University of California Sustainable Practices Policy (https://policy.ucop.edu/doc/3100155) and the University of California Sustainable Procurement Guidelines:
(https://www.ucop.edu/procurement-services/_files/sustainableprocurementguidelines.pdf).

In accordance with the University of California Sustainable Practices Policy, Supplier will adhere to the following requirements and standards, as applicable. Supplier acknowledges that failure to comply with any of the sustainability standards and requirements in the Agreement will constitute a material breach of the Agreement and UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

Terms and Conditions of Purchase

17 Revised 2/27/2020

A. Sustainability Marketing Standards. Supplier sustainability related claims, where applicable, must meet UC recognized certifications and standards set forth in the UC Sustainable Procurement Guidelines and/or meet the standards of Federal Trade Commission’s (FTC) Green Guides.

B. Electronic Transfer of Supplier Information. Suppliers, when interacting with the UC, shall be prohibited from providing hard copies of presentations, marketing material, or other informational materials. Suppliers will be required to present all information in electronic format that is easily transferable to UC staff. Materials may be provided in hard copy or physical format if specifically required or requested by a UC representative.

C. Packaging Requirements. All packaging must be compliant with the Toxics in Packaging Prevention Act (AB 455) and must meet all additional standards and requirements set forth in the UC Sustainable Practices Policy. In addition, UC requires that all packaging meet at least one of the criteria listed below:

1. Uses bulk packaging;

2. Uses reusable packaging (e.g. totes reused by delivery service for next delivery);

3. Uses innovative packaging that reduces the weight of packaging, reduces packaging waste, or utilizes packaging that is a component of the product;

4. Maximizes recycled content and/or meets or exceeds the minimum post-consumer content level for packaging in the U.S.

Environmental Protection Agency Comprehensive Procurement Guidelines;

5. Uses locally recyclable or certified compostable material.

D. Foodservice Foam Ban. As of 2018, the University no longer allows packaging foam or expanded polystyrene (EPS) for takeaway containers or other food service items, in any University-owned or -operated food service facility.

E. Product Packaging Foam Ban. Beginning January 1st, 2020, the University will prohibit all contracted and non-contracted suppliers from selling or distributing packaging foam (other than that utilized for laboratory supply or medical packaging) to UC campuses.

Packaging foam is defined as any open or closed cell, solidified, polymeric foam used for cushioning or packaging, including but not limited to: low-density polyethylene foam, polypropylene foam, polystyrene foam (i.e. expanded polystyrene (EPS)), polyurethane foam, polyethylene foam, polyvinyl chloride (PVC) foam, and microcellular foam. Not included in this ban are easily biodegradable, plant-based foams such as those derived from corn or mushrooms.

F. E-Waste Recycling Requirements. All recyclers of UC electronic equipment must be e-Steward certified by the Basel Action Network (BAN).

G. Hosted and Punch-out Catalog Requirements. Suppliers enabled with eProcurement hosted catalog functionality must clearly identify products with UC-recognized certifications, as defined by the UC Sustainable Procurement Guidelines, in both hosted and punch-out catalog e-procurement environments.

ARTICLE 23 – PATIENT PROTECTION AND AFFORDABLE CARE ACT (PPACA) EMPLOYER SHARED RESPONSIBILITY If the Services involve Supplier furnishing UC with temporary or supplementary staffing, Supplier warrants that:

A. If Supplier is an Applicable Large Employer (as defined under Treasury Regulation Section 54.4980H-1(a)(4)):

1. Supplier offers health coverage to its full-time employees who are performing Services for UC;

2. Supplier’s cost of enrolling such employees in Supplier’s health plan is factored into the fees for the Services; and

3. The fees for the Services are higher than what the Services would cost if Supplier did not offer health coverage to such full-time employees.

B. If Supplier is not an Applicable Large Employer (as defined above):

1. Supplier offers group health coverage to its full-time employees who are performing Services for UC and such coverage is considered Minimum Essential Coverage (as defined under Treasury Regulation Section 1-5000A-2) and is Affordable (as defined under Treasury Regulation Section 54.4980H-5(e)); or

2. Supplier’s full-time employees who are performing services for UC have individual coverage and such coverage satisfies the PPACA requirements for mandated individual coverage.

Terms and Conditions of Purchase

17 Revised 2/27/2020

Supplier acknowledges that UC is relying on these warranties to ensure UC’s compliance with the PPACA Employer Shared Responsibility provision.

ARTICLE 24 - PREVAILING WAGES
Unless UC notifies Supplier that the Services are not subject to prevailing wage requirements, Supplier will comply, and will ensure that all sub-suppliers comply, with California prevailing wage provisions, including but not limited to those set forth in Labor Code sections 1770, 1771, 1771.1, 1772, 1773, 1773.1, 1774, 1775, 1776, 1777.5, and 1777.6. For purposes of the Agreement, the term “sub-supplier” means a person or firm, of all tiers, that has a contract with Supplier or with a sub-supplier to provide a portion of the Services. The term subsupplier will not include suppliers, manufacturers, or distributors. Specifically, and not by way of limitation, if apprenticable occupations are involved in providing the Services, Supplier will be responsible for ensuring that Supplier and any sub-suppliers comply with Labor Code Section 1777.5. Supplier and sub-supplier may not provide the Services unless currently registered and qualified to perform public work pursuant to Labor Code Section 1725.5 and 1771.1. Notwithstanding the foregoing provisions, Supplier will be solely responsible for tracking and ensuring proper payment of prevailing wages regardless if Services are partially or wholly subject to prevailing wage requirements. In every instance, Supplier will pay not less than the UC Fair Wage (defined as $13 per hour as of 10/1/15, $14 per hour as of 10/1/16, and $15 per hour as of 10/1/17) for Services being performed at a UC Location (defined as any location owned or leased by UC).

The California Department of Industrial Relations (DIR) has ascertained the general prevailing per diem wage rates in the locality in which the Services are to be provided for each craft, classification, or type of worker required to provide the Services. A copy of the general prevailing per diem wage rates will be on file at each UC Location’s procurement office, and will be made available to any interested party upon request. Supplier will post at any job site:

A. Notice of the general prevailing per diem wage rates, and B. Any other notices required by DIR rule or regulation.

By this reference, such notices are made part of the Agreement. Supplier will pay not less than the prevailing wage rates, as specified in the schedule and any amendments thereto, to all workers employed by Supplier in providing the Services. Supplier will cause all subcontracts to include the provision that all sub-suppliers will pay not less than the prevailing rates to all workers employed by such subsuppliers in providing the Services. The Services are subject to compliance monitoring and enforcement by the DIR. Supplier will forfeit, as a penalty, not more than $200 for each calendar day or portion thereof for each worker that is paid less than the prevailing rates as determined by the DIR for the work or craft in which the worker is employed for any portion of the Services provided by Supplier or any sub-supplier. The amount of this penalty will be determined pursuant to applicable law. Such forfeiture amounts may be deducted from the amounts due under the Agreement. If there are insufficient funds remaining in the amounts due under the Agreement, Supplier will be liable for any outstanding amount remaining due. Supplier will also pay to any worker who was paid less than the prevailing wage rate for the work or craft for which the worker was employed for any portion of the Services, for each day, or portion thereof, for which the worker was paid less than the specified prevailing per diem wage rate, an amount equal to the difference between the specified prevailing per diem wage rate and the amount which was paid to the worker. Review of any civil wage and penalty assessment will be made pursuant to California Labor Code section 1742.

ARTICLE 25 – FAIR WAGE/FAIR WORK
If the Agreement is for Services that will be performed at one or more UC Locations, does not solely involve furnishing Goods, and are not subject to extramural awards containing sponsor-mandated terms and conditions, Supplier warrants that it is in compliance with applicable federal, state and local working conditions requirements, including but not limited to those set forth in Articles 11, 12 and 14 herein, and that Supplier pays its employees performing the Services no less than the UC Fair Wage. Supplier agrees UC may conduct such UC Fair Wage/Fair Work interim compliance audits as UC reasonably requests, as determined in UC’s sole discretion. Supplier agrees to post UC Fair Wage/Fair Work notices, in the form supplied by UC, in public areas (such as break rooms and lunch rooms) frequented by Supplier employees who perform Services.

For Services rendered (actual spend) not subject to prevailing wage requirements in excess of $100,000 in a year (under the Agreement or any combination of agreements for the same service), Supplier will (i) at Supplier’s expense, provide an annual independent verification Terms and Conditions of Purchase

17 Revised 2/27/2020

(https://www.ucop.edu/procurement-services/for-suppliers/fwfw-resources-suppliers.html) performed by a licensed public accounting firm (independent accountant) or the Supplier’s independent internal audit department (http://na.theiia.org/standardsguidance/topics/Pages/Independence-and-Objectivity.aspx) in compliance with UC’s required verification standards and procedures (https://www.ucop.edu/procurement-services/for-suppliers/fwfw-resources-suppliers.html), concerning Supplier’s compliance with this provision, and (ii) ensure that in the case of a UC interim audit, its independent accountant/independent internal auditor makes available to UC its UC Fair Wage/Fair Work work papers for the most recent verification period. Supplier agrees to provide UC with a UC Fair Wage/Fair Work verification annually, in a form acceptable to UC, no later than ninety days after the end of the 12-month period in which $100,000 in spend is reached.

The Fair Wage Fair Work annual independent verification requirement does not extend to contracts for professional services or consulting for which pre-certification has been provided to UC ( https://www.ucop.edu/procurement-services/for-suppliers/fwfw- resourcessuppliers.html). Please see the UC Procurement/Supply Chain Management Policy BUS-43 (https://www.ucop.edu/procurementservices/policies-forms/business-and-finance/index.html) for the definition of professional services and consulting.

ARTICLE 26 – MEDICAL DEVICES
This Article applies when the Goods and/or Services involve UC purchasing or leasing one or more medical devices from Supplier, or when Supplier uses one or more medical devices in providing Goods and/or Services to UC.

Medical Device as used herein will have the meaning provided by the U.S. Food and Drug Administration (“FDA”) and means an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: (i) recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them; (ii) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in humans or other animals, or (iii) intended to affect the structure or any function of the body of humans or other animals, and which does not achieve any of its primary intended purposes through chemical action within or on the body of humans or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes.

Supplier warrants that prior to UC’s purchase or lease of any Medical Device or Supplier’s use of any Medical Device in providing Goods and/or Services hereunder, Supplier will: (i) perform security testing and validation for each such Goods and/or Services or Medical Device, as applicable; (ii) perform security scans to detect malware on any software embedded within any Goods and/or Services or Medical Device, as applicable, in order to verify that the software does not contain any known malware; (iii) conduct a vulnerability scan encompassing all ports and fuzz testing; and (iv) provide UC with reports for (i) – (iii). Supplier warrants that any Good or Medical Device is compliant with FDA’s most current guidance or regulation for the quality system related to the cybersecurity and the Management of Cybersecurity in Medical Devices, and that Supplier will maintain compliance with any updates to such guidance or regulations.

Throughout Supplier’s performance of this Agreement, Supplier will provide UC with reasonably up-to-date patches, firmware and security updates for any Medical Device provided to UC, and any other Medical Device used in the course of providing Services, as applicable. All such patches and other security updates will be made available to UC within thirty (30) days of its commercial release or as otherwise recommended by Supplier or Supplier’s sub-supplier, whichever is earlier.

Supplier warrants that all software and installation media not specifically required for any Medical Device used by Supplier or Goods and/or Services delivered to UC under this Agreement as well as files, scripts, messaging services and data will be removed from all such Goods and/or Services or Medical Device following installation, and that all hardware ports and drivers not required for use or operation of such Goods and/or Services or Medical Device will be disabled at time of installation. In addition, Medical Devices must be configured so that only Supplier-approved applications will run on such Medical Devices.

Supplier agrees that UC may take any and all actions that it, in its sole discretion, deems necessary to address, mitigate and/or rectify any real or potential security threat, and that no such action, to the extent such action does not compromise device certification, will impact, limit, reduce or negate Supplier’s warranties or any of Supplier’s other obligations hereunder.

Terms and Conditions of Purchase

17 Revised 2/27/2020

Supplier warrants that any Medical Device provided to UC, and any other Medical Device used in the course of providing such Goods and/or Services, meet and comply with all cyber-security guidance and similar standards promulgated by the FDA and any other applicable regulatory body.

If the Goods and/or Services entail provision or use of a Medical Device, Supplier will provide UC with a completed Manufacturer Disclosure Statement for Medical Device Security (MDS2) form for each such Medical Device before UC is obligated to purchase or lease such Medical Device or prior to Supplier’s use of such device in its performance of Services. If Supplier provides an MDS2 form to UC concurrently with its provision of Goods and/or Services, UC will have a reasonable period of time to review such MDS2 form, and if the MDS2 form is unacceptable to UC, then UC in its sole discretion may return the Goods or terminate the Agreement with no further obligation to Supplier.

ARTICLE 27 – FORCE MAJEURE
Neither Party will be liable for delays due to causes beyond the Party’s control (including, but not restricted to, war, civil disturbances, earthquakes, fires, floods, epidemics, quarantine restrictions, freight embargoes, and unusually severe weather).

