STATE OF MICHIGAN CENTRAL PROCUREMENT SERVICES …Oct 01, 2016 · MI Department of Corrections FY20 Services: Payment Milestone Definition ... 3.1 Consultation Session 1 Complete

STATE OF MICHIGANCENTRAL PROCUREMENT SERVICESDepartment of Technology, Management, and Budget525 W. ALLEGAN ST., LANSING, MICHIGAN 48913P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICEChange Notice Number 3

to071B7700014Contract Number

[email protected]

Mike Keck

Sean Regan

[email protected]

Becky Kelderhouse

Canton, OH 44718

NORTHPOINTE, INC.

CV0067099

231-714-0166

4825 Higbee Avenue NW , Suite 101

(517) 243-8459STATE

Pro

gra

m

Manager

Contra

ct

Adm

inistra

tor

CO

NTRACTO

R

MDOC

517-334-9426

DTMB

[email protected]

$3,000,000.00

October 1, 2016 September 30, 2020

LICENSING, MAINTENANCE & SUPPORT FOR THE CORRECTIONS

September 30, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE BEFORE

7 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☐ Yes ☒ NoMINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICEOPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☒ 1 Year ☐ September 30, 2020CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,028,978.00 $4,028,978.00

Effective August 22, 2019, this contract is exercising the first option year and is increased by $1,028,978.00. The revised expiration date is September 30, 2020.The Michigan Department of Corrections is revising Schedule I - Services Fees to the updated table below and also amending Schedule G by adding the module, 9. DES Broker, at no cost to the State for the remainder of the Contract. All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement and DTMB procurement approval, and State Administrative approval on September 12, 2019.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

DESCRIPTION

CONTRACT SUMMARY

Schedule I - Service Fees The prices charged for Services purchased under this Agreement will be capped by the Contract rates for such services. All Services for the State will be defined per annual Delivery Order term based on the Delivery Order Statement of Work (SOW) and presented as firm fixed fee costs. All invoices for services delivered will be issued based upon the pre-defined milestones agreed to in the DO SOW. Upon completion of each milestone, Contractor will issue an invoice in the amount assigned for the completed milestone. Invoices will be sent to the State per Contractor’s monthly billing cycle. Note that multiple milestones may be billed in one billing cycle. MI Department of Corrections FY20 Services: Payment Milestone Definition Milestone Description Amount*

1.0 Annual Hosting Fee: OCC Prod/Test Sites $ 20,085.00 2.1 Status Report - October $ 5,440.00 2.2 Status Report - November $ 5,440.00 2.3 Status Report - December $ 5,440.00 2.4 Status Report - January $ 5,440.00 2.5 Status Report - February $ 5,440.00 2.6 Status Report - March $ 5,440.00 2.7 Status Report - April $ 5,440.00 2.8 Status Report - May $ 5,440.00 2.9 Status Report - June $ 5,440.00

2.10 Status Report - July $ 5,440.00 2.11 Status Report - August $ 5,440.00 2.12 Status Report - September $ 5,440.00 3.1 Consultation Session 1 Complete $ 2,625.00 3.2 Consultation Session 2 Complete $ 2,625.00 3.3 Consultation Session 3 Complete $ 2,625.00 3.4 Consultation Session 4 Complete $ 2,625.00 4.1 COMS Demographic Interface Launch $ 5,000.00 4.2 COMS Demographic Interface System Test Launch $ 8,700.00 4.3 COMS Demographic Interface Delivered in Test Site $ 5,000.00 5.1 Gen Enhancements Development Launch $ 10,566.75 5.2 Gen Enhancements Development Complete $ 24,655.75 5.3 Gen Enhancements UAT Launch $ 10,566.75 5.4 Gen Enhancements completed and successfully

tested in the Test site $ 24,655.75

6.1 Training Session 1 (Topic TBD, 1 day max) $ 2,525.00 6.2 Training Session 2 (Topic TBD, 1 day max) $ 2,525.00 6.3 Training Session 3 (Topic TBD, 1 day max) $ 2,525.00 6.4 Training Session 4 (Topic TBD, 1 day max) $ 2,525.00 6.5 Training Session 5 (Topic TBD, 1 day max) $ 2,525.00 6.6 Training Session 6 (Topic TBD, 1 day max) $ 2,525.00 6.7 Training Session 7 (Topic TBD, 1 day max) $ 2,525.00

6.8 Training Session 8 (Topic TBD, 1 day max) $ 2,525.00 7.1 Core Probation Outcomes & Calibration Study $ 17,750.00 7.2 Women’s Core Probation Outcomes & Calibration

Study $ 17,750.00

TOTAL $ 240,710.00

*Milestones will be billed upon completion.

STATE OF MICHIGANCENTRAL PROCUREMENT SERVICESDepartment of Technology, Management, and Budget525 W. ALLEGAN ST., LANSING, MICHIGAN 48913P.O. BOX 30026 LANSING, MICHIGAN 48909



[email protected]

Mike Keck

Sean Regan

[email protected]

Becky Kelderhouse

Canton, OH 44718

Northpointe, Inc.

CV0067099

231-714-0166

4825 Higbee Avenue NW

(517) 243-8459STATE

Pro

gra

m

Manager

Contra

ct

Adm

inistra

tor

CO

NTRACTO

R

MDOC

517-334-9426

DTMB

[email protected]

$3,000,000.00


LICENSING, MAINTENANCE & SUPPORT FOR THE CORRECTIONAL OFFENDER MANAGEMENT PROFILING FOR ALTERNATIVE SANCTIONS (COMPAS) SUITE - MDOC

September 30, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE BEFORE

7 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME


☐ P-Card ☐ Direct Voucher (DV) ☐ Other ☐ Yes ☒ NoMINIMUM DELIVERY REQUIREMENTS


☐ ☐ September 30, 2019CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $3,000,000.00

Effective October 1st, 2018, the Michigan Department of Corrections is revising Schedule I - Services Fees to the updated table below. Please note the contract administrator has been updated to Sean Regan. All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement and DTMB procurement approval.


DESCRIPTION

CONTRACT SUMMARY

MI Department of Corrections FY19 Services: Payment Milestone Definition

Milestone Description Amount 1.0 Annual Hosting Fee: OCC Prod/Test Sites $ 20,085.00 2.1 Status Report - October $ 5,440.00 2.2 Status Report - November $ 5,440.00 2.3 Status Report - December $ 5,440.00 2.4 Status Report - January $ 5,440.00 2.5 Status Report - February $ 5,440.00 2.6 Status Report - March $ 5,440.00 2.7 Status Report - April $ 5,440.00 2.8 Status Report - May $ 5,440.00 2.9 Status Report - June $ 5,440.00

2.10 Status Report - July $ 5,440.00 2.11 Status Report - August $ 5,440.00 2.12 Status Report - September $ 5,440.00 3.1 Consultation Session 1 Complete $ 2,625.00 3.2 Consultation Session 2 Complete $ 2,625.00 3.3 Consultation Session 3 Complete $ 2,625.00 3.4 Consultation Session 4 Complete $ 2,625.00 4.1 OMNI Demographic Interface Launch $ 5,000.00 4.2 OMNI Demographic Interface System Test Launch $ 8,700.00 4.3 OMNI Demographic Interface Delivered in Test Site $ 5,000.00 5.1 Gen Enhancements Development Launch $ 4,422.75 5.2 Gen Enhancements Development Complete $ 10,319.75 5.3 Gen Enhancements UAT Launch $ 4,422.75 5.4 Gen Enhancements Delivered in Test Site $ 10,319.75 6.1 Training Session 1 (Topic TBD, 1 day max) $ 2,525.00 6.2 Training Session 2 (Topic TBD, 1 day max) $ 2,525.00 6.3 Training Session 3 (Topic TBD, 1 day max) $ 2,525.00 6.4 Training Session 4 (Topic TBD, 1 day max) $ 2,525.00 6.5 Training Session 5 (Topic TBD, 1 day max) $ 2,525.00 6.6 Training Session 6 (Topic TBD, 1 day max) $ 2,525.00 6.7 Training Session 7 (Topic TBD, 1 day max) $ 2,525.00

6.8 Training Session 8 (Topic TBD, 1 day max) $ 2,525.00 6.9 Training Session 9 (Topic TBD, 1-day max) $ 2,525.00

6.10 Training Session 10 (Topic TBD, 1-day max) $ 2,525.00 7.1 Core Probation Outcomes & Calibration Study $ 17,750.00 7.2 Reentry Risk Outcomes & Calibration Study $ 17,750.00 7.3 Women’s Core Probation Outcomes & Calibration Study $ 17,750.00 7.4 Women’s Reentry Risk Outcomes & Calibration Study $ 17,750.00

TOTAL $ 240,300.00

**Milestones will be billed upon completion. Development work milestones split into 15/35/15/35 per state request.

STATE OF MICHIGANENTERPRISE PROCUREMENTDepartment of Technology, Management, and Budget525 W. ALLEGAN ST., LANSING, MICHIGAN 48913P.O. BOX 30026 LANSING, MICHIGAN 48909



$3,000,000.00


LICENSING, MAINTENANCE & SUPPORT FOR THE CORRECTIONAL OFFENDER MANAGEMENT PROFILING FOR ALTERNATIVE SANCTIONS (COMPAS) SUITE - MDOC

September 30, 2019

INITIAL AVAILABLE OPTIONS EXPIRATION DATE BEFORE CHANGE(S) NOTED BELOW

7 - 1 YearPAYMENT TERMS DELIVERY TIMEFRAME


☐ P-Card ☐ Direct Voucher (DV) ☐ Other ☐ Yes ☒ NoMINIMUM DELIVERY REQUIREMENTS


☐ NA ☐ NA September 30, 2019CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$0.00 $3,000,000.00

DESCRIPTION:

Effective immediately, Schedule A, Section 1.202 State Staff, Roles, and Responsibilities, C., 4. Is hereby updated replacing a Contract Manager with Contract Monitor:

b. Contract Monitor. The Contract Monitor will work with the State and Contractor Program Managers if performance concerns are identified. The Contract Monitor will review, document, and assess Contractor performance to this agreement:

State:Christopher Balmes206 E. Michigan Ave. – 5th Floor Grandview PlazaLansing, MI [email protected]

[email protected]

Mike Keck

James Topping

[email protected]

Becky Kelderhouse

Canton, OH 44718

Northpointe, Inc.

*******5507

231-714-0166

4825 Higbee Avenue NW

(517) 284-7000

STATE

Pro

gra

m

Manager

Contra

ct

Adm

inistra

tor

CO

NTRACTO

R

MDOC

517-334-9426


DTMB

DESCRIPTION

[email protected]

CONTRACT SUMMARY

(517) 290-2935

Effective October 1, 2017, this Schedule E is updated. Please see separately attached Schedule E.

Effective October 1, 2017, this Schedule I – Services fees is updated for the period October 1, 2017 – September 30, 2018. Please see separately attached Schedule I.

Schedule E

Agency/Vendor: Equivant (Northpointe) Contract #: 071B7700014

Effective Date: 10/01/17

Metric 1: Technical Report

Definition and Purpose

The Contractor will check the calibration of the Reentry VFO Risk and Non-VFO Risk scales, including tests in new data, in accordance with contract standard 1.104 Work and Deliverables Subsection A. Service Categories, e. Research.

Data Source:

Technical Report – Study results and recommendations will be drafted and delivered by Contractor via brief (1-3 pages) electronic technical report.

Methodology:

The Michigan Department of Corrections (MDOC) will review the submission of the Technical Report to ensure compliance with contract requirements.

Acceptable Standard:

The Technical Report must be submitted to the MDOC within thirty business days of request.

Service Level Credit

A $2,000 credit to the State will be assessed for each occurrence that fails to meet the Acceptable Standard. For any credit that is assessed, it will be deducted from a subsequent invoiced payment.

Metric 2: Monthly Project Status Reports


Monthly Project Status Reports are required to ensure that projects are being delivered in accordance with contract standard 1.302 Reports, subsection 1.

Data Source:

Monthly Project Status Reports.

Methodology:

The MDOC will review the submission of the Monthly Project Status Reports to ensure timeliness and compliance.


The Monthly Project Status Reports must be submitted to the MDOC monthly within twenty (20) calendar days at the end of each month.


A $200 credit to the State will be assessed for each occurrence that fails to meet the Acceptable Standard. For any credit that is assessed, it will be deducted from a subsequent invoiced payment

Metric 3: LEIN


The contractor will provide the Law Enforcement Information Network (LEIN) Information Form to the MDOC in

accordance with contract standard A Statement of Work, Section 1.201 Contractor Staff, Roles, and Responsibilities, B. On

Site Work Requirements, 4. Additional Security and Background Check Requirements.

Data Source:

Equivant (Northpointe) Staff Listing

Methodology:

The MDOC will review the submission of the LEIN Form to ensure timeliness and compliance with contract requirements.


All contracted employees must be LEIN cleared by the MDOC prior to commencement of any work for or with MDOC

offenders and yearly thereafter. Each employee that fails to meet this standard is considered to be an occurrence.


A $500 credit to the State will be assessed for each occurrence that fails to meet the Acceptable Standard. For any credit

that is assessed, it will be deducted from a subsequent invoiced payment.

Schedule I - Service Fees

The prices charged for Services purchased under this Agreement will be capped by the Contract rates for such services. All Services for the State will be defined per annual PO term based on the PO Statement of Work (SOW) and presented as firm fixed fee costs.

All invoices for services delivered will be issued based upon the pre-defined milestones agreed to in the PO SOW. Upon completion of each milestone, Contractor will issue an invoice in the amount assigned for the completed milestone. Invoices will be sent to the State per Contractor’s monthly billing cycle. Note that multiple milestones may be billed in one billing cycle.

MI Department of Corrections

FY18 Services: Payment Milestone Definition

Milestone Description Amount

1.0 Annual Hosting Fee: OCC Prod/Test Sites 20,085.00$

2.1 Status Report - October 5,440.00$

2.2 Status Report - November 5,440.00$

2.3 Status Report - December 5,440.00$

2.4 Status Report - January 5,440.00$

2.5 Status Report - February 5,440.00$

2.6 Status Report - March 5,440.00$

2.7 Status Report - April 5,440.00$

2.8 Status Report - May 5,440.00$

2.9 Status Report - June 5,440.00$

2.1 Status Report - July 5,440.00$

2.11 Status Report - August 5,440.00$

2.12 Status Report - September 5,440.00$

3.1 Assessment Consultation Session 1 Complete 2,625.00$

3.2 Assessment Consultation Session 2 Complete 2,625.00$

4.1 OMNI Demographic Interface Launch 5,000.00$

4.2 OMNI Demographic Interface System Test Launch 8,700.00$

4.3 OMNI Demographic Interface Delivered in Test Site 5,000.00$

5.1 QA Module Development Launch 6,382.50$

5.2 QA Module Development Complete 14,892.50$

5.3 QA Module UAT Launch 6,382.50$

5.4 QA Module Delivered in Test Site 14,892.50$

6.1 Training Module Development Launch 7,912.50$

6.2 Training Module Development Complete 18,462.50$

6.3 Training Module UAT Launch 7,912.50$

6.4 Training Module Delivered in Test Site 18,462.50$

7.1 Gen Enhancements Development Launch 4,422.75$

7.2 Gen Enhancements Development Complete 10,319.75$

7.3 Gen Enhancements UAT Launch 4,422.75$

7.4 Gen Enhancements Delivered in Test Site 10,319.75$

8.1 Training Session 1 (Topic TBD, 1 day max) 2,525.00$








9.1 Core Probation Outcomes & Calibration Study 17,750.00$

9.2 Reentry Risk Outcomes & Calibration Study 17,750.00$

TOTAL 289,800.00$

**Milestones will be billed upon completion.

1

Form No. DTMB-3522 (Rev. 10/2015) AUTHORITY: Act 431 of 1984 COMPLETION: Required PENALTY: Contract change will not be executed unless form is filed

NOTICE OF CONTRACT NO. 071B7700014

between

THE STATE OF MICHIGAN and

NAME & ADDRESS OF CONTRACTOR PRIMARY CONTACT EMAIL

Northpointe, Inc. Becky Kelderhouse becky.kelderhouse@northpoi nteinc.com

4825 Higbee Avenue NW, Suite 101, PHONE VENDOR TAX ID # (LAST FOUR DIGITS ONLY)

Canton, OH 44718 231-714-0166 5507

STATE CONTACTS AGENCY NAME PHONE EMAIL PROGRAM MANAGER MDOC Mike Keck 517 - 334-9426 [email protected]

CONTRACT ADMINISTRATOR DTMB-Procurement James Topping 517- 284-7032 [email protected]

CONTRACT SUMMARY DESCRIPTION: Licensing, Maintenance & Support for the Correctional Offender Management Profiling for Alternative Sanctions (COMPAS) Suite. - MDOC

INITIAL TERM EFFECTIVE DATE INITIAL EXPIRATION DATE AVAILABLE OPTIONS 3 Years 10/01/2016 9/30/2019 7, 1 Yr

PAYMENT TERMS F.O.B. SHIPPED TO 45 Days NA NA

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING □ P-card ☐ Direct Voucher (DV) ☐ Other □ Yes ☒ No

MINIMUM DELIVERY REQUIREMENTS NA MISCELLANEOUS INFORMATION This Contract is established to provide Northpointe services for the continuation of Licensing, Maintenance & Support for the Correctional Offender Management Profiling for Alternative Sanctions (COMPAS) Suite for the Department of Corrections. An Invitation to Negotiate was published on the Buy4Michigan system, confirming that Northpointe is the single provider of this service.

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION $3,000,000.00

mailto:[email protected]


Page 2 Notice of Contract #". 07187700014

For the Contractor:

2 3 / IZ / lb

Date

For the State:

William Pemble, Director, IT Division State of Michigan

Date

2

CONTRACT #071B7700014

3

STATE OF MICHIGAN CONTRACT TERMS

Software

This Software Contract (this “Contract”) is agreed to between the State of Michigan (the “State”) and Northpointe (“Contractor”), a Delaware corporation. This Contract is effective on October 1, 2016 (“Effective Date”), and unless earlier terminated, will expire on September 30, 2019 (the “Term”).

This Contract may be renewed for up 7 additional 1 year period(s). Renewal must be by written notice from the State at least thirty (30) days prior to the expiration of the then current term and will automatically extend the Term of this Contract.

1. Definitions.

“Action” has the meaning set forth in Section 8.1..

“Allegedly Infringing Features” has the meaning set forth in Section 8.3(b)(ii).

“Authorized Users” means all Persons authorized by the State to access and use the Services through the State’s

account under this Contract, subject to the maximum number of users specified in the applicable Statement of Work.

“Business Day” means a day other than a Saturday, Sunday or State Holiday.

“Change Notice” has the meaning set forth in Section 2.2.

“Code” has the meaning set forth in Section 14.

“Confidential Information” has the meaning set forth in Section 7.1.

