request for proposals

---

REQUEST FOR PROPOSALS PROPOSALS MUST BE SENT ONLY TO THE ADDRESS BELOW (Email or Facsimile Submissions are NOT Acceptable)

THE CITY UNIVERSITY OF NEW YORK OFFICE OF THE UNIVERSITY CONTROLLER PROCUREMENT OFFICE – 5TH FLOOR 230 WEST 41ST STREET, NEW YORK NY 10036 DUE DATE AND TIME FOR PROPOSAL SUBMISSION: September 12, 2014, 5:00 PM ET REQUEST FOR PROPOSALS NUMBER: UCO-560

TITLE: CUNYfirst Migration Project and Hosting Services SPECIFICATION REFERENCE: As incorporated in the Request for Proposals MANDATORY PRE-PROPOSAL CONFERENCE DATE: July 24, 2014 DOCUMENT VIEWING SESSION: August 13, 2014

DUE DATE FOR NOTICE OF INTENT TO ATTEND MANDATORY PRE-PROPOSAL CONFERENCE: No later than July 24, 2014 DUE DATE FOR NOTICE OF INTENT TO ATTEND DOCUMENT VIEWING: August 6, 2014

DESIGNATED CONTACT Paul Fallon Email: [email protected] The Proposal and this Cover Form must be fully and properly signed and notarized and submitted to CUNY by an official authorized to bind Proposer. By signing in the space provided below and returning the entire completed Cover Form with Proposer’s Proposal, you certify on behalf of Proposer: (1) your express authority to sign on behalf of and bind Proposer, and Proposer’s full knowledge and acceptance of this Request for Proposals, Appendix A (Standard Clauses for New York State), all Attachments, and State Finance Law §139-j and §139-k (Procurement Lobbying), and that all information provided is complete, true and accurate. By your signing, Proposer affirms that it understands and agrees to comply with New York State procedures relative to permissible contacts as required by State Finance Law §139-j(3) and §139-j (6)(b). Information may be accessed at: Procurement Lobbying: http://www.ogs.ny.gov/acpl; (2) that the Proposal, both technical and pricing components, shall remain valid for at least one hundred eighty (180) days from the Proposal Due Date and that Proposer will extend the period for an additional one hundred eighty (180) days, if requested by CUNY; (3) that Proposer meets all the minimum qualifications described in the RFP (see Section 1.3);

1

(4) that if awarded the contract, Proposer will comply with CUNY’s Security Policies and Procedures at: http://www.cuny.edu/about/administration/offices/CIS/security/pnp.html; (5) that Proposer will comply with all the requirements identified in Sections 2.1 and 2.2 of this RFP solicitation. PROPOSER’S Federal Tax Identification Number: Legal Business Name of Company Proposing: D/B/A – Doing Business As (if applicable): Street

City

State

Zip Code

Proposer’s Signature:

Printed or Typed Name: Title: Date: Contact Name: Contact Telephone Number: Contact Email Address:

ACKNOWLEDGEMENT State of County of On the ____day of _____________in the year 2014, before me personally appeared__________________________, known to me to be the person who executed the foregoing instrument, who, being duly sworn by me did depose and say that _he maintains an office in _____________________________, and further that _he is the ________________of the corporation described in said instrument; that, by authority of the Board of Directors of said corporation, ________________________________ is authorized to execute the foregoing instrument on behalf of the corporation set forth herein; and that, pursuant to that authority, __________________________________ executed the foregoing instrument in the name of and on behalf of said corporation as the act and deed of said corporation.

Notary Public Registration No.

THIS COMPLETED COVER FORM MUST BE PART OF THE PROPOSAL SUBMITTED BY PROPOSER 2

REQUEST FOR PROPOSALS MIGRATION PROJECT AND HOSTING SERVICES PROPOSAL CHECKLIST

Volume I: Cover Form; Technical and Management Proposal

Yes

Cover Form signed and notarized 13 paper copies of Volume I, and one (1) soft copy on a CD or DVD (in MS Office 2010 compatible format) — each clearly identified on the cover or label with the Proposer’s name and the words “CUNYfirst Migration Project and Hosting Services RFP Volume I — Technical and Management Proposal.” Proposals are securely sealed and clearly labeled. The outside packaging containing Volume I copies is clearly marked with the words “CUNYfirst Migration Project and Hosting Services RFP, Volume I — Technical and Management Proposal.” All soft copies of all files provided are NOT password protected or locked down in any form Any confidential and proprietary information is identified by marking each such page in the Proposal as “Confidential and Proprietary.” There is NO Pricing information included in Volume I The title page of the Proposal includes the name, address, and telephone number of the Proposer, including a contact person and the name of the person(s) who prepared the Proposal All subcontractors and MWBEs are identified Attachment B (Minimum Qualifications Certification), completed and attached to Proposer’s Executive Summary (see section 3.3.3) Attachment D (Proposer Reference Form), completed and attached All information required to be submitted in section 3.3 is addressed There is NO Attachment G information (Information required to be submitted by Short-Listed Proposers) in Volume I

RFP: Migration Project and Hosting Services

Page 1

REQUEST FOR PROPOSALS MIGRATION PROJECT AND HOSTING SERVICES PROPOSAL CHECKLIST Volume II: Price Proposal

Yes

5 paper copies of Volume II, and one (1) soft copy on a CD or DVD (in MS Office 2010 compatible format) — each clearly identified on the cover or label with the Proposer’s name and the words “CUNYfirst Migration Project and Hosting Services RFP, Volume II — Price Proposal.”

Proposals are securely sealed and clearly labeled. Any outside packaging containing Volume II copies must be clearly marked with the words “CUNYfirst Migration Project and Hosting Services RFP, Volume II — Price Proposal.”

Attachment C, Migration Project and Hosting Services RFP – Price Proposal Worksheet.xlsx. All of the worksheets in the Excel spreadsheet are completed. Prices are inclusive of all direct and indirect costs and fee/profit (including but not limited to printing, secretarial, program entry, travel, meals, lodging, overhead, etc.) Price Proposal does not include state, local, sales and/or use taxes

Soft copy of Attachment C is in a non-copy-protected format (a PDF file or any other type of protected format document is not acceptable) Attachment C Price Proposal affirmation and certification is completed

Volume II: Terms and Conditions of Contract Acceptance of Terms and Conditions: Have you specifically stated acceptance of all Terms and Conditions of the Contract (Attachment A to the RFP), except as described in Attachment F? Attachment F – Proposer Information and Certifications completed, along with any requested exceptions or deviations taken to the Terms and Conditions of the Contract (Attachment A to RFP) and sufficient amplification and justification to permit evaluation

RFP: Migration Project and Hosting Services

Page 2

REQUEST FOR PROPOSALS MIGRATION PROJECT AND HOSTING SERVICES PROPOSAL CHECKLIST

Volume II: RFP Addenda Acknowledgement

Yes

Have you included in your Volume II Proposal a copy of each Addendum issued by CUNY to the RFP signed by an authorized representative of your firm (or organization) acknowledging receipt and acceptance of any such Addenda? Volume II: Required Documents and Forms Yes Attachment F, Proposer Information and Certification Forms completed and attached, including on a separate page any requested exceptions or deviations to the Terms and Conditions contained in Attachment A Attachment K, Form #1, M/WBE Utilization Plan completed and attached Attachment K, Form #2 (if applicable) Attachment I, signed Company Confidentiality and Non-disclosure Agreement Attachment H, Procurement Lobbying Act Forms, completed and attached - Form#1, Proposer’s Affirmation of Understanding of and Agreement pursuant to State Finance Law §139-j (3) and §139-j (6) (b); and - Form #2, Proposer’s Disclosure of Prior Non-Responsibility Determinations

Each of the two parts of the proposal, Volume I and Volume II must be complete in itself and packaged separately. As per Section 5.3, item, proposal is due by 3:00 PM on September 12, 2014, to Paul Fallon The City University of New York Procurement Office, 5th Floor 230 West 41st Street New York, NY 10036 Attention: CUNYfirst Migration Project and Hosting Services RFP

This Proposal Checklist has been provided for the convenience of all prospective Proposers as they prepare their Proposals. It is not meant to serve as a substitute for all the requirements for the submission of Proposals set forth in the RFP document. Proposers remain subject to all such requirements.

RFP: Migration Project and Hosting Services

Page 3

THE CITY UNIVERSITY OF NEW YORK (CUNY) REQUEST FOR PROPOSALS CUNYfirst Migration Project & Hosting Services

Proposal Due Date:

September 12, 2014

Proposal Delivery Location and Additional Information: Office of the University Controller 230 West 41st Street New York, NY 10036 Attention: Paul Fallon

Contents 1. INTRODUCTION ...................................................................................................................................... 4 1.1 Purpose ...................................................................................................................................................... 4 1.2 Migration Project and Hosting Services Scope and Objectives............................................................... 5 1.3 Minimum Qualifications .......................................................................................................................... 5 1.4 M/WBE Participation Goals ....................................................................................................................... 6 1.5 Term of Agreement .................................................................................................................................... 6 1.6 Schedule of Key Events and Designated Contact .................................................................................... 6 1.7 CUNY General Information – For Informational Purposes Only............................................................ 7 2. CONTRACT SPECIFICS ......................................................................................................................... 8 2.1 Contractor Responsibilities – General ........................................................................................................ 8 2.2 Scope of Services and Deliverables ....................................................................................................... 10 2.2.1 Migration Project (Attachment A, Exhibit 1) ........................................................................................ 10 2.2.2 Hosting Services (Attachment A, Exhibit 2) ......................................................................................... 10 3. PROPOSAL FORMAT AND CONTENTS .......................................................................................... 11 3.1 General Procedures................................................................................................................................... 11 3.2 Cover Form............................................................................................................................................... 11 3.3 Volume I: Technical and Management Proposal ..................................................................................... 11 3.3.1 Title page ............................................................................................................................................... 12 3.3.2 Table of Contents ................................................................................................................................... 12 3.3.3.

Executive Summary .......................................................................................................................... 12

3.3.4 Proposer Experience .............................................................................................................................. 12 3.3.5 Migration Project ................................................................................................................................... 13 3.3.6 Hosting Services .................................................................................................................................... 13 3.4 Volume II – Price Proposal.................................................................................................................... 15 3.4.1 Attachment C – Price Proposal.............................................................................................................. 15 3.4.2 Terms and Conditions of Contract......................................................................................................... 16 3.4.3 RFP Addenda Acknowledgement Forms ............................................................................................. 16 3.4.4 Required Documents and Forms .......................................................................................................... 16 4. PROPOSAL EVALUATION ................................................................................................................ 18 4.1 Overview................................................................................................................................................ 18 4.2 Stage I – Initial Proposal Evaluation and Scoring ................................................................................. 20

1.

CUNYfirst Migration Project and Hosting Services RFP

STAGE I – Initial Proposal Evaluation and Scoring ...................................................................................... 21 4.2.1 Step 0: Pre-Screening............................................................................................................................. 21 4.2.2 Step 1: Minimum Qualifications Review .............................................................................................. 21 4.2.3 Step 2(a): Volume I - Technical and Management Proposal Scoring (Sixty (60) Points) ..................... 21 4.2.4 Step 2(b): Volume II - Price Proposal Scoring (Forty (40) Points) ....................................................... 21 4.2.5 Step 3: Stage I Total Proposal Score (Maximum: One hundred (100) Points) ...................................... 21 Short-Listed Proposers will proceed to Stage II Evaluation........................................................................... 21 4.3 Stage II – Short-Listed Proposal Evaluation and Scoring ..................................................................... 22 STAGE II – Short-Listed Proposal Evaluation and Scoring .......................................................................... 23 4.3.1 Step 1: Annotated Volume I – Technical and Management Proposal with Submission of Attachment G Information (Sixty (60) Points) ...................................................................................................................... 23 4.3.2 Step 2: Price Proposal Scoring (Twenty (20) Points) ............................................................................ 23 4.3.3 Step 3: Oral Presentation (Ten (10) Points) ....................................................................................... 23 4.3.4 Step 4: Site Visit (Ten (10) Points) ................................................................................................... 23 4.3.5 Best and Final Offers (BAFO) .............................................................................................................. 23 4.3.6 Calculation of Final Total Proposal Scores – Selection of Proposal for Contract Negotiations............ 24 4.3.7 Negotiations ........................................................................................................................................... 24 4.4 Recommended Short-Listed Proposer ...................................................................................................... 24 5. ADMINISTRATIVE SPECIFICATIONS ............................................................................................ 25 5.1 Mandatory Pre-Proposal Conference....................................................................................................... 25 5.2 Document Viewing................................................................................................................................... 25 5.3 Proposal Submission .............................................................................................................................. 25 5.4 Inquiries and Information ........................................................................................................................ 26 5.5 Withdrawal of Proposal ........................................................................................................................... 26 5.6 General Conditions .................................................................................................................................. 27 5.7 Reservation of Rights .............................................................................................................................. 29 5.8 Consultant Employment Disclosure Forms .............................................................................................. 30 5.9 Consultant Responsibility When Proposing to Use a Former CUNY Employee ..................................... 31

The following additional documents are part of this RFP : a. Attachment A: Master Services Agreement 1. Exhibit 1 − Migration Project Agreement 2. Exhibit 2 − Hosting Services Exhibit 3. Exhibit 3 − Subcontractor Confidentiality and Non-Disclosure Agreement 4. Exhibit 4 − Third Party Confidentiality and Non-Disclosure Agreement b. Attachment B: Minimum Qualifications Certification 2.

CUNYfirst Migration Project and Hosting Services RFP

c. d. e. f. g. h. i. j. k.

Attachment C: Price Proposal - Excel Spreadsheet Attachment D: Proposer Reference Form Attachment E: Contractor's Responsibility when Proposing Former CUNY Employees Attachment F: Proposer Information and Certifications Attachment G: Information required to be Submitted by Short-Listed Proposers Attachment H: Procurement Lobbying Act and Forms Attachment I: Company Confidentiality and Non-Disclosure Agreement Attachment J: M/WBE requirements Attachment K: New York State Forms 1. M/WBE Utilization Plan 2. M/WBE Request for Waiver Form 3. M/WBE Quarterly Report Form 4. Minority and Women-Owned Business Enterprises (MWBE) Equal Employment Opportunity (EEO) Policy Statement 5. EEO Staffing Plan 6. Quarterly EEO Work Force Utilization Report

3.

CUNYfirst Migration Project and Hosting Services RFP

1. INTRODUCTION 1.1 Purpose The City University of New York (CUNY or University) is issuing this Request for Proposals (RFP) to solicit firms (Proposers) to offer proposals for services to migrate CUNY’s current hosting operations of the CUNYfirst applications to a new environment (as described below, Migration Project) and to provide these hosting operations on an ongoing basis in a manner that will meet CUNY’s current and future needs (as described below, Hosting Services). CUNYfirst is the University’s implementation of the Oracle PeopleSoft Version 9 Enterprise Resource Planning (ERP) suite of software applications for Financial, Human Resources, Campus Solutions and ancillary operations. This RFP specifies the performance requirements, Contractor responsibilities, and other pertinent information related to the execution of the Migration Project and Hosting Services. The provisions and requirements of this RFP and the selected proposal will be incorporated into the resulting contract made between CUNY and the selected Proposer. The agreement between CUNY and the selected Proposer can be found in Attachment A (Master Services Agreement and Exhibits). Please note that CUNY will not consider alternative forms of agreement in connection with this solicitation. CUNY anticipates making one award as a result of this solicitation and issuing a single contract (Contract) to the selected Proposer (Provider or Contractor) as set forth in Attachment A (Master Services Agreement and Exhibits). This document contains the following major sections: Section 1 – Introduction: Provides an overview of CUNY and background information about the Migration Project and Hosting Services. Section 2 – Contract Specifics: Lists Contractor Responsibilities for the services to be provided. Section 3 – Proposal Format and Contents: Describes the format and prescribed content required for the responses to this RFP. Section 4 – Proposal Evaluation: Describes the methodology that will be used to evaluate responses to the RFP. Section 5 – Administrative Specifications: Contains general administrative information regarding the solicitation.

(INTENTIONALLY LEFT BLANK)

4.

CUNYfirst Migration Project and Hosting Services RFP

1.2 Migration Project and Hosting Services Scope and Objectives Contractor will be required to provide services in connection with the Migration Project and the Hosting Services as described in Section 2.2 and as set forth in Exhibits 1 and 2 of Attachment A, including: 1. A 24 x 7 x 365 scalable hosting solution for CUNY’s Oracle PeopleSoft ERP implementation, with all of the support required to sustain at least 15,000 concurrent users, as defined in Attachment A, Exhibit 2, Section 3.0, with 99.9% production application availability; 2. A migration approach based on experience with large, complex organizations and similar migrations of size, scope, and scale from one hosting provider to another of production applications, preferably PeopleSoft; 3. A Disaster Recovery (DR)/ Business Continuity plan and a site that achieves a Recovery Time Objective (RTO) of no greater than 8 hours and a Recovery Point Objective (RPO) of no greater than 15 minutes; 4. Best-in-class Application Performance Monitoring (APM) tools and processes, whereby the Contractor states its proposed approach for the installation and integration of CUNY monitoring agents behind its firewall in read-only mode, utilizing SNMP standard protocol for CUNY to monitor the environment; 5. A Help Desk function integrated with CUNY’s help desk to address and respond within an agreed time frame to service requests initiated by the University and; 6. At CUNY’s option, provision of and support for the network between CUNY’s demarcation point in New York City and the hosting DR facilities.

1.3 Minimum Qualifications In order to be considered for contract award, Proposers together with any subcontractor(s) must meet the minimum qualifications stated below. Failure to meet the minimum qualifications set forth below will result in the rejection of the proposal as non-responsive. Proposers must complete and verify in Attachment B that the minimum qualification requirements set forth below have been met as of the due date and time for proposals submitted in response to this RFP (Proposal Due Date): 1. Proposer has provided outsourced hosting services with a minimum of 5,000 concurrent users; and 2. Proposer has a minimum of five (5) years of experience in providing outsourced hosting services; and 3. Proposer has demonstrated implementation and usage of ITIL standards for hosting and migration services; and 4. Proposer has at least two (2) existing reference clients for whom Proposer has completed migration services and provided hosting services for at least two (2) years during the last three (3) years.

(INTENTIONALLY LEFT BLANK)

5.

CUNYfirst Migration Project and Hosting Services RFP

1.4 M/WBE Participation Goals 1. CUNY has set a twenty percent (20%) participation goal in the aggregate for New York State certified Minority-Owned Business Enterprises (MBE) and Women-Owned Business Enterprises (WBE and, together with MBE, MWBEs) to be part of the proposed team to provide the services as a subcontractor or subcontractors (the MWBE Subcontractor(s)). The Contractor shall be required to use good-faith efforts to subcontract a minimum of twenty percent (20%) of the value of the services to one or more MWBE Subcontractors. Additional MWBE and Equal Employment Opportunity requirements and exemptions applicable to this RFP and to the Contract are attached hereto as Attachment J. 2. Proposers may identify potential MWBE Subcontractors by, among other means, referencing the directory of New York State Certified MBWEs found at the following internet address: http://www.esd.ny.gov/mwbe.html. 3. In addition, Proposers are encouraged to contact the Division of Minority and Woman Business Development (518) 292-5250; (212) 803-2414; or (716) 846-8200) to discuss additional methods of maximizing participation by MWBEs on the Contract. 1.5 Term of Agreement The initial term of the contract will commence with the start of the Migration Project and continue for five (5) years from Cutover (i.e., the date that CUNY’s production system will be in use at Contractor’s facilities for CUNY’s business operations), with five (5) successive one (1) year renewal options exercisable at CUNY’s sole option. At this time, the anticipated signing date of the contract is May 1, 2015. It is expected that the Migration Project will commence in October 2015 with all Migration services tested successfully for a production cutover in May 2016. 1.6 Schedule of Key Events and Designated Contact The University reserves the right to amend any or all of these dates. If required by law or the terms of this RFP, the University will issue such amendment in writing. Table 1 - Key Events and Dates Event

Timeline

RFP Release Date

7/2/14

Notice of Intent to attend Mandatory Pre-Proposal Conference Due

No later than 7/24/14

Mandatory Pre-Proposal Conference*

7/24/14

Document Viewing*

8/13/14

Deadline for Proposer Questions

8/25/14

Due Date and Time for Proposal Submission

9/12/14

Oral Presentations and Demonstrations

November 2014

Commencement of Contract Negotiations

December 2014

Contract Negotations Complete & Contract Signed by the Parties

June 2015

6.