ARTICLE 28 – ASSIGNMENT AND SUBCONTRACTING
Except as to any payment due hereunder, Supplier may not assign or subcontract the Agreement without UC’s written consent. In case such consent is given, the assignee or subcontractor will be subject to all of the terms of the Agreement.

ARTICLE 29 – NO THIRD-PARTY RIGHTS
Nothing in the Agreement, express or implied, is intended to make any person or entity that is not a signer to the Agreement a third-party beneficiary of any right created by this Agreement or by operation of law.

ARTICLE 30 – OTHER APPLICABLE LAWS
Any provision required to be included in a contract of this type by any applicable and valid federal, state or local law, ordinance, rule or regulations will be deemed to be incorporated herein.

ARTICLE 31 – NOTICES
A Party must send any notice required to be given under the Agreement by overnight delivery or by certified mail with return receipt requested, to the other Party’s representative at the address specified by such Party.

ARTICLE 32 – SEVERABILITY
If a provision of the Agreement becomes, or is determined to be, illegal, invalid, or unenforceable, that will not affect the legality, validity or enforceability of any other provision of the Agreement or of any portion of the invalidated provision that remains legal, valid, or enforceable.

ARTICLE 33 – WAIVER
Waiver or non-enforcement by either Party of a provision of the Agreement will not constitute a waiver or non-enforcement of any other provision or of any subsequent breach of the same or similar provision.

ARTICLE 34 – AMENDMENTS
The Parties may make changes in the Goods and/or Services or otherwise amend the Agreement, but only by a writing signed by both Parties’ authorized representatives. In the event there is a Material Change to the Agreement, the parties agree to meet and confer in good faith in order to modify the terms of the Agreement. A Material Change as used herein refers to:

A. A change to the scope of Goods and/or Services to be provided by Supplier, as agreed to by UC; B. A change in the Institutional Information Supplier is required to create, receive, maintain or transmit in performance of the Agreement, such that the Protection Level Classification of such Institutional Information changes; Terms and Conditions of Purchase

17 Revised 2/27/2020

C. Changes in the status of the parties;
D. Changes in flow down terms from external parties; and E. Changes in law or regulation applicable to this Agreement.

Each party shall notify the other party upon the occurrence of a Material Change.

ARTICLE 35 – GOVERNING LAW AND VENUE
California law will control the Agreement and any document to which it is appended. The exclusive jurisdiction and venue for any and all actions arising out of or brought under the Agreement is in a state court of competent jurisdiction, situated in the county in the State of California in which the UC Location is located or, where the procurement covers more than one UC Location, the exclusive venue is Alameda County, California.

ARTICLE 36 – ASSISTANCE IN LITIGATION OR ADMINISTRATIVE PROCEEDINGS Supplier will make itself and its employees, subcontractors, or agents assisting Supplier in the performance of its obligations reasonably available to UC at no cost to UC to testify as witnesses, or otherwise, in the event of investigations, or proceedings against UC, its directors, officers, agents, or employees relating to the Goods or Services.

ARTICLE 37 – SUPPLIER TERMS
Any additional terms that Supplier includes in an order form or similar document will be of no force and effect, unless UC expressly agrees in writing to such terms.

ARTICLE 38 – SURVIVAL CLAUSE
Upon expiration or termination of the Agreement, the following provisions will survive: WARRANTIES; INTELLECTUAL PROPERTY, COPYRIGHT, PATENTS, AND DATA RIGHTS; INDEMNITY AND LIABILITY; USE OF UC NAMES AND TRADEMARKS; LIABILITY FOR UC-FURNISHED PROPERTY; COOPERATION; TERMS APPLICABLE TO THE FURNISHING OF GOODS; AUDIT REQUIREMENTS; PROHIBITION ON UNAUTHORIZED USE OR DISCLOSURE OF INSTITUTIONAL INFORMATION; GOVERNING LAW AND VENUE, and, to the extent incorporated into the Agreement, the terms of the APPENDIX–DATA SECURITY, APPENDIX–BAA, and/or APPENDIX-GDPR.

ARTICLE 39 – CONTRACTING FOR COVERED SERVICES

Covered Services, for the purpose of this Agreement, are defined as work customarily performed by bargaining unit employees at the University in the categories of services described in Regents Policy 5402, and American Federation of State, County, and Municipal Employees (AFSCME) Collective Bargaining Agreement Article 5. Covered Services include, but are not necessarily limited to, the following services: cleaning, custodial, janitorial, or housekeeping services; food services; laundry services; grounds keeping; building maintenance (excluding skilled crafts); transportation and parking services; and security services.

Unless UC notifies Supplier that the Services are not Covered Services, Supplier warrants that it is in compliance with applicable federal, state and local working conditions requirements, including but not limited to those set forth in in other Articles of the Agreement. In accordance with Regents Policy 5402 and AFSCME Collective Bargaining Agreement Article 5, Supplier also warrants that it pays its employees performing the Covered Services at UC locations the equivalent value of the wages and benefits – as determined in the Wage and Benefit Parity Appendix – received by UC employees providing similar services at the same, or nearest UC location.

Supplier agrees UC may conduct such compliance audits as UC reasonably requests, and determined at UC’s sole discretion. Supplier agrees to post UC Contracting for Covered Services notices, in the template supplied by UC, in a prominent and accessible place (such as break rooms and lunch rooms) where it may be easily seen by workers who perform Covered Services. The term "Supplier" includes Supplier and its Sub-Suppliers at any tier. Supplier also agrees to:
(a) upon UC’s request, provide verification of an independent audit performed by Supplier’s independent auditor or independent internal audit department (http://na.theiia.org/standards-guidance/topics/Pages/Independence-and-Objectivity.aspx) and at Terms and Conditions of Purchase

17 Revised 2/27/2020

Supplier’s expense; and

(b) ensure that, in the case of a UC interim audit, Supplier’s auditor makes available to UC its Contracting for Covered Services work papers for the most recently audited time period. Supplier agrees to provide UC requested verification, in a form acceptable to UC, no later than ninety days after receiving UC’s request.

Appendix
Data Security

8/12/2019 Page 1 of 12
ARTICLE 1. PURPOSE AND INTRODUCTION
A. In the course of providing the Goods and/or Services contemplated by the Agreement, Supplier may gain access to the University of California’s (UC) Institutional Information and/or IT Resources (both defined below). In such an event, UC and Supplier desire to appropriately protect Institutional Information and IT Resources. The purpose of this Appendix-Data Security is to specify Supplier’s cybersecurity and risk management responsibilities when Supplier has access to Institutional Information and/or IT Resources.

B. Any capitalized terms used here have the meaning ascribed to such terms as set forth in the Agreement or Incorporated Documents.

C. Supplier must provide commercially acceptable cybersecurity and cyber risk management to protect Institutional Information and/or IT Resources. This must include, but is not limited to the Supplier:

1. Developing and documenting a plan that protects Institutional Information and IT Resources.
• Supplier must responsibly execute this plan.
• Supplier’s approach must conform to a recognized cybersecurity framework designed for that purpose.1
• Supplier’s information security plan must be supported by a third-party review or certification. Supplier may only use an alternative to a third- party review if approved by the responsible UC Information Security Officer.

2. Conducting an accurate and thorough assessment of the potential risks to and vulnerabilities of the security of the Institutional Information and/or IT Resources. Supplier must mitigate anticipated risks effectively. This includes implementing commercially acceptable security policies, procedures, and practices that protect Institutional Information and/or IT Resources.

3. Updating its plan to effectively address new cybersecurity risks.

4. Complying with pertinent contractual and regulatory responsibilities.

5. Providing UC with evidence of compliance with Supplier’s information security plan.

6. Keeping UC informed with timely updates on risks, vulnerabilities, Security Incidents, and Breaches.

7. Keeping UC informed of any measures UC must perform to ensure the security of Institutional Information and IT Resources.

1 Examples include the latest versions of PCI DSS, NIST CSF, CIS Critical Security Controls , IS0 27002, NIST SP 800-53 and NIST SP 800-171.

University of California Appendix
Data Security

8/12/2019 Page 2 of 12
D. If, in the course of providing the Goods and/or Services under the Agreement, Supplier engages in transactions with UC affiliated individuals (including but not limited to: students, staff, faculty, customers, patients, guests, volunteers, visitors, research subjects, etc.), as a benefit and result of the Agreement, Supplier must treat any data about UC affiliated individuals that Supplier creates, receives, and/or collects in the course of those transactions with the same level of privacy and security protections and standards as required of Institutional Information by this Appendix.

E. Supplier agrees to be bound by the obligations set forth in this Appendix. To the extent applicable, Supplier also agrees to impose, by written contract, the same terms and conditions contained in this Appendix on any sub-supplier retained by Supplier to provide or assist in providing the Goods and/or Services to UC.

F. To the extent that a requirement of this Appendix conflicts with those of any other UC Agreement or Incorporated Document, the most stringent requirement (including but not limited to: least risk to UC, shortest time, best practice, etc.) will apply.

ARTICLE 2. DEFINED TERMS
A. “Breach” means: (1) Any disclosure of Institutional Information to an unauthorized party or in an unlawful manner; (2) Unauthorized or unlawful acquisition of information that compromises the security, confidentiality, or integrity of Institutional Information and/or IT Resources; or (3) The acquisition, access, use, or disclosure of protected health information (PHI) or medical information in a manner not permitted under the Health Insurance Portability and Accountability Act (HIPAA) or California law.

B. “Illicit Code” means: (1) Any code UC would not reasonably expect to be present or operating; (2) Hidden software or functionality with adverse or undesired actions or consequences; (3) Code that replicates or transmits Institutional Information or activates operating systems or other similar services without the express knowledge and approval of UC; (4) Code that alters, damages, or erases any Institutional Information or software without the express knowledge and approval of UC; or (5) Code or apparatus that functions in any way as a: key lock, node lock, time-out, “back door,” “trap door,” “booby trap,” “dead drop device,” “data scrambling device,” or other function, regardless of how it is implemented, which is intended to alter or restrict the use of or access to any Institutional Information and/or IT Resources.

C. “Institutional Information” means: Any information or data created, received, and/or collected by UC or on its behalf, including but not limited to: application logs, metadata, and data derived from such data.

D. “IT Resource” means: IT infrastructure, cloud services, software, and/or hardware with computing and/or networking capability that is Supplier owned/managed or UC- owned, or a personally owned device that stores Institutional Information, is connected to UC systems, is connected to UC networks, or is used for UC business. IT Resources include, but are not limited to: personal and mobile computing systems and devices, University of California Appendix
Data Security

8/12/2019 Page 3 of 12
mobile phones, printers, network devices, industrial control systems (including but not limited to: SCADA, PLCs, DPC, Operational Technology, etc.), access control systems, digital video monitoring systems, data storage systems, data processing systems, backup systems, electronic and physical media, biometric and access tokens, Internet of Things (IoT), or any other device that connects to any UC network.

E. “Major Change” means: The implementation of a change that could have an effect on the security of an IT Resource or Institutional Information. The scope includes changes to architectures, processes, tools, metrics, and documentation, as well as changes to IT services and other configuration items. These include changes related to:

1. Technology upgrades or migrations.

2. Responses to Security Incidents.

3. Modifications of scope (data elements, features, location of Institutional Information, etc.).

4. Regulatory guidance.

5. Law and legal regulations.

6. Responses to risk assessments.

7. Addressing vulnerabilities.

8. Material updates or shifts in technologies used by Supplier.

F. “Security Incident” means: (1) A material compromise of the confidentiality, integrity, or availability of Institutional Information; (2) A single event or a series of unwanted or unexpected events that has a significant probability of compromising UC business operations or threatening Institutional Information and/or IT Resources; (3) Any event involving a cyber intrusion; or (4) A material failure of Supplier’s administrative, technical, or physical controls that resulted or could have resulted in an adverse impact to the confidentiality, integrity, or availability of Institutional Information or IT Resources.

ARTICLE 3. ACCESS TO INSTITUTIONAL INFORMATION AND IT RESOURCES A. Supplier must limit its access to, use of, and disclosure of Institutional Information and IT Resources to the least invasive degree necessary required to provide the Goods and/or Services.

1. Supplier may not access or use Institutional Information and IT Resources for any purpose except to provide the Goods and/or Services.

2. For the avoidance of doubt, Supplier may not access, use, or disclose Institutional Information and IT Resources outside the scope of the Agreement for purposes of, including but not limited to: marketing, advertising, research, sale, or licensing unless expressly approved in writing by UC.

B. In the event that Goods and/or Services include the review of a specific Security Incident or a threat to or anomaly in Institutional Information or IT Resources, Supplier must limit inspection to the least invasive degree necessary required to perform the investigation.

University of California Appendix
Data Security

8/12/2019 Page 4 of 12
ARTICLE 4. SUPPLIER’S INFORMATION SECURITY PLAN AND RESPONSIBILITIES A. Supplier acknowledges that UC must comply with information security standards as required by law, regulation, and regulatory guidance, as well as by UC’s internal security program that protects Institutional Information and IT Resources.

