STATE OF CALIFORNIA DEPARTMENT OF GENERAL SERVICE
PARTICIPATING ADDENDUM NUMBER
CONTRACT NO. SLP-25-70-0063E
TABORDA
APPROVED:
CITY OF MERCED
A California Charter Municipal
Corporation
BY:_
D. Scott McBride
City Manager
ATTEST:
D. SCOTT MCBRIDE, CITY CLERK
BY:
Assistant/Deputy City Clerk
APPROVED AS TO FORM:
CRAIG J. CORNWELL, CITY ATTORNEY
or Caris Genuell 5/1/2001
ACCOUNT DATA:
M. VENUS RODRIGUEZ
BY:
Verified by Finance Officer
Procurement Division
CALIFORNIA DEPARTMENT OF
DGS GENERAL SERVICES 707 Third Street, 2nd Floor, MS #2-202 West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP)
AMENDMENT NO. 1
softwarelicensingprogram
Contractor Taborda Solutions, Inc.
Contract Number: SLP-25-70-0063E
SLP Contract Term: 1/30/2025 through 12/31/2027
Contract Base: GovOS, Inc. Offer Number GOVOS-SLP-2025
This amendment is being issued to:
1. Remove all incorporated references to the state's general and special provisions and replace with the following provisions:
• Information Technology - General Provisions - Cloud Computing Services, DGS PD 402-ITGP (Cloud), effective 02/20/2025
• Information Technology - General Provisions - Non-Cloud Goods & Services, DGS PD 403-ITGP (Non-Cloud), effective 02/20/2025
2. Remove the provision "GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) REPORTING" and replace with the following provision:
GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI)
State agencies must follow the required GenAl purchase procedures outlined in the State Contracting Manual (SCM) and the California Department of Technology GenAl policies.
ALL OTHER TERMS AND CONDITIONS REMAIN THE SAME.
For State of CA: For Contractor:
For Julie MattheWs Date: 2025.06.18 11-53.5a-0rvs Vanessa Facio Stephanne Lim Signature
Manager
Multiple Award Programs Section Contracts & Agreements Specialist Procurement Division Printed Title
Department of General Services Vanessa Facio
6/18/2025 Printed Name
Date Taborda Solutions, Inc.
Company Name
4/25/2025
Date
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400 Procurement Division
CALIFORNIA DEPARTMENT O
GS GENER ADASER VICES 707 Third Street, 2nd Floor, MS #2-202 West Sacramento, CA 95605-2811
State of California
SOFTWARE LICENSING PROGRAM (SLP) AGREEMENT
softwarelicensingprogram
Contractor: Taborda Solutions, Inc.
Contract Number: SLP-25-70-0063E
SLP Contract Term: 01/30/2025 through 12/31/2027
Contract Base: GovOs, Inc. Offer Number GOVOS-SLP-2025
This contract is available for use by State of California departments and any city, county, make its own determination whether the SLP is consistent with their procurement policies and regulations.
The SLP Contractor is required to provide all SLP contract terms and conditions with the list of products, services and prices.
Terms and conditions listed below are hereby incorporated by reference and made a part of this SLP Agreement as if attached herein and shall apply to the purchase of goods or services made under this Participating Agreement. Contractor non-compliance with the requirements of this contract may result in contract termination.
By signing below, Contractor agrees to the Informational Technology - General Provisions (Non-Cloud Goods and Services and Cloud Computing Services) dated November 12, 2024, and all other provisions included herein. 1) General Provisions - Information Technology (Non-Cloud) effective 11/12/24 2) General Provisions - Information Technology (Cloud) effective 11/12/24 For State of CA: For Contractor:
Vanassa Facio
For Stephanne Lim Signature
Manager
Multiple Award Programs Section Contracts & Agreements Specialist Procurement Division Printed Title
Department of General Services Vanessa Facio
02/04/2025 Printed Name
Date Taborda Solutions, Inc.
Company Name
1/31/2025
Date
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
CONTRACTOR PROVIDES COPY OF Reports that include paper checks for THE CONTRACT AND SUPPLEMENTS quarterly incentive fees must be mailed and shall not be emailed
The SLP Contractors are required to
provide the entire contract that consists of For the full instructions on completing and submitting SLP Quarterly Business Activity
the following:
Reports, reference "ATTACHMENT A" of
• SLP Cover sheet with signatures from this agreement.
the DGS Procurement Division Deputy Important things to remember regarding Director or designee and Contractor. SLP Quarterly Business Activity Reports:
• Ordering instructions. • A report is required for each SLP, each • Std. 204 Payee Data Record. quarter, even when no new purchase orders are received in the quarter.
• SLP Contract terms and conditions
(General provisions). • A separate report is required for each SLP agreement.
• Software License Agreement pricing.
• Each purchase order must be
• Supplements, if applicable reported only once in the quarter identified by the purchase order
CONTRACTOR QUARTERLY REPORTS date, regardless of when the services were performed, the
SLP Contractors are required to submit products were delivered, the invoice a detailed SLP Business Activity Report was sent, or the payment was on a quarterly basis to the SLP Unit. received.
SLP Quarterly Business Activity Reports are • Purchase orders from State and local due to the SLP Unit within two weeks after government agencies must be the end of each quarter as shown below: separated on the report, as shown in the instructions.
Quarter Reporting Period Due Date
Due Apr 15 • Any report that does not follow the
Quarter 1 Jan 1 to Mar 31
Quarter 2 Apr 1 to Jun 30 required format or excludes required Due Jul 15
Quarter 3 Jul 1 to Sep 30 Due Oct 15 information will be deemed incomplete and returned to the SLP contractor for
Quarter 4 Oct 1 to Dec 31 Due Jan 15
corrections.
This report shall be emailed to the SLP • Taxes and freight must not be included Unit general e-mail: in the report.
[email protected] • New SLP agreements, renewals, and
amendments will be approved only i
Alternatively, this report can be mailed to: the SLP contractor has submitted al required quarterly reports and incentive
Department of General Services fees.
Procurement Division - SLP Unit • A quarterly report is required even Attention: Quarterly Report Processing when there is no activity. 707 Third Street, MS #2-202
West Sacramento, CA 95605
BUILDING GREEN BUYING GREEN WORKING GREEN 2
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
CONTRACTOR QUARTERLY • State Agency Bill Code
INCENTIVE FEES • Line item numbe
All SLP contractors, including certified • Unit price
Small Businesses and Disabled Veteran • Extended line item price Business Enterprises, will be required to • Invoice total pay incentive fees for all orders placed by State sales tax and/or use tax shall be local government agencies. See the itemized separately and added to each current incentive fees in the DGS Price invoice as applicable. The company name Book (https://www.dgs.ca.gov/OFS/Price- on the SLP contract, purchase order and Book). invoice must match or the State
A local government agency is any city, Controller's Office will not approve county, district, or other local governmental payment.
body, including the California State CONTRACTOR OWNERSHIP University (CSU) and University of INFORMATION
California (UC) systems, K-12 public
schools and community colleges Taborda Solutions, Inc. is a large business empowered to expend public funds. enterprise.
Local incentive fee payments may be GENERATIVE ARTIFICIAL made with a paper check, electronic check INTELLIGENCE (GENAI) REPORTING or credit card. 1. State Agencies
Contractor may make an electronic check State agencies are required to obtain a or credit card payment through the LPA GenAl Reporting and Factsheet (STD Payment Portal 1000) from the Contractor prior to
(https://www.dgs.ca.gov/PD/Services/Page award.
-Content/Procurement-Division-Services-
List-Folder/Access-LPA-Payment-Portal). If GenAl is disclosed by the Contractor, state agencies must follow the required
If payment is made with a paper check, the GenAl purchase procedures outlined in check shall be made payable to the State Contracting Manual (SCM) Department of General Services, SLP Unit, Volume 2, Chapter 23, Generative and must be mailed to the SLP Unit along Artificial Intelligence (GenAl). State with the applicable Quarterly Report. agencies must retain the STD 1000 and See the provision in this SLP entitled confirmation the purchase may proceed "Contractor Quarterly Report Process" for in their procurement file. information on when and where to send
2. Contractor
these checks and reports.
CONTRACTOR INVOICES Upon request by an ordering agency, Contractor must complete a GenAl
Unless otherwise stipulated, the contractor Reporting and Fact Sheet (STD 1000) to must send their invoices to the department identify if their solution or service address set forth in the purchase order. includes, or makes available, any GenAl Invoices shall be submitted in triplicate and including, GenAl from third parties or shall include the following: subcontractors.
• Contract number During the term of the contract,
• Agency purchase order number Contractor must notify the State in BUILDING GREEN • BUYING GREEN WORKING GREEN 3
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
writing if their services or any work On March 4, 2022, Governor Gavin under this contract includes, or makes Newsom issued Executive Order N-6-22 available, any previously unreported (the EO) regarding Economic Sanctions GenAl technology, including GenAl from against Russia and Russian entities and third parties or subcontractors. individuals. "Economic Sanctions" refers to Contractor shall immediately complete sanctions imposed by the U.S. government the GenAl Reporting and Factsheet in response to Russia's actions in Ukraine, (STD 1000) to notify the State of any as well as any sanctions imposed under new or previously unreported GenAl state law. The EO directs state agencies to technology. terminate contracts with, and to refrain
from entering any new contracts with,
At the direction of the State, Contractor
individuals or entities that are determined
shall discontinue the use of any new or
to be a target of Economic Sanctions.
previously undisclosed GenAl Accordingly, should the State determine technology that materially impacts Contractor is a target of Economic functionality, risk or contract
performance, until use of such GenAl Sanctions or is conducting prohibited transactions with sanctioned individuals or
technology has been approved by the entities, that shall be grounds for State.
termination of this agreement. The State
Failure to disclose GenAl use to the shall provide Contractor advance written State and submit the GenAl Reporting notice of such termination, allowing and Factsheet (STD 1000) may be Contractor at least thirty (30) calendar days considered a breach of the contract by to provide a written response. Termination the State at its sole discretion and the shall be at the sole discretion of the State.
State may consider such failure to
disclose GenAl and/or failure to submit AGENCY NON-COMPLIANCE the GenAl Reporting and Factsheet
(STD 1000) as grounds for the Agency non-compliance with the immediate termination of the contract. requirements of this contract may result in The State is entitled to seek any and all the loss of delegated purchasing authority relief to which it may be entitled to as a to use the SLP. result of such non-disclosure.
PLEASE REQUEST A COPY OF ALL
The State reserves the right to amend CONTRACT TERMS AND CONDITIONS the contract, without additional cost, to FROM THE CONTRACTOR, IF NOT incorporate GenAl Special Provisions PROVIDED INITIALLY. into the contract at its sole discretion
and/or terminate any contract that AVAILABLE PRODUCTS AND/OR presents an unacceptable level of risk to SERVICES
the State.
If Contractor identifies GenAl in their This contract may provide for the purchase and warranty of software, software
solution, a copy of the STD 1000 must maintenance, technical support, training, be submitted to the State Contract installation, software as a service, and Administrator.
implementation services.
EXECUTIVE ORDER N-6-22 - RUSSIA
SANCTIONS
BUILDING GREEN • BUYING GREEN WORKING GREEN 4
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
Only products from the manufacturer listed • Installation Services must not exceed below are available within the scope of this the total cost of the software. contract:
IMPLEMENTATION SERVICES
• GovOS, Inc.
Before procuring Implementation Services,
UNAVAILABLE PRODUCTS AND/OR state departments should conduct an SERVICES analysis and use their own due diligence to
determine if these services are the most
The following products and/or services are cost effective solution that meets their not available under this contract: business needs and security requirements. • STANDALONE HARDWARE Requirements
• CONSULTING
• TELECOMMUNICATION PRODUCTS • State departments must complete a • CLOUD: IAAS/PAAS Statement of Work (SOW) for all
Implementation services.
Notice to State Agencies: Software • Job titles/categories are limited to those appliances/hardware products offered identified in the SLP price list. under the Software Publisher's pricelist are
NOT available under the Software • Hourly rates must not exceed those Licensing Program (SLP) if the same type identified in the SLP price list. of software appliance/hardware products • Implementation services can only be are currently available under any purchased when they are in support of mandatory Statewide Contract. State software purchased under the SLP. agencies who want to purchase a software
appliance/hardware product type, other • Time and Material pricing must not than what is available through a exceed the job Title hourly rate times mandatory Statewide Contract must submit the number of hours to complete the job. an exemption request to the mandatory NOTE: Implementation Services under Statewide Contract Administrator. For this contract must be paid in arrears. more information and the required
justification forms regarding the exemption SOFTWARE MAINTENANCE. process, please refer to the following SUBSCRIPTION AND SAAS RENEWALS website:
https://www.dgs.ca.gov/PD/Services/Page- Software Maintenance, Subscription and Content/Procurement-Division-Services- SaaS renewals shall be fixed at the List-Folder/Request-an-IT-Hardware- agency's prior applicable SLP rates (or Contract-Exemption. This restriction does lower), with a 0% uplift (no up-lift) and no not apply to local governmental agencies. additional increases, fees or charges added. for the duration of this SLP
INSTALLATION SERVICES contract.
• Installation Services can only be SERVICE CREDITS
purchased when they are in support of
software purchased under this SLP Service credits are acceptable only if they contract. meet the following requirements:
BUILDING GREEN BUYING GREEN WORKING GREEN 5
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
• Service credits must be used for decisions, including use of the SLP training, certifications, or support and program and associated outcomes. must never expire even when this
contract term ends. This responsibility includes, but is not necessarily limited to, ensuring the
Unused service credits can be used for necessity of the services, securing other services such as training, appropriate funding, complying with laws certification, or support. Example: If and policies, preparing the purchase order $1,000 is purchased in training credits in a manner that safeguards the State's but is not fully utilized, the department interests, obtaining required approvals, and may use the remainder of unused documenting compliance with Government credits for certifications or support. Code 19130.b (3) for outsourcing services.
ISSUE PURCHASE ORDER TO It is the responsibility of each agency to consult as applicable with their legal staff
Agency purchase orders must be mailed to and contracting offices for advice the following address, or e-mailed: depending upon the scope or complexity of the purchase order.
Taborda Solutions, Inc.
9580 Oak Ave Pkwy, Ste 7-180 If you do not have legal services available Folsom, CA 95630 to you within your agency, the DGS Office Attn: Taborda Sales of Legal Services is available to provide services on a contractual basis.
Agencies with questions regarding
products and/or services may contact the ORDER REQUIREMENTS AND contractor as follows: MAXIMUM ORDER LIMIT
Phone: (916) 990-9864 • Unless otherwise determined by an E-mail: [email protected] individual ordering agency purchasing SHIPPING INSTRUCTIONS authority, no SLP order may be
executed by a State agency that
F.O.B. (Free On Board) Destination exceeds that agency's purchasing authority threshold. State agencies with
DELIVERY approved purchasing authority, along
with their dollar thresholds can be
30 days after receipt of order, or as obtained at the List of State negotiated between agency and Contractor Departments with Approved Purchasing and included in the purchase order Authority.
AGENCY RESPONSIBILITY • Agencies must adhere to the detailed requirements in the State Contracting
Agencies must contact contractors to Manual (SCM) when using SLP obtain copies of the contracts and compare contracts. The requirements for the them for a best value purchasing decision. following bullets are in the SCM, Volume 2, (for IT): If soliciting offers from a
Each agency is responsible for its own certified DVBE, include the Disabled contracting program and purchasing Veteran Business Enterprise BUILDING GREEN BUYING GREEN WORKING GREEN 6
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
Declarations form (Std. 843) in the Splitting a project into small projects to Request for Offer. This declaration avoid either fiscal or procedural controls is must be completed and returned by the prohibited (SAM 4819.34).
DVBE prime contractor and/or any
DVBE subcontractors. (See the SCM MINIMUM ORDER LIMITATION Volume 2, Chapter 1200) There is no minimum dollar value limitation • This is not a bid transaction, so the on orders placed under this contract. small business preference, DVBE
ORDERING PROCEDURES
participation goals, protest language,
intents to award, evaluation criteria, 1. Order Form
advertising, etc., are not applicable.
State departments shall use a
• If less than 3 offers are received, State Contract/Delegation Purchase Order agencies must document their file with (Std. 65) for purchases and services. the reasons why the other suppliers
solicited did not respond with an offer. Local governments shall, in lieu of the State's Purchase Order (Std. 65), use
• Assess the offers received using best
their own purchase order document.
value methodology, with cost as one of
the criteria. Electronic copies of the State Standard
Forms can be found at the Office of
• Issue a Purchase Order to the selected
State Publishing web site:
contractor. http://www.dgs.ca.gov/osp (select
Standard Forms). The site provides
• For SLP transactions under $10,000, information on the various forms and only one offer is required if the State use with the Adobe Acrobat Reader. agency can establish and document that Beyond the Reader capabilities, Adobe the price is fair and reasonable. The fair Acrobat advanced features may be and reasonable method can only be utilized if you have Adobe Business used for non-customizable purchases. Tools or Adobe Acrobat 4.0 installed on your computer. Direct link to the
• Local governments set their own order Standard Form 65:
limits. (http://www.osp.dgs.ca.gov/pdf/std065.p
SPLITTING ORDERS df)
Splitting orders to avoid any monetary 2. Purchase Orders limitations is prohibited. All Ordering Agency purchase order documents executed under this SLP
Do not circumvent normal procurement must contain the applicable SLP methods by splitting purchases into a contract number as show on page 1. series of delegated purchase orders (SAM
3572). a. State Departments:
Std. 65 Purchase Documents - State
departments not transacting in
BUILDING GREEN BUYING GREEN WORKING GREEN 7
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
FI$Cal must use the Purchasing software maintenance if the SLP Authority Purchase Order (Std. 65) contract end term has expired. for purchase execution. An electronic
version of the Std. 65 is available at CONTRACT PRICES
the DGS-PD website at
http://www.dgs.ca.gov/ Contract prices for products and/or pd/Forms.aspx (select Standard STD Separent me courage energetinge Forms).
lower prices.
FI$Cal Purchase Documents - State
departments transacting in FISCal PRODUCT AND PRICING CHANGES will follow the FI$Cal procurement AND/OR UPDATES ARE NOT and contracting procedures. AUTHORIZED UNTIL REVIEWED AND
APPROVED BY DGS PROCUREMENT
b. Local Governmental Departments: DIVISION SOFTWARE LICENSING PROGRAM.
Local governmental agencies may
use their own purchase document Said documents are to be sent to the for purchase execution. Department of General Services (DGS) Procurement Division, Software Licensing
The agency is required to complete and Program, 707 Third Street, 2nd Floor, West distribute the order form. For services, Sacramento, CA 95605-2811, Attention the agency shall modify the information SLP Unit.
contained on the order to include the
service period (start and end date), and CONTRACT EXTENSIONS the monthly cost (or other intermittent
cost), and any other information The initial term of this SLP contract is 3 pertinent to the services being provided. years and may be extended for an The cost for each line item should be additional 2-years, however an amendment included in the order, not just system must be issued prior to contract end date. totals.
NOTE: Extensions are optional and are
The contractor must immediately reject at the discretion of the state. orders that are not accurate.
Discrepancies are to be negotiated and SMALL BUSINESS MUST BE incorporated into the order prior to the CONSIDERED
products and services being delivered. Prior to placing orders under the SLP, state
3. Service and Delivery after Contract departments shall, whenever practicable, first consider offers from small businesses
Expiration
that have established SLP contracts [GC
Purchase orders must be issued before Section 14846(b)]. NOTE: The the SLP contract end term expires. Department of General Services auditors will request substantiation of compliance
Also, purchase order amendments with this requirement when department cannot be issued to add product and files are reviewed.
SMALL BUSINESS/DVBE - TRACKING
BUILDING GREEN • BUYING GREEN WORKING GREEN 8
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
State departments are able to claim • Indicate the dollar amount of subcontracting dollars towards their small each subcontract with a small business or DVBE goals whenever the business or DVE that may be Contractor subcontracts a commercially claimed by the ordering useful function to a certified small business department towards the small or DVBE. The Contractor will provide the business or DVBE goal; and ordering department with the name of the Indicate what commercially •
small business or DVBE used and the
useful function the small
dollar amount the ordering department can business or DVBE subcontractor apply towards its small business or DVBE
will be providing towards
goal. fulfillment of the order.
SMALL BUSINESS/DVBE - 3. The ordering department's purchase SUBCONTRACTING order must be addressed to the prime
1. The amount an ordering department Contractor, and the purchase order must reference the information provided
can claim towards achieving its small
business or DVBE goals is the dollar by the prime Contractor as outlined above.
amount of the subcontract award made
by the Contractor to each small CERTIFICATION OF PAYMENT business or DVBE.
OPTIONS - Military & Vets Code §§999.5
2. The Contractor will provide an ordering and 999.7(a) (SB588) department with the following
information at the time the order is
In accordance with the State Contracting
quoted: Manual, Volume 2, Section 1203.1, State
departments shall require the Contractor to
a. The Contractor will state that, as the
submit a complete an accurate Prime
prime Contractor, it shall be Contractor's Certification - DVBE responsible for the overall execution
Subcontracting Report (STD. 817) upon
of the fulfillment of the order.
acceptance of ordered goods or services
b. The Contractor will indicate to the for which the Contractor committed to ordering department how the order DVBE subcontractor participation. meets the small business or DVBE Upon delivery or completion of ordered goal, as follows: goods or services, State departments shall do the following:
• List the name of each company
that is certified by the Office of • Provide proper withhold notification to Small Business and DVBE prime contractors.
Certification that it intends to Withhold $10,000 or the full amount of subcontract a commercially the final invoice if less than $10,000 useful function to; and pending receipt of the complete and • Include the small business or accurate STD 817.
DVBE certification number of • Review the STD 817. If it is determined each company listed, and attach to be complete and accurate, authorize a copy of each certification; and payment of the withhold.
BUILDING GREEN • BUYING GREEN WORKING GREEN
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
• If the STD 817 is late or incomplete, Category 1 - Critical Software: Critical department must send the prime software is software that is required to contractor a cure notice allowing at control the overall operation of a computer least 15 days, but not more than 30 system or peripheral equipment. Included days, to meet the Certification of in this category are operating systems, Payments to DVBE Subcontractors data base management systems, language requirements. interpreters, assemblers and compilers,
communications software, and other
• If the prime contractor does not comply essential system software. by the identified deadline, permanently
deduct the withhold.
Final Bid
• Retain all records for a minimum of six Cost Installation Submission years. More than
$100,000 8 months 6 months
PRODUCTIVE USE REQUIREMENTS $10,000 up to
$100,000 4 months 3 months
The customer in-use requirement applies Less than
to all procurements of information 1 month
$10,000 1 month
technology equipment and software, per
the SCM, Volume 2, Chapter 1000, Section Category 2 - All Information Technology Equipment and Non-Critical Software:
Information technology equipment is
Each equipment or software component defined in State Administrative Manual must be in current operation for a paying (SAM) § 4819.2. customer and the paying customer must be
external to the contractor's organization Final Bid
(not owned by the contractor and not Cost Installation Submission owning the contractor. More than
$100,000 6 months 4 months
To substantiate compliance with the
Productive Use Requirements, the SLP $10,000 up to
contractor must provide upon request the $100,000 4 months 3 months Less than
name and address of a customer
$10,000 1 month 1 month
installation and the name and telephone
number of a contact person.
STATE AND LOCAL GOVERNMENTS
The elapsed time such equipment or CAN USE THE SLP
software must have been in operation is
based upon the importance of the State and local government use of the SLP equipment or software for system
operation and its cost. The following
designates product categories and the
required period of time for equipment or colleges,
software operation prior to approval of the
replacement item on SLP. that is empowered to expend public funds.
While the state makes this contract
BUILDING GREEN • BUYING GREEN WORKING GREEN 10
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
available, each local government agency STATEWIDE PROCUREMENT should make its own REQUIREMENTS
determination whether the SLP is Departments must carefully review and consistent with their procurement policies adhere to the following Procurement and regulations. Requirements, such as:
APPLICABLE CODES, POLICIES AND • SAM Section 4819.41 and 4832 GUIDELINES certifications for information technology
procurements and compliance with
All California codes, policies and guidelines policies. are applicable. THE USE OF THE SLP • Services may not be paid for in
DOES NOT REDUCE OR RELIEVE
STATE DEPARTMENTS OF THEIR advance.
RESPONSIBILITY TO MEET STATEWIDE • Departments are required to file with the REQUIREMENTS REGARDING Department of Fair Employment and CONTRACTING OR THE Housing (DFEH) a Contract Award
PROCUREMENT OF GOODS OR Report Std. 16 for each order over SERVICES. Most procurement and $5,000 within 10 days of award, contract codes, policies, and guidelines are including supplements that exceed incorporated into The SLP contracts. $5,000.
Notwithstanding this, there is no guarantee
that "every" possible requirement that • Pursuant to Unemployment Insurance pertains to all the different and unique state Code Section 1088.8, state and local processes has been included. government agencies must report to the Employment Development Department
TERMINATION OF SLP CONTRACT (EDD) all payments for services that equal $600 or more to independent sole
1. The State or Contractor may terminate proprietor contractors. See the this SLP Contract at any time upon 30 contractor's Std. Form 204, Payee Data days prior notice. Record, in the SLP contract to
2. Upon termination or other expiration of determine sole proprietorship. All inquiries regarding this subject should
this Contract, each party will assist the ›e forwarded to EDD: Technica other party in orderly termination of the auestions: 916/651-6945 or Informatio Contract and the transfer of all assets, and forms: 916/657-0529. tangible and intangible, as may
facilitate the orderly, nondisrupted • Annual small business and disabled business continuation of each party. veteran reports.
3. This provision shall not relieve the ETHNICITY/RACE/GENDER REPORTING Contractor of the obligation to perform REQUIREMENT
under any purchase order or other
similar ordering document executed Effective July 1, 2002, in accordance with prior to the termination becoming Public Contract Code 10116, state effective. departments are to capture information on
ethnicity, race, and gender of business
owners (not subcontractors) for all
BUILDING GREEN • BUYING GREEN WORKING GREEN
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
awarded contracts, including CAL-Card Software warranty upgrades and transactions. Each department is required extensions may also be paid for in to independently report this information to advance, one time. the Governor and the Legislature on an
annual basis. 3. Payee Data Record (Std. 204)
Departments are responsible for State Agencies not transacting in developing their own guidelines and forms FISCal, must obtain a copy of the for collecting and reporting this information, Payee Data Record (Std. 204) in order to process payments. State Ordering
Contractor participation is voluntary. Agencies forward a copy of the Std. 204 to their accounting office (s).
PAYMENTS AND INVOICES Without the Std. 204, payment may be unnecessarily delayed. State Agencies
1. Payment Terms should contact the Contractor for copies of the Payee Data Record
Payment will be made in accordance
with the provisions of the California 4. DGS Administrative Fees Prompt Payment Act, Government
Code Section 927 et. seq. Unless Orders from State Agencies:
expressly exempted by statute, the Act
requires State agencies to pay properly The Department of General Services submitted, undisputed invoices not (DGS) will bill each State agency more than 45 days after (i) the date of directly an administrative fee for use of acceptance of goods or performance of SLP contracts. The administrative fee services; or (ii) receipt of an undisputed should NOT be included in the order invoice, whichever is later. total, nor remitted before an invoice is received from DGS.