CUNYfirst Migration Project and Hosting Services RFP

All questions concerning this solicitation must be directed to the designated contact, Paul Fallon, by e-mail at [email protected]. The last date to submit questions for this solicitation is indicated in Section 1.6, Schedule of Key Events above. All proposal submissions must be addressed to: Paul Fallon The City University of New York Office of the University Controller Procurement Office, 5th Floor 230 West 41st Street New York, NY 10036 Attention: CUNYfirst Migration Project and Hosting Services RFP *Mandatory Pre-Proposal Conference; Document Viewing: Prospective proposers must attend the Pre-Proposal Conference in order to be responsive and have their proposals considered further for review under the RFP. Prospective proposers who attended the mandatory Pre-Proposal Conference will be provided the opportunity to view-only certain technical and related system documentation. Please refer to Sections 5.1 and 5.2 of this RFP for further instructions and information. Any interpretation, clarification, or correction, as well as any other additions or amendments, and answers to all questions of a substantive nature will be issued in writing by the University as an addendum to the RFP (Addendum).

1.7 CUNY General Information – For Informational Purposes Only The City University of New York is the nation's largest urban public university. Founded in New York City in 1847 as the Free Academy, CUNY currently comprises 24 institutions: 11 senior colleges, 7 community colleges, the William E. Macaulay Honors College at CUNY, and 5 graduate and professional schools. CUNY serves more than 271,000 degree-credit students and 270,000 adult, continuing, and professional education students and has nearly 40,000 employees. The student full-time equivalent population has averaged a growth of 5% over the last six years. Additional data regarding CUNY’s size and diversity are available at our Office of Institutional Research website: http://www.cuny.edu/about/administration/offices/ira/ir.html Additional information about CUNY’s facilities can be found at: http://www.cuny.edu/about/colleges.html For more information about CUNYfirst see the CUNYfirst website: http://www.cuny.edu/about/administration/offices/CIS/CUNYfirst.html

7.

CUNYfirst Migration Project and Hosting Services RFP

2. CONTRACT SPECIFICS 2.1 Contractor Responsibilities – General 1. The prime Contractor must be a single firm. No joint ventures are permitted. The Contractor that executes the agreement with CUNY will be fully responsible for the coordination and integration of its project team. 2. See Attachment A, Exhibits 1, 2, 3, and 4 for specific Contractor and CUNY responsibilities with respect to the Migration Project and Hosting Services; 3. Contractor’s Key Team Members shall perform the Hosting Services at the primary data center in the United States and in a secondary data center in the United States at a distance from the physical primary data center deemed acceptable to CUNY for use in recovery operations and/or during disaster recovery services; 4. The Contractor will have access to CUNY subject matter experts and technical experts to assist Contractor, as necessary. The persons performing the following Contractor roles will be considered Key Team Members: Full Time

Role

Part Time

Contractor Executive Sponsor*

B

Contractor Account Executive*

B

Contractor Information Security Officer*

B

Project Director

M

Project Manager

B

Quality Assurance Lead

M

Hosting Migration Project Lead

M

Security Lead

M

Testing Lead

B

Note: M is the Migration Project H is the Hosting Services B is both Migration Project and Hosting Services *

The Contractor Executive Sponsor, Contractor Information Security Officer, and Contractor Account Executive shall not be directly chargeable to CUNY

8.

H

H

CUNYfirst Migration Project and Hosting Services RFP

All of the key staff except as indicated in the chart above shall be dedicated full time to the CUNYfirst Migration Project and Hosting Services. Other professional personnel shall work on the Migration Project and Hosting Services as scheduled or as otherwise needed and, if assigned full time, shall be dedicated to the Migration Project and Hosting Services with this project assigned as their highest priority; 5. Contractor shall designate an executive-level individual (Executive Sponsor) who will have overall responsibility for the relationship between the parties with respect to the Migration Project and Hosting Services. Contractor shall also designate an Account Executive to serve as Contractor’s regular point of contact to administer the Migration Project and Hosting Services and oversee the overall performance of Contractor’s Responsibilities; 6. During and post migration, Contractor shall maintain the continuity of its resources. Contractor shall obtain CUNY’s prior written approval of persons proposed to replace Contractor Key Team Members; 7. Contractor shall perform background checks on all employees and subcontractors working on the Migration Project and Hosting Services and inform CUNY of the results. CUNY also reserves the right to perform such background checks; 8. CUNY will provide Contractor with a schedule of CUNY holidays and, where available, relevant CUNY employee vacation schedules; 9. The Contractor Project Manager shall (among other project management activities): a) b) c) d) e)

Maintain control over the work duties, schedule, and performance of the Contractor support team; Conduct weekly status meetings; Provide weekly status reports; Provide meeting summaries (minutes) within two (2) business days of meetings; Resolve submitted Service Requests according to priority. Coordinate support and maintenance services issues with CUNY and CUNY's Third Parties, when needed; and f) Provide Migration Project plans for any upgrades or enhancements that include a consolidated plan for each sub-project showing tasks, predecessors, estimated and actual duration, timeline, Contractor resources;

10. Contractor shall designate a Security Lead for the Migration Project and Hosting Services. The Security Lead shall ensure Contractor’s initial and ongoing compliance with: a) Security policies and procedures required by applicable law; b) CUNY’s security policies and procedures as stated at http://www.cuny.edu/about/administration/offices/CIS/security/pnp.html; and c) Contractor’s security methodologies as detailed in its Proposal, as amended and incorporated in Contractor’s Contract with CUNY. Subparagraphs (a), (b), and (c) shall collectively be referred to as “Security Policies and Procedures”. At least once every six (6) months, and at any other time requested by CUNY, Contractor shall provide a written certification to CUNY confirming Contractor’s compliance with the Security Policies and Procedures; 11. Contractor shall obtain CUNY’s prior written approval before Contractor, or any of its officers, employees, or agents, makes any statement to the press or issues any communication or publication concerning or related to CUNY; 12. The Contractor shall ensure that it will comply with CUNY’s Records Retention and Disposition Schedule (see CUNY’s Record Retention Policy at: http://policy.cuny.edu/records_retention_schedule/pdf/#Navigation_Location;

9.

CUNYfirst Migration Project and Hosting Services RFP

13. Contractor shall keep all deliverables up to date, with revisions to be approved by CUNY; and 14. Contractor shall submit invoices with the sufficient and appropriate documentation and submit to Accounts Payable Department, [email protected]. 230 West 41st Street, 5th floor, New York, NY 10036. 2.2 Scope of Services and Deliverables The Contractor shall perform both the Migration Project and Hosting Services as introduced below and further detailed in Attachment A, Exhibits 1 and 2. 2.2.1

Migration Project (Attachment A, Exhibit 1)

The Migration Project includes all the preparatory work necessary to establish the physical, virtual, and network environments for the CUNYfirst Hosting Services at Contractor’s hosting site. It also includes the planning for and moving of all the CUNYfirst applications, CUNY data and any other required objects, from CUNY’s existing hosted environment, testing, qualifying, validating, providing all requisite documentation, and certifying that the applications have been properly moved and are operational. The Contractor and CUNY will develop jointly a Statement of Work, Project Plan, and Joint Resource Plan which will define the phases, tasks, and responsibilities in connection with the Migration Project. The Migration Project is anticipated to be completed within 120 days. 2.2.2 Hosting Services (Attachment A, Exhibit 2) The Contractor will implement a new hosting platform that will: 1. Meet or exceed CUNY's hosting requirements for CUNYfirst set forth in Attachment A, Exhibit 2 and provide all required services and deliverables provided therein; and 2. Employ a scalable and proven infrastructure and a fully supported and certified PeopleSoft software technology stack. Proposers may propose an alternative technology stack, but must then explain how that stack will meet the requirements and service level agreements set forth in Attachment A – Exhibit 2; and 3. Provide a cost effective environment to operationally support and maintain the hosting operations, ensuring a high level of data security while meeting all performance standards set forth in Attachment A – Exhibit 2.

(INTENTIONALLY LEFT BLANK)

10.

CUNYfirst Migration Project and Hosting Services RFP

3. PROPOSAL FORMAT AND CONTENTS 3.1 General Procedures

1. For the purposes of evaluation, each Proposal must consist of: A. Cover Form and Technical and Management Proposal - Volume I; and B. Price Proposal - Volume II

2. Each of the two parts of the Proposal must be complete in itself in order that the evaluation of both parts can be accomplished independently and concurrently, and the Technical and Management Proposal can be evaluated strictly on the basis of its merits. Proposers shall not include any price information in or with the Volume I submittal. CUNY reserves the right to: reject Proposals submitted with conflicting information (information shall be consistent across submitted documents); determine that a Proposer has substantially met the requirements of the RFP and/or to ask for additional information; and deem non-compliance with this section or failure to provide information and/or required forms as non-responsive to this RFP.

3. CUNY will protect confidential and proprietary information from disclosure to the extent permitted by the Freedom of Information Law (FOIL), Article 6 of the Public Officers Law. Accordingly, Proposers must identify as confidential and proprietary those page(s) of their proposal that contain such information by marking each such page “Confidential and Proprietary.”

4. Proposers are not required to provide Proposal surety bond. 5. Proposers must not submit any unnecessary literature (marketing materials, catalogs, sales pamphlets, etc.) with their submission. CUNY is seeking concise and complete responses that address the requirements identified and using the format defined herein. Proposers must tabulate and paginate their Proposal, clearly marking sections with the Section number to which they are responding. The Proposer’s proposal for the Migration Project and Hosting Services will be composed and presented in the following format and order: 3.2 Cover Form The Proposer must sign, notarize and submit the Cover Form with the Proposal. 3.3 Volume I: Technical and Management Proposal The Proposer must submit thirteen (13) paper copies of Volume I, and one (1) soft copy on a CD or DVD (in MS Office 2010 compatible format) — each clearly identified on the cover or label with the Proposer’s name and the words “CUNYfirst Migration Project and Hosting Services RFP Volume I — Technical and Management Proposal.” Proposals must be securely sealed and clearly labeled. The outside packaging containing Volume I copies must be clearly marked with the words “CUNYfirst Migration Project and Hosting Services RFP, Volume I — Technical and Management Proposal.” The outside packaging containing Volume II copies must be clearly marked with the words “CUNYfirst Migration Project and Hosting Services RFP, Volume II — Pricing Proposal.” Proposers shall package Volume II separately from Volume I and not include any information from Volume II in Volume I. All soft copies of all files provided must not be password protected or locked down in any form. Failure to carry out any of the foregoing may result in the rejection of Proposer’s proposal.

11.

CUNYfirst Migration Project and Hosting Services RFP

Note: In accordance with Section 4. Proposal Evaluation, the evaluation of Technical and Management Proposals occurs in two (2) Stages. Stage I includes the evaluation of all the information required to be submitted in response to 3.2 and 3.3 herein. Proposers that are short-listed based on the process set forth in Section 4. Proposal Evaluation, Stage I, Steps 1 through 3 will be notified in writing and required to provide the information contained in Attachment G, Key Personnel, Migration and Hosting Site Capabilities. Do not include Attachment G information in your initial submission of the Volume I Technical and Management Proposal.

3.3.1 Title page The title page of the Proposal must include the name, address, and telephone number of the Proposer, including a contact person and the name of the person(s) who prepared the Proposal. The name(s) and address(es) of all subcontractor(s) must be identified. 3.3.2 Table of Contents 3.3.3. Executive Summary; Attachment B Provide a brief description of the proposed approach and work effort. Please attach your completed Minimum Qualifications Certification (Attachment B) to this executive summary. 3.3.4 Proposer Experience Proposer References 1. Using the form provided in Attachment D, provide at least two (2) and up to six (6) references which verify that the Proposer has successfully migrated and successfully provided hosting services, using Oracle PeopleSoft software version 8.9 (or higher) or a comparable similar ERP system in an environment of similar size and complexity to CUNY. Similar size and complexity will be deemed to mean providing migration and hosting services in an enterprise environment with at least five thousand (5,000) concurrent users, across at least three (3) functional areas and across multiple sites. Proposers with a demonstrated track record of providing migration and hosting services in the public and/or higher education sectors are preferred. CUNY strongly desires that Proposers have migration and hosting experience with Oracle PeopleSoft version 8.9 or higher. 2. References must be current (i.e., work at the reference’s business must have occurred during the last three (3) years). If a particular implementation or integration involved the use of third-party products, identify each such product and the version implemented. 3. Proposers should specifically identify how/whether the migration and hosting services cited above: a. involved scalable, upgradeable solution(s); b. utilized innovative practices and methodologies; c. incorporated support capabilities that ensured maximal usage and system availability.

12.

CUNYfirst Migration Project and Hosting Services RFP

4. Provide a minimum of two (2) references for each proposed subcontractor. All references shall be for a migration project and/or hosting services currently in progress or completed within the last three (3) years and relevant to CUNY’s Migration Project and Hosting Services. The references shall also address the relevant information requested under 3. above. 5. Describe any Proposer and/or subcontractor(s) relevant certifications, alliances or awards.

3.3.5 Migration Project Migration Methodology and Management Plan - see Section 2.2.1 Specifically address each of the following items in sufficient detail for CUNY to fully understand the proposed approach and management plan for accomplishing the Migration Project: 1. methodology including how disaster recovery back-up and uninterrupted service to CUNY will be ensured; 2. management plan for how the effort will be planned, directed and controlled including: a. arrangements for, and roles of any subcontractors; b. the anticipated roles of CUNY management and staff vis-a-vis Proposer (and any subcontractors); and c. an organization chart and staffing plan. 3.

proposed schedule for the Migration Project that identifies key tasks and milestones, and any assumptions for achieving the timeframe(s). Identify any recommendations and opportunities for condensing the schedule.

4. anticipated need for CUNY resources (personnel and other). 5. additional, relevant information that you wish to include for consideration.

3.3.6 Hosting Services 3.3.6.1 Hosting Services – see Section 2.2.2 Describe the proposed hosting platform. Specifically detail how the proposed platform provides a: 1. scalable and proven infrastructure; 2. fully supported technology stack; and 3. cost effective environment that ensures a high level of data security and meets all performance standards. 3.3.6.2 Hosting Services – Attachment A, Exhibit 2 Describe how you will address the areas below based on the requirements set forth in Attachment A, Exhibit 2. Provide a sufficient level of detail so that CUNY may clearly understand how the Proposer (and any subcontractors) will meet their responsibilities as a managed hosting service provider.

1. Hosting facility management; 2. Hardware and operating system management; 13.

CUNYfirst Migration Project and Hosting Services RFP

3. Network management; 4. Storage management; 5. Backup/Restore and disaster recovery; 6. Data administration; 7. Applications management; 8. Release management; 9. Monitoring; 10. Security; 11. Performance management; 12. Contractor customer support center; 13. Communications management; and 14. The anticipated roles of CUNY management and staff vis-a-vis Proposer (and any subcontractors).

(INTENTIONALLY LEFT BLANK)

14.

CUNYfirst Migration Project and Hosting Services RFP

3.4 Volume II – Price Proposal Proposers must submit five (5) paper copies of Volume II, and one (1) soft copy on a CD or DVD (in MS Office 2010 compatible format) — each clearly identified on the cover or label with the Proposer’s name and the words “CUNYfirst Migration Project and Hosting Services RFP, Volume II — Price Proposal.” All copies of Volume II must be packaged separately from Volume I. Failure to do so may result in rejection of Proposer’s Proposal. Proposals shall be securely sealed and clearly labeled. Any outside packaging containing Volume II copies must be clearly marked with the words “CUNYfirst Migration Project and Hosting Services RFP, Volume II —Price Proposal.” ALL PRICING INFORMATION IS TO BE ENTERED ON THE EXCEL SPREADSHEET PROVIDED AS ATTACHMENT C – “Migration Project and Hosting Services RFP – Price Proposal Worksheet.xlsx.” Instructions on how to complete the spreadsheet are contained in the spreadsheet. Volume II consists of two sections: (1) a Price Proposal which sets forth the price for performing the services, including a fixed price for the Migration Project and prices for Hosting Services and Additional Resources Charges. All prices are to be entered on the Attachment C Excel Spread sheet (see Attachment C); and (2) the contract section which specifies the Proposer’s acceptance of the terms and conditions in Attachment A to this RFP, except as provided below. Each Volume II submission is required to contain the following elements: Note: In accordance with Section 4. Proposal Evaluation, the evaluation of the Volume II Price Proposal occurs in two (2) Stages. Stage I includes the evaluation of all the information required to be submitted in response to 3.4.herein. Proposers that are short-listed based on the process set forth in Section 4. Proposal Evaluation, Stage I, Steps 1 through 3 will be notified in writing and will proceed to Stage II. The Volume II Price Proposals from Stage I will continue to be used for the purposes of Stage II; CUNY may seek Best and Final Offers from the Short-Listed Proposers. 3.4.1 Attachment C – Price Proposal Complete Attachment C - pricing for the Migration Project, Hosting Services and Additional Resource Charges (ARCs). Proposer must complete all of the worksheets in the Excel spreadsheet. Prices shall be inclusive of all direct and indirect costs and fee/profit (including but not limited to printing, secretarial, program entry, travel, meals, lodging, overhead, etc.). Proposers shall present their pricing information by completing the Excel spreadsheet included with the procurement package (ATTACHMENT C – “Migration Project and Hosting Services RFP – Price Proposal Worksheet.xlsx.”). Proposers must return the spreadsheets in a non-copyprotected format. A PDF file or any other type of protected format document is not acceptable. Note 1: The Price Proposal includes an affirmation and certification that the Proposer has based its pricing for the Migration Project, Hosting Services and Additional Resource Charges (ARCs) on Attachment A (Master Services Agreement and Exhibits). Proposers are reminded and cautioned not to base the Price Proposal on their standard business terms or practices or any reduced service level agreements or other levels of commitments or obligations that Proposer believes it may negotiate. Proposers found non-compliant with this requirement shall be deemed non-responsive. Note 2: Tax Exemption - CUNY is exempt from the payment of all state, local, sales, and use taxes. The Price Proposal shall not include the amount of any such taxes.

15.

CUNYfirst Migration Project and Hosting Services RFP

3.4.2 Terms and Conditions of Contract Acceptance of Terms and Conditions: The Proposer shall specifically state its acceptance of all Terms and Conditions of the Contract (Attachment A to this RFP), except as described in the following paragraph. Proposers shall complete and submit the “Consultant Information and Certifications Form,” included in Attachment F, to this RFP, to indicate their acceptance of the Contract’s Terms and Conditions. Proposers are to list any exceptions on separate sheet(s) of paper and attach to Attachment F. Any exceptions or deviations taken to the Terms and Conditions of the Contract (Attachment A to this RFP) must contain sufficient amplification and justification to permit evaluation. Such exceptions will not, of themselves, automatically cause a Proposal to be deemed unacceptable. However, a large number of exceptions, or one or more significant exceptions not providing benefit to CUNY may result in rejection of such proposal as unacceptable. CUNY reserves the right to consider only those exceptions or deviations identified and included with Attachment F.

3.4.3 RFP Addenda Acknowledgement Forms RFP Addenda Acknowledgement Forms: Any future addenda to this RFP will contain Addenda Acknowledgement forms. Proposers must have an authorized representative of the firm (or organization) acknowledge receipt and acceptance of each of the Addenda by including a signed copy with their Volume II Proposal. CUNY may reject a Proposer’s submission as non-responsive if Proposer fails to acknowledge receipt and acceptance of RFP addenda in its Proposal. 3.4.4 Required Documents and Forms Proposer shall submit with its Volume II Proposal the following documents, completed and signed by an authorized representative of Proposer in the format attached to this RFP or as may be otherwise required by CUNY: a) b) c) d)

Proposer Information and Certifications Forms (contained in Attachment F); and Compliance with Procurement Lobbying Act (PLA) forms (Attachment H)*; and Company Confidentiality and Non-disclosure Agreement (Attachment I); and M/WBE Utilization Plan (Attachment K, Form #1; Form #2 if applicable)

*All Proposers should visit the following website for more information on the PLA: http://www.ogs.ny.gov/acpl. Filing the two required forms is mandatory for all Proposers in order to be considered for Contract award (see Attachment H). The required forms are: •

Offerer’s Affirmation of Understanding of and Agreement pursuant to State Finance Law §139-j (3) and §139-j (6) (b); and

•

Offerer Disclosure of Prior Non-Responsibility Determinations.

NOTE: Failure to submit the required PLA forms with your Price Proposal may result in the rejection of your Proposal as non-responsive. Use Contract Number (UCO-560) wherever requested in the forms. Please call or e-mail the person identified as the designated contact for this RFP, if you have any questions regarding how to complete the required forms.

16.