B. Supplier must establish, maintain, comply with, and responsibly execute its information security plan.

C. Supplier’s initial information security plan is attached as Exhibit 2 and incorporated by reference.

D. Updates to Exhibit 2 will occur as follows:

1. On an annual basis, Supplier will review its information security plan, update it as needed, and submit it upon written request by UC.

2. In the event of a Major Change, Supplier will review its information security plan, update it as needed, and submit it to UC as detailed herein.

E. If Supplier makes any material modifications to its information security plan that will affect the security of Institutional Information and IT Resources, Supplier must notify UC within seventy-two (72) calendar hours and identify the changes.

F. Supplier’s Information Security Plan must:

1. Ensure the security (including but not limited to: confidentiality, integrity, and availability) of Institutional Information and IT Resources through the use and maintenance of appropriate administrative, technical, and physical controls;

2. Protect against any reasonably anticipated threats or hazards to Institutional Information and IT Resources;

3. Address the risks associated with Supplier having access to Institutional Information and IT Resources;

4. Comply with applicable regulations and/or external obligations listed in Exhibit 1;

5. Comply with all applicable legal and regulatory requirements for data protection, security, and privacy;

6. Clearly document the cybersecurity responsibilities of each party;

7. Follow UC records retention requirements outlined in the Statement of Work (SOW) or in UC’s Terms and Conditions;

8. Prevent the sharing of passwords or authentication secrets that provide access to Institutional Information and/or IT Resources;

9. Prevent the use of passphrases (passwords) or other authentication secrets that are common across customers or multiple unrelated UC sites or units;

10. Prevent unauthorized access to Institutional Information and IT Resources;

11. Prevent unauthorized changes to IT Resources;

12. Prevent the reduction, removal, or turning off of any security control without express written approval from UC;
University of California Appendix
Data Security

8/12/2019 Page 5 of 12

13. Prevent the creation of new Supplier accounts to access Institutional Information and IT Resources without express written approval from UC;

14. Prevent the storing, harvesting, or passing through of UC credentials (username, password, authentication secret, or other factor); and

15. Prevent the use or copying of Institutional Information for any purpose not authorized under the Agreement or any associated Statement of Work (SOW).

ARTICLE 5. REQUESTS FROM UC AND EVIDENCE OF COMPLIANCE
A. Supplier must provide UC with evidence that demonstrates to UC’s reasonable satisfaction Supplier’s adherence to its information security plan (including but not limited to: third-party report, attestation signed by an authorized individual, attestation of compliance by a qualified assessor, or a mutually agreed upon equivalent) upon execution of the Agreement, upon reasonable request (including but not limited to:
annually, after Major Changes, and/or as a result of a Security Incident), or as required by any applicable regulatory or governmental authority.

B. Supplier must respond to UC’s reasonable questions related to cybersecurity controls, Security Incidents, or Major Changes, newly published vulnerabilities, and/or risk assessments within ten (10) business days.

C. UC may request and perform a security audit using a qualified third party or a mutually agreed upon alternative annually or as a result of a Breach.

ARTICLE 6. NOTIFICATION OF MAJOR CHANGES AND VULNERABILITY

DISCLOSURES
A. Within twenty (20) business days, Supplier must notify UC regarding changes in Supplier’s security posture or IT infrastructure. Such notices must occur:

1. When Major Changes happen.

2. When Supplier becomes aware of a vulnerability that warrants a CVE2 rating of “High” or “Critical,” based on the latest CVE version, for which a patch is not yet available or for which Supplier will delay application of an available patch.

B. Supplier must use commercially acceptable efforts to remediate, within twenty (20) business days, any vulnerability rated as CVE High or Critical.

C. In response to Major Changes, Supplier must update its information security plan no later than fifteen (15) days into the next calendar quarter and must provide updated evidence of compliance with the information security plan.

2 Common Vulnerabilities and Exposures (CVE) is a dictionary-type list of standardized names for vulnerabilities and other information related to security exposures maintained by The MITRE Corporation. CVE aims to standardize the names for all publicly known vulnerabilities and security exposures. The goal of CVE is to make it easier to share data across separate vulnerability databases and security tools. The CVE list can be found at:
cve.mitre.org
University of California Appendix
Data Security

8/12/2019 Page 6 of 12
ARTICLE 7. RETURN AND DISPOSAL OF INSTITUTIONAL INFORMATION A. Within thirty (30) calendar days of the termination, cancellation, expiration, or other conclusion of the Agreement, Supplier must return all Institutional Information to UC and then dispose of the Institutional Information in possession of Supplier as detailed herein. This provision also applies to all Institutional Information that is in the possession of sub-suppliers or agents of Supplier.

B. Such disposal will be accomplished using the methods described in UC’s Institutional Information Disposal Standard
(https://security.ucop.edu/policies/institutional-information-disposal.html) or an alternative approved by UC.

C. Supplier will certify in writing to UC that such return and/or disposal has been completed.

D. If Supplier believes that return and/or disposal of Institutional Information is technically impossible or impractical, Supplier must provide UC with a written statement explaining the reason for this conclusion. If UC determines that return and/or disposal is technically impossible or impractical, Supplier will continue to protect the Institutional Information in accordance with the terms of this Appendix for as long as the Institutional Information is in Supplier’s possession.

ARTICLE 8. NOTIFICATION OF CORRESPONDENCE CONCERNING INSTITUTIONAL

INFORMATION
A. Supplier agrees to notify UC promptly, both orally and in writing, but in no event more than seventy-two (72) calendar hours after Supplier receives correspondence or a complaint that relates to a regulation, contractual obligation, Breach, or material risk concerning Institutional Information. For purposes of this Article 8.A, a correspondence or complaint may include, but is not limited to, any communication that originates from law enforcement, regulatory or governmental agencies, government investigators, corporations, or an individual, but excludes normal customer service correspondence or inquiries.

ARTICLE 9. COORDINATING, REPORTING, AND RESPONDING TO BREACHES AND

SECURITY INCIDENTS
A. Reporting of Breach or Security Incident: If Supplier reasonably suspects or confirms a Breach and/or a Security Incident impacting Institutional Information and/or IT Resources, Supplier must promptly notify UC both orally and in writing using the contacts in the Agreement. Supplier must provide such notifications no later than (1) seventy-two (72) calendar hours after the initial suspicion of a Security Incident and/or Breach and (2) seventy-two (72) calendar hours after the initial confirmation of a Security Incident and/or Breach, if Supplier is able to make such a confirmation. Supplier’s notification must identify:

1. Contacts for both technical and management coordination; University of California Appendix
Data Security

8/12/2019 Page 7 of 12

2. Escalation and identifying information, such as ticket numbers, system identifiers, etc.;

3. The nature of the Breach and/or Security Incident;

4. The Institutional Information and/or IT Resources affected;

5. What Supplier has done or will do to mitigate any deleterious effect; and

6. What corrective action Supplier has taken or will take to prevent future Security Incidents.

B. Supplier will provide other information as reasonably requested by UC.

C. In the event of a suspected Breach and/or Security Incident, Supplier will keep UC informed regularly of the progress of its investigation until the incident is resolved.

D. Coordination of Breach Response or Security Incident Activities: Supplier will fully cooperate with UC’s investigation of any Breach and/or Security Incident involving Supplier and/or Goods and/or Services. Supplier’s full cooperation will include, but not be limited to, Supplier:

1. Promptly preserving any potential forensic evidence relating to the Breach and/or Security Incident;

2. Remedying the Breach and/or Security Incident as quickly as circumstances permit;

3. Promptly, but no more than seventy two (72) calendar hours after the discovery of Breach and/or Security Incident, designating a contact person to whom UC will direct inquiries and who will communicate Supplier responses to UC inquiries;

4. As rapidly as circumstances permit, assigning/using appropriate resources to remedy, investigate, and document the Breach and/or Security Incident, to restore UC service(s) as directed by UC, and undertake appropriate response activities;

5. Providing status reports to UC regarding Breach and Security Incident response activities, either on a daily basis or a frequency approved by UC;

6. Coordinating all media, law enforcement, or other Breach and/or Security Incident notifications with UC in advance of such notification(s), unless expressly prohibited by law;

7. Ensuring that knowledgeable Supplier employees are available on short notice, if needed, to participate in UC and Supplier initiated meetings and/or conference calls regarding the Breach and/or Security Incident; and

8. Ensuring that knowledgeable Supplier employees and agents participate in after-action analysis, including root cause analysis and preventive action planning.

E. Breaches and Security Incidents – Corrective And Preventive Action: As a result of a Breach and/or Security Incident impacting Institutional Information and/or IT Resources, and upon UC’s request, Supplier must prepare a report detailing corrective and preventive actions. The report must include:

University of California Appendix
Data Security

8/12/2019 Page 8 of 12

1. A mutually agreed upon timeline for the corrective and preventive actions based on the nature of the Breach and/or Security Incident;

2. Identification and description of the root causes; and

3. Precise steps Supplier will take to address the failures in the underlying administrative, technical, and/or physical controls to mitigate damages and future cyber risk.

F. Costs: Supplier must reimburse UC for reasonable costs related to responding to Breaches impacting Institutional Information and IT Resources caused by Supplier. This includes all costs associated with notice and/or remediation of the Breach.

G. Grounds for Termination: Any Breach may be grounds for termination of the Agreement by UC. Agreement obligations to secure, dispose, and report continue through the resolution of the Breach and/or Security Incident.

ARTICLE 10. ILLICIT CODE WARRANTY
A. Supplier represents and warrants that the Goods and/or Services do not contain Illicit Code.

B. To the extent that any Goods and/or Services have Illicit Code written into them, Supplier will be in breach of this Agreement, and no cure period will apply.

C. Supplier agrees, in order to protect UC from damages that may be intentionally or unintentionally caused by the introduction of Illicit Code, to promptly isolate or otherwise secure and then return Institutional Information and/or IT Resources.

D. Supplier acknowledges that it does not have any right to electronically hold Institutional Information or assert any claim against UC by withholding the Goods and/or Services using Illicit Code.

E. Should Supplier learn of the presence of Illicit Code, Supplier will promptly provide UC with written notice explaining the scope and associated risk.

F. Supplier represents and warrants that it will take commercially reasonable steps to promptly remove Illicit Code.

G. Supplier represents and warrants that even if Illicit Code is unintentionally installed via any method, Supplier will never utilize the Illicit Code.

H. This provision does not relate to malware or viruses that attack the running IT Resource. These are covered under ARTICLE 9 - COORDINATING, REPORTING, AND RESPONDING TO BREACHES AND SECURITY INCIDENTS.

ARTICLE 11. BACKGROUND CHECKS
A. Before Supplier’s employee, sub-supplier, or agent may access Institutional Information and/or IT Resources classified at Protection Level 3 or Protection Level 43, Supplier must conduct a thorough and pertinent background check. Supplier must evaluate the results prior to granting access in order to assure that there is no indication

3 See Exhibit 1.

University of California Appendix
Data Security

8/12/2019 Page 9 of 12
that the employee, sub-supplier, or agent presents a risk to Institutional Information and IT Resources.

B. Supplier must retain each employee’s, sub-supplier’s, or agent’s background check documentation for a period of three (3) years following the termination of the Agreement.

University of California Appendix
Data Security

8/12/2019 Page 10 of 12
Exhibit 1 – Institutional Information

1. Protection Level Classification4:
 Protection Level 1
 Protection Level 2
 Protection Level 3
 Protection Level 4
Explanation: [Optional, add detail if needed, may be covered in SOW] The Protection Level determines the applicable cyber security insurance requirement in the Terms and Conditions.

2. Institutional Information data element descriptors:

Select all data types that apply:

A.  Animal Research Data.

B.  Controlled Technical Information (CTI).

C.  Controlled Unclassified Information (CUI) – 800-171/NARA.

D.  Defense Department: Covered Defense Information (CDI).

E.  Federal Acquisition Regulations (FARS/DFAR) other than CUI.

F.  GDPR personal data.

G.  GDPR special data.

H.  Health data – other identifiable medical data not covered by HIPAA. (Including but not limited to: occupational health, special accommodation, or services qualification, etc.)
I.  Health Records subject to HIPAA Privacy or Security Rule (PHI).

J.  Human Subject Research Data.

1.  Identified.

2.  Anonymized.

K.  Intellectual property (IP), such as patents, copyright, or trade secrets.

L.  ITAR/EAR-controlled data.

M.  Payment card data (PCI, PCI DSS).

N.  Personally identifiable information – PII.

O.  Student data, whether or not subject to FERPA.

P.  Other: __________________________________________________________ Q.  Other: __________________________________________________________

4 For reference see: https://security.ucop.edu/policies/institutional-information-and-it-resource-classification.html University of California Appendix
Data Security

8/12/2019 Page 11 of 12
R.  Other: __________________________________________________________ S.  Other: __________________________________________________________

3. Institutional Information Regulation or Contract Requirements:

Select all regulations or external obligations that apply to inform UC and the Supplier of obligations related to this Appendix:

Privacy (* indicates data security requirements are also present) A.  California Confidentiality of Medical Information Act (CMIA) *.