2. Advance Payments
5. Credit Card
Advance payment is allowed for
services only under limited, narrowly The Contractor accepts the State of defined circumstances, e.g. between California credit card (CAL-Card). specific departments and certain types
of non-profit organizations, or when A Purchasing Authority Purchase Order paying another government agency (Std. 65) is required even when the (Government Code (GC) § 11256 - ordering department chooses to pay the 11263 and 11019). contractor via the CAL-Card. Also, the DGS administrative fee is applicable for
It is NOT acceptable to pay in advance, all SLP orders to suppliers not except software maintenance and California certified as a small business. license fees, which are considered a
subscription and may be paid in FEDERAL DEBARMENT
advance if a provision addressing
payment in advance is included in the When federal funds are being expended, purchase order. the department is required to obtain (retain in file) a signed "Federal Debarment"
certification from the contractor before the
BUILDING GREEN • BUYING GREEN WORKING GREEN 12
SOFTWARE LICENSING PROGRAM (SLP)
TABORDA SOLUTIONS, INC.
SLP-25-70-0063E
purchase order is issued. This
certification is required by the regulations
implementing Executive Order 12549
Debarment and Suspension, 29 CFR Part
98, Section 98.510, Participants;
responsibilities. The regulations were
published as Part VII of the May 26, 1988
Federal Register (pages 19160-19211).
AMERICANS WITH DISABILITY ACT
(ADA)
(See attachment B)
DGS PROCUREMENT DIVISION
CONTACT AND PHONE NUMBER
Department of General Services
Procurement Division, SLP Unit
707 Third Street, 2nd Floor
West Sacramento, CA 95605-2811
Phone no.: 916/375-4365
Faxination no.: 916/376-6371
BUILDING GREEN • BUYING GREEN • WORKING GREEN 13
ATTACHMENT A
SLP QUARTERLY BUSINESS ACTIVITY REPORT
Company Name: Reporting Calendar Year:
Software Publisher:
Reporting Quarter: • Q1 (January to March)
Contract Number: • Q2 (April to June)
For Questions Regarding this Report: • Q3 (July to September) E-mail: • Q4 (October to December)
Check Here if No New Orders for This Quarter
STATE GOVERNMENT AGENCY PURCHASES
Total Dollars
State Agency Purchase Purchase Agency Phone
Name Per Purchase Agency Contact Agency Address Number
Order Number Order Date Billing Code
Order
Total State Agency Dollars Reported for Quarter: $
LOCAL GOVERNMENT AGENCY PURCHASES
Local Government Agency Purchase Order Purchase Total Dollars Per Agency Phone Name Number Order Date Purchase Order Contact Agency Address Number Total Local Government Agency Dollars for Quarter: $
1.25% Remitted to DGS (of total Local Govt agency dollars reported for quarter): $ Total of State and Local Government Agency Dollars Reported for this Quarter: $ Updated 1/2024
ATTACHMENT A
SLP QUARTERLY BUSINESS ACTIVITY REPORT
Instructions for completing the SLP Quarterly Business Activity Report.
1. Complete the top of the form with the appropriate information for your company.
2. Agency Name - Identify the State agency or Local Government agency that issued the order.
3. Purchase Order Number - Identify the purchase order number (and amendment number if applicable) on the order form. This is not your invoice number. This is the number the State agency or Local Government agency assigns to the order.
4. Purchase Order Date - Identify the date the purchase order was issued, as shown on the order. This is not the date you received, accepted, or invoiced the order.
5. Agency Billing Code - Identify the State agency billing code. This is a five-digit number identified on the upper right hand corner of the Std. 65 purchase order form.
You must identify this number on all purchases made by State of California agencies.
Billing codes are not applicable to Local Government agencies.
6. Total Dollars Per PO - Identify the total dollars of the order excluding tax and freight.
Tax must NOT be included in the quarterly report, even if the agency includes tax on the purchase order. The total dollars per order should indicate the entire purchase order amount (less tax and freight) regardless of when you invoice order, perform services, deliver product, or receive payment.
7. Agency Contact - Identify the ordering agency's contact person on the purchase order.
8. Agency Address - Identify the ordering agency's address on the purchase order.
9. Phone Number - Identify the phone number for the ordering agency's contact person.
10. Total State Sales & Total Local Sales - Separately identify the total State dollars and/or Local Government agency dollars (pre-tax) for all orders placed in quarter.
11. 1.25% Remitted to DGS - Identify 1.25% of the total Local Government agency dollars reported for the quarter.
12. Grand Total - Identify the total of all State and Local Government agency dollars reported for the quarter.
Notes:
• A report is required for each SLP contract each quarter even when there are no new orders for the quarter.
• Quarterly reports are due two weeks after the end of the quarter.
Procurement Division | State of California | California Government Operations Agency 707 3rd Street, 2ndFloor | West Sacramento, CA 95605 | t 916.375-4400
ATTACHMENT B
ADA NOTICE
Procurement Division (State Department of General Services)
AMERICANS WITH DISABILITIES ACT (ADA) COMPLIANCE
POLICY OF NONDISCRIMINATION ON THE BASIS OF DISABILITY
To meet and carry out compliance with the nondiscrimination requirements of the Americans With Disabilities Act (ADA), it is the policy of the Procurement Division (within the State Department of General Services) to make every effort to ensure that its programs, activities, and services are available to all persons, including persons with disabilities.
For persons with a disability needing a reasonable accommodation to participate in the Procurement process, or for persons having questions regarding reasonable accommodations for the Procurement process, please contact the Procurement Division at (916) 375-4400 (main office); the Procurement Division TTY/TDD (telephone device for the deaf) or California Relay Service numbers which are listed below. You may also contact directly the Procurement Division contact person who is handling this procurement.
IMPORTANT: TO ENSURE THAT WE CAN MEET YOUR NEED, IT IS BEST THAT WE RECEIVE YOUR REQUEST AT LEAST 10 WORKING DAYS
BEFORE THE SCHEDULED EVENT (i.e., MEETING, CONFERENCE,
WORKSHOP, etc.) OR DEADLINE DUE-DATE FOR PROCUREMENT
DOCUMENTS.
The Procurement Division TTY telephone numbers are:
Sacramento Office: (916) 376-1891
Fullerton Office: (714) 773-2093
The California Relay Service Telephone Numbers are:
Voice: 1-800-735-2922 or 1-888-877-5379
TTY: 1-800-735-2929 or 1-888-877-5378
Speech-to-Speech: 1-800-854-7784
Updated 2/06/2018 16
Taborda ABC, LLC
ENS ABC, LLC
October 31, 2025 420 Boylston St., Suite 302
Boston, MA 02116
NOTICE OF ASSIGNMENT FOR THE BENEFIT OF CREDITORS
To the creditors, equity holders, and other parties in interest of Taborda Solutions, Inc. and/or Enterprise Networking Solutions Inc.:
Please be advised that Taborda Solutions, Inc., a California corporation (EIN: 76-0805711) and Enterprise Networking Solutions Inc., a California corporation (EIN: 68-0434432), (together, "Assignor") executed respective general assignments for the benefit of creditors (together, the "Assignment") on October 3, 2025 (the "Assignment Date") in favor of, respectively, Taborda ABC, LLC and ENS ABC, LLC (together, "Assignee"), ach a California limited liability company, pursuant to California law. The Assignment was approved b Assignor's board of directors and a majority of Assignor's stockholders. A fully executed copy of th Assignment can be shared upon request.
Pursuant to the Assignment, ownership of all of Assignor's assets, both tangible and intangible (collectively, the "Assets"), transferred to Assignee. Since the Assignment Date Assignee has (i) continued certain commercial operations and business activity of Assignor for which full payment to vendors is made in full and on time, (ii) begun the process of marketing the Assets for sale (the "Asset Sale Proces") and otherwise monetizing the Assets in behalf of Assignor's creditors, and (iii) begun preparing for the Distribution, as defined below (collectively, the "ABC Process"). The Asset Sale Process is expected to be completed in December 2025.
All parties wishing to assert any claim against Assignor must submit to Assignee no later than April 1, 2026 (the "Bar Date") a completed proof of claim, using the form attached hereto, along with supporting documentation.
The Assignee will analyze submissions to assess validity.
If at the conclusion of the ABC Process funds in the Assignment estate are sufficient for a distribution, Assignee will issue payments to parties that submitted valid claims to Assignee by the Bar Date (the "Distribution"). No other party will be entitled to share in the Distribution. Distributions generally follow a priority scheme in which secured claims are paid in full first, followed by priority unsecured claims, followed by general unsecured claims, followed by equity ownership interests. Neither this notice nor the filing of a claim guarantees that there will in fact be a recovery for any interested party. The ABC Process is expected to conclude shortly after the Bar Date.
Submissions can be emailed to [email protected] or mailed.
Sincerely,
Nate MO
Nate McOmber
Representative
Taborda ABC, LLC, solely in its limited capacity as assignee for the benefit of creditors of Taborda Solutions, Inc.
ENS ABC, LLC, solely in its limited capacity as assignee for the benefit of creditors of Enterprise Networking Solutions, Inc.
Enclosure: proof of claim form
Taborda ABC, LLC
ENS ABC, LLC
Proof of Claim 420 Boylston St., Suite 302
Assignment for the benefit of creditors of Taborda Solutions, Inc. and Enterprise Networking Solutions, Inc.
Claim submission deadline (the "Bar date"): April 1, 2026 The undersigned, an interested party of Taborda Solutions, Inc. and/or Enterprise Networking Solutions, Inc., hereby submits its claim, in the amount set forth below and substantiated by the attached documentation, in the assignment estate created on October 3, 2025 upon execution of the general ssignment for the benefit of creditors by and between Taborda Solutions, Inc. and Taborda ABC, LIC (solely in its limited capacity as assignee fo he benefit of creditors of Taborda Solutions. Inc.). or by and between Enterprise Networking Solutions. Inc. and ENS ABC, LIC (solelv in it limited capacity as assignee for the benefit of creditors of Taborda Solutions, Inc.).
Claimant Name: Basis for Claim:
Street Address: • Goods sold
• Money loaned
City: • Taxes
State and ZIP: • Wages
Contact Person Name: • Services performed
Telephone Number: • Equipment leased
Email: ] Equity interest
• Other (describe):
Claim Amount
Date of Submission
Summary of basis for claim and explanation of attached supporting documentation:
Requirements for Submission:
_ Completion of Proof of Claim Form
agreement exists between Assignor and claimant providing for the payment of interest, claimant may include interest owed as of the Attachment: Supporting Documentation Assignment Date.
3. If signing party is an authorized agent, please so indicate in the title Claims submissions will not be accepted unless all the above line and attach a power of attorney. items are fully completed and submitted prior to the Bar Date. 4. Digital signatures are acceptable.
Preference is for all documents to be included in a single PDF.
By my signature below, I declare under penalty of perjury, under the laws of the State of California, that the information provided herein and attached hereto is true and correct to the best of my knowledge and belief.
Signature:
Print Name: Completed proof of claim must be
Title: submitted by the above Bar Date
via email ([email protected]).
Company:
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
General Services Procurement Division
INFORMATION TECHNOLOGY - GENERAL PROVISIONS
NON-CLOUD GOODS & SERVICES
SECTION 1. DEFINITIONS. 2
SECTION 2. CONTRACT FORMATION 4
SECTION 3. ORDER OF PRECEDENCE... 5
SECTION 4. LICENSE GRANTS... 5
SECTION 5. SERVICES... 7
SECTION 6. INSPECTION, ACCEPTANCE & REJECTION...... 7
SECTION 7. PACKING, SHIPPING, TRANSPORTATION & DELIVERY... ...9 SECTION 8. WARRANTIES & REPRESENTATIONS. 10
SECTION 9. RIGHTS IN WORK PRODUCT & GOVERNMENT PURPOSE RIGHTS 12 SECTION 10. CONFIDENTIALITY; DATA RIGHTS . 13
SECTION 11. INDEMNIFICATION .. 15
SECTION 12. LIMITATION OF LIABILITY .. . 17
SECTION 13. STATUTORY & REGULATORY REQUIREMENTS; CONTRACTOR CERTIFICATIONS.. .. 18
SECTION 14. CONTRACTOR RESPONSIBILITIES ..22
SECTION 15. INVOICES; PAYMENTS; TAXES & AUDITS .. 23
SECTION 16. TERMINATION.. ..24
SECTION 17. DISPUTE RESOLUTION .. .27
SECTION 18. STOP WORK ..28
SECTION 19. SMALL BUSINESS (SB) PARTICIPATION & DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) PARTICIPATION REPORTING REQUIREMENTS.
SECTION 20. GENERAL TERMS........ ....30
SECTION 21. DATA PROTECTION PROVISIONS ..31
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
SECTION 1. DEFINITIONS
1.1 DEFINITIONS:
Unless otherwise specified in the Statement of Work, the following terms shall be given the meaning shown unless the context requires otherwise. Capitalized terms used in this Contract and not defined in the text of Contract have the meaning below.
1.1.1 Buyer: the State's or Eligible Public Entity's authorized Contracting official.
1.1.2 Contract: these Information Technology General Provisions - Non-Cloud Goods & Services (GSPD - ITGP (Non-Cloud)) and the other documents set forth in Section 3 (Order of Precedence) that collectively make up this Contract.
1.1.3 Contractor: individual(s) or business entity with whom the State enters this Contract.
1.1.4 Data Breach: any access, destruction, loss, theft, use, modification, or disclosure of State Data by an unauthorized party or that is in violation of Contract terms or applicable state or federal law.
1.1.5 Day(s): calendar day(s) unless otherwise indicated.
1.1.6 Deliverables: Software, Services, Goods, works of authorship, and any other items (e.g., reports, Documentation) to be delivered pursuant to this Contract, including any incidental items.
1.1.7 Documentation: instructions, specifications, training materials, or other documents provided in hard copy or electronic form with the Software, Services, Goods, or otherwise, in accordance with Contract.
1.1.8 Eligible Public Entity: includes the county, city, city and county, district, public authority, public agency, municipal corporation, or any other political subdivision or public corporation in the State. Eligible Public Entity also includes a federally recognized tribal entity acting in its tribal governmental capacity.
1.1.9 Goods: all types of tangible personal property, including materials, supplies, and equipment (including computer, telecommunications, broadband equipment) (PCC §10290(d))
1.1.10 Hardware: physical, tangible elements of equipment or Software products to be delivered pursuant to this Contract.
1.1.11 Recovery Point Objective (RPO): the point in time to which State Data can be recovered and systems restored when service is restored after an interruption. The RPO is expressed as the length of time between the interruption and the most proximate backup of State Data immediately preceding the interruption.
1.1.12 Recovery Time Objective (RTO): the period of time within which information technology services, Systems, applications, and functions must be recovered following an unplanned interruption.
1.1.13 Reseller (see also "Contractor"): business entity authorized by the Service Provider or Software publisher to resell the Deliverables to the State.
1.1.14 Security Incident: an actual or suspected Data Breach.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
1.1.15 Services: an all-inclusive term which includes, but is not limited to, support services (such as maintenance and operation) and other personal services (e.g., technical or professional services, such as consulting and direction, project management, implementation, training, customization) provided by Contractor in accordance with this Contract.
1.1.16 Service Provider: provider of the Services under Contract, as set forth in the Statement of Work, if applicable.
1.1.17 Software: an all-inclusive term which refers to any computer programs, routines, or subroutines supplied by Contractor, including operating Software, application programs, programming aids, program products, or enabling Software that facilitates use of on- premises.
1.1.18 State: refers to the government of the State of California, its employees, and authorized representatives, including, without limitation, any department agency or government unit of the State as identified in the Contract.
1.1.19 State Data: all data owned by the State and submitted to, processed by, or stored under this Contract and includes, but is not limited to, all data that originated with the State or Users, all data provided by the State or Users, and all data generated, manipulated, produced, reported by, or otherwise emanating from or by applications run by the State or Users on the Systems or Services. For clarity, and without narrowing the scope of this definition, State Data is synonymous with "customer data," "customer content," or similar terms, as may be used in Contractor's or Service Provider's service agreement and incorporated into Contract as an attachment or by reference, and includes the following:
(a) Non-Public Data: data, including Personal Information, that is not subject to distribution to the public as Public Information. It is deemed to be sensitive or confidential by the State because it contains information that may be exempt by statute, regulation, or policy from access by the general public as Public Information. (b) Personal Information: has the definition set forth in the California Information Practices Act (Civ. Code, § 1798).
(c) Public Information: any information prepared, owned, used, or retained by the State and not specifically exempt from the disclosure requirements of the California Public Records Act (Gov. Code, § 7920.00 et seq.) or other applicable state or federal laws. For clarity, "Public Information" is also interchangeable with "Public Data".
1.1.20 Statement of Work (SOW): description of the State's requirements for work that includes but is not limited to Deliverables, major tasks, detailed work plans, methods, goals, objectives, timeframes, locations, and contacts.
1.1.21 System: Hardware, Software, and Services as described in this Contract when integrated, functioning together, and performing in accordance with this Contract.
1.1.22 U.S. Intellectual Property Right: any intellectual property right enforceable in the United States, including, without limitation, rights in trade secrets, copyrights, and U.S. patents.
1.1.23 User(s) (or Customer): any State or Eligible Public Entity's authorized end user of the Deliverables, including employees, independent contractors, authorized agents, auditors, and other independent providers as may be agreed by the parties.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
SECTION 2. CONTRACT FORMATION
2.1 CONTRACT FORMATION:
The State and Contractor are individually referred to as "Party" and collectively referred to as "Parties."
2.1.1 Sealed Bid. If this Contract results from a sealed bid offered in response to a solicitation conducted pursuant to Chapters 2 (commencing with § 10290), 3 (commencing with § 12100), and 3.6 (commencing with § 12125) of Part 2 of Division 2 of the Public Contract Code (PCC), then Contractor's bid is a firm offer to the State which is accepted by the issuance of this Contract and no further action is required by either party.
2.1.2 Other Offers, Quotes, or Proposals. If this Contract results from a solicitation other than as set forth in Section 2.1.1, Contractor's quotation or proposal is deemed a firm offer and this Contract is the State's acceptance of that offer.
2.1.3 Joint Bid. If this Contract resulted from a joint bid, it shall be deemed one indivisible Contract. Each such joint Contractor will be jointly and severally liable for the performance of the entire Contract. The State assumes no responsibility or obligation for the division of orders or purchases among joint Contractors.
2.2 CONTRACTOR'S POWER & AUTHORITY:
2.2.1 Contractor warrants that it has full power and authority to grant the rights herein and will hold the State harmless from and against any loss, cost, liability, and expense (including reasonable attorney fees) arising out of any breach of this warranty. The State will notify Contractor promptly in writing of any such claim, and Contractor will have sole control of the defense of any claim and all negotiations for its settlement or compromise, provided that:
(a) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is required by law, the State may participate in such action at its own expense with respect to attorneys' fees and costs (but not liability); (b) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services (DGS), or as appropriate, the California Department of Technology (CDT), must approve any settlement or compromise, which approval will not unreasonably be withheld or delayed; and
(c) the State will reasonably cooperate in the defense and in any related settlement negotiations. Further, Contractor agrees it will not enter into any arrangement with any third-party which may diminish any rights of the State under this Contract.
2.2.2 To the extent Contractor is a Reseller, Contractor warrants that (a) the Service Provider has reviewed this Contract; (b) in Contractor's agreement with the Service Provider, the Service Provider has agreed to accept the responsibilities, obligations, and liabilities (such as License Grant, Inspection, Acceptance, Rejection, Warranties, Confidentiality, Indemnification, Data Protection Provisions) under this Contract that naturally reside with the Service Provider with respect to the provision of Deliverables; and (c) Contractor can provide the Deliverables in accordance with the Contract.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
2.2.3 Nothing contained in this Contract, or otherwise, shall create any contractual relation between the State and any subcontractors, and no subcontract shall relieve Contractor of Contractor's responsibilities and obligations hereunder. Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by Contractor. Contractor's obligation to pay its subcontractors is an independent obligation from the State's obligation to make payments to Contractor. As a result, the State shall have no obligation to pay any moneys to any subcontractor.
SECTION 3. ORDER OF PRECEDENCE
In the event of any inconsistency or conflict between the sections, exhibits, attachments, specifications, or provisions comprising the Contract, the following order of precedence shall apply:
(a) These GSPD - ITGP (Non-Cloud) (except in the instances herein where the provision contains "Unless otherwise specified in the Statement of Work" (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in these (GSPD - ITGP (Non-Cloud));
(b) Contract form(s), i.e., Purchase Order STD 65, Standard Agreement STD 213, FI$Cal generated Purchase Order, etc., and any amendments;
(c) Other Special Provisions (except in the instances therein where the provision contains "Unless otherwise specified in the Statement of Work" (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in the applicable Special Provisions);
(d) Statement of Work (SOW), as an exhibit, including any specifications incorporated by reference herein;
(e) Cost worksheets;
(f) Other work description, work authorization or exhibit issued by Users; and (g) All other Contractor's or Service Provider's attachments included in the Contract and/or incorporated in the Contract by reference (e.g., end user license agreements, (h) acceptable use policies, service guides, product specific terms and conditions).
SECTION 4. LICENSE GRANTS
4.1 SOFTWARE LICENSE:
Unless otherwise specified in the Statement of Work, Contractor hereby grants to the State and the State accepts from Contractor, subject to the terms and conditions of this Contract, a perpetual, irrevocable, royalty-free, non-exclusive license to use the Software, as well as and any Documentation.
The State may use the Software and Documentation in the conduct of its own business and any division thereof.
The license granted herein authorizes the State to use the Software in machine-readable form on the computer System located at the site(s) specified in the Statement of Work. The computer System and its associated units (collectively, CPU) are as designated in the Statement of Work. If the designated CPU is inoperative due to malfunction, the license
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
granted herein shall be temporarily extended to authorize the State to use the Software, in machine-readable form, on any other State CPU.
By prior written notice, the State may redesignate the CPU in which the Software is to be used, provided that the redesignated CPU is substantially similar in size and scale, at no additional cost. The redesignation shall not be limited to the original site and will be effective upon the date specified in the notice of redesignation.
Acceptance of commercial Software (including third-party Software) and custom Software will be governed by the terms and conditions of the Contract.
4.2 RIGHT TO COPY OR MODIFY:
Any Software provided by Contractor in machine-readable form may be copied, in whole or in part, in printed or machine-readable form, for use by the State with the designated CPU, to perform one-time benchmark tests, for archival or emergency restart purposes, to replace a worn copy, to understand the contents of such machine-readable material, or to modify the Software as provided below; provided, however, that no more than the number of printed copies and machine-readable copies as specified in the Statement of Work will be in existence under this Contract at any time without Contractor's prior written consent, which shall not be unreasonably withheld. The original, and any copies of the Software, in whole or in part, which are made hereunder shall be the property of Contractor.
Unless prohibited or restricted in the Statement of Work, the State may modify any non- personal computer Software, in machine-readable form, for its own use and merge it into other program material. Any portion of the Software included in any merged program material shall be used only on the designated CPUs and shall be subject to the terms and conditions of the Contract.
4.3 FUTURE RELEASES:
Unless otherwise specified in the Statement of Work, if improved versions, patches, corrections, modifications, bug fixes, updates, or releases (collectively, Updates) of the Software versions are developed by Contractor and are made available to other licensees, such Updates will be made available to the State at no additional cost only if such are made available to other licensees at no additional cost. If Contractor offers new versions or upgrades to the Software, they shall be made available to the State at the State's option, at a price no greater than the Contract price, plus a price increase proportionate to the increase from the list price of the original version to that of the new version, if any. If the Software has no list price, such price increase will be proportionate to the increase in average price from the original to the new version, if any, as estimated by Contractor in good faith.
4.4 AUTHORIZATION CODES:
When encryption/CPU identification (ID) authorization codes are required to operate the Software, Contractor will provide all codes to the State with delivery of the Software. In case of inoperative CPU, Contractor will provide a temporary encryption/CPU ID authorization code to the State for use on a temporarily authorized CPU until the designated CPU is returned to operation. When changes in designated CPUs occur, the State will notify Contractor by telephone or e-mail of such change. Upon receipt of such notice, Contractor will issue to the State within 24 hours, via telephone or e-mail, a temporary encryption/CPU ID authorization code for use on the newly designated CPU until such time as a permanent code is assigned.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
4.5 DOCUMENTATION:
Contractor agrees to provide to the State, at no charge, all Documentation as described within the Statement of Work, and updated versions thereof, which are necessary or useful to the State in its use of the Deliverables or the System provided hereunder. The State may reproduce the Documentation as reasonably necessary to use the Deliverables or System, provided that all such copies reproduce Contractor's proprietary markings in the same form and manner as the original. Contractor agrees to provide additional Documentation at prices not in excess of charges made by Contractor to its other customers for similar Documentation or Contract rate.
If Contractor is no longer performing or unable to perform support or maintenance on the Deliverables or the System purchased under this Contract, then upon written notice by the State, Contractor will provide adequate and reasonable assistance with relevant documentation to allow the State to perform maintenance based on Contractor's methodology, at Contractor's then current rates and fees. Contractor agrees that the State may reproduce such Documentation for the State's own use in maintaining the Deliverables or the System, and Contractor agrees to license any other Contractor that the State may have hired for maintenance to use the above noted Documentation. The State agrees to include Contractor's copyright notice on any such Documentation reproduced, in accordance with copyright instructions to be provided by Contractor.
SECTION 5. SERVICES
5.1 SUPPORT SERVICES:
If applicable, Contractor will provide the support services for the periods set forth in the Contract, subject to the State's payment of the applicable support and maintenance fees.
5.2 PROFESSIONAL SERVICES:
If applicable, Contractor will provide professional Services in accordance with Contract. The State shall provide reasonable access to information, documentation, facilities, equipment, Hardware, Software, and personnel as agreed by the Parties to facilitate Contractor's performance of the professional Services.
SECTION 6. INSPECTION, ACCEPTANCE & REJECTION
6.1 ACCEPTANCE TESTING:
Unless otherwise specified in the Statement of Work:
6.1.1 Non-Customized Deliverables. When acquiring Goods or commercial Software, the State shall rely on Contractor's existing quality assurance system as a substitute for State inspection and testing. All Goods may be subject to inspection, test, and acceptance by the State or its authorized representatives at the destination, notwithstanding any payment or inspection at source.
6.1.2 Customized Deliverables. For all other Software, Goods, or Services customized for the State pursuant to Contract, Contractor will ensure and maintain a quality assurance system acceptable to the State covering such Deliverables and will tender to the State only those
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
Deliverables that have been inspected and found to conform to this Contract's requirements.
All Goods may be subject to inspection, test and acceptance by the State or its authorized representatives, at destination, notwithstanding any payment or inspection at source.
6.1.3 Contractor Duties. Contractor shall provide all reasonable facilities for the safety and convenience of inspectors at no additional cost to the State. Contractor shall furnish to inspectors all information and data reasonably required to perform inspection and testing.
Contractor shall keep records evidencing inspections and their result and will make these records available to the State during Contract performance and for 3 years after final payment.
Contractor shall permit the State to review procedures, practices, processes, and related documents to determine the acceptability of Contractor's quality assurance system or other similar business practices related to performance of Contract.