CUNYfirst Migration Project and Hosting Services RFP

In accordance with the Procurement Lobbying Act of 2005, any person who wishes to contact CUNY regarding this procurement may only contact the designated contact. The designated contact for this procurement is: Paul Fallon The City University of New York Office of the University Controller Procurement Office, 5th Floor 230 West 41st Street New York, NY 10036 [email protected]

(INTENTIONALLY LEFT BLANK)

17.

CUNYfirst Migration Project and Hosting Services RFP

4. PROPOSAL EVALUATION 4.1

Overview

1.

The Proposal Evaluation process shall be administered by CUNY’s Office of the University Controller. Proposers are required to submit all documents WITH THEIR PROPOSALS. Proposers shall not modify this RFP or any of its Attachments and Exhibits. Submission of a Proposal is deemed assent to the terms of this RFP, subject to exceptions and deviations set forth in the Proposal.

2.

Under no circumstances shall CUNY be liable for any costs incurred by Proposers in preparation and/or production and/or negotiation of a Proposal; for attending the Oral Presentation; for participating in the Site Visit; and/or for any services performed prior to CUNY’s written authorization to proceed.

3.

Proposals will be evaluated by the University using a Best Value Method evaluation process based on the technical and price criteria described below. Technical considerations are of greater importance than price considerations; however, price is a significant factor in the University’s evaluation of proposals. The Price Proposal will be point-scored in accordance with the pre-established criteria listed in Sections 4.2 and 4.3 below.

4.

Proposal evaluation will be conducted by a representative selection committee (Committee) comprised, as appropriate, of CUNY technical, program, and management personnel.

5.

Proposal evaluation will be conducted in two (2) stages: Stage I: Initial Proposal Evaluation and Scoring. Stage I includes the review of Minimum Qualifications, the initial evaluation and scoring of the Volume I Technical and Management Proposals and the scoring of the Volume II Proposals. Stage I will result in the identification of those Proposers whose submissions will be considered further for contract award (Short-Listed Proposers), and proceed to Stage II. In Stage I, the Volume I Technical and Management submissions which pass the Minimum Qualifications review will be evaluated by the Committee based on the technical and management criteria set forth in 4.2 below. Committee members will evaluate each proposal individually and then meet as a group to discuss the Proposals. Proposers may be requested to clarify issues and to provide additional insights into their Volume I Technical and Management Proposal through written clarifications. Evaluators will take into account such discussions and written clarifications in their evaluations and scoring. The Pricing Proposal score will be added to the Technical and Management Proposal score, and the Short-Listed Proposers will be determined in accordance with section 4.2, Step 3. At the conclusion of Stage I, all Proposers will be notified of their status in writing. Short-Listed Proposers will proceed to the Stage II Short-Listed Proposal Evaluation and Scoring. Stage II: Short-Listed Proposal Evaluation and Scoring. In Stage II, Short-Listed Proposers will be required to re-submit their Volume I Technical and Management Proposal. The Volume I Technical and Management Proposal shall be annotated to include any clarifications from Stage I, and shall also provide the information contained in Attachment G. The Short-Listed Proposers’ Volume II Price Proposals from Stage I will continue to be used for the purposes of Stage II. Short-Listed Proposers will be required to participate in Oral Presentations and Site Visits. All information will be scored in accordance with the criteria set forth in 4.3 below.

18.

CUNYfirst Migration Project and Hosting Services RFP

In Stage II, CUNY reserves the right to request Best and Final Offers from the Short-Listed Proposers. Selection of the Short-Listed Proposer for award will be determined in accordance with section 4.3, Step 4.3.5. At the conclusion of Stage II, CUNY will notify all Short-Listed Proposers of their status under the solicitation. 6.

Debriefings At the conclusion of the Stage I and Stage II evaluation periods, respectively, Proposers will be notified of their respective status under this solicitation. Proposers not selected to be Short-Listed, or not selected for award under Stage II, may request a debriefing of their proposal by sending a request in writing, postmarked within 30 days of being notified of being unsuccessful, to the Designated Contact for this solicitation.

7.

Best Value Award CUNY shall award this Contract(s), if at all, based on best value to a responsive and responsible Proposer as these terms are defined by New York State Finance Law Article 11, Section 163.

(INTENTIONALLY LEFT BLANK)

19.

CUNYfirst Migration Project and Hosting Services RFP

4.2

Stage I – Initial Proposal Evaluation and Scoring Stage 1 - Proposal Initial Scoring Criteria and Weights Step Title

Scoring Method

Points out of 100

0

Pre-Screening

Pass/Fail

N/A

1

Minimum Qualifications Review

Pass/Fail

N/A

Minimum qualifications 2 (a)

Technical and Management Proposal

Scored 15

Proposer Experience (3.3.4.1) •

Proposer references

•

Proposer projects and highlights (see 15

Migration Project (see 3.3.5.1)

2(b) 3

•

Management plan

•

Coordination

•

Methodology

Hosting Services (see 3.3.6)

30

Technical and Management Proposal Total

60 Scored

Price Proposal (see 3.4) Total Proposal Scoring for Short-List

20.

40 100

CUNYfirst Migration Project and Hosting Services RFP

STAGE I – Initial Proposal Evaluation and Scoring 4.2.1 Step 0: Pre-Screening CUNY will conduct a Pass/Fail Pre-Screening of each Proposal to ensure that all content has been submitted in accordance with the RFP. Those Proposers whose Proposals do not include all required content will be deemed non-responsive under law, unless CUNY deems such omissions non-material. CUNY will notify non-responsive Proposers in writing. 4.2.2 Step 1: Minimum Qualifications Review In Step 1, CUNY will conduct a Pass/Fail Minimum Qualifications Review of each Proposal that passed PreScreening. CUNY will notify Proposers in writing if their submissions are deemed non-responsive to the Minimum Qualifications. All Proposals which pass the Minimum Qualifications Review will be evaluated and scored based in accordance with the criteria and weights identified above, and Steps 2(a) and 2(b) below. 4.2.3 Step 2(a): Volume I - Technical and Management Proposal Scoring (Sixty (60) Points) The Committee will evaluate each Volume I - Technical and Management Proposal individually and then meet as a group to discuss the Proposals. Proposers may be requested to clarify issues and provide additional insights into their Volume I Technical and Management Proposal through written clarifications. Evaluators will take into account such discussions and written clarifications in their evaluations and scoring. The average Technical Score for each Proposal will consist of the sum of each Committee member’s Technical Score divided by the number of Committee members. 4.2.4 Step 2(b): Volume II - Price Proposal Scoring (Forty (40) Points) CUNY’s Office of the University Controller will perform the Price Proposal scoring. Prices totaled over the entire initial term specified in Section 1.5 of this RFP will be scored using a mathematical calculation in which the lowest price proposed receives the maximum Price Proposal Score of 40 points, and higher proposed prices receive proportionately lower Price Proposal Scores. 4.2.5 Step 3: Stage I Total Proposal Score (Maximum: One hundred (100) Points) The Office of the University Controller will add the average Technical Score (4.2.3) to the Price Score (4.2.4) for each Proposal. The Proposers who are susceptible to award will be designated as the Short-Listed Proposers Short-Listed Proposers will proceed to Stage II Evaluation.

(INTENTIONALLY LEFT BLANK)

21.

CUNYfirst Migration Project and Hosting Services RFP

4.3

Stage II – Short-Listed Proposal Evaluation and Scoring Stage II – Short-Listed Proposal Scoring Criteria and Weights Step

Title

Scoring

Points

Method

Out of 120

1

Annotated Technical and Management

Scored

Proposal with Schedule G Information Proposer Experience

15

•

Proposer references

•

Proposer projects and highlights

•

Key Team Members (Attachment G)

Migration Project 15

•

Management plan

•

Coordination

•

Methodology

•

Technical Information (Attachment G)

Hosting Services (including Attachment G)

30

Technical & Management Proposal Total

60

2

Price Proposal

40

3

Oral Presentation

10

•

4

Quality of presentation including demonstrated understanding of CUNY scope and objectives; key personnel capabilities; relevant experience and approach to managing the effort

10

Site Visit •

10 Quality, completeness and sufficiency of site capabilities

Total

10

120

22.

CUNYfirst Migration Project and Hosting Services RFP

STAGE II – Short-Listed Proposal Evaluation and Scoring Short-Listed Proposers will be notified in writing of their status. Short-Listed Proposers will be required to (1) resubmit their Stage I Technical and Management Proposal annotated to include any clarifications from Stage I, as well the information set forth in Attachment G; (2) participate in a scheduled Oral Presentation; and (3) provide a timely Site Visit. The Volume II Price Proposals from Stage I will continue to be used for the purposes of Stage II; CUNY may seek Best and Final Offers from the Short-Listed Proposers. 4.3.1 Step 1: Annotated Volume I – Technical and Management Proposal with Submission of Attachment G Information (Sixty (60) Points) The Committee will score each annotated Volume I - Technical and Management Proposal including the information required to be provided in Attachment G based on the criteria set forth above. The average Technical Score for each Proposal will consist of the sum of each Committee member’s Technical Score divided by the number of Committee members. 4.3.2 Step 2: Price Proposal Scoring (Forty (40) Points) CUNY’s Office of the University Controller will perform the Price Proposal scoring for the Short-Listed Proposers using the Stage I Price Proposals. Prices totaled over the entire initial term specified in Section 1.5 of this RFP will be scored using a mathematical calculation in which the lowest price proposed receives the maximum Price Proposal Score of 20 points, and higher proposed prices receive proportionately lower Price Proposal Scores. 4.3.3 Step 3: Oral Presentation

(Ten (10) Points)

Short-Listed Proposers will be required to provide an Oral Presentation to the Committee at a CUNY facility in New York City. Inability or unwillingness to provide an Oral Presentation will preclude a Short-Listed Proposer from further evaluation and consideration for award. Attendance by the Proposer’s Account Executive and full time Key Personnel Team members (including subcontractors) identified in response to Attachment G is strongly recommended. 4.3.4 Step 4: Site Visit (Ten (10) Points) CUNY will arrange a Site Visit with each Short-Listed Proposer at the site where the Short-Listed Proposer’s hosting operations to be provided hereunder would take place. Inability or unwillingness to provide a timely Site Visit will preclude a Short-Listed Proposer from further evaluation and consideration for award. The Site Visit will be conducted by a CUNY non-voting site technical team (“Site Technical Team”). The non-voting site technical team will issue a report of its evaluation of the site capabilities of each Short-Listed Proposer. The Committee will use this report to score the Site Visit. 4.3.5 Best and Final Offers (BAFO) CUNY reserves the right to request Best and Final Offers (BAFOs) from Short-Listed Proposers. If CUNY decides to request BAFOs, then CUNY will request a BAFO from each Short-Listed Proposer that has complied with the entire Stage II process set forth above. In the event that CUNY requests BAFOs from the Short-Listed Proposers, Committee members will include the information submitted in the respective BAFOs in their evaluation and scoring using the Stage II criteria in Section 4.3 above.

23.

CUNYfirst Migration Project and Hosting Services RFP

4.3.6 Calculation of Final Total Proposal Scores – Selection of Proposal for Contract Negotiations CUNY’s Office of the University Controller will calculate the Final Total Proposal Score for each Short-Listed Proposer. The Final Total Proposal Score shall be the sum of the scores of each Short-Listed Proposer’s Technical and Management Proposal, Price Proposal, Oral Presentation and Site Visit, based on a possible maximum Final Total Proposal Score of one hundred (100) points. The Short-Listed Proposer that has the highest Final Total Proposal Score shall be selected for contract negotiations. 4.3.7 Negotiations Negotiations will commence with the Short-Listed Proposer with the highest Final Total Proposal Score. Upon notification by CUNY, the selected Short-Listed Proposer must be ready to deploy a senior negotiation team to support contract negotiations. If CUNY and the selected Short-Listed Proposer are unable to reach agreement on all parts of the Agreement, Statement of Work and other project documents, including pricing and other key business terms such as service level agreements, events of default, liabilities, damages, etc. in a timely manner, CUNY reserves the right to terminate negotiations and proceed to the Short-Listed Proposer with the next highest Final Total Proposal Score. If negotiations with that entity are not successful, CUNY may elect to proceed to the Short-Listed Proposer with the third highest Final Total Proposal Score. In the event CUNY is unable to successfully conclude negotiations with the third highest ranked Short-Listed Proposer, CUNY will cancel the solicitation. At the conclusion of negotiations, CUNY may require that the selected Short-Listed Proposer sign such contract as a final written offer with a provision that such offer is irrevocable and cannot be withdrawn for a period of up to one hundred and fifty (150) days (or such longer period of time as CUNY and Proposer may agree). The contract signed by the Proposer can only be countersigned (and thus become a binding agreement between Proposer and CUNY) after the contract is approved by appropriate authorities in CUNY and the State. 4.4 Recommended Short-Listed Proposer Upon successfully concluding negotiations with the selected Short-Listed Proposer, CUNY will take action to promptly and expediently secure all required CUNY and state approvals.

(INTENTIONALLY LEFT BLANK)

24.

CUNYfirst Migration Project and Hosting Services RFP

5. ADMINISTRATIVE SPECIFICATIONS 5.1 Mandatory Pre-Proposal Conference To assist firms in preparing proposals in response to this solicitation, a mandatory pre-proposal conference will be held on July 24, 2014. The Pre-proposal Conference will present a general review of the solicitation, and specific questions regarding the solicitation may be answered. Attendance at the Pre-Proposal Conference is mandatory. The Pre-Proposal Conference will be held on: July 24, 2014 starting at 9:00 AM at: CUNY’s 10th floor conference room at 230 West 41st, New York, NY, 10036 Proposers are requested to notify the Designated Contact, Paul Fallon, of their intent to attend the mandatory PreProposal Conference, along with the names of the attendees, by not later than July 24, 2014. Proposers are requested to limit the number of attendees to five (5) members per firm. Proposers may submit questions in writing in advance of the Pre-Proposal Conference to the Designated Contact. To the extent feasible, CUNY may address any such questions at the Pre-Proposal Conference. Any questions asked at the Pre-Proposal Conference will be compiled by the Designated Contact. Any interpretation, clarification, or correction, as well as any other additions or amendments, and answers to all questions of a substantive nature will be issued in writing by the University as an addendum to the RFP (Addendum). Notifications and questions regarding the RFP may be sent to the Designated Contact at [email protected]. 5.2 Document Viewing Proposers who attended the mandatory Pre-Proposal Conference will be provided the opportunity to view-only certain technical and related system documentation. Proposers are strongly encouraged to view this documentation. The Document Viewing session will be held on: August 13, 2014, from 10:00 am to 4:00 pm at a location to be determined at a later date. Proposers interested in attending the Document Viewing session should notify the Designated Contact, Paul Fallon, and provide the names of the attendees, by not later than August 6, 2014, at [email protected]. Proposers are requested to limit the number of attendees to five (5) members per firm. Proposers will be required to execute the non-disclosure agreement attached to this solicitation as Attachment I in advance of viewing documents. Please be advised that cell phones, iPads and tablets, cameras and any other recording devices will not be allowed in the conference room containing the documentation. You may bring pens, pencils and paper. Questions regarding the documentation will not be addressed at the viewing session. Any questions must be submitted in writing to the Designated Contact at [email protected] by August 25, 2014. All such questions will be compiled by the Designated Contact. Any interpretation, clarification, or correction, as well as any other additions or amendments, and answers to all questions of a substantive nature will be issued in writing by the University as an addendum to the RFP (Addendum) 5.3 Proposal Submission 1. The Proposal shall be signed by an official authorized to bind the Proposer;

25.

CUNYfirst Migration Project and Hosting Services RFP

2. Your proposal must be received by CUNY by 3:00 pm (EDT) on the day indicated in Section 1.6, Schedule of Key Events (above) (Proposal Due Date). The proposal must be addressed to: Paul Fallon The City University of New York Procurement Office, 5th Floor 230 West 41st Street New York, NY 10036 Attention: CUNYfirst Migration Project and Hosting Services RFP. 3. Proposers assume all risks in connection with timely, properly delivered Proposals. strongly encouraged to arrange for delivery of Proposals prior to the Proposal Due Date:

Proposers are

a) The University accepts no responsibility for Proposals left at any other location; b) The University accepts no responsibility for Proposals that are sent by mail or by courier; c) Proposals received after the Proposal Due Date will be returned unopened; and d) Proposals that are transmitted by facsimile (fax) or e-mail are not acceptable and will not be considered. 5.4 Inquiries and Information 1. All questions concerning this solicitation must be directed to the Designated Contact, Paul Fallon, at (212) 397-5614 or by e-mail at [email protected]>. 2. Proposers are reminded that, from the date issued until a Contract is signed, NO contact with any CUNY or Related Entity staff is permitted regarding this solicitation, except with the Designated Contact named above. Any unauthorized contact by a Proposer may result in the rejection of its Proposal. 3. The last date to submit questions for this solicitation is indicated in Section 1.6, Schedule of Key Events. Questions may be submitted by e-mail or via the US Postal Service at the following address: Paul Fallon The City University of New York Office of the University Controller Procurement Office, 5th Floor 230 West 41st Street New York, NY 10036 Attention: CUNYfirst Migration Project and Hosting Services RFP Email: [email protected] 4. All clarifications, corrections, interpretations, additions, amendments, and answers to all questions of a substantive nature, as well as copies of the questions, will be given in writing by the University as an addendum to the RFP (Addendum) and will be sent by e-mail, facsimile, or courier to each entity recorded as having requested a copy of the RFP. The Addendum shall become a part of the RFP and shall be binding on all Proposers. No clarifications, corrections, interpretations, additions, amendments, or answers, other than those given by the University in writing in the form of an Addendum, shall be binding. 5.5 Withdrawal of Proposal 1. A Proposer may withdraw its Proposal at any time before the Proposal Due Date; thereafter, a Proposer may withdraw its Proposal only after the expiration of 180 calendar days from the Proposal Due Date and

26.

CUNYfirst Migration Project and Hosting Services RFP

prior to any actual award. A request to withdraw a Proposal shall be made in writing and delivered to the Proposal submission location described in Section 5.2 above. 2. Upon discovery of a material error by the Proposer or notification of a material error by CUNY, the Proposer may decide that it does not wish to have the evaluation of its Proposal continue. Such request for a withdrawal of a Proposal must be received in writing from the person who signed the Proposal within three business days of such discovery or notification. CUNY shall retain the sole right to determine whether to grant such request for withdrawal of the Proposal and will respond in writing to the Proposer with its decision. 5.6 General Conditions 1. This RFP is being conducted in compliance with all requirements of applicable New York State laws, including, without limitation, New York State Finance Law §139-j and §139-k, and University regulations. This RFP is intentionally structured with broad guidelines and few mandated components in order encourage competition. 2. Proposers shall not make any changes to the documents of this RFP. All Proposers are required to submit Proposals in response to the same terms and conditions. Attempts to make changes to the RFP documents may render a Proposal non-responsive. Changes to the RFP documents by others are not binding on the University. a) Proposers shall indicate on the Proposer Information and Certification Form in Attachment F, Part III, any exceptions or deviations from the Terms and Conditions of Contract (ATTACHMENT A). Unless exceptions or deviations are so indicated, CUNY will assume that a Proposer agrees to the Terms and Conditions. CUNY reserves the right to accept or reject any exceptions or deviations a Proposer may suggest. 3. Proposers are expected to have assessed the conditions that may affect services to be provided. Proposer shall be presumed to have full knowledge of any and all conditions affecting, in any way, the performance of the work under the Contract that were or should have been discovered by a reasonably prudent Proposer. It is each Proposer’s responsibility to familiarize itself with relevant facilities at the University, and Proposer assumes full responsibility to provide services as specified herein that meet the Contract requirements for the Proposal Price. 4. All Proposals, upon submission to CUNY, shall become its property for use as deemed appropriate. By submitting a Proposal, the Proposer covenants not to make any claim for, or have any right to, damages because of any misinterpretation or misunderstanding of the specification, or because of any misinformation or lack of information. 5. In accordance with New York State Finance Law, Section 163, contract award is made on the “basis of best value to a responsive and responsible offerer.” All selected offerers of contracts valued at $100,000 or more will be required to provide vendor responsibility information to CUNY before negotiation of a contract. CUNY recommends that vendors file the required Vendor Responsibility Questionnaire online via the New York State VendRep System. To enroll in and use the New York State VendRep System, see the VendRep System Instructions at http://www.osc.state.ny.us/vendrep/vendor_index.htm, or go to the VendRep System online at https://portal.osc.state.ny.us. Vendors must provide their New York State Vendor Identification Number when enrolling. To request assignment of a Vendor ID, or for VendRep System assistance, contact the Office of the State Comptroller’s Help Desk at 866-370-4672 or 518-4084672, or by e-mail at [email protected]. Vendors opting to complete a paper questionnaire can obtain the questionnaire from the VendRep website at http://www.osc.state.ny.us/vendrep, or may contact CUNY or the Office of the State Comptroller’s Help Desk. CUNY reserves the right to require a hard copy of vendor responsibility forms (as may be provided by CUNY) from Proposers for solicitations valued in excess of $100,000. All such forms shall be submitted within ten (10) days of CUNY’s request.