“Contract” has the meaning set forth in the preamble.

“Contract Administrator” is the individual appointed by each party to (a) administer the terms of this Contract, and (B) approve and execute any Change Notices under this Contract. Each party’s Contract Administrator will be identified in the Statement of Work.

“Contractor” has the meaning set forth in the preamble.

“Contractor Personnel” means all employees and agents of Contractor, all Subcontractors and all employees and

agents of any Subcontractor, involved in the performance of Services.


4

“Contractor Security Officer” has the meaning set forth in Section 2.5(a).

“Contractor Service Manager” has the meaning set forth in Section 2.5(a).

“Documentation” means all generally available documentation relating to the Services, including all user manuals, operating manuals and other instructions, specifications, documents and materials, in any form or media, that describe any component, feature, requirement or other aspect of the Services, including any functionality, testing, operation or use thereof.

“DOC” means all Michigan Department of Corrections.

“Effective Date” has the meaning set forth in the preamble.

“Fees” has the meaning set forth in Section 5.1.

“Force Majeure Event” has the meaning set forth in Section 12.1.

“Harmful Code” means any software, hardware or other technologies, devices or means, the purpose or effect of which is to: (a) permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner, any (i) computer, software, firmware, hardware, system or network, or (ii) any application or function of any of the foregoing or the integrity, use or operation of any data Processed thereby; or (b) prevent the State or any Authorized User from accessing or using the Services or Contractor Systems as intended by this Contract, and includes any virus, bug, trojan horse, worm, backdoor or other malicious computer code and any time bomb or drop dead device.

“HIPAA” has the meaning set forth in Section 6.1.

“Hosted Services” has the meaning set forth in Section 2.1(a).

“Intellectual Property Rights” means any and all rights comprising or relating to: (a) patents, patent disclosures and

inventions (whether patentable or not); (b) trademarks, service marks, trade dress, trade names, logos, corporate names and domain names, together with all of the goodwill associated therewith; (c) authorship rights, copyrights and copyrightable works (including computer programs) and rights in data and databases; (d) trade secrets, know-how and other confidential information; and (e) all other intellectual property rights, in each case whether registered or unregistered and including all applications for, and renewals or extensions of, such rights, and all similar or equivalent rights or forms of protection provided by applicable Law in any jurisdiction throughout the world.

“Key Personnel” means any Contractor Personnel identified as key personnel in this Contract or any Statement of

Work.

“Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction.


5

“Loss” means all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards,

penalties, fines, costs or expenses of whatever kind, including reasonable attorneys’ fees and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers. “Losses” has a correlative meaning.

“OCC-CCAB” means Office of Community Corrections - Community Corrections Advisory Boards.

“Person” means an individual, corporation, partnership, joint venture, Limited Liability Company (LLC), governmental

authority, unincorporated organization, trust, association or other entity.

“Personal Health Information (PHI)” has the meaning set forth in Section 6.1.

“Personally Identifiable Information (PII)” has the meaning set forth in Section 6.1.

“Process” means to perform any operation or set of operations on any data, information, material, work, expression or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or (c) block, erase or destroy. “Processing” and “Processed” have correlative meanings.

“Representatives” means a party’s employees, officers, directors, consultants, legal advisors and, with respect to

Contractor, Contractor’s Subcontractors.

“RFP” means the State’s request for proposal designed to solicit responses for Services under this Contract.

“Service Software” means COMPAS Suite Software and any and all software applications and any third-party or other software, and all new versions, updates, revisions, improvements and modifications of the foregoing, that Contractor provides remote access to and use of as part of the Services.

“Services” has the meaning set forth in Section 2.1.

“Software” means on-premises COMPAS Suite Software, Contractor’s proprietary software.

“Source Code” means the human readable source code of the Service Software to which it relates, in the

programming language in which the Service Software was written, together with all related flow charts and technical documentation, including a description of the procedure for generating object code, all of a level sufficient to enable a programmer reasonably fluent in such programming language to understand, build, operate, support, maintain and develop modifications, upgrades, updates, adaptations, enhancements, new versions and other derivative works and improvements of, and to develop computer programs compatible with, the Service Software.

“Specifications” means the specifications for the Services set forth in the applicable Statement of Work and, to the

extent consistent with and not limiting of the foregoing, the Documentation.

“State” has the meaning set forth in the preamble.

“State Data” has the meaning set forth in Section 6.1.


6

“State Modification” has the meaning set forth in Section 8.2(a).

“State Project Manager” has the meaning set forth in Section 2.7.

“State Systems” means the information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems) and networks, of the State or any of its designees.

“Statement of Work” has the meaning set forth in Section 2.1(a). The Initial Statement of Work is attached as

Schedule A, and subsequent Statements of Work shall be sequentially identified and attached as Schedule A-1, A-2, A-3, etc.

“Subcontractor” means any entity that performs any Services under this Contract and otherwise has the meaning set

forth in Section 2.4(a).

“Term” has the meaning set forth in the preamble.

“Transition Period” has the meaning set forth in Section 4.3.

“Transition Responsibilities” has the meaning set forth in Section 4.3.

“User Data” means any and all information reflecting the access or use of the Software, Service Software, or Hosted Services by or on behalf of the State or any Authorized User, including any end user profile, visit, session, impression, click-through or click-stream data and any statistical or other analysis, information or data based on or derived from any of the foregoing.

Within this Agreement where hosting services are referenced, the terms are applicable only to the OCC-CCAB

software installation.

2. Services.

2.1 Services. Throughout the Term and at all times in connection with its actual or required performance under this Contract, Contractor will, in accordance with all terms and conditions set forth in this Contract and each applicable Statement of Work, provide to the State and its Authorized Users the following services (“Services”):

(a) deliver, install, configure, integrate, and otherwise provide and make fully operational the Software on or

prior to the applicable Milestone Date in accordance with the criteria set forth in the Statement of Work;

(b) the hosting of the OCC-CCAB instance, management and operation of the Service Software and other services for remote electronic access and use by the State and its Authorized Users (“Hosted Services”) as described in one or more written, sequentially numbered, statements of work referencing this Contract, including all Specifications set forth in such statements of work, which, upon their execution will be attached as Schedule A to this Contract and by this reference are incorporated in and made a part of this Contract (each, a “Statement of Work”);

(c) service maintenance and the Support Services as set forth in the applicable Statement of Work; and


7

(d) such other services as may be specified in the applicable Statement of Work.

2.2 Change Notices.

(a) Any modifications or changes to the Services under any executed Statement of Work will be effective only

if and when memorialized in a mutually agreed written change notice (“Change Notice”) signed by both Parties, provided, however, that for any Services provided on a limited basis (for example, on a per user, server, CPU or named-user basis), the State may, at any time, increase or decrease the number of its licenses hereunder subject to a corresponding forward- going adjustment of the Fees to reflect these changes in accordance with the pricing set forth in the applicable Statement of Work.

(b) In the event the Services are customizable, a more detailed change control process may be specified in

the applicable Statement of Work. In such event, the change control process set forth in such Statement of Work shall control.

2.3 Compliance With Laws. Contractor must comply with all applicable Laws as they concern this

Contract, including by securing and maintaining all required and appropriate visas, work permits, business licenses and other documentation and clearances necessary for performance of the Services.

2.4 Subcontracting. Contractor will not itself, and will not permit any Person to, subcontract any Services,

in whole or in part, without the State’s prior written consent, which consent may be given or withheld in the State’s sole discretion. Without limiting the foregoing:

(a) Contractor must ensure each Contractor subcontractor (including any subcontractor of a Contractor

subcontractor, each, a “Subcontractor”) complies with all relevant terms of this Contract, including all provisions relating to State Data or other Confidential Information of the State;

(b) the State’s consent to any such Subcontractor does not relieve Contractor of its representations,

warranties or obligations under this Contract;

(c) Contractor will remain responsible and liable for any and all: (i) performance required hereunder, including the proper supervision, coordination and performance of the Services; and (ii) acts and omissions of each Subcontractor (including, such Subcontractor’s employees and agents, who, to the extent they are involved in providing any Services, are deemed Contractor Personnel) to the same extent as if such acts or omissions were by Contractor;

(d) any noncompliance by any Subcontractor or its employees or agents with the provisions of this Contract or

any Statement of Work will constitute a breach by Contractor;

(e) prior to the provision of Services by any Subcontractor, Contractor must obtain from each such proposed Subcontractor:

(i) the identity of such Subcontractor and the location of all its data centers, if any, that will be used in

Processing any State Data, which information Contractor shall promptly disclose to the State in writing; and


8

(ii) a written confidentiality, restricted use, work-for-hire and intellectual property rights assignment

Contract in form and substance acceptable to the State, giving the State rights at least equal to those set forth in Section 6 (State Data), and Section 7 (Confidentiality), Security, and Redundancy, Data Backup and Disaster Recovery and containing the Subcontractor’s acknowledgment of, and agreement to, the provisions of Section 2.5 (Contractor Personnel), a fully-executed copy of which agreement Contractor will promptly provide to the State upon the State’s request.

2.5 Contractor Personnel. Contractor will:

(a) subject to the prior written approval of the State, appoint: (i) a Contractor employee to serve as a primary

contact with respect to the Services who will have the authority to act on behalf of Contractor in matters pertaining to the receipt and processing of Support Requests and the Support Services (the “Contractor Service Manager”); and (ii) a Contractor employee to respond to the State’s inquiries regarding the security of the Contractor Systems who has sufficient knowledge of the security of the Contractor Systems and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”); and (iii) other Key Personnel, who will be suitably skilled, experienced and qualified to perform the Services;

(b) provide names and contact information for Contractor’s Key Personnel to this Contract;

(c) maintain the same Contractor Service Manager, Contractor Security Officer and other Key Personnel

throughout the Term and such additional period, if any, as Contractor is required to perform the Services, except for changes in such personnel due to: (i) the State’s request pursuant to Section 2.5(d); or (ii) the death, disability, resignation or termination of such personnel or other circumstances outside Contractor’s reasonable control; and

(d) upon the reasonable written request of the State, promptly replace any Key Personnel of Contractor.

2.6 Management and Payment of Contractor Personnel.

(a) Contractor is solely responsible for the payment of Contractor Personnel, including all fees, expenses and

compensation to, by or on behalf of any Contractor Personnel and, if applicable, the withholding of income taxes and payment and withholding of social security and other payroll taxes, unemployment insurance, workers’ compensation insurance payments and disability benefits.

(b) Contractor will ensure that no Person who has been convicted of a felony or any misdemeanor involving, in

any way, theft, fraud, or bribery provides any Services or has access to any State Data, State Systems or State facilities. On a case-by-case basis, the State may request that Contractor initiate a background check on any Contractor Personnel before they may have access to State Data, State Systems or State facilities. Any request for a background check shall be initiated by the State and must be reasonably related to the type of work requested. The scope of the background check is at the discretion of the State and the results shall be used solely to determine the eligibility of Contractor Personnel to work with State Data, State Systems or in State facilities. If provided to the State, results of background checks will be promptly returned to Contractor, and will be treated as Confidential Information. All investigations will include a Michigan State Police Background check (ICHAT) and may include a National Crime Information Center (NCIC) Finger Print check. Contractor will present attestation of satisfactory completion of such tests. Contractor is responsible for all costs and expenses associated with such background checks.


9

2.7 State Project Manager. The State will appoint and, in its reasonable discretion, replace, a State

employee to serve as the primary contact with respect to the Services who will have the authority to act on behalf of the State in matters pertaining to the Support Services, including the submission and processing of Support Requests (the “State Project Manager”).

3. License Grant and Restrictions.

3.1 Contractor License Grant. Contractor hereby grants to the State, exercisable by and through its

Authorized Users, a nonexclusive, nontransferable license, without the right to grant sublicenses, to use the Software and Service Software, in executable code form only, royalty-free, irrevocable (except as provided herein) right and license during the Term and such additional periods, if any, as Contractor is required to perform Services under this Contract or any Statement of Work, to:

(a) access and use the Software and Service Software, including in operation with other software, hardware,

systems, networks and services, for the State’s business purposes, including for Processing State Data;

(b) generate, print, copy, upload, download, store and otherwise Process all GUI, audio, visual, digital and other output, displays and other content as may result from any access to or use of the Software or Service Software;

(c) prepare, reproduce, print, download and use a reasonable number of copies of the Specifications and

Documentation for any use of the Software or Service Software under this Contract; and

(d) access and use the Software or Service Software for all such non-production uses and applications as may be necessary or useful for the effective use of the Software or Service Software hereunder, including for purposes of analysis, development, configuration, integration, testing, training, maintenance, support and repair, which access and use will be without charge and not included for any purpose in any calculation of the State’s or its Authorized Users’ use of the Software or Service Software, including for purposes of assessing any Fees or other consideration payable to Contractor or determining any excess use of the Software or Service Software as described in Section 3.3.

3.2 License Restrictions. The State will not: (a) rent, lease, lend, sell, sublicense, assign, distribute,

publish, transfer or otherwise make the Software or Service Software available to any third party, except as expressly permitted by this Contract or in any Statement of Work; or (b) use or authorize the use of the Services, Software, or Service Software, or Documentation in any manner or for any purpose that is unlawful under applicable Law.

3.3 Use. The State will pay Contractor the corresponding Fees set forth in the Statement of Work for all

Authorized Users access and use of the Software or Service Software. Such Fees will be Contractor’s sole and exclusive remedy for use of the Software or Service Software, including any excess use.

3.4 State License Grant. The State hereby grants to Contractor a limited, non-exclusive, non-transferable

license (i) to use the State's (or individual agency’s, department’s or division’s) name, trademarks, service marks or logos, solely in accordance with the State’s specifications, and (ii) to display, reproduce, distribute and transmit in digital form the State’s (or individual agency’s, department’s or division’s) name, trademarks, service marks or logos in connection with promotion of the Services as communicated to Contractor by the State. Use


10

of the State’s (or individual agency’s, department’s or division’s) name, trademarks, service marks or logos will be specified in the applicable Statement of Work.

3.5 Contractor’s Audit Rights. No more than once every twenty-four (24) months, Contractor may

request written certification from the State regarding the State’s use of the Software and Service Software. The State agrees to respond to any such request within 15 business days of such request. If the State’s use is greater than contracted, the State shall be invoiced for any unlicensed use (and related support), and corresponding Fees, as set forth in the Statement of Work, and said invoice shall be payable in accordance with this Contract. Payment under this provision shall be Contractor’s sole and exclusive remedy to cure these issues.

4. Termination, Expiration and Transition.

4.1 Termination for Cause. In addition to any right of termination set forth elsewhere in this Contract:

(a) The State may terminate this Contract for cause, in whole or in part, if Contractor, as determined by the State: (i) endangers the value, integrity, or security of State Systems, State Data, or the State’s facilities or personnel; (ii) becomes insolvent, petitions for bankruptcy court proceedings, or has an involuntary bankruptcy proceeding filed against it by any creditor; or (iii) breaches any of its material duties or obligations under this Contract. Any reference to specific breaches being material breaches within this Contract will not be construed to mean that other breaches are not material.

(b) If the State terminates this Contract under this Section 4.1, the State will issue a termination

notice specifying whether Contractor must: (a) cease performance immediately, or (b) continue to perform for a specified period. If it is later determined that Contractor was not in breach of this Contract, the termination will be deemed to have been a termination for convenience, effective as of the same date, and the rights and obligations of the parties will be limited to those provided in Section 4.2.

(c) The State will only pay for amounts due to Contractor for Services accepted by the State on or

before the date of termination, subject to the State’s right to set off any amounts owed by the Contractor for the State’s reasonable costs in terminating this Contract. Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination. Further, Contractor must pay all reasonable costs incurred by the State in terminating this Contract for cause, including administrative costs, attorneys’ fees, court costs, transition costs, and any costs the State incurs to procure the Services from other sources. The State is obligated to mitigate its damages.

4.2 Termination for Convenience. The State may terminate this Contract in whole or in part, without

penalty, by providing the Contractor with thirty (30) days’ prior written notice of the termination, and for any reason, including but not limited to, appropriation or budget shortfalls. The termination notice will specify whether Contractor must: (a) cease performance immediately, or (b) continue to perform in accordance with Section 4.3. If the State terminates this Contract for convenience and desires transition services, the State shall be obligated to pay for State approved Transition Responsibilities and for any other professional services provided to the State


11

prior to termination or expiration of the Transition Period. Under this Section, Contractor shall have no obligation to perform transition services without payment from the State.

4.3 Transition Responsibilities. Upon termination or expiration of this Contract for any reason, Contractor

must, for a period of time specified by the State (not to exceed 90 calendar days; the “Transition Period”), provide all reasonable transition assistance requested by the State, to allow for the expired or terminated portion of the Contract to continue without interruption or adverse effect, and to facilitate the orderly transfer of the Services to the State or its designees with all said transition services billable and due to Contractor. Such transition assistance may include but is not limited to: (a) continuing to perform the Services at the established Statement of Work rates; (b) taking all reasonable and necessary measures to transition performance of the work, including all applicable Services to the State or the State’s designee; (c) taking all necessary and appropriate steps, or such other action as the State may direct, to preserve, maintain, protect, or return to the State all State Data; and (d) preparing an accurate accounting from which the State and Contractor may reconcile all outstanding accounts (collectively, the “Transition Responsibilities”). The Term of this Contract is automatically extended through the end of the Transition Period. Any Transition Responsibilities performed by Contractor will be billed at the Contract rate.

4.4 Effect of Termination. Upon and after the termination or expiration of this Contract or one or more

Statements of Work for any or no reason:

(a) Contractor will be obligated to perform all Transition Responsibilities specified in Section 4.3 that the State pays for, subject to the State’s right of set-off under a Termination for Cause.

(b) All licenses granted to Contractor in State Data will immediately and automatically also terminate. Contractor must promptly return to the State all State Data not required by Contractor for its Transition Responsibilities, if any.

(c) All licenses granted to State will immediately and automatically terminate, subject to any use during the

Transition Period. Contractor must promptly return to the State all State Data stored on Contractor hosted services, and destroy any residual data.

(d) The State must promptly discontinue all use of the Software, erase all copies of the Software from the

State’s computers, and return to Contractor or destroy all copies of the Software in State’s possession or control immediately upon termination or completion of transition services.

(e) Contractor will (i) return to the State all documents and tangible materials (and any copies)

containing, reflecting, incorporating, or based on the State’s Confidential Information; (ii) permanently erase the State’s Confidential Information from its computer systems; and (iii) certify in writing to the State that it has complied with the requirements of this Section 4, in each case to the extent such materials are not required by Contractor for Transition Responsibilities, if any.

(f) For purposes of transitioning the Services, notwithstanding any provisions of this Contract or any

Statement of Work to the contrary, upon the State’s termination of this Contract or any Statement of Work for cause pursuant to Section 4.1, the State will have the right and option to continue to access and use the Services under


12

each applicable Statement of Work, in whole and in part, for a period not to exceed one hundred and eighty (180) days from the effective date of such termination pursuant to the terms and conditions of this Contract and each applicable Statement of Work.