6.2 NOTICE OF REJECTION:
The State shall give written notice of rejection (Rejection Notice) of Deliverables provided, performed or delivered within a reasonable time after receipt or performance of such Deliverables. The Rejection Notice will provide information on which Deliverables do not substantially conform to required specifications. If the State does not provide a Rejection Notice within 30 Days of delivery or within such time provided in the Contract for inspection, acceptance and rejection if longer than 30 Days, such Deliverables will be deemed to have been accepted.
In the event any Deliverables should fail to conform to Contractual requirements, or to the sample submitted by Contractor (if applicable), the State may reject the same, and Contractor shall reclaim and remove the item promptly or correct the performance of Services, without expense to the State, and immediately replace all such rejected items with items conforming to the Contract.
6.2.1 Bulk Purchases: Unless otherwise specified in the Statement of Work, the State shall have the right to reject entire batches of Goods delivered if 20% of the batch fails the State's inspection. Except as specifically stated in this Section, the State further has the right to require Contractor to inspect, test and verify that the Deliverables conform to Contract requirements.
6.3 ACCEPTANCE:
Acceptance by the State will be final and irreversible, except as it relates to latent defects, fraud, and gross mistakes amounting to fraud. Acceptance shall not be construed to waive any warranty rights that the State might have at law or by express reservation in this Contract with respect to any non-conformity.
6.4 TITLE:
Unless otherwise specified in the Statement of Work, title to Goods and Software shall remain with Contractor and assigns, if any, until there is successful completion of the acceptance testing. Title to a special feature installed on a machine IT Equipment and for which only a single installation charge was paid shall pass to the State at no additional charge, together with title to the machine IT Equipment on which it was installed.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
6.5 SAMPLES & DEMONSTRATIONS:
The State may request samples or demonstrations for inspection and specification testing and Contractor shall furnish samples free of charge. The samples furnished must be identical to the Goods and Services as set forth in the bid or as specified in the Contract. Samples, if not destroyed by tests, may, upon request at the time the sample is furnished, be returned at Contractor's expense. All samples shall be provided, or demonstrations of Deliverables shall be conducted at no cost to the State.
SECTION 7. PACKING, SHIPPING, TRANSPORTATION & DELIVERY
7.1 PACKING:
All Goods shall be packed in suitable containers for protection in shipment and storage, and in accordance with applicable specifications. Each container of a multiple-container shipment shall be identified to:
(a) show the number of the container and the total number of containers in the shipment; (b) the number of the container in which the packing sheet has been enclosed; (C) be made as specified in the Contract, as it may be amended, or otherwise directed in writing by the State's Transportation Management Unit within the Department of General Services, Procurement Division.
7.2 SHIPMENT:
Unless otherwise specified in the Statement of Work or otherwise directed in writing by the State's Transportation Management Unit within DGS' Procurement Division (Transportation Management Unit), all shipments by Contractor or its subcontractors must include packing sheets identifying: (a) the State's Contract number and line item number; item number; (b) quantity and unit of measure, and quantity in unit of measure; ( c) part number and description of the Goods shipped; and (d) appropriate evidence of inspection, if required. Goods for different Contracts shall be listed on separate packing sheets.
7.3 TRANSPORTATION COSTS & OTHER FEES OR EXPENSES:
7.3.1 No Additional Charges. No charge for delivery, drayage, express, parcel post, packing, cartage, removal of dunnage (if applicable), insurance, license fees, permits, cost of bonds, or for any other purpose will be paid by the State unless expressly included and itemized in the Contract.
7.3.2 Free on Board (F.O.B). Contractor must strictly follow the Contract requirements regarding F.O.B., freight terms and routing instructions. The State may permit use of an alternate carrier at no additional cost to the State with advance written authorization of the Buyer.
7.3.3 F.O.B. Shipping Point Transactions. Should any shipments under the Contract be lost or received by the State in a damaged condition, and any related freight loss and damage claims filed against the carrier or carriers be wholly or partially declined by the carrier or carriers with the inference that loss or damage was the result of the act of the shipper such as inadequate packaging or loading or some inherent defect in the equipment or material, Contractor, on request of the State, shall at Contractor's own expense, assist the State in
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
establishing carrier liability by supplying evidence that the equipment or material was properly constructed, manufactured, packaged, and secured to withstand normal transportation conditions.
7.3.4 Prepay & Add. Unless otherwise specified in the Statement of Work or approved by the Transportation Management Unit, if "prepay and add" is selected, supporting freight bills are required when over $50.
7.4 DELIVERY:
Contractor shall strictly adhere to the delivery and completion schedules specified in the Contract. The quantities specified herein are the only quantities required. If Contractor delivers more than the quantities specified, the State shall not be required to make any payment for the excess Goods and may return them to Contractor at Contractor's expense or utilize any other rights available to the State at law or in equity.
7.5 NEWLY MANUFACTURED GOODS:
Unless otherwise specified in the Statement of Work, all Goods supplied under the Contract shall be newly manufactured Goods or certified as new and warranted as new by the manufacturer; and used or reconditioned Goods are prohibited, unless otherwise specified.
7.6 SUBSTITUTIONS:
Substitution of Deliverables may not be tendered without advance written consent of the Buyer.
Contractor shall not use any specification in lieu of those contained in Contract without Buyer's prior written consent.
SECTION 8. WARRANTIES & REPRESENTATIONS
8.1 WARRANTIES' DURATION & ASSIGNMENT:
8.1.1 Unless otherwise specified in the Statement of Work, the warranties in this Section 8 begin upon delivery of the Deliverables (or activation date in case of Software, as applicable).
For clarification, this warranty period shall apply to any Deliverables provided as part of warranty replacement.
8.1.2 Unless otherwise specified in the Statement of Work, duration of warranty for Deliverables shall be as follows:
(a) Warranty for Goods shall terminate one year after delivery of the Goods. (b) Warranty for Software and Services shall be for the duration of the State's use of the Software and Services.
8.1.3 All warranties, including additional warranties specified elsewhere herein, shall inure to the State, its successors, assignees, Buyer, and Users of Deliverables.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24).
8.2 WARRANTIES FOR DELIVERABLES:
Contractor warrants that Deliverables:
(a) will substantially conform to the requirements of the Contract (including without limitation all descriptions, specifications, and drawings identified in the Statement of Work),
(b) will substantially conform to the manufacturer's published specifications and the requirements of the Contract (including without limitation all descriptions, specifications, and drawings identified in the Statement of Work),
(c) will be free from material defects in materials and workmanship, (d) shall provide all material functionality required where the Parties have agreed to design specifications (such as a detailed design document) and incorporated the same or equivalent in the Statement of Work directly or by reference, provided however, that the State's approval of designs or specifications furnished by Contractor shall not relieve Contractor of its obligations under this warranty, and
(e) will not infringe or violate any U.S. Intellectual Property Right.
8.3 ADDITIONAL WARRANTIES FOR SERVICES:
The Services will be performed in a skilled, professional manner by competent personnel and in accordance with the Contract.
8.4 ADDITIONAL WARRANTIES FOR SOFTWARE
Contractor warrants that Software supplied hereunder has been tested in accordance with industry standards to minimize the risk, at the time of delivery, of harmful code (e.g., computer viruses, worms, trap doors, time bombs, disabling code, or any similar malicious mechanism designed to interfere with the intended operation of, or cause damage to, computers, data, or Software). Without limiting the generality of the foregoing, if the State believes that harmful code may be present in any commercial Software delivered hereunder, Contractor will, upon the State's request, provide a new or clean install of the Software.
8.4.1 Unless otherwise specified in the Statement of Work:
(a) Contractor does not warrant that any Software provided hereunder is error-free or that it will run without immaterial interruption.
(b) Contractor does not warrant and will have no responsibility for a claim to the extent that it arises directly from: (i) a modification made by the State, unless such modification is approved or directed by Contractor; (i) use of Software in combination with or on products other than as specified by Contractor; or(iii) misuse or unauthorized use by the State.
8.5 PASS-THROUGH WARRANTIES:
8.5.1 In addition to the warranties set forth herein, any Goods provided by Contractor shall be covered by the manufacturer's consumer warranty that will be passed through to the State.
Contractor shall provide the manufacturer's warranty information (e.g., terms and conditions, provider, etc.) to the State with all Goods at the time of delivery. Where Contractor resells
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
Goods it purchased from a third-party, Contractor, to the extent it is legally able to do so, will pass through any such third-party warranties to the State and will reasonably cooperate in enforcing them. Contractor shall facilitate Goods replacement or cooperate in resolving any disputes with the Goods manufacturer. Any Software provided by the Service Provider or Contractor shall be covered by the software developer's consumer warranty that will be passed through to the State.
8.5.2 Contractor agrees that the warranty pass-through set forth herein shall not relieve Contractor from Contractor's warranty obligations set forth herein.
8.6 REMEDIES FOR BREACH OF WARRANTY:
Unless otherwise specified in the Statement of Work, the State's remedy for any breach of the warranty provided in this Section 8 shall include, at the State's sole discretion: (a) re- performance, repair, or replacement of the nonconforming Deliverables (including without limitation an infringing Deliverable); or (b) right to terminate the Contact, either in whole or in part, and a refund of all amounts paid by the State for the nonconforming Deliverable and payment to the State of any additional amounts necessary to equal the State's Cost to Cover. "Cost to Cover" means the cost, properly mitigated, of procuring Deliverable of equivalent capability, function, and performance. If Contractor fails to re-perform, repair, replace, or refund fees paid for the Deliverable as appropriate, the State may terminate Contract.
8.7 DISCLAIMER:
EXCEPT FOR THE WARRANTIES SPECIFIED IN THIS CONTRACT, CONTRACTOR
MAKES NO OTHER EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT
LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SECTION 9. RIGHTS IN WORK PRODUCT & GOVERNMENT PURPOSE RIGHTS
9.1 OWNERSHIP & RIGHTS IN WORK PRODUCT:
9.1.1 Work Product. Unless otherwise specified in the Statement of Work (or as required for federally funded projects), all inventions, discoveries, intellectual property, technical communications, and records originated or prepared by Contractor pursuant to the Contract including papers, reports, charts, computer programs, and other Documentation or improvements thereto, and including Contractor's administrative communications and records relating to this Contract (collectively, Work Product), shall be Contractor's exclusive property.
9.1.2 Pre-Existing Material. Software, and components, and other materials developed or otherwise obtained by or for Contractor or its affiliates independently of the Contract (Pre- Existing Materials) do not constitute Work Product. If Contractor creates Derivative Works of Pre-Existing Materials, the elements of such Derivative Works created pursuant to the Contract based upon the Work Product, such as an enhancement, update, translation, abridgment, summary, or aggregation. Nothing in this Section will be construed to interfere with Contractor's or its affiliates' ownership of Pre-Existing Materials.
9.1.3 Jointly Developed Work Product. The ideas, concepts, know-how, techniques, customizations, or configurations, relating to data processing, developed during the Contract
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
by Contractor or jointly by Contractor and the State may be used by either Party without obligation of notice or accounting.
9.1.4 Proprietary Products. The Contract shall not preclude Contractor from developing materials outside the Contract that are competitive, irrespective of their similarity to materials which might be delivered to the State pursuant to the Contract.
9.2 GOVERNMENT PURPOSE RIGHTS:
The State will have Government Purpose Rights to Work Product. "Government Purpose Rights" are the unlimited, irrevocable, worldwide, perpetual, royalty-free, and non-exclusive rights and licenses to use, modify, reproduce, perform, release, display, create Derivative Works from, and disclose the Work Product. Government Purpose Rights also include the right to release or disclose the Work Product outside the State for any State government purpose and to authorize recipients to use, modify, reproduce, perform, release, display, create Derivative Works from, and disclose the Work Product for any State government purpose.
Such recipients of the Work Product may include, without limitation, State Contractors, California local governments, the U.S. federal government, U.S. tribal governments, and state and local governments of other states. Government Purpose Rights do not include any rights to use, modify, reproduce, perform, release, display, create Derivative Works from, or disclose the Work Product for any commercial purpose.
9.3 FEDERALLY FUNDED PROJECTS:
This Section and the rights hereunder may be modified in the Statement of Work as required for federally funded projects pursuant to federal law or regulations, including, but not limited to, 7 CFR 277.18 and 45 CFR 95.617.
SECTION 10. CONFIDENTIALITY; DATA RIGHTS
10.1 CONFIDENTIALITY OBLIGATIONS:
Each Party will ensure that access to the other Party's confidential information is only provided to those individuals who need access to such information to fulfill their obligations under the Contract. With regards to the State, confidential information includes Personal Information and Non-Public Data maintained by State agencies.
Confidential information does not include information that: (a) is or enters the public domain without breach of this Contract; (b) came into the receiving Party's possession from a third- party entitled to disclose such information without an obligation of confidentiality; (c) is independently developed by the receiving Party without use or reference to the disclosing Party's confidential information; or (d) required to be produced in compliance with statute, regulation or court order, provided that Contractor provides advance written notice of such disclosure to the State.
10.2 CONFIDENTIALITY OF STATE DATA:
State Data, including all financial, statistical, personal, technical, and other data and information relating to the State's operation, which are designated confidential by the State and made available to Contractor in order to carry out the Contract, or which become available to Contractor in carrying out the Contract, shall be protected by Contractor from unauthorized use
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
and disclosure through the observance of the same or more effective procedural requirements as are applicable to the State. The identification of all such confidential data and information as well as the State's procedural requirements for protection of such data and information from unauthorized use and disclosure shall be provided by the State in writing to Contractor.
Contractor shall comply and ensure compliance by the Service Provider with the Security and Data Protection provisions set forth in the GSPD - ITGP (Non-Cloud). Contractor shall not be required under this Section to keep confidential any data or information which meet the exceptions set forth in Section 10.1.
10.3 CONTRACTOR'S CONFIDENTIALITY OBLIGATIONS:
Contractor shall have appropriate agreements in place to ensure confidentiality and security of State Data required pursuant to the Contract. Contractor shall ensure that all Contractor and Service Provider personnel with access to State Data shall comply with security and confidentiality obligations set forth in the Contract.
10.4 RIGHTS TO STATE DATA:
All rights, including all intellectual property rights, in and to State Data, shall remain the exclusive property of the State. Contractor has a limited, non-exclusive license to access and use State Data solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to State Data, including user tracking and exception data within the System, by implication, estoppel, or otherwise, under U.S. Intellectual Property Rights, to any third-party. Unauthorized use of State Data by Contractor or third parties is prohibited. For the purposes of this requirement, the phrase "unauthorized use" includes data mining, machine learning from data, or processing of data, stored or transmitted by the System, for any purpose that is not authorized by the Contract or Statement of Work.
10.5 RESTRICTIONS ON USE OF STATE DATA:
Contractor shall not collect, use, disclose, retain, or maintain (collectively, "use") State Data except as necessary and proportionate to perform Contractor's obligations under the Contract. contractor shall not: (a) transter, share, rent, barter, trade, sell, loan, lease, or otherwise distribute or make available to any third-party any State Data except as expressly permitted by the Contract; (b) copy, modify, destroy, or delete State Data during the Contract term; and (c) shall not sell or share State Data or Personal Information collected in the service of Contract with the State. For the purposes of this Section, "collect" and "collected" have the meaning provided in Civil Code Section 1798.140, subdivision (f) and "sell" has the meaning provided in Civil Code Section 1798.140, subdivision (ad)(1).
10.6 PROTECTION OF CONTRACTOR'S PROPRIETARY SOFTWARE & OTHER PROPRIETARY DATA AND MATERIALS:
All material appropriately marked or identified in writing as proprietary and supplied hereunder are provided for the State's exclusive use for the purposes of the Contract only. All such proprietary materials (including proprietary data) shall remain the property of Contractor.
Subject to the Public Records Act (Gov. Code, § 7920.00 et seq.), or other applicable law or legal process, the State agrees to: (a) take all reasonable steps to ensure that such proprietary materials/data are not disclosed to others; (b) provide prior written notice to Contractor in
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
sufficient time to seek a protective order (unless such notice is prohibited by law); (c) ensure, prior to disposing of any media, that any licensed materials have been erased, destroyed, or otherwise sanitized; and (d) take appropriate action by instruction, agreement, or otherwise with its employees or other persons permitted access to licensed Software and other proprietary data to satisfy its obligations in the Contract with respect to use, copying, modification, protection, and security of proprietary Software and other proprietary materials.
10.7 LEGAL REQUESTS:
Contractor shall notify the State by the fastest means available, not later than 48 hours after receipt, of any subpoena, warrant, court order, service of process, California Public Records Act (Gov. Code, § 7920.00 et seq.) request, and or other legal request ("Requests") which seeks access to State Data or information about the State's use of the Deliverables, unless such notification is prohibited by law. Unless prohibited by law, Contractor shall also provide written notice to Contracting agency (Buyer) and to the Agency Chief Information Security Officer (CISO) or designee of Contracting agency. Unless prohibited by law, Contractor shall not respond to such Requests unless authorized in writing to do so by the State and shall not respond to such Requests directed at Contractor regarding the Contract without first notifying the State in writing. Unless prohibited by law, Contractor shall provide the State with its intended responses to such Requests with adequate time for the State to review, revise, and, if necessary, seek a protective order.
SECTION 11. INDEMNIFICATION
11.1 INTELLECTUAL PROPERTY (IP) INDEMNITY:
11.1.1 Contractor's IP Indemnification Obligations. Notwithstanding Section 12 (Limitation of Liability), Contractor will indemnify, defend, and save harmless the State, its officers, agents, and employees from any and all third-party claims, costs, expenses (including without limitation reasonable attorneys' fees), fines, penalties, deficiencies, liabilities, and losses (including settlements and judgments) arising from or related to any allegation that the Deliverables violate, misappropriate, or infringe of any U.S. Intellectual Property Right.
11.1.2 Pass-Through Indemnity for Third-Party Obligations. With respect to such claims arising from Deliverables provided by a third-party and supplied by Contractor to the State, Contractor will pass-through to the State such indemnity rights as it receives from such third- party ("Third-Party Obligation") and will cooperate in enforcing them; provided that if the third- party manufacturer fails to honor the Third-Party Obligation, Contractor will indemnify, defend, and save harmless the State, its officers, agents, and employees, to the same extent as the Third-Party Obligation, subject to any applicable limitation of liability in Section 12 (Limitation of Liability).
11.1.3 Notice of Remedy for IP Infringement. Should the Deliverables whether provided by Contractor or manufactured by a third-party become, or in Contractor's opinion are likely to become, the subject of a claim of infringement or violation of a U.S. Intellectual Property Right, Contractor shall provide the State with written notice of the circumstances giving rise to such claim or likely claim. If the State receives notice of a claim of infringement, or is made Party to, or is threatened with such claim, the State will provide Contractor with notice of such claim or threat.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
(a) Following receipt of such notice, Contractor will either (at Contractor's expense): (i) procure for the State the right to continue using the Deliverables; or (i) replace or modify the same so that they become non-infringing. If none of these options can reasonably be exercised, Contractor shall take back such Goods or other Deliverables and terminate any infringing Services, make every reasonable effort to assist the State in procuring substitute Deliverables for the State, and pay the State any additional amounts necessary to equal the State's Cost to Cover. If none of the foregoing options is reasonably acceptable to the State, the State shall have the right to terminate the Contract, in whole or in part, without damage, penalty, termination charge, or further obligation and Contractor agrees to refund any sums the State has paid Contractor less any reasonable amount for use or damage.
(b) Contractor shall have no liability to the State under any provision of this Section 11.1 with respect to any claim of patent, copyright, or trade secret infringement which is based upon: (i) the State's combination or utilization of Goods supplied hereunder with non-Contractor supplied Goods; (i) the combination or utilization of Services not made or supplied by Contractor, and introduced into the State's computing environment; (iii) the modification initiated by the State, or a third-party at the State's direction, of any Deliverables supplied hereunder; (iv) the combination or utilization of Goods supplied hereunder with non-Contractor supplied other Deliverables; or (v) the State's unauthorized use, or continuing infringing use after notification, of Deliverables supplied hereunder.
(c) Contractor certifies that it has appropriate systems and controls in place to ensure that State funds will not be used in the performance of this Contract for the acquisition, operation, or maintenance of Software in violation of any U.S. intellectual property laws.
11.2 INDEMNIFICATION FOR INJURY OR DAMAGE:
Contractor shall indemnify, defend, and save harmless the State, its officers, agents, and or omissions of Contractor or any of its affiliates, agents, subcontractors, employees, suppliers, or laborers supplying work, services, materials, or supplies in connection with the performance of the Contract.
11.3 INDEMNIFICATION PROCESS:
Unless a Third-Party Obligation provides otherwise, the defense and payment obligations for indemnification under Sections 13.1 and 11 are conditioned on the following:
The State will notify Contractor promptly in writing of any demand for indemnification and, in the notification, describe the circumstances giving rise to the demand. Notwithstanding the foregoing, if Contractor is not notified of a claim in a timely manner, Contractor is still obligated to indemnify the State, unless such delay causes material prejudice to Contractor. Contractor will have sole control of the defense of any claim and all negotiations for its settlement or compromise; provided that:
(a) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
of the State is required by law, the State may participate in such action at its own expense with respect to attorneys' fees and costs (but not liability; or (b) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, DGS or CDT, as appropriate, must approve any settlement or compromise and the State will reasonably cooperate in the defense and in any related settlement negotiations.
SECTION 12. LIMITATION OF LIABILITY
12.1 LIMITATION OF LIABILITY:
Except as may be otherwise approved by DGS-PD's Deputy Director or their designee, or as applicable, CDT's Office of Statewide Technology Procurement Deputy Director (STP), Contractor's liability for damages to the State for any cause whatsoever, and regardless of the form of action, whether in Contract or tort, shall be limited to the Purchase Price. "Purchase Price" means the aggregate Contract price; except that, with respect to a Contract under which multiple purchase orders will be issued (e.g., a Master Agreement or Multiple Award Schedule Contract), "Purchase Price" will mean the total price of the purchase order for the Deliverable(s) that gave rise to the loss, such that Contractor will have a separate limitation of liability for each purchase order. The State's liability for damages for any cause whatsoever, and regardless of the form of action whether in Contract or in tort, shall be limited to the Purchase Price as that term is defined above. Nothing herein shall be construed to waive or limit the State's sovereign immunity or any other immunity from suit provided by law.
IN NO EVENT WILL A PARTY BE LIABLE TO THE OTHER FOR CONSEQUENTIAL,
INCIDENTAL, INDIRECT, SPECIAL, OR PUNITIVE DAMAGES, EVEN IF NOTIFICATION
HAS BEEN GIVEN AS TO THE POSSIBILITY OF SUCH DAMAGES, EXCEPT (A) TO THE
EXTENT THAT CONTRACTOR'S LIABILITY FOR SUCH DAMAGES IS SPECIFICALLY SET
FORTH IN THE STATEMENT OF WORK OR (B) TO THE EXTENT THAT CONTRACTOR'S
LIABILITY FOR SUCH DAMAGES FALLS UNDER ONE OF THE EXCEPTIONS IN SECTION
12.2 BELOW.
12.2 EXCEPTIONS:
The foregoing limitation of liability shall not apply to: (a) any liability under Section 13.1 (Compliance with Statutes & Regulations); (b) liability under Section 11.1 (Intellectual Property (IP) Indemnity) or to any other liability (including, without limitation, indemnification obligations) for infringement of third-party intellectual property rights; (c) liability under Section 11.2 (Indemnification for Injury or Damage); (d) costs or attorney's fees that the State becomes entitled to recover as a prevailing Party in any action; or (e) direct costs of mitigation, remediation, and third-party claims resulting from any Data Breach attributable to Contractor's acts or omissions (including the acts or omissions of Contractor's employees, Contractors, and agents). Nothing herein shall prevent the Parties from determining the appropriate amounts attributable to the direct costs of data breach notification, credit monitoring, and other obligations set forth in Civil Code § 1798.29 as further specified in Section 21.10 (Data Breach).
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
SECTION 13. STATUTORY & REGULATORY REQUIREMENTS; CONTRACTOR
CERTIFICATIONS
THE FOLLOWING PROVISIONS ARE REQUIRED BY LAW AND CANNOT BE EDITED OR REMOVED FROM CONTRACT.
13.1 COMPLIANCE WITH STATUTES & REGULATIONS:
The Parties warrant and certify that in the performance of this Contract, they will comply with all applicable statutes, rules, regulations, and orders of the United States and the State of Calitornia. Contractor agrees to indemnify the State against any loss, cost, damage, or liability by reason of Contractor's violation of this provision (including violations by Contractor's employees, Contractors, and agents), subject to the procedures set forth in Section 11.3 (Indemnification Process).
13.2 NONDISCRIMINATION CLAUSE:
During the performance of this Contract, Contractor and its subcontractors: (a) shall not unlawfully discriminate, harass, or allow harassment against any employee or applicant for employment because of sex, sexual orientation, race, color, ancestry, religious creed, national origin, disability (including HIV and AIDS), medical condition (cancer), age, marital status, and denial of family care leave; (b) shall ensure that the evaluation and treatment of their employees and applicants for employment are free from such discrimination and harassment; (c) shall comply with the provisions of the Fair Employment and Housing Act (Gov. Code, § 12990 et seq.) and the applicable regulations promulgated thereunder (Cal. Code Regs., tit. 2, organizations with which they have a collective bargaining or other agreement. The applicable regulations of the Fair Employment and Housing Commission implementing Government Code Section 12990, subdivisions (a) through (f), set forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations are incorporated into this Contract by reference. Contractor shall include the nondiscrimination and compliance provisions of this provision in all subcontracts to perform work under the Contract.
13.3 ACCESSIBILITY:
To the extent that the Contract falls within the scope of Government Code Section § 11135, Contractor shall respond to and resolve any complaint brought to its attention regarding accessibility of its products or services, in accordance with Government Code § 7405.
13.4 AMERICANS WITH DISABILITIES ACT:
Contractor shall comply with the Americans with Disabilities Act of 1990 (42 U.S.C. § 12101 et seq).
13.5 PRIORITY HIRING CONSIDERATIONS:
If this Contract includes Services over $200,000, Contractor shall give priority consideration in filling vacancies in positions funded by the Contract to qualified recipients of aid under Welfare and Institutions Code § 11200 in accordance with PCC § 10353.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
13.6 FOLLOW-ON CONTRACTS:
If this Contract fits the definition of a "consulting services contract" within the meaning of PCC § 10335.5, Contractor may be prohibited from bidding on or being awarded a subsequent Contract in accordance with the provisions of PCC § 10365.5, subject to the provisions of PCC § 10430.
To the extent permissible by law, the Director of DGS (DGS Director), or as appropriate, the Director of CDT (CDT Director), or their designees, may waive the restrictions set forth in this Section by written notice to Contractor if the DGS Director or, as appropriate, CDT Director, determines their application would not be in the State's best interest.
The restrictions of this Section will not apply: (a) to follow-on advice given by vendors of commercial off-the-shelf products, including Software and Hardware, on the operation, integration, repair, or maintenance of such products after sale; or (b) where the State has entered into a master agreement for Software or Services and the scope of work at the time of Contract execution expressly calls for future recommendations among Contractor's own products.
The restrictions set forth in this Section 13.6 are in addition to conflict-of-interest restrictions imposed on public Contractors by California law (Conflict Laws). In the event of any inconsistency, such Conflict Laws override the provisions of this Section 13.6, even if enacted after execution of this Contract.