27.

CUNYfirst Migration Project and Hosting Services RFP

6. Proposers should be aware that, per Section 5-a of the NYS Tax Law, all vendors selected for contracts in excess of $100,000 for the sale of goods or services must complete and submit (Contractor Certifications) Form ST-220-TD to the State and Form ST-220-CA to the University. Proposers can view these forms by visiting the following websites: http://www.tax.ny.gov/pdf/publications/sales/pub223.pdf http://www.tax.ny.gov/pdf/current_forms/st/st220ca_fill_in.pdf http://www.tax.ny.gov/pdf/current_forms/st/st220td_fill_in.pdf 7. Any contract entered into pursuant to an award of this solicitation shall contain a provision that grants the option to extend the terms and conditions of such contract to any other State agency in New York. However, any response to this solicitation shall be based solely on the purpose of this solicitation and shall not factor in the possibility that this contract may, in the future, be applicable to other State agencies. Please be advised that any award made pursuant to this solicitation shall be based on the specific requirements of this solicitation only. 8. Under no circumstances shall CUNY be liable for any costs incurred by Proposers in the preparation and/or production and/or negotiation of a Proposal or for attending Proposers’ conferences and/or site visits, preparing for or attending an Oral Presentation, or for any Services performed prior to the date set forth in the notice of award CUNY sends to the Proposer awarded the Contract. 9. Receipt of a Proposal by CUNY does not indicate that the University has reviewed the Proposer’s qualifications to receive a contract award. The University shall review the Proposal and make a determination of each Proposer’s qualifications to receive a contract award after the Proposal Due Date. There will not be a public opening of Proposals. 10. Issuance of this RFP does not commit the University to award a contract for any services. 11. Any contract award shall be subject to all required internal and external oversight approvals, including, as applicable, approvals by the University’s Board of Trustees, the Office of the New York State Attorney General, the Office of the New York State Comptroller, the New York City Law Department, and the Office of the New York City Comptroller, and shall be contingent on the availability of funds. The University shall have no obligation or liability whatsoever to the Proposer selected as a result of this solicitation, unless and until a contract satisfactory to the University is approved and executed by the Proposer and all necessary State officials, if any. 12. By signing and submitting a Proposal, Proposer is affirming that it has read this RFP, including but not limited to the Terms and Conditions of Contract (ATTACHMENT A), accepts its terms, and is able and willing to sign the Contract if its Proposal is selected, subject only to any changes negotiated and agreed to by both parties. The Terms and Conditions, together with the contents of the selected Proposal, any Addenda, including any formal questions and answers provided during the evaluation process, shall be incorporated into and comprise the Contract. The issuance of a letter of intent to award or similar documentation does not require or commit CUNY to enter into the Contract with a Proposer until all terms and conditions are negotiated and acceptable to CUNY. 13. The selected Proposer shall possess the requisite business integrity justifying the confidence of CUNY; to adhere, throughout the duration of the project, to the highest standards of business conduct and professional responsibility by fulfilling its obligations under the resulting Contract, and as required under Section 139 (j) and (k) and 163(9)(c) of the State Finance Law. 14. Conflicts between documents shall be resolved in the following order of precedence: a) NYS Appendix A; b) Executed Contract with Contractor, including ATTACHMENT A – Master Services Agreement and Exhibits;

28.

CUNYfirst Migration Project and Hosting Services RFP

c) Section 2 – Contract Responsibilities of this RFP; d) Other documents and information issued by the University; and e) Information submitted by Proposer, including Contractor’s Proposal. 15. Any Contract award shall be subject to the submission of all documentation required by CUNY and receipt of all necessary governmental approvals. Proposers shall complete, sign, and submit within ten (10) days of CUNY’s request, any documentation required by CUNY, which may include, without limitation, the following: a) New York State Vendor Responsibility Questionnaire; b) Tax Law § 5-a, Form ST-220-CA and ST-220-TD - Contractor Certification; c) New York State Consultant Services - Planned Employment Forms for Consultants; d) New York City Vendor Qualification Questionnaire (VENDEX); e) New York City Principal Questionnaire (VENDEX); f) Executive Law Article 15-A - Minority and Women-Owned Business Enterprises and Equal Employment Opportunity Policy Statement; g) Executive Law Article 15-A - Equal Employment Opportunity Staffing Plan; h) Evidence, in form and substance satisfactory to the University, that Contractor maintains worker’s compensation and disability insurance coverage required by the New York State Workers’ Compensation Law; and CUNY reserves the right to require such documentation from any proposed subcontractors. Failure to provide any such documentation timely, in form and substance acceptable to CUNY, shall be grounds for rejection of a Proposer’s proposal. Additional information on certain of these requirements may be set forth in this RFP.

5.7 Reservation of Rights In addition to any other rights described in this RFP, CUNY reserves the following rights: 1. To accept or reject any or all Proposals including, without limitation, to reject a Proposal if: a) The Proposer does not provide any part of the information or documents required by the RFP; b) The Proposer misstates, misleads, or conceals any material fact in its Proposal or at any time in connection with this RFP; c) The Proposal is not in compliance with law; d) The Proposal is not responsive to the requirements of this RFP or the requirements of the Contract terms and conditions; e) Any part of the Proposal, such as the Price Proposal, is conditional; f) The Proposal, in the opinion of CUNY, contains unbalanced prices; or g) A determination that the Proposer is not “responsible” (as defined by law) is made in accordance with law or CUNY regulations. 2. To re-issue a solicitation; 3. To correct any arithmetic errors in any or all Proposals;

29.

CUNYfirst Migration Project and Hosting Services RFP

4. To use or adopt any or all of a selected Proposer’s Proposal; 5. To negotiate modifications to the scope, Contract terms and conditions, and fee with the selected Proposer prior to contract award; 6. To reject Proposals containing material deviations (as that term is construed by New York State law), and/or permit Proposer(s) to amend one or more non-material item in their Proposal(s) to comply with this RFP and/or waive or modify minor irregularities in Proposals; a) In the event of a discrepancy between the Proposal Price, as stated in words and as stated in numbers, or as stated on any other part of a Proposal, the University reserves the right to deem the lower price to be the Proposal Price; and b) In the event of an arithmetic error in Proposer’s multiplication of the unit price by the quantity of that item specified, University reserves the right to make the arithmetic correction and deem the corrected amount the Proposal Price. 7. To seek clarifications concerning Proposals; 8. To amend the RFP after its Release Date upon appropriate notification; 9. To issue Requests For Additional Information (RFAIs”) to Proposers; 10. To require Short-Listed Proposers to attend Oral Presentations. 11. To issue additional questions to Short-Listed Proposers. The answers to such questions shall be returned to CUNY, in writing, and become part of the Short-Listed Proposer's Proposal. 12. To allow evaluators to include in their final score an evaluation of Answers to Required Questions and such additional materials as Proposers provide; 13. To contact all Proposer references during the Proposal Evaluation process. 14. To ask Short-Listed Proposers for Best and Final Offers; 15. To terminate negotiations with a prospective awardee if negotiations of legal terms and conditions are unsuccessful; and 16. Upon terminating negotiations with a Short-Listed Proposer, to negotiate with the next highest ShortListed Proposer.

5.8 Consultant Employment Disclosure Forms Proposers may refer to Chapter XI.18.C (Consultant Disclosure Legislation) of the New York State Guide to Financial Operations, available at the State Comptroller’s website (http://www.osc.state.ny.us/agencies/guide/MyWebHelp/ ), to become familiar with Consultant Employment Disclosure requirements. Each Consultant selected as a result of this solicitation shall complete the ‘State Consultant Services – Contractor’s Planned Employment” form, as required by CUNY, and submit it when their contract is signed. For each contract year thereafter, each Consultant shall complete the “State Consultant Services Contractor’s Annual Employment Report” form, as required by CUNY, and submit copies to the Office of the State Comptroller, the University of Civil Service, and the City University of New York on or before May 15 of each year.

30.

CUNYfirst Migration Project and Hosting Services RFP

5.9 Consultant Responsibility When Proposing to Use a Former CUNY Employee It is the Consultant’s responsibility to ensure that it proposes staff eligible to work on the subject project. Under the attached procedures, before the consultant proposes a former CUNY employee, the individual must obtain an opinion from the New York State Ethics Commission that approves their participation in the subject project. For an outline of the procedure that applies to this situation, see Attachment E.

31.

CUNYfirst Migration Project & Hosting Services RFP

ATTACHMENTS A through K

CUNY Hosting RFP

ATTACHMENTS COVER PAGE

MASTER SERVICES AGREEMENT BY AND BETWEEN

THE CITY UNIVERSITY OF NEW YORK AND

[PRIME VENDOR] ___________, 2014

CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

TABLE OF CONTENTS PAGE RECITALS

..........................................................................................................

ARTICLE 1

SCOPE OF AGREEMENT, PARTNERING PRINCIPLES AND RELATIONSHIP MANAGEMENT ........................................... Scope of Agreement .......................................................................... Partnering Principles .......................................................................... Relationship Management.................................................................. 1.3.1 General .................................................................................. 1.3.2 Executive Sponsors ................................................................ 1.3.3 Executive Briefings ................................................................. 1.3.4 Prime Vendor Account Executive ........................................... 1.3.5 Prime Vendor Project Management ........................................ 1.3.6 Prime Vendor Contract Manager ............................................ 1.3.7 Compliance with Security Policies and Procedures; Prime Vendor Information Security Officer; and Security Certification .......................................................................... Conflicts in Interpretation ................................................................... Definitions and Construction ..............................................................

1.1 1.2 1.3

1.4 1.5 ARTICLE 2

ARTICLE 3 3.1 3.2

3.3

3.4 3.5 3.6 ARTICLE 4 4.1 4.2 4.3 4.4 4.5

HOSTING SERVICES, THE MIGRATION PROJECT AND FUTURE PROJECTS AND SERVICES .................................. PRICING AND PAYMENT TERMS.................................................... Fees for Hosting Services .................................................................. Project and Other Services-Based Fees ............................................ 3.2.1 Services Fees......................................................................... 3.2.2 Service Rate(s)....................................................................... 3.2.3 Adjustment of Services Fees Under Time and Material Arrangements ....................................................................... Payment of Invoices ........................................................................... 3.3.1 General .................................................................................. 3.3.2 Timeliness and Accuracy of Invoices ...................................... 3.3.3 Payment and Disputes ........................................................... Travel and Out-of-Pocket Expenses................................................... Set-Off Rights .................................................................................... Taxes ................................................................................................. REPRESENTATIONS, WARRANTIES AND COVENANTS .............. Services Warranty .............................................................................. Disabling Codes ................................................................................. Comprehensiveness of Project Agreements and Contract Supplements and Sufficiency of Due Diligence ................................ Correction of Failure to Meet Functionality and Performance Warranties ....................................................................................... Warranty of Authority .........................................................................

-iCUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

1

2 2 2 3 3 3 4 4 4 4

5 6 7 8 9 9 9 9 9 9 10 10 10 11 11 11 11 12 12 12 12 13 13

4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13

Pending Litigation Warranty ............................................................... Offshoring .......................................................................................... CUNY Data ........................................................................................ Conflicts of Interest ............................................................................ Compliance with Federal and State Programs ................................... Additional Warranties ......................................................................... Material Misstatements or Omissions ................................................. Disclaimer of Warranties ....................................................................

13 13 14 14 15 15 15 15

ARTICLE 5 5.1

TERM AND TERMINATION .............................................................. Term .................................................................................................. 5.1.1 Term of Agreement................................................................. 5.1.2 Term of Project Agreements and Contract Supplements ........ 5.1.3 Termination for Convenience .................................................. 5.1.4 Termination Due to Insufficient Funding ................................. 5.1.5 Survival .................................................................................. Events of Default ................................................................................ Rights and Remedies of Prime Vendor Upon Default of CUNY .......... Rights and Remedies of CUNY Upon Default of Prime Vendor .......... Transition Services.............................................................................

15 15 15 16 16 17 17 17 18 18 19

ARTICLE 6 6.1 6.2 6.3 6.4

LIMITATION ON LIABILITY .............................................................. Cap on Damages.................................................................................... Exclusions from Limitations on Liability .............................................. Restoration of Liability Cap ................................................................ Costs of Cure .....................................................................................

19 19 20 20 20

ARTICLE 7 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8

DATA RIGHTS, CONFIDENTIALITY AND DATA SECURITY .......... Ownership of Data ............................................................................. Confidential Information ..................................................................... Public Records Disclosures................................................................ Confidentiality of Prime Vendor Personnel ......................................... Notification Obligation ........................................................................ Information Sharing ............................................................................ HIPAA ................................................................................................ Security .............................................................................................. 7.8.1 Data Security Program ........................................................... 7.8.2 Security Breaches .................................................................. 7.8.3 Security Breach Notification Statutes ...................................... Survival ..............................................................................................

20 20 20 21 21 21 22 22 22 22 22 23 23

INDEMNIFICATION ........................................................................... General .............................................................................................. Infringement ....................................................................................... Procedures for Indemnification ........................................................... 8.3.1 General .................................................................................. 8.3.2 Defense .................................................................................. 8.3.3 Settlement of Claims .............................................................. Survival; No Limitations on Liability ....................................................

23 23 24 24 24 24 24 24

5.2 5.3 5.4 5.5

7.9 ARTICLE 8 8.1 8.2 8.3

8.4

-iiCUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ARTICLE 9 9.1 9.2 9.3 9.4 9.5

DISPUTE RESOLUTION ................................................................... Administrative-Level Performance Review ......................................... Executive-Level Performance Review ................................................ Voluntary, Non-Binding Mediation ...................................................... Redress in Court ................................................................................ Continued Performance; No Tolling of Cure Periods ..........................

25 25 25 25 25 25

ARTICLE 10 10.1 10.2

MISCELLANEOUS ............................................................................ Notices ............................................................................................... Audits and Requests for Records ....................................................... 10.2.1 Financial Audits ...................................................................... 10.2.2 Operational and Security Audits by CUNY .............................. 10.2.3 Maintenance of Records ......................................................... Insurance ........................................................................................... 10.3.1 Required Coverages............................................................... 10.3.2 Additional Insureds and Evidence of Coverage ...................... 10.3.3 Claims-Made Coverage .......................................................... 10.3.4 Notice of Cancellation ............................................................. 10.3.5 Subcontractor Insurance......................................................... Approval of Subcontractors ................................................................ Force Majeure .................................................................................... Notice of Financial Impacts ................................................................ No Agency ......................................................................................... Severability ........................................................................................ Waiver................................................................................................ Governing Law; Exclusive Jurisdiction ............................................... Binding Nature and No Assignment ................................................... Counterparts ...................................................................................... Public Announcements ...................................................................... CUNY Policies ................................................................................... Compliance with Laws ....................................................................... Waiver of UCITA ................................................................................ Binding, Irrevocable Offer .................................................................. No Construction Against Drafter ......................................................... Contractor Certifications ..................................................................... Comptroller's Approval ....................................................................... Entire Agreement; Modifications.........................................................

25 25 26 26 27 27 27 27 28 28 28 28 29 30 30 30 31 31 31 31 31 31 32 32 32 32 32 32 33 33

10.3

10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11 10.12 10.13 10.14 10.15 10.16 10.17 10.18 10.19 10.20 10.21

-iiiCUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULES AND EXHIBITS APPENDIX AND SCHEDULES Appendix A Schedule 1.5 Schedule 2.1 Schedule 2.2 Attachment A Schedule 2.3 Attachment A Schedule 2.4 Schedule 3.2.2 Schedule 10.3.1 Schedule 10.14

New York State Appendix A Definitions Project Management Services Change Order Procedures Change Order Form Certification Process for Deliverables; Ownership Certification Form Personnel Service Rate(s) Insurance Coverages CUNY Policies

EXHIBITS Exhibit 1 Exhibit 2 Exhibit 3 Exhibit 4

Migration Project Agreement Hosting Services Subcontractor Confidentiality and Non-Disclosure Agreement Third Party Confidentiality and Non-Disclosure Agreement

-ivCUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

MASTER SERVICES AGREEMENT This Master Services Agreement ("Agreement" or "MSA") is made and entered into as of ______________, 2014 (the "Effective Date"), by and between The City University of New York, an educational corporation acting pursuant to New York State Education Law Article 125, with a place of business at 205 East 42nd Street, New York, NY 10017 ("CUNY"), and _____________________, a _______ corporation, with a principal place of business at _________________________________ ("Prime Vendor"). WHEREAS, on _________________, 2014, CUNY issued a request (the "RFP", as further defined herein) to provide hosting services ("Hosting Services" as further defined herein) (the conversion and migration of CUNY's current hosted environment to Prime Vendor's hosting environment is referred to as the "Migration Project"). WHEREAS, on _______, 2014, Prime Vendor submitted to CUNY its written response to the RFP, as subsequently supplemented (the "Hosting RFP Response", as further defined herein), and in the Hosting RFP Response and otherwise Prime Vendor represented to CUNY that it has the equipment, facilities, infrastructure, disaster recovery and business continuity, software, services, skills and personnel required to meet the requirements set forth in the RFP, transition, convert and migrate CUNY's current hosted environment to Prime Vendor's hosted environment with no disruption in CUNY's systems or operations and provide the Hosting Services, all in accordance with the terms set forth in the Agreement. WHEREAS, Prime Vendor acknowledges that during the negotiation period, including the implementation planning study workshops, it had sufficient time and opportunity to conduct comprehensive due diligence on the Migration Project, including the ability to obtain a full understanding and clarification of the CUNY Requirements. WHEREAS, in reliance on the representations made by Prime Vendor in the Hosting RFP Response and in subsequent discussions, presentations to CUNY and the commitments and assurances made by Prime Vendor herein, CUNY selected Prime Vendor over other prospective technology providers to provide the Hosting Services. WHEREAS, CUNY and Prime Vendor want to specify the terms and conditions under which Prime Vendor and CUNY will form their long-term technology partnership, for Prime Vendor to provide the Hosting Services, and engage in future projects and services as may be agreed to by the parties. NOW, THEREFORE, in consideration of the foregoing and the mutual covenants and agreements hereinafter set forth, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree to the foregoing and as follows:

-1CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ARTICLE 1 SCOPE OF AGREEMENT, PARTNERING PRINCIPLES AND RELATIONSHIP MANAGEMENT 1.1 Scope of Agreement. The Agreement shall apply to all Services provided by Prime Vendor to CUNY, whether such Services are contemplated as of the Effective Date or thereafter. 1.2 Partnering Principles. The principles identified below ("Partnering Principles") include principles that the parties have determined to be important to ensure the success of their relationship. The Partnering Principles function as "constitutional" statements regarding the parties’ overall intentions for the Agreement and all Project Agreements and Contract Supplements executed pursuant to the Agreement. If any term or condition of the Agreement or any Project Agreement or Contract Supplement is ambiguous or unclear or if the parties did not anticipate a particular issue, the parties shall refer to and apply the Partnering Principles to resolve and/or address the ambiguous, unclear and/or unanticipated issue. PARTNERING PRINCIPLE #1

DIRECT SENIOR EXECUTIVE OVERSIGHT AND DECISION MAKING

Direct senior executive oversight and involvement by both parties are needed to ensure all commitments and timeframes are met. While ultimate decision making authority with respect to the Migration Project and future projects rests with CUNY, Prime Vendor and CUNY must each manage their personnel and discharge their duties within the agreed parameters and requirements to ensure the projects are successfully implemented.

PARTNERING PRINCIPLE #2

COMPETITIVE PRICING, GROWTH OF CUNY AND PREDICTABILITY OF ON-GOING COSTS AND EXPENSES

Prime Vendor’s Services must be competitively priced and contemplate the growth in use at CUNY. Costs and expenses must be clearly articulated and understood by the parties prior to initiating a project or any change orders. Cost, personnel and other resource requirements must be clearly outlined for all parties. PARTNERING PRINCIPLE #3

QUALITY PERSONNEL TO SUPPORT THE RELATIONSHIP

Qualified personnel will be devoted by both parties to the relationship. The parties will commit appropriate, qualified management, technical, administrative and other support personnel to achieve the objectives of the relationship.