B.  California Consumer Privacy Act (CCPA).

C.  California Information Practices Act (IPA).

D.  European Union General Data Protection Regulation (GDPR)*.

E.  Family Educational Rights and Privacy Act (FERPA) *.

F.  Federal Policy for the Protection of Human Subjects (“Common Rule”).

G.  Genetic Information Nondiscrimination Act (GINA).

H.  Gramm-Leach-Bliley Act (GLBA) (Student Financial Aid) *.

I.  Health Insurance Portability and Accountability Act/Health Information Technology for Economic and Clinical Health Act (HIPAA/HITECH) *.

J.  Substance Abuse and Mental Health Services Administration SAMHSA (CFR 42 Part 2).

K.  The Fair and Accurate Credit Transaction Act (FACTA).

L.  The Fair Credit Reporting Act (FCRA).

Data Security
M.  Chemical Facility Anti-Terrorism Standards (CFATS).

N.  Defense Federal Acquisition Regulations (DFARS).

O.  Export Administration Regulations (EAR).

P.  Federal Acquisition Regulations (FARS).

Q.  Federal Information Security Modernization Act (FISMA).

R.  International Traffic in Arms Regulations (ITAR).

S.  Payment card data (PCI, PCI DSS).

T.  Toxic Substances Control Act (TSCA).

U.  Other: __________________________________________________________ V.  Other: __________________________________________________________ W.  Other: __________________________________________________________ X.  Other: __________________________________________________________

University of California Appendix
Data Security

8/12/2019 Page 12 of 12
Exhibit 2
Supplier’s Initial Information Security Plan

[Supplier to provide and update per the Appendix DS requirements.] •.UNIVERSITY
0F

CALIFORNIA
Appendix—BusinessAssociateAgreement
ThisAppendix-BusinessAssociateAgreement(‘AppendixBAA”)supplementsandismadeapartof anyandallagreementsenteredintobyandbetweenTheRegentsoftheUniversityofCalifornia,a Californiacorporation(“UC”),onbehalfofitsUniversityofCaliforniaHealthSystemand ____________________________________
BusinessAssociate(“BA”).

RECITALS
A.UCisa“CoveredEntity”asdefinedunder45C.F.R.§160.103
B.UCandBAareenteringintoorhaveenteredinto,andmayinthefutureenterinto,oneormore agreements(eachan“UnderlyingAgreement”)underwhichBAperformsfunctionsoractivitiesforor onbehalfof,orprovidesservicestoUC(“Services”)thatinvolvereceiving,creating,maintaining and/ortransmittingProtectedHealthInformation(“PHI”)ofUCasa“BusinessAssociate”ofUCas definedunder45C.F.R.§160.103.ThisAppendixBAAshallonlybeoperativeintheeventandtothe extentthisAppendixBAAisincorporatedintoanUnderlyingAgreementbetweenUCandBA.

C.UCandBAdesiretoprotecttheprivacyandprovideforthesecurityofPHIusedbyordisclosedtoBA incompliancewiththeHealthInsurancePortabilityandAccountabilityActof1996(“HIPAA”),the regulationspromulgatedthereunderbytheU.S.DepartmentofHealthandHumanServices(45C.F.R.

Parts160,162and164)(the“HIPAARegulations”),theHealthInformationTechnologyforEconomic andClinicalHealthActof2009(the“HITEçHAct”),CaliforniaCivilCode§56etseq.,§1798.82 and1798.29,andotherapplicablelawsandregulations.ThepurposeofthisBAAgreementistosatisfy certainstandardsandrequirementsofHIPAA,theHIPAARegulations,including45CFR§164.504(e), theHITECHAct,includingSubtitleD,part1,astheymaybeamendedfromtimetotime,andsimilar requirementsunderCalifomialaw.

D.UChasdesignatedallofitsHIPAAhealthcarecomponentsasasinglecomponentofitshybridentity andthereforethisBAAgreementisbindingonallotherUChealthcarecomponents(collectively,the SingleHealthCareComponentortheSHCC).ThisBAAgreementiseffectiveonthedateofthe UnderlyingAgreementunderwhichBAprovidesServicestoUC(“EffectiveDate”).

1.DEFINITIONS
ExceptforPHI,allcapitalizedtermsinthisAppendixBAAshallhavethesamemeaningasthoseterms intheHIPAARegulations.

PHIshallhavethesamemeaningas“protectedhealthinformation”intheHIPAARegulationsthatis created,received,maintained,ortransmittedbyBusinessAssociateoranySubcontractoronbehalfofUC andshallalsoinclude“medicalinformation”asdefinedatCal.Civ.Code§56.05. 1 8.1.19

2.OBLIGATIONSOFBA
BAagreesto:

A.ComplywiththerequirementsofthePrivacyRulethatapplytoUCincarryingoutsuchobligations, totheextentBAcarriesoutanyobligationsofUCunderthePrivacyRule.BAalsoagreestocomply withtherequirementsofCaliforniastateprivacylawsandregulationsthatapplytoUCincarryingout suchobligations,totheextentBAcarriesoutanyobligationsofUCunderCaliforniaCivilCode§1798 etseq.,CaliforniaCivilCode§56etseq.,andCaliforniaHealth&SafetyCode§1280.15and 1280.18,asapplicable,unlessotherwisemutuallyagreedtobyBAandUC.

B.NotUseorDisclosePHIotherthanaspermittedorrequiredbytheUnderlyingAgreementoras requiredbylaw.

C.Useappropriatesafeguards,andcomply,whereapplicable,with45C.F.R.§164SubpartCwith respecttoePHI,topreventtheUseorDisclosureofPHIotherthanasprovidedforbytheUnderlying Agreement(s)andtheAppendixBAA.

D.NotifiUC,orallyandinwriting,assoonaspossible,butinnoeventmorethanfive(5)calendar days,afterBAbecomesawareofanyUseorDisclosureofthePHInotpermittedorrequiredbythe AppendixBAAorUnderlyingAgreement(s),includingBreachesofunsecuredPHIasrequiredby45 C.F.R.§164.410andpotentialcompromisesofUCPHI,includingpotentialinappropriateaccess, acquisition,useordisclosureofUCPHI(each,collectivelyan“Incident”).BAshallbedeemedtobe awareofanysuchIncident,asofthefirstdayonwhichitbecomesawareofit,orbyexercising reasonablediligence,shouldhavebeenknowntoitsofficers,employees,agentsorsub-suppliers.The notificationtoUCshallinclude,totheextentpossible,eachindividualwhoseunsecuredPHIhas been,orisreasonablybelievedbyBAtohavebeen,accessed,acquired,usedordisclosedduringsuch Incident.BAshallfurtherprovideUCwithanyotheravailableinformationthatUCisrequiredto includeinanotificationtoaffectedindividualsatthetimeofthenotificationtoUC,orpromptly thereafterasinformationbecomesavailable.BAshalltakepromptcorrectiveactiontoremedyany suchIncident,and,assoonaspossible,shallprovidetoUCinwriting:(i)theactionsinitiatedbythe BAtomitigate,totheextentpracticable,anyharmfuleffectofsuchIncident;and(ii)thecorrective actionBAhasinitiatedorplanstoinitiatetopreventfuturesimilarIncidents.

E.EnsurethatanySubcontractorsthatcreate,receive,maintain,ortransmitPHIonbehalfoftheBAagree tothesamerestrictions,conditions,andrequirementsthatapplytotheBAwithrespecttosuchPHI.

F.IfBAmaintainsPHIinaDesignatedRecordSet,BAshallmakethePHIintheDesignatedRecordSet availabletoUC,orifdirectedbyUCtotheIndividualortheIndividual’sdesignee,asnecessaryto satisfyUC’sobligationsunder45C.F.R.§164.524.

G.IfBAmaintainsPHIinaDesignatedRecordSet,BAshallmakeanyamendmentsdirectedoragreed tobyUCpursuantto45C.F.R.§164.526,ortakeothermeasuresasnecessarytosatisfyUC’s obligationsunder45C.F.R.§164.526.
2 8.1.19
H.MaintainandmakeavailabletheinformationrequiredtoprovideanaccountingofdisclosurestoUC, orifdirectedbyUCtotheIndividual,asnecessarytosatisfyUC’sobligationsunder45C.F.R.§ 164.528.

I.Makeitsinternalpractices,books,andrecords,relatingtotheUseandDisclosureofPHIavailableto UC,andtotheSecretaryforpurposesofdeterminingUC’scompliancewithHIPAA,HITECHand theirimplementingregulations.

3.PERMITTEDUSESANDDISCLOSURESBYBA
BAmayonlyUseorDisclosetheMinimumNecessaryPHItoperformtheservicessetforthinthe UnderlyingAgreement.

4.TERMANDTERMINATION
A.TerminationforCause.UCmayterminatethisAppendixBAAandanyUnderlyingAgreement(s),if UCdeterminesBAhasviolatedamaterialtermoftheAppendixBAA.

B.UponterminationofthisAppendixBAAforanyreason,withrespecttoPHIreceivedfromUC,or created,maintained,orreceivedbyBAonbehalfofUC,BAshallreturntoUC,orifagreedtobyUC, destroy,allsuchPHIthatBAstillmaintainsinanyform,andretainnocopiesofsuchPHI.

TotheextentreturnordestructionofUCPHIisnotfeasible,BAshall(1)retainonlythatPHIwhich isnecessaryforBAtocontinueitspropermanagementandadministrationortocarryoutitslegal responsibilities;and(2)continuetouseappropriatesafeguardsforsuchUCPHIandcomplywith SubpartCof45C.F.R.Part164withrespecttoePHItopreventUseorDisclosureofthePHI,other thanasprovidedforinthisSection,foraslongasBAretainsthePHI.

C.Survival.TheobligationsofBAunderthisSection4.BshallsurvivetheterminationofthisAppendix BAAandanyUnderlyingAgreement(s).

TheAppendixBAAissignedbelowbytheparties’dulyauthorizedrepresentatives.

THEREGENTSOFTHEBUSINESSASSOCIATE

UNIVERSITYOFCALIFORNIA
(SupplierName)
(Signature)(Signature)
/I1
___________
‘PrintedNameTitle)(PrintedNameTitle)
-
(Date)(Date)
3 8.1.19

Revised 7/12/2017 Page 1 of 7

ATTACHMENT A TO PURCHASING AGREEMENT #______

STATEMENT OF WORK

This Statement of Work # __ (“SOW”) is issued pursuant to Purchasing Agreement #_______ dated _______________, 20__ between UC and Supplier (“Agreement”).

1. Title and Description of the Scope of Goods and/or Services [Buyer: Provide an overview and background of Goods and/or Services to be provided.]

2. Term of SOW
This SOW will begin on __________, 20__ (“Effective Date”) and continue through ______________, 20__.

This SOW may not be renewed or otherwise amended except through a Change Order pursuant to the Change Management section below.

3. Key Tasks and Activities, Deliverables and Completion Timeframe Supplier Obligations
Task Activities Deliverables
Completion
Date or
Timeframe
1 [General
description]
[Specific details using action
verbs like “create”, “develop”,
“test”, “analyze”, “evaluate”,
etc.]
[List each discrete
tangible work
product that is
considered a
critical end result
from the Supplier;
deliverables are
nouns, not verbs]
[Specific
dates are
best; can be
stated as
“Week 1”,
“Week 2”,
etc.]
2 3
4 5
Additional
as needed

Include: Identify all phases. If
additional phases will not be
known until first phase work
begins, be sure to specify
hourly rate and a not to
exceed price for this work.

Request Supplier to provide
data type, protected health
information and other data

Revised 7/12/17 Page 2 of 7

4. UC Obligations
[Buyer: Include as appropriate language such as: UC will provide working space, equipment, furniture, utilities, and services, as follows:]

5. Place(s) of Performance
[Buyer: Use this section if appropriate to outline where Services will be provided]

6. Key Personnel
Supplier’s Account Manager is listed below , is subject to UC approval, and has overall responsibility for managing the UC/Supplier relationship:

Name
Phone
Email
Address

Subcontractors authorized to provide Goods and/or Services under this SOW [Buyer: Names should be listed only if Agreement permits use of subcontractors]:

Name of Subcontractor Goods and/or Services the
Subcontractor will provide

Revised 7/12/17 Page 3 of 7

Supplier’s Account Management Team is:

Name
Phone
Email
Address

Name
Phone
Email
Address

Name
Phone
Email
Address

Name
Phone
Email
Address

UC’S Project Manager, responsible for acceptance/rejection of project results/deliverables, is:

Name
Phone
Email
Address

7. Reporting Requirements
[Buyer: Identify any key reports that should be produced by Supplier or critical reporting events. This can be included in the table above if preferred.]

Supplier agrees to provide other reports as reasonably requested by UC during the Term of the Agreement and any extension(s) to the Term at no additional cost to UC.