4.5 Survival. The rights, obligations and conditions set forth in this Section 4.5 and Section 1

(Definitions), Section 4.4 (Effect of Termination; Data Retention), Section 6 (State Data), Section 7 (Confidentiality), Section 8 (Indemnification), Section 9 (Limitations of Liability), Section 10 (Representations and Warranties), Section 10.3 (Insurance) and Section 14 (Effect of Contractor Bankruptcy) and Section 15 (General Provisions), and any right, obligation or condition that, by its express terms or nature and context is intended to survive the termination or expiration of this Contract, survives any such termination or expiration hereof for a period of three (3) years with the exception of Section 6, State Data.

5. Fees and Expenses.

5.1 Fees. Subject to the terms and conditions of this Contract and the applicable Statement of Work,

including the provisions of this Section 5, the State shall pay the fees set forth in the applicable Statement of Work, subject to such increases and adjustments as may be permitted pursuant to Section 5.2 (“Fees During Option Years”).

5.2 Fees During Option Years. Contractor’s Fees are fixed during the initial period of the Term.

Contractor may increase Fees for any renewal period by providing written notice to the State at least sixty (60) calendar days prior to the commencement of such renewal period. For the term of this Agreement, including any option periods, an increase of Fees for any renewal period may not exceed five percent (5%) of the Fees effective during the immediately preceding twelve (12) month period. No increase in Fees is effective unless made in compliance with the provisions of this Section 5.2.

5.3 Responsibility for Costs. Contractor is responsible for all costs and expenses incurred in or incidental

to the performance of Services, including all costs of any materials supplied by Contractor, all fees, fines, licenses, bonds, or taxes required of or imposed against Contractor, and all other of Contractor’s costs of doing business.

5.4 Taxes. The State is exempt from State sales tax for direct purchases and may be exempt from

federal excise tax, if Services purchased under this Contract are for the State’s exclusive use. Notwithstanding the foregoing, all Fees are inclusive of taxes, and Contractor is responsible for all sales, use and excise taxes, and any other similar taxes, duties and charges of any kind imposed by any federal, state, or local governmental entity on any amounts payable by the State under this Contract.

5.5 Invoices. Contractor will invoice the State for all Fees in electronic format, via such delivery means

and to such address as are specified by the State in writing from time to time. If more than one Statement of Work is in effect, Contractor shall provide separate invoices for each Statement of Work. Each separate invoice must: (a) clearly identify the Statement of Work to which it relates, in such manner as is required by the State; (b) list each Fee item separately; (c) include sufficient detail for each line item to enable the State to verify the calculation thereof; (d) for Fees determined on a time and materials basis, report details of time taken to perform Services, and such other information as the State requires, on a per-individual basis; and (e) include such other information as may be required by the State as set forth in the applicable Statement of Work.


13

5.6 Payment Terms. Invoices are due and payable by the State, in accordance with the State’s standard

payment procedures as specified in 1984 Public Act no. 279, MCL 17.51, et seq., within forty-five (45) calendar days after receipt, provided the State determines that the invoice was properly rendered.

5.7 State Audits of Contractor.

(a) During the Term, and for four (4) years after, Contractor must maintain complete and accurate

books and records regarding its business operations relevant to the calculation of Fees and any other information relevant to Contractor’s compliance with this Section 5. During the Term, and for four (4) years after, upon the State’s request, Contractor must make such books and records and appropriate personnel, including all financial information, available during normal business hours for inspection and audit by the State or its authorized representative, provided that the State: (a) provides Contractor with at least fifteen (15) days prior notice of any audit, and (b) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations.

(b) The State may take copies and abstracts of materials audited. The State will pay the cost of such audits

unless an audit reveals an overbilling or over-reporting of five percent (5%) or more, in which case Contractor shall reimburse the State for the reasonable cost of the audit. Contractor must immediately upon written notice from the State pay the State the amount of any overpayment revealed by the audit, together with any reimbursement payable pursuant to the preceding sentence.

5.8 Payment Does Not Imply Acceptance. The making of any payment or payments by the State, or the

receipt thereof by Contractor, will in no way affect the responsibility of Contractor to perform the Services in accordance with this Contract, and will not imply the State’s Acceptance of any Services or the waiver of any warranties or requirements of this Contract.

5.9 Payment Disputes. The State may withhold from payment any amount disputed by the State in

good faith, pending resolution of the dispute, provided that the State:

(a) timely pays all amounts not subject to dispute;

(b) notifies Contractor of the dispute prior to the due date of the properly issued invoice, specifying in such notice (i) the amount in dispute, and (ii) the reason for the dispute set out in sufficient detail to facilitate investigation by Contractor and resolution by the parties;

(c) works with Contractor to resolve the dispute promptly through the Dispute Resolution Procedure; and

(d) promptly pays any amount determined to be due by resolution of the dispute.

5.10 Right of Set-off. Without prejudice to any other right or remedy it may have, the State reserves the

right to set off at any time any amount then due and owing to it by Contractor against any amount payable by the State to Contractor under this Contract.

5.11 Support Not to be Withheld or Delayed. Contractor may not withhold or delay any access to any

Software, Service Software, or Hosted Services or Support Services or fail to perform any other Services or


14

obligations hereunder by reason of: (a) the State’s good faith withholding of any payment or amount in accordance with this Section 5; or (b) any dispute whatsoever between the parties, including any payment or other dispute arising under or concerning this Contract or any other agreement between the parties.

6. State Data.

6.1 Ownership. The State’s data (“State Data,” which will be treated by Contractor as Confidential

Information) includes: (a) User Data; and (b) the State’s data collected, used, processed, stored, or generated in connection with the Services, including but not limited to (i) personally identifiable information (“PII”) collected, used, processed, stored, or generated as the result of the Services, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed; and (ii) personal health information (“PHI”) collected, used, processed, stored, or generated as the result of the Services, which is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and its related rules and regulations. State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State. This Section 6.1 survives termination or expiration of this Contract.

6.2 Contractor Use of State Data. Contractor is provided a limited license to State Data for the sole and

exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Services. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Contract, any applicable Statement of Work, and applicable law; and (c) not use, sell, rent, transfer, distribute, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent. This Section 6.2 survives termination or expiration of this Contract.

6.3 Backup and Extraction of State Data. Contractor will provide:

(a) On a quarterly basis or as needed for continued operations, a backup of the OCC-CCAB current image

within five (5) Business Days, or another mutually agreed upon time frame and format, of the State’s request, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Contractor).

(b) Extraction. If requested by the State, Contractor will provide an extract of State data to the State in the

format specified by the State within a mutually agreed upon timeframe, at the Contract rates.

6.4 Discovery. Contractor shall immediately notify the State upon receipt of any requests which in any way might reasonably require access to State Data or the State's use of the Software, Service Software, or Hosted Services. Contractor shall notify the State Project Manager by the fastest means available and also in writing. In no event shall Contractor provide such notification more than twenty-four (24) hours after Contractor


15

receives the request. Contractor shall not respond to subpoenas, service of process, FOIA requests, and other legal requests related to the State without first notifying the State and obtaining the State’s prior approval of Contractor’s proposed responses. Contractor agrees to provide its completed responses to the State with adequate time for State review, revision and approval.

6.5 Compromise of Data. In the event of any act, error or omission on the part of Contractor that

compromises the security, confidentiality, or integrity of State Data hosted in Contractor’s systems Contractor must, as applicable: (a) notify the State as soon as practicable but no later than twenty-four (24) hours of becoming aware of such occurrence; (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State; (c) in the case of PII or PHI, at the State’s sole election, (i) with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within five (5) calendar days of the occurrence; or (ii) reimburse the State for any costs in notifying the affected individuals; (d) in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals; (e) perform or take any other actions required to comply with applicable law as a result of the occurrence; (f) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution; (g) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all third party claims which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence; (h) be responsible for assisting the State in recreating lost State Data without charge to the State; and (i) provide to the State a detailed plan within ten (10) calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum: name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery. Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination. Notwithstanding anything to the contrary set forth in this Section or any other provision of this Contract, the aggregate liability of Contractor for damages under this Section shall not exceed Two Million Dollars ($2,000,000.00). This Section 6.5 survives termination or expiration of this Contract.

6.6 HIPAA Compliance. The State and Contractor must comply with all obligations under HIPAA and its

accompanying regulations, including but not limited to entering into a business associate agreement, if reasonably necessary to keep the State and Contractor in compliance with HIPAA.


16

6.7 ADA Compliance. If the Services are required to be compliant with the Americans with Disabilities Act

or Section 508 of the Workforce Rehabilitation Act of 1973, such compliance requirements shall be specified in the Statement of Work.

7. Confidentiality.

7.1 Meaning of Confidential Information. The term “Confidential Information” means all information and

documentation of a party that: (a) has been marked “confidential” or with words of similar meaning, at the time of disclosure by such party; (b) if disclosed orally or not marked “confidential” or with words of similar meaning, was subsequently summarized in writing by the disclosing party and marked “confidential” or with words of similar meaning; and, (c) should reasonably be recognized as confidential information of the disclosing party. The term “Confidential Information” does not include any information or documentation that was or is: (a) in the possession of the State and subject to disclosure under the Michigan Freedom of Information Act (FOIA); (b) already in the possession of the receiving party without an obligation of confidentiality; (c) developed independently by the receiving party, as demonstrated by the receiving party, without violating the disclosing party’s proprietary rights; (d) obtained from a source other than the disclosing party without an obligation of confidentiality; or, (e) publicly available when received, or thereafter became publicly available (other than through any unauthorized disclosure by, through, or on behalf of, the receiving party). Notwithstanding the above, in all cases and for all matters, State Data is deemed to be Confidential Information.

7.2 Obligation of Confidentiality. The parties agree to hold all Confidential Information in strict confidence

and not to copy, reproduce, sell, transfer, or otherwise dispose of, give or disclose such Confidential Information to third parties other than employees, agents, or subcontractors of a party who have a need to know in connection with this Contract or to use such Confidential Information for any purposes whatsoever other than the performance of this Contract. The parties agree to advise and require their respective employees, agents, and subcontractors of their obligations to keep all Confidential Information confidential. Disclosure to the Contractor’s subcontractor is permissible where: (a) the subcontractor is a Permitted Subcontractor; (b) the disclosure is necessary or otherwise naturally occurs in connection with work that is within the Permitted Subcontractor's responsibilities; and (c) Contractor obligates the Permitted Subcontractor in a written contract to maintain the State’s Confidential Information in confidence. At the State’s request, any of the Contractor’s Representatives may be required to execute a separate agreement to be bound by the provisions of this Section 7.2.

7.3 Cooperation to Prevent Disclosure of Confidential Information. Each party must use its best efforts to

assist the other party in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the foregoing, each party must advise the other party immediately in the event either party learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Contract. Each party will cooperate with the other party in seeking injunctive or other equitable relief against any such person.

7.4 Remedies for Breach of Obligation of Confidentiality. Each party acknowledges that breach of its

obligation of confidentiality may give rise to irreparable injury to the other party, which damage may be inadequately compensable in the form of monetary damages. Accordingly, a party may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any other


17

legal remedies which may be available, to include, in the case of the State, at the sole election of the State, the immediate termination, without liability to the State, of this Contract or any Statement of Work corresponding to the breach or threatened breach.

7.5 Surrender of Confidential Information upon Termination. Upon termination or expiration of this

Contract or a Statement of Work, in whole or in part, each party must, within five (5) Business Days from the date of termination, return to the other party any and all Confidential Information received from the other party, or created or received by a party on behalf of the other party, which are in such party’s possession, custody, or control. If Contractor or the State determine that the return of any Confidential Information is not feasible, such party must destroy the Confidential Information and certify the same in writing within five (5) Business Days from the date of termination to the other party.

8. Indemnification.

8.1 General Indemnification. Contractor must defend, indemnify and hold harmless the State, and the

State’s agencies, departments, officers, directors, employees, agents, and contractors from and against all third party claims for death, personal injury, or property damage arising out of negligent acts or omissions or willful misconduct of Contractor during the performance of the Agreement.

8.2 Infringement Indemnification By Contractor. Contractor must indemnify, defend and hold the State, and the State’s agencies, departments, officers, directors, employees, agents, and contractors harmless from and against all Losses arising out of or resulting from any Action that does or is alleged to arise out of or result from a claim that any of the Service Software or Software, or the State’s or any Authorized User’s use thereof, actually does or threatens to infringe, misappropriate or otherwise violate any Intellectual Property Right or other right of a third party, provided however, that Contractor shall have no liability or obligation for any Action or Loss to the extent that such Action or Loss arises out of or results from any:

(a) alteration or modification of the Service Software or Software by or on behalf of the State or any Authorized

User without Contractor’s authorization (each, a “State Modification”), provided that no infringement, misappropriation or other violation of third party rights would have occurred without such State Modification and provided further that any alteration or modification made by or for Contractor at the State’s request shall not be excluded from Contractor’s indemnification obligations hereunder unless (i) such alteration or modification has been made pursuant to the State’s written specifications and (ii) the Service Software or Software, as altered or modified in accordance with the State’s specifications, would not have violated such third party rights but for the manner in which the alteration or modification was implemented by or for Contractor; and

(b) use of the Service Software or Software by the State or an Authorized User pursuant to this Contract in

combination with any software or service not provided, authorized or approved by or on behalf of Contractor, if (i) no violation of third party rights would have occurred without such combination and (ii) such software or service is not commercially available and not standard in Contractor’s or the State’s industry and there are no Specifications, Documentation, or other materials indicating Contractor’s specification, authorization or approval of the use of the Service Software or Software in combination therewith.


18

8.3 Mitigation.

(a) If Contractor receives or otherwise learns of any threat, warning or notice alleging that all, or any

component or feature, of the Service Software or Software violates a third party’s rights, Contractor must promptly notify the State of such fact in writing, and take all commercially reasonable actions necessary to ensure the State’s continued right to access and use such Services and otherwise protect the State from any Losses in connection therewith, including investigating such allegation and obtaining a credible opinion of counsel that it is without merit.

(b) Subject to the exclusions set forth in clauses (a) and (b) of Section 8.2, if any of the Service Software or

Software or any component or feature thereof is ruled to infringe or otherwise violate the rights of any third party by any court of competent jurisdiction, or if any use of the Service Software or Software or any component thereof is threatened to be enjoined, or is likely to be enjoined or otherwise the subject of an infringement or misappropriation claim, Contractor must, at Contractor’s sole cost and expense:

(i) procure for the State the right to continue to access and use the Service Software or Software to the

full extent contemplated by this Contract and the Specifications; or

(ii) modify or replace all components, features and operations of the Service Software or Software that infringe or are alleged to infringe (“Allegedly Infringing Features”) to make the Service Software or Software non-infringing while providing equally or more suitable features and functionality, which modified and replacement services shall constitute Service Software or Software and be subject to the terms and conditions of this Contract.

(c) If neither of the remedies set forth in Section 8.3(b) is reasonably available with respect to the Allegedly

Infringing Features then Contractor may direct the State to cease any use of any materials that have been enjoined or finally adjudicated as infringing, provided that Contractor will:

(i) refund to the State any prepaid Fees for Services, Service Software, or Software that have not been

provided; and

(ii) in any case, at its sole cost and expense, secure the right for the State to continue using the Allegedly Infringing Features for a transition period of up to six (6) months to allow the State to replace the affected Services Service Software or Software or Allegedly Infringing Features without disruption.

(d) The remedies set forth in this Section 8.3 are in addition to, and not in lieu of, all other remedies that may

be available to the State under this Contract or otherwise, including the State’s right to be indemnified pursuant to Section 8.1 and Section 8.2.

8.4 Indemnification Procedure. The State shall promptly notify Contractor in writing if indemnification is

sought; however, failure to do so will not relieve Contractor, except to the extent that Contractor is materially prejudiced. Contractor must, to the satisfaction of the State, demonstrate its financial ability to carry out these obligations. The State is entitled to: (i) regular updates on proceeding status; (ii) participate in the defense of the proceeding; (iii) employ its own counsel; and to (iv) retain control of the defense, at its own expense, if the State deems necessary. Contractor will not, without the State’s prior written consent (not to be unreasonably withheld), settle, compromise, or consent to the entry of any judgment in or otherwise seek to terminate any


19

claim, action, or proceeding. Any litigation activity on behalf of the State or any of its subdivisions, under this Section 8, must be coordinated with the Department of Attorney General. An attorney designated to represent the State may not do so until approved by the Michigan Attorney General and appointed as a Special Assistant Attorney General.

9. Limitations of Liability.

(a) The Parties’ Disclaimer of Damages. NEITHER PARTY WILL BE LIABLE, REGARDLESS OF THE FORM

OF ACTION, WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR BY STATUTE OR OTHERWISE, FOR ANY CLAIM RELATED TO OR ARISING UNDER THIS CONTRACT FOR CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY OR SPECIAL DAMAGES, INCLUDING LOST PROFITS, AND LOST BUSINESS OPPORTUNITIES.

(b) The Parties’ Limitation of Liability. IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY TO

THE OTHER UNDER THIS CONTRACT, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR BY STATUTE OR OTHERWISE, FOR ANY CLAIM RELATED TO OR ARISING UNDER THIS CONTRACT, EXCEED THE MAXIMUM AMOUNT OF FEES PAID BY THE STATE FOR THE SPECIFIC SERVICE(S) GIVING RISE TO SUCH CLAIM DURING THE PRIOR TWELVE MONTH PERIOD.

(c) Sections 9 (a) and 9 (b), above, shall not apply to:

(i) Contractor’s indemnification obligations under Section 8 of this Contract, which shall be capped at $5

million; or to

(ii) Contractor’s State Data obligations, which shall be subject to the cap outlined in Section 6.5.

10. Contractor Representations and Warranties.

10.1 Authority and Bid Response. Contractor represents and warrants to the State that:

(a) it is duly organized, validly existing, and in good standing as a corporation or other entity as represented under this Contract under the laws and regulations of its jurisdiction of incorporation, organization, or chartering;

(b) it has the full right, power, and authority to enter into this Contract, to grant the rights and licenses granted

under this Contract, and to perform its contractual obligations;

(c) the execution of this Contract by its Representative has been duly authorized by all necessary organizational action;

(d) when executed and delivered by Contractor, this Contract will constitute the legal, valid, and binding

obligation of Contractor, enforceable against Contractor in accordance with its terms;


20

(e) the prices proposed by Contractor were arrived at independently, without consultation, communication, or

agreement with any other bidder for the purpose of restricting competition; the prices quoted were not knowingly disclosed by Contractor to any other bidder to the RFP; and no attempt was made by Contractor to induce any other Person to submit or not submit a proposal for the purpose of restricting competition;

(f) all written information furnished to the State by or for Contractor in connection with this Contract, including

Contractor’s bid response to the RFP, is true, accurate, and complete, and contains no untrue statement of material fact or omits any material fact necessary to make the information not misleading; and

(g) Contractor is not in material default or breach of any other contract or agreement that it may have with the

State or any of its departments, commissions, boards, or agencies. Contractor further represents and warrants that it has not been a party to any contract with the State or any of its departments that was terminated by the State within the previous five (5) years for the reason that Contractor failed to perform or otherwise breached an obligation of the contract.