-2CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

PARTNERING PRINCIPLE #4

COOPERATION WITH CUNY'S OTHER TECHNOLOGY PARTNERS

Joint planning, open communication, and cooperation and collaboration between CUNY and all of its technology partners will be required. PARTNERING PRINCIPLE #5

ALIGNMENT OF ACCOUNTABILITY AND RESPONSIBILITY

Accountability and responsibility of roles should be aligned to ensure that each party is responsible for the aspects of a project, service or relationship that they control.

PARTNERING PRINCIPLE #6

THOROUGH AND SPEEDY ISSUE RESOLUTION

Prime Vendor and CUNY will ensure a thorough and speedy resolution of issues that arise in the relationship, including issues that may arise in a project or the delivery of a service.

PARTNERING PRINCIPLE #7

TRANSPARENCY OF ENVIRONMENT AND SERVICE DELIVERY PRACTICES

Prime Vendor will ensure the transparency of all of its practices for the delivery of the hosting environments and services to CUNY under the Agreement or any Project Agreement or Contract Supplement. 1.3 Relationship Management. The parties commit to proactive sponsorship of the relationship created under the Agreement, and to further the interests of the relationship, agree to the following: 1.3.1 General. Each party shall allocate appropriate, quality personnel to fulfill the objectives of the relationship including, as appropriate and applicable, personnel to fulfill the obligations set forth herein and in a Project Agreement and/or Contract Supplement. If either party believes that the other has not allocated sufficient personnel, the matter will be brought to the attention of the Executive Sponsors for resolution. 1.3.2 Executive Sponsors. Each party shall designate a senior executivelevel individual (for CUNY, the "CUNY Executive Sponsor," and for Prime Vendor, the "Prime Vendor Executive Sponsor," and each an "Executive Sponsor") who will have overall responsibility for the relationship between the parties with respect to the relationship. The Prime Vendor Executive Sponsor shall be the Chief Executive Officer of Prime Vendor or a direct report to the Chief Executive Officer and have full authority to act on behalf of Prime Vendor with respect to all matters related to the Agreement. CUNY may designate a new Executive Sponsor at any time by providing written notice thereof Prime Vendor. Prime Vendor Executive Sponsor's support of the relationship, including partici-3CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

pation in phone calls, meetings (on-site and off-site), problem resolution and the like, and any expenses incurred in connection therewith, shall not be chargeable to CUNY. 1.3.3 Executive Briefings. The relationship with Prime Vendor will involve a significant investment and substantial commitment from CUNY in the form of monies, personnel, time and effort. During the pendency of the Migration Project, the Executive Sponsors and other appropriate representatives from each party shall meet at least quarterly, or more frequently if needed, at CUNY, to discuss the overall relationship of the parties, the status of the Migration Project, the status of and any risks, issues and any problems or difficulties relating to the Migration Project and the Hosting Services, whether timeframes are being met, and what actions Prime Vendor can take to mitigate such risks, issues, problems or difficulties. From and after Project Completion of the Migration Project, the Executive Sponsors shall meet annually, or more frequently at the request of a party, at CUNY's offices, to discuss the overall relationship of the parties, any risks, issues, problems or difficulties relating to Hosting Services and any and such other items as appropriate. 1.3.4 Prime Vendor Account Executive. Prime Vendor shall designate an individual (the "Prime Vendor Account Executive") to serve as Prime Vendor’s regular point of contact to administer the Agreement and projects, oversee the delivery of Services to CUNY and the overall performance of Prime Vendor’s responsibilities under the Agreement and any Project Agreements and Contract Supplements. The Prime Vendor Account Executive shall attend all executive briefings. If CUNY perceives that the Prime Vendor Account Executive is not effectively discharging his or her duties, at CUNY's request, Prime Vendor shall replace such individual. Prime Vendor shall not charge CUNY for any Services, meeting time, etc., provided or expenses incurred by the Prime Vendor Account Executive. 1.3.5 Prime Vendor Project Management. For each project, Prime Vendor shall appoint one or more Prime Vendor Project Manager(s) ("Prime Vendor Project Manager(s)"), and where more than one Prime Vendor Project Manager is assigned, then a project director to oversee the multiple Prime Vendor Project Managers ("Prime Vendor Project Director"). 1.3.6 Prime Vendor Contract Manager. Prime Vendor shall designate an individual (the "Prime Vendor Contract Manager") to be responsible primarily for ensuring Prime Vendor’s contractual compliance with the Agreement, and for proactively communicating and coordinating with Prime Vendor's Project Director, Project Manager(s) and other Prime Vendor personnel as needed, to ensure such compliance. In furtherance thereof, the Prime Vendor Contract Manager shall, among other things: (a) Be fully knowledgeable about all the Hosting Services and other commitments made by Prime Vendor in the Agreement, Hosting Services Exhibit, Project Agreements and Contract Supplements, especially where such commitments may differ from Prime Vendor’s general business practices and policies; (b) Advise Prime Vendor personnel and Prime Vendor’s subcontractors on the commitments made by Prime Vendor to ensure the Prime Vendor personnel have a full and complete understanding of the level and scope of the -4CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

commitments made under the Agreement, Project Agreements and Contract Supplements; (c) Along with the Prime Vendor Account Executive, serve as a point of contact to administer the Agreement; (d) Ensure that all policies and procedures relating to Prime Vendor’s administration of the Agreement are applied consistently by Prime Vendor; and (e) Such other duties or responsibilities relating to the administration of the Agreement as may be reasonably requested from time-to-time by either party. 1.3.7 Compliance with Security Policies and Procedures; Prime Vendor Information Security Officer; and Security Certification. (a) Compliance with Security Policies and Procedures. Prime Vendor shall comply with: (i) security requirements and obligations required by applicable Law; (ii) the CUNY Security Policies and Procedures; and (iii) Prime Vendor's security standards, policies, guidelines and procedures, provided that the CUNY Security Policies and Procedures shall take precedence over any inconsistencies or conflicts with Prime Vendor's security standards, polices, guidelines and procedures (subsections (i) through (iii) are collectively referred to as the "Security Policies and Procedures"). If there is a change in the Security Policies and Procedures from and after the Effective Date that applies to all similarly-situated CUNY vendors, Prime Vendor shall be required to comply with such change. (b) Prime Vendor Information Security Officer Responsibilities. Prime Vendor shall designate a corporate officer ("Information Security Officer") who shall, at no cost or expense to CUNY: (i) Be responsible to ensure Prime Vendor's initial and ongoing compliance with the Security Policies and Procedures; (ii) At least once every six (6) months, and at any other time requested by CUNY, provide a written certification to CUNY confirming Prime Vendor's compliance with the Security Policies and Procedures; and (iii) Upon CUNY's request, including following any certification related to Prime Vendor's compliance with the Security Policies and Procedures, meet with CUNY's Chief Information Security Officer to discuss Prime Vendor's certification, the Security Policies and Procedures or other related matters. (c) Security Certifications. Prime Vendor represents and warrants that it is certified under ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) ISO/IEC 27001:2005 or 2013, -5CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Code of Practice for Information Security Management ("ISO Security Standards"), and shall maintain such certification on an on-going basis. Prime Vendor shall provide CUNY with full and complete copies of any ISO Security Standards and other security audits, reports and reviews, whether conducted internally by Prime Vendor or through a Third Party, within five (5) days of a request by CUNY and within twenty (20) days of Prime Vendor's receipt of such audits, reports and reviews. If there are deficiencies cited and/or recommendations made, the Prime Vendor Information Security Officer, the Prime Vendor Executive Sponsor and other appropriate personnel from Prime Vendor shall meet to review the deficiencies and recommendations and develop a plan of action to address such items. The implementation of any measures to address deficiencies and/or recommendations shall not be chargeable to CUNY. 1.4 Conflicts in Interpretation. In resolving any inconsistencies relating to the Agreement, the following order of precedence shall be followed: (a) First, and most senior, and except as otherwise stated in the Agreement, to the extent the subject matter is not addressed in the Agreement, applicable Laws and the terms and conditions of New York State Appendix A; (b)

Second, the terms contained in the main body of the Agreement;

(c) Third, the terms contained in any Schedule, Exhibit (except for Project Agreement and Contract Supplement) and/or Attachment to the Agreement, provided that no order of precedence shall be given among them; (d) Fourth, the terms contained in the main body of a Project Agreement and/or Contract Supplement; (e) Fifth, the terms contained in any Schedule, Exhibit and/or Attachment to a Project Agreement and/or Contract Supplement other than the Project Plan and any Statement of Work, provided that no order of precedence shall be given among them; (f) Sixth, the Statement of Work document, if any, for the applicable Project Agreement and/or Contract Supplement; (g) Seventh, the Joint Resource Plan, if any, for the applicable Project Agreement and/or Contract Supplement; (h) Eighth, the Project Plan, if any, for the applicable Project Agreement and/or Contract Supplement; (i)

Ninth, the RFP Response; and

(j) Tenth, any Documentation (to the extent not included in one of the preceding subsections) in the order of precedence contained in the definition thereof. All RFP Responses, including the Hosting RFP Response, are incorporated herein by reference and made a part of the Agreement. In addition, all Schedules, Attachments and Exhibits to the -6CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Agreement, including the following, are incorporated herein by reference and made a part of the Agreement: Appendix A Schedule 1.5 Schedule 2.1 Schedule 2.2 Attachment A Schedule 2.3 Attachment A Schedule 2.4 Schedule 3.2.2 Schedule 10.3.1 Schedule 10.14

New York State Appendix A Definitions Project Management Services Change Order Procedures Change Order Form Certification Process for Deliverables; Ownership Certification Form Personnel Service Rate(s) Insurance Coverages CUNY Policies

Exhibit 1

Migration Project Agreement (including all Schedules and Exhibits therein) Hosting Services (including all Schedules and Exhibits therein) Subcontractor Confidentiality and Non-Disclosure Agreement Third Party Confidentiality and Non-Disclosure Agreement

Exhibit 2 Exhibit 3 Exhibit 4

Prime Vendor Implementation Methodologies will be used in the Migration Project and in future projects. Using such Prime Vendor Implementation Methodologies may involve the use of terms, conditions, processes, protocols, workflows, assumptions or other features that the parties are required to follow. Using, following or implementing such Prime Vendor Implementation Methodologies shall not alter or modify Prime Vendor’s obligations under the Agreement or any Project Agreement. Without limiting the generality of the foregoing, to the extent a project charter, "project management plan," "project initiation plan," "test materials" or similar documents are developed for the Migration Project or other project, but are not attached to the applicable Project Agreement or Contract Supplement on its effective date, such items must be developed consistently with the terms of the Agreement, and any deviation from the terms of the Agreement because of the Prime Vendor Implementation Methodologies or otherwise, will not be deemed to amend or modify the terms of the Agreement, and the parties expressly disclaim that such changes amend the Agreement through course of dealing, by operation of law or otherwise. 1.5 Definitions and Construction. Capitalized terms used herein shall have the meanings ascribed to them in Schedule 1.5, or in any other Schedule, Exhibit or Attachment. Any project-specific definitions, if any, shall be included in the applicable Project Agreement or Contract Supplement. The words "include", "including" and variations thereof, will not be deemed to be terms of limitation, but rather will be deemed to be followed by the words "without limitation". Any reference herein to a particular Article or Section number (e.g., "Article 7" or "Section 7.8"), shall be deemed a reference to all Sections of the Agreement that bear subnumbers to the number referenced in the Article or Section (e.g., a reference to Article 7 includes Section 7.1 through 7.9, and a reference to Section 7.8 includes reference to Sections 7.8.1, through 7.8.3). The terms "hereof," "hereunder," "herein" and words of similar import will refer to the Agreement as a whole and not to any particular provision of the Agreement. Definitions in the Agreement apply equally to the singular and plural forms of the defined terms. Unless otherwise expressly specified, all references to "days" without any designation of "calendar" -7CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

or "business" will be deemed to be references to calendar days and not business days. All references to "business days" shall mean Monday through Friday, excluding Holidays. When calculating the time period before which, within which or following which any act is to be done or step taken pursuant to the Agreement, the date that is referenced in calculating such period will be excluded (for example, if an action is to be taken within two (2) days of a triggering event and such event occurs on a Tuesday then the action must be taken by Thursday). If the last day of a business day period is a non-business day, the period in question will end on the next succeeding business day.

ARTICLE 2 HOSTING SERVICES, THE MIGRATION PROJECT AND FUTURE PROJECTS AND SERVICES The terms and conditions relating to the transition, conversion and migration of CUNY's current hosted environment to Prime Vendor's hosted environment are set forth in the Migration Project Agreement, attached as Exhibit 1. CUNY shall purchase Hosting Services, and Prime Vendor shall supply Hosting Services in accordance with the terms and conditions set forth in the Hosting Services Exhibit, Exhibit 2. In delivering the Migration Project and for future projects, the terms and conditions relating to project management, Change Orders, personnel and Deliverables as set forth in Schedules 2.1 through 2.4 shall apply. In the delivery of Services not involving a project, the terms and conditions relating to Change Orders, personnel and Deliverables as set forth in Schedules 2.2 through 2.4 shall apply. CUNY shall purchase future Services other than Hosting Services from Prime Vendor pursuant to the terms of a Project Agreement for project-related initiatives (a "Project Agreement"), and a contract supplement for non-project related initiatives such as development or consulting services not involving a project (a "Contract Supplement"). All future Project Agreements developed by the parties shall be substantially in the same form and format as the Migration Project Agreement, and, to the extent applicable, Contract Supplements, and shall be consistent with the terms and conditions contained in the Agreement, and include, as applicable, the following items: (a)

A list of all Services;

(b)

Complete pricing information for the Services;

(c)

A Statement of Work, Project Plan and Joint Resource Plan for the Ser-

(d)

A list of Key Personnel;

vices;

(e) Additional Performance Standards, if any, to those specified in the Hosting Services Exhibit; (f) Project management, performance and other tools and utilities relating to the project or Services; and -8CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(g)

Any other terms and conditions.

ARTICLE 3 PRICING AND PAYMENT TERMS 3.1 Fees for Hosting Services. The Monthly Hosting Fees and related payment terms are set forth in the Hosting Services Exhibit. 3.2

Project and Other Services-Based Fees.

3.2.1 Services Fees. Fees for the Migration Project are set forth in the Migration Project Agreement. Fees for future Services shall be set forth in the Project Agreement or Contract Supplement, as applicable. Upon CUNY's request, Prime Vendor shall provide a Fixed Fee, not-to-exceed fee and/or time and materials estimate of the fees for the implementation Services to be provided under a future Project Agreement or Contract Supplement. 3.2.2 Service Rate(s). The one or more Service Rates used to develop any Fixed Fee arrangement and for Change Orders that increase or decrease fees shall be based on the services rate(s) ("Service Rate(s)") set forth in Schedule 3.2.2, and Prime Vendor shall be permitted to allocate a contingency component of such Fixed Fee, provided Prime Vendor sets forth and separately identifies the contingency amount. Fees for all consulting Services provided on a time and materials or other billable basis shall be calculated using rates that do not exceed the Service Rate(s) set forth in Schedule 3.2.2. The Service Rate(s) may be increased by Prime Vendor once annually commencing on the first (1st) anniversary of the date of Project Completion for the Migration Project; provided, however, that such annual increases shall not exceed CPI, with a cap of two percent (2%), in each case of the then-current Service Rate(s). Annual increases shall not carry forward from one year to the next, meaning that if Prime Vendor elects not to increase the Service Rate(s) in one year by the full amount allowed hereunder, Prime Vendor shall not have the right to carry forward such "unused" increase into subsequent years. CUNY shall have the right to require Prime Vendor to provide documentation substantiating the fee increase. If Prime Vendor notifies CUNY of a fee increase which exceeds the foregoing limits, then notwithstanding any prior payment by CUNY of invoices presented by Prime Vendor, CUNY shall be entitled to a refund or credit based on the actual increase that was permissible. In determining Service Rate(s) for personnel, Prime Vendor shall not differentiate Service Rate(s) within a single job or personnel classification, and if Prime Vendor’s business practices now or in the future nonetheless make this distinction, Prime Vendor shall use the lesser of the applicable rates. Prime Vendor shall not increase a particular person’s billing rate as a result of a promotion, change in job classification or otherwise without CUNY's prior written consent, it being the understanding of the parties that CUNY does not expect any rate changes during the course of a particular project. Additionally, Prime Vendor shall bill CUNY in increments of one-tenth (1/10) hour for all implementation Services provided, and shall not bill CUNY for travel time. 3.2.3 Adjustment of Services Fees Under Time and Material Arrangements. For each Project Agreement and Contract Supplement involving consulting Ser-9CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

vices to be provided under a time and materials basis, Prime Vendor shall provide CUNY with an estimate of the total number of hours to complete the work effort under the Project Agreement or Contract Supplement ("Original Estimated Hours"). If there is a change in scope under a Project Agreement or Contract Supplement, the parties shall utilize the Change Order procedures under Schedule 2.2, and the Original Estimated Hours shall be adjusted appropriately. Each month (or more frequently as requested by CUNY), appropriate representatives of each party shall meet to discuss whether the Original Estimated Hours, as adjusted, is on target or is being exceeded (as reported in the most recent Project Status Report). If the actual number of consulting Services hours provided by Prime Vendor under a Project Agreement or Contract Supplement exceeds the Original Estimated Hours, then the following adjustments to the Service Rate(s) shall be made for any hours exceeding the Original Estimated Hours, as adjusted, as follows: Percentage of Overage Hours (Based on the Original Estimated Hours, as Adjusted) 0 – 10%

Percentage Discount Off Service Rate(s) for Hours in Percentage Range 0%

> 10 + < 25%

10%

> 25 + < 40%

30%

> 40%

40%

The discounts set forth above shall only correspond to the hours included in the applicable percentage range. By way of example, if the Original Estimated Hours is one hundred (100) hours and the actual number of hours is one hundred thirty (130), then: No discount shall apply for hours up to 110; a ten percent (10%) discount shall apply to hours 111 through 125; and thirty percent (30%) discount shall apply to hours 126 through 130. 3.3

Payment of Invoices.

3.3.1 General. Prime Vendor shall issue all invoices promptly following the occurrence of the invoicing events specified in the Hosting Services Exhibit and/or in the applicable Project Agreement or Contract Supplement, and all such invoices shall be directed to CUNY or its designee for payment. All invoices shall be submitted in a form and detail acceptable to CUNY as specified by CUNY. All Prime Vendor invoices shall include a reasonably detailed description of the Services performed, including the date, hours worked and related expenses incurred and/or Hosting Services to which the invoice relates. By submitting an invoice, Prime Vendor certifies that the amount billed is accurate with respect to the fees, charges and expenses set forth therein and that such fees, charges and expenses are allowed pursuant to the Agreement. 3.3.2 Timeliness and Accuracy of Invoices. Prime Vendor acknowledges that timeliness of invoicing is a critical CUNY business requirement, as Prime Vendor's failure to do so may adversely impact CUNY's ability to review and confirm the accuracy of such invoices and encumber funds within the proper fiscal year. Accordingly, Prime Vendor shall issue each invoice hereunder within sixty (60) calendar days after the date on which Prime Vendor was authorized by the terms of the Hosting Services Exhibit and/or the applicable Project Agreement or Contract Supplement to issue such invoice -10CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

to CUNY, provided that CUNY's obligation to pay such invoices received after such invoicing date shall not be diminished. 3.3.3 Payment and Disputes. Prime Vendor shall promptly issue invoices to CUNY and, provided Prime Vendor abides by its obligation to promptly issue the invoice to CUNY and does not "back date" invoices, such invoices will be deemed received by CUNY as of the invoice date. Within thirty (30) calendar days following its receipt of the applicable invoice, CUNY shall pay the invoice, provided that: (a) it was accurately and timely issued as provided in Sections 3.3.1 and 3.3.2; and (b) such invoice is not disputed by CUNY in accordance with the further terms of this Section. If an invoiced amount is disputed in good faith by CUNY, then CUNY promptly shall notify Prime Vendor of the disputed item or items in such invoice, and Prime Vendor shall prepare and submit to CUNY a revised invoice omitting the disputed item or items. Until resolution of the dispute occurs pursuant to Article 9, CUNY shall have the right to withhold and suspend disputed payment of such item or items. All of the parties' obligations under the Agreement shall continue unabated during the duration of the dispute resolution. If CUNY claims that it has been inappropriately billed but it has already paid the disputed amount, the parties shall work to resolve the matter within ninety (90) calendar days from the date of CUNY's written notice of such overpayment, and each party shall provide the other with all relevant documentation in an effort to resolve the matter as quickly as possible. If Prime Vendor determines that CUNY was billed improperly, it promptly shall issue to CUNY a credit on its next invoice for any over-billed amount. If any invoicing dispute cannot be resolved within a ninety (90) calendar day period, CUNY shall have the right to withhold the disputed amount from any unpaid Prime Vendor invoices while the parties engage in continued efforts to resolve the dispute pursuant to Article 9. 3.4 Travel and Out-of-Pocket Expenses. All fees for services provided by Prime Vendor under this Master Services Agreement, whether for a Fixed Fee arrangement or otherwise, shall be inclusive of all travel and out-of-pocket expenses, and there shall be no separate reimbursement of Prime Vendor for such expenses. 3.5 Set-Off Rights. Prime Vendor shall be subject to the terms of New York State Appendix A and as set forth in this Section with respect to the issuance of credits and CUNY's set off rights. Prime Vendor shall comply with CUNY's billing practices relating to the issuance of credit notes and/or memoranda relating to amounts due to CUNY under the Agreement, including any Delay Credits, Quality Credits, Performance Credits, or unresolved disputed amounts as described in Section 3.3.3. If Prime Vendor fails to issue to CUNY a credit note or memorandum on its next invoice to CUNY for any amounts that become due to CUNY in accordance with the above, then CUNY shall have the right to set off such amounts against any amounts then due or that become due to Prime Vendor under the Agreement. If CUNY cannot effectuate a complete set-off due to insufficient amounts owed by CUNY to Prime Vendor, Prime Vendor promptly shall refund unrealized set off amounts to CUNY no later than twenty (20) days following its receipt of written notice from CUNY requiring it to do so. 3.6 Taxes. CUNY is exempt from all sales and use taxes and, upon request, CUNY will provide evidence of such exemptions to Prime Vendor. Prime Vendor shall not charge CUNY for any taxes on the Services, including Hosting Services or otherwise levied or assessed on Prime Vendor's income, or separately charge CUNY on the income of Prime Vendor's employees such as IRS compensatory taxes. CUNY reserves the right to require evi-11CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

dence of payment of such taxes prior to making any final payments due under a Project Agreement or Contract Supplement. If CUNY loses its tax exempt status, CUNY shall be responsible for all taxes, assessments or other charges levied by the Federal government, and any state, municipal or other U.S. governmental entity with authority arising out of or in connection with the Agreement (excluding any taxes levied or assessed on Prime Vendor's income or the income of Prime Vendor's employees such as IRS compensatory taxes).