8. Assumptions
a) The following items are not included within the scope of Goods and/or Services to be provided under this SOW: [Buyer: Delete if not needed]
b) [Buyer: Add more as needed]
c) Additional assumptions include the following: [ Buyer: Delete if not needed, but list any UC dependencies that must be fulfilled in order for Supplier to provide the Goods and/or Services] d) [Buyer: Add more as needed]

Revised 7/12/17 Page 4 of 7

9. Service Level Agreement
a) [Buyer: Any critical SLAs should be stated here. For goods, consider the following language:] During the Term of the Agreement, and any extension(s) of the Term, Supplier will provide the following minimum service standards:

Normal delivery -next business day
Rush delivery -within 4 hours
Pick up returns -within 2 business days
Request for reports -within 5 business days
Order fill rate -98%
Delivery accuracy -98%
Delivery, on-time -98%
Invoice/billing accuracy -98%
Customer service satisfaction -98%

The minimum service standards set forth above recognize that occasional errors are likely; however, Supplier further agrees to use its best efforts to achieve 100% of service levels. Should the service levels fall below the minimum standards and Supplier does not take corrective action within fourteen (14) days following UC written notification, UC reserves the right to terminate the Agreement immediately.

10. Pricing, Invoicing Method, and Settlement Method and Terms [Buyer: Pricing includes the contract amount (for instance, time and materials using an hourly rate; whether there is a not to exceed cap; and flat fee); and the payment schedule (what percentage must be paid at what times, including milestones)]
Pricing is addressed below. The Invoicing Method, and Settlement Method and Terms are addressed in the applicable Agreement. As regards Invoicing Method, and Settlement Method and Terms, the terms of the applicable Agreement will take precedence over any conflicting terms in this Statement of Work. a) “Fixed Price Services” to be rendered under this SOW, including deliverables to be provided as part of Fixed Price Services, are described in this section as:
b) “Time and Materials Services” to be rendered under this SOW, including deliverables to be provided as part of Time and Materials Services:
c) The rates applicable to each person who will render Time and Materials Services are as follows:

Name and Title of Person
Rendering Services
Rate per
Hour/Day
Estimated No. of
Days
Extended
Cost of
Fees
UC MRC

Estimated Maximum Expenses (if any): n/a

Revised 7/12/17 Page 5 of 7

Estimated Maximum Cost:

d) [Buyer: Outline Payment Schedule as needed]

11. Program Requirements
[Buyer: If items will be ordered by catalog, use the Appendix – Electronic Commerce. If applicable, consider using these additional terms for Goods:]

Order Packaging and Labeling. Supplier agrees that each UC order will be individually wrapped and labeled with the following information:

Purchase Order number;
Product description, quantity and catalog number of the product ordered and an open 30-character field for internal identification e.g., UC storehouse catalog numbers and/or internal customer order numbers; and
Other information, as may be requested by ordering UC Location.

Packaging slips will be attached to the outside of the package such that it can be inspected by UC at the requesting department and/or receiving dock.

Receiving Locations. Supplier agrees to provide desktop and dock delivery to all UC current and future authorized personnel delivery points, as requested by UC.

Standard Delivery Requirements. Supplier will deliver Monday through Friday, excluding UC- and Supplier- observed holidays. Supplier provide UC with a schedule on or before September 1 of the following calendar year showing holidays and other planned shutdowns (such as the annual inventory) that would impact Supplier’s ability to deliver the Goods and/or Services. Supplier agrees to deliver all UC orders received by 3:30pm Pacific Time the next business day as follows:

Campus direct (desktop delivery) - by 3:30 pm Pacific Time Storehouse (drop ship delivery) - by 10:00 am Pacific Time

Delivery Delays. Supplier will report any delivery delay whatsoever to the ordering Location, as well as its cause, within two (2) hours after Supplier is able to reasonably determine there will be a delay; the report will be provided to UC by telephone, e-mail, or facsimile. Supplier will keep UC fully informed and will take all reasonable action in eliminating the cause of delay.

Rush Delivery Requirements . Supplier agrees to deliver UC emergency orders within four (4) hours after receipt of order at no additional charge to UC. Rush delivery orders for same day delivery must be requested by UC prior to 1:00 pm Pacific Time. Supplier cannot guarantee, but agrees to use good faith efforts to provide same day delivery for rush orders UC places after 1:00 pm Pacific Time.

Returns. Supplier agrees to accept Goods returned by UC if in resalable condition and if made within thirty (30) days of original shipment. Supplier must pick up returns from the ordering department location within two business days. Services under $20.00 do not need to be physically returned to Supplier.

Credit. Requests for credit can be transmitted by the ordering UC personnel via the e stablished order management system (telephone, fax, paper return form, and web-based). Chargebacks and credit memos will be issued to UC ordering departments in the current month’s billing period. Return items will be credited at cost. If Goods were purch ased via UC purchasing card, credit must be issued to the same purchasing card.

Revised 7/12/17 Page 6 of 7

Out of Stock Items. If there is an out of stock situation of any ordered inventoried item(s), the out of stock item will be added to the back order file and will be delivered to UC when the item is in stock without a further order being submitted.

Surveys. Supplier will, at UC’s request, conduct customer surveys of UC orders through questionnaires. The content of these surveys will be approved by UC. UC will be responsible for the tabulation of these surveys.

12. Acceptance Criteria and Testing
[Buyer: Provide details of the Acceptance Criteria and testing which each Deliverable or Milestone must meet to be accepted, if specifics aren’t defined.]
a) [Buyer: Indicate any additional financial or other considerations resulting from acceptance testing]

13. Changes to the Services
UC may desire to change the Goods and/or Services following execution of an SOW. If so, UC will submit a written Amendment to Supplier describing the changes in appropriate detail . If an Amendment does not require Supplier to incur any additional material costs or expenses, then Supplier will make the modification within ten (10) business days of Supplier’s receipt of UC’s Amendment. If an Amendment does require that Supplier incur additional mater ial costs or expenses, then Supplier in good faith will provide UC with a written, high level, non-binding assessment of the costs and expenses and the time required to perform the modifications required by the Amendment , within ten (10) business days of S upplier’s receipt of UC’s Amendment. UC will notify Supplier in writing within ten (10) business days after receipt of Supplier’s response to the Amendment as to whether UC wishes Supplier to implement the Amendment based on the response. UC will compensate Supplier for implementation of an Amendment in accordance with the terms and conditions of the relevant Amendment and Supplier’s response to the Amendment, if any. Supplier’s implementation of a n Amendment will not delay the performance of Services and/or the delivery of deliverables not reasonably affected by an Amendment.

14. No Mandatory Use
Because there is no mandatory use policy at UC, nothing in this Statement of Work will be construed to prevent UC from entering into similar agreements with any third parties including, without limitation, suppliers that may be in competition with Supplier.

15. Additional Terms
[Buyer: If recording devices will be allowed, add the following: Supplier will use recording devices in discussions with UC employees only when UC and the employees so authorize; this authorization must be in writing. If applicable, Supplier's use of recording devices in such discussion is proposed as follows:
(Insert terms)]
Insurance Requirements [Buyer: insert terms, if needed or different from basic levels in T&Cs]

Revised 7/12/17 Page 7 of 7

This Statement of Work is signed below by the parties’ duly authorized representatives.

THE REGENTS OF THE [SUPPLIER NAME]

UNIVERSITY OF CALIFORNIA

________________________________ ____________________________________ (Signature) (Signature)

________________________________ ____________________________________ (Printed Name, Title) (Printed Name, Title)

________________________________ ____________________________________ (Date) (Date)

Value Added Facility Planning
Solutions and Pricing

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 2

Background Information
Gordian’s Facility Planning solutions were first provided by a strategic consulting firm, Sightlines, founded in 2000 with the mission of enabling organizations to better manage their facilities operations and capital investments using objective data analytics and expertise. In 2015, Sightlines was acquired by Gordian to deliver a full life cycle of construction and facilities management services. Gordian’s Planning services assess the current conditions of an organizations facilities, analyze the operational performance of those facilities, and benchmark every aspect of their operation against peers in order to make reliable, data- driven decisions that support the overall strategy of the organization.

Gordian has delivered Planning solutions to more than 450 organizations across North America and stewards the largest verified database (representing more than 1.5 billion gross square feet) of Higher Ed, Healthcare, and Community facilities information. Gordian’s experience in construction procurement and cost estimating through RSMeans data provides access to hundreds of planning, design, procurement, construction and operations experts.

Our third-party independent perspective is key to our success. Since our core business is the measurement and strategic assessment of facilities assets, we help drive new policies that create change and improve facilities operations. Gordian professionals’ experience within both the facilities and financial arenas provides member organizations with solutions that are realistic, quantifiable, and financially obtainable.

Our analysis remains rigorous and completely objective.

Gordian proposes to include our Planning services in response to this RFP in order to make these services available to both University campuses, as well as Omni members through the adoption of this contract by Omnia.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 3

Gordian’s Planning service offerings include:

Sightlines Return on Physical Assets (ROPA): Physical facilities represent the largest investment most organizations will make. Most see buildings as a depreciating asset and look to avoid expenditures unless absolutely necessary rather than treat them as real investments and seek a strong return.

ROPA provides the data, contextual understanding and strategic recommendations needed to steward facilities most effectively. Gordian partners with organizations to develop an analytical framework and dialogue with stakeholders that aligns space, capital and operational needs. This objective analysis of performance provides facilities and finance administrators with the context and validation needed to evaluate investment tradeoffs and helps ensure facilities best serve the community.

Sightlines Strategic Capital Planning: In today’s facilities environment, there is always going to be more capital need than available funding. So how does an organization decide which projects to fund and which to defer? To answer the question, many organizations conduct a facilities condition assessment (FCA) to understand the magnitude of the problem. Although often successful at establishing the funding shortfall and level of deficiencies, these studies rarely result in the actionable plans and campus-wide support for the capital strategy that is needed to address the core issues that leaders face.

Strategic Capital Planning takes the FCA to the next level utilizing engineering professionals and data analysts who do more than merely assemble a list of needs. Gordian works hand in hand with the facilities managers and other key stakeholders to engage across the organization or community to design capital plans that marry technical needs with strategic vision and financial capacity. Using our Building Portfolio process, Gordian takes an overwhelming backlog and guides decision making so organizations can improve their facilities and slow the ongoing rate of project deferral.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 4

Sightlines Space Utilization: Colleges and universities are under more pressure than ever to use campus spaces to their full potential. Finding common ground with stakeholders can be difficult in the face of demands to decrease costs, respond to changing enrollment and fairly evaluate space ownership.

Using advanced data analytics and a thorough assessment of teaching spaces, Sightlines Space Utilization offers the tools that will help separate fact from fiction around space usage, optimize the use of existing assets to avoid unnecessary costs and provide a foundation for strategic campus growth. Tailored recommendations empower administrators to make more informed decisions, negotiate around both shared and owned spaces and produce results that satisfy all campus stakeholders.

Sightlines Sustainability Solutions: Being an effective steward of your facilities is one thing. Acting as a good steward of the environment requires a different set of tools entirely.

Gordian provides campus sustainability professionals with Benchmarking and Reporting tools that ease the time-consuming burden of continuous data collection and reporting. This opens up more time for pursuing their true mission: advocating and implementing campus policies that minimize impact on the planet. Whether the goal is to measure carbon footprint, fulfill STARS, Carbon Commitment, Sierra Club and/or Princeton Review reporting requirements, Gordian has a sustainability solution that can help.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 5

Sightlines Return on Physical Assets
Scope of Work
It can be hard to know which choices about your space, capital and operations are the right ones.

Sightlines Return on Physical Assets (ROPA) provides the data-based perspective, contextual understanding and strategic recommendations needed to help you take informed action to evolve your facilities to their ideal future state. We’ll work with you to establish an analytical framework for facilities decision-making, so you’re certain your choices are founded on objective data and tied to historical and peer performance. As your trusted long-term partners, we’ll be by your side with decades of industry experience and an unbiased perspective to guide you through your critical business decisions.

The ROPA Decision-Making Framework

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 6

What Can ROPA Do For You?
Establish Clear Communication and Action-Planning Across Your Organization By defining a common vocabulary around facilities issues and creating alignment on priorities from boiler room to boardroom, our proprietary decision-making framework gives business officers and facilities managers the tools they need to articulate their shared vision for the community, institution, or district.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 7

Technical Approach
Data Discovery and Benchmarking
Our proprietary model helps you take a vast amount of facilities data and turn it into actionable information for optimal decision-making. Our team leads a discovery process at every organization by extracting large amounts of base data from disparate local sources and converting it into usable information and knowledge. We create a historical performance profile and peer comparisons which lead to objective observation, contextual understanding and strategic discussion.

Process specifics:
 Conduct onsite collection and assembly of space, capital and operations data to create a minimum five-year performance trend for over 200 facilities metrics  Data is processed using Gordian’s standard Quantify, Verify, Qualify (QVQ) approach to ensure consistent data collection, accurate performance measurement and confidence in comparative information
 Longitudinal and comparative benchmarks are created to identify areas of opportunities and see how your performance stacks up against peers to help improve your competitive edge  Issues are examined to understand impact on performance and set balanced investment targets  Objective observations are shared to fuel knowledge-based decisions and strategies Capital Renewal Projections
We take a detailed look at your facilities lifespan, spending patterns and average growth of deferred maintenance to provide an accurate projection of future investment needs. By anticipating capital

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 8

renewal needs, you’re able to better align funding with priority projects and prevent future accumulation of critical deferred maintenance.