10.2 Software and Service Software Warranties. Contractor represents and warrants to the State that:

(a) Contractor has, and throughout the Term and any additional periods during which Contractor does or is

required to perform the Services will have, the unconditional and irrevocable right, power and authority, including all permits and licenses required, to provide the Services, Software, and Service Software, and grant and perform all rights and licenses granted or required to be granted by it under this Contract;

(b) neither Contractor’s grant of the rights or licenses hereunder nor its performance of any Services or other

obligations under this Contract does or at any time will: (i) conflict with or violate any applicable Law, including any Law relating to data privacy, data security or personal information; (ii) require the consent, approval or authorization of any governmental or regulatory authority or other third party; or (iii) require the provision of any payment or other consideration by the State or any Authorized User to any third party, and Contractor shall promptly notify the State in writing if it becomes aware of any change in any applicable Law that would preclude Contractor’s performance of its material obligations hereunder;

(c) as accessed and used by the State or any Authorized User in accordance with this Contract and the

Specifications, the Software, Service Software, Documentation and all other Services and materials provided by Contractor under this Contract will not infringe, misappropriate or otherwise violate any Intellectual Property Right or other right of any third party;

(d) there is no settled, pending or, to Contractor’s knowledge as of the Effective Date, threatened Action, and

it has not received any written, oral or other notice of any Action (including in the form of any offer to obtain a license): (i) alleging that any access to or use of the Services or Service Software does or would infringe, misappropriate or otherwise violate any Intellectual Property Right of any third party; (ii) challenging Contractor’s ownership of, or right to use or license, any software or other materials used or required to be used in connection with the performance or receipt of the Services, Software, or Service Software, or alleging any adverse right, title or interest with respect thereto; or (iii) that, if decided unfavorably to Contractor, would reasonably be expected to have an actual or potential adverse effect on its ability to perform the Services or its other obligations, or provide the Software or Service Software, under this Contract, and it has no knowledge after reasonable investigation of any factual, legal or other reasonable basis for any such litigation, claim or proceeding;


21

(e) the Service Software and Services will in all material respects conform to and perform in accordance with

the Specifications and all requirements of this Contract, including the Availability and Availability Requirement provisions set forth in Schedules attached to this Contract;

(f) all Specifications are, and will be continually updated and maintained so that they continue to be, current,

complete and accurate and so that they do and will continue to fully describe the Software, Service Software, and Services in all material respects such that at no time during the Term or any additional periods during which Contractor does or is required to perform the Services, or provide the Software or Service Software, will the Services, Software, or Service Software, have any material undocumented feature;

(g) the Contractor Systems, Software, Service Software, and Services are and will remain free of Harmful Code;

(h) Contractor will not advertise through the Hosted Services (whether with adware, banners, buttons or other

forms of online advertising) or link to external web sites that are not approved in writing by the State;

(i) Contractor will perform all Services, and provide all Software and Service Software, in a timely, professional and workmanlike manner with a level of care, skill, practice and judgment consistent with generally recognized industry standards and practices for similar services, using personnel with the requisite skill, experience and qualifications, and will devote adequate resources to meet Contractor’s obligations under this Contract;

(j) During the term of this Contract, any audit rights contained in any third-party software license agreement or

end user license agreement for third-party software incorporated in or otherwise used in conjunction with the Software, Service Software, or Services, will apply solely to Contractor’s (or its subcontractors) facilities and systems that host the Services (including any disaster recovery site), and regardless of anything to the contrary contained in any third-party software license agreement or end user license agreement, third-party software providers will have no audit rights whatsoever against State systems or networks; and

(k) Contractor acknowledges that the State cannot indemnify any third parties, including but not limited to any

third-party software providers that provide software that will be incorporated in or otherwise used in conjunction with the Services, and that notwithstanding anything to the contrary contained in any third-party software license agreement or end user license agreement, the State will not indemnify any third party software provider for any reason whatsoever.

10.3 DISCLAIMER. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS CONTRACT,

CONTRACTOR HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE UNDER OR IN CONNECTION WITH THIS CONTRACT OR ANY SUBJECT MATTER HEREOF.

11. Insurance.

11.1 Required Coverage.


22

(a) Insurance Requirements. Contractor must maintain the insurances identified below and is responsible for

all deductibles. All required insurance must: (a) protect the State from claims that may arise out of, are alleged to arise out of, or result from Contractor's or a subcontractor's performance; (b) be primary and non-contributing to any comparable liability insurance (including self-insurance) carried by the State; and (c) be provided by an company with an A.M. Best rating of "A" or better and a financial size of VII or better.

Required Limits Additional Requirements Commercial General Liability Insurance

Minimal Limits: $1,000,000 Each Occurrence Limit

$1,000,000 Personal & Advertising Injury Limit $2,000,000 General Aggregate Limit $2,000,000 Products/Completed Operations

Deductible Maximum: $500,000 Each Occurrence

Contractor must have their policy endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds using endorsement CG 20 10 11 85, or both CG 2010 07 04 and CG 2037 07 0.

Umbrella or Excess Liability Insurance

Minimal Limits: $5,000,000 General Aggregate

Contractor must have their policy endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds.

Automobile Liability Insurance Minimal Limits: $1,000,000 Per Occurrence

Contractor must have their policy: (1) endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds; and (2) include Hired and Non-Owned Automobile coverage.

Workers' Compensation Insurance Minimal Limits: Coverage according to applicable laws governing work activities.

Waiver of subrogation, except where waiver is prohibited by law.

Employers Liability Insurance Minimal Limits: $500,000 Each Accident $500,000 Each Employee by Disease $500,000 Aggregate Disease.

Privacy and Security Liability (Cyber Liability) Insurance

Minimal Limits: $1,000,000 Each Occurrence $1,000,000 Annual Aggregate

Contractor must have their policy: (1) endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds; and (2) cover information security and privacy liability, privacy notification costs, regulatory defense and penalties, and website media content liability.

Crime (Fidelity) Insurance


23

Minimal Limits: $1,000,000 Employee Theft Per Loss

Contractor must have their policy: (1) cover forgery and alteration, theft of money and securities, robbery and safe burglary, computer fraud, funds transfer fraud, money order and counterfeit currency, and (2) endorsed to add “the State of Michigan, its departments, divisions, agencies, offices, commissions, officers, employees, and agents” as additional insureds.

Professional Liability (Errors and Omissions) Insurance

Minimal Limits: $5,000,000 Each Occurrence $5,000,000 Annual Aggregate

Deductible Maximum: $500,000 Per Loss

(b) If Contractor's policy contains limits higher than the minimum limits, the State is entitled to coverage to the extent of the higher limits. The minimum limits are not intended, and may not be construed to limit any liability or indemnity of Contractor to any indemnified party or other persons.

(c) If any of the required policies provide claims-made coverage, Contractor must: (a) provide coverage with

a retroactive date before the effective date of the contract or the beginning of contract work; (b) maintain coverage and provide evidence of coverage for at least three (3) years after completion of the contract of work; and (c) if coverage is canceled or not renewed, and not replaced with another claims-made policy form with a retroactive date prior to the contract effective date, Contractor must purchase extended reporting coverage for a minimum of three (3) years after completion of work.

(d) Contractor must: (a) provide insurance certificates to the Contract Administrator, containing the agreement

or purchase order number, at Contract formation and within 20 calendar days of the expiration date of the applicable policies; (b) require that subcontractors maintain the required insurances contained in this Section; (c) notify the Contract Administrator within 5 business days if any insurance is cancelled; and (d) waive all rights against the State for damages covered by insurance. Failure to maintain the required insurance does not limit this waiver.

11.2 Non-waiver. This Section 10.3 is not intended to and is not be construed in any manner as waiving, restricting or

limiting the liability of either party for any obligations under this Contract (including any provisions hereof requiring Contractor to indemnify, defend and hold harmless the State).

12. Force Majeure.

12.1 Force Majeure Events. Subject to Section 12.2, neither party will be liable or responsible to the other

party, or be deemed to have defaulted under or breached this Contract, for any failure or delay in fulfilling or performing any term hereof, when and to the extent such failure or delay is caused by: acts of God, flood, fire or


24

explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Contract, national or regional emergency, or any passage of law or governmental order, rule, regulation or direction, or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition (each of the foregoing, a “Force Majeure Event”), in each case provided that: (a) such event is outside the reasonable control of the affected party; (b) the affected party gives prompt written notice to the other party, stating the period of time the occurrence is expected to continue; (c) the affected party uses diligent efforts to end the failure or delay and minimize the effects of such Force Majeure Event.

12.2 State Performance; Termination. In the event of a Force Majeure Event affecting Contractor’s

performance under this Contract, the State may suspend its performance hereunder until such time as Contractor resumes performance. The State may terminate this Contract by written notice to Contractor if a Force Majeure Event affecting Contractor’s performance hereunder continues substantially uninterrupted for a period of five (5) Business Days or more. Unless the State terminates this Contract pursuant to the preceding sentence, any date specifically designated for Contractor’s performance under this Contract will automatically be extended for a period up to the duration of the Force Majeure Event.

12.3 Exclusions; Non-suspended Obligations. Notwithstanding the foregoing or any other provisions of this

Contract:

(a) in no event will any of the following be considered a Force Majeure Event:

(i) shutdowns, disruptions or malfunctions of the Contractor Systems or any of Contractor’s telecommunication or internet services other than as a result of general and widespread internet or telecommunications failures that are not limited to the Contractor Systems; or

(ii) the delay or failure of any Contractor Personnel to perform any obligation of Contractor hereunder

unless such delay or failure to perform is itself by reason of a Force Majeure Event; and

(b) no Force Majeure Event modifies or excuses Contractor’s obligations under Section 6 (State Data), Section 7 (Confidentiality), Security, Data Backup and Disaster Recovery, or Section 8 (Indemnification) obligations under this Contract or an applicable Statement of Work.

13. Software Escrow. The parties may enter into a separate intellectual property escrow agreement. Such escrow agreement will govern all aspects of Source Code escrow and release.

14. Effect of Contractor Bankruptcy. All rights and licenses granted by Contractor under this Contract are and shall be deemed to be rights and licenses to “intellectual property,” and the subject matter of this agreement, including the Services, is and shall be deemed to be “embodiments” of “intellectual property” for purposes of and as such terms are used in and interpreted under section 365(n) of the United States Bankruptcy Code (the “Code”) (11 U.S.C. § 365(n) (2010)). The State has the right to exercise all rights and elections under the Code and all other applicable bankruptcy, insolvency and similar laws with respect to this Contract (including all executory Statement of Works). Without limiting the generality of the foregoing, if Contractor or its estate becomes subject to any bankruptcy or similar proceeding, subject to the State’s


25

rights of election, all rights and licenses granted to the State under this Contract will continue subject to the respective terms and conditions of this Contract, and will not be affected, even by Contractor’s rejection of this Contract.

15. General Provisions.

15.1 Further Assurances. Each party will, upon the reasonable request of the other party, execute such

documents and perform such acts as may be necessary to give full effect to the terms of this Contract.

15.2 Relationship of the Parties. The relationship between the parties is that of independent contractors. Nothing contained in this Contract is to be construed as creating any agency, partnership, joint venture or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party has authority to contract for or bind the other party in any manner whatsoever.

15.3 Media Releases. News releases (including promotional literature and commercial advertisements)

pertaining to this Contract or project to which it relates must not be made without the prior written approval of the State, and then only in accordance with the explicit written instructions of the State.

15.4 Notices. All notices, requests, consents, claims, demands, waivers and other communications

hereunder, other than routine communications having no legal effect, must be in writing and addressed to the parties as follows (or as otherwise specified by a party in a notice given in accordance with this Section):

If to Contractor:

Northpointe, Inc 4825 Higbee Ave. NW Suite 101 Canton, OH 44718

E-mail: [email protected]

Attention: Becky Kelderhouse

Title: Director of Operations

If to the State:

525 W Allegan, 1st Floor Lansing, MI 48913

E-mail: [email protected]

Attention: James Topping

Title: IT Buyer

Notices sent in accordance with this Section 15.4 will be deemed effectively given: (a) when received, if delivered by hand (with written confirmation of receipt); (b) when received, if sent by a nationally recognized overnight courier (receipt requested); (c) on the date sent by e-mail (with confirmation of transmission), if sent during normal business hours




26

of the recipient, and on the next business day, if sent after normal business hours of the recipient; or (d) on the fifth (5th) day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid.

15.5 Extended Purchasing Program.

Reserved

15.6 Headings. The headings in this Contract are for reference only and do not affect the interpretation of

this Contract.

15.7 Entire Agreement. This Contract, including all Statements of Work and other Schedules and Exhibits, constitutes the sole and entire agreement of the parties to this Contract with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter. In the event of any conflict between the terms of this Contract and those of any Schedule, Exhibit or other document, the following order of precedence governs: (a) first, this Contract, excluding its Exhibits and Schedules; and (b) second, the Exhibits and Schedules to this Contract as of the Effective Date. NO TERMS ON CONTRACTORS WEBSITE, BROWSE-WRAP, SHRINK-WRAP, CLICK-WRAP OR OTHER NON-NEGOTIATED TERMS AND CONDITIONS PROVIDED WITH ANY OF THE SERVICES, OR DOCUMENTATION HEREUNDER WILL CONSTITUTE A PART OR AMENDMENT OF THIS CONTRACT OR IS BINDING ON THE STATE OR ANY AUTHORIZED USER FOR ANY PURPOSE. ALL SUCH OTHER TERMS AND CONDITIONS HAVE NO FORCE AND EFFECT AND ARE DEEMED REJECTED BY THE STATE AND THE AUTHORIZED USER, EVEN IF ACCESS TO OR USE OF SUCH SERVICE OR DOCUMENTATION REQUIRES AFFIRMATIVE ACCEPTANCE OF SUCH TERMS AND CONDITIONS.

15.8 Assignment. Contractor may not assign or otherwise transfer any of its rights, or delegate or

otherwise transfer any of its obligations or performance, under this Contract, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without the State’s prior written consent. The State has the right to terminate this Contract in its entirety or any Services or Statements of Work hereunder, pursuant to Section 4.2, if Contractor delegates or otherwise transfers any of its obligations or performance hereunder, whether voluntarily, involuntarily, by operation of law or otherwise, and no such delegation or other transfer will relieve Contractor of any of such obligations or performance. For purposes of the preceding sentence, and without limiting its generality, any merger, consolidation or reorganization involving Contractor (regardless of whether Contractor is a surviving or disappearing entity) will be deemed to be a transfer of rights, obligations, or performance under this Contract for which the State’s prior written consent is required. Any purported assignment, delegation, or transfer in violation of this Section 15.8 is void.

15.9 No Third-party Beneficiaries. This Contract is for the sole benefit of the parties and nothing herein,

express or implied, is intended to or will confer on any other person or entity any legal or equitable right, benefit or remedy of any nature whatsoever under or by reason of this Contract.

15.10 Amendment and Modification; Waiver. This Contract may only be amended, modified or

supplemented by an agreement in writing signed by each party’s Contract Administrator. No waiver by any party of any of the provisions hereof is effective unless explicitly set forth in writing and signed by the party so waiving. Except as otherwise set forth in this Contract, no failure to exercise, or delay in exercising, any right,


27

remedy, power or privilege arising from this Contract will operate or be construed as a waiver thereof; nor will any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege.

15.11 Severability. If any term or provision of this Contract is invalid, illegal or unenforceable in any

jurisdiction, such invalidity, illegality or unenforceability will not affect any other term or provision of this Contract or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal or unenforceable, the parties hereto will negotiate in good faith to modify this Contract so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible.

15.12 Governing Law. This Contract is governed, construed, and enforced in accordance with Michigan law,

excluding choice-of-law principles, and all claims relating to or arising out of this Contract are governed by Michigan law, excluding choice-of-law principles. Any dispute arising from this Contract must be resolved in the Michigan Court of Claims. Complaints against the State must be initiated in Ingham County, Michigan. Contractor waives any objections, such as lack of personal jurisdiction or forum non conveniens. Contractor must appoint agents in Michigan to receive service of process

15.13 Equitable Relief. Each party to this Contract acknowledges and agrees that (a) a breach or

threatened breach by such party of any of its obligations under this Contract would give rise to irreparable harm to the other party for which monetary damages would not be an adequate remedy and (b) in the event of a breach or a threatened breach by such party of any such obligations, the other party hereto is, in addition to any and all other rights and remedies that may be available to such party at law, at equity or otherwise in respect of such breach, entitled to equitable relief, including a temporary restraining order, an injunction, specific performance and any other relief that may be available from a court of competent jurisdiction, without any requirement to post a bond or other security, and without any requirement to prove actual damages or that monetary damages will not afford an adequate remedy. Each party to this Contract agrees that such party will not oppose or otherwise challenge the appropriateness of equitable relief or the entry by a court of competent jurisdiction of an order granting equitable relief, in either case, consistent with the terms of this Section 15.13.

15.14 Nondiscrimination. Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., and

the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, marital status, or mental or physical disability. Breach of this covenant is a material breach of this Contract.

15.15 Unfair Labor Practice. Under 1980 PA 278, MCL 423.321, et seq., the State must not award a

contract or subcontract to an employer whose name appears in the current register of employers failing to correct an unfair labor practice compiled under MCL 423.322. This information is compiled by the United States National Labor Relations Board. A contractor of the State, in relation to the contract, must not enter into a contract with a subcontractor, manufacturer, or supplier whose name appears in this register. Under MCL


28

423.324, the State may void any contract if, after award of the contract, the contractor as an employer or the name of the subcontractor, manufacturer or supplier of the contractor appears in the register.

15.16 Schedules All Schedules that are referenced herein and attached hereto are hereby incorporated by

reference. The following Schedules are attached hereto and incorporated herein:

Exhibit 1 Business Continuity and Disaster Recovery Plan (To be provided by Contractor)

Schedule A Statement of Work for Fiscal Year 2017

Schedule B Business Requirements

Schedule C SSAE 16

Schedule D Technical/ General System and Functional Requirements of COMPAS Suite Software

Schedule E Reporting Service Level Agreements – Performance Metrics

Schedule F Monthly Narrative Progress Reports

Schedule G Software Licensing

Schedule H Glossary

Schedule I Pricing

15.17 Counterparts. This Contract may be executed in counterparts, each of which will be deemed an original, but all of which together are deemed to be one and the same agreement and will become effective and binding upon the parties as of the Effective Date at such time as all the signatories hereto have signed a counterpart of this Contract. A signed copy of this Contract delivered by facsimile, e-mail or other means of electronic transmission (to which a signed copy is attached) is deemed to have the same legal effect as delivery of an original signed copy of this Contract


29

Exhibit 1 Northpointe Business Continuity Plan

Business Continuity Northpointe’s ability to continue delivering its products and/or services at acceptable predefined levels following a disruptive incident is paramount to customer success. Continuity of services is based on a strategy that identifies threats and risks that could occur, and ways to protect priority assets and personnel.