ARTICLE 4 REPRESENTATIONS, WARRANTIES AND COVENANTS 4.1 Services Warranty. Prime Vendor represents and warrants to CUNY that it shall perform all Services in accordance with industry practices and standards generally applicable to such Services; provided, however, that where the Agreement, the Hosting Services Exhibit, a Project Agreement or Contract Supplement specifies a particular standard or criteria for performance, this warranty is not intended to and does not diminish that standard or criteria for performance. Without limiting the foregoing, Prime Vendor represents and warrants to CUNY that the Hosting Services shall meet or exceed the Performance Standards set forth in the Hosting Services Exhibit. 4.2 Disabling Codes. Prime Vendor represents and warrants that the Prime Vendor Environment and any Deliverable provided by Prime Vendor do not contain – and CUNY shall not receive from the Hosting Services or any Prime Vendor data transmission (including any connection to any Prime Vendor web-site or bulletin board) – any virus, worm, trap door, back door, timer, clock, counter or other limiting routine, instruction or design that would erase data or programming or otherwise cause any CUNY system to become inoperable or incapable of being used in the full manner for which it was designed and created (a "Disabling Code"). If Prime Vendor introduces a Disabling Code that affects CUNY's systems, at its sole cost and expense, Prime Vendor shall, as applicable: (a) take all steps necessary to test for the presence of Disabling Codes; (b) restore an environment without the presence of Disabling Codes; (c) restore any and all data and programming lost by CUNY as a result of such Disabling Code (such restoration shall include, if needed, on-site technical assistance to extract data from corrupted data files, restoration of backup media, data log analysis, and the like). This representation and warranty shall survive the expiration or termination of the Agreement. 4.3 Comprehensiveness of Project Agreements and Contract Supplements and Sufficiency of Due Diligence. In order to avoid out-of-scope changes to the Hosting Services, or to a project and work to be performed under a Project Agreement or Contract Supplement, Prime Vendor represents and warrants to CUNY that, as of the Effective Date with respect to the Hosting Services, and as of the effective date of the applicable Project Agreement or Contract Supplement: (a) Prime Vendor either identified in the Hosting Services Exhibit or applicable Project Agreement or Contract Supplement or has made provisions for all the software, services, equipment, infrastructures and other items required to: (i) complete the project and provide the Hosting Services and other Services, all as described therein; and (ii) achieve the CUNY Requirements, Performance Standards and other requirements as set forth in the Hosting Services Exhibit, or applicable Project Agreement or Contract Supplement; (b) all such software, services and other items are included in or have been accounted for by Prime Vendor in connection with the Hosting Services Exhibit, or applicable Project Agreement or Contract Supplement; and (c) there are no other software, services, equipment, infrastructure or other items that are required to meet the CUNY Requirements or Performance Standards. Prime Vendor -12CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

further represents and warrants to CUNY that, upon entering into a Project Agreement or Contract Supplement, it will have properly sized the amount of personnel and other resources required to complete its obligations under the Hosting Services Exhibit, a Project Agreement or Contract Supplement for the fees stated therein; the Services to be provided by Prime Vendor on a Fixed Fee basis under any Project Agreement or Contract Supplement are the only services required to meet Prime Vendor's obligations therein, including any CUNY Requirements and Performance Standards; and there are no other services (i.e., optional or needed additional services) that are omitted from the Hosting Services Exhibit, Project Agreement or Contract Supplement but necessary to meet such requirements. 4.4 Correction of Failure to Meet Functionality and Performance Warranties. Upon any failure to comply with the representations, warranties and/or covenants set forth in Sections 4.1 through 4.3, within five (5) days following receipt of written notice from CUNY of such failure, Prime Vendor shall repair, replace or correct, at Prime Vendor’s sole cost and expense, the applicable component(s) of the Prime Vendor Environment or other components as necessary, including by providing any additional software, equipment and/or services. The remedies set forth in this Section shall be in addition to any Performance Credits and/or any other rights and remedies that may be available to CUNY under the Agreement. 4.5 Warranty of Authority. Each party represents and warrants to the other that it has the right to enter into the Agreement and, in the case of Prime Vendor, as of the Effective Date and as of the effective date of each Project Agreement and Contract Supplement (except to the extent disclosed therein), there is not and there shall not be, any outstanding assignments, grants, licenses, encumbrances, obligations or agreements that relate to the system (whether written, oral or implied) that are inconsistent with the Agreement and the rights granted or transferred herein. CUNY further represents and warrants to Prime Vendor that it has a right to the licenses it has or will deliver to Prime Vendor with respect to the Hosting Services, and that, subject to the approval of the Agreement and each Project Agreement and Contract Supplement by the Office of the New York State Comptroller, CUNY has obtained or will obtain all necessary authorizations or consents to enable Prime Vendor to host CUNY software. This representation and warranty shall survive the expiration or termination of the Agreement. 4.6 Pending Litigation Warranty. Prime Vendor represents and warrants to CUNY that, as of the Effective Date and as of the effective date of each Project Agreement and Contract Supplement (except to the extent disclosed therein), there is (and there shall be at the time of a future Project Agreement and Contract Supplement), no action, suit, claim, investigation or proceeding pending, or the basis for any action, suit, investigation or proceeding, and to the best of Prime Vendor’s knowledge, there is no action, suit, claim, investigation or proceeding, or the basis for any action, suit, investigation or proceeding, threatened against, by or affecting Prime Vendor, its Affiliates or the system in any court, or by or before any federal, state, municipal or other governmental department, commission, board, bureau, agency or instrumentality, domestic or foreign, or before any arbitrator of any kind that, if adversely determined, might affect Prime Vendor’s ability to enter into the Agreement and/or the applicable Project Agreement or Contract Supplement and perform all of its obligations herein. 4.7 Offshoring. Prime Vendor represents, warrants and covenants to CUNY that Prime Vendor shall not: (a) except as may otherwise be set forth expressly in a Project Agreement or Contract Supplement, perform any of its obligations under the Agreement from locations, or using employees, contractors and/or agents, situated outside the United States; or (b) -13CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

directly or indirectly (including through the use of subcontractors) transmit any CUNY Data outside the United States; or (c) allow any CUNY Data to be accessed by Prime Vendor employees, contractors and/or agents from locations outside the United States. If a Project Agreement or Contract Supplement provides that Services may be provided offshore, to the extent any Law enacted after the Effective Date or any policy or circumstances exist or are created which have, or may have, an adverse impact on CUNY with respect to legal compliance or its relationships with the State, its unions or otherwise, Prime Vendor acknowledges and agrees that, to the extent technically feasible and commercially reasonable, it shall change the delivery of any affected offshore Services in a manner which enables CUNY to avoid such adverse impact; or if the foregoing objective cannot be met to the satisfaction of the parties, then the parties shall engage in good faith negotiations to arrive at a mutually agreeable reasonable alternative. 4.8 CUNY Data. Prime Vendor represents and warrants to CUNY that it shall not collect, use, store, display and/or transmit CUNY Data (including in a summary, extracted, redacted or de-identified form) other than as necessary to fulfill its obligations under the Agreement. 4.9 Conflicts of Interest. Prime Vendor represents and warrants to CUNY that neither Prime Vendor, any of its Affiliates or authorized subcontractors, nor any employee of either, has, shall have, or shall: (a) Acquire, any contractual, financial, business or other interest, direct or indirect, that would conflict in any manner or degree with Prime Vendor’s performance of its duties and responsibilities to CUNY under the Agreement or otherwise create an appearance of impropriety with respect to the Agreement. (b) Use the authority provided or to be provided under the Agreement to improperly obtain financial gain for Prime Vendor, any of its Affiliates, any of their employees, or any member of the immediate family of any such employee. (c) Use any CUNY Data acquired in connection with the Agreement to obtain financial gain for Prime Vendor, any of its Affiliates, any of their employees, or any member of the immediate family of any such employee. (d) Accept anything of value based on an understanding that the actions of Prime Vendor, any such Affiliates or any such employees on behalf of CUNY would be influenced thereby; and neither Prime Vendor nor any of its Affiliates shall attempt to influence any CUNY employee by the direct or indirect offer of anything of value. (e) Pay or agree to pay any person, other than bona fide employees working solely for Prime Vendor or such Affiliates or any of Prime Vendor’s subcontractors, any fee, commission, percentage, brokerage fee, contingent fee, gift or any other consideration, that is contingent upon or resulting from the award or execution of the Agreement. If Prime Vendor fails to comply with this Section, CUNY shall have the right to either cancel the Agreement without liability to CUNY or, in CUNY's discretion, deduct from payments due to Prime Vendor, or otherwise recover from Prime Vendor, the full amount of such commission, percentage, brokerage fee, contingent fee, gift or other consideration.

-14CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

4.10 Compliance with Federal and State Programs. With respect to Prime Vendor and Prime Vendor's employees providing Services to CUNY: (a) Prime Vendor represents and warrants that neither Prime Vendor nor any of its employees is currently ineligible to participate in federal or state procurement or non-procurement programs because of being excluded, debarred, suspended or otherwise declared ineligible to participate. (b) Prime Vendor shall immediately disclose to CUNY if it or any of its employees is debarred, suspended, excluded or otherwise declared ineligible to participate in federal or state procurement or non-procurement programs. (c) Prime Vendor shall immediately disclose to CUNY if Prime Vendor or any of its employees is proposed for exclusion, debarment or suspension from participation in any federal or state procurement or non-procurement program. (d) CUNY has the right to immediately terminate the Agreement for cause and without further liability to CUNY if Prime Vendor becomes ineligible to participate in federal or state procurement or non-procurement programs because of being excluded, debarred, suspended or otherwise declared ineligible to participate. If any of the occurrences described above, Prime Vendor shall provide written notice immediately to CUNY in accordance with Section 10.1. 4.11 Additional Warranties. Additional representations and warranties may be set forth in the Hosting Services Exhibit, a Project Agreement or Contract Supplement. 4.12 Material Misstatements or Omissions. No representation or warranty by a party that is contained in the Agreement or that may be contained in any Project Agreement, Contract Supplement, Schedule, Exhibit, Addendum or Attachment contains any untrue statement of a material fact or omits to state a material fact necessary to make the statements and facts contained herein or therein not materially misleading. 4.13 Disclaimer of Warranties. THE WARRANTIES SET FORTH IN THE AGREEMENT AND IN ANY PROJECT AGREEMENT OR CONTRACT SUPPLEMENT, SCHEDULE, EXHIBIT, ADDENDUM OR ATTACHMENT CONSTITUTE THE ONLY WARRANTIES OF THE PARTIES AND ARE IN LIEU OF ALL OTHER WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

ARTICLE 5 TERM AND TERMINATION 5.1

Term.

5.1.1 Term of Agreement. The Agreement shall commence on the Effective Date and remain in effect until the date that no obligations remain under the Hosting Services Exhibit or any Project Agreement, Contract Supplement, Change Order or other ordering document unless: (a) the parties mutually agree in writing to terminate the -15CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Agreement; (b) CUNY terminates the Agreement pursuant to Section 5.1.3 or Section 5.1.4; or (c) a party elects to terminate the Agreement following the occurrence for an Event of Default or under the circumstances described in Section 10.5. 5.1.2 Term of Project Agreements and Contract Supplements. Each Project Agreement and Contract Supplement shall commence on its effective date and remain in effect until: (a) with respect to a Project Agreement, Project Completion of such Project Agreement occurs, and with respect to a Contract Supplement, the obligations under the Contract Supplement have been fulfilled, provided that a Project Agreement or Contract Supplement may provide that certain terms and conditions may survive; (b) the parties mutually agree in writing to terminate the Project Agreement or Contract Supplement; (c) CUNY terminates the Project Agreement or Contract Supplement pursuant to Section 5.1.3 or Section 5.1.4; or (d) a party elects to terminate the Project Agreement or Contract Supplement following the occurrence for an Event of Default or under the circumstances described in Section 10.5. 5.1.3 Termination for Convenience. CUNY shall have the right to terminate, in whole or in part, the Agreement, the Hosting Services Exhibit and any Project Agreement or Contract Supplement involving the purchase of Services, and/or any line or category of Services being provided under the Hosting Services Exhibit or a Project Agreement or Contract Supplement, without cause and for its convenience and without further liability (except as provided in this Section) upon thirty (30) days prior written notice to Prime Vendor. Following any such termination, CUNY will only be responsible for: (a) subject to the terms of Section 3.4, actual, documented reimbursable expenses incurred by Prime Vendor prior to receipt of the written notice of termination; (b) the value (at the applicable rates under the Agreement) of any Services provided by Prime Vendor prior to (and/or, if authorized as provided above in this Section, after) receipt of the written notice of termination; and (c) the amount of any uncapitalized costs of equipment and other components of the Prime Vendor Environment that Prime Vendor cannot recoup as a consequence of such early termination, provided Prime Vendor provides access to its books and records to enable CUNY to substantiate any such uncapitalized and non-recoupable costs. Upon Prime Vendor's receipt of written notice of termination pursuant to this Section, to the extent not previously delivered, Prime Vendor shall deliver to CUNY all Deliverables developed by Prime Vendor, whether completed or in draft form, and the terms of Section 4 of Schedule 2.3 shall apply. In determining the fees owed under subsection (b) above with respect to partially completed Deliverables or milestones developed under a fixed fee arrangement, Prime Vendor shall disclose to CUNY: (d) the number of hours already expended by Prime Vendor toward achieving the milestone or Deliverable ("E"); and (e) the number of hours still needed by Prime Vendor to complete the Deliverable or milestone ("N"). The percent complete for the Deliverable or milestone will be represented by the fraction of: E/(N+E) x 100. For example, if Prime Vendor has expended sixty (60) hours towards completing a Deliverable or milestone and Prime Vendor estimates that it will take ninety (90) additional hours to complete such Deliverable or milestone, the Deliverable or milestone will be calculated to be forty percent (40%) complete (i.e., (60/(60+90) x 100 = 40%). CUNY shall then have the option of requiring Prime Vendor to complete the Deliverable or milestone for the applicable unpaid Deliverable or milestone fee, or pay Prime Vendor a pro

-16CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

rata amount of such Deliverable or milestone fee based on the percent complete as calculated above. 5.1.4 Termination Due to Insufficient Funding. If there is insufficient funding to complete a project such as the Migration Project or to continue the Hosting Services, CUNY and Prime Vendor shall meet and discuss adjusting the time frames for the delivery of the project and/or an adjustment to the Monthly Hosting Fees or other applicable fees. The parties will negotiate in good faith for a period of ninety (90) days (or longer by mutual agreement). If the parties cannot restructure the Agreement, CUNY shall have the right to terminate the Agreement in whole or in part without further liability. 5.1.5 Survival. Any terms of the Agreement and/or any Project Agreements and Contract Supplements that would, by their nature or through the express terms of the Agreement or the applicable Project Agreement or Contract Supplement, survive the expiration or termination of the Agreement and/or the applicable Project Agreement or Contract Supplement shall so survive, including the terms of Sections 3.3 through 3.6, 4.2 through 4.8, 5.5, and Articles 6 through 10. 5.2 Events of Default. The following events shall constitute "Events of Default," and the occurrence of any one (1) or more of such Events of Default shall constitute a material breach of the Agreement and/or the applicable Project Agreement or Contract Supplement that shall afford the non-breaching party the rights and remedies set forth in this Article: (a) Prime Vendor’s failure to achieve any Critical Milestone by the applicable Critical Milestone Due Date, which failure shall constitute a Prime Vendor Event of Default unless such failure: (i) was caused by CUNY or its Third Party's delays or a Force Majeure Event that was not capable of being mitigated; or (ii) is cured by Prime Vendor within ten (10) days after its receipt of written notice of such breach; (b) A Chronic Performance Standards Failure as described in the Hosting Services Exhibit; (c) A party’s material breach of any other representation, warranty or covenant set forth in the Agreement, which material breach shall constitute an Event of Default by the non-performing party, provided further that: (i) such failure is not cured within the applicable time frames, if any, set forth in the Agreement, or if no time frame for curing such breach is specified, then within ten (10) days following the non-performing party’s receipt of written notice of such failure; or (ii) if the breach reasonably cannot be cured within the time frames specified in the foregoing subsection (i), the nonperforming party has failed to provide to the other party within five (5) days following its receipt of written notice of such failure a written plan to cure such failure that is acceptable to such other party in its sole discretion; (d) Prime Vendor’s failure to maintain insurance coverage as specified in Sections 10.3, provided that such failure is not cured by Prime Vendor within twenty (20) days following receipt of written notice of such failure, which failure shall constitute a Prime Vendor Event of Default;

-17CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(e) CUNY's failure to pay any undisputed invoice after Prime Vendor has provided written notice to CUNY of such failure, and CUNY has not cured such failure to pay within ninety (90) days of receipt of such written notice, which failure shall constitute a CUNY Event of Default; (f) The institution of bankruptcy, receivership, insolvency, reorganization or other similar proceedings by or against Prime Vendor or any parent Affiliate of Prime Vendor under any Law if such proceedings have not been dismissed or discharged within thirty (30) days after they are instituted; the insolvency or making of an assignment for the benefit of creditors or the admittance by Prime Vendor or any parent Affiliate of Prime Vendor of any involuntary debts as they mature; the institution of any reorganization arrangement or other readjustment of debt plan of Prime Vendor or any parent Affiliate of Prime Vendor; or any corporate action taken by the Board of Directors of Prime Vendor or any parent Affiliate of Prime Vendor in furtherance of any of the above actions, which shall constitute a Prime Vendor Event of Default; or (g) If Prime Vendor or any parent Affiliate of Prime Vendor makes an assignment of all or substantially all of its assets for the benefit of creditors, or Prime Vendor’s or any parent Affiliate of Prime Vendor’s Board of Directors takes any corporate action by in furtherance of the above action, which shall constitute a Prime Vendor Event of Default. 5.3 Rights and Remedies of Prime Vendor Upon Default of CUNY. Upon the occurrence of a CUNY Event of Default, Prime Vendor shall be entitled to all of the remedies described below in this Section. In addition, if one (1) or more events as described in Section 5.2 occur that would give rise to a CUNY Event of Default but CUNY has effected a cure within the applicable time frames set forth in Section 5.2, if any, or thereafter, then Prime Vendor nonetheless shall be entitled to the remedies set forth in subsections (b) and (c) below. (a) Subject to CUNY's rights as set forth below, fully or partially terminate the Agreement and/or the affected Project Agreement(s) or Contract Supplement(s); and/or (b)

Subject to the terms of Article 6, recover damages from CUNY; and/or

(c) Any other additional remedies that may be set forth in a Project Agreement or Contract Supplement. Notwithstanding any provision contained in the Agreement to the contrary, absent the receipt by Prime Vendor of a final, non-appealable judicial order terminating the Agreement in its entirety, Prime Vendor expressly waives and disclaims any self-help right or remedy or any right or remedy it may have under any existing or future Laws or otherwise to terminate, suspend, withhold, disable or otherwise interfere with the provision of Services by Prime Vendor under the Hosting Services Exhibit and any Project Agreement or Contract Supplement, including CUNY’s use of or access to the Hosting Services or any portion thereof. 5.4 Rights and Remedies of CUNY Upon Default of Prime Vendor. Upon the occurrence of a Prime Vendor Event of Default, CUNY shall be entitled to all of the remedies described below in this Section. In addition, if one (1) or more events as described in Section 5.2 occur that would give rise to a Prime Vendor Event of Default but Prime Vendor has effected a cure -18CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

within the applicable time frames set forth in Section 5.2, if any, or thereafter, then CUNY nonetheless shall be entitled to recover damages from Prime Vendor, subject to the terms of Article 6. (a) Fully or partially terminate the Agreement, the affected Project Agreement or Contract Supplement (or Schedule or Exhibit thereto), Statement of Work or other document, or the affected line or category of Services being provided under a Project Agreement or Contract Supplement; and/or (b)

Subject to the terms of Article 6, recover damages from Prime Vendor;

(c) 5.5; and/or

Obtain from Prime Vendor transition Services in accordance with Section

and/or

(d) Any other additional remedies that may be set forth in a Project Agreement or Contract Supplement. 5.5 Transition Services. Upon an expiration or a complete or partial termination of the Agreement, one (1) or more Project Agreements, Contract Supplements or Exhibits, and/or one or more lines or categories of Services for any reason, CUNY shall have the right, at CUNY's option, for up to thirty six (36) months (the "Transition Period"), to all or any combination of the following: (a) continue to receive Hosting Services for the Monthly Hosting Fees; (b) receive from Prime Vendor all Services reasonably necessary to effectuate an orderly transition to a new hosted environment, either on-premise or with a Third Party; and (c) obtain from Prime Vendor the transfer of Knowledge. All Services provided by Prime Vendor during the Transition Period shall be provided at the Monthly Hosting Fees or Service Rate(s), as applicable, set forth in the Agreement. Notwithstanding the foregoing, if the Agreement or any Project Agreement or Contract Supplement, or an affected line or category of Services being provided under a Project Agreement or Contract Supplement is completely or partially terminated due to the occurrence of a Prime Vendor Event of Default, Prime Vendor shall provide transition Services, other than Hosting Services, at no cost to CUNY.