13.7 CHILD SUPPORT COMPLIANCE ACT:
For any Contract in excess of $100,000, Contractor acknowledges, in accordance with PCC § 7110, that: (a) they recognize the importance of child and family support obligations and shall fully comply with all applicable State and federal laws relating to child and family support enforcement, including, but not limited to, disclosure of information and compliance with earnings assignment orders, as provided in Chapter 8, commencing with Section 5200 of Part 5 of Division 9 of the Family Code; and (b) Contractor, to the best of its knowledge, is fully complying with the earnings assignment orders of all employees and is providing the names of all new employees to the New Hire Registry maintained by the California Employment Development Department.
13.8 LOSS LEADER:
Contractor shall comply with PCC Section 12104.5, subdivision (b) and shall not engage in business within this state to sell or use any article or product as a "loss leader" as defined in § 17030 of the Business and Professions Code.
13.9 GOVERNMENT PROCUREMENT AGREEMENT:
If the value of this Contract exceeds the US dollar procurement threshold determined by the US Trade Representative (as set forth in the Federal Register), this Contract shall be subject to the requirements of the World Trade Organization Government Procurement Agreement.
13.10 ASSIGNMENT OF ANTITRUST ACTIONS:
Pursuant to Government Code Sections 4552, 4553, and 4554, the following provisions are incorporated herein:
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
(a) in submitting a bid to the State, Contractor offers and agrees that if the bid is accepted, it will assign to the State all rights, title, and interest in and to all causes of action it may have under Section 4 of the Clayton Act (15 U.S.C. § 15) or under the Cartwright Act (Bus. & Prof. Code, Chapter 2, commencing with § 16700 et seq.), arising trom purchases of Goods, material, services, or other items, by the supplier for sale to the State pursuant to the solicitation. Such assignment shall be made and become effective at the time the State tenders final payment to Contractor; (b) if the State receives, either through judgment or settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand, recover from the State any portion of the recovery, including treble damages, attributable to overcharges that were paid by the assignor but were not paid by the State as part of the bid price, less the expenses incurred in obtaining that portion of the recovery. (c) Upon demand in writing by the assignor, the assignee shall, within one year from such demand, reassign the cause of action assigned under this part if the assignor has been or may have been injured by the violation of law for which the cause of action arose and: (i) the assignee has not been injured thereby; or (ii) the assignee declines to file a court action for the cause of action.
13.11 EXECUTIVE ORDER N-6-22-RUSSIA SANCTIONS:
Contractor shall comply with Executive Order N-6-22 (EO) regarding Economic Sanctions against Russia and Russian entities and individuals. "Economic Sanctions" refers to sanctions imposed by the U.S. government in response to Russia's actions in Ukraine, as well as any sanctions imposed under State law. The EO directs State agencies to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. Accordingly, should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for termination of the Contract. The State shall provide Contractor prior written notice of termination, allowing Contractor at least 30 Days to provide a written response. Termination shall be at the State's sole discretion.
13.12 NATIONAL LABOR RELATIONS BOARD CERTIFICATION:
Contractor swears under penalty of perjury that no more than one final, unappealable finding of contempt of court by a federal court has been issued against Contractor within the immediately preceding two-year period because of Contractor's failure to comply with an order of the National Labor Relations Board. This provision is required by and shall be construed in accordance with PCC § 10296.
13.13 DRUG-FREE WORKPLACE CERTIFICATION:
Contractor certifies that the Contractor will comply with the requirements of the Drug-Free Workplace Act of 1990 (Gov. Code, § 8350 et seq.) and will provide a drug-free workplace by taking the following actions:
(a) Publish a statement notifying employees that unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited and specifying actions to be taken against employees for violations, as required by Government Code Section 8355, subdivision (a).
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
(b) Establish a Drug-Free Awareness Program as required by Government Code Section 8355, subdivision (b), to inform employees about all of the following: (i) the dangers of drug abuse in the workplace; (ii) the person's or organization's policy of maintaining a drug-free workplace; (iii) any available counseling, rehabilitation, and employee assistance programs; and (iv) penalties that may be imposed upon employees for drug abuse violations.
(C) Provide, as required by Government Code Section 8355, subdivision (c), that every employee who works on the proposed or resulting Contract: (i) will receive a copy of the company's drug-free policy statement; and (i) will agree to abide by the terms of the company's statement as a condition of employment on the Contract.
13.14 SWEAT FREE CODE OF CONDUCT:
Contractor certifies that no equipment, materials, or supplies supplied to the State pursuant to the Contract have been produced in whole or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, in compliance with PCC section 6108.
Contractor certifies that they adhere to the Sweat Free Code of Conduct as set forth on the California Department of Industrial Relations website located at www.dir.ca.gov. Contractor agrees to cooperate fully in providing reasonable access to its records, documents, agents or employees, or premises if reasonably required by authorized officials of the State, the Department of Industrial Relations, or the Department of Justice to determine Contractor's compliance with this provision.
13.15 DOMESTIC PARTNERS:
For Contracts over $100,000 executed or amended after January 1, 2007, Contractor certifies that they comply with PCC Section 10295.3.
13.16 RECYCLED CONTENT REQUIREMENTS:
Contractor shall certify in writing under penalty of perjury, the minimum, if not exact, percentage of post-consumer material in the Goods offered or sold to the State that falls under any of the statutory categories regardless of whether the Goods meets the requirements of PCC section 12209. Contractor shall provide the certification, even if the Goods contain no post-consumer recycled material, and even if the post-consumer content is unknown. With respect to printer or duplication cartridges that comply with the requirements of PCC Section 12156, subdivision (e), the certification required by this subdivision shall specify that the cartridges so comply (PCC, § 12205).
A State Buyer may waive the certification requirements if the percentage of postconsumer material in the Goods can be verified in a written advertisement, including, but not limited to, a product label, a catalog, or a manufacturer or vendor Internet website. Contractors are to use to the maximum extent economically feasible in the performance of Contract, recycled content products (PCC, § 12203, subd. (d)).
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
13.17 ELECTRONIC WASTE RECYCLING ACT OF 2003
To the extent the Contract involves the purchase or lease of electronic devices, Contractor certifies that it complies with the applicable requirements of the Electronic Waste Recycling Act of 2003, Chapter 8.5, Part 3 of Division 30, commencing with Section 42460 of the Public Resources Code. Contractor shall maintain documentation and provide reasonable access to its records and documents that evidence compliance.
13.18 FOUR-DIGIT DATE COMPLIANCE:
Contractor warrants that it will provide only Four-Digit Date Compliant (as defined below) Deliverables to the State. "Four Digit Date Compliant" Deliverables can accurately process, calculate, compare, and sequence date data, including without limitation date data arising out of or relating to leap years and changes in centuries. This warranty and representation is subject to the warranty terms and conditions of the Contract and does not limit the generality of warranty obligations set forth elsewhere herein.
13.19 COVENANT AGAINST GRATUITIES:
Contractor certifies that no gratuities (in the form of entertainment, gifts, or otherwise) were offered or given by Contractor, or any agent or representative of Contractor, to any officer or employee of the State with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract. For breach or violation of this warranty, the State shall have the right to terminate the Contract, either in whole or in part, and any loss or damage sustained by the State in procuring on the open market any items which Contractor agreed to supply shall be borne and paid for by Contractor. The rights and remedies of the State under this Section are not exclusive and are in addition to any other rights and legal or equitable remedies.
13.20 EXPATRIATE CORPORATIONS:
Contractor certifies that it is not an expatriate corporation or subsidiary of an expatriate corporation within the meaning of PCC sections 10286 and 10286.1 and is eligible to contract with the State.
SECTION 14. CONTRACTOR RESPONSIBILITIES
14.1 INSURANCE:
Contractor shall maintain all commercial general liability insurance, workers' compensation insurance, and any other insurance required under the Contract. Contractor shall furnish insurance certificate(s) evidencing required insurance coverage acceptable to the State, including endorsements showing the State as an "additional insured" if required under the Contract. Any required endorsements requested by the State must be separately provided; merely referring to such coverage on the certificates(s) is insufficient for this purpose. When performing work on State owned or controlled property, Contractor shall provide a waiver of subrogation in favor of the State for its workers' compensation policy.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
14.2 ACCIDENT PREVENTION:
If performing work under the Contract on State premises, Contractor shall conform to any specific safety requirements contained in the Contract or as required by law or regulation.
Contractor shall take any additional precautions as the State may reasonably require for safety and accident prevention purposes. Any violation of such rules and requirements, unless promptly corrected, shall be grounds for termination of the Contract for default.
14.3 CONTRACTOR'S LIABILITY FOR INJURY TO PERSONS OR DAMAGE TO PROPERTY:
Contractor shall be liable for damages arising out of injury to the person or damage to the real or tangible personal property of the State, State employees, persons designated by the State for training, or any other person(s) other than agents or employees of Contractor, designated by the State for any purpose, prior to, during, or subsequent to delivery, installation, acceptance, and use of the Deliverables either at Contractor's site or at the State's place of business, provided that the injury or damage was caused by Contractor's fault or negligence.
Contractor shall not be liable for damages arising out of, or caused by, an alteration or an Attachment not made or installed by Contractor, or for damage to alterations or Attachments that may result from the normal operation and maintenance of the Deliverables provided by Contractor during the Contract. "Attachment" means a mechanical, electrical, or electronic interconnection to Contractor-supplied equipment, manufactured by other than the original equipment manufacturer that is not connected by Contractor.
SECTION 15. INVOICES; PAYMENTS; TAXES & AUDITS
15.1 INVOICES:
Unless otherwise specified, invoices shall be sent to the address set forth herein. Invoices shall be submitted electronically, or in triplicate if in hardcopy, and shall include the Contract number, release order number (if applicable), item number, unit price, extended item price, and invoice total amount. State sales tax or use tax shall be itemized separately and added to each invoice as applicable.
15.2 REQUIRED PAYMENT DATE:
Payment will be made in accordance with the provisions of the California Prompt Payment Act (Act) (Gov. Code, § 927 et seq.). Unless expressly exempted by statute, the Act requires State agencies to pay properly submitted, undisputed invoices not more than 45 Days after: (a) the date of acceptance or performance of Deliverables; or (b) receipt of an undisputed invoice, whichever is later.
15.3 TAXES:
Unless otherwise required by law, the State of California is exempt from federal excise taxes.
The State will only pay for any state or local sales or use taxes on the Deliverables supplied to the State pursuant to the Contract.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
15.4 USE TAX COLLECTION:
Contractor shall comply with Section 7101 of the Revenue and Taxation Code. Contractor shall immediately notify the State in writing of any change in its retailer's seller's permit, certification of registration, applicable affiliate's seller's permit, or certificate of registration as described in of PCC Section 10295.1 (a).
15.5 EXAMINATION & AUDIT:
The State or its designated representative shall have the right to review and copy any records and supporting documentation directly pertaining to performance of this Contract.
Contractor shall maintain such records for production or audit for a minimum of 3 years after final payment unless a longer period of records retention is stipulated. Contractor agrees to allow the State or its designee access to such records during normal business hours and to allow interviews of any employees or others who might reasonably have information related to such records. Further, Contractor agrees to include a similar right of the State to audit records and interview staff in any subcontract related to performance of the Contract. The State shall provide reasonable advance written notice of such audits) to Contractor.
15.6 SOFTWARE LICENSE AUDIT:
The State is responsible for monitoring compliance with the terms and conditions of use for any licensed Software delivered pursuant to the Contract. The State agrees that, upon 45 Days prior written notice, Contractor or an independent third-party designated by Contractor, may audit the State's compliance with applicable license requirements. License audits requiring on-site presence at the State's facilities shall require the State's express written consent, which shall not be unreasonably withheld. Contractor agrees to limit such license audits to one audit per calendar year. The State, Contractor, or independent third-party shall cooperate in good faith with such audit, which Contractor agrees will be confidential and commercially reasonable in scope and duration. Each Party shall bear its own costs for such license audits (including the cost of any independent third parties).
The State shall have the opportunity to review the results of any license audit and, within 60 Days of receiving such results, shall notify Contractor of any disputed findings. Should the State dispute any findings, the Parties shall work in good faith to resolve the matter and, if the Parties are unable to resolve the matter after 30 Days, Contractor may initiate the dispute resolution process described in Section 17 (Dispute Resolution). If the State accepts the audit findings, within 60 Days of receiving such results the State shall order sufficient quantities of licenses at Contracted rate.
SECTION 16. TERMINATION
16.1 TERMINATION FOR NON-APPROPRIATION OF FUNDS:
The State's obligation to proceed with the Contract is contingent on the appropriation of funds for such purpose by the California Legislature or, if applicable, the United States Congress.
The State will have to right to terminate the Contract without damage, penalty, cost, or further obligation in the event funding is not appropriated, and Contractor agrees to take back any affected Goods supplied under the Contract and terminate any Services supplied to the State
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
under the Contract. The State and Contractor shall agree to take all reasonable steps to prioritize work and Goods and minimize the incurrence of costs prior to the expiration of funding for the Contract.
IF TERMINATION OCCURS UNDER THIS SECTION, THE STATE SHALL RETURN TO
CONTRACTOR COMMERCIAL HARDWARE AND SOFTWARE THAT HAS NOT BEEN PAID
FOR IN SUBSTANTIALLY THE SAME CONDITION IN WHICH DELIVERED TO THE STATE, SUBJECT TO NORMAL WEAR AND TEAR. THE STATE SHALL PAY FOR PACKING,
CRATING, TRANSPORTATION TO CONTRACTOR'S NEAREST FACILITY AND SHALL
REIMBURSE CONTRACTOR FOR EXPENSES INCURRED FOR CONTRACTOR'S ASSISTANCE IN PACKING AND CRATING.
16.2 TERMINATION FOR CONVENIENCE:
The State may terminate performance of work under this Contract for its convenience, in whole or in part, if DGS-PD's Deputy Director, or Buyer, or as applicable, CDT'S STP Deputy Director, or designee determines that termination is in the State's interest. If such a determination is made, the State shall provide Contractor a Notice of Termination (Termination Notice) specifying the extent of termination and the effective termination date (Termination Date), which shall be no less than 15 Days from the Termination Notice date.
16.2.1 Effect of Termination for Convenience. After receipt of a Termination Notice, and except as directed by the State, Contractor shall immediately proceed with the following obligations, as applicable, regardless of any delay in determining or adjusting any amounts due under this Section. Contractor shall: (a) stop work as specified in the Termination Notice; (b) place no further subcontracts for materials, services, or facilities, except as necessary to complete the continuing portion of the Contract; (c) terminate all subcontracts to the extent they relate to the work terminated; and (d) settle all outstanding liabilities and termination settlement proposals arising from the termination of subcontracts.
16.2.2 Termination Proposal. After termination, Contractor shall submit a final termination settlement proposal to the State in the form and with the information prescribed by the State.
Contractor shall submit the proposal promptly, but no later than 30 Days after the Termination Date, unless otherwise provided in the Termination Notice. Contractor and the State may agree upon the whole or any part of the amount to be paid pursuant to Section 16.2.3 below.
16.2.3 Payments in Event of Termination. Unless otherwise specified in the Statement of Work, if Contractor and the State fail to agree on the amount to be paid pursuant to termination under Section 16.2, the State will pay Contractor the following amounts (provided that in no event will total payments exceed the amount payable to Contractor if Contract had been fully performed):
(a) Contract price for Deliverables accepted, utilized or retained by the State and not previously paid for, adjusted for any savings on freight and other charges; and (b) the total of:
(i) The reasonable costs incurred in the performance of the work terminated, including initial costs and preparatory expenses allocable thereto, but excluding any cost attributable to Deliverables paid or to be paid; (ii) The reasonable cost of settling and paying termination settlement proposals under terminated subcontracts that are properly chargeable to the terminated portion of the Contract; and
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
(ili) Reasonable storage, transportation, demobilization, unamortized overhead and capital costs, and other costs reasonably incurred by Contractor in winding down and terminating its work.
Contractor will use generally accepted accounting principles, or accounting principles otherwise agreed to in writing by the Parties, and sound business practices in determining all costs claimed, agreed to, or determined under this Section.
16.3 TERMINATION FOR DEFAULT:
Subject to Section 20.3 (Force Majeure) and to Section 16.3.1 below, the State may, by written notice of default to Contractor, terminate the Contract, in whole or in part, if Contractor fails to:
(a) deliver or perform the Deliverables within the time specified in the Contract or any amendment; (b) make progress, so that the lack of progress endangers performance of the Contract; or (c) perform any provisions of the Contract.
The State's termination rights under this Section may be exercised only if the failure constitutes a material breach of the Contract and Contractor fails to cure such default within the time frame stated in the cure notice, which in no event will be less 15 Days, unless otherwise specified in the Statement of Work.
16.3.1 Effect of Termination for Default. If the State terminates the Contract in whole or in part for default:
(a) it may acquire, under terms and in the manner it considers appropriate, Deliverables similar to those terminated, and Contractor will be liable to the State for any excess costs for those Deliverables, including without limitation, costs charged by third-party vendors for such Deliverables. However, Contractor shall continue the work not terminated.
(b) it may require Contractor to transfer title, or in the case of licensed Software, license, and deliver to the State, as directed by the Buyer, any: (i) completed Deliverables; (i) partially completed Deliverables; and (iii) subject to Section 16.3.2 below, any other Deliverables related to the terminated portion of the Contract.
Nothing in this Section will be construed to grant the State rights to Deliverables that it would not have received had the Contract been fully performed. Upon direction of the Buyer, Contractor shall also protect and preserve property in its possession in which the State has an interest.
16.3.2 Payments in the Event of Default. The State shall pay the Contract price for completed and accepted Deliverables, and for items the State requires Contractor to transfer under Section 16.3.1 above, subject to the State's rights and remedies under the Contract.
Unless otherwise specified in the Statement of Work, Contractor and Buyer shall attempt to agree on the amount of payment for Deliverables accepted by the State for the protection and preservation of the property; provided that where Contractor has billed the State for any such materials no additional charge will apply. Failure to agree will constitute a dispute under Section 17 (Dispute Resolution). The State may withhold from these amounts any sum it determines to be necessary to protect the State against loss because of outstanding liens or claims of former lien holders.
If, after termination, it is determined by a final decision that Contractor was not in default, the rights and obligations of the Parties shall be the same as if the termination had been issued for the convenience of the State.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
16.4 RIGHTS & REMEDIES OF STATE FOR DEFAULT:
Any loss or damage sustained by the State in procuring any items which Contractor agreed to supply shall be borne and paid for by Contractor, subject to Section 12 (Limitation of Liability).
The State reserves the right to offset the reasonable cost of all damages caused to the State against any outstanding invoices or amounts owed to Contractor or to make a claim against Contractor. Both Parties, upon any termination for default, have a duty to mitigate the damages suffered by it. The rights and remedies of the State in this Section are in addition to any other rights and legal or equitable remedies available under law, or provided under the Contract, subject to Section 12 (Limitation of Liability).
SECTION 17. DISPUTE RESOLUTION
17.1 DISPUTES BETWEEN BUYER AND CONTRACTOR DEPARTMENT CONTRACTS:
The Parties shall deal in good faith and attempt to resolve potential disputes informally. If the dispute persists, Contractor may submit to the Buyer's department director (Buyer's Director) or designee a written demand for a final decision regarding the disposition of any dispute between the Parties regarding the Contract. Contractor's written demand shall be fully supported by factual information, and if such demand involves a cost adjustment to the Contract, Contractor shall include with the demand a written statement signed by an authorized person indicating that the demand is made in good faith, that the supporting data are accurate and complete and that the amount requested accurately reflects the Contract adjustment for which Contractor believes the State is liable. The Buyer's Director or designee shall have 30 Days after receipt of Contractor's written demand invoking this Section to render a written decision. If a written decision is not rendered within 30 Days after receipt of Contractor's demand, it shall be deemed a decision adverse to Contractor's contention.
If Contractor is not satisfied with the decision of the Buyer's Director or designee, Contractor may appeal the decision, in writing, within 15 Days of its issuance (or the expiration of the 30 Day period if no decision is rendered by the Buyer's Director), to the DGS-PD Deputy Director, or the CDT Statewide Technology Procurement Deputy Director, as applicable, who shall have 30 Days to render a final decision. If Contractor does not appeal the decision of the Buyer's Director or designee, the decision shall be conclusive and binding and Contractor shall be barred from commencing an action in court, or with the Government Claims Program, for failure to exhaust Contractor's administrative remedies.
Pending the final resolution of any dispute regarding the Contract, Contractor agrees to diligently proceed with the performance of the Contract, in accordance with the State's instructions regarding the Contract, unless work is stopped pursuant to Section 18, or by mutual written agreement. Contractor's failure to diligently proceed in accordance with the State's instructions regarding the Contract shall be considered a material breach of the Contract.
If Contractor appeals, any final decision of the State shall be in writing, signed by the DGS-PD Deputy Director, or the CDT STP Deputy Director, as applicable, expressly identifying it as final. If the DGS-PD Deputy Director or the CDT STP Deputy Director fails to render a final decision within 30 Days after receipt of Contractor's appeal, it shall be deemed a final decision adverse to Contractor's contentions. The State's final decision shall be conclusive and binding unless Contractor files a claim with the Government Claims Board contesting such decision.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
The dates to issue a final decision or final decision on an appeal, as applicable in this section may be modified by mutual consent of the Parties.
17.2 DISPUTES REGARDING CONTRACTS ISSUED BY DGS-PD:
For disputes involving Contracts with DGS-PD, Contractor shall submit to the DGS-PD Deputy Director or designee a written demand for a final decision, in the manner described in Section
17.1 above. The DGS-PD Deputy Director or designee shall have 30 Days to render a final decision. If a final decision is not rendered within 30 Days after receipt of Contractor's demand, it shall be deemed a final decision adverse to Contractor's contention.
17.3 FINAL DECISION:
The final decision rendered under Section 17 shall be conclusive and binding regarding the dispute unless Contractor seeks other administrative remedies. The dates of decision and appeal in this Section may be modified by mutual written consent, as applicable, except for the time to commence a claim with the Government Claims Program.
SECTION 18. STOP WORK
18.1 STOP WORK:
The State may, at any time, by written Stop Work Order to Contractor, require Contractor to stop all, or any part, of the work called for by this Contract for a period up to 60 Days after the Stop Work Order is delivered to Contractor, and for any further period to which the Parties may agree. The Stop Work Order shall be specifically identified as such and shall indicate it is issued under this Section. Upon receipt of the Stop Work Order, Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the Stop Work Order during the period of work stoppage.
Within a period of 45 Days after a Stop Work Order is delivered to Contractor, or within any extension of that period to which the Parties shall have agreed, the State shall either: (a) cancel the Stop Work Order; or (b) terminate the work covered by the Stop Work Order as provided for in Section 16.2 (Termination for Convenience) or Section 16.3 (Termination for Default).
18.2 CANCELLATION/EXPIRATION OF STOP WORK ORDER:
If a Stop Work Order issued under this Section is canceled or the period of the Stop Work Order or any extension expires, Contractor shall resume work. The State shall make an equitable adjustment in the delivery schedule, Contract price, or both, and the Contract shall be modified, in writing, accordingly, if: (a) the Stop Work Order results in an increase in the time required for, or in Contractor's cost properly allocable to the performance of any part of the Contract; and (b) Contractor asserts its right to an equitable adjustment within 60 Days after the end of the period of work stoppage; provided, that if the State decides the facts justify the action, the State may receive and act upon a proposal submitted at any time before final payment under the Contract.
If a Stop Work Order is not canceled and the work covered by the Stop Work Order is terminated pursuant to Section 16.2 (Termination for Convenience), the State shall allow reasonable costs resulting from the Stop Work Order in arriving at the termination settlement.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
The State shall not be liable to Contractor for loss of profits because of a Stop Work Order issued under this Section.
SECTION 19. SMALL BUSINESS (SB) PARTICIPATION & DISABLED VETERAN
BUSINESS ENTERPRISE (DVBE) PARTICIPATION REPORTING REQUIREMENTS
THE FOLLOWING PROVISIONS ARE REQUIRED BY LAW AND CANNOT BE EDITED OR REMOVED FROM CONTRACT.
19.1 SMALL BUSINESS PARTICIPATION (SB):
If, for this Contract, Contractor made a commitment to achieve SB participation, then Buyer requires Contractor upon completion of this Contract (or within such other period as may be specitied elsewhere in the Contract) to report the actual percentage of SB participation that was achieved (Govt. Code, § 14841).
19.2 DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) PARTICIPATION:
19.2.1 If, for the Contract, Contractor made a commitment to achieve the DVBE participation goal, then, pursuant to Military & Veterans Code, Section 999.5, subdivision (d), upon completion of the Contract, Buyer requires Contractor to certify using the Prime Contractor's Certification - DVBE Subcontracting Report (STD 817), all of the following:
(a) the total amount the Prime Contractor received under the Contract; (b) the name, address, Contract number, and certification ID number of the DVBE(s) that participated in the performance of the Contract;
(c) the amount and percentage of work the Prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor;
(d) that all payments under the Contract have been made to the DVBE(s); and (e) the actual percentage of DVBE participation that was achieved. (f) upon request, the Prime Contractor shall provide proof of payment to the DVBE(s) for the work.
Until Contractor complies with the certification requirements above, the State will withhold $10,000 from the final payment, or the full final payment if less than $10,000. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 Days but not more than 30 Days from the date of written notice, the prime Contractor refuses to comply with the certification requirements, the State shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets. Code, § 999.7).
19.2.2 Contractor shall comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Military & Veterans Code, including, but not limited to, the requirements of Section 999.5, subdivision (d). (PCC, § 10230). A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code, § 999.5, subd. (d); Gov. Code, § 14841).
19.2.3 For purposes of this Section only "Prime Contractor" means the same as Contractor as defined in the Contract.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
SECTION 20. GENERAL TERMS
20.1 INDEPENDENT CONTRACTOR:
Contractor, its officers, employees, and agents, in the performance of the Contract, shall act in an independent capacity and not as officers, employees, or agents of the State.
20.2 NO PUBLICITY:
Unless otherwise specified in the Statement of Work, news releases, endorsements, advertising, social media content, and any other form of publicity pertaining to the Contract shall not be made without prior written approval of the Buyer's Department, DGS, or CDT, as applicable.
20.3 FORCE MAJEURE:
Except for defaults of subcontractors at any tier, and any Contractor responsibilities concerning disaster recovery or business continuity, Contractor shall not be liable for any excess costs if the failure to perform the Contract arises from causes beyond the control and without the fault or negligence of Contractor. Examples of such causes include, but are not limited, to: (a) acts of God or of the public enemy; and (b) acts of the federal or State government in either its sovereign or contractual capacity. If the failure to perform is caused by the default of a subcontractor at any tier, and if the cause of the default is beyond the control of both Contractor and subcontractor, and without the fault or negligence of either, Contractor shall not be liable for any excess costs for failure to perform.
20.4 NOTICE OF INSOLVENCY:
Contractor shall notify the State immediately in writing if Contractor files any federal bankruptcy action or state receivership action, or if any federal bankruptcy or state receivership action is commenced against Contractor, Contractor is adjudged bankrupt, or a receiver is appointed.
Should any such event occur, the State may, pursuant to Section 16.2 (Termination for Convenience), terminate the Contract.
20.5 COMPLETE INTEGRATION:
The Contract, including any documents incorporated by reference, is intended to be a complete integration and there are no prior or contemporaneous different or additional agreements pertaining to the subject matter of the Contract. No oral understanding or contract not incorporated in the Contract is binding on any of the Parties.