Information technology systems require hardware, software, data and connectivity to function as expected. Without a component of the “system” intact, the system may fail, creating impact to business critical functions, employees and customers that host web applications with Northpointe directly. Therefore, Northpointe’s recovery strategies anticipate the loss of one or more of the following system components:

• Computer room environment/data center (secure computer room with climate control, conditioned and backup power supply, etc.)

• Hardware (networks, servers, desktop and laptop computers, wireless devices and peripherals) • Connectivity to a service provider (fiber, cable, wireless, etc.) • Software applications (electronic data interchange, office productivity, etc.) • Data and restoration

Northpointe’s critical business applications required for internal operations and longevity are provided via its corporate parent company and are therefore hosted offsite. Daily functions can continue with employees working remotely if necessary.

Some business applications cannot tolerate any downtime and Northpointe customers that rely on hosted applications to perform required processing fall into this category. Northpointe utilizes geo-replication (dual data centers located in different areas of the continental United States) capable of handling all data processing needs, which run in parallel with data mirrored between the two centers. Both data centers are owned and operated by Amazon Web Services.

Hosted Platform Overview Northpointe has chosen the Amazon GovCloud (US) as the platform best suited for hosting needs. https://aws.amazon.com/govcloud-us/

AWS GovCloud (US) is an isolated AWS region designed to host sensitive data and regulated workloads in the cloud, helping customers support their U.S. government compliance requirements, including the International Traffic in Arms Regulations (ITAR) and Federal Risk and Authorization Management Program (FedRAMP). AWS GovCloud (US) is operated by employees who are vetted "U.S. Persons" and root account holders of AWS accounts must confirm they are U.S. Persons before being granted access credentials to the region.

AWS GovCloud (US) is available to U.S. government agencies and organizations in government-regulated industries, which meet GovCloud (US) requirements for access.

FedRAMP is government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. AWS GovCloud (US) has received a Provisional Authority to Operate (P-ATO) from the Joint Authorization Board (JAB) under the Federal Risk and Authorization Management Program (FedRAMP) High baseline.

Disaster Recovery Approach Northpointe’s archival and retention approach begins with our backup solutions. These backup files are the foundation of Northpointe’s ability to recover quickly and efficiently in the event of system failure.

Northpointe’s data archival process and retention approach is designed for methodic redundancy (multiple stage backups), and quick restoration of services. Daily incremental database snapshots and full nightly backups are managed

https://aws.amazon.com/govcloud-us/

https://aws.amazon.com/what-is-cloud-computing/

https://www.fedramp.gov/


30

through the SQL Server Agent. GovCloud Amazon S3, Amazon Glacier, and Amazon EBS are “standard tools” for data archival in the GovCloud.

Northpointe retains backups on encrypted EBS volumes. Production data transaction logs are tracked every 5 minutes. Nightly snapshots of the EBS volumes are maintained, and 5 days of those backups are stored on secondary servers.

Daily audit processes includes specialized automated alerts and notifications designed to immediately notify the Northpointe engineers and DevOps support team if security or operational integrity is compromised. This includes latency issues and/or external connectivity errors.

General incidents can be reported through the Northpointe support Zen Desk online system. Priority 1 issues (I.E. site access failure) can be reported 24 hours a day for customers enrolled in that advanced support plan. Notification of an “incident” launches the Hosted Service Interruption Response Plan for all hosted sites, both internal (Northpointe training and demo) and external (customer).

Data Recovery time targets are less than 2 hours (customer restoration dependent upon backup database size for transfer and reload), but should never exceed one business day for load time.

Hosted Service Interruption Response & Action Plan

1. Service interruption is reported: a. Reported by Customer b. Reported by Automated alert c. Reported by Customer Care

2. Service interruption is documented by Customer Care: a. Source of report (name of reporter) b. How was the incident detected? c. Time of report d. Call back information of customer e. Is it customer specific or does it affect all sites f. Description of incident g. Attach relevant documentation, logs, screen shots, etc. h. Estimate the impact:

i. Total outage ii. Slowness iii. Timeout iv. Intermittent loss of service.

3. Prioritize interruption (P1 – P4). 4. Assign to an appropriate support level based upon prioritization level (P1-P2 support resource).

a. Notify management (Operations, Software Development Manager, Technical Support Manager) of any P1 level incidents within 10 minutes.

5. System failure event: a. Notify Customer administrator directly confirming problem

i. “We are responding to your issue. We determined that it was a system wide interruption… It has been assigned to … We will send an update in 20 minutes…”

b. Redirect traffic to geo-replicated application located in secondary data center. c. Test responsiveness d. Notify customer of status e. Initiate customer test facilitation

f. P1 to respond to customer directly once problem has been temporarily rectified:

i. “We are investigating initial issue. We will send an update in 1 hour…” 6. System Performance event (response, page server, latency, etc):

a. Monitor the issue; communicate with customer as needed: b. We determined additional issues are… c. It will take XX hours to restore service… d. We will update you in…


31

7. Service has been restored: a. “We resolved the issue; here are the details”

i. This is what happened- 1. Describe issue 2. Service was restored after X hours

ii. This is what we did to fix it iii. L1 Customer care communicates to customer(s) within 1 hour of resolution.

b. “We resolved the issue but we do not know root cause” i. This is what we did to restore service ii. This is what we are doing to determine what happened iii. L1 – We will update you in 24 hours. iv. Iterate until root cause is discovered.

ROLES & RESPONSIBILITY ASSIGNMENTS This document outlines the summary of the roles and responsibilities for the Northpointe Development Operations and management team. These assignments relate to Northpointe owned internal systems only, and the information secured therein. The following Roles and Responsibility Matrix describe 4 activities:

1) Responsible (R) – Person working on activity 2) Accountable (A) – Person with decision authority and one who delegates the work 3) Consulted (C) – Key stakeholder or subject matter expert who should be included in decision or work activity 4) Informed (I) – Person who needs to know of decision or action

In a total system and/or bandwidth failure extending beyond a regional failure, the following roles and tasks will be required to accomplish system rebuild and security settings within the Northpointe physical office:

Roles Dat

a O

wne

r Sy

stem

Ow

ner

Syst

em

Adm

in/D

evel

oper

D

O/In

form

atio

n Se

curit

y O

ffice

r Tasks Configure information system to protect the integrity of transmitted information

R

A

R

R

Configure information system to protect the confidentiality of transmitted information

R

A

R

R

Configure wireless communications to utilize a encryption algorithm

R

A

Manage cryptographic keys R R A

Generate encryption keys through an approved package A R R

Secure private keys in motion or at rest A R R

Implement required cryptographic protections A R R

Define and document the selection and deployment of encryption technologies

A/R

Document appropriate encryption processes A/R

Employ encryption over networks A R R

Use data classification process to finalize application development processes

A/R


32

Include the proper use of encryption in training program A/R

Follow policy to issue public key certificates A R R

Select and implement protection mechanisms A R R

Protect the confidentiality and integrity of information at rest

A

R

R

Communication Plan & Work Base Communication during any critical incident or service failure is required. Northpointe will initiate communications to the proper audience identified based upon the type of incident or the potential impacts of an incident. The following list identifies the incidents that will trigger communication:

• accidents that injure employees or others [internal] • property damage to facilities [internal, external] • liability associated injury to or damage sustained by others [internal] • production or service interruptions for hosted accounts [internal, external] • issues with potential off-site consequences, including hosting [internal, external] • product quality issues [external]

The communications team, including select members of the management team, will work from an office to support the work effort and oversee contact. The offices used will be located at the business main office or at an alternate site if the main office site cannot be occupied. Business activity can be mobilized with ease given the technology in use and the existing hosting and development redundancies built into the environments. Ongoing activity can be achieved remotely by all company personnel, including the management team if necessary barring nation-wide internet failure.

The goal of the communications team is to gather information about the incident and facilitate two-way communications for external stakeholders when/if necessary. This includes monitoring the types of questions posed to support representatives or staff. Emails received by Customer care and/or any website or news activity will also be monitored for dissemination purposes.


33

Schedule A Statement of Work (SOW)

1.000 Project Identification 1.1 PROJECT REQUEST

The purpose of this Contract is to provide maintenance and support, update/modification, reliability & validity testing and on-site staff training for the Correctional Offender Management Profiling for Alternative Sanctions (COMPAS) Suite. The COMPAS Suite is used as the Automated Offender Risk Assessment System (AORAS) by the Michigan Department of Corrections (MDOC) and the Office of Community Corrections (OCC) Community Corrections Advisory Boards (CCAB) in the reentry effort. The COMPAS generated assessment will form the basis of offender case planning and management. COMPAS Suite may interface with MDOC’s Offender Management Network Information (OMNI) and Offender Management Systems (OMS), or any future applicable offender systems, per specific service request.

1.2 BACKGROUND COMPAS Suite has been essential for offender success in assimilating back into the community. Through the development of COMPAS Suite and interface with OMNI and OMS, evidence based practices have been fully utilized for identifying the risks, needs, and strengths for offenders to access the services and programming they need.

1.100 Scope of Work and Deliverables 1.101 IN SCOPE This project consists of the following scope:

1. Software User License (two digital licenses: MDOC, OCC-CCAB instances) 2. Maintenance and Support Services 3. Training and Documentation 4. Subject Matter Expert Support and Consultation 5. Software Customization and/or Configuration 6. Research Studies and Support Services 7. Project Management 8. Hosting and Storage for the OCC-CCAB stand-alone system only

The State reserves the right to procure additional licenses, maintenance, support, training and proprietary services. A detailed description of the services and deliverables available for this project is provided in Article 1, Section 1.104, Work and Deliverables. The State may finalize specific services per annual term based upon the Work and Deliverables offered by the Contractor. The Work and Deliverables will be requested and finalized through a purchase order for each fiscal year, as approved by the State.

1.102 OUT OF SCOPE Modification, rewrite or replacement of the OMNI and OMS is out of scope for this Contractor.

1.103 ENVIRONMENT The links below provide information on the State’s Enterprise information technology (IT) policies, standards and procedures which includes security policy and procedures, eMichigan web development, and the State Unified Information Technology Environment (SUITE).


34

Contractors are advised that the State has methods, policies, standards and procedures that have been developed over the years.

Enterprise IT Policies, Standards and Procedures: http://michigan.gov/dtmb/0,4568,7-150-56355_56579_56755---,00.html

All software and hardware items provided by the Contractor must run on and be compatible with the DTMB Standard Information Technology Environment. In addition, the DTMB must ensure that the Contractor System Requirements for the COMPAS Suite are implemented and maintained in order to achieve expected application performance within the DTMB data center.

Enterprise IT Security Policy and Procedures: http://www.michigan.gov/documents/dmb/1210.32.pdf http://www.michigan.gov/documents/dmb/1325_193160_7.pdf http://www.michigan.gov/documents/dmb/1335_193161_7.pdf http://www.michigan.gov/documents/dmb/1340_193162_7.pdf

The State’s security environment includes: • DTMB Single Login. • DTMB provided SQL security database. • Secured Socket Layers. • SecureID (State Security Standard for external network access and high risk Web systems)

ADA Compliance

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA), and has adopted a formal policy regarding accessibility requirements for websites and software applications. The State is requiring that Contractor’s solution conform, where relevant, to level AA of the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.0. Contractor may provide a description of conformance with the above mentioned specifications by means of a completed Voluntary Product Accessibility Template for WCAG 2.0 (WCAG 2.0 VPAT) or other comparable document. Contractor may consider, where relevant, the W3C’s Guidance on Applying WCAG 2.0 to Non-Web Information and Communications Technologies (WCAG2ICT) for non-web software and content. Any additional compliance requirements shall be specified in the Statement of Work.

Look and Feel Standard

All software items provided by the Contractor must adhere to the Look and Feel Standards www.michigan.gov/somlookandfeelstandards.

The State Unified Information Technology Environment (SUITE): Includes standards for project management, systems engineering, and associated forms and templates – must be followed: http://www.michigan.gov/suite

Contractor Provided Hosting Environment: OCC-CCAB System A. COMPAS Application Server

o Operating System - Windows Server 2012 R2 o IIS 8.5 o .Net Framework 4.5

B. MS SQL Database Server

o Operating System - Windows 2012 R2 o SQL Server 2014

http://michigan.gov/dtmb/0%2C4568%2C7-150-56355_56579_56755---%2C00.html

http://www.michigan.gov/documents/dmb/1210.32_Information_Processing_Report_390411_7.pdf?20150721085447

http://www.michigan.gov/documents/dmb/1210.32_Information_Processing_Report_390411_7.pdf?20150721085447

http://www.michigan.gov/documents/dmb/1325_193160_7.pdf





http://www.michigan.gov/somlookandfeelstandards


35

State Client Environment Software Specifications (to be provided by the State) • Internet Browsers: Windows Internet Explorer version 11, Chrome • Adobe Reader 9.0

Client Environment Hardware Specifications (to be provided by the State)

• Operating System: Windows 7, 8 • MDOC Specific Technical Environment • Hardware/Network Environment • Intranet (SOM-only) browser-based application • Application and database servers Windows 2012 in NGDI Virtual Environment • Database MS SQL 2012 • COMPAS website site hosted on IIS 8.5 • Clients running Windows 7, 8, and 10 • Clients using IE11 browser. • Minimum System requirements for COMPAS applications/servers: • Server OS: Windows Server 2008 R2 • Database: MS SQL 2008 R2 • Webserver: IIS 7 • Client OS: Windows 7 • Web Browser: IE 9

1.104 WORK AND DELIVERABLES I. Services and Deliverables to Be Provided Contractor must provide services and software licenses necessary for the performance of work, as mutually agreed upon. This section defines the available billable service categories and corresponding deliverables available per the terms of this agreement; the State will request services and deliverables to be implemented per contract term. All services and deliverables will be mutually agreed upon and defined in a Statement of Work attached to the annual Purchase Order prior to project initiation by the Contractor.

A. Service Categories

a. Consulting The Contractor may perform consulting work that focuses on field practices and policy implementation in the software. Consulting deliverables include, but are not limited to, the following:

Software configuration audits to support the MDOC’s ongoing business processes – onsite and remote consulting; hours specified per request. Advanced consulting sessions for Judges at Pre-Sentence Investigation – 1 day, onsite. Subject matter expert support/field practice consulting – 1 day, onsite: • Implementation support for the purpose of incorporating an evidence-based service model

system wide • Analysis and interpretation supporting logic • Strategic planning • Policy and procedure review • Organizational decision making support • Resource management • Key stakeholder consideration • Outcomes monitoring support • Other services as required and approved by the MDOC Project Manager (PM)


36

• Interpretation: provide for the knowledge transfer/transition related to the logic model and research behind the COMPAS application, software application design, and application development.

b. Training

The Contractor may perform training services based upon the MDOC’s need for field training. Training is delivered onsite by a Contractor approved trainer with expertise in the COMPAS application. Training must be provided in a variety of formats commensurate with subject matter and level (e.g., basic, advanced, refresher, etc.) as mutually agreed upon by the Contractor and MDOC. Training components must include introductory, advanced, update and Train-the-Trainer sessions. End user and/or web based training will be provided as requested. The following trainings are available:

Basic Software Training – 2 days, onsite (up to 15 training participants): Basic COMPAS software training is conducted for multiple end users, such as MDOC Staff,

Judges, Prosecutors, Defense Bar, and Subcontractors WRNA Basic Software Training – 2 days, onsite (up to 15 training participants). Youth Basic Software Training – 2 days, onsite (up to 15 training participants). Advanced Case Planning – two days, onsite (up to 15 training participants). Train the Trainer – four days, onsite (up to 10 training participants): Impart and develop knowledge base of the COMPAS Suite and required skill-sets for the

purpose of educating others in the agency. This training is for advanced COMPAS users with field experience using assessments and case plans. Any costs related to the training updates of MDOC Training staff to ensure the fidelity of COMPAS Suite Training delivery must be figured into the cost of this deliverable.

Train the Trainer - COMPAS Core/Reentry/Youth Train the Trainer – Women's Risk Needs Assessment (WRNA)

Technical Training – 1 day, remote or onsite. Training focuses on configuring the application including establishing databases and interface with external systems, customization, and upgrading the customized software. Technical personnel only.

System Administration Training - .5 day, remote or onsite. System administration training for State personnel who will be responsible for ongoing maintenance and administration of the system, including security.

Training services include training materials as requested. Training preparation and custom materials are estimated in addition to the onsite training time outlined above; training preparation will be tracked and invoiced according to the firm fixed price for the session.

Contractor shall be responsible for travel costs and any expenses incurred by their staff during the facilitation of any training sessions at no cost to the State. Training preparation, curriculum development, travel time, etc, must be configured into the firm fixed price as mutually agreed upon for each session.

The State shall provide training sites, necessary hardware and coordinate services for the purpose of training facilitation at no cost to the Contractor.

All training manuals, training plans and other documentation provided become the property of the State.

The Contractor must provide one (1) electronic copy of all manuals. The State is permitted to reproduce copyrighted materials for the sole use by the State. The Contractor must provide all training materials to the State requestor no later than 5 business days prior to training.

c. Technical Support


37

Offline module setup and configuration – remote and onsite. Advanced upgrade support for implementation – remote. Environmental reviews/audit for DTMB technical staff – remote.

d. Software Development Customizations

All software development customization work requires the State Project Manager approval prior to scheduling service delivery with the Contractor. The Contractor will manage the requirements specification phase of custom development prior to approving or scheduling any software development work. All custom requests are vetted by the Contractor to determine impact of request against the software code base; COMPAS is an off the shelf system and must maintain market integrity. Customizations are scheduled for development in Contractor software releases based on availability and completion of an approved requirements specification document.

System interface requirements for any third party system, or State owned system requiring data exchange capabilities. The Contractor will work with the State to finalize technical system requirements for interfacing with OMNI, OMS, or any future system. Contractor maintains an API service library for all interface capabilities to the COMPAS application. The State will implement the necessary API interface within any state-owned or third party system that will interface with the COMPAS application. The Contractor is responsible for the COMPAS application API configuration and setup only.

• Remote and/or onsite service per request. MDOC Integration: Offender demographic information for COMPAS Suite intake

assessment. Only demographic data elements have been identified for inclusion in the demographic interfaces. Existing COMPAS API service will be utilized to interface with the system(s).