ARTICLE 6 LIMITATION ON LIABILITY 6.1

Cap on Damages. EXCEPT AS SET FORTH IN SECTION 6.2:

(A) SUBJECT TO THE EXCEPTIONS SET FORTH IN SECTION 6.2 BELOW, WITH RESPECT TO PRIME VENDOR'S LIABILITY TO CUNY, PRIME VENDOR'S CUMULATIVE LIABILITY TO CUNY FOR ANY AND ALL CAUSES OF ACTION ARISING OUT OF OR RELATING TO THE AGREEMENT SHALL NOT EXCEED THREE (3) TIMES THE FEES PAID OR TO BE PAID UNDER THE AGREEMENT (INCLUSIVE OF ALL PROJECT AGREEMENTS, CONTRACT SUPPLEMENTS AND OTHER ORDERING DOCUMENTS); AND (B) WITH RESPECT TO CUNY's LIABILITY TO PRIME VENDOR, CUNY SHALL BE LIABLE TO PRIME VENDOR ONLY FOR UNPAID AND UNDISPUTED INVOICES FOR SERVICES AND EXPENSES.

-19CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

6.2 Exclusions from Limitations on Liability. Notwithstanding anything contained herein to the contrary, the limitations on liability set forth in Section 6.1 shall not apply: (a) to claims arising as a result of personal injury, including death, caused by a party or its employees, agents and/or subcontractors; (b) to claims arising as a result of damage to real property or tangible personal property (including loss of data) caused by a party or its employees, agents and/or subcontractors; (c) to Prime Vendor’s failure to comply with its obligations under Section 1.3.7 and Articles 7 and 8; (d) to any amounts paid by Prime Vendor as Delay Credits, Quality Credits and/or Performance Credits; and (e) any negligence or willful misconduct on the part of Prime Vendor. 6.3 Restoration of Liability Cap. If, at any time: (a) (i) the total aggregate liability of Prime Vendor for claims asserted by CUNY under or in connection with the Agreement exceeds seventy percent (70%) of the limitation of liability amount in Section 6.1(A); and (ii) Prime Vendor does not agree in writing to increase such amount by the amount required to restore the full original value of the limitation of liability amount in Section 6.1(A) within thirty (30) days following its receipt of a written request from CUNY that it do so; or (b) the total aggregate liability of Prime Vendor equals or exceeds the limitation of liability amount in Section 6.1(A), then CUNY shall have the right to terminate the Agreement, the Hosting Services Exhibit, and/or any Project Agreement or Contract Supplement (in whole or in part) by delivering a written notice of termination to Prime Vendor. Any termination pursuant to this Section shall not constitute a termination under any other provision of the Agreement. 6.4 Costs of Cure. To the extent a party elects to cure any failure by it to comply with its obligations under the Agreement, all costs and expenses associated with such cure shall be borne solely by the curing party and shall in no event count toward satisfaction of the cap on damages described in Section 6.1.

ARTICLE 7 DATA RIGHTS, CONFIDENTIALITY AND DATA SECURITY 7.1 Ownership of Data. Each party is and shall remain the owner of all right, title and interest in and to any data that it owned prior to the Effective Date, and in and to any data to which it may hereafter acquire ownership. CUNY shall own all right, title and interest in and to CUNY Data. Except as otherwise provided in the Agreement, no party shall be obligated to convey any right, title and/or interest in any data to the other. Subject to the terms of the Agreement, each party, upon request of the other, promptly shall return to the other any data owned by the other that may have been disclosed hereunder (including CUNY Data). 7.2 Confidential Information. Each party acknowledges that it may acquire or be exposed to Confidential Information of the other party. Having acknowledged the foregoing, the party that has received Confidential Information ("Receiving Party") agrees: (a) to exercise the same degree of care and protection with respect to the Confidential Information of the party that has disclosed Confidential Information ("Disclosing Party") that it exercises with respect to its own Confidential Information, but in no event less than a reasonable degree of care; (b) not to use the Disclosing Party’s Confidential Information except as permitted or contemplated hereunder; and (c) not to directly or indirectly disclose, distribute, republish or allow any Third Party to have access to any Confidential Information of the Disclosing Party without such Third Party executing: (i) with respect to disclosure of Prime Vendor Confidential Information, the Third Party Confidentiality and Non-Disclosure Agreement set forth in Exhibit 4, provided that for Third -20CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Parties that have a signed confidentiality agreement with CUNY as of the Effective Date, such Third Parties shall not be required to execute the Third Party Confidentiality and Non-Disclosure Agreement; and (ii) with respect to disclosure of CUNY Data, a confidentiality and nondisclosure agreement with no less protective confidentiality provisions than those set forth in the Agreement. Notwithstanding the above, but subject to the further requirements of the Agreement, as applicable: (d) CUNY may disclose Prime Vendor Confidential Information to CUNY's Authorized Users who have a need to know; (e) Prime Vendor may disclose CUNY Data to its employees and authorized agents who have a need to know; and (f) a party may disclose Confidential Information if so required by Law (including court order or subpoena), provided that such disclosure is made in accordance with Section 7.4. With respect to Prime Vendor's Confidential Information, such information shall not include information that is: (g) publicly available or later becomes available other than through a breach of the Agreement; (h) known to the Receiving Party or its employees, agents or representatives prior to disclosure by the Disclosing Party or is independently developed by the Receiving Party or its employees, agents or representatives subsequent to such disclosure; or (i) subsequently lawfully obtained by the Receiving Party or its employees, agents or representatives from a Third Party without obligations of confidentiality. 7.3 Public Records Disclosures. Notwithstanding anything contained in the Agreement to the contrary, including in Section 7.2 or 7.4, Prime Vendor acknowledges that CUNY is a public organization and that the terms and conditions of the Agreement (including the Hosting Services Exhibit and all Project Agreements and Contract Supplements) and other Prime Vendor information including Prime Vendor Confidential Information, Documentation and Deliverables may be subject to disclosure under the applicable Law, including the Freedom of Information Law of the State of New York and other Laws. Subject to a court of competent jurisdiction issuing an order prohibiting such release or the requesting party notifying CUNY in writing prior to CUNY's planned release that it has rescinded its request for disclosure, CUNY shall release and disclose all requested information without liability therefor. 7.4 Confidentiality of Prime Vendor Personnel. Prime Vendor shall cause all of its employees and any authorized subcontractor employees who have access to CUNY's Confidential Information to be bound by a confidentiality agreement with confidentiality provisions no less protective than the confidentiality terms contained herein. 7.5 Notification Obligation. If the Receiving Party becomes aware of any unauthorized use or disclosure of the Confidential Information of the Disclosing Party, the Receiving Party promptly and fully shall notify the Disclosing Party of all facts known to it concerning such unauthorized use or disclosure. In addition, if the Receiving Party or any of its employees or agents are requested or required (by oral questions, interrogatories, requests for information or documents in legal proceedings, subpoena, civil investigative demand or other similar process) to disclose any of the Confidential Information of the Disclosing Party, the Receiving Party shall not disclose the Confidential Information without providing the Disclosing Party with reasonable prior written notice of any such request or requirement so that the Disclosing Party may seek a protective order or other appropriate remedy and/or waive compliance with the provisions of the Agreement. If, in the absence of a protective order or other remedy or the receipt of a waiver by the Disclosing Party, the Receiving Party or any of its employees are nonetheless, in the written opinion of the Receiving Party’s counsel (a copy of which opinion shall be delivered to the Disclosing Party), legally compelled to disclose Confidential Information to any tribunal or otherwise stand liable for contempt or suffer other censure or penalty, the Receiving Party or its employ-21CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ees may, without liability hereunder, disclose to such tribunal only that portion of the Confidential Information that such counsel advises the Receiving Party that it is legally required to disclose. Notwithstanding the foregoing, the Receiving Party shall exercise its best efforts to preserve the confidentiality of the Confidential Information, including by cooperating with the Disclosing Party to obtain an appropriate protective order or other reliable assurance that confidential treatment shall be accorded the Confidential Information by such tribunal. 7.6 Information Sharing. As part of its mission, CUNY intends to share information with other higher education institutions to promote best practices. The types of information shared by CUNY may include design documents, technical specifications, reports and report formats, workflow processes, policies and procedures, printed training and education materials, computer-based training and education materials, configuration strategies and recommendations, screen shots and queries and job descriptions. Prime Vendor shall permit CUNY to share the above types of Prime Vendor Confidential Information with other institutions. 7.7 HIPAA. To the extent HIPAA compliance is required, if Prime Vendor (or any subcontractor) will, or will likely, have access to protected health information (as defined in the Health Insurance Portability and Accountability Act of 1996, as may be amended from time-totime ("HIPAA") of CUNY, Prime Vendor and any applicable subcontractor(s) shall execute the then-current form of Business Associate Agreement of CUNY. 7.8

Security.

7.8.1 Data Security Program. Prime Vendor shall maintain in effect at all times a comprehensive data security program that includes reasonable and appropriate administrative, technical and physical security measures designed to detect, prevent and mitigate the risk of identity theft and protect against the destruction, loss, unauthorized access, disclosure, use and/or alteration of data (whether or not encrypted), including CUNY Data, in Prime Vendor's possession or under Prime Vendor's control, and which shall be no less rigorous than those measures that are required to be maintained by Prime Vendor or CUNY to comply with applicable Laws. 7.8.2 Security Breaches. If Prime Vendor discovers or is notified of the destruction, loss and/or unauthorized access, disclosure, use and/or alteration of CUNY Data or any attempt to access CUNY Data that is reasonably likely to result in the destruction, loss and/or unauthorized access, disclosure, use and/or alteration of CUNY Data (each such event, a "Security Event"), Prime Vendor shall without undue delay and unless prohibited by Law: (a) promptly notify CUNY of the Security Event; (b) investigate the Security Event and provide reasonable cooperation with CUNY's investigation of the Security Event, including periodic updates with respect to Prime Vendor's investigation of the Security Event; (c) if the source of the Security Event is not within the control of Prime Vendor, provide reasonable cooperation with CUNY's development of a risk assessment, root cause analysis and corrective action plan, including CUNY's mitigation and remediation activities; and (d) provide reasonable cooperation with CUNY in complying with the requirements of all applicable Laws, including Security Breach Notification Statutes. In addition, if the source of the Security Event is within the control of Prime Vendor, Prime Vendor shall: (e) promptly provide a written report to CUNY that sets forth Prime Vendor's risk assessment, root cause analysis and corrective action plan, provided that Prime Vendor shall not be required to disclose information that Prime -22CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Vendor reasonably determines would compromise the security of Prime Vendor's technology or premises; (f) implement the corrective action plan and mitigate the effects of the Security Event as soon as practicable; and (g) provide CUNY periodic updates with respect to Prime Vendor's mitigation and corrective action efforts. For purposes of this Section 7.8.2, a Security Event includes the detection of any "Red Flag," as defined in the federal Identity Theft Rules. 7.8.3 Security Breach Notification Statutes. Prime Vendor acknowledges that CUNY Data may include Personal Information pertaining to residents in New York State and other states that have enacted Security Breach Notification Statutes. Having acknowledged the foregoing, in addition to its obligations set forth in Section 7.8.2, Prime Vendor shall comply with the requirements of all applicable Security Breach Notification Statutes. If and to the extent any unauthorized access, disclosure or use of CUNY Data: (a) is attributable to a breach by Prime Vendor of its obligations under the Agreement, including the failure of Prime Vendor to comply with the Security Policies and Procedures; and (b) triggers notice or other requirements under a Security Breach Notification Statute, Prime Vendor shall bear the costs incurred by CUNY and/or its Affiliates in complying with such legal obligations relating to such unauthorized access, disclosure or use of CUNY Data, including the reasonable costs of providing notices, a tollfree call center / help desk, credit monitoring services and identity theft insurance to affected individuals. CUNY shall be responsible for any direct correspondence or communication with the data subjects (e.g., making corrections to data requested by data subjects), subject to Prime Vendor's obligation to bear the costs described in the preceding sentence. Nothing contained herein shall be deemed to release Prime Vendor from its indemnification obligations as set forth in Article 8. 7.9 Survival. The terms of this Article 7 shall survive the expiration or termination of the Agreement.

ARTICLE 8 INDEMNIFICATION 8.1 General. Prime Vendor (the "Indemnifying Party") shall assume all risk of and responsibility for, and shall indemnify, defend and hold harmless CUNY and its trustees, directors, officers, employees, contractors, consultants, volunteers, representatives, agents, attorneys, successors and assigns (collectively, the "Indemnified Parties") from and against all claims, demands, suits, actions, recoveries, judgments and actual costs and expenses (including all attorneys’, advisors and consultant fees and costs) in connection therewith on account of any Third Party claim arising out of or relating to: (a) bodily injury, including death, and real property and tangible personal property damage arising from or resulting directly or indirectly from the Services provided under the Agreement and/or otherwise relating directly or indirectly from Prime Vendor’s or its employees’, agents’ or representatives’ acts or omissions; (b) Prime Vendor’s or its employees’, agents’ or representatives’ failure to comply with the terms of Article 7; (c) any failure by Prime Vendor to comply with its obligations under Section 10.15; (d) CUNY's rights to indemnity under Section 10.4; (e) a breach of Prime Vendor's obligations which results in a fine or penalty to an Indemnified Party; or (f) Prime Vendor’s negligence or willful misconduct in its performance under the Agreement. The indemnity provisions in this Section shall not be limited by reason of any insurance coverage required under the Agreement.

-23CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Prime Vendor’s indemnity obligations under this Section may be reduced to the extent CUNY is found to have been contributorily negligent. 8.2 Infringement. Prime Vendor shall indemnify, defend and hold harmless the Indemnified Parties from and against any claim asserted or any claim, suit or proceeding brought by a Third Party against the Indemnified Parties alleging that the Deliverables, Services, or any part thereof, or CUNY's use of the Deliverables or Services constitutes a misappropriation of any proprietary or trade secret information or an infringement of any Intellectual Property Right. Prime Vendor shall pay all damages awarded or agreed to settlement payments, and any actual costs and expenses, including attorneys’ fees, litigation costs (including the costs and expenses of any appellate bonds) arising from any such claim and incurred by the Indemnified Parties; provided, however, that the Indemnified Parties, after receiving notice thereof, promptly shall advise Prime Vendor of any such claim, suit or proceeding and, at Prime Vendor’s expense, cooperate with Prime Vendor in the defense thereof. If Prime Vendor reasonably believes that any such claim, suit or proceeding may be successful, Prime Vendor shall, at no additional cost to the Indemnified Parties, either: (a) procure for the Indemnified Parties the right to continue using the portion of the Deliverables and/or Services subject to such claim, suit or proceeding; or (b) replace or modify the Deliverables and/or Services so that it no longer is subject to any such claim, suit or proceeding while maintaining equivalent or better functionality and performance capabilities. No undertaking of Prime Vendor under this Section shall extend to any alleged infringement or violation to the extent that such infringement or violation arises from adherence to design modifications, specifications, drawings or written instructions that Prime Vendor is specifically directed by CUNY to follow, or relates to uses of the Deliverables and/or Services in combination with other systems, furnished either by Prime Vendor or others, which combination was not recommended or otherwise approved by Prime Vendor in writing, where the lack of the combination would not, in and of itself, be infringing. 8.3

Procedures for Indemnification.

8.3.1 General. Promptly after becoming aware of same, the Indemnified Parties shall notify Prime Vendor of any Third Party claim covered under the terms of Sections 8.1 or 8.2, as applicable, for which the Indemnified Parties seeks indemnification. 8.3.2 Defense. The defense counsel selected by Prime Vendor shall be reasonably acceptable to the Indemnified Parties. Prime Vendor acknowledges that, as an instrumentality of government, CUNY may be required to be represented by any or all of the CUNY Office of General Counsel, the Corporation Counsel of the City of New York and the Attorney General's Office of the State of New York, and Prime Vendor acknowledges and shall not object to CUNY being represented independently at any and all such proceedings by any of the foregoing counsel provided that CUNY bear its own costs of such counsel. 8.3.3 Settlement of Claims. Prime Vendor shall not settle any claim, suit or action without the prior written consent of CUNY. 8.4 Survival; No Limitations on Liability. The terms of this Article shall survive any expiration or termination of the Agreement. Notwithstanding anything contained in the Agreement to the contrary, the terms of any limitations on liability clauses contained in the Agreement shall not apply to Prime Vendor’s indemnification obligations under this Article. -24CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ARTICLE 9 DISPUTE RESOLUTION 9.1 Administrative-Level Performance Review. If a dispute relating to the Agreement arises between the parties, the Prime Vendor Account Executive and the CUNY Project Director shall meet and attempt to resolve the dispute. If the parties are unable to resolve the dispute within ten (10) days after the initial request for a meeting, then the parties shall seek to resolve the dispute through an executive-level performance review as provided in Section 9.2. 9.2 Executive-Level Performance Review. For disputes that are not resolved at the Prime Vendor Account Executive and CUNY Project Director level, the Executive Sponsors shall meet and attempt to resolve the dispute. If such representatives are unable to resolve the dispute within five (5) business days after the parties have commenced negotiations, or ten (10) days have passed since the initial request for negotiations at this level, then the parties may seek to resolve the dispute through mediation as hereinafter provided or, if the parties do not agree to submit the dispute to mediation, to seek any and all rights and remedies that may be available to them as provided in the Agreement. 9.3 Voluntary, Non-Binding Mediation. If the prior levels of dispute resolution are not invoked or are unsuccessful, the parties may, but shall not be obligated to, mutually agree in writing to submit the dispute to non-binding mediation. Mediation must occur within thirty (30) days after the parties agree to submit the dispute to mediation. The parties mutually shall select an independent mediator experienced in information systems of the type in dispute, and each shall designate a representative(s) to meet with the mediator in good faith in an effort to resolve the dispute. The specific format for the mediation shall be left to the discretion of the mediator and the designated party representatives and may include the preparation of agreed-upon statements of fact or written statements of position furnished to the other party. 9.4 Redress in Court. Informal dispute resolution under this Article shall not be a pre-condition to any action by a party to enforce its rights under the Agreement. 9.5 Continued Performance; No Tolling of Cure Periods. Except where clearly prevented by the area in dispute, the parties shall continue performing their obligations under the Agreement while the dispute is being resolved as provided in this Article, unless and until the dispute is resolved or until the Agreement, the Hosting Services Exhibit, and/or the applicable Project Agreement or Contract Supplement, as applicable, is terminated. The time frame for a party to cure any breach of the terms of the Agreement shall not be tolled by the pendency of any dispute resolution procedures.