20.6 ASSIGNMENT:
Contractor shall not assign the Contract, in whole or in part, without the written consent of the State, whose consent shall not be unreasonably withheld or delayed. The State will not unreasonably prohibit Contractor from freely assigning its right to payment, provided that Contractor remains responsible for its contractual obligations.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
20.7 NO WAIVER; REMEDIES CUMULATIVE:
The failure of the State to enforce any provision or exercise rights under the Contract shall not be construed to be a waiver by the State of its rights to enforce that provision or exercise that right in the future. Except as specifically set forth in Section 8 (Warranties & Representations), all rights and remedies of the State herein are cumulative and are in addition all other available rights or legal or equitable remedies.
20.8 AMENDMENT:
No amendment or modification of the terms, of the Contract, shall be valid unless made in writing, signed by the Parties, and approved as required. No oral understanding or agreement not incorporated in the Contract is binding on any of the Parties.
20.9 SEVERABILITY:
If any provision of the Contract is unenforceable, invalid, or conflicts with applicable law, by a court of competent jurisdiction then such term or provision shall be deemed stricken, without the need for a formal amendment and the remainder of the Contract shall remain in full force and effect. Either Party having knowledge of such term or provision shall promptly inform the other of the presumed non-applicability of such provision.
20.10 APPLICABLE LAW; JURISDICTION & VENUE:
The Contract shall be governed by the laws of the State of California, exclusive of any choice of law rules. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Contract. Any action regarding this Contract shall be subject to the exclusive jurisdiction and venue of the state and federal courts in the City and County of Sacramento, California.
20.11 SURVIVAL:
Upon expiration or termination of the Contract, this Section and the following provisions will survive: Section 13.1 (Compliance with Statutes and Regulations), Section 8 (Warranties & Representations), Section 9 (Rights in Work Product & Government Purpose Rights), Section 10 (Confidentiality; Data Rights), Section 11 (Indemnification), Section 12 (Limitation of Liability), Section 15.5 (Examination & Audit), and Section 21.11 (Transition Period). Further, any other Contract term that expressly states or by its nature should survive, shall survive.
SECTION 21. DATA PROTECTION PROVISIONS
21.1 ACCESS TO STATE SYSTEMS:
In the course of providing the Deliverables, Contractor may gain access to and use State Data and State's Systems, and electronic communications networks, including but not limited to, voicemail, email, databases, and internet/intranet systems. Access to such State Data and State Systems is intended for legitimate business use related to the fulfillment of the Contract.
Contractor acknowledges it has no expectation of privacy regarding the use of the State's Systems and that all use of, or access to, the State's Systems made by or on behalf of
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
Contractor is subject to State scrutiny and oversight at all times during the term of the Contract.
21.2 COMPLIANCE WITH DATA PROTECTION LAWS, POLICIES & REGULATIONS:
21.2.1 Subject to Section 21.3 below, but notwithstanding anything to the contrary in the Contract, Contractor shall comply with the data protection laws, regulations, and policies relating to the collection, maintenance, transmission, use, receipt, storage, disclosure, retention, destruction, unavailability, security, or other use or processing of State Data, in connection with Contractor's provision of Deliverables under the Contract, including but not limited to, and to the extent applicable
(a) California Information Practices Act (Civil Code, § 1798 et seq.), (b) Federal Privacy Act of 1974,
(c) Health Insurance Portability and Accountability Act of 1996, (d) IRS 1075 regulations,
(e) Health Information Technology for Economic and Clinical (HITECH) Act, Criminal Justice Information Services (CJIS) Security Policy, (g) Social Security Administration (SSA) Electronic Information Exchange Security Requirements,
(h) Payment Card Industry (PCI) Data Security Standard (DSS), (i) NIST Special Publications,
() California State Administrative Manual (SAM) (Chapters 4983, 5100, 5300), and (k) California Statewide Information Management Manual (SIMM) Sections 5305A, 5310A and B, 5315-B, 5325A and B, 5340A and C, and 5360B.
21.2.2 Contractor shall not take, or fail to take, any action that would put the State in violation of such data protection laws, policies and regulations.
21.3 DATA CLASSIFICATION STANDARDS & SECURITY CONTROLS:
21.3.1 Unless otherwise specified in the SOW, security requirements designated in these GSPD - ITGP (Non-Cloud) are assuming a National Institute of Standards and Technology (NIST) MODERATE classification. For a higher or lower data classification standard, State shall:
(a) Classify their data pursuant to the State Administrative Manual (SAM) 5305.5; and (b) Obtain approval from the State Chief Information Security Officer (CISO) or User's CISO prior to modifying this Section of the GSPD - ITGP (Non-Cloud) through the SOW to meet the needs of the Contract.
21.3.2 Contractor shall comply with the current version of the NIST Special Publication (SP) 800-53 Security and Privacy Controls for Systems and Organizations.
21.3.3 Controls shall be applied at the MODERATE level.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
21.3.4 Subject to the prior written approval of the State CISO (or designee), Contractor may submit a current ISO 27001 certification in satisfaction of the foregoing requirements of this subsection. Responsibility to obtain CISO approval lies with the State.
21.3.5 Contractor shall comply with NIST 800-171, if applicable, and shall implement and maintain a system security plan with respect to any System that Contractor has assisted the State to implement and any of Contractor's systems that in any way interact with the State's System or State Data. Contractor shall ensure such plan is reviewed annually.
21.4 DATA SAFEGUARDS:
Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards in accordance with applicable laws, policies, and regulations, at all times during the Contract term, to secure State Data from Data Breach and protect State Data, Systems, Services, and components thereof, from unauthorized or unlawful use, access, modification, disclosure or destruction, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the State's access.
21.5 ENCRYPTION:
End-to-End encryption shall be implemented for all Personal Information and Non-Public Data that is transmitted, stored, or accessed both inside and outside the secure internal network, including Contractor's servers. The Statement of Work or Service Level Agreement will specify which Party is responsible for encryption and access control of the State Data under the Contract. If the Statement of Work or Service Level Agreement are silent, then the State is responsible for encryption and access control. All Non-Public or Personal Information must be encrypted at rest and in transit with validated cryptography standards as referenced in FIPS 140-3 (or higher).
21.6 SYSTEM AVAILABILITY:
The minimum standards for State System Availability shall be as set forth herein. Nothing herein precludes the State from specifying a higher standard for System Availability in the Statement of Work. Requests for a lower System Availability standard shall require the written approval of the State CISO prior to Contract execution. Responsibility to obtain CISO approval lies with the State.
(a) The System shall be available 24 hours per Day, 365 Days per year, excluding agreed- upon maintenance downtime (System Availability).
(b) If the monthly System availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to recover damages, apply credits, or use other contractual remedies, including those set forth in the Statement of Work. (c) If the monthly System availability averages less than 99.9% (excluding agreed-upon maintenance downtime) for 3 or more months in a rolling 12-month period, the State may terminate the Contract for material breach in accordance with Section 16.3 (Termination for Default).
(d) Contractor shall provide advance written notice to the State in the manner set forth in the Statement of Work of any major upgrades or changes that will affect the System availability.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
21.7 DATA AVAILABILITY:
The minimum standards for State Data Availability shall be as set forth herein. Nothing herein prevents the State from specifying a higher standard for Data Availability in the Statement of Work. Requests for a lower Data Availability standard shall require the written approval of the State CISO prior to Contract execution. Responsibility to obtain CISO approval lies with the State.
(a) State Data shall be available 24 hours per Day, 365 Days per year, excluding agreed- upon maintenance downtime (Data Availability).
(b) If the State Data monthly Data Availability averages less than 99.9% (excluding agreed- upon maintenance downtime), the State shall be entitled to recover damages, apply credits, or use other contractual remedies as set forth in the Statement of Work if the State is unable to access the State Data as a result of:
Acts or omission of Contractor;
(ii) Acts or omissions of third parties working on behalf of Contractor; (iii) Network compromise, network intrusion, hacks, introduction of viruses, disabling devices, malware and other forms of attack that can disrupt access to Contractor's server, to the extent such attack would have been prevented by Contractor taking reasonable industry standard precautions; or (iv) Power outages or other telecommunications or Internet failures, to the extent such outages were within Contractor's direct or express control. (C) If monthly Data Availability averages less than 99.9% (excluding agreed-upon maintenance downtime), for 3 or more months in a rolling 12-month period, the State may terminate the Contract for material breach in accordance with Section 16.3 (Termination for Default).
21.8 DATA LOCATION & ACCESS:
21.8.1 Data Center Location in U.S. The physical location of Contractor's data center where State Data is stored shall be within the continental United States, unless otherwise specified in the Statement of Work and approved in advance in writing by the State CISO. Responsibility to obtain CISO approval lies with the State.
21.8.2 Data Access. Contractor shall not allow its personnel or subcontractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its data centers located in the continental United States. Remote access to State Data from outside the continental United States, including remote access to State Data by authorized Services support staff in identified support centers, is prohibited unless approved in advance in writing by the State CISO. Responsibility to obtain CISO approval lies with the State.
21.9 SECURITY INCIDENT:
Upon identification of a Security Incident affecting the Contract or State Data, Contractor shall immediately provide information directly related to the Security Incident including Indicators of Compromise (IOC) to enable the State to complete a timely and cooperative investigation.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
21.10 DATA BREACH:
21.10.1 Unless otherwise specified in the Statement of Work, upon discovery or reasonable belief of any Data Breach, Contractor shall notify the State by the fastest means available, as well as in writing, with additional notification provided to the State CISO or designee of the Contracting agency. Contractor shall provide such notification immediately after Contractor reasonably believes there has been such a Data Breach, in no event greater than 48 hours after such determination.
21.10.2 Contractor's notification shall identify, to the full extent known to Contractor:
(a) The nature of the Data Breach;
(b) The State Data improperly accessed, used, or disclosed; (c) The number of individual records improperly accessed, used, or disclosed if Personal Information is involved;
(d) The person(s) who improperly accessed, used, disclosed, or received State Data; (e) What Contractor has done or will do to quarantine and remediate the Data Breach; and (f) What corrective action(s) Contractor has taken or will take to prevent future Data Breaches.
21.10.3 Contractor will provide daily updates, or more frequently as required by the State, regarding findings and actions performed by Contractor until the Data Breach has been effectively resolved to the State's satisfaction.
21.10.4 Contractor shall contain and mitigate the Data Breach and ensure secure access to State Data in accordance with the service level agreement set forth in the Statement of Work, if applicable.
21.10.5 If Contractor experiences a Data Breach, the State's CISO or designee shall determine whether notification to any individuals whose State Data has been improperly accessed, lost, or breached is appropriate. If Personal Information is reasonably believed to have been improperly accessed or acquired by an unauthorized person as a result of a Data Breach that is not due to the fault of the State or any person or entity under the control of the State, Contractor shall bear any and all costs associated with the State's notification obligations and other obligations set forth in Civil Code Section 1798.29, subdivision (d), as well as the cost of credit monitoring, subject to the dollar limitation, if any, agreed to by the State and Contractor in the Statement of Work. These costs may include, but are not limited to staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach of the security of such Personal Information.
21.10.6 Contractor shall investigate the Data Breach and shall share the investigation report with the State. The State or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the State, its agents, and law enforcement.
21.10.7 Contractor shall promptly refer to the State any inquiries received by Contractor regarding Contractor's information security or privacy practices relating to the State Data.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
21.11 TRANSITION PERIOD:
Unless otherwise specified in the Statement of Work, for 90 Days prior to the expiration date of the Contract, or upon notice of termination of the Contract and for 90 Days thereafter, Contractor shall assist the State in extracting or transitioning all State Data in the format determined by the State (Transition Period).
During the Transition Period, System, Services, and State Data access shall continue to be made available to the State without alteration. The State, at its option, may purchase additional transition services as specified in the Statement of Work.
Unless otherwise specified in the Statement of Work, Contractor shall permanently destroy or render inaccessible any portion of State Data in the possession or control of Contractor (including the possession or control of Contractor's agents, affiliates, and subcontractors) following the expiration of all obligations in this Section. Within 30 Days, Contractor shall issue a written statement to the State confirming the destruction or inaccessibility of State Data.
Contractor shall compensate the State for damages or losses the State incurs as a result of Contractor's failure to comply with this Section subject to any applicable limitation of liability.
21.12 DISASTER RECOVERY & BUSINESS CONTINUITY:
21.12.1 Disaster Recovery Plan. Unless otherwise provided in the Statement of Work, Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of electronic data in the event of an emergency.
Emergency means any circumstance or situation that causes normal system operations to become unavailable for use in performing the work required under the Contract for more than 24 hours. Contractor shall make the disaster recovery plan available to the State upon request.
21.12.2 Data Backup Plan. Unless otherwise provided in the Statement of Work, Contractor must have established documented procedures to securely backup the System to maintain retrievable exact copies of all data. The backups shall be encrypted in accordance with Section 21.5 (Encryption). The plan must include a regular system back up schedule for making backups, storing backups offsite, an inventory of backup media, and the amount of time to restore should it be lost. At a minimum, full onsite data backup must be performed weekly. Full offsite storage of backup data must be performed monthly.
21.12.3 Notification & Recovery. In the event of disaster or catastrophic failure that results in loss of State Data or extended loss of access to State Data, unless otherwise specified in the Statement of Work or where Contractor has no responsibility to host and no access to State Data, Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the State CISO or designee of Contracting agency. Contractor shall provide such notification within 24 hours after Contractor reasonably believes there has been such a disaster or catastrophic failure. In the notification, Contactor shall inform the State of:
(a) The scale and quantity of the State Data loss;
(b) What Contractor has done or will do to recover State Data and mitigate the effect of the State Data loss; and
(c) Corrective action(s) Contractor has taken or will take to prevent future State Data loss.
If Contractor fails to respond immediately and remedy the failure, the State may exercise its options for assessing damages or other remedies under the Contract.
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
21.12.4 Contractor shall repair and restore continuity of the System, Services, or data, in accordance with the RPO and RTO, as needed to meet the performance requirements stated in the Service Level Agreement, if applicable. Failure to do so may result in the State exercising its options for assessing damages or other remedies under the Contract.
21.13 INSPECTION & AUDIT OF CONTRACTOR'S SYSTEMS:
21.13.1 Inspection & Audit. Upon advance written request, Contractor agrees that the State or its designated representative shall have access to Contractor's system, data, operational documentation, records, and databases, including online inspections, that relate to the System, Services, or data purchased by the State under the Contract. The online inspection shall allow the State, its authorized agents, or a mutually acceptable third-party, to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:
(a) Operating system/network vulnerability scans;
(b) Web application vulnerability scans;
(c) Database application vulnerability scans; and
(a) Any other scans to be performed by the State or its authorized representatives.
Upon written request, Contractor shall provide the results of any independent tests performed by Contractor including the results of any penetration testing. The State shall maintain the confidentiality of any information provided by Contractor pursuant to this Section.
21.13.2 Remediation. Contractor shall remediate vulnerabilities and correct flaws identified through testing and assessments within the State's designated time periods, or a mutually agreed upon time period with Contractor. Contractor will notify the State once corrections and remediation have been completed. Contractor shall implement security, policies, procedures, and practices to protect State Data as required by the Contract.
21.13.3 Post-Breach/Disaster Audit. After any Data Breach or after any disaster or catastrophic failure that results in a loss of State Data, Contractor shall at its expense, have an independent, industry-recognized, State-approved third-party perform an information security audit. State approval of the auditor will not be unreasonably withheld. The audit results shall be shared with the State within 7 Days of Contractor's receipt of such results. Within 30 Days of receiving the results of the audit, Contractor will provide the State with written evidence of planned remediation and promptly modify its security measures to meet its obligations under the Contract.
21.14 ACCESS TO REPORTS:
Unless otherwise provided in the Statement of Work:
(a) Contractor shall maintain a Software bill of materials that includes, at a minimum, the details and supply chain relationships of the components used in the Software or Services. Contractor shall provide a copy of the Software bill of materials to the State upon request.
(b) Contractor shall maintain a U.S. Cybersecurity & Infrastructure Security Agency Secure Software Development Attestation Form, or equivalent attestation, and provide a copy of the attestation to the State upon request. The attestation shall state, at a minimum, that:
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
(i) The Software will be developed and built in secure environments that are secured by, at a minimum; separating and protecting each environment involved in developing and building the Software; regularly logging, monitoring, and auditing trust relationships used for authorization and access to any Software development and build environments, as well as among components within each environment; enforcing multi-factor authentication and conditional access across the environments relevant to developing and building the Software in a manner that minimizes security risk; taking consistent and reasonable steps to document, as well as minimize use or inclusion of Software products that create undue risk within the environments used to develop and build the Software; encrypting sensitive data, such as credentials, to the extent practicable and based on risk; implementing defensive cybersecurity practices, including continuous monitoring of operations and alerts and, as necessary, responding to suspected and confirmed cyber incidents;
(ii) Contractor will make good-faith efforts to maintain trusted source code supply chains by employing automated tools or comparable processes to address the security of internal code and third-party components and manage related vulnerabilities.
(ili) Contractor will maintain provenance for internal code and third-party components incorporated into the Software to the greatest extent feasible. (iv) Contractor will employ automated tools or comparable processes that check for security vulnerabilities; Contractor operates these processes on an ongoing basis and prior to product, version, or update releases; Contractor has a policy or process to address discovered security vulnerabilities prior to product release; and Contractor operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed Software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.
(c) Contractor and the State recognize that security responsibilities are shared. Contractor is responsible for providing a secure infrastructure, as applicable. Specific shared responsibilities are identified within the Statement of Work or Service Level Agreement.
21.15 BACKGROUND CHECKS:
Unless otherwise provided in the Statement of Work, and as permitted or required by law, Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty.
Contractor shall promote and maintain an awareness of the importance of securing the State's Data among Contractor's employees and agents.
21.16 SYSTEM SECURITY CONTROLS:
21.16.1 Patch Management. Unless otherwise provided in the Statement of Work, all of Contractor's workstations, laptops, and other systems that process or store State Data must
GSPD-ITGP (Non-Cloud) (Revised and Effective 11/12/24)
have operating system and application security patches applied, with system reboot if necessary. Contractor shall maintain a documented patch management process which determines installation timeframe based on risk assessment. At a minimum, emergency (vulnerability and active exploit) patches must be applied immediately, while critical (vulnerability and no exploit known) patches must be applied within 30 Days of release. All other applicable patches must be installed within 90 Days of release.
21.16.2 Endpoint Protection Standard. All Contractor workstations, laptops, and other systems used to process or store State Data must install and actively use a comprehensive endpoint protection solution that will, at a minimum, comply with SIMM 5335-A.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
General Services Procurement Division
INFORMATION TECHNOLOGY - GENERAL PROVISIONS
CLOUD COMPUTING SERVICES
SECTION 1. DEFINITIONS.. ..2
SECTION 2. CONTRACT FORMATION... 4
SECTION 3. ORDER OF PRECEDENCE. 5
SECTION 4. LICENSE GRANTS....... 6
SECTION 5. SERVICES ....... 7
SECTION 6. DEMONSTRATIONS 7
SECTION 7. INSPECTION, ACCEPTANCE & REJECTION 7
SECTION 8. WARRANTIES & REPRESENTATIONS 8
SECTION 9. RIGHTS IN WORK PRODUCT & GOVERNMENT PURPOSE RIGHTS 11 SECTION 10. CONFIDENTIALITY; DATA RIGHTS. 12
SECTION 11. INDEMNIFICATION 14
SECTION 12. LIMITATION OF LIABILITY 15
SECTION 13. STATUTORY & REGULATORY REQUIREMENTS; CONTRACTOR CERTIFICATIONS 16
SECTION 14. CONTRACTOR RESPONSIBILITIES 21
SECTION 15. INVOICES; PAYMENTS; TAXES & AUDITS 22
SECTION 16. TERMINATION.. 24
SECTION 17. DISPUTE RESOLUTION.. 27
SECTION 18. STOP WORK 28
SECTION 19. SMALL BUSINESS (SB) PARTICIPATION & DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) PARTICIPATION REPORTING REQUIREMENTS 29 SECTION 20. GENERAL TERMS... 30
SECTION 21. DATA PROTECTION PROVISIONS 32
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
SECTION 1. DEFINITIONS
1.1 DEFINITIONS:
Unless otherwise specified in the Statement of Work, the following terms shall be given the meaning shown unless the context requires otherwise. Capitalized terms used in this Contract and not defined in the text of Contract have the meaning below.
1.1.1 Buyer: the State's or Eligible Public Entity's authorized contracting official.
1.1.2 Cloud Computing Services: cloud services, including Software as a Service (SaaS), Infrastructure as a Service (laaS), Platform as a Service (PaaS), any other vendor- managed or hosted services, and any related services, provided to the State pursuant to Contract.
1.1.3 Cloud Computing Services Overage Charges: any additional fees incurred for usage of Cloud Computing Services that exceeds the allocated usage limits specified in Contract.
1.1.4 Contract: these Information Technology General Provisions - Cloud Computing Services (GSPD - ITGP (Cloud)) and the other documents set forth in Section 3 (Order of Precedence) collectively make up this Contract.
1.1.5 Contractor: individual(s) or business entity with whom the State enters this Contract.
1.1.6 Data Breach: any access, destruction, loss, theft, use, modification, or disclosure of State Data by an unauthorized party or that is in violation of Contract terms or applicable state or federal law.
1.1.7 Day(s): calendar day(s) unless otherwise indicated.
1.1.8 Deliverables: Cloud Computing Services, Software, Services, Goods, works of authorship, and any other items (e.g., reports, Documentation) to be delivered pursuant to this Contract, including any incidental items.
1.1.9 Documentation: instructions, specifications, training materials, or other documents provided in hard copy or electronic form with the Cloud Computing Services, Software, Services, or Goods, or otherwise, in accordance with Contract.
1.1.10 Eligible Public Entity: includes the county, city, city and county, district, public authority, public agency, municipal corporation, or any other political subdivision or public corporation in the State. "Eligible Public Entity" also includes a federally recognized tribal entity acting in its tribal governmental capacity.
1.1.11 Goods: all types of tangible personal property, including materials, supplies, and equipment (including computer, telecommunications, broadband equipment) (Pub. Con.
Code §10290(d).)
1.1.12 Infrastructure-as-a-Service (laaS): capability to provide processing, storage, networks, and other fundamental computing resources where the User is able to deploy and run arbitrary software, which can include operating systems and applications. The User does not manage or control the underlying Cloud Computing Services infrastructure but has control over operating systems, storage, and deployed applications and possibly limited control of select networking components (e.g., host firewalls).
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
1.1.13 Platform-as-a-Service (PaaS): capability to deploy onto Cloud Computing Services infrastructure customer-created or acquired applications created using programming languages and tools supported by the Service Provider. This capability does not necessarily preclude the use of compatible programming languages, libraries, services, and tools from other sources. The User does not manage or control the underlying Cloud Computing Services infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.
1.1.14 Recovery Point Objective (RPO): the point in time to which State Data can be recovered and systems restored when service is restored after an interruption. The RPO is expressed as the length of time between the interruption and the most proximate backup of State Data immediately preceding the interruption.
1.1.15 Recovery Time Objective (RTO): the period of time within which information technology services, systems, applications, and functions must be recovered following an unplanned interruption.
1.1.16 Reseller (see also "Contractor"): business entity authorized by the Service Provider or software publisher to resell the Deliverables to the State.
1.1.17 Security Incident: an actual or suspected Data Breach.
1.1.18 Services: an all-inclusive term which includes, but is not limited to, support services (such as maintenance and operation) and other personal services (e.g., technical or professional services, such as consulting and direction, project management, implementation, training, customization) provided by Contractor in accordance with this Contract. This term does not include Cloud Computing Services.
1.1.19 Service Provider: provider of the Services or Cloud Computing Services under Contract, as set forth in the Statement of Work, if applicable.
1.1.20 Software: an all-inclusive term that refers to any computer programs, routines, or subroutines supplied by Contractor, including operating Software, application programs, or programming aids to facilitate the execution of specific tasks or the use of Cloud Computing Services.
1.1.21 Software as a Service (SaaS): capability provided to the User to use the Service Provider's applications running on a Cloud Computing Services infrastructure; applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface; User does not manage or control the underlying Cloud Computing Services infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application configuration settings.
1.1.22 State: refers to the government of the State of California, its employees, and authorized representatives, including, without limitation, any department, agency, or government unit of the State as identified in Contract.
1.1.23 State Data: all data owned by the State and submitted to, processed by, or stored under this Contract and includes, but is not limited to, all data that originated with or provided by the State or Users, all data provided by the State or Users, and all data generated, manipulated, produced, reported by, or otherwise emanating from or by applications run by the State or Users on the Systems, Services, or Cloud Computing Services. For clarity, and without narrowing the scope of this definition, State Data is
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
synonymous with "customer data," "customer content," or similar terms, as may be used in Contractor's or Service Provider's service agreement that may be incorporated into Contract as an attachment or by reference, and includes the following:
(a) Non-Public Data: data, including Personal Information, that is not subject to distribution to the public as Public Information. It is deemed to be sensitive or confidential by the State because it contains information that may be exempt by statute, regulation, or policy from access by the general public as Public Information. (b) Personal Information: has the definition set forth in the California Information Practices Act (Civ. Code, § 1798).
(C) Public Information: any information prepared, owned, used, or retained by the State and not specifically exempt from the disclosure requirements of the California Public Records Act (Gov. Code, § 7920.00 et seq.) or other applicable state or federal laws. For clarity, "Public Information" is also interchangeable with "Public Data".
1.1.24 Statement of Work: description of the State's requirements for work that includes but is not limited to Deliverables, major tasks, detailed work plans, methods, goals, objectives, timeframes, locations, and contacts.
1.1.25 System: hardware, Software, Services, and Cloud Computing Services as described in this Contract when integrated, functioning together, and performing in accordance with this Contract.
1.1.25 U.S. Intellectual Property Right: any intellectual property right enforceable in the United States, including, without limitation, rights in trade secrets, copyrights, and U.S. patents.
1.1.26 Users) (or Customer): any State or Eligible Public Entity's authorized end User of the Deliverables, including employees, independent contractors, authorized agents, auditors, and other independent providers as may be agreed by the parties.
SECTION 2. CONTRACT FORMATION
2.1 CONTRACT FORMATION:
The State and Contractor are individually referred to as a "Party" and collectively referred to as "Parties."
2.1.1 Sealed Bid. If this Contract results from a sealed bid offered in response to a solicitation conducted pursuant to Chapters 2 (commencing with § 10290), 3 (commencing with § 12100), and 3.6 (commencing with § 12125) of Part 2 of Division 2 of the Public Contract Code (PCC), then Contractor's bid is a firm offer to the State which is accepted by the issuance of this Contract and no further action is required by either Party.
2.1.2 Other Offers, Quotes, or Proposals. If this Contract results from a solicitation other than as set forth in Section 2.1.1, Contractor's quotation or proposal is deemed a firm offer, and this Contract is the State's acceptance of that offer.
2.1.3 Joint Bid. If this Contract resulted from a joint bid, it shall be deemed one indivisible Contract. Each such joint Contractor will be jointly and severally liable for the performance of the entire Contract. The State assumes no responsibility or obligation for the division of orders or purchases among joint Contractors.