Software enhancement requirements for any new software development build request. Requirements must be defined by the State and documented by the Contractor for final sign off and acceptance prior to software development work initiation. This includes requirements for minor and major software enhancements to the COMPAS application. Remote and/or onsite service per request.

The Contractor reserves the right to accept or reject software enhancement requests based upon impact to the application code base.

A new Offender Classification module may be defined and documented with a formal requirement specification document.

Software interface development and quality assurance – remote. System testing for any customization performed by the Contractor. Contractor must provide test scripts and results to the State for confirmation of system performance. This service will require State resources to perform full system testing with any other third party or state-owned system – remote. Software enhancement development and quality assurance – remote.

• Requested software customization must be submitted to the MDOC Automated Data Support Services (ADSS) and approved by the MDOC and DTMB Project Managers prior to the Contractor beginning work.

The Contractor will deliver software customizations via new software releases when all development, unit testing and system testing is complete and approved. The Contractor will schedule software releases containing new custom developed features with the MDOC Project Manager to ensure the MDOC has scheduled resources for final UAT testing.


38

The State Project Manager will track UAT issues in an issue log and submit any noted issues to the Contractor Project Manager for review and the Contractor Project Manager will establish a time line for resolution to be reviewed and accepted by the State Project Manager or designee. Both the Contractor and the State must have access to the issue log to track progress. The requirement specification will be used to determine acceptance of all documented specifications; any issue or request that is outside the scope of the requirement specification will require a Change Control.

e. Research Research Norming, Validation Studies: ongoing support of the Contractor Research division to work with the State’s Research Department on norming and validation studies. As requested by the State.

The Contractor will complete Norming and Validation studies at the request of the State using data collected from COMPAS applications and MDOC data sources. MDOC shall consult with Contractor when setting parameters to gauge outcomes. Contractor must provide analysis in conjunction with a written Validation Report containing an Executive Summary at a mutually agreed upon date.

In coordination with MDOC, Contractor will collect COMPAS assessment data in conjunction with new arrest or conviction, technical violation, revocations, and return to prison data to conduct an outcomes study to determine the predictive accuracy of the:

Core and Reentry COMPAS risk scoring Women’s COMPAS norming and risk scoring Youth COMPAS norming and risk scoring Other as determined by the State, i.e., Core COMPAS

Contractor will perform statistical analysis on the outcome data (i.e., technical violations, absconds, revocations, and new arrests); review cut point rules/guidelines; conduct initial survival analysis and strengthen/refine scoring as needed. Contractor will then provide an electronic technical report to the MDOC at the conclusion of the study.

Probation Local Validation Contractor will collect the completed COMPAS assessments from MDOC, provide data preparation, coding, cleaning, conduct reliability assessments, norming and calibration, perform analysis and comparisons between MDOC data and existing national norms, and conduct validation studies (concurrent validity). Contractor will provide an electronic Technical Report to MDOC at a mutually agreed upon date.

Outcomes Study: Outcomes and calibration tests for violent felony offense (VFO) and non-VFO reentry risk. The Contractor may update the Reentry outcomes data. The Contractor will check the calibration of the Reentry VFO Risk and Non-VFO Risk scales, including tests in new data. Study results and recommendations will be drafted and delivered by Contractor via one brief

(1-3 pages) electronic technical report.

Outcomes Study: outcomes & calibration tests for VFO/non-VFO Core probation. The Contractor will update the probation outcomes data. The Contractor will check the calibration of the probation VFO Risk and Non-VFO Risk scales in the software application, including tests in new data. Study results and recommendations will be drafted and delivered by Contractor via one brief

(1-3 pages) electronic technical report.

Inter-rater Reliability: The Contractor will research and determine the feasibility of a quality assurance feature within the software to support inter-rater reliability. Research personnel will work with the State to develop specifications for a system to track quality assurance/inter-rater


39

reliability within the State owned Test site. Research will lead the inter-rater reliability planning of and will oversee the development of a specification outlining this feature/module that may be scheduled for future custom software development.

Assessment Maintenance: The Contractor will provide research support and expertise to work collaboratively with the MDOC to review the existing COMPAS application’s questions in the assessment scales. The Contractor’s offsite and onsite consultation will determine if changes can be made to the COMPAS application scales, while maintaining the validity of the assessment scoring.

f. Project Management The Contractor will provide a Project Manager to interact with the designated personnel from the State to insure a smooth transition to the new system. The project manager/technical lead will coordinate all of the activities of the Contractor personnel assigned to the project and create all reports required by State. The Contractor's project manager/technical lead responsibilities include, at a minimum:

a. Manage all defined Contractor responsibilities per the approved Scope of Services for the agreed

upon term b. Manage Contractor’s subcontractors, if any c. Develop the project plan and schedule, and update as needed d. Serve as the point person for all project issues e. Coordinate and oversee the day-to-day project activities of the project team f. Assess and report project feedback and status g. Escalate project issues, project risks, and other concerns h. Review all project deliverables and provide feedback i. Utilize change control procedures j. Prepare project documents and materials k. Manage and report on the project’s budget l. Participate in MDOC site reviews to ensure contract compliance.

g. Proprietary Rights

Contractor will retain exclusive ownership in all deliverables created by Contractor hereunder and will own all intellectual property rights, title and interest in any ideas, concepts, know how, documentation or techniques developed by Contractor under this Agreement. Contractor will also retain all intellectual property rights with respect to the tools and/or software that Contractor uses to deliver the Services. Subject to payment in full for the applicable Services, Contractor grants Customer a perpetual, non-exclusive, non-transferable, royalty-free right to use the deliverables solely for Customer’s internal use.

h. Limited Warranty

CONTRACTOR WARRANTS THAT SERVICES WILL BE PERFORMED IN A GOOD AND WORKMANLIKE MANNER. EXCEPT AS EXPRESSLY STATED IN THE PRECEDING SENTENCE, CONTRACTOR MAKES NO EXPRESS OR IMPLIED WARRANTIES WITH RESPECT TO THE SERVICES, INCLUDING BUT NOT LIMITED TO, ANY WARRANTY RELATING TO THIRD PARTY PRODUCTS OR THIRD PARTY SERVICES; ANY WARRANTY WITH RESPECT TO THE PERFORMANCE OF ANY HARDWARE OR SOFTWARE USED IN CONDUCTING SERVICES; ANY WARRANTY CONCERNING THE RESULTS TO BE OBTAINED FROM THE SERVICES ,ANY IMPLIED WARRANTIES CONCERNING THE PERFORMANCE, MERCHANTABILITY, SUITABILITY, NON-INFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE OF ANY OF THE DELIVERABLES OR OF ANY SYSTEM THAT MAY RESULT FROM THE IMPLEMENTATION OF ANY RECOMMENDATION CONTRACTOR MAY PROVIDE.


40

B. Software License

Deliverable(s) 1. Software Module Licensing

The Contractor must provide the State and the OCC-CCAB unlimited user licenses for the term of the Contract. See Schedule G - Software Licensing Specifications for a list of all software modules.

C. Documentation

Technical Manuals Contractor’s technical documentation is maintained in an electronic format and stored online for easy access. This includes the following:

a. User and Technical Manuals b. Configuration/System Administration Manual

The following documentation is provided for services per request:

a. End-User training manuals to be used as a basis for “User Manuals” and online help at State’s discretion b. Installation procedure c. Module configuration documents sufficient for configuration maintenance purposes d. Specification documentation (customization service, project specific)

1. The documentation of system components, features, and use of the software must be detailed such that

resolution of most problems can be determined from the documentation, and most questions can be answered.

2. All system, operational, user, change, and issue documentation must be available in electronic format, updated regularly, with unique numerical identifiers for each section and be consistent with the most current version of the application(s).

3. Documents created independently by the State are the property of the State. Contractor may not use or reproduce this property without the express written consent of the State.

D. Maintenance and Support

Deliverable(s) 1. Maintenance and Support Services Contractor must provide key personnel for the purpose of on-going technical support of the COMPAS Suite to authorized DTMB and MDOC staff. DTMB, MDOC and the Contractor must maintain a list of authorized staff for the term of the Contract. Virtual Private Network (VPN) access may be granted and authorized by MDOC and DTMB Project Managers to the Contractor as necessary. Contractor must provide technical support from 8 a.m. to 5 p.m. EST, Monday through Friday via:

• Online Support System (Customer Care, Zendesk system) • All communications managed and tracked via assigned Ticket Number for authorized personnel. • Authorized personnel are assigned at the discretion of the State. Contractor is not responsible for

assigning user accounts. • A Contractor provided toll-free phone number.

Administrative Access for Remote Support


41

The COMPAS Suite must allow on-site administrator access for system configuration. Except for scheduled maintenance events, (software bugs, fixes, enhancements, new releases and updates/upgrades), Contractor must ensure State Administrative Access and user access to the COMPAS application 24x7x365 to meet the requirements set by regulating agencies and/or institutions.

Support Services The Contractor will provide software support for software bugs, fixes, new releases and updates/upgrades through its Customer Care division and online support system for the following:

a. Error Correction. Upon notice by State of a problem with the Software (which problem can be

verified), to correct or provide a State approved working solution for the problem. b. Material Defects. Contractor must notify the State of any material errors or defects in the

deliverables known, or made known to Contractor from any source during the Contract term that could cause the production of inaccurate, or otherwise materially incorrect results, and must initiate actions necessary to effect corrections of any such errors or defects.

c. Updates. All new releases and bug fixes for any software deliverable developed or published by Contractor and made generally available to its other customers must be provided to the State at no additional charge.

d. Tool Interpretation. Contractor must respond to all requests from the State Project Manager(s) regarding information, clarification, or interpretation of the Assessment tools. If required, Contractor must respond in the defense or explanation of the Contractor’s COMPAS Suite product, data analysis, resulting findings, theory or intellectual properties.

e. Request for Information. Any request for information concerning State of Michigan’s use of COMPAS Suite that is received from sources outside of the MDOC requires MDOC Project Manager approval. Contractor must notify the MDOC Project Manager regarding outside requests for information and subsequent Contractor responses, as they relate to Michigan’s use of COMPAS Suite.

All software bugs, fixes, enhancements, new releases and updates/upgrades must be fully tested on Contractor’s system that is compatible with MDOC’s production environment, tested on a State approved test site and accepted by MDOC prior to Production implementation. MDOC is responsible for requesting all upgrades and managing the process internally to complete the release upgrade in the DTMB hosted production environment.

Release Management Contractor will provide Maintenance and Support Services only for the most current release and the immediately preceding major release of the Software at no additional cost. Contractor may elect to cease supporting a platform upon twelve (12) months’ notice to the CUSTOMER. Contractor shall have no responsibility under this Agreement to fix any errors in the Software arising out of or related to the following: (a) the State’s modification or combination of the Software (in whole or in part), (b) use of the Software in an environment other than any hardware and operating system platform which Contractor supports for use with the Software; or (c) hardware problems in the State owned data center. Any corrections performed by Contractor for such errors shall be made, at the Contract rates.

Contractor will provide updates for the Software as and when developed for general release in accordance with the agreed upon schedule. Each update will consist of a set of files made available electronically and will be defined by Documentation (Release Notes) adequate to inform the State of the problems resolved and any significant operational differences resulting there from.

Software Upgrades The State is responsible for documenting an Upgrade Procedure to follow when Contractor makes new software releases available. Contractor releases multiple software versions per calendar year. It is recommended that the State document the procedure for testing and accepting software upgrades released by Contractor, and for making new versions of the system documentation available to all Agency locations.


42

The State will request a software upgrade from the Contractor, and the upgrade will be scheduled for Contractor technical personnel. The MDOC system instance is upgraded by DTMB personnel. The OCC-CCAB system instance is upgraded by Contractor personnel.

Contractor will not install a new software release in a Contractor hosted Production environment without express approval from the State.

The Contractor must provide the anticipated date of the next major release 90 calendar days prior to implementation so that MDOC/DTMB Project Managers have the ability to coordinate deployment that is mutually agreed upon by the parties.

E. Hosting Services Contractor will provide a hosted Web based UAT and Production environment to the State for the OCC-CCAB system instance only. The UAT and Production environments will be available to the OCC-CCAB staff during normal business hours, 8:00 a.m. through 5 p.m. EST., Monday through Friday. The OCC-CCAB environment/s will be updated in conjunction with the MDOC state-hosted system per approval from authorized personnel. It is recommended that system upgrades be performed to keep the two separate Production systems (MDOC and OCC-CCAB) in sync with one another; Contractor will perform upgrades upon receipt of upgrade request from the State.

The scope of Contractor’s hosting services for the OCC-CCAB system includes the operation, maintenance, and support of the:

• Application and SQL Database hosted under this agreement • Database security • Database Backup services, with retention • Data Center server operation.

Amazon Web Services Service Level Agreement Amazon Web Services (AWS) GovCloud platform is the hosting provider for Northpointe’s hosting services. AWS provides server hardware, scheduled maintenance services, replication and back-up utilities.

AWS guarantees its network uptime to be 99.99%. This guarantee assures that all major routing devices within the data center and internal network are reachable from the United States internet 99.99% of the time. AWS’s hosting SLA includes exclusions for scheduled maintenance, malicious attacks, and legal actions that may impact network uptime.

A. Application

Application refers to the State’s software licensed from Contractor pursuant to this agreement. The Application is hosted by Contractor pursuant to this Agreement.

B. Support Software Support Software includes the operating system, utilities, database software, monitoring services and necessary licenses required to operate the Application and is provided by Northpointe as part of the scope.

• Monitoring includes Maintenance and Performance monitors on bandwidth access (connectivity), server up time and processing stability, unauthorized access, and back door attacks. 24x7 monitoring is performed by Contactor personnel.

C. Backups

The Production Database will be backed up two times per day:


43

• Full back-up of Production database files executed at 7:00AM EST • Full back-up of Production database files executed at 7:00PM EST • Backups are physically stored in the assigned AWS data center; all data is stored within the United

States physical borders. • Backup files are retained for 14 calendar days. • A copy of the backup files are securely transferred on a daily schedule to an encrypted storage

volume located in a second storage location within an assigned data center. Files are encrypted during transport and while at rest.

• All backup files are stored electronically and available to the State through the Contractor, on approved servers. No other media is used to backup, store, or secure offsite backups.

Hours of System Operations The Application will be accessible and available to the State and capable of normal operating functions 24 hours a day, seven days a week, except for periods of Scheduled Maintenance and previously approved outages communicated by the hosting provider. Contractor will not be responsible for inaccessibility arising from communications problems occurring anywhere beyond the Contractor production server side of the router resident at the AWS Data Center.

Compliance Status

State Responsibilities The State OCC-CCAB is responsible for:

• Assigning a primary and alternate representative to coordinate all communications and activities related to Contractor hosting services. These representatives should be authorized decision-makers with appropriate technical capabilities.

• Providing user identification data and determining the appropriate security profile for each user account within the software application. State will control security at the Application level within all hosted environments.

• All printing activities. No print job will print at the Data Center and all physical printing requirements will be handled by the State. This includes the purchase and installation of printers at State’s sites for the Application being utilized as defined in this agreement.

• Installing, operating and maintaining all workstation software (and State’s LAN, existing data communications configuration, hardware, or software required at the State’s site) except as otherwise stipulated in the Scope of Services. Contractor network and network responsibility includes the data center hardware configuration (servers, routers) to the boundary of the State network. Internet bandwidth and uptime from the State entry point (physical location/s) is the responsibility of the State.

• Requesting and scheduling all software release upgrades with Contractor technical staff. This must be performed a minimum of once per contract year in order to maintain compliance with Contractor’s End of Life Software Policy.

• Testing application upgrades and/or application fixes applied by Contractor to Applications used by State. State will test all software release updates and fixes prior to their introduction to the State’s Production environment within a mutually agreed upon time frame. Approval to alter the hosted test and production environments is required by the State.

1.200 Roles and Responsibilities 1.201 CONTRACTOR STAFF, ROLES, AND RESPONSIBILITIES


44

A. Contractor Staff The Contractor will provide resumes of staff, including subcontractors, who will be assigned to the Contract, indicating the duties/responsibilities and qualifications of such personnel, and stating the amount of time each will be assigned to the project. The competence of the personnel the Contractor proposes for this project will be measured by the candidate’s education and experience with particular reference to experience on similar projects as described in this Statement of Work. The Contractor will provide sufficient qualified staffing to satisfy the deliverables of this Statement of Work.

1. Single Point of Contact

The Contractor will identify a Single Point of Contact (SPOC). The duties of the SPOC shall include, but not be limited to:

a. Supporting the management of the Contract b. Facilitating dispute resolution c. Advising the State of performance under the Terms and Conditions of the Contract

The State reserves the right to require a change in the SPOC, at any point in time, if the assigned SPOC is not, in the opinion of the State, adequately serving the needs of the State.

2. Key Personnel

The contractor must submit a letter of commitment for Key Personnel, signed by the identified resource, stating their commitment to work for the contractor/subcontractor. If the identified personnel are currently assigned to a State project the contractor must provide a letter signed by the State Project Manager releasing the individual from the project upon execution of the contract.

The Contractor will provide, and update when changed, an organizational chart indicating lines of authority for personnel involved in performance of this Contract and relationships of this staff to other programs or functions of the firm. This chart must also show lines of authority to the next senior level of management and indicate who within the firm will have prime responsibility and final authority for the work.

All Key Personnel may be subject to the State’s interview and approval process. Any key staff substitution must have the prior approval of the State. The State has identified the following as key personnel for this project:

a. Project Manager b. Technical Lead c. Data Scientist Expert

3. Subcontractors

If the Contractor intends to utilize subcontractors, the Contractor must disclose the following:

a. The subcontractor’s legal business name, address, and telephone number; a description of the subcontractor’s organization and the services it will provide; and information concerning the subcontractor’s ability to provide the Contract Activities.

b. A complete description of the work that will be performed or provided by the subcontractor. c. Of the total contract cost, the price of the subcontractor’s work.

B. On Site Work Requirements 1. Location of Work The MDOC will not require the Contractor to maintain a primary worksite in State owned buildings. However, the Contractor and any requested employee of the Contractor must be available to meet either in person or via teleconference at the request of the MDOC at a location chosen by the MDOC. The MDOC will not supply the Contractor or its employees with a work station, computer, printer, or transportation for the purposes of this work.


45

2. Hours of Operation: a. Normal State working hours are 8:00 a.m. to 5:00 p.m. EST, Monday through Friday, with work

performed as necessary after those hours to meet project deadlines. No overtime will be authorized or paid.

b. The State is not obligated to provide State management of assigned work outside of normal State working hours. The State reserves the right to modify the work hours in the best interest of the project.

c. Contractor shall observe the same standard holidays as State employees. The State does not compensate for holiday pay.

3. Travel:

a. No travel or expenses will be reimbursed. This includes travel costs related to training provided to the State by Contractor.

b. Travel time will not be reimbursed.