Process specifics:
 Accurately project 10-year system-level needs based on modeled life cycle cost data and institutional knowledge
 Compare projected investment capacity with future needs to measure impact of investments on deferred maintenance
 Develop action plans to lower the risk of system failures and improve the educational experience Performance Measurement & Optimization
We provide an invaluable continuous improvement cycle by acknowledging historical accomplishments, setting targets based on internal goals and industry best practices and ensuring progress is sustained.

Process specifics:
 Identify key operating and capital metrics and establish strategic objectives for each  Create performance dashboards to select and manage changes by targeting improvement opportunities and defining the pace of change
 Track results against best-in-class performers
 Reevaluate goals as your physical profile evolves

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 9

Base Data Collected

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 10

Deliverables
Over 50% of the organizations we work with have us presenting directly to their Board of Trustees or senior leadership to make the case for facilities stewardship. Our third-party perspective gives us the ability to effectively remove subjectivity and make credible recommendations that speak to the concerns of all stakeholders and help you reach the best outcomes for your organization. Our success tells us that effective deliverables must be understandable from the boiler room to the boardroom. Therefore, strategic and technical information must be integrated to ensure policy initiatives can be easily translated into tactical actions for implementation at all levels of the organization. During our initial year, Gordian will provide three presentations as deliverables:
 A data qualification meeting as part of the QVQ process  Preliminary presentation that shares initial findings and strategic recommendations with leadership
 Presentation of findings developed in conjunction with the member to deliver a focused, simplified story to an executive or board-level audience In addition, after the findings are delivered the Gordian team stays engaged across the rest of the year to provide additional analysis and support, as well as explore with your team ways of driving the gained knowledge into actionable plans and offer an added perspective with actions at other organizations.

Subsequent years feature two presentations: a qualification and a final. Presentations are trustee quality and encourage key organizational personnel to participate in the final deliverable presentation.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 11

In addition to presentation deliverables, key organizational personnel receive access to the Gordian’s Member Portal, an online platform that provides quick access to facilities data, the ability to run comparative reports among all other Gordian Members and read access to reports and deliverables.

Project Schedule
Below is a typical schedule for the initial year of our ROPA service. Gordian takes you from data to discovery in 15-18 weeks depending on organizational schedules, facilities staff availability, data complexity and presentation milestones. Upon proposal acceptance, we will contact you to formalize our service schedule.

Typical Startup Schedule

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 14

Sightlines Strategic Capital Planning
Executive Summary
The purpose of this document is to put forth a proposal for strategic analysis of facility needs and financial investment priorities through our Sightlines Strategic Capital Planning service. The goal of this service is to go beyond the traditional facilities condition assessment (FCA) and help your organization develop an actionable, long-term capital plan that aligns with strategic vision and financial realities to ensure each dollar is allocated to the highest priorities.

Our work with over 350 communities, institutions, and districts annually gives us unparalleled perspective on facilities stewardship strategies. It is this perspective that allows us to firmly state capital planning is more than just a project list. Rather than simply “picking projects” from technical condition data, we will help you create a multi-year investment plan that aligns facilities and strategic priorities and engages decision-makers in a conversation about vision and financial realities.

By taking a different, more strategic and portfolio-based approach to managing your capital needs, Strategic Capital Planning is the comprehensive solution you need to make your facilities renewal more manageable and align project selection with strategic goals to achieve optimal investment outcomes.

Scope of Work
Gordian has developed a series of tools that will assist your community, institution or district in defining a multi-year investment plan instead of simply picking projects. The Strategic Capital Planning solution brings the concepts of financial investment and portfolio-based wealth management to the facilities

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 15

world, treating each building and grounds feature as an investment-worthy asset rather than a financial liability. This strategic focus allows decision-makers to target investments that reflect your mission and vision and ensure each dollar is allocated to the highest priority.

Unlike traditional facilities assessments that lead to disjointed project selection, our process builds transparency and constituency by engaging all levels of the organization from the boiler room to the board room. A focus on defined outcomes and total organizational engagement builds confidence in the process and the anticipated results.

Gordian’s Strategic Capital Planning solution optimizes your limited resources by integrating the facilities organization, mission and vision, and the finance office. To this end, there is a focus on flexibility in both the process and the tools to ensure the development of an actionable plan:
 Step 1 — Establish a Baseline. Our flexible baselining process allows for you to choose the approach that fits best for each physical asset so that you only allocate precious resources where they are most necessary:
a. Detailed Assessment – For facilities which need a fine-tooth comb we will conduct an in-person condition assessment of the facility.
b. Existing Data Migration – Because resources are precious, we want to help you put existing data to work rather than reinvent the wheel.
c. Core Systems Assessment –A fully-remote approach leverages the power and insights that exist in Gordian’s cost and facilities databases (RSMeans, Gordian Planning, and Gordian JOC) to assess building needs at a system-level (Uniformat Level 3).

Because all three baseline approaches result in Uniformat codifications and are compared using RSMeans pricing, we are able to create a consistent and apples-to-apples inventory of facilities needs across your portfolio of physical assets.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 16

 Step 2 — Integrate Operational Perspectives. We harness the latent knowledge that exists within your organization by conducting interviews with facilities managers, frontline trades staff and other key stakeholders to validate our baseline data and ensure it is consistent with operational insight. This step helps us acquire operator input regarding the necessary repairs, priority, and timeframe, resulting in a more accurate list of facilities needs. Additionally, this step creates a sense of ownership with those ultimately responsible for the work and leads to an outcome with buy-in at every level of the community, institution, or district.  Step 3 — Create Building Portfolios. We will use your leadership’s goals and objectives to strategically segment your buildings into a portfolio of assets with similar functions, priorities, or other factor unique to you. Not all buildings are created equal, and our Building Portfolios process allows us to define areas of emphasis and provides a rationale for facilities funding distribution.

This segmentation helps you form unique investment strategies and performance metrics that engage key stakeholders in a conversation about facilities and financial priorities and mission to accelerate decision-making.
 Step 4 — Develop Multi-year Capital Plan. With portfolios in place, Gordian supports resource allocation discussions and the creation of a capital investment plan. By adding an understanding of historical spending profiles, we can create outcome-based strategies that balance asset preservation with program adaptation in various financial scenarios to ensure practicality of results.
 Step 5 — Ongoing Project Selection. Project selection is a combination of art and science.

Gordian’s objective prioritization tools allow leadership to create and manage investment strategies that tie technical issues to vision and finance. Because they are objective, these tools help minimize the number of politically-motivated decisions and allow facilities leaders to create constituency and manage change. By providing access and training for our Gordian Cloud portal, we provide the team the ability manage the list independent of us, ensuring the priorities remain in focus for project selection.

Capital planning should not be a one-time exercise. Our solution is designed to integrate with your current planning systems: first by maintaining a live database so you can engage senior leadership as

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 17

organizational activity demands, and then by tracking performance to targets, which builds credibility for future appropriations.

The Process
Step 1: Establish a Baseline
Far too often, leaders start a strategic process by fixating on individual details without fully understanding their significance to the total result. By streamlining the path to a prioritized plan, we help you avoid putting effort and finances into extraneous details which are not critical to the organizational future.

Phase 1: Creation of Baseline Inventory
The first step in our process is to select a baseline approach that optimizes the relationship between cost and detail, keeping in mind that more detail comes with a higher financial cost and a longer lead time.

Our flexible baseline methodology allows you to target high-priority buildings with Detailed Assessments, put old data back to work with an Existing data Migration, and reduce overall costs without sacrificing accuracy by choosing a Core Systems Assessment. For more detail on what each baseline approach has to offer, see below:
a. Detailed Assessment – For facilities which need a fine-tooth comb we will conduct an in-person condition assessment of the facility. During this assessment we will:
i. inventory components at a granular level (Uniformat Level 5), confirming location, quantity, and renewal need
ii. conduct a visual inspection adhering to ASTM 2018-15 condition assessment standards iii. identify each deficiency it’s cause and recommended remedial action iv. Create preliminary estimates of cost of replacement and/or remediation v. Take and compile photographs to document critical deficiencies as appropriate

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 18

b. Existing Data Migration – Because resources are precious, we want to help you put existing data to work rather than reinvent the wheel. If you have an existing assessment for a facility which still contains relevant, trustworthy data, allow us to migrate the data into our system so that it can be viewed in alongside other facilities in a comprehensive needs inventory and can make use of the strategic tools discussed later in the process.
c. Core Systems Assessment – For facility which do not require a detailed approach, but where accuracy of information is critical, this fully-remote approach leverages the power and insights that exist in Gordian’s cost and facilities databases (RS Means, Gordian Planning, and Gordian JOC) to assess building needs at a system-level (Uniformat Level 3). This approach uses database cost- models, existing maintenance data, and user experiences to focus on the 20 most critical systems in each building which comprise over 95% of the identifiable needs within a facility. The system- level cost models are then customized for each unique facility to accurately reflect the specific needs of that physical asset.

Once the selection of the baseline approach is complete, the next step is to assemble the inventory through building assessments, data migrations, and cost-model creation. The resulting inventory is stored in Gordian Cloud’s secure platform, which leads us to phase 2.

Phase 2: Introduction and Setup on Gordian Cloud
To ensure the continued accuracy of the assessment data, Gordian makes our information accessible to you through our online platform, Gordian Cloud. This web-based platform will be the central repository for all detailed assessments, migrated data, cost models, and strategic tools as they are created. An introduction to this platform will begin during the baselining stage but will continue throughout the partnership with Gordian, as sustained engagement on the platform will be critical to the longevity and sustainment of the project results. Formal training on the usage of Gordian Cloud will be delivered after the conclusion of Step 4.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 19

Step 2: Integrate Operational Perspectives
To harness the vast amount of latent knowledge held by your supervision and trades staff, Gordian will conduct interviews with facilities managers and other knowledgeable individuals. We find these interviews invaluable to:
 Confirm and adjust assumptions in the Core Systems and Detailed Assessments  Confirm building and system alignment with operational objectives and direction.  Validate life cycle and pricing estimates.
 Build operator confidence in the process, project recommendations and overall findings.

Supervisor interviews are an iterative process requiring equal involvement of your organization and Gordian staff. The time commitment required of organizational staff can vary, ranging from a few hours to a couple days. Because this stage runs through Gordian Cloud, these interviews can happen on-site or remotely through a web-meeting at your request.

Step 3: Customize Strategy Tools
Successful long-term planning requires more than a technical baseline. Gordian uses an array of strategic concepts as tools to tie facilities projects to the mission and vision of leadership and to define a framework for reinvestment funding. The primary strategic and functional prioritization tools are outlined below though others may be added as necessary to ensure a robust toolkit.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 20

Building Portfolios
Organizing buildings into a portfolio of assets provides the means to reflect existing priorities and future aspirations. The Building Portfolio structures are often strategic, functional, geographic or a locally appropriate combination of these attributes which best highlight areas of emphasis or funding distribution across your community, institution, or district. This structure accelerates focus onto sequencing of future investments. Leadership can then target investments toward one portfolio over another or across portfolios as appropriate to best reflect your organizational goals and objectives. Projects can now happen in a transparently predictable fashion.

Project Category
The classification of a project helps to differentiate between a “want” versus a “need.” Gordian uses “Repair & Maintenance” where replacement is done in-kind and at end of life; an example would be replacing a roof when it begins to leak. “Modernization” is used to describe an improvement or an addition; common examples of modernization work would be the addition of an elevator in a building or the upgrade from a two-pipe heating system to a four-pipe heating and cooling system. “New Construction” needs are also clarified using Project Category to indicate that they too serve a different purpose than Repair & Maintenance or Modernization by adding to the facilities inventory.

Project Package
After codifying each project to a building or architectural system, Gordian assigns each project to a broader project package. Planning at a higher level, project integration (e.g. window replacements and brick pointing together) creates efficiencies among previously isolated projects. Typical packages are Building Envelope, Building System, Infrastructure, Space Renewal and Safety/Code.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 21

Timeframe
Our experiences have taught us that the sequencing of work is essential to aligning financing to successful project execution. Multi-year investment time frames (immediate investment needs, 1-3 years, 4-7 years, 8-10 years, etc.) establish useful investment horizons based on age, condition and can be clearly communicated to leadership and decision makers without committing to individual project years.

Investment Criteria
Additionally, Gordian uses Investment Criteria to help decision-makers understand the importance or impact of a project. Each project is assigned to one of five Investment Criteria:
 Reliability: Issues of imminent failure or compromise to the system that may result in interruption to use of the space.
 Asset Preservation: Projects that preserve or enhance the integrity of building systems, building structure or local infrastructure.
 Safety/Code: Code compliance issues and safety priorities or items that are not in conformance with current codes, even though the system is “grandfathered in” and exempt from current code.
 Program Improvement: Projects that improve the functionality of space, primarily driven by facility occupants. These projects also address local impact and image needs.  Economic Opportunity: Projects that result in a reduction of annual operating costs or capital savings.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 22

Step 4: Develop a Multi-Year Capital Plan
The goal of the facility planning process is defining a plan that is credible, affordable and actionable. To accomplish this, Gordian engages leadership in an exercise that explores how the backlog came to exist, ties needs to vision and investment drivers, and develops multi-year funding plans based on strategy- driven outcomes for specific groups of buildings. Successful facilities plans deliver a capital program that will manage the rate of backlog accumulation, guide future investment decisions and ensure the effective use of gains made by capital infusions.