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
2.2 CONTRACTOR'S POWER & AUTHORITY:
2.2.1 Contractor warrants that it has full power and authority to grant the rights herein and will hold the State harmless from and against any loss, cost, liability, and expense (including reasonable attorney fees) arising out of any breach of this warranty. The State will notify Contractor promptly in writing of any such claim, and Contractor will have sole control of the defense of any claim and all negotiations for its settlement or compromise, provided that:
(a) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is required by law, the State may participate in such action at its own expense with respect to attorneys' fees and costs (but not liability); where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services (DGS), or as appropriate, the California Department of Technology (CDT), must approve any settlement or compromise, which approval will not unreasonably be withheld or delayed; and
(c) the State will reasonably cooperate in the defense and in any related settlement negotiations. Further, Contractor agrees it will not enter into any arrangement with any third-party which may diminish any rights of the State under the Contract.
2.2.2 To the extent Contractor is a Reseller, Contractor warrants that (a) the Service Provider has reviewed the Contract; (b) in Contractor's agreement with the Service Provider, the Service Provider has agreed to accept the responsibilities, obligations, and liabilities (such as License Grant, Inspection, Acceptance, Rejection, Warranties, Confidentiality, Indemnification, Data Protection Provisions) under this Contract that naturally reside with the Service Provider with respect to the provision of Deliverables; and (c) Contractor can provide the Deliverables in accordance with the Contract.
2.2.3 Nothing contained in the Contract, or otherwise, shall create any contractual relation between the State and any subcontractors, and no subcontract shall relieve Contractor of Contractor's responsibilities and obligations hereunder. Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by Contractor. Contractor's obligation to pay its subcontractors is an independent obligation from the State's obligation to make payments to Contractor. As a result, the State shall have no obligation to pay any moneys to any subcontractor.
SECTION 3. ORDER OF PRECEDENCE
In the event of any inconsistency or conflict between the sections, exhibits, attachments, specifications, or provisions comprising the Contract, the following order of precedence shall apply:
(a) These GSPD - ITGP (Cloud) (except in the instances herein where the provision contains "Unless otherwise specified in the Statement of Work" (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in these GSPD - ITGP (Cloud));
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(b) Contract form(s), i.e., Purchase Order STD 65, Standard Agreement STD 213, FISCal generated Purchase Order, etc., and any amendments;
Other Special Provisions (except in the instances therein where the provision contains "Unless otherwise specified in the Statement of Work" (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in the applicable Special Provisions);
d) Statement of Work (SOW), as an exhibit, including any specifications incorporated by reference herein;
(e) Cost worksheets;
(f) Other work description, work authorization or exhibit issued by Users; and (g) All other Contractor's or Service Provider's attachments included in Contract and/or incorporated in Contract by reference (e.g., end User license agreements, acceptable use policies, service guides, product specific terms and conditions).
SECTION 4. LICENSE GRANTS
4.1 SOFTWARE LICENSE:
Unless otherwise specified in the Statement of Work, if use of the Cloud Computing Services requires the use of separate or additional Software, Contractor grants to the State, and the State accepts from Contractor, subject to the terms and conditions of this Contract, a royalty- free, non-exclusive license to use the Software and any Documentation. The State may use the Software only in connection with use of the Cloud Computing Services and according to any licensing terms as may be specified in this Contract. Acceptance of Software (including third-party Software) will be governed by the terms and conditions of the Contract.
4.2 FUTURE RELEASES:
Unless otherwise specified in the Statement of Work, if improved versions, patches, corrections, modifications, bug fixes, updates, or releases (collectively, Updates) of the Software versions are developed by Contractor and are made available to other licensees, such Updates will be made available to the State at no additional cost only if such are made available to other licensees at no additional cost. If Contractor offers new versions or upgrades to the Software, they shall be made available to the State at the State's option, at a price no greater than Contract price, plus a price increase proportionate to the increase from the list price of the original version to that of the new version, if any. If the Software has no list price, such price increase will be proportionate to the increase in average price from the original to the new version, if any, as estimated by Contractor in good faith.
4.3 ENCRYPTION & AUTHORIZATION KEYS:
Upon initiation of Cloud Computing Services, Contractor shall provide all encryption and authorization keys required by the Users to access the Cloud Computing Services.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
SECTION 5. SERVICES
5.1 SUPPORT SERVICES:
If applicable, Contractor will provide the support services for the periods set forth in the Contract subject to the State's payment of the applicable support and maintenance fees.
5.2 PROFESSIONAL SERVICES:
If applicable, Contractor will provide professional Services in accordance with the Contract.
The State shall provide reasonable access to information, documentation, facilities, equipment, hardware, software, and personnel as agreed by the Parties to facilitate Contractor's performance of the professional Services.
SECTION 6. DEMONSTRATIONS
The State may request demonstrations of Deliverables, and such demonstrations shall be conducted at no cost to the State.
SECTION 7. INSPECTION, ACCEPTANCE & REJECTION
7.1 ACCEPTANCE TESTING:
Unless otherwise specified in the Statement of Work:
7.1.1 Non-Customized Deliverables. When acquiring commercial Software, Goods, or Cloud Computing Services, the State shall rely on Contractor's existing quality assurance system as a substitute for State inspection and testing. All Goods may be subject to inspection, test, and acceptance by the State or its authorized representatives at the destination, notwithstanding any payment or inspection at source.
7.1.2 Customized Deliverables. For all other Software, Goods, Services, or Cloud Computing Services customized for the State pursuant to the Contract, Contractor will ensure and maintain a quality assurance system acceptable to the State covering such Deliverables and will tender to the State only those Deliverables that have been inspected and found to conform to this Contract's requirements. All Goods may be subject to inspection, test and acceptance by the State or its authorized representatives, at destination, notwithstanding any payment or inspection at source.
7.1.3 Contractor Duties. Contractor shall provide all reasonable facilities for the safety and convenience of inspectors at no additional cost to the State. Contractor shall furnish to inspectors all information and data reasonably required to perform inspection. Contractor shall keep records evidencing inspections and their result and make these records available to the State during Contract performance and for 3 years after final payment. Contractor shall permit the State to review procedures, practices, processes, and related documents to determine the acceptability of Contractor's quality assurance system or other similar business practices related to performance of the Contract.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
7.2 NOTICE OF REJECTION:
The State shall give written notice of rejection (Rejection Notice) of Deliverables provided, pertormed, or delivered within a reasonable time after receipt or performance of such Deliverables. The Rejection Notice will provide information on which Deliverables do not substantially conform to required specifications. If the State does not provide a Rejection Notice within 30 Days of delivery or within such time provided in the Contract for inspection, acceptance, and rejection if longer than 30 Days, such Deliverables will be deemed to have been accepted.
In the event any Deliverables should fail to conform to Contractual requirements, or to the sample submitted by Contractor (if applicable), the State may reject the same, and Contractor shall reclaim and remove the item promptly or correct the performance of Services or Cloud Computing Services, without expense to the State, and immediately replace all such rejected items with items conforming to the Contract.
7.3 ACCEPTANCE:
Acceptance by the State will be final and irreversible, except as it relates to latent defects, fraud, and gross mistakes amounting to fraud. Acceptance shall not be construed to waive any warranty rights that the State might have at law or by express reservation in the Contract with respect to any non-conformity.
7.4 TITLE:
Unless otherwise specified in the Statement of Work, title to Goods shall remain with Contractor and assignees, if any, until there is successful completion of the acceptance testing.
SECTION 8. WARRANTIES & REPRESENTATIONS
8.1 WARRANTIES' DURATION AND ASSIGNMENT:
8.1.1 Unless otherwise specified in the Statement of Work, the warranties in this Section 8 begin upon delivery of the Deliverables (or activation date in case of Software or Cloud Computing Services, as applicable). For clarification, this warranty period shall apply to any Deliverables provided as part of warranty replacement.
8.1.2 Unless otherwise specified in the Statement of Work, duration of warranty for Deliverables shall be as follows:
Warranty for Goods shall terminate one year after delivery of the Goods.
Warranty for Software, Services, and Cloud Computing Services shall be for the duration of the State's use of the Software, Services, and Cloud Computing Services.
8.1.3 All warranties, including additional warranties specified elsewhere herein, shall inure to the State, its successors, assignees, Buyer, and Users of Deliverables.
8.2 WARRANTIES FOR DELIVERABLES:
Contractor warrants that Deliverables:
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(a) will substantially conform to the requirements of the Contract including without limitation all descriptions, specifications, and drawings identified in the Statement of Work),
(b) will substantially conform to the manufacturer's published specifications and the requirements of the Contract (including, without limitation, all descriptions, specifications, and drawings identified in the Statement of Work). (c) will be free from material defects in materials and workmanship, (d) shall provide all material functionality required where the Parties have agreed to design specifications (such as a detailed design document) and incorporated the same or equivalent in the Statement of Work directly or by reference, provided, however, that the State's approval of designs or specifications supplied by Contractor shall not relieve Contractor of its obligations under this warranty, and
(e) will not infringe or violate any U.S. Intellectual Property Rights.
8.3 ADDITIONAL WARRANTIES FOR SERVICES:
The Services will be performed in a skilled, professional manner by competent personnel and in accordance with the Contract.
8.4 ADDITIONAL WARRANTIES FOR SOFTWARE:
8.4.1 Contractor warrants that Software supplied hereunder has been tested in accordance with industry standards to minimize the risk, at the time of delivery, of harmful code (e.g., computer viruses, worms, trap doors, time bombs, disabling code, or any similar malicious mechanism designed to interfere with the intended operation of, or cause damage to, computers, data, or Software). Without limiting the generality of the foregoing, if the State believes that harmful code may be present in any commercial Software delivered hereunder, Contractor will, upon the State's request, provide a new or clean install of the Software.
8.4.2 Unless otherwise specified in the Statement of Work:
(a) Contractor does not warrant that any Software provided hereunder is error-free or that it will run without immaterial interruption.
(b) Contractor does not warrant and will have no responsibility for a claim to the extent that it arises directly from: (i) a modification made by the State unless such modification is approved or directed by Contractor; (i) use of Software in combination with or on products other than as specified by Contractor; or (iii) misuse or unauthorized use by the State.
8.5 ADDITIONAL WARRANTIES FOR CLOUD COMPUTING SERVICES:
8.5.1 Unless otherwise specified in the Statement of Work, Contractor warrants Cloud Computing Services and all support for Cloud Computing Services will be performed in a skilled, professional manner by competent personnel and in accordance with the Contract.
Contractor shall ensure that the Service Provider applies anti-malware controls to the Cloud Computing Services to help avoid malicious software gaining unauthorized access to State Data, including malicious software originating from public networks. Such controls shall at all times equal or exceed the controls consistent with the industry standards for such data, but in
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
no event less than the controls that Contractor applies to its own internal corporate electronic data of like character.
8.5.2 Unless otherwise specified in the Statement of Work:
(a) any implied warranties, guarantees, or conditions not able to be disclaimed as a matter of law will last for one year from the start of the Cloud Computing Services warranty; (b) the Cloud Computing Services warranty does not cover problems caused by the State's accident, abuse or use in a manner inconsistent with the Contract or any applicable service agreement, or resulting from events beyond Contractor's reasonable control; (c) the Cloud Computing Services warranty does not apply to components of Software that the State may be permitted to redistribute;
(d) the Cloud Computing Services warranty does not apply to free, trial, pre-release, or beta services; and
(e) the Cloud Computing Services warranty does not apply to problems caused by the State's failure to meet minimum system requirements.
8.6 PASS-THROUGH WARRANTIES:
(a) In addition to the warranties set forth herein, any Goods provided by Contractor shall be covered by the manufacturer's consumer warranty that will be passed through to the State. Contractor shall provide the manufacturer's warranty information (e.g., terms and conditions, provider, etc.) to the State with all Goods at the time of delivery. Where Contractor resells Goods it purchased from a third-party, Contractor, to the extent it is legally able to do so, will pass through any such third-party warranties to the State and will reasonably cooperate in enforcing them. Contractor shall facilitate Goods replacement or cooperate in resolving any disputes with the Goods manufacturer. Any Software provided by the Service Provider or Contractor shall be covered by the software developer's consumer warranty that will be passed through to the State. (b) Contractor agrees that the warranty pass-through set forth herein shall not relieve Contractor from Contractor's warranty obligations set forth herein.
8.7 REMEDIES FOR BREACH OF WARRANTY:
Unless otherwise specified in the Statement of Work, the State's remedy for any breach of the warranty provided in this Section 8 shall include, at the State's sole discretion (a) re- performance, repair, or replacement of the nonconforming Deliverables (including without limitation an infringing Deliverable); or (b) right to terminate the Contract, either in whole or in part, and a refund of all amounts paid by the State for the nonconforming Deliverable and payment to the State of any additional amounts necessary to equal the State's Cost to Cover. "Cost to Cover" means the cost, properly mitigated, of procuring Deliverable of equivalent capability, function, and performance. If Contractor fails to re-perform, repair, replace, or refund fees paid for the Deliverable as appropriate, the State may terminate the Contract.
8.8 DISCLAIMER:
EXCEPT FOR THE WARRANTIES SPECIFIED IN THIS CONTRACT, CONTRACTOR
MAKES NO OTHER EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SECTION 9. RIGHTS IN WORK PRODUCT & GOVERNMENT PURPOSE RIGHTS
9.1 OWNERSHIP & RIGHTS IN WORK PRODUCT:
9.1.1 Work Product: Unless otherwise specified in the Statement of Work (or as required for federally funded projects), all inventions, discoveries, intellectual property, technical communications, and records originated or prepared by Contractor pursuant to the Contract, including papers, reports, charts, computer programs, and other Documentation or improvements thereto, and including Contractor's administrative communications and records relating to this Contract (collectively, Work Product), shall be Contractor's exclusive property.
9.1.2 Pre-Existing Material: Software, Cloud Computing Services and components, and other materials developed or otherwise obtained by or for Contractor or its affiliates independently of the Contract (Pre-Existing Materials) do not constitute Work Product. If Contractor creates Derivative Works of Pre-Existing Materials, the elements of such Derivative Works created pursuant to the Contract constitute Work Product, but other elements do not. "Derivative Works" means any work that is based upon the Work Product, such as an enhancement, update, translation, abridgment, summary, or aggregation. Nothing in this Section will be construed to interfere with Contractor's or its affiliates' ownership of Pre- Existing Materials.
9.1.3 Jointly Developed Work Product: The ideas, concepts, know-how, techniques, customizations, or configurations, relating to data processing, developed during the Contract by Contractor or jointly by Contractor and the State may be used by either Party without obligation of notice or accounting.
9.1.4 Proprietary Products: The Contract shall not preclude Contractor from developing materials outside this Contract that are competitive, irrespective of their similarity to materials which might be delivered to the State pursuant to the Contract.
9.2 GOVERNMENT PURPOSE RIGHTS:
The State will have Government Purpose Rights to Work Product. "Government Purpose Rights" are the unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive rights and licenses to use, modify, reproduce, perform, release, display, create Derivative Works from, and disclose the Work Product. Government Purpose Rights also include the right to release or disclose the Work Product outside the State for any State government purpose and to authorize recipients to use, modify, reproduce, perform, release, display, create Derivative Works from, and disclose the Work Product for any State government purpose. Such recipients of the Work Product may include, without limitation, State contractors, California local governments, the U.S. federal government, U.S. tribal governments, and state and local governments of other states. Government Purpose Rights do not include any rights to use, modify, reproduce, perform, release, display, create Derivative Works from, or disclose the Work Product for any commercial purpose.
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
9.3 FEDERALLY FUNDED PROJECTS:
This Section and the rights hereunder may be modified in the Statement of Work as required for federally funded projects pursuant to federal law or regulations, including, but not limited to, 7 CFR 277.18 and 45 CFR 95.617.
SECTION 10. CONFIDENTIALITY; DATA RIGHTS
10.1 CONFIDENTIALITY OBLIGATIONS:
Each Party will ensure that access to the other Party's confidential information is provided only to those individuals who need access to such information to fulfill their obligations under the Contract. With regards to the State, confidential information includes Personal Information and Non-Public Data maintained by state agencies.
Confidential information does not include information that: (a) is or enters the public domain without breach of this Contract; (b) came into the receiving Party's possession from a third- party entitled to disclose such information without an obligation of confidentiality; (c) is independently developed by the receiving Party without use or reference to the disclosing party's confidential information; or (d) required to be produced in compliance with statute, regulation or court order, provided that Contractor provides advance written notice of such disclosure to the State.
10.2 CONFIDENTIALITY OF STATE DATA:
State Data, including all financial, statistical, personal, technical and other data and information relating to the State's operation, which are designated confidential by the State and made available to Contractor in order to carry out the Contract, or which become available to Contractor in carrying out the Contract, shall be protected by Contractor from unauthorized use and disclosure through the observance of the same or more effective procedural requirements as are applicable to the State. The identification of all such confidential data and information, as well as the State's procedural requirements for protection of such data and information from unauthorized use and disclosure, shall be provided by the State in writing to Contractor.
Contractor shall comply and ensure compliance by the Service Provider with the Security and Data Protection provisions set forth in the GSPD - ITGP (Cloud Services) Contractor shall not be required under this Section to keep confidential any data or information that meet the exceptions set forth in Section 10.1.
10.3 CONTRACTOR'S CONFIDENTIALITY OBLIGATIONS:
Contractor shall have appropriate agreements in place to ensure confidentiality and security of State Data required pursuant to the Contract. Contractor shall ensure that all Contractor and Service Provider personnel with access to State Data shall comply with security and confidentiality obligations set forth in the Contract.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
10.4 RIGHTS TO STATE DATA:
All rights, including all intellectual property rights, in and to State Data, shall remain the exclusive property of the State. Contractor has a limited, non-exclusive license to access and use State Data solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to State Data, including User tracking and exception data within the System, by implication, estoppel, or otherwise, under U.S. Intellectual Property Rights, to any third-party. Unauthorized use of State Data by Contractor or third parties is prohibited. For the purposes of this requirement, the phrase "unauthorized use" includes data mining, machine learning from data, or processing of data, stored or transmitted by the System, for any purpose that is not authorized by the Contract or Statement of Work.
10.5 RESTRICTIONS ON USE OF STATE DATA:
Contractor shall not collect, use, disclose, retain, or maintain (collectively, "use") State Data except as necessary and proportionate to perform Contractor's obligations under the Contract.
Contractor shall not: (a) transfer, share, rent, barter, trade, sell, loan, lease, or otherwise distribute or make available to any third party any State Data except as expressly permitted by the Contract; (b) copy, modify, destroy, or delete State Data during the Contract term; and (c) shall not sell or share State Data or Personal Information collected in the service of the Contract with the State. For the purposes of this Section 10.5: (a) "collect" and "collected" have the meaning provided in Civil Code section 1798.140, subdivision (f); and (b) "sell" has the meaning provided in Civil Code section 1798.140, subdivision (ad)(1).
10.6 PROTECTION OF CONTRACTOR'S PROPRIETARY SOFTWARE & OTHER PROPRIETARY DATA & MATERIALS:
All material appropriately marked or identified in writing as proprietary and supplied hereunder are provided for the State's exclusive use for the purposes of the Contract only. All such proprietary materials (including proprietary data) shall remain the property of Contractor.
Subject to the California Public Records Act, or other applicable law or legal process, the State agrees to: (a) take all reasonable steps to ensure that such proprietary materials/data are not disclosed to others; (b) provide prior written notice to Contractor in sufficient time to seek a protective order (unless such notice is prohibited by law); (c) ensure, prior to disposing of any media, that any licensed materials have been erased, destroyed or otherwise sanitized; and (d) take appropriate action by instruction, agreement, or otherwise with its employees and other persons permitted access to licensed Software and other proprietary data to satisfy its obligations in the Contract with respect to use, copying, modification, protection, and security of proprietary Software and other proprietary materials.
10.7 LEGAL REQUESTS:
Contractor shall notify the State by the fastest means available, not later than 48 hours after receipt, of any subpoena, warrant, court order, service of process, California Public Records Act (Gov. Code, § 7920.00 et seq.) request, and or other legal request ("Requests") which seeks access to State Data or information about the State's use of the Deliverables, unless such notification is prohibited by law. Unless prohibited by law, Contractor shall also provide
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
written notice to Contracting agency and to the Agency Chief Information Security Officer (CISO) or designee of Contracting agency. Unless prohibited by law, Contractor shall not respond to such Requests unless authorized in writing to do so by the State and shall not respond to such Requests directed at Contractor regarding the Contract without first notifying the State in writing. Unless prohibited by law, Contractor shall provide the State with its intended responses to such Requests with adequate time for the State to review, revise, and, if necessary, seek a protective order.
SECTION 11. INDEMNIFICATION
11.1 INTELLECTUAL PROPERTY (IP) INDEMNITY:
11.1.1 Contractor's IP Indemnification Obligation. Notwithstanding Section 12 (Limitation of Liability), Contractor will indemnify, defend, and save harmless the State, its officers, agents, and employees, from any and all third-party claims, costs, expenses (including without limitation reasonable attorneys' fees), fines, penalties, deficiencies, liabilities and losses (including settlements and judgments) arising from or related to any allegation that the Deliverables violate, misappropriate or infringe of any U.S. Intellectual Property Right.
11.1.2 Pass-Through Indemnity for Third Party Obligations. With respect to such claims arising from Deliverables provided by a third-party and supplied by Contractor to the State, Contractor will pass through to the State such indemnity rights as it receives from such third- party ("Third-Party Obligation") and will cooperate in enforcing them; provided that if a third- party manufacturer fails to honor any Third-Party Obligation, Contractor will indemnify, defend, and save harmless the State, its officers, agents and employees, to the same extent as the Third-Party Obligation, subject to any applicable limitation of liability in Section 12 (Limitation of Liability).
11.1.3 Notice of Remedy for IP Infringement. Should the Deliverables, whether provided by Contractor or manufactured by a third-party, become, or in Contractor's opinion are likely to become, the subject of a claim of infringement or violation of a U.S. Intellectual Property Right, Contractor shall provide the State with written notice of the circumstances giving rise to such claim or likely claim. If the State receives notice of a claim of infringement or is made Party to, or is threatened with such claim, the State will provide Contractor with notice of such claim or threat.
(a) Following receipt of such notice, Contractor will either (at Contractor's expense): (i) procure for the State the right to continue using the Deliverables; or (i) replace or modify the same so that they become non-infringing. If none of these options can reasonably be exercised, Contractor shall take back such Goods or other Deliverables, and terminate any infringing Services or Cloud Computing Services, make every reasonable effort to assist the State in procuring substitute Deliverables for the State, and pay the State any additional amounts necessary to equal the State's Cost to Cover.
If none of the foregoing options is reasonably acceptable to the State, the State shall have the right to terminate the Contract, in whole or in part, without damage, penalty, termination charge, or further obligation and Contractor agrees to refund any sums the State has paid Contractor less any reasonable amount for use or damage. (b) Contractor shall have no liability to the State under any provision of this Section 11.1 with respect to any claim of patent, copyright or trade secret infringement which is based upon: (i) the State's combination or utilization of Goods supplied hereunder with
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
non-Contractor supplied Goods; (i) the combination or utilization of Services or Cloud Computing Services not made or supplied by Contractor, and introduced into the State's computing environment; (iii) the modification initiated by the State, or a third-party at the State's direction, of any Deliverables supplied hereunder; (iv) the combination or utilization of Goods supplied hereunder with non-Contractor supplied other Deliverables; or (v) the State's unauthorized use, or continuing infringing use after notification, of Deliverables supplied hereunder.
(c) Contractor certifies that it has appropriate systems and controls in place to ensure that State funds will not be used in the performance of this Contract for the acquisition, operation or maintenance of Software in violation of any U.S. intellectual property laws
11.2 INDEMNIFICATION FOR INJURY OR DAMAGE:
Contractor shall indemnify, defend and save harmless the State, its officers, agents and employees from any and all third-party claims, costs (including, without limitation, reasonable attorneys' fees), and losses due to the injury or death of any individual, or the loss or damage to any real or tangible personal property, resulting from the willful misconduct or negligent acts or omissions of Contractor or any of its affiliates, agents, subcontractors, employees, suppliers, or laborers supplying work, services, materials, or supplies in connection with the performance of the Contract.
11.3 INDEMNIFICATION PROCESS:
Unless a Third-Party Obligation provides otherwise, the defense and payment obligations for indemnification under Sections 13.1 and 11 are conditioned on the following:
The State will notify Contractor promptly in writing of any demand for indemnification and, in the notification, describe the circumstances giving rise to the demand. Notwithstanding the foregoing, if Contractor is not notified of a claim in a timely manner, Contractor is still obligated to indemnify the State, unless such delay causes material prejudice to Contractor. Contractor will have sole control of the defense of any claim and all negotiations for its settlement or compromise; provided that:
(a) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is required by law, the State may participate in such action at its own expense with respect to attorneys' fees and costs (but not liability); or (b) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, DGS or CDT, as appropriate, must approve any settlement or compromise and the State will reasonably cooperate in the defense and in any related settlement negotiations.
SECTION 12. LIMITATION OF LIABILITY
12.1 LIMITATION OF LIABILITY:
Except as may be otherwise approved by DGS-PD's Deputy Director or their designee, or as applicable, CDT's Office of Statewide Technology Procurement Deputy Director (STP), Contractor's liability for damages to the State for any cause whatsoever, and regardless of the form of action, whether in contract or tort, shall be limited to the Purchase Price. "Purchase
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
Price" means the aggregate Contract price; except that, with respect to a Contract under which multiple purchase orders will be issued (e.g., a Master Agreement or Multiple Award Schedule contract), "Purchase Price" will mean the total price of the purchase order for the Deliverable(s) that gave rise to the loss, such that Contractor will have a separate limitation of liability for each purchase order. The State's liability for damages for any cause whatsoever, and regardless of the form of action whether in Contract or in tort, shall be limited to the Purchase Price as that term is defined above. Nothing herein shall be construed to waive or limit the State's sovereign immunity or any other immunity from suit provided by law.
IN NO EVENT WILL A PARTY BE LIABLE TO THE OTHER FOR CONSEQUENTIAL,
INCIDENTAL, INDIRECT, SPECIAL, OR PUNITIVE DAMAGES, EVEN IF NOTIFICATION
HAS BEEN GIVEN AS TO THE POSSIBILITY OF SUCH DAMAGES, EXCEPT (A) TO THE
EXTENT THAT CONTRACTOR'S LIABILITY FOR SUCH DAMAGES IS SPECIFICALLY SET
FORTH IN THE STATEMENT OF WORK OR (B) TO THE EXTENT THAT CONTRACTOR'S
LIABILITY FOR SUCH DAMAGES FALLS UNDER ONE OF THE EXCEPTIONS IN SECTION
12.2 BELOW.
12.2 EXCEPTIONS:
The foregoing limitation of liability shall not apply to: (a) any liability under Section
13.1(Compliance with Statutes & Regulations); (b) liability under Section 11.1 (Intellectual Property (IP) Indemnity) or to any other liability (including, without limitation, indemnification obligations) for infringement of third-party intellectual property rights; (c) liability under Section
11.2 (Indemnification for Injury or Damage); (d) costs or attorney's fees that the State becomes entitled to recover as a prevailing Party in any action; or (e) direct costs of mitigation, remediation, third-party claims, and notification obligations resulting from any Data Breach attributable to Contractor's acts or omissions (including the acts or omissions of Contractor's employees, contractors or agents). Nothing herein shall prevent the Parties from determining the appropriate amounts attributable to the direct costs of data breach notification, credit monitoring, and other obligations set forth in Civil Code § 1798.29 as further specified in Section 21.11 (Data Breach).