4. Additional Security and Background Check Requirements: While performing services under this Contract, Contractor staff has access to working with offenders (prisoners, parolees, probationers). The Contractor must complete the Law Enforcement Information Network (LEIN) Information Form providing the necessary information for those employees working under the Contract that provide direct services, handle or may have access to offender records, or provide supervisory services to staff performing any of the previously identified functions. The LEINs must be conducted to ensure staff working under the Contract have no outstanding warrants, no active personal protection orders for domestic violence, are not currently on probation or parole, or otherwise under the jurisdiction of any federal, State, county or local criminal justice agency, for a minimum of two years. The LEIN Information Form must be sent to the MDOC Program Manager prior to staff working with MDOC offenders and yearly following approval.

In Addition, if an employee of the Contractor or subcontractor has a conviction for any of the following they will not be permitted to enter any MDOC facility which houses prisoners: 1. Engaging in sexual abuse in a prison, jail, lockup, community confinement facility, juvenile facility or other institution (as defined in 42 U.S.C. 1997); 2. Been convicted of engaging in, attempting to engage in or conspiracy to engage in sexual activity facilitated by force, overt or implied threats of force or coercion, or if the victim did not consent or was unable to consent or refuse; or 3. Been civilly or administratively adjudicated to have engaged in the activity described in Number 2 above.

1.202 STATE STAFF, ROLES, AND RESPONSIBILITIES A. The State will provide the following resources for the Contractor’s use on this project:

The State will provide the following resources for the Contractor’s use on this project:

a. Meeting space for MDOC Project Manager approved meetings b. Printer c. Access to copiers and fax machine

The State project team will consist of Executive Subject Matter Experts (SME’s), project support, and a DTMB and MDOC Project Manager:

B. Executive Subject Matter Experts The Executive Subject Matter Experts representing the business units involved will provide the vision for the business design and how the application shall provide for that vision. They shall be available on an as needed basis. The Executive SME’s will be empowered to:

1. Resolve project issues in a timely manner 2. Review project plan, status, and issues 3. Resolve deviations from project plan


46

4. Utilize change control procedures 5. Ensure timely availability of State resources 6. Make key implementation decisions, as identified by the Contractor’s project manager, within 48-

hours of their expected decision date.

Name Agency/Division Title Phone/e-mail Mike Keck MDOC/Reentry

Administration/FOA Parole Probation Specialist

(517) 334-9426 [email protected]

Aneka Stewart MDOC/CFA Departmental Specialist (517) 335-1416 [email protected]

Frank Vernarsky MDOC/ADSS Departmental Manager (517) 373-7427 [email protected]

C. State Project Manager (s)- (DTMB and MDOC) 1. Project Manager

DTMB will provide a Project Manager who will be responsible for the State’s infrastructure and coordinate with the Contractor in determining the system configuration.

The State’s Project Manager will provide the following services:

a. Provide State facilities, as needed b. Coordinate the State resources necessary for the project c. Facilitate coordination between various external contractors d. Facilitate communication between different State departments/divisions e. Provide acceptance and sign-off of deliverable/milestone f. Review and sign-off of timesheets and invoices g. Resolve project issues h. Escalate outstanding/high priority issues i. Utilize change control procedures j. Conduct regular and ongoing review of the project to confirm that it meets original objectives and

requirements k. Document and archive all important project decisions l. Arrange, schedule and facilitate State staff attendance at all project meetings.

Name Agency/Division Title Mohamed Peeran DTMB -IT Project Manager Frank Vernarsky Agency Project Manager

2. Contract Administrator The Contract Administrator for each party is the only person authorized to modify any terms of this Contract, and approve and execute any change under this Contract (each a “Contract Administrator”):

State: Contractor: James Topping 525 West Allegan St. Lansing, MI 48929 [email protected] (517) 284-7032

3. Program Manager The Program Manager for each party will monitor and coordinate the day-to-day activities of the Contract (each a “Program Manager”):





47

State: Contractor: Mike Keck [email protected] (517) 334-9426

4. Contract Manager The Contract Manager will monitor and coordinate the non-day-to-day activities of the Contract. The Contract Manager will work with the Contract Administrator/Buyer/Program Manager if there are reasons to modify any terms of this Contract:

State: Contractor: Destinie Shipman [email protected] (517) 373-3320

1.203 OTHER ROLES AND RESPONSIBILITIES Name Agency/Division Role Lead’s Phone/e-mail

Department Liaison Team (DLT)

Representing all divisions of MDOC

Evaluate, Coordinate Work and Advise decisions related to this contract

Jack Beeler (517) 335-7853 [email protected]

Michigan Cyber Security

DTMB Security Assessment Review David Enslin (517) 930-6332 [email protected]

COMPAS Technical Review Committee

Representing all divisions of MDOC

Analyze, research, and advise decision making processes related to technical aspects of COMPAS Applications in their relationship to MDOC business practices.

Mike Keck (517) 334-9426 [email protected]

1.300 Project Plan 1.301 PROJECT PLAN MANAGEMENT

A. Preliminary Project Plan Contractor will provide a Project Plan at the beginning of each new annual term, including necessary time frames and deliverables for the various stages of the project. 1. The Preliminary Project Plan will include a MS Project plan or equivalent:

a. A description of the deliverables to be provided under this contract. b. Target dates and critical paths for the deliverables. c. The labor and materials required to be provided by the State in meeting the target dates established

in the Preliminary Project Plan. d. Internal milestones e. Task durations









48

2. The Preliminary Project Plan shall include the following deliverable/milestones for which payment shall be made.

a. Payment to the Contractor will be made upon the completion and acceptance of the deliverable or milestone, not to exceed contractual costs of the phase.

b. A milestone is defined as complete when all of the deliverables within the milestone have been completed and accepted by the State

A Final Project Plan will be required within 60 calendar days of Contract execution.

B. Orientation Meeting Upon 15 calendar days from execution of the Contract, the Contractor will be required to attend an orientation meeting to discuss the content and procedures of the Contract. The meeting will be held in Lansing, Michigan, at a date and time mutually acceptable to the State and the Contractor. The State shall bear no cost for the time and travel of the Contractor for attendance at the meeting.

C. Performance Review Meetings The State will require the Contractor to attend annual meetings, at a minimum, to review the Contractor’s performance under the Contract. The meetings will be held in Lansing, Michigan, or by teleconference, as mutually agreed by the State and the Contractor. The State shall bear no cost for the time and travel of the Contractor for attendance at the meeting.

D. Project Control 1. The Contractor will carry out this project under the direction and control of the State. 2. Within 30 working days of the execution of the Contract, the Contractor will submit to the State project

manager(s) and Contract Manager for final approval of the project plan. This project plan must be in agreement with Article 1, Section 1.104 Work and Deliverables, and must include the following:

a. The Contractor’s staffing table with names and title of personnel assigned to the project. This must be in agreement with staffing of accepted proposal. Necessary substitutions due to change of employment status and other unforeseen circumstances may only be made with prior approval of the State.

b. The project work breakdown structure (WBS) showing activities and tasks, and resources required and allocated to each.

c. The time-phased plan in the form of a graphic display, showing each event, task, and decision point in the WBS.

1.302 REPORTS Reporting formats must be submitted to the MDOC Contract Manager for approval within thirty (30) calendar days after the execution of the Contract. Once both parties have agreed to the format of the report, it must become the standard to follow for the duration of the Contract.

The Contractor will be required to submit the following reports:

1. Monthly Project status reports - Due within twenty (20) calendar days at the end of each month. The reports shall contain:

a. Summary of activity during the report period b. Accomplishments during the report period c. Deliverable status d. Schedule status e. Action Item status f. Issues


49

g. Change Control h. Financial Report

Attachment E – Monthly Narrative Project Report: This monthly report must be submitted in conjunction with the coordinating monthly invoice using the required format as illustrated.

2. Final Report on validity of risk, needs and strengths instrument, including recommendation for all future

research and development. This report must be submitted within 30 days of request by the State.

1.400 Project Management 1.401 ISSUE MANAGEMENT An issue is an identified event that if not addressed may affect schedule, scope, quality, or budget.

The Contractor shall maintain a project issue log for issues relating to the provision of services under this Contract. The issue management log must be communicated to the State’s Contract Manager on an agreed upon schedule, with email notifications and updates. The issue log must be updated and must contain the following minimum elements:

1. Description of issue 2. Issue identification date 3. Responsibility for resolving issue 4. Priority for issue resolution (to be mutually agreed upon by the State and the Contractor) 5. Resources assigned responsibility for resolution 6. Resolution date 7. Resolution description

Issues shall be escalated for resolution from level 1 through level 3, as defined below:

Level 1 – Business leads Level 2 – Project Managers Level 3 – Contract Manager

1.402 RISK MANAGEMENT A risk is an unknown circumstance or event that, if it occurs, may have a positive or negative impact on the project.

The Contractor is responsible for establishing a risk management plan and process, including the identification and recording of risk items, prioritization of risks, definition of mitigation strategies, monitoring of risk items, and periodic risk assessment reviews with the State.

The Contractor is responsible for identification of risks for each phase of the project. Mitigating and/or eliminating assigned risks will be the responsibility of the Contractor. The State will assume the same responsibility for risks assigned to them.

1.403 CHANGE MANAGEMENT Change management is defined as the process to communicate, assess, monitor, and control all changes to system resources and processes. The State also employs change management in its administration of the Contract.

If a proposed contract change is approved by the Agency, the Contract Administrator will submit a request for change to the Department of Technology, Management and Budget, Procurement Buyer, who will make recommendations to the Director of DTMB-Procurement regarding ultimate approval/disapproval of change


50

request. If the DTMB Procurement Director agrees with the proposed modification, and all required approvals are obtained (including State Administrative Board), the DTMB-Procurement Buyer will issue an addendum to the Contract, via a Contract Change Notice. Contractors who provide products or services prior to the issuance of a Contract Change Notice by the DTMB-Procurement, risk non-payment for the out-of-scope/pricing products and/or services.

The Contractor must employ change management procedures to handle such things as “out-of-scope” requests or changing business needs of the State while the migration is underway.

The Contractor will employ the change control methodologies to justify changes in the processing environment, and to ensure those changes will not adversely affect performance or availability.

1.500 Acceptance

1.501 CRITERIA A. Document Deliverables

1. Documents are dated and in electronic format. 2. Requirements documents are reviewed and updated throughout the development process to assure

requirements are delivered in the final product. 3. Draft documents are not accepted as final deliverables. 4. The documents will be reviewed and accepted in accordance with the requirements of the Contract and

Appendices. 5. MDOC and DTMB will review documents within a mutually agreed upon timeframe.

a. Approvals will be written and signed by both the MDOC Project Manager and DTMB Project Manager.

b. Issues will be documented and submitted to the Contractor. c. After issues are resolved or waived, the Contractor must resubmit documents for approval within 30

days of receipt.

B. Software Deliverables - Software includes, but is not limited to, software product, support tools, and installation software. Beta software is not accepted as final deliverable.

1. The software will be reviewed and accepted in accordance with the requirements of the Contract and/or any

approved Requirements Specification documents defining software enhancements, customizations, or bug fixes. Validation of the Requirements Specification documents based on detailed functionality will govern acceptance.

2. MDOC and DTMB will review software within a mutually agreed upon timeframe for acceptance of functionality, usability, installation, performance, security, standards compliance, backup/recovery, and operation.

a. Approvals will be written and signed by MDOC and DTMB Project Manager. b. Unacceptable issues will be documented and submitted to the Contractor. c. After issues are resolved or waived, the Contractor must resubmit software for approval within thirty

(30) days of receipt. 3. Software is installed and configured with assistance from MDOC and DTMB in an appropriate environment

(e.g. UAT, and Production). 4. Contingency plans; de- installation procedures, and software are provided by the Contractor and approved by

MDOC and DTMB Project Manager. 5. Final acceptance of the software will depend on the successful completion of User Acceptance Testing. 6. Testing must demonstrate the system’s compliance with the requirements of the Contract. At a minimum, the

testing must confirm the following:


51

a. Functional - the capabilities of the system with respect to the functions and features described in the Contract.

b. Performance - the ability of the system to perform the workload throughout requirements. All problems should be completed satisfactorily within the allotted time frame.

7. MDOC and DTMB will review test software, data, and results within a mutually agreed upon timeframe. a. Approvals will be written and signed by MDOC and DTMB Project Manager. b. Unacceptable issues will be documented and submitted to the Contractor. c. After issues are resolved or waived, the Contractor must resubmit test software for approval within

thirty (30) days of receipt. 8. MDOC and DTMB will review software license agreements within a mutually agreed upon timeframe.

a. Approvals will be written and signed by MDOC and DTMB Project Manager. b. Unacceptable issues will be documented and submitted to the Contractor. c. After issues are resolved or waived, the Contractor will resubmit the license agreement for approval

and final signature by the authorized State signatory within 30 days of receipt

1.502 FINAL ACCEPTANCE Final acceptance is expressly conditioned upon completion of all deliverables, completion of all tasks in the project plan as approved, completion of all applicable inspection and/or testing procedures, delivery of services, and the certification by the State that the Contractor has met the defined requirements. Final acceptance of any component or configuration will be formally executed in writing by the State of Michigan and the Contractor after all issues identified during User Acceptance Testing have been resolved, tested, and accepted.

1.600 Compensation and Payment

1.601 COMPENSATION AND PAYMENT A. Method of Payment This Contract is a fixed price not to exceed deliverables based Contract. Contractor will be compensated in accordance with the provision D (1-3) of this section. Monthly invoices shall be received no more than fifteen (15) calendar days from the end of the month in which the work occurred. See Schedule I for Pricing.

All invoices for services should reflect actual milestones completed by payment date and document the work performed. Incorrect or incomplete invoices will be returned to Contractor for correction and reissue. The Contractor must submit its monthly bill and documentation to the “Bill To Address” on the purchase order at the end of the month in which the service was provided. Incorrect or incomplete invoices will be returned to Contractor for correction and reissue. Invoices must be approved by Project Manager or designee prior to payment

Extended purchasing program volume requirements are not included, unless stated otherwise.

B. Travel The State will not pay for any travel expenses, including hotel, mileage, meals, parking, etc. Travel time will not be reimbursed.

C. Issuance of Purchase Orders 1. Unless otherwise agreed by the parties, each Statement of Work will include:

a. Background b. Project Objective c. Scope of Work d. Deliverables e. Acceptance Criteria f. Project Control and Reports g. Specific Department Standards h. Payment Schedule


52

i. Project Contacts j. Agency Responsibilities and Assumptions k. Location of Where the Work is to be performed l. Expected Contractor Work Hours and Conditions

2. The parties agree that the Services/Deliverables to be rendered by Contractor pursuant to this Contract (and

any future amendments of it) will be defined and described in detail in Purchase Orders (PO) executed under this Contract. Contractor shall not be obliged or authorized to commence any work until authorized via a PO issued against this Contract. Contractor shall perform in accordance with this Contract, including the Purchase Orders executed under it.

D. Invoicing Contractor will submit properly itemized invoices to

DTMB – Financial Services Accounts Payable P.O. Box 30026 Lansing, MI 48909 or [email protected]

Invoices must provide and itemize, as applicable: 1. Contract number; 2. Purchase Order number 3. Contractor name, address, phone number, and Federal Tax Identification Number; 4. Description of any commodities/hardware, including quantity ordered; 5. Date(s) of delivery and/or date(s) of installation and set up; 6. Price for each item, or Contractor’s list price for each item and applicable discounts; 7. Maintenance charges; 8. Net invoice price for each item; 9. Shipping costs; 10. Other applicable charges; 11. Total invoice price; and 12. Payment terms, including any available prompt payment discount.

Incorrect or incomplete invoices will be returned to Contractor for correction and reissue.

1. Payment Terms The State will pay the Contractor the fees set forth on Schedule H for all Annual Software - Licenses, Maintenance & Support costs as well as Annual fixed fee Services. All Fees are non-refundable. Fees are due within forty-five (45) calendar days of the receipt of an accurate and undisputed invoice containing the required elements listed in the section above.

The State agrees to pay Contractor within forty-five (45) calendar days after the date of receipt of an accurate and undisputed invoice containing the required elements listed in the section above from Contractor. Fees for any Services will be billed as set forth on Schedule H. Fees exclude, and the State will make all payments of fees to Contractor free and clear of, all applicable sales, use, and other taxes and all applicable export and import fees, customs duties and similar charges.

2. Annual Software - Licenses, Maintenance & Support Fees The License, Maintenance and Support Fees for the Software are annual fees that are payable in advance for each contract year and are defined in Schedule H. The License, Maintenance and Support Fees are to be billed in accordance with the Purchase Order (PO) issued against the Contract for the period covered by the license agreement.



53

Fees are based on the package of product modules provided to the State; the Fees may be modified each year at the discretion of the State and as reflected on the PO, by changing the package options.


54

Schedule B – Business Requirements

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)

Response (1,2,3,4,5)

Comments

Business Requirements Req. 1 Configuration Audit and Consultation

The Contractor will perform one application configuration audit on the existing Michigan Department of Corrections’ (MDOC) system. To accomplish this audit, the MDOC will allow the Contractor to copy the Production instance into a Test environment, so full auditing and testing can be completed without impacting the current Production environment. The Contractor Consultant will perform the audit, and will prepare for the delivery of the audit results to the MDOC. All configuration modifications will be performed within a Test environment.

Deliverables for Consulting

1. Consulting for the application Configuration Audit 2. Consulting for configuration modifications in a Test

environment 3. Consulting for configuration implementation support in

a Production environment

O Y 4 Adding to FY17 service scope.


55

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)


Comments

Req. 2 Advance Case Planning Training

The Advanced Case Planning training focuses on the practical application of case planning in a field setting, including the mechanics of the case planning functionality within COMPAS. The training curriculum will be created by the Contractor as part of this scope of work, and will address planning techniques, prioritizations and ongoing case planning oversight.

This training will be provided by the Contractor onsite in a classroom setting, with a maximum of 20 participants per session at an MDOC specified location.

The training services will include:

1. Curriculum Planning and review with the MDOC Training Director

2. Preparation of training materials and test site setup, as needed by the Contractor trainer

E Y 4 Adding to FY17 service scope.

Req. 3 An advanced consultation for Judges at PSI

A consultation will be will be prepared for selected Judge, Prosecutors, and Defense Bars participants as noted by the MDOC concerning COMPAS Risk/Needs Assessments at pre- screening investigation (PSI). This consultation will be delivered onsite to participants, and the MDOC will prepare the facilities and all required logistics as needed. All sessions will provided at an MDOC specified location. No custom session materials are included in this scope of work.

E Y 5 Adding to FY 17 service scope.


56

Req. 4 OMS Interface Requirements

The Contractor will provide interface planning services for the integration between the Contractor Suite and the OMS. The project team will discuss and specify the data elements required, the time of the exchange, and the method of data exchange needed. The Contractor and the MDOC’s technical resources will develop a mutually acceptable requirements document, outlining the design of the interface to be completed (development and implementation are not included in this SOW).