Background
As facilities budgets continue to be stretched and strained, leaders are faced with difficult decisions. It’s not reasonable, or even fiscally responsible, to reduce the facilities backlog to zero, so the key is to define the backlog threshold that effectively manages facility risk. Gordian is not only able to communicate the size of the need, but we will explain how this need came to exist. An analysis of historical annual stewardship, capital investment and maintenance deferral will help outline where the organization has been to assure forward strategy will not repeat previous actions.

Frame the Outcome
We find that grouping projects within the five Investment Criteria categories outlined above is instructional in defining investment priorities. The process ties the raw project data to mission and objectives, effectively making the case for facilities funding through a balance of planned vision and physical plant needs. This analysis can be communicated to and understood by all constituents in the community, institution or district, in terms that are important to them.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 23

Gordian uses Net Asset Value (NAV) as one important tool to help define outcomes by portfolio.

Calculated as the replacement value less the total needs for the building divided by the replacement value, it represents the “percent good” remaining in the building. Equipped with NAV data by portfolio (and by building), Gordian will work with the key stakeholders and senior leadership to establish acceptable condition levels by portfolio.

A variety of methods are utilized to
organize decisions made with the tools.

One example to the right brings the
Building Portfolio, Timeframe, and
Investment Criteria together in a
decision-making form to aid in setting
investment priorities so leaders can
move to the project selection phase of
the process.

Step 5: Project Selection
With an investment plan by Portfolio established, the process of deciding which projects to accomplish and in what sequence can commence. This is an iterative process guided by the multi-year plan.

Understanding that annual priorities shift and impact project selection, these decision tools become an integral part of the planning and prioritization process moving forward for your organization.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 24

Project selection is a combination of art and science. Technical issues of priority and reliability dictate the science. Occupancy, funding and the political environment guide the art.

Gordian will work with the community, institution, or district to assign a custom scoring methodology to rank projects within buildings where a Detailed Assessment was conducted or those facilities which otherwise have component-level detail. Creating an effective array of project scoring factors will increase both the transparency and effectiveness in the project selection process.

Each project receives a score based on the overall condition of the building, the importance of investment criteria and timeframe. Scores are customized to fit the specific needs of your organization.

For example, an entity that wishes to stress fire protection and ADA compliance, Safety/Code projects can be given a higher score relative to others. A sample scoring scheme is shown here.

In this example, projects will be
considered more urgent if they are
imminent issues within critical
systems in high-need buildings.

Gordian will work with leadership to
help guide toward the most effective
and impactful set of project scoring
factors for your organization. Our
process includes tools that breaks
ties for mid-range priorities.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 25

Deliverables
Gordian deliverables are designed to effectively communicate findings to build broad support in the community and integrate with existing management systems. The results of the study are segmented between communication and physical deliverables.

Communication: Gordian will conduct four (4) on-site or remote presentations for the Strategic Capital Planning process:
 The first presentation will serve to review and qualify the summarized data from the building models, initial assessments and start the planning process.  The second presentation will serve review planning and funding scenarios.  The third presentation will be a review of the completed strategic capital plan and recommendations for next steps. This presentation will recommend a strategic course of action as well as:
o Provide context of historical funding levels and detail how the backlog came to exist. o Give a summary level overview of facilities needs highlighting key strategic issues. o Summarize Gordian’s recommendation for a facilities reinvestment plan that ties to mission and available funding.
 The final presentation can be given to senior leadership (e.g. CFO, President, School Board, Legislature, etc.) or the appropriate audience within your organization.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 26

Virtual Deliverables:
 Web-based access to inventory of projects/assets and all associated information: timeframe, cost, Uniformat code, investment criteria, etc.
 Web-based access to dashboards containing visual summaries of the inventory by building, Uniformat level and portfolio.
 Training for client-team on how to access and use web-based portal and ongoing support from Gordian-team with regards to usage and issues
Physical Deliverables:
 A recommended ten-year project plan by investment criteria that ties to mission, operations and finance.
 PDF copies of all presentations delivered by team throughout the timeline of the engagement.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 27

Schedule
Typical Project Schedule
Gordian’s standard is a 20-week schedule to deliver our Strategic Capital Planning service. A draft timeframe is shown below. We can adjust our project calendar based on the needs of each institution, district or entity. Timelines may be refined upon project acceptance based on mutual agreement of the parties. Achievement of the milestones and deliverables within this schedule is fully dependent upon the availability of buildings, staff and data.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 28

Week # Component Milestones for this Week 3-week hold Pre-Weeks, Kick-Off
Presentation
Scheduled dates & times for all meetings
Collect existing base data
Introduce strategic tools
Discuss common costing and life cycles
1 Building Walk-
Throughs and
System Setup
Buildings Inspected (if necessary)
Core Systems Assessment models created

2-4 Data Processing List skeleton built, inspection data entered 5 Supervisor
Interviews
All interviews completed
Collect all capital planning documents -
funding, projects, etc.

Discuss investment objectives
6-8 Data Processing All projects priced & codified
All interview follow-ups completed
9 Data Qualification
Meeting
All follow-up questions addressed
Finalized project inventory
Introduction to Gordian Cloud
10-12 Data Revisions All changes made
13 Strategy
Qualification
Meeting
Finalized strategic tools
Finalized portfolios
Discuss funding availability
14-16 Data Cleanup Preliminary Presentation built
17 Preliminary
Presentation
Capital Plan finalized
Initial training for Gordian Cloud
18-19 Data Refinement Final Presentation built
20 Final Presentation

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 32

Sightlines Space Utilization
Scope of Work
Gordian has provided information on our Sightlines Space Utilization solution, and is uniquely qualified to offer actionable space management recommendations to your leadership. The four primary components of Gordian Space Utilization Solution are:
 Field inspection of each classroom and its components, including technology  Coordinated effort to solicit feedback from students and faculty  Assessment of classroom and position utilization
 Review of institutional scheduling policy
The service proposed combines academic space profiling, classroom and lab utilization assessment, and facility condition and modernization assessments into a single effort to guide space planning.

There is one imperative in managing college & university facilities — programs change over time.

Teaching methods constantly evolve, instead the living and learning environment seldom keeps pace. We have seen new spaces require renovation just after building occupancy to respond to the change in program needs over the timeframe of building design through construction. Such rapid functional obsolescence creates great pressures upon capital budgets. Spaces “churn” well before their physical lifecycle while building envelopes and mechanical systems reach lifecycle expectations.

Although it is impossible to accurately forecast space changes five or more years in the future, there are methods to understand why spaces are functioning effectively or not. Gordian believes that an understanding of the utilization rates, the space use, and the instruction methods are key.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 33

The Gordian approach uses three distinct data points to better contextualize the results of any utilization analysis.

1. Granular utilization data, broken down into 15-minute intervals by class and room, allows for better insights into utilization trends.

2. Condition, technology, and configuration data for each potential teaching spaces identifies the characteristics of the most and least popular rooms.

3. Focus group information adds in user opinions from faculty and students, the end users of the spaces.

This three-pronged approach not only gives insight into utilization levels, but gives the tools for the institutions to understand why the results are what they are and how best to approach future changes. In addition, our qualification of the data helps to ensure the data is accurate, that any scheduling nuances are addressed and communicated correctly to all institutional audiences.

While our methodology and approach is standardized, our recommendations and visual deliverables are flexible to allow for customized modeling, best supporting campus needs and the impact of future changes. Our clients have successfully overcome internal politics, to implement significant space management improvements. Gordian service offers both short-term and long-term recommendations, and facilitates the process of getting these recommendations approved. Our clients have successfully upgraded classrooms, in response to stakeholder feedback, centralized scheduling of department-held classrooms, and “found” space without having to build new.

The services proposed combines academic space profiling, classroom and lab utilization assessment, and facility condition and modernization assessments into a single effort to guide space planning.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 34

There is one imperative in managing college & university facilities — Programs Change Over Time.

Teaching methods constantly evolve, but the living and learning environment seldom keeps pace. We have seen new spaces require renovation just after building occupancy to respond to the change in program needs over the timeframe of building design through construction. Such rapid functional obsolescence creates great pressures upon capital budgets. Spaces “churn” well before their physical lifecycle while building envelopes and mechanical systems reach lifecycle expectations.

Although it is impossible to accurately forecast space changes five or more years in the future, there are methods to understand why spaces are functioning effectively or not. Gordian believes that an understanding of the utilization rates, the space use, and the instruction methods are key.

Gordian suggests the following process to meet the objectives outlined in the RFP:

Step 1: Assemble the Core Data
We compile a data base of scheduled spaces, capacities, interior conditions and technology assets to understand the current state of your school’s spaces. Gordian will document all of the components in each room, how these components work effectively to support program, and how these components should be modernized in future capital investment plans. Documentation of existing space utilization both Assemble the Core Data
Complete an Advanced Data Analysis
Conduct Focus Groups
Provide Actionable Improvement Options

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 35

by room and position (chair) use. In addition, analysis the spread of existing space versus what is currently needed for class enrollments.

Gordian will:
 Document Building size, configuration, and layout of space  Utilize existing 2D (8½” x 11”) floor plans and CAD drawings create a database of room sizes, use, and assignment.
 Quantify the academic spaces as to size, components and condition.  Complete a detailed review of the classroom and lab schedules for four semesters.  Identify the utilization of each room by comparing the schedule of room usage to the available times the room is available to be scheduled.
 Classify the position utilization by quantifying the numbers of people in the class as compared to the room’s capacity.
 Document the space condition and its success in supporting program (mediation, computer integration, seating, shading, etc.)

Step 2: Complete an Advanced Data Analysis
Once the data is gathered, we’ll provide you a detailed picture of classroom usage and scheduling trends and communicate the financial impact of those trends.

Step 3: Conduct Focus Groups
We give key stakeholders a seat at the table to provide input on space needs and conditions. Deans, faculty, and facilities staff – everyone has a voice because space utilization affects the entire campus experience. Gordian will solicit feedback from students and faculty to understand internal preferences and rationale for room use by asking questions on comfort (NSF per student), location and availability.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 36

In addition, Gordian will review the institutional scheduling policy. In every campus there are idiosyncrasies in programs and between departments that over time incrementally fragment space scheduling and utilization. Some of these policies are intentional and some are not. Some of these policies are desirable and logical in support of campus program and some are not. Gordian will define these issues and support a discussion of these policy attributes, potential issues, and options for change.

Step 4: Provide Actionable Improvement Options
All the information in the world won’t matter without an action plan. We’ll deliver independent recommendations for improvement to help you reach the outcomes you desire for standards, space utilization efficiencies, and adaptive reuse of space
Space assessments often suggest the renovation and or the creation of new space. Gordian has also discovered that campuses can attain a more effective outcome by considering the re-use of a space for an alternative function. Building a new lab building and converting the old lab to housing for example is an adaptive reuse that reaches program goals for far less resources than building two new facilities.

The recommendation process is iterative between the Gordian team and the client. After all of the data is reviewed and verified, the Gordian team will hold a preliminary presentation to share the findings and highlight recommendations. After feedback Gordian will refine, if necessary, the draft survey to a final report.

Deliverables
Gordian deliverables are designed to effectively communicate findings to build constituency with the client. Gordian will conduct three presentations of the Space Utilization Solution onsite. The first will

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 37

serve to qualify the data and initiate the scenario planning process. The second presentation will be a preliminary session given to those who participated in the effort to validate findings and identify questions with data collection and/or analysis. The final presentation can be given the appropriate audience.

The preliminary and final presentations will:
 Correlate existing academic program review information with the existing classroom physical profile and utilization to define key attributes for successful teaching environments.  Analyze the classroom needs based upon current program and provide models to forecast the impact of enrollment changes.
 Analyze where capital efficiencies are obtained to meeting academic space needs — through renovation, additions, new construction, or adaptive reuse of space.  Define order of magnitude capital and operating costs for investment options defined.  Correlate changes in space to the institution’s wealth profile to indicate, over the long term, the implications of facility overhead to the current / forecast campus financial profile.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 38

This vision should provide the ability to develop a future scenario, define the variances to the existing conditions, and detail the probable range of financial implications of the actions. Having implemented such tools for over one hundred institutions, Gordian has the experience and knowledge to assure success of implementation over the long term. Gordian takes great pride in understanding the institutional financial pressures and customizing solutions that are financially realistic, operationally sound, and sustainable over time.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 39

Teaching space Inventory
Gordian will provide a room inventory of condition and components in Excel format that can be analyzed by individual building, room type, specific room, time of day, or day of the week.

Photographs
Gordian will provide digital photographs, for each facility and each teaching space evaluated, highlighting overall appearance, furniture and technology as part of the final report and deliverable dataset.

The Gordian approach uses three distinct data points to better contextualize the results of any utilization analysis.

1. Granular utilization data, broken down into 15-minute intervals by class and room, allows for better insights into utilization trends.