SECTION 13. STATUTORY & REGULATORY REQUIREMENTS; CONTRACTOR
CERTIFICATIONS
THE FOLLOWING PROVISIONS ARE REQUIRED BY LAW AND CANNOT BE EDITED OR REMOVED FROM CONTRACT.
13.1 COMPLIANCE WITH STATUTES & REGULATIONS:
The Parties warrant and certify that in the performance of this Contract, they will comply with all applicable statutes, rules, regulations, and orders of the United States and the State of California. Contractor agrees to indemnify the State against any loss, cost, damage, or liability by reason of Contractor's violation of this provision (including violations by Contractor's employees, contractors, and agents), subject to the requirements set forth in Section 11.3 (Indemnification Process).
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
13.2 NONDISCRIMINATION CLAUSE:
During the performance of this Contract, Contractor and its subcontractors: (a) shall not unlawfully discriminate, harass, or allow harassment against any employee or applicant for employment because of sex, sexual orientation, race, color, ancestry, religious creed, national origin, disability (including HIV and AIDS), medical condition (cancer), age, marital status, and denial of family care leave; (b) shall ensure that the evaluation and treatment of their employees and applicants for employment are free from such discrimination and harassment; (c) shall comply with the provisions of the Fair Employment and Housing Act (Gov. Code, § 12990 et seq.) and the applicable regulations promulgated thereunder (Cal. Code Regs., tit. 2, § 7285.0 et seq.) and (d) shall give written notice of their obligations under this clause to labor organizations with which they have a collective bargaining or other agreement. The applicable regulations of the Fair Employment and Housing Commission implementing Government Code Section 12990, subdivisions (a) through (f), set forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations are incorporated into this Contract by reference. Contractor shall include the nondiscrimination and compliance provisions of this provision in all subcontracts to perform work under the Contract.
13.3 ACCESSIBILITY:
To the extent that the Contract falls within the scope of Government Code § 11135, Contractor shall respond to and resolve any complaint brought to its attention regarding accessibility of its products or services, in accordance with Government Code § 7405.
13.4 AMERICANS WITH DISABILITIES ACT:
Contractor shall comply with the Americans with Disabilities Act of 1990 (42 U.S.C. § 12101 et seq.).
13.5 PRIORITY HIRING CONSIDERATIONS:
If this Contract includes Services over $200,000, Contractor shall give priority consideration in filling vacancies in positions funded by the Contract to qualified recipients of aid under Welfare and Institutions Code § 11200 in accordance with PCC § 10353.
13.6 FOLLOW-ON CONTRACTS:
If this Contract fits the definition of a "consulting services contract" within the meaning of PCC § 10335.5, Contractor may be prohibited from bidding on or being awarded a subsequent contract in accordance with the provisions of PCC § 10365.5, subject to the provisions of PCC § 10430.
To the extent permissible by law, the Director of DGS (DGS Director), or as appropriate, the Director of CDT (CDT Director), or their designees, may waive the restrictions set forth in this Section by written notice to Contractor if the DGS Director or, as appropriate, CDT Director, determines their application would not be in the State's best interest.
The restrictions of this Section will not apply: (a) to follow-on advice given by vendors of commercial off-the-shelf products, including Software and hardware, on the operation,
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
integration, repair, or maintenance of such products after sale; or (b) where the State has entered into a master agreement for Software or Services and the scope of work at the time of Contract execution expressly calls for future recommendations among Contractor's own products.
The restrictions set forth in this Section 13.6 are in addition to conflict-of-interest restrictions imposed on public contractors by California law (Conflict Laws). In the event of any inconsistency, such Conflict Laws override the provisions of this Section 13.6, even if enacted after execution of this Contract.
13.7 CHILD SUPPORT COMPLIANCE ACT:
For any Contract in excess of $100,000, Contractor acknowledges, in accordance with PCC § 7110, that: (a) they recognize the importance of child and family support obligations and shall fully comply with all applicable State and federal laws relating to child and family support enforcement, including, but not limited to, disclosure of information and compliance with earnings assignment orders, as provided in Chapter 8, commencing with Section 5200 of Part 5 of Division 9 of the Family Code; and (b) Contractor, to the best of its knowledge, is fully complying with the earnings assignment orders of all employees and is providing the names of all new employees to the New Hire Registry maintained by the California Employment Development Department.
13.8 LOSS LEADER:
Contractor shall comply with PCC § 12104.5, subdivision (b) and shall not engage in business within this state to sell or use any article or product as a "loss leader" as defined in § 17030 of the Business and Professions Code.
13.9 GOVERNMENT PROCUREMENT AGREEMENT:
If the value of this Contract exceeds the US dollar procurement threshold determined by the US Trade Representative (as set forth in the Federal Register), this Contract shall be subject to the requirements of the World Trade Organization Government Procurement Agreement.
13.10 ASSIGNMENT OF ANTITRUST ACTIONS:
Pursuant to Government Code sections 4552, 4553, and 4554, the following provisions are incorporated herein:
(a) in submitting a bid to the State, Contractor offers and agrees that if the bid is accepted, it will assign to the State all rights, title, and interest in and to all causes of action it may have under Section 4 of the Clayton Act (15 U.S.C. § 15) or under the Cartwright Act (Bus. & Prof. Code, Chapter 2, commencing with § 16700 et seq.), arising from purchases of Goods, material services, or other items, by the supplier for sale to the State pursuant to the solicitation. Such assignment shall be made and become effective at the time the State tenders final payment to the Contractor; (b) if the State receives, either through judgment or settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor shall be entitled to receive
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
reimbursement for actual legal costs incurred and may, upon demand, recover from the State any portion of the recovery, including treble damages, attributable to overcharges that were paid by the assignor but were not paid by the State as part of the bid price, less the expenses incurred in obtaining that portion of the recovery. (c) Upon demand in writing by the assignor, the assignee shall, within one year from such demand, reassign the cause of action assigned under this part if the assignor has been or may have been injured by the violation of law for which the cause of action arose and: (i) the assignee has not been injured thereby; or (ii) the assignee declines to file a court action for the cause of action.
13.11 EXECUTIVE ORDER N-6-22-RUSSIA SANCTIONS:
Contractor shall comply with Executive Order N-6-22 (EO) regarding Economic Sanctions against Russia and Russian entities and individuals. "Economic Sanctions" refers to sanctions imposed by the U.S. government in response to Russia's actions in Ukraine, as well as any sanctions imposed under state law. The EO directs state agencies to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. Accordingly, should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for termination of the Contract. The State shall provide Contractor prior written notice of termination, allowing Contractor at least 30 Days to provide a written response. Termination shall be at the State's sole discretion.
13.12 NATIONAL LABOR RELATIONS BOARD CERTIFICATION:
Contractor swears under penalty of perjury that no more than one final, unappealable finding of contempt of court by a federal court has been issued against Contractor within the immediately preceding 2-year period because of Contractor's failure to comply with an order of the National Labor Relations Board. This provision is required by and shall be construed in accordance with PCC § 10296.
13.13 DRUG-FREE WORKPLACE CERTIFICATION:
Contractor certifies that Contractor will comply with the requirements of the Drug-Free Workplace Act of 1990 (Gov. Code, § 8350 et seq.) and will provide a drug-free workplace by taking the following actions:
(a) Publish a statement notifying employees that unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited and specifying actions to be taken against employees for violations, as required by Government Code section 8355, subdivision (a).
(b) Establish a Drug-Free Awareness Program as required by Government Code section 8355, subdivision (b), to inform employees about all of the following: (i) the dangers of drug abuse in the workplace; (i) the person's or organization's policy of maintaining a drug-free workplace; (iii) any available counseling, rehabilitation, and employee assistance programs; and (iv) penalties that may be imposed upon employees for drug abuse violations.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(c) Provide, as required by Government Code section 8355, subdivision (c), that every employee who works on the proposed or resulting Contract: (i) will receive a copy of the company's drug-free policy statement; and (i) will agree to abide by the terms of the company's statement as a condition of employment on the Contract.
13.14 SWEAT FREE CODE OF CONDUCT:
Contractor certifies that no equipment, materials, or supplies supplied to the State pursuant to the Contract have been produced in whole or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, in compliance with PCC section 6108.
Contractor certifies that they adhere to the Sweat Free Code of Conduct as set forth on the California Department of Industrial Relations website located at www.dir.ca.gov. Contractor agrees to cooperate fully in providing reasonable access to its records, documents, agents or employees, or premises if reasonably required by authorized officials of the State, the Department of Industrial Relations, or the Department of Justice to determine Contractor's compliance with this provision.
13.15 DOMESTIC PARTNERS:
For Contracts over $100,000 executed or amended after January 1, 2007, Contractor certifies that they comply with PCC section 10295.3.
13.16 RECYCLED CONTENT REQUIREMENTS:
Contractor shall certify in writing under penalty of perjury, the minimum, if not exact, percentage of post-consumer material in the Goods offered or sold to the State that fall under any of the statutory categories regardless of whether the Goods meets the requirements of PCC section 12209. Contractor shall provide the certification, even if the Goods contain no post-consumer recycled material, and even if the post-consumer content is unknown. With respect to printer or duplication cartridges that comply with the requirements of PCC section 12156, subdivision (e), the certification required by this subdivision shall specify that the cartridges so comply (PCC, § 12205).
A State Buyer may waive the certification requirements if the percentage of post-consumer material in the Goods can be verified in a written advertisement, including, but not limited to, a product label, a catalog, or a manufacturer or vendor Internet web site. Contractors are to use to the maximum extent economically feasible in the performance of Contract, recycled content products (PCC, § 12203, subd. (d)).
13.17 ELECTRONIC WASTE RECYCLING ACT OF 2003:
To the extent the Contract involves the purchase or lease of electronic devices, Contractor certifies that it complies with the applicable requirements of the Electronic Waste Recycling Act of 2003, Chapter 8.5, Part 3 of Division 30, commencing with section 42460 of the Public
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
Resources Code. Contractor shall maintain documentation and provide reasonable access to its records and documents that evidence compliance.
13.18 FOUR-DIGIT DATE COMPLIANCE:
Contractor warrants that it will provide only Four-Digit Date Compliant (as defined below) Deliverables to the State. "Four Digit Date Compliant" Deliverables can accurately process, calculate, compare, and sequence date data, including without limitation date data arising out of or relating to leap years and changes in centuries. This warranty and representation is subject to the warranty terms and conditions of the Contract and does not limit the generality of warranty obligations set forth elsewhere herein.
13.19 COVENANT AGAINST GRATUITIES:
Contractor certifies that no gratuities (in the form of entertainment, gifts, or otherwise) were offered or given by Contractor, or any agent or representative of Contractor, to any officer or employee of the State with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract. For breach or violation of this warranty, the State shall have the right to terminate the Contract, either in whole or in part, and any loss or damage sustained by the State in procuring on the open market any items which Contractor agreed to supply shall be borne and paid for by Contractor. The rights and remedies of the State under this section are not exclusive and are in addition to any other rights and legal or equitable remedies.
13.20 EXPATRIATE CORPORATIONS:
Contractor certifies that it is not an expatriate corporation or subsidiary of an expatriate corporation within the meaning of PCC sections 10286 and 10286.1 and is eligible to contract with the State.
SECTION 14. CONTRACTOR RESPONSIBILITIES
14.1 INSURANCE:
Contractor shall maintain all commercial general liability insurance, workers' compensation insurance and any other insurance required under the Contract. Contractor shall furnish insurance certificate(s) evidencing required insurance coverage acceptable to the State, including endorsements showing the State as an "additional insured" if required under the Contract. Any required endorsements requested by the State must be separately provided; merely referring to such coverage on the certificates(s) is insufficient for this purpose. When performing work on State owned or controlled property, Contractor shall provide a waiver of subrogation in favor of the State for its workers' compensation policy.
14.2 ACCIDENT PREVENTION:
If performing work under this Contract on State premises, Contractor shall conform to any specific safety requirements contained in the Contract or as required by law or regulation.
Contractor shall take any additional precautions as the State may reasonably require for safety
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
and accident prevention purposes. Any violation of such rules and requirements, unless promptly corrected, shall be grounds for termination of the Contract for default.
14.3 CONTRACTOR'S LIABILITY FOR INJURY TO PERSONS OR DAMAGE TO PROPERTY:
Contractor shall be liable for damages arising out of injury to the person or damage to the real or tangible personal property of the State, State employees, persons designated by the State for training, or any other person(s) other than agents or employees of Contractor, designated by the State for any purpose, prior to, during, or subsequent to delivery, installation, acceptance, and use of the Deliverables either at Contractor's site or at the State's place of business, provided that the injury or damage was caused by Contractor's fault or negligence.
Contractor shall not be liable for damages arising out of, or caused by, an alteration or an Attachment not made or installed by Contractor, or for damage to alterations or Attachments that may result from the normal operation and maintenance of the Deliverables provided by Contractor during the Contract. "Attachment" means a mechanical, electrical, or electronic interconnection to Contractor-supplied equipment, manufactured by other than the original equipment manufacturer that is not connected by Contractor.
SECTION 15. INVOICES; PAYMENTS; TAXES & AUDITS
15.1 INVOICES:
Unless otherwise specified, invoices shall be sent to the address set forth herein. Invoices shall be submitted electronically, or in triplicate if in hardcopy, and shall include the Contract number, release order number (if applicable), item number, unit price, extended item price and invoice total amount. State sales tax and/or use tax shall be itemized separately and added to each invoice as applicable.
15.2 REQUIRED PAYMENT DATE:
Payment will be made in accordance with the provisions of the California Prompt Payment Act (Act) (Gov. Code, § 927 et seq). Unless expressly exempted by statute, the Act requires State agencies to pay properly submitted, undisputed invoices not more than 45 Days after: (a) the date of acceptance or performance of Deliverables; or (b) receipt of an undisputed invoice, whichever is later.
15.3 TAXES:
Unless otherwise required by law, the State of California is exempt from federal excise taxes.
The State will only pay for any state or local sales or use taxes on the Deliverables supplied to the State pursuant to the Contract.
15.4 USE TAX COLLECTION:
Contractor shall comply with section 7101 of the Revenue and Taxation Code. Contractor shall immediately notify the State in writing of any change in its retailer's seller's permit, certification
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
of registration, applicable affiliate's seller's permit, or certificate of registration as described in PCC section 10295.1(a).
15.5 EXAMINATION & AUDIT:
The State or its designated representative shall have the right to review and copy any records and supporting documentation directly pertaining to performance of this Contract. Contractor shall maintain such records for production or audit for a minimum of 3 years after final payment unless a longer period of records retention is stipulated. Contractor agrees to allow the State or its designee access to such records during normal business hours and to allow interviews of any employees or others who might reasonably have information related to such records.
Further, Contractor agrees to include a similar right of the State to audit records and interview staff in any subcontract related to performance of the Contract. The State shall provide reasonable advance written notice of such audits) to Contractor.
15.6 SOFTWARE LICENSE AUDIT:
The State is responsible for monitoring compliance with the terms and conditions of use for any licensed Software delivered pursuant to the Contract. The State agrees that, upon 45 Days prior written notice, Contractor or an independent third-party designated by Contractor, may audit the State's compliance with applicable license requirements. License audits requiring on-site presence at the State's facilities shall require the State's express written consent, which shall not be unreasonably withheld. Contractor agrees to limit such license audits to one audit per calendar year. The State, Contractor and/or independent third-party shall cooperate in good faith with such audit, which Contractor agrees will be confidential, and commercially reasonable in scope and duration. Each Party shall bear its own costs for such license audits (including the cost of any independent third parties).
The State shall have the opportunity to review the results of any license audit and, within 60 Days of receiving such results, shall notify Contractor of any disputed findings. Should the State dispute any findings, the Parties shall work in good faith to resolve the matter and, if the Parties are unable to resolve the matter after 30 Days, Contractor may initiate the dispute resolution process described in Section 17 (Dispute Resolution). If the State accepts the audit findings, within 60 Days of receiving such results the State shall order sufficient quantities of licenses at Contracted rate.
15.7 CLOUD COMPUTING SERVICES OVERAGE CHARGES:
15.7.1 Notification Requirement:
(a) Contractor shall promptly notify the State when the State's usage of Cloud Computing Services reaches the percentage of the allocated limit specified in the Contract. Such notification will include an estimate of potential Cloud Computing Services Overage Charges based on projected usage and recommendations for managing or reducing usage. Overages shall be billed at Contract Price.
(b) Upon the State's usage of Cloud Computing Services exceeding the maximum amount allocated within the Contract, Contractor shall promptly notify the State. Such notice shall include an estimate of the amount of usage of Cloud Computing Services in
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
excess of the maximum allocated amount specified in the Contract, as well as an estimate of the Cloud Computing Services Overage Charges based on the exceedance.
15.7.2 Review and Adjustment: The State shall have the opportunity to review the notification of any Cloud Computing Services Service Overage Charges and, within 60 Days of receiving such notification, shall notify Contractor of any disputed findings. Should the State dispute any of the findings included in the notice, the Parties shall work in good faith to resolve the matter and, if the Parties are unable to resolve the matter after 30 Days, Contractor may initiate the dispute resolution process described in Section 17 (Dispute Resolution). If the State accepts the notification, within 60 Days of receiving such notification, the Parties shall amend the Contract to account for the additional Cloud Computing Services usage.
15.7.3 Cap on Cloud Computing Services Overage Charges. The maximum amount of Cloud Computing Services Overage Charges that may be incurred by the State shall not exceed the amount specified in the Statement of Work.
15.7.4 If the Cloud Computing Services Overage Charges exceed the cap specified above, the State may issue a Stop Work order to prevent further charges until a resolution is reached.
SECTION 16. TERMINATION
16.1 TERMINATION FOR NON-APPROPRIATION OF FUNDS:
The State's obligation to proceed with the Contract is contingent on the appropriation of funds for such purpose by the California Legislature or, if applicable, the United States Congress.
The State will have the right to terminate the Contract without damage, penalty, cost, or further obligation in the event funding is not appropriated, and Contractor agrees to take back any affected Goods supplied under the Contract and terminate any Services or Cloud Computing Services supplied to the State under the Contract. The State and Contractor shall agree to take all reasonable steps to prioritize work and minimize the incurrence of costs prior to the expiration of funding for the Contract.
IF TERMINATION OCCURS UNDER THIS SECTION, THE STATE SHALL RETURN TO
CONTRACTOR COMMERCIAL HARDWARE AND SOFTWARE THAT HAS NOT BEEN PAID
FOR IN SUBSTANTIALLY THE SAME CONDITION IN WHICH DELIVERED TO THE STATE, SUBJECT TO NORMAL WEAR AND TEAR. THE STATE SHALL PAY FOR PACKING,
CRATING, AND TRANSPORTATION TO CONTRACTOR'S NEAREST FACILITY, AND SHALL
REIMBURSE CONTRACTOR FOR EXPENSES INCURRED FOR CONTRACTOR'S ASSISTANCE IN PACKING AND CRATING.
16.2 TERMINATION FOR CONVENIENCE:
The State may, terminate performance of work under this Contract for its convenience, in whole or in part, if DGS-PD's Deputy Director or Buyer, or as applicable, CDT's STP Deputy Director, or designee determines that termination is in the State's interest. If such a determination is made, the State shall provide Contractor a Notice of Termination (Termination Notice) specifying the extent of termination and the effective termination date (Termination Date) which shall be no less than 15 Days from the Termination Notice date.
16.2.1 Effect of Termination for Convenience. After receipt of a Termination Notice, and except as directed by the State, Contractor shall immediately proceed with the following
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
obligations, as applicable, regardless of any delay in determining or adjusting any amounts due under this section. Contractor shall: (a) stop work as specified in the Termination Notice; (b) place no further subcontracts for materials, services, or facilities, except as necessary to complete the continuing portion of the Contract; (c) terminate all subcontracts to the extent they relate to the work terminated; and (d) settle all outstanding liabilities and termination settlement proposals arising from the termination of subcontracts.
16.2.2 Termination Proposal. After termination, Contractor shall submit a final termination settlement proposal to the State in the form and with the information prescribed by the State.
Contractor shall submit the proposal promptly, but no later than 30 Days after the Termination Date, unless otherwise provided in the Termination Notice. Contractor and the State may agree upon the whole or any part of the amount to be paid pursuant to Subsection 16.2.3 below.
16.2.3 Payments in Event of Termination. Unless otherwise specified in the Statement of Work, if Contractor and the State fail to agree on the amount to be paid pursuant to termination under Section 16.2, the State will pay Contractor the following amounts (provided that in no event will total payments exceed the amount payable to Contractor if Contract had been fully performed):
(a) Contract price for Deliverables accepted, utilized or retained by the State and not previously paid for, adjusted for any savings on freight and other charges; and (b) the total of:
(i) The reasonable costs incurred in the performance of the work terminated, including initial costs and preparatory expenses allocable thereto, but excluding any cost attributable to Deliverables paid or to be paid; (ii) The reasonable cost of settling and paying termination settlement proposals under terminated subcontracts that are properly chargeable to the terminated portion of the Contract; and
(ili) Reasonable storage, transportation, demobilization, unamortized overhead and capital costs, and other costs reasonably incurred by Contractor in winding down and terminating its work.
Contractor will use generally accepted accounting principles, or accounting principles otherwise agreed to in writing by the Parties, and sound business practices in determining all costs claimed, agreed to, or determined under this Section.
16.3 TERMINATION FOR DEFAULT:
Subject to Section 20.3 (Force Majeure) and to Section 16.3.1 below, the State may, by written notice of default to Contractor, terminate the Contract, in whole or in part, if Contractor fails to:
(a) deliver or perform the Deliverables within the time specified in the Contract or any amendment; (b) make progress, so that the lack of progress endangers performance of the Contract; or (c) perform any provisions of the Contract.
The State's termination rights under this Section may be exercised only if the failure constitutes a material breach of the Contract and Contractor fails to cure such default within
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
the time stated in the cure notice, which in no event will be less 15 Days, unless otherwise specified in the Statement of Work.
16.3.1 Effect of Termination for Default. If the State terminates the Contract in whole or in part for default:
(a) it may acquire, under terms and in the manner it considers appropriate, Deliverables similar to those terminated, and Contractor will be liable to the State for any excess costs for those Deliverables, including without limitation, costs charged by third-party vendors for such Deliverables. However, Contractor shall continue the work not terminated.
(b). it may require Contractor to transfer title, or in the case of licensed Software, license, and deliver to the State, as directed by the Buyer, any: (i) completed Deliverables; (i) partially completed Deliverables; and (iii) subject to Section 16.3.2 below, any other Deliverables related to the terminated portion of the Contract.
Nothing in this Section will be construed to grant the State rights to Deliverables that it would not have received had the Contract been fully performed. Upon direction of the Buyer, Contractor shall also protect and preserve property in its possession in which the State has an interest.
16.3.2 Payments in the Event of Default. The State shall pay the Contract price for completed and accepted Deliverables, and items the State requires Contractor to transfer under Section 16.3.1 above, subject to the State's rights and remedies under the Contract.
Unless otherwise specified in the Statement of Work, Contractor and Buyer shall attempt to agree on the amount of payment for Deliverables accepted by the State for the protection and preservation of the property; provided that where Contractor has billed the State for any such materials no additional charge will apply. Failure to agree will constitute a dispute under Section 17 (Dispute Resolution). The State mayfrom these amounts any sum it determines to be necessary to protect the State against loss because of outstanding liens or claims of former lien holders.
If, after termination, it is determined by a final decision that Contractor was not in default, the rights and obligations of the Parties shall be the same as if the termination had been issued for the convenience of the State.
16.4 RIGHTS & REMEDIES OF STATE FOR DEFAULT:
Any loss or damage sustained by the State in procuring any items which Contractor agreed to supply shall be borne and paid for by Contractor, subject to Section 12 (Limitation of Liability).
The State reserves the right to offset the reasonable cost of all damages caused to the State against any outstanding invoices or amounts owed to Contractor or to make a claim against Contractor. Both Parties, upon any termination for default, have a duty to mitigate the damages suffered by it. The rights and remedies of the State in this Section are in addition to any other rights and legal or equitable remedies available under law, or provided under the Contract, subject to Section 12 (Limitation of Liability).
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
SECTION 17. DISPUTE RESOLUTION
17.1 DISPUTES BETWEEN BUYER AND CONTRACTOR DEPARTMENT CONTRACTS:
The Parties shall deal in good faith and attempt to resolve potential disputes informally. If the dispute persists, Contractor may submit to the Buyer's department director (Buyer's Director) or designee a written demand for a final decision regarding the disposition of any dispute between the Parties regarding the Contract. Contractor's written demand shall be fully supported by factual information, and if such demand involves a cost adjustment to the Contract, Contractor shall include with the demand a written statement signed by an authorized person indicating that the demand is made in good faith, that the supporting data are accurate and complete and that the amount requested accurately reflects the Contract adjustment for which Contractor believes the State is liable. The Buyer's Director or designee shall have 30 Days after receipt of Contractor's written demand invoking this Section to render a written decision. If a written decision is not rendered within 30 Days after receipt of Contractor's demand, it shall be deemed a decision adverse to Contractor's contention.
If Contractor is not satisfied with the decision of the Buyer's Director or designee, Contractor may appeal the decision, in writing, within 15 Days of its issuance (or the expiration of the 30 Day period if no decision is rendered by the Buyer's Director), to the DGS-PD Deputy Director, or the CDT Statewide Technology Procurement Deputy Director, as applicable, who shall have 30 Days to render a final decision. If Contractor does not appeal the decision of the Buyer's Director or designee, the decision shall be conclusive and binding and Contractor shall be barred from commencing an action in court, or with the Government Claims Program, for failure to exhaust Contractor's administrative remedies.
Pending the final resolution of any dispute regarding the Contract, Contractor agrees to diligently proceed with the performance of the Contract, in accordance with the State's instructions regarding the Contract, unless work is stopped pursuant to Section 18, or by mutual written agreement. Contractor's failure to diligently proceed in accordance with the State's instructions regarding the Contract shall be considered a material breach of the Contract.
If Contractor appeals, any final decision of the State shall be in writing, signed by the DGS-PD Deputy Director, or the CDT STP Deputy Director, as applicable, expressly identifying it as final. If the DGS-PD Deputy Director or the CDT STP Deputy Director fails to render a final decision within 30 Days after receipt of Contractor's appeal, it shall be deemed a final decision adverse to Contractor's contentions. The State's final decision shall be conclusive and binding unless Contractor files a claim with the Government Claims Board contesting such decision.
The dates to issue a final decision or final decision on an appeal, as applicable in this section may be modified by mutual consent of the Parties.
17.2 DISPUTES REGARDING CONTRACTS ISSUED BY DGS-PD:
For disputes involving Contracts with DGS-PD, Contractor shall submit to the DGS-PD Deputy Director or designee a written demand for a final decision, in the manner described in Section
17.1 above. The DGS-PD Deputy Director or designee shall have 30 Days to render a final
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
decision. If a final decision is not rendered within 30 Days after receipt of Contractor's demand, it shall be deemed a final decision adverse to Contractor's contention.