The MDOC will appoint the appropriate staff to reach consensus and decisions on all interface requirements during the discussion and according to the proposed timeline.

The Contractor’s approach to develop the OMS interface requirements includes the following:

1. The Contractor will facilitate one requirements gathering session with the MDOC’s technical team via a remote consulting session

a. The MDOC will identify the business case/need for the interface and will document the expected data elements included in the applicable interface.

b. The MDOC will define their Networking requirements and configuration needs related to the implementation of a interface

2. The Contractor will document and submit the final Requirements document to the MDOC

3. The Contractor will facilitate review session(s) to address MDOC questions and gather feedback on any remaining modifications to the OMS Requirements document

a. The Contractor will modify the Requirements document and submit the final draft to the MDOC for review and sign off

MDOC will provide final approval of the Interface Document.

M Y 4 This includes one interface with OMS for FY17 only. No other interfaces with other systems are included in this scope. 1 Demographic Interface will be included. Any additional interfaces to OMNI or OMS will require a Change Control and an additional budget.


57

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)


Comments

This requirement does not include hours for the development, testing or the implementation of the applicable interface. The Contractor will deliver technical resource time to document the requirements as specified above.

a. Deliverable for OMS Interface – Requirements Software development and QA tasks

b. Implementation support to the MDOC’s Test site. Interface Requirements

1. The Contractor to deliver remote technical documentation

Interface Requirements document, copies to be delivered electronically.

N 5

Req. 5 Outcomes & Calibration Tests for VFO/non-VFO Reentry Risk [Research]

Using the State of Michigan supplied data files, the Contractor will check the calibration of the Reentry VFO Risk and Non- VFO Risk scales. Results and recommendations will be documented in a brief technical report.

The Contractor will complete the following tasks:

1. Obtain updated MSP extracts, sentencing files, and transit files

2. Update results for default Reentry risk scales 3. Update results for new VFO Risk and Non-VFO Risk

scales 4. Check calibration of VFO Risk and Non-VFO Risk

scales 5. Produce tables and graphs 6. Document the brief technical report

M Y 4 Adding to FY17 service scope.


58

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)


Comments

Req. 6 Outcomes & Calibration Tests for VFO/non-VFO Core Probation [Research]

Using the State of Michigan supplied data files, the Contractor will check the calibration of the Core Probation VFO Risk and Non-VFO Risk scales. Results and recommendations will be documented in a brief technical report.

The Contractor will complete the following tasks:

1. Obtain updated Michigan State Police (MSP) extracts, sentencing files, and transit files

2. Update results for default Core risk scales 3. Update results for probation VFO Risk and Non-VFO

Core risk scales 4. Check calibration of probation VFO Risk and Non-VFO

Core risk scales 5. Produce tables and graphs 6. Document the brief technical report

Deliverables for Research

1. Reentry Outcomes & Calibration Study technical report, delivered electronically annually

2. Probation Outcomes & Calibration Study technical report, delivered electronically annually

M Y 4 Adding to FY17 service scope.


59

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)


Comments

Req. 7 Quality Assurance/Inter-rate Reliability Module

Deliverables 1. Proof of Concept for, a system to track Quality

Assurance/In-rater Reliability within the Training site 2. Specification review session(s), to be delivered

remotely.

M N 4 Cannot comply 100% as this is written. Contractor to provide Proof of Concept work only. Development cannot be scheduled or estimated until the State’s proof of concept is 100% complete and approved.


60

A B C D E F

Req. No.

Requirement

Mandatory (M)

Expected (E)

Optional (O)

Response (Yes / No)


Comments

Req. 8 Assessment Consultation

The Contractor must work collaboratively with the MDOC to review the assessment questions in the COMPAS application, and provide offsite and onsite consultation to determine if changes could be made to the application, while still maintaining the validity of the assessment Areas of potential focus are to include, but not limited to:

a. Reducing the number of scale items in the assessment b. Collapsing appropriate Likert scale answers (e.g. from

5 to 3 responses) c. Updating Tool Tips d. Improving scoring rules to achieve better consistency in

the administration of the assessment The deliverable must include development review session(s) at a location approved by the MDOC. If the concept of the overall deliverable is feasible, then it must also include research/validation and testing/implementation support. Results and recommendations will be drafted and delivered via a brief technical report.

E Y 4 Adding to FY17 service scope.


61

SCHEDULE C - Security

Amazon Web Services (AWS) GovCloud platform is the hosting provider for Contractor’s outsourced hosting services. AWS provides server hardware, scheduled maintenance services, replication options and back-up utilities. AWS maintains its own physical facilities and hardware, as well as annual certifications for security standards at the federal level.

All AWS published compliancy certifications can be referenced directly at https://aws.amazon.com/compliance/published-certifications/.

SSAE 16

1. Security. 1.1 Protection of the State’s Confidential Information. Throughout the Term and at all times in connection with its actual or required performance of the Services hereunder, Contractor will: (a) Maintain an annual SSAE 16 SOC 2 Type 2 audit of the hosted facilities, IT infrastructure security controls, and processes; (b) ensure that the Service Software is securely hosted, supported, administered, and accessed in a data center that resides in the continental United States, and minimally meets Uptime Institute Tier 3 standards (www.uptimeinstitute.com); (c) maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in the Contract, and, to the extent such practices and standards are consistent with and not less protective than the foregoing requirements, are at least equal to applicable best industry practices and standards as recommended by the National Institute of Standards and Technology (NIST); (d) provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of the State’s Confidential Information and the nature of such Confidential Information, consistent with best industry practice and standards. (e) Take all reasonable measures to: (i) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “hackers” and others who may seek, without authorization, to disrupt, damage, modify, access or otherwise use Contractor Systems or the information found therein; (ii) prevent (A) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (B) the State’s Confidential Information from being commingled with or contaminated by the data of other customers or their users of the Services; and (C) unauthorized access to any of the State’s Confidential Information; (f) Continuously monitor its systems for potential areas where security could be breached. 1.2 Unauthorized Access. Contractor may not access, and shall not permit any access to, State Systems, in whole or in part, whether through Contractor’s Systems or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract

https://aws.amazon.com/compliance/published-certifications/


62

and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section 6.2. All State-authorized connectivity or attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time. 1.3 Contractor Systems. Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems) and networks used by or for Contractor in connection with the Services (“Contractor Systems”) and shall prevent unauthorized access to State Systems through the Contractor Systems. 1.4 Security Audits. During the Term, Contractor will: (a) maintain complete and accurate records relating to its data protection practices, IT security controls, and the security logs of any of the State’s Confidential Information, including any backup, disaster recovery or other policies, practices or procedures relating to the State’s Confidential Information and any other information relevant to its compliance with this Section 6; (b) upon the State’s request, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Contractor Systems and their housing facilities and operating environments; and (c) If requested by the State, provide a copy of Contractor’s SSAE 16 SOC 2 Type 2 audit report to the State within thirty (30) days after Contractor’s receipt of such report. Any such audit reports will be recognized as Contractor’s Confidential Information. 1.5 Nonexclusive Remedy for Security Breach. Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.


63

Schedule D – Technical/General System and Functional Requirements of COMPAS Suite Software

A. Technical/General System Requirements 1. The system must comply with Section 1.103 in Schedule A.

B. Functional Requirements

1. The system must be capable of interfacing with the Offender Management Network Information (OMNI)

and Offender Management System (OMS) using Contractor’s standard API Web Services

2. The system must provide auditing of all transactions including the user ID, the date and time, and the computer from which the data was accessed or modified.

3. The system must ensure that confidential information is protected, both when it is at rest and during

transit.

4. The system must provide efficient license management and control allowing license details to be reviewed and edited in the configuration module without manual intervention.

5. The system must provide for the careful and full protection of all clients' rights to privacy and

confidentiality through effective internal and external security controls that meet or exceed all legal requirements and official regulations on the subject.

6. The system must provide access to all State authorized users with the ability to query, generate,

access and create reports at no additional charge to the State.

7. The system must have the capability to automatically produce routine and official reports required by State or federal statutes and regulations.

8. The system must contain on-line, built-in validation and edit capabilities, including provision of

warnings when data entries are inconsistent with system standards to ensure data integrity.

9. The system must provide automated flow in logical progression of data and windows to enhance worker orientation and familiarization of the system.

10. The system must be able to export created documents to Microsoft word processing applications,

Microsoft Excel, and PDF files.

11. The system must highlight problem areas, such as cases that are unassigned.

12. The system must operate uniformly throughout the State. All functionality, including but, not limited to entering and retrieving data in the system must be available to all State employees throughout the field offices.

13. The system standardizes forms.

14. The system must use consistent methods to enter, update, and retrieve data. Users who understand

one function of the system and feel comfortable navigating through it will feel comfortable navigating through all functions.

15. The system should have on-line general context and field-level help.

16. The system must have a logical navigation order for each screen.


64

17. The system must support data entry processes by a series of edits, which provide integrity, validation, and consistency of format throughout the system. The system must be capable of "freezing" any entered data according to established business rules.

18. The system must provide the capability to confirm or undo changes, as well as prompt the user when

required that data have not been properly entered.

19. The system must allow full functional access by State employees for a minimum of 18 hours-per-day, 7 days-per-week basis, taking into consideration approved system maintenance windows and backup requirements.

20. The system must refresh screen functionality automatically.

21. The system must work within the existing agency and State technical environment. The State must

comply with all published System Requirements posted by the Contractor on an annual basis. Failure to comply may result in negative performance of the State hosted system.

22. The system must be designed to eliminate data redundancy as much as possible and to prevent

unnecessary movement through fields during data entry.

23. The system must include a data control and security component that prevents editing of all specified narrative text once it is considered finalized and saved in the system.

24. The system must be able to maintain any medical data according to HIPAA standards.

25. The system must provide the capability to sort data presented in a grid view by each column.

26. The system must have a robust, multi-level ability to check new person entries against the database for possible duplicates.

27. Contractor must respond to deficiencies found through the audit process and identify and provide an

agreed upon plan for corrective action.


65

Schedule E, Reporting Service Level Agreements – Performance Metrics Northpointe, Inc.

Background The MDOC will be utilizing a series of metrics to monitor contractor performance. Each identified performance metric includes the information that will be assessed or an explanation of the numerator and denominator of the metric, the minimum threshold that needs to be met, and the service credit for not meeting the threshold. By utilizing metrics, MDOC will ensure that its service goals drive continuous improvement and efficiency.

The minimum threshold for each metric will be reviewed with the Contractor, and may be revised on an annual basis if mutually agreed upon. The metrics have been derived from key areas of the Contract which include credentialing, training and timeliness of reports.

Purpose and Objectives The Performance Metrics defined in this attachment represent MDOC’s expectations as they relate to important contract obligations. These standards are based on current MDOC Policies, Protocols and Procedures, and represent the level of expected performance as it relates to providing services. These performance reviews will occur in the first six months of the Contract, but will not have a financial implication until the seventh month of the Contract to allow time for the Contractor to establish processes to ensure compliance.

Audit Process The specifications listed under each metric name will be reviewed and audited according to the timetable listed for each metric. Audits will be conducted by MDOC staff, with specific data elements for the audit being shared with the Contractor prior to the audit. Records being audited include, but are not limited to:

• Technical Reports • Monthly Project Status Reports

Service Level Agreements (SLAs) that are determined to fall below the compliance percentage will be re-evaluated during the next audit period (monthly, quarterly or annually). In the event they continue to fall below the threshold, the Credit amount shall be double the original assessment.

Corrective Action Plan The Contractor must prepare and implement a corrective action plan (CAP) within 30 days for each metric that falls below the target or threshold. This does not in any way limit the State’s ability to assess service credits where the metric falls below the minimum threshold.

CAPs will be provided in a standardized format throughout the Contract and the template will be provided by the MDOC.

66

Northpointe, Inc. Service Level Agreements CONTRACT #071B7700014 Number Metric Name/Description Timeframes Numerator Denominator Minimum Credits Threshold

1

Using the State of Michigan supplied data files, the Contractor will check the calibration of the Reentry VFO Risk and Non-VFO Risk scales. Results and recommendations will be documented in a brief technical report.

Annually

Technical Reports submitted to MDOC

Technical

Reports required (1) by MDOC

100%

$2,000.00

per occurrence

2

The Contractor must update the probation outcomes data. The Contractor must check the calibration of the probation VFO Risk and Non-VFO Risk scales, including tests in new data. Results and recommendations will be drafted and delivered via a brief technical report.

Annually

Technical Reports submitted to MDOC

Technical

Reports required (1) by MDOC

100%

$2,000.00

per occurrence

3

Reporting formats must be submitted to the MDOC Contract Manager for approval within thirty (30) calendar days after the execution of the Contract. Once both parties have agreed to the format of the report, it must become the standard to follow for the duration of the Contract.

The Contractor will be required to submit the following reports:

Monthly Project status reports - Due within twenty (20) calendar days of the following month. The reports shall contain:

a. Summary of activity during the report period b. Accomplishments during the report period c. Deliverable status d. Schedule status e. Action Item status f. Issue Log containing the following minimum elements:

1. Description of issue 2. Issue identification date 3. Responsibility for resolving issue 4. Priority for issue resolution (to be mutually

agreed upon by the State and the Contractor)

5. Resources assigned responsibility for resolution

6. Resolution date 7. Resolution description

g. Change Control

Monthly

Monthly Project Status Reports submitted timely

to MDOC

Monthly Project Status Reports required (12) by

MDOC

91.7% Annually

$200.00 per occurrence

67

h. Financial report detailing expenditures invoiced for as well as funding leveraged to support other services provided.

68

Schedule F - Monthly Narrative Progress Report

Deliverables/Activities Project Narrative (Required for Each Deliverable Invoiced) Deadlines

Deliverable A (Option 1) – Annual Unlimited User Fee. Maintenance is included in overall license fee

Deliverable C – Training Travel is included in day rate

Requires Contract

Deliverable D –

Project Management Requires Contract Project Manager Prior

Deliverable E – Software Configuration Requires Contract Project Manager Prior

Deliverable E (1) – OCC Conversion

Deliverable F – Research - Outcomes Validation Study

Requires Contract

Deliverable G – Classification Requires Contract Project Manager Prior A l

Deliverable I Consultation

Requires Contract Project Manager Prior Approval


Schedule G - Software Licensing Software Licensing includes access to the following modules:

1. Core, Reentry and Women’s modules • Case Supervision Level Review instrument

2. Youth module 3. Case Plan module 4. Secondary Assessments:

• Static 99 sex offender assessment • VASOR • TCU drug screener • Mental Health pre-screener • STABLE

5. PSI module 6. Case Manager 7. Ad Hoc Report Generator 8. Offline Module [MDOC Division only]

Schedule H – Glossary

70

AORAS Automated Offender Risk Assessment System ADSS Automated Data Support Services Audit Table Electronic record of all data entered and deleted from all State of Michigan

users to the COMPAS Suite CCAB Community Corrections Advisory Boards CCAMIS Community Corrections Advisory Management Information System CFA Correctional Facilities Administration COMPAS Correctional Offender Management Profiling for Alternative Sanctions DTMB State of Michigan Department of Technology, Management, and Budget FOA Field Operations Administration HIPA Health Insurance Portability and Accountability Act IT Information Technology JPIS Jail Population Information Systems MDOC State of Michigan Department of Corrections OMNI Offender Management Network Information OMS Offender Management Systems OMS Offender Call Out Management Systems PO Purchase Order PSI Pre-Sentence Investigation QA Quality Assurance SLA Service Level Agreement SME's Executive Subject Matter Experts SPOC Single Point of Contact SUITE State Unified Information Technology Environment TAP Transition Accountability Planning VFO Violent Felony Offense VPN Virtual Private Network WAN Wide Area Network WBS Work Breakdown Structure

71

Schedule I - Service Fees

The prices charged for Services purchased under this Agreement will be capped by the Contract rates for such services. All Services for the State will be defined per annual PO term based on the PO Statement of Work (SOW) and presented as firm fixed fee costs.

All invoices for services delivered will be issued based upon the pre-defined milestones agreed to in the PO SOW. Upon completion of each milestone, Contractor will issue an invoice in the amount assigned for the completed milestone. Invoices will be sent to the State per Contractor’s monthly billing cycle. Note that multiple milestones may be billed in one billing cycle.

This PO SOW annual service milestones will be defined per the following payment schedule format:

MI Department of Corrections

FY17 Services: Payment Milestone Definition Milestone Description Amount

1 Annual Hosting Fee $19,500 2 Status Report - December $6,460

2.1 Status Report - January $6,460 2.2 Status Report - February $6,460 2.3 Status Report - March $6,460 2.4 Status Report - April $6,460 2.5 Status Report - May $6,460 2.6 Status Report - June $6,460 2.7 Status Report - July $6,460 2.8 Status Report - August $6,460 2.9 Status Report - September $6,460 3 Advanced Case Plan Training Complete $5,500 4 CFA Train the Trainer Session 1 Complete $10,100

4.1 CFA Train the Trainer Session 2 Complete $10,100 5 Demographic Interface Specification Complete $5,640

5.1 Demographic Interface Development Complete - Test $7,000 6 QA/Interrater Reliability Module Planning Session Complete $8,200 7 Assessment Consultation Session Complete $4,200 8 Offender Classification System - Planning Session Complete $5,600 9 Research - Reentry Risk Outcomes & Calibration Study $17,750 10 Research - Core Probation Outcomes & Calibration Study $17,750 11 Advanced Consultation for Judges Complete $3,400

$179,340 **Milestones will be billed upon completion.

72

Rate Table for Future Enhancements

Pricing includes travel and other related expenses

Firm Fixed Hourly Rate

Firm Fixed Hourly Rate

Resource Onsite Offsite

Project Manager $225.00/hour $170.00/hour Scientific Director $250.00/hour $175.00/hour Senior Software Developer $250.00/hour $170.00/hour Technical Lead $225.00/hour $170.00/hour Training / Coordinator $250.00/hour $175.00/hour Senior Consultant $250.00/hour $175.00/hour

73

Schedule J – License and Maintenance Fees

A. Base Years Annual Software - Licenses, Maintenance & Support costs

No. Software name Annual maintenance fees Comments

Base Year 1 COMPAS – Software Suite $742,000 Two digital software licenses (DOC, OCC) with

maintenance and support. Base Year 2 COMPAS –

Software Suite $749,420 Two digital software licenses (DOC, OCC) with maintenance and support.

Base Year 3 COMPAS – Software Suite $756,914 Two digital software licenses (DOC, OCC) with

maintenance and support. Total Cost of Software $2,248,334

B. Option Years Annual Software - Licenses, Maintenance & Support costs

No.

Software name Annual

maintenance fees

Comments

Option Year 1 COMPAS – Software Suite $768,268 Two digital software licenses (DOC, OCC)

with maintenance and support. Option Year 2 COMPAS –









with maintenance and support. Total Cost of Software $5,626,022