2. Condition, technology, and configuration data for each potential teaching spaces identifies the characteristics of the most and least popular rooms.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 40

3. Focus group information adds in user opinions from faculty and students, the end users of the spaces.

This three-pronged approach not only gives insight into utilization levels, but gives the tools for the institutions to understand why the results are what they are and how best to approach future changes. In addition, our qualification of the data helps to ensure the data is accurate, that any scheduling nuances are addressed and communicated correctly to all institutional audiences.

While our methodology and approach is standardized, our recommendations and visual deliverables are flexible to allow for customized modeling, best supporting campus needs and the impact of future changes.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 42

Sightlines Campus Sustainability
Scope of Work
Gordian has been active in the higher education
sustainability community since 2007. Our collaboration
with Clean Air - Cool Planet led to the initial version of our service intended to help institutions satisfy the early requirements of Second Nature’s Climate Commitment.

Since then we have completed over 500 greenhouse gas
inventories and been a frequent contributor of content
to numerous green publications, conferences, and other
media.

Today, our Campus Sustainability solution is more than
just a greenhouse gas inventory. Gordian independently
validates sustainability performance and supports our
members as they create and expand their climate
programs. Working with our members, we make strategic recommendations to enhance environmental stewardship, connect sustainability to other campus investments, and help communicate plans to various constituencies on campus. Our solution provides institutions with accurate and verified information regarding their green programs as well as the ability to benchmark their performance with over 50 other member institutions through our Member Portal.

Gordian uses SiMAP (Sustainability Indicator Management & Analysis Platform), developed by the Sustainability Institute at the University of New Hampshire, to quantify and track greenhouse gas Our QVQ Process:

To ensure the highest level of quality
and consistency in our data collection,
we:
 Collect data on site using our staff
 Use standard templates to gather
valid comparative information
 Create a five-year performance
trend for all data
 Correlate performance metrics and
logical data relationships to
establish confidence
 Qualify the data via presentation
to key institutional personnel

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 43

emissions. This tool provides a credible and replicable base for measurement and comparison. When combined with Gordian proven data collection and qualification tools, SiMAP can assure consistency and comparability in measurement. Additionally, since it is the most accepted tool within higher education, Gordian’s Campus Sustainability solution supports clients as they fulfill the quantitative requirements of Second Nature’s Carbon Commitment and AASHE STARS, which recognize the SiMAP as their preferred methodology and baseline for measuring future greenhouse gas reductions.

Data Collection Process
The initial process performed at each institution involves the collection of five years of data (a historic review of four years plus the current year’s data) to allow evaluation of trends and to assure accuracy moving forward. Each year following, data collection is performed for the recently completed fiscal year.

All Gordian services are designed to convert a wealth of campus data to usable information and actionable knowledge.

Gordian uses its own staff to collect and validate base data from each institution. We do not rely on self-reported surveys or questionnaires. Our QVQ Process (Quantify, Verify, Qualify) is designed to achieve confidence and credibility in facilities and sustainability data. Since Gordian visits every campus and applies the QVQ Process consistently each year, members can “compare with confidence” now and into the future.

What do we
measure?
Scope 1: Primarily composed of
fossil fuel combustion for heating,
cooling and other power
generation; also fertilizer, campus
vehicle fleets, refrigerant releases
and research livestock.

Scope 2: Indirect emissions from
the generation of power or other
end-use utilities imported to the
institution.

Scope 3: Other indirect emissions
that are the result of the
institution’s activities but not
owned or controlled by the
institution (can be difficult to
measure, includes commuting, air
travel, waste disposal, paper

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 44

Gordian utilizes SiMAP to compile GHG inventories and to assure comparability among members. The calculator adheres to World Resources Institute Greenhouse Gas Protocol which puts forth a standard categorization of emissions. There are many gases that contribute to global warming. All emissions are expressed in units of carbon dioxide equivalents or MTCDE (metric tons of carbon dioxide equivalents).

Regardless of the emission type, one MTCDE is equal to the global warming impact of one metric ton of carbon dioxide.

Gordian measures scope 1, scope 2 and scope 3 emissions. Second Nature states that the GHG inventories for signatories must include a full accounting of scope 1 and scope 2 emissions. Scope 3 reporting is only required for commuting and directly financed air travel. Gordian makes every effort to account for emissions as thoroughly as possible and views this as a minimum requirement.

The following chart details the data required for Sustainability Solutions. Prior to on-site data collection, a web-based meeting will be scheduled to review the availability of data, confirm the timelines, and determine a presentation date.

Data Elements Collected
Data Component Description/Action
Utility Cost & Consumption Collect utility information by fuel or energy type Determine source of electric purchases
Generation Review Overview of utility systems and efficiencies of generation (if applicable)
Space Profile Review Identify square footage to be analyzed Community Population Review Standardize population data (FTE) Collect data for faculty, staff and students

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 45

Agriculture Headcounts of livestock on campus (if applicable) Fertilizer consumption (pounds and nitrogen content)
Commuting Review existing commuting analyses
Execute web-based Gordian Commuting Assessment
Collect zip codes for faculty, staff and student commuters Identify percent of residential faculty, staff and students Directly Financed Travel Collect distance or cost of directly financed travel Determine mode of directly financed travel
Fleet Vehicles Fuel use by type for institution owned/leased vehicles Waste Disposal & Recycling Tons of waste disposed
Method of disposal (landfill/incineration)
Tons of construction waste
Tons of recycled materials
Tons of composted waste
Refrigerant Use Volumes of refrigerants used by type
Water/Sewer Water and sewer use in gallons
Separate irrigation and utility systems (if applicable) “Green” Construction Square footage of LEED certified buildings

Timeframe
Gordian will work with you to determine the most appropriate schedule for site visits and presentations.

The following tables contain suggested milestones for both solutions:

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 46

Data Component Description/Action
Data Collection Data collection will begin with a web-
based meeting to discuss required data
and scheduling.

One day on-site or web based meeting
will be scheduled.

Analysis – QVQ Process Analysis of data should span
approximately three weeks with a web-
based or live meeting to follow. Data
will be qualified.

Deliverables Deliverables will be available
approximately one-month after on-site
data collection – contingent on data
collection being complete.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 47

Deliverables
As in any organizational or process assessment, the final deliverables are crucial to the successful implementation of recommendations. Gordian provides “trustee quality” deliverables which provide both summary and detail findings of Sustainability Solutions. We have found that effective deliverables must be understandable from the boardroom to the boiler room. Therefore, information is integrated to include both strategic and technical components. This integration helps assure that strategic policy initiatives can be easily translated to tactical actions for implementation at all levels of the organization.

Gordian provides the following deliverables:
 PowerPoint presentation of the results delivered either on-site or via webinar;  Gordian Member Portal which provides full access to all institutional environmental data and the ability to run comparative reports among all Gordian members.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 48

Sustainability Reporting
Scope of Work
Gordian has been active in the higher education sustainability community since 2007. Our collaboration with Clean Air - Cool Planet led to the initial version of our service intended to help institutions satisfy the early requirements of Second Nature’s Climate Commitment. Since then we have completed over 500 greenhouse gas inventories and been a frequent contributor of content to numerous green publications, conferences, and other media.

Gordian now turns its data collection and analysis skills towards assisting institutions to participate in the AASHE STARS program. Gordian can facilitate collection of all data and report results related to the four STARS modules:
 Operations – Credits reflecting the physical administration of the campus including greenhouse gas emissions, green constructions, food services, transportation, waste, etc.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 49

 Academics – Credits that recognize institutions that have formal education programs, research programs and courses that address sustainability.
 Engagement – A series of metrics that demonstrate the presence of sustainability related learning experiences outside of the classroom and for all members of the community and beyond.  Administration & Planning – Credits related to the organizational structures that support sustainability, workplace programs and campus investment.

The completion of each module will rely on robust data collection paired with key stakeholder interviews to validate and clarify findings. Where data is not available for collection, Gordian will make recommendations to the institution regarding enhanced systems for future years.

Prior to beginning the reporting process, the institution is responsible for listing Gordian as “Data Entry” User within STARS Reporting Tool. The institution is also responsible for all costs associated with STARS Reporting access.

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 50

Important Data Note
Gordian will expire all reasonable efforts to collect each data piece (3 data requests via phone and/or email, followed by troubleshooting with key campus leaders) to overcome any data collection issues. Any data not provided in a timely manner, despite these systematic outreach efforts, will not be included in the Gordian analysis. Secondly, any institution may choose not to pursue a credit, for any reason. Once a decision is made not to pursue a credit, Gordian will cease all collection efforts related to that credit.

Deliverables: Sustainability Reporting
Gordian provides the following deliverables:
 PowerPoint presentation of the results delivered either on-site or via webinar which outlines:
o Data Collected
o STARS Performance

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 51

o Recommendations for continuous improvement, including:
 Short Term Recommendations that can be implemented before the next reporting cycle with limited capital and/or manpower
 Long Term Recommendations that will require more time and/or resources to implement
 Completed STARS report (for each contracted section)

30 Patewood Drive
Greenville, SC 29615
855.467.9444
gordian.com 52

Timeframe
Our Sustainability Reporting solution streamlines your STARS reporting. We will work with you to determine the most appropriate schedule for our on-site visits and presentations. The following table describes the schedule generally:

Stage Description/Action
Kick Off/Mobilization Formally initiate the project with key stakeholders Data Collection &
Processing
Data collection will begin with a web-based meeting to discuss required data and scheduling. Four weeks off-site.

Interviews Interviews (2-3 days depending on scope of work) Data will be qualified via email to the proper campus contacts who must review and sign-off.

Qualification of Data Review of inventory with key stakeholders 3rd Party Data Review Gordian assigns individual to perform a review of the analysis separate from the core assessment team
Gap Analysis Analysis areas of opportunity for additional points Preliminary Submission of
STARS Report
Submit STARS report for a preliminary score from AASHE
Data Revisions with AASHE
Guidance
Update STARS report with feedback from AASHE and finalize gap analysis
Presentation & Deliverables Deliverables will be available approximately one-month after on-site data collection – contingent on data collection being complete.

A presentation of final deliverables:

1. Completed STARS report

2. Senior level presentation

Amendment No. XX Page 1 of 1
Agreement No. XXX
Revised 11/4/15
This Amendment # 1 to Agreement # 201002786 (“Agreement”) is entered into between The Regents of the University of California (UC) and Supplier.

AMENDMENT TO AGREEMENT
The Agreement is hereby amended as follows:

Documents incorporated and listed under Section 19. Incorporated Documents:
- n. RFP # 002013-MAY2020 UC System-wide Job Order Contracting (JOC) Services All other terms, conditions and provisions of the Agreement shall remain in full force and effect.

This Amendment is signed by the parties’ duly authorized representatives, and shall be effective as of April 27 th, 2021.

The GORDIAN GROUP INC. THE REGENTS OF THE

UNIVERSITY OF CALIFORNIA
By:

Name:

Title:

Date:

Amendment to Agreement
Ammon T. Lesher
VP, General Counsel
4/22/2021
Sean Parker
Acting Associate Director - Procurement
4/22/2021
Amendment No. 2 Page 1 of 1
Agreement No. 2021002786
Revised 5/13/2021

This Amendment # 2 to Agreement # 201002786 (“Agreement”) is entered into between The Regents of the University of California (UC) and Supplier.

AMENDMENT TO AGREEMENT
The Agreement is hereby amended as follows:

Section 1. Statement of Work to add the following language:

“As a result of Request for Proposal # 00213 -MAY2020 UC System -wide Job Order Contracting (JOC) Services, the Agreement to furnish certain goods and services described herein and in the documents referenced herein (“Goods and/or Se rvices”) is made by and between The Regents of the University of California, a California public cooperation (“UC”) on behalf of the University of California and the supplier named below (“Supplier”). This Agreement is binding only if it is negotiated and executed by an authorized representative with the proper delegation of authority.

Supplier agrees to extend Goods and/or Services to public agencies (state and local governmental entities, public and private primary, secondary and higher education entities, non -profit entities, and agencies for the public benefit (“Public Agencies”) registered with OMNIA Partners, Public Sector (“Participating Public Agencies”) under the terms of this agreement. All contractual administration (e.g. terms, conditions, extensions, and renewals) will remain the UC’s responsibility except as outlined in the above referenced RFP 00213 -MAY2020 UC System- wide Job Order Contracting (JOC) Services .

Operational issues, fiduciary responsibility, payment issues and liabilities, and disputes involving individual Participating Public Agencies will be addressed, administered, and resolved by each Participating Public Agency.”

Documents incorporated and listed under Section 19. Incorporated Documents:
- o. RFP # 002013-MAY2020- Questionnaire Response – Gordian

All other terms, conditions and provisions of the Agreement shall remain in full force and effect.

This Amendment is signed by the parties’ duly authorized representatives, and shall be effective as of May 20 th,
2021.

GORDIAN GROUP INC. THE REGENTS OF THE

UNIVERSITY OF CALIFORNIA
By:

Name:

Title:

Date:

Amendment to Agreement
Ammon T .Lesher
VP, General Counsel
5/17/21
Sean Parker
Acting Associate Director - Procurement
5/17/21