17.3 FINAL DECISION:
The final decision rendered under this Section 17 shall be conclusive and binding regarding the dispute unless Contractor seeks other administrative remedies. The dates of decision and appeal in this Section 17 may be modified by mutual written consent, as applicable, except for the time to commence a claim with the Government Claims Program.
SECTION 18. STOP WORK
18.1 STOP WORK:
The State may, at any time, by written Stop Work Order to Contractor, require Contractor to stop all, or any part, of the work called for by this Contract for a period up to 60 Days after the Stop Work Order is delivered to Contractor, and for any further period to which the Parties may agree. The Stop Work Order shall be specifically identified as such and shall indicate it is issued under this Section. Upon receipt of the Stop Work Order, Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the Stop Work Order during the period of work stoppage.
Within a period of 45 Days after a Stop Work Order is delivered to Contractor, or within any extension of that period to which the Parties shall have agreed, the State shall either: (a) cancel the Stop Work Order; or (b) terminate the work covered by the Stop Work Order as provided for in Section 16.2 (Termination for Convenience) or Section 16.3 (Termination for Default.
18.2 CANCELLATION/EXPIRATION OF STOP WORK ORDER:
If a Stop Work Order issued under this Section is canceled or the period of the Stop Work Order or any extension expires, Contractor shall resume work. The State shall make an equitable adjustment in the delivery schedule, Contract price, or both, and the Contract shall be modified, in writing, accordingly, if: (a) the Stop Work Order results in an increase in the time required for, or in Contractor's cost properly allocable to the performance of any part of the Contract; and (b) Contractor asserts its right to an equitable adjustment within 60 Days after the end of the period of work stoppage; provided, that if the State decides the facts justify the action, the State may receive and act upon a proposal submitted at any time before final payment under the Contract.
If a Stop Work Order is not canceled and the work covered by the Stop Work Order is terminated pursuant to Section 16.2 (Termination for Convenience), the State shall allow reasonable costs resulting from the Stop Work Order in arriving at the termination settlement.
The State shall not be liable to Contractor for loss of profits because of a Stop Work Order issued under this Section.
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
SECTION 19. SMALL BUSINESS (SB) PARTICIPATION & DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) PARTICIPATION REPORTING REQUIREMENTS:
THE FOLLOWING PROVISIONS ARE REQUIRED BY LAW AND CANNOT BE EDITED OR REMOVED FROM CONTRACT.
19.1 SMALL BUSINESS PARTICIPATION (SB):
If, for this Contract, Contractor made a commitment to achieve SB participation, then Buyer requires Contractor upon completion of this Contract (or within such other period as may be specified elsewhere in the Contract) to report the actual percentage of SB participation that was achieved. (Govt. Code, § 14841).
19.2 DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) PARTICIPATION:
19.2.1 If, for the Contract, Contractor made a commitment to achieve the DVBE participation goal, then, pursuant to Military & Veterans Code, section 999.5, subdivision (d), upon completion of the Contract, Buyer will require Contractor to certify using the Prime Contractor's Certification - DVBE Subcontracting Report (STD 817), all of the following:
(a) the total amount the Prime Contractor received under the Contract; (b) the name, address, Contract number and certification ID number of the DVBE(s) that participated in the performance of the Contract;
(c) the amount and percentage of work the Prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the Prime Contractor;
(d) that all payments under the Contract have been made to the DVBE(s); and (e) the actual percentage of DVBE participation that was achieved. (f) upon request, the Prime Contractor shall provide proof of payment to the DVBE(s) for the work.
Until Contractor complies with the certification requirements above, the State will withhold $10,000 from the final payment, or the full final payment if less than $10,000. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 Days but not more than 30 Days from the date of written notice, the Prime Contractor refuses to comply with the certification requirements, the State shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets. Code, § 999.7).
19.2.2 Contractor shall comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Military & Veterans Code, including, but not limited to, the requirements of Section 999.5, subdivision (d). (PCC, § 10230). A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code, § 999.5, subd. (d); Gov. Code, § 14841).
19.2.3 For purposes of this Section only, "Prime Contractor" means the same as Contractor as defined in the Contract.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
SECTION 20. GENERAL TERMS
20.1 INDEPENDENT CONTRACTOR:
Contractor, its officers, employees, and agents, in the performance of the Contract, shall act in an independent capacity and not as officers, employees or agents of the State.
20.2 NO PUBLICITY:
Unless otherwise specified in the Statement of Work, news releases, endorsements, advertising, social media content, and any other form of publicity pertaining to the Contract shall not be made without prior written approval of the Buyer's Department, DGS, or CDT, as applicable.
20.3 FORCE MAJEURE:
Except for defaults of subcontractors at any tier, and any Contractor responsibilities concerning disaster recovery and/or business continuity, Contractor shall not be liable for any excess costs if the failure to perform the Contract arises from causes beyond the control and without the fault or negligence of Contractor. Examples of such causes include but are not limited to: (a) acts of God or of the public enemy; and (b) acts of the federal or State government in either its sovereign or contractual capacity. If the failure to perform is caused by the default of a subcontractor at any tier, and if the cause of the default is beyond the control of both Contractor and subcontractor, and without the fault or negligence of either, Contractor shall not be liable for any excess costs for failure to perform.
20.4 NOTICE OF INSOLVENCY:
Contractor shall notify the State immediately in writing if Contractor files any federal bankruptcy action or state receivership action, or if any federal bankruptcy or state receivership action is commenced against Contractor, Contractor is adjudged bankrupt, or a receiver is appointed.
Should any such event occur, the State may, pursuant to Section 16.2 (Termination for Convenience), terminate the Contract.
20.5 COMPLETE INTEGRATION:
The Contract, including any documents incorporated by reference, is intended to be a complete integration, and there are no prior or contemporaneous different or additional agreements pertaining to the subject matter of the Contract. No oral understanding or contract not incorporated in the Contract is binding on any of the Parties.
20.6 ASSIGNMENT:
Contractor shall not assign the Contract, in whole or in part, without the written consent of the State, which consent shall not be unreasonably withheld or delayed. The State will not unreasonably prohibit Contractor from freely assigning its right to payment, provided that Contractor remains responsible for its contractual obligations.
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
20.7 NO WAIVER; REMEDIES CUMULATIVE:
The failure of the State to enforce any provision or exercise rights under the Contract, shall not be construed to be a waiver by the State of its rights to enforce that provision or exercise that right in the future. Except as specifically set forth in Section 8 (Warranties & Representations), all rights and remedies of the State herein are cumulative and are in addition all other available rights or legal or equitable remedies.
20.8 AMENDMENT:
No amendment or modification of the terms of the Contract shall be valid unless made in writing, signed by the Parties, and approved as required. Notwithstanding the foregoing, with regard to Cloud Computing Services only, service agreements may be modified by Service Provider from time to time without the necessity of amending the Contract so long as any such modification does not degrade the functionality or security features of the Cloud Computing Services, pose unacceptable level of risk to the State, or amend or modify any clauses of the GSPD - ITGP (Cloud), SOW or any other exhibits. Service agreements shall be subject to Section 3 (Order of Precedence). In the event of the conflict between the terms of the Contract including the Service Agreement, and any subsequently modified online terms, the Contract shall take precedence pursuant to Section 3 (Order of Precedence).
20.9 SEVERABILITY:
If any provision of the Contract is unenforceable, invalid, or conflicts with applicable law by a court of competent jurisdiction then such term or provision shall be deemed stricken, without the need for a formal amendment and the remainder of the Contract shall remain in full force and effect. Either Party having knowledge of such term or provision shall promptly inform the other of the presumed non-applicability of such provision.
20.10 APPLICABLE LAW; JURISDICTION & VENUE:
The Contract shall be governed by the laws of the State of California, exclusive of any choice of law rules. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Contract. Any action regarding this Contract shall be subject to the exclusive jurisdiction and venue of the state and federal courts in the City and County of Sacramento, California.
20.11 SURVIVAL:
Upon expiration or termination of the Contract, this Section and the following provisions will survive: Section 13.1 (Compliance with Statutes & Regulations), Section 8 (Warranties & Representations), Section 9 (Rights in Work Product & Government Purpose Rights), Section 10 (Confidentiality; Data Rights), Section 11 (Indemnification), Section 12 (Limitation of Liability), Section 15.5 (Examination & Audit), and Section 21.12 (Transition Period). Further, any other Contract term that expressly states or by its nature should survive, shall survive.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
SECTION 21. DATA PROTECTION PROVISIONS
21.1 ACCESS TO STATE SYSTEMS:
In the course of providing the Deliverables, Contractor may gain access to State Data and State's Systems and electronic communications networks, including but not limited to, voicemail, email, databases, and internet/intranet systems. Access to such State Data and State's Systems is intended for legitimate business use related to the fulfillment of the Contract. Contractor acknowledges it has no expectation of privacy regarding the use of the State's Systems and that all use of, or access to, the State's Systems made by or on behalf of Contractor is subject to State scrutiny and oversight at all times during the term of the Contract.
21.2 COMPLIANCE WITH DATA PROTECTION LAWS, POLICIES & REGULATIONS:
21.2.1 Subject to Section 21.3 below but notwithstanding anything to the contrary in the Contract, Contractor shall comply with the data protection laws, regulations, and policies relating to the collection, maintenance, transmission, use, receipt, storage, disclosure, retention, destruction, unavailability, security, or other use or processing of State Data in connection with Contractor's provision of Deliverables under the Contract, including but not limited to, and to the extent applicable
(a) the California Information Practices Act (Civil Code § 1798 et seq.), (b) Federal Privacy Act of 1974,
(C) Health Insurance Portability and Accountability Act of 1996, (d) IRS 1075 regulations,
(e) Health Information Technology for Economic and Clinical (HITECH) Act, (f) Criminal Justice Information Services (CJIS) Security Policy, (g) Social Security Administration (SSA) Electronic Information Exchange Security Requirements,
(h) Payment Card Industry (PCI) Data Security Standard (DSS), (i) NIST Special Publications,
California State Administrative Manual (SAM) (Chapters 4983, 5100, 5300), and (k) California Statewide Information Management Manual (SIMM) Sections 5305A, 5310A and B, 5315-B, 5325A and B, 5340 A and C, and 5360B.
21.2.2 Contractor shall not take, or fail to take, any action that would put the State in violation of such data protection laws, policies, and regulations.
21.3 DATA CLASSIFICATION STANDARDS & SECURITY CONTROLS:
21.3.1 Unless otherwise specified in the Statement of Work, security requirements designated in these GSPD - ITGP (Cloud) are assuming a National Institute of Standards and Technology (NIST) MODERATE classification. For a higher or lower data classification standard, State shall:
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(a) Classify their data pursuant to the State Administrative Manual (SAM) 5305.5; and (b) Obtain approval from the State Chief Information Security Officer (CISO) or User's CISO prior to modifying this Section of the GSPD - ITGP (Cloud) through the SOW to meet the needs of the Contract.
21.3.2 Contractor shall comply with the current version of the NIST Special Publication (SP) 800-53 Security and Privacy Controls for Systems and Organizations.
21.3.3 Controls shall be applied at the MODERATE level.
21.3.4 Subject to the prior written approval of the State CISO or designee, Contractor may submit a current ISO 27001 certification in satisfaction of the foregoing requirements of this subsection. Responsibility to obtain CISO approval lies with the State.
21.3.5 Contractor shall comply with NIST 800-171, if applicable, and shall implement and maintain a system security plan with respect to any System that Contractor has assisted the State to implement and any of Contractor's systems that in any way interact with the State's System or State Data. Contractor shall ensure such plan is reviewed annually.
21.4 DATA SAFEGUARDS:
Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards in accordance with applicable laws, policies, and regulations at all times during the Contract term, to secure State Data from Data Breach, and protect State Data and Systems, Services, Cloud Computing Services and components thereof, from unauthorized or unlawful use, access, modification, disclosure or destruction, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the State's access.
21.5 ENCRYPTION:
End-to-end encryption shall be implemented for all Personal Information and Non-Public Data that is transmitted, stored, or accessed both inside and outside the secure internal network, including Contractor's servers. The Statement of Work or Service Level Agreement will specify which Party is responsible for encryption and access control of the State Data under the Contract. If the Statement of Work or Service Level Agreement are silent, then the State is responsible for encryption and access control. All Non-Public or Personal Information must be encrypted at rest and in transit with validated cryptography standards as referenced in FIPS 140-3 (or higher).
21.6 FEDERAL TAX INFORMATION:
The Parties acknowledge that information transmitted by the State to Contractor or Service Provider may inadvertently contain Federal Tax Information (FTI). The State will use all reasonable efforts to prevent the transmittal of FTI to Contractor or Service Provider under the Contract. The State further acknowledges that Contractor or Service Provider does not require any "access" to, or "receipt" or "storage" of FTI to perform the Cloud Computing Services under the Contract. Contractor or Service Provider further acknowledge that Contractor or Service Provider shall not knowingly access or permit access to such FTI, unless directed by the State.
Access to FTI is out-of-scope of the Cloud Computing Services.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
To the extent that Contractor's or Service Provider's access to FTI is "incidental" to Contractor's provision of Cloud Computing Services, it is the Parties' view that such incidental exposure should not legally subject Contractor or Service Provider to the Internal Revenue Service (IRS) requirements set forth in IRS Publication 1075, section 11.2. However, if the IRS ultimately takes a contrary position, and determines that Contractor, Service Provider or the State should have nevertheless complied with the requirements of IRS Publication 1075, the Parties will immediately evaluate the feasibility of continued performance under the Contract.
21.7 CLOUD COMPUTING SERVICE AVAILABILITY:
The minimum standards for Cloud Computing Services Availability shall be as set forth herein.
Nothing herein precludes the State from specifying a higher standard for Cloud Computing Services Availability in the Statement of Work. Requests for a lower Cloud Computing Services Availability standard shall require the written approval of the State CISO prior to Contract execution. Responsibility to obtain CISO approval lies with the State. (a) The Cloud Computing Services shall be available 24 hours per Day, 365 Days per year, excluding agreed-upon maintenance downtime (Cloud Computing Service Availability). (b) If the monthly Cloud Computing Service Availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to recover damages, apply credits, or use other contractual remedies as set forth in the Statement of Work.
(c) If the monthly Cloud Computing Service Availability averages less than 99.9% (excluding agreed-upon maintenance downtime) for 3 or more months in a rolling 12- month period, the State may terminate the Contract for material breach in accordance with Section 16.3 (Termination for Default).
(d) Contractor shall provide advance written notice to the State in the manner set forth in the Statement of Work of any major upgrades or changes that will affect Cloud Computing Services Availability.
21.8 DATA AVAILABILITY:
The minimum standards for State Data Availability shall be as set forth herein. Nothing herein prevents the State from specifying a higher standard for Data Availability in the Statement of Work. Requests for a lower Data Availability standard shall require the written approval of the State CISO prior to Contract execution. Responsibility to obtain CISO approval lies with the State.
(a) State Data shall be available 24 hours per Day, 365 Days per year, excluding agreed- upon maintenance downtime (Data Availability).
(b) If the monthly Data Availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to recover damages, apply credits, or use other contractual remedies as set forth in the Statement of Work if the State is unable to access the State Data as a result of:
(i) Acts or omissions of Contractor;
(i) Acts or omissions of third parties working on behalf of Contractor;
GSPD-ITGP (Cloud) (Revised and Effective 11/12/24)
(iii) Network compromise, network intrusion, hacks, introduction of viruses, disabling devices, malware and other forms of attack that can disrupt access to Contractor's server, to the extent such attack would have been prevented by Contractor taking reasonable industry standard precautions; or (iv) Power outages or other telecommunications or Internet failures, to the extent such outages were within Contractor's direct or express control. (c) If the monthly Data Availability averages less than 99.9% (excluding agreed-upon maintenance downtime) for 3 or more months in a rolling 12-month period, the State may terminate the Contract for material breach in accordance with Section 16.3 (Termination for Default).
21.9 DATA LOCATION & ACCESS:
21.9.1 Data Center Location in U.S. The physical location of Contractor's data center where State Data is stored shall be within the continental United States, unless otherwise specified in the Statement of Work and approved in advance in writing by the State CISO. Responsibility to obtain CISO approval lies with the State.
21.9.2 Data Access. Contractor shall not allow its personnel or subcontractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its data centers located in the continental United States. Remote access to State Data from outside the continental United States, including remote access to State Data by authorized Services support staff in identified support centers, is prohibited unless approved in advance in writing by the State CISO. Responsibility to obtain CISO approval lies with the State.
21.10 SECURITY INCIDENT:
Upon identification of a Security Incident affecting the Contract or State Data, Contractor shall immediately provide information directly related to the Security Incident including Indicators of Compromise (IOC) to enable the State to complete a timely and cooperative investigation.
21.11 DATA BREACH:
21.11.1 Unless otherwise specified in the Statement of Work, upon discovery or reasonable belief of any Data Breach, Contractor shall notify the State by the fastest means available, as well as in writing, with additional notification provided to the State CISO, or designee of the Contracting agency. Contractor shall provide such notification immediately after Contractor reasonably believes there has been such a Data Breach, in no event greater than 48-hours after such determination.
21.11.2 Contractor's notification shall identify, to the full extent known to Contractor:
(a) The nature of the Data Breach;
(b) The State Data improperly accessed, used, or disclosed; (c) The number of individual records improperly accessed, used, or disclosed if Personal Information is involved;
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(d) The person(s) who improperly accessed, used, disclosed or received State Data; (e) What Contractor has done or will do to quarantine and remediate the Data Breach; and What corrective action(s) Contractor has taken or will take to prevent future Data Breaches.
21.11.3 Contractor will provide daily updates, or more frequently as required by the State, regarding findings and actions performed by Contractor until the Data Breach has been effectively resolved to the State's satisfaction.
21.11.4 Contractor shall contain and mitigate the Data Breach and ensure secure access to State Data in accordance with the service level agreement set forth in the Statement of Work, if applicable.
21.11.5 If Contractor experiences a Data Breach, the State's CISO or designee, shall determine whether notification to any individuals whose State Data has been improperly accessed, lost or breached is appropriate. If Personal Information is reasonably believed to have been improperly accessed or acquired by an unauthorized person as a result of a Data Breach that is not due to the fault of the State or any person or entity under the control of the State, Contractor shall bear any and all costs associated with the State's notification obligations and other obligations set forth in Civil Code section 1798.29, subdivision (d), as well as the cost of credit monitoring, subject to the dollar limitation, if any, agreed to by the State and Contractor in the Statement of Work. These costs may include, but are not limited to staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach of the security of such Personal Information.
21.11.6 Contractor shall investigate the Data Breach and shall share the investigation report with the State. The State or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the State, its agents, and law enforcement.
21.11.7 Contractor shall promptly refer to the State any inquiries received by Contractor regarding Contractor's information security or privacy practices relating to the State Data.
21.12 TRANSITION PERIOD:
Unless otherwise specified in the Statement of Work, for 90 Days prior to the expiration date of the Contract, or upon notice of termination of the Contract and for 90 Days thereafter, Contractor shall assist the State in extracting or transitioning all State Data in the format determined by the State (Transition Period).
During the Transition Period, System, Services, and State Data access shall continue to be made available to the State without alteration. The State, at its option, may purchase additional transition Services as specified in the Statement of Work.
Unless otherwise specified in the Statement of Work, Contractor shall permanently destroy or render inaccessible any portion of State Data in the possession or control of Contractor (including the possession or control of Contractor's agents, affiliates, and subcontractors) following the expiration of all obligations in this section. Within 30 Days, Contractor shall issue a written statement to the State confirming the destruction or inaccessibility of State Data.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
Contractor shall compensate the State for damages or losses the State incurs as a result of Contractor's failure to comply with this Section subject to any applicable limitation of liability.
21.13 DISASTER RECOVERY & BUSINESS CONTINUITY:
21.13.1 Disaster Recovery Plan. Unless otherwise provided in the Statement of Work, Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of electronic data in the event of an emergency.
Emergency means any circumstance or situation that causes normal system operations to become unavailable for use in performing the work required under the Contract for more than 24 hours. Contractor shall make the disaster recovery plan available to the State upon request.
21.13.2 Data Backup Plan. Unless otherwise provided in the Statement of Work, Contractor must have established documented procedures to securely backup the System to maintain retrievable exact copies of all data. The backups shall be encrypted in accordance with section 21.5 (Encryption). The plan must include a regular system backup schedule for making backups, storing backups offsite, an inventory of backup media, and the amount of time to restore should it be lost. At a minimum, full onsite data backup must be performed weekly. Full offsite storage of backup data must be performed monthly.
21.13.3 Notification & Recovery. In the event of disaster or catastrophic failure that results in loss of State Data or extended loss of access to State Data, unless otherwise specified in the Statement of Work, Contractor shall notify the State by the fastest means available and also in writing, with additional notification provided to the State CISO or designee of contracting agency. Contractor shall provide such notification within 24 hours after Contractor reasonably believes there has been such a disaster or catastrophic failure. In the notification, Contactor shall inform the State of:
(a) The scale and quantity of the State Data loss;
(b) What Contractor has done or will do to recover State Data and mitigate the effect of the State Data loss; and
(c) Corrective action(s) Contractor has taken or will take to prevent future State Data loss.
If Contractor fails to respond immediately and remedy the failure, the State may exercise its options for assessing damages or other remedies under the Contract.
21.13.4 Contractor shall repair and restore continuity of the System, Services, or data, in accordance with the RPO and RTO, as needed to meet the performance requirements stated in the Service Level Agreement, if applicable. Failure to do so may result in the State exercising its options for assessing damages or other remedies under the Contract.
21.14 INSPECTION & AUDIT OF CONTRACTOR'S SYSTEMS:
21.14.1 Inspection & Audit. Upon advance written request, Contractor agrees that the State or its designated representative shall have access to Contractor's system, data, operational documentation, records, and databases, including online inspections, that relate to the System, Service, or data purchased by the State under the Contract. The online inspection shall allow the State, its authorized agents, or a mutually acceptable third-party, to test that
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
controls are in place and working as intended. Tests may include, but not be limited to, the following:
(a) Operating system/network vulnerability scans;
(b) Web application vulnerability scans;
(c) Database application vulnerability scans; and
(d) Any other scans to be performed by the State or its authorized representatives.
Upon written request, Contractor shall provide the results of any independent tests performed by Contractor including the results of any penetration testing. The State shall maintain the confidentiality of any information provided by Contractor pursuant to this Section.
21.14.2 Remediation. Contractor shall remediate vulnerabilities and correct flaws identified through testing and assessments within the State's designated time periods, or a mutually agreed upon time period with Contractor. Contractor will notify the State once corrections and remediation have been completed. Contractor shall implement security, policies, procedures, and practices to protect State Data as required by the Contract.
21.14.3 Post-Breach/Disaster Audit. After any Data Breach or after any disaster or catastrophic failure that results in a loss of State Data, Contractor shall, at its expense, have an independent, industry-recognized, State-approved third-party perform an information security audit. State approval of the auditor will not be unreasonably withheld. The audit results shall be shared with the State within 7 Days of Contractor's receipt of such results. Within 30 Days of receiving the results of the audit, Contractor will provide the State with written evidence of planned remediation and promptly modify its security measures to meet its obligations under the Contract.
21.15 DATA CENTER AUDIT:
Unless otherwise provided in the Statement of Work, for all Contracts requiring NIST SP 800- 53 MODERATE or higher-level Security and Privacy Controls for Systems and Organizations, Contractor shall undergo an annual Statement on Standards for Attestation Engagements (SSAE) No. 18 Service Organization Control (SOC) 2 Type II audit (or successor), at its own expense, of: (1) its data centers, and (2) Cloud Computing Services that in any way interact with the State's System or Non-Public Data. Contractor shall provide a redacted version of audit reports and Contractor's plan to correct any negative findings upon request. Contractor may remove its proprietary information from the redacted version.
21.16 ACCESS TO SECURITY LOGS AND REPORTS:
Unless otherwise provided in the Statement of Work:
(a) (For laaS Only) Upon request, Contractor shall provide reports to the State directly related to the infrastructure Contractor controls upon which the State account resides.
Contractor shall provide the State a history of all Application Program Interface (API) calls for the State account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by Contractor. The report will be sufficient to enable the State to perform security analysis, resource change tracking and compliance auditing.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
(b) (For PaaS Only) Upon request, Contractor shall provide reports to the State in a format as specified in the Statement of Work or Service Level Agreement and agreed to by both Contractor and the State. Reports will include latency statistics, User access, User access IP address, User access history, and security logs for all State files related to Contract.
(C) Contractor shall maintain a software bill of materials that includes, at a minimum, the details and supply chain relationships of the components used in the Software or Services. Contractor shall provide a copy of the software bill of materials to the State upon request.
(d) Contractor shall maintain a U.S. Cybersecurity & Infrastructure Security Agency Secure Software Development Attestation Form, or equivalent attestation, and provide a copy of the attestation to the State upon request. The attestation shall state, at a minimum, that:
(i) The Software will be developed and built in secure environments that are secured by, at a minimum; separating and protecting each environment involved in developing and building the Software; regularly logging, monitoring, and auditing trust relationships used for authorization and access to any Software development and build environments, as well as among components within each environment; enforcing multi-factor authentication and conditional access across the environments relevant to developing and building the Software in a manner that minimizes security risk; taking consistent and reasonable steps to document, as well as minimize use or inclusion of software products that create undue risk within the environments used to develop and build the Software; encrypting sensitive data, such as credentials, to the extent practicable and based on risk; implementing defensive cybersecurity practices, including continuous monitoring of operations and alerts and, as necessary, responding to suspected and confirmed cyber incidents;
(ii) Contractor will make good-faith efforts to maintain trusted source code supply chains by employing automated tools or comparable processes to address the security of internal code and third-party components and manage related vulnerabilities.
(iii) Contractor will maintain provenance for internal code and third-party components incorporated into the Software to the greatest extent feasible. (iv) Contractor will employ automated tools or comparable processes that check for security vulnerabilities; Contractor operates these processes on an ongoing basis and prior to product, version, or update releases; Contractor has a policy or process to address discovered security vulnerabilities prior to product release; and Contractor operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed Software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies.
(v) Contractor and the State recognize that security responsibilities are shared.
Contractor is responsible for providing a secure infrastructure, as applicable.
GSPD-ITGP(Cloud) (Revised and Effective 11/12/24)
Specific shared responsibilities are identified within the Statement of Work or Service Level Agreement.
21.17 BACKGROUND CHECKS:
Unless otherwise provided in the Statement of Work, and as permitted or required by law, Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty.
Contractor shall promote and maintain an awareness of the importance of securing the State's Data among Contractor's employees and agents.
21.18 SYSTEM SECURITY CONTROLS:
21.18.1 Patch Management. Unless otherwise provided in the Statement of Work, all of Contractor's workstations, laptops, and other systems that process or store State Data must have operating system and application security patches applied, with system reboot if necessary. Contractor shall maintain a documented patch management process which determines installation timeframe based on risk assessment. At a minimum, emergency (vulnerability and active exploit) patches must be applied immediately, while critical (vulnerability and no exploit known) patches must be applied within 30 Days of release. All other applicable patches must be installed within 90 Days of release.
21.18.2 Endpoint Protection Standard. All Contractor workstations, laptops, and other systems used to process or store State Data must install and actively use a comprehensive endpoint protection solution that will at minimum comply with SIMM 5335-A.