ARTICLE 10 MISCELLANEOUS 10.1 Notices. Any written notice required or permitted to be delivered pursuant to the Agreement (other than project-related notices that may be sent by email) shall be in writing and shall be deemed delivered: (a) upon delivery if delivered in person; (b) three (3) business days after deposit in the United States mail, certified mail, return receipt requested, postage prepaid; (c) upon transmission if sent via e-mail or fax, with a confirmation copy sent via overnight mail; -25CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

or (d) one (1) business day after deposit with a national overnight courier, in each case addressed to the following address: If to CUNY:

If to Prime Vendor:

The City University of New York 395 Hudson Street 6th Floor New York, New York 10014 Attention: Chief Information Officer Fax: (212) 541-0379 E-mail: [email protected]

_________________________ _________________________

with a copy to:

with a copy to:

The City University of New York Office of the Controller 230 West 41st Street 5th Floor New York, New York 10036 Attention: Associate Controller for Procurement Fax: (__) ________________ E-mail: ___________________

_________________________ _________________________ _________________________

_________________________ Attention: ________________ Fax: (__) ________________ E-mail: __________________

_________________________ Attention: ________________ Fax: (__) ________________ E-mail: __________________

and a copy to: The City University of New York Office of General Counsel 205 East 42nd Street 11th Floor New York, NY 10017 Attention: General Counsel Fax: (__) ________________ E-mail: ____________________ or to such other addresses as may be specified by a party upon notice given to the other. 10.2

Audits and Requests for Records.

10.2.1 Financial Audits. At any time up to and including six (6) years following the termination of the Agreement, CUNY (itself or through a Third Party) shall have the right upon reasonable advance written notice and on an annual basis to fully audit the books and records of Prime Vendor to the extent reasonably necessary to confirm the accuracy and appropriateness of all invoices issued under the Agreement, including all supporting details, and to verify compliance with applicable Laws. All such audits shall be conducted during normal business hours. If any audit demonstrates that Prime Vendor has overcharged or undercharged CUNY, then either: (a) Prime Vendor promptly shall refund the overcharges to CUNY; or (b) following receipt of Prime Vendor’s invoice, -26CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

CUNY shall pay the undercharge to Prime Vendor. Further, if any overcharge is in excess of five percent (5%) of the aggregate charges incurred during the period to which the audit relates, then Prime Vendor shall reimburse CUNY for the reasonable costs and expenses (up to $75,000 in expenses) incurred to conduct such audit. 10.2.2 Operational and Security Audits by CUNY. Upon prior written notice to Prime Vendor, Prime Vendor shall make available to CUNY (itself or to a Third Party) for the purpose of performing such audits or inspections access at all reasonable times to: (a) the data and records relating to the Services and Prime Vendor's other obligations under the Agreement; and (b) Prime Vendor's internal controls and systems as may be reasonably necessary to examine Prime Vendor's performance of the Services and compliance with its duties, responsibilities and obligations under the Agreement, including the safeguarding of CUNY Data and compliance with the Security Policies and Procedures and the terms set forth in Section 1.3.7. Prime Vendor shall provide to such auditors such assistance and support as they may reasonably request. If any audit reveals deficiencies, Prime Vendor shall review the findings with CUNY. If there are deficiencies to be corrected, Prime Vendor shall prepare and deliver to CUNY a detailed plan that is reasonably acceptable to CUNY for correcting all such deficiencies. Any audits shall be conducted so as to be non-disruptive to Prime Vendor's operational systems. User-level access may be granted to Applications to support such audits, and if necessary, will be coordinated between the parties. 10.2.3 Maintenance of Records. Prime Vendor and its subcontractors shall maintain books, records, documents and other evidence relating to the Agreement, protection and use of CUNY Data, and accounting procedures and practices which sufficiently and properly reflect all the costs of any nature invoiced in the performance of the Agreement. Prime Vendor shall retain all such records for six (6) years after the expiration or termination of the Agreement. Records involving matters in litigation related to the Agreement shall be kept for either one (1) year following the termination of litigation, including all appeals, or six (6) years from the date of expiration or termination of the Agreement, whichever is later. Prime Vendor shall incorporate in its subcontracts with subcontractors the terms and conditions of this Section. Books, records, documents, and other evidence of accounting procedures and practices related to Prime Vendor’s cost structure, including overhead, general and administrative expenses, and profit factors shall be excluded from CUNY's or its auditors’ review unless the cost or any other material issue under the Agreement is calculated or derived from these factors. 10.3

Insurance.

10.3.1 Required Coverages. At Prime Vendor's sole cost and expense, Prime Vendor shall procure and maintain in effect from and after the Effective Date and for the duration of the Agreement the insurance coverages described in the attached Schedule 10.3.1. Insurance may be maintained with one or more carriers, each of which must: (a) be authorized to do business in the State of New York or be eligible surplus lines insurers acceptable to CUNY and having agents in New York upon which service of process may be made; and (b) have a financial strength rating of A- or better and a financial size category of A-XIII or better, each as reported in the most recent edition of Best's Insurance Reports (or any successor or replacement rating agency). Any insurance or selfinsurance available to CUNY shall be in excess of, and non-contributing with, any insur-27CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ance that Prime Vendor is required to procure and maintain. Prime Vendor's insurance policies shall apply on a primary basis. To the extent that claims are paid under any insurance coverage resulting in a reduction of the remaining coverage amounts, Prime Vendor shall procure additional insurance as needed to continually meet and maintain the coverage amounts set forth on Schedule 10.3.1. 10.3.2 Additional Insureds and Evidence of Coverage. By endorsement to all liability policies, except for the Professional Liability/Errors & Omissions and Internet Policies insurance and Workers Compensation, CUNY shall be named as additional insureds for all liability arising from the Agreement. On or before the Effective Date, thereafter upon each insurance policy renewal, and otherwise promptly following CUNY's request from time-to-time, Prime Vendor shall provide CUNY with certificates of insurance, together with copies of all applicable endorsements (by endorsement crossliability of all insureds), evidencing Prime Vendor's compliance with the requirements set forth in this Section 10.3. If at any time during the period when insurance is required by the Agreement, an insurer fails to comply with the requirements set forth herein, as soon as Prime Vendor has knowledge of any such failure, Prime Vendor shall immediately notify CUNY and immediately replace such insurance with insurance meeting the Agreement requirements set forth herein. Within ten (10) business days following Prime Vendor's receipt of CUNY's written request, Prime Vendor shall provide (or cause to be provided) to CUNY a certified copy of any insurance policies that are required under this Section 10.3. 10.3.3 Claims-Made Coverage. If and to the extent any insurance coverage required under the Agreement is purchased on a "claims-made" basis, such insurance must: (a) cover the acts or omissions of Prime Vendor and any subcontractors, as applicable, up through and including the date that the Agreement and all Project Agreements and Contract Supplements have terminated and any Transition Period has expired; and (b) be continuously maintained by Prime Vendor, with full prior acts coverage, for at least six (6) years beyond the date that the Agreement and all Project Agreements and Contract Supplements have terminated and any Transition Period has expired. 10.3.4 Notice of Cancellation. Prime Vendor shall procure (or cause to be procured) endorsement(s) to its insurance policies that identify CUNY as a scheduled party to receive written notice thirty (30) days in advance of the cancellation of any insurance required hereunder. 10.3.5 Subcontractor Insurance. If Prime Vendor elects to have an approved subcontractor provide any Services to CUNY, including any collocation or data center facility or facilities from which Prime Vendor provides Hosting Services prior to providing any such Services, Prime Vendor must furnish to CUNY a certified copy of the applicable insurance policy or policies reflecting coverages of the type and amount agreed upon by Prime Vendor and CUNY pursuant to Section 10.4. Additionally, if an approved subcontractor provides Hosting Services or any component thereof, either: (a) such subcontractor must have commercial general liability insurance, professional liability/errors & omissions and internet policies insurance, ID theft and cyber extortion insurance and umbrella or excess liability insurance, all in the amounts set forth herein; or (b) Prime Vendor's insurance policies must specifically cover all of such subcontractor's services,

-28CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

and Prime Vendor must provide documentation from the applicable underwriter(s), acceptable to CUNY in its sole discretion, confirming such coverage. 10.4 Approval of Subcontractors. Prime Vendor shall obtain CUNY's prior written consent, which CUNY may withhold in its sole discretion, before entering into an agreement with any subcontractor who may be retained by Prime Vendor to provide any Services, including a Third Party providing collocation or data center facilities. In addition, at the request of CUNY, Prime Vendor shall provide CUNY with a full and complete copy of any proposed or signed agreement with the subcontractor (pricing may be redacted), to ensure that the subcontracted Services or other items are adequately covered, and CUNY may condition the approval of any subcontractor based on Prime Vendor's (and/or its subcontractor's) compliance with the foregoing. If CUNY determines, in its sole discretion, that any previously-approved Prime Vendor subcontractor is not satisfactorily performing its obligations, CUNY reserves the right to require Prime Vendor to replace such subcontractor with another subcontractor or for Prime Vendor to directly perform such obligations. Prime Vendor shall ensure that all such subcontractor agreements include provisions naming CUNY as a direct and intended third party beneficiary or otherwise granting CUNY the right to directly enforce Prime Vendor’s rights against such subcontractor and provisions. CUNY shall not be bound by the terms of such agreements entered into by Prime Vendor, and such agreements shall not contain any obligations with respect to CUNY, including a guarantee of payments to such subcontractor. In addition to the foregoing, any approval of Prime Vendor’s right to use a subcontractor may be conditioned by CUNY, in its sole discretion, to some or all of the following conditions: (a) the agreement between Prime Vendor and subcontractor not imposing or seeking to impose any liabilities or obligations on CUNY, including the pass throughs of any termination fees, damages or costs in the event Prime Vendor is required to replace the subcontractor; (b) with respect to any subcontractor who, if approved by CUNY, will perform services of the type requiring subcontractor to be subject to audits under the American Institute of Certified Public Accountants' Statement on Standards for Attestation Engagements (SSAE) No. 16: (i) the agreement between Prime Vendor and subcontractor containing substantially the same terms as those set forth in Section 2.6 of Exhibit 2 (modified as appropriate since the agreement will be one between Prime Vendor and the applicable subcontractor); (ii) CUNY's receipt of subcontractor's SOC 2 Type 2 Report for the immediately preceding audit period; (iii) a letter executed by an authorized senior executive officer of subcontractor updating the most recently issued SOC 2 Type 2 Report, that contains a written description of any material changes to the control environment that would adversely affect the most recently issued SOC 2 Type 2 Report and that covers the time period not covered under the scope of such most recently issued audit report from the date of such report until the date requested in CUNY's written request, or if there have not been any such changes, a letter stating that there have not been any changes since the date of the most recently issued report; and (iv) CUNY's right to conduct a review and audit of the subcontractor of the type described in Section 2.6.1.2(B) of Exhibit 2; (c) CUNY's ability to obtain a full assignment of such agreement upon written notice by CUNY to the subcontractor following any default by Prime Vendor under the Agreement, the Hosting Services Exhibit, and/or the applicable Project Agreement or Contract Supplement; (d) all employees of the subcontractor providing Services to CUNY being subject to the terms and restrictions of Section 7.4; (e) Prime Vendor being responsible for managing all subcontractor relationships; (f) Prime Vendor further acknowledging in writing that it is fully responsible and liable for the acts and omissions of any subcontractor; (g) CUNY and Prime Vendor agreeing to the level and types of insurance to be obtained by subcontractor; (h) subcontractor agreeing to the terms of the Host-29CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ing Services Exhibit, and demonstrating to CUNY's satisfaction its capabilities to perform Hosting Services in accordance with the terms therein; (i) the receipt of SOC 2 reports along with the security policies, practices and procedures of the subcontractor, which items are acceptable to CUNY in its sole discretion; (j) subcontractor agreeing to the terms of Section 10.3.4; and (k) subcontractor executing and delivering to CUNY the Subcontractor Confidentiality and NonDisclosure Agreement, the form of which is set forth in Exhibit 3. Assignment of any subcontractor agreement to CUNY shall not diminish, reduce, modify or affect Prime Vendor’s obligations and liabilities to CUNY hereunder, and Prime Vendor shall remain responsible for all such obligations and liabilities. Prime Vendor shall indemnify, defend and hold harmless the Indemnified Parties for the actions of its subcontractors. 10.5 Force Majeure. Except as provided below, each party may be excused from performing any of its obligations hereunder, in whole or in part, to the extent that the inability to perform is caused by an act of God, war, riot, civil commotion, explosion, fire, government action, court order, epidemic, CUNY-related labor activities or other similar circumstance beyond its reasonable control (each, a "Force Majeure Event"). Prime Vendor’s labor and unionrelated activities, the non-performance of Prime Vendor or any Prime Vendor subcontractor, and the inability or failure of Prime Vendor to obtain permits, visas or other governmental authorizations for its personnel, regardless of cause, shall not constitute a Force Majeure Event. A failure of the Internet or telecommunications lines shall not be a Force Majeure Event if Prime Vendor is obligated to provide an alternative form of communication and/or diverse routing communications linkages. If a Force Majeure Event prevents, hinders or delays performance of either party’s obligations hereunder for more than five (5) days, the party not prevented from performing shall have the right to terminate the affected portion of the Agreement, the Hosting Services Exhibit, and/or applicable Project Agreements and Contract Supplements as of the date specified by such party in a written notice of termination to the other party; provided that during the pendency of such five (5) day period the party whose performance is not prevented, hindered or delayed shall have the right to take all commercially reasonable actions that may be necessary to mitigate the impact of the other party’s non-performance, and the party claiming a Force Majeure Event shall take all commercially reasonable actions that may be necessary to mitigate the impact of its non-performance. 10.6 Notice of Financial Impacts. Prime Vendor shall provide written notice to CUNY within five (5) business days following the occurrence of any event that will or may be likely to have a material adverse impact upon Prime Vendor’s ability to perform its obligations hereunder, including Prime Vendor’s breach of any significant contract, default of any credit agreement, denial of significant funding requests and/or the filing of a significant lawsuit against Prime Vendor, and promptly (but in no event longer than ten (10) business days) thereafter shall meet with CUNY to discuss Prime Vendor’s ability to continue to perform its obligations under the Agreement in light of such event. 10.7 No Agency. No party shall make any representations or warranties or incur any liability on behalf of the other. No party is the agent, representative or partner of the other party. The parties agree that Prime Vendor is an independent contractor, that neither Prime Vendor nor its employees, subcontractors and/or agents are employees of CUNY and that CUNY shall not, on its behalf: Withhold income or other taxes; provide Industrial Insurance; participate in group insurance plans which may be available to employees of CUNY; participate or contribute or any public employees retirement system; accumulate vacation leave or sick leave; or provide unemployment compensation coverage. Neither Prime Vendor nor its employees, subcontrac-30CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

tors and/or agents are employees of CUNY, and accordingly, none of them are entitled to any of the compensation, benefits, rights or privileges of employees of CUNY. 10.8 Severability. If any provision of the Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, such determination shall not affect the validity or enforceability of any other part or provision of the Agreement and/or such Project Agreement or Contract Supplement. 10.9 Waiver. No delay or omission by a party to exercise any right occurring upon any non-compliance or default by the other party with respect to any of the terms of the Agreement shall impair any such right or power or be construed to be a waiver thereof. A waiver by any of the parties of any of the covenants, conditions or agreements to be performed by the other shall not be construed to be a waiver of any succeeding breach thereof or of any covenant, condition or agreement herein. 10.10 Governing Law; Exclusive Jurisdiction. The Agreement shall be deemed to be executed in the City of New York, State of New York, regardless of the domicile of Prime Vendor, and shall be governed by and construed in accordance with the laws of the State of New York, without application of its choice of law principles. The parties agree that any and all claims asserted by or against CUNY arising under this Agreement or related thereto shall be resolved pursuant to the terms of this Agreement and, thereafter, shall be heard and determined either in the courts located in New York City or in the courts of the State of New York located in the County of New York. THE PARTIES EACH CONSENT TO THE SOLE AND EXCLUSIVE PERSONAL JURISDICTION AND VENUE OF THE COURTS LOCATED IN NEW YORK CITY OR IN THE COURTS OF THE STATE OF NEW YORK LOCATED IN THE COUNTY OF NEW YORK. 10.11 Binding Nature and No Assignment. The Agreement or any of its provisions shall not be assigned, delegated or transferred, including a Change of Control which shall be deemed to be a transfer, in whole or in part, by either party without the prior written consent of the other party. The Agreement shall be binding on the parties and their successors and permitted assigns. 10.12 Counterparts. The Agreement and any Project Agreements and Contract Supplements may be executed in one (1) or more duplicate originals, all of which together shall be deemed one and the same instrument. 10.13 Public Announcements. Without the prior written consent of CUNY, which consent may be withheld in CUNY's sole discretion, Prime Vendor shall not make or publish, directly or indirectly, any statements, articles, public or private announcements (including any announcement made via e-mail or any posting on the Internet or any Prime Vendor website), media releases, press conferences, advertising or similar publicity in any form relating to the fact that the parties have entered into the Agreement, the name, image or logo of CUNY (or any variation or combination of such name, image or logo), as well as the name or image of any CUNY employee or contractor of CUNY. Without limiting the generality of the foregoing, Prime Vendor shall not, without CUNY's prior written approval, make any references to Third Parties that CUNY is a customer of Prime Vendor, include or make any reference to CUNY or CUNY's name in any proposals to Third Parties, or provide CUNY contact information to existing or prospective customers of Prime Vendor. -31CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

10.14 CUNY Policies. Prime Vendor, its employees, agents and permitted subcontractors shall comply with all CUNY policies, procedures, orders and directives that CUNY provides in writing to Prime Vendor, including the Security Policies and Procedures and those policies set forth on Schedule 10.14 and all standards referenced therein (collectively, the "CUNY Policies"). Prime Vendor acknowledges and agrees that the CUNY Policies and the list of CUNY Policies set forth on Schedule 10.14 may change from time-to-time and that CUNY may add, delete and/or change the CUNY Policies and/or the list of CUNY Policies set forth on Schedule 10.14, in its discretion. 10.15 Compliance with Laws. With respect to its obligations under the Agreement, Prime Vendor shall at all times comply with all applicable Laws, including Security Breach Notification Statutes, federal and applicable state nondiscrimination Laws, including Title VII of the Civil Rights Act, 42 U.S.C. §12101 et seq., the Americans with Disabilities Act, the Family Educational Rights and Privacy Act, and the Gramm-Leach-Bliley Act, HIPAA, and all rules, regulations and policies promulgated thereunder, including the commitment to negotiate in good faith any sub-agreements that may be required to be entered into by the parties pursuant to such Laws, and any and all obligations to obtain similar protections in or institute safeguards with respect to any Third Party agreements and/or arrangements. Prime Vendor shall comply with all Laws governing the importation, exportation or transfer of technology across national boundaries, shall obtain all necessary permits and governmental authorizations and approvals necessary to the performance of the Agreement. Prime Vendor’s noncompliance, or refusal to comply, with any applicable Law shall constitute an Event of Default pursuant to Section 5.2(c) and CUNY shall have the rights and remedies set forth in Section 5.4, additionally Prime Vendor may be declared ineligible for further contracts with CUNY or the State of New York. 10.16 Waiver of UCITA. The parties agree that the Uniform Computer Information Transactions Act or any substantially similar Law is enacted as part of the law of the State of New York or any other state ("UCITA"), shall not apply to the Agreement and, to the extent that UCITA is applicable, the parties agree to opt-out of the applicability of UCITA pursuant to the opt-out provision(s) contained therein, if any. 10.17 Binding, Irrevocable Offer. In consideration of CUNY agreeing to continue evaluating Prime Vendor as its service provider, Prime Vendor agrees that the signed Agreement and the Migration Project Agreement by Prime Vendor constitutes a binding, irrevocable offer to CUNY on the terms and conditions set forth herein which shall remain in full force and effect through and including __________________________, or such later date as may be agreed to in writing by the parties. The Agreement shall only become an effective and binding agreement upon CUNY's execution and delivery of a copy of the Agreement to Prime Vendor. 10.18 No Construction Against Drafter. The parties agree that any principle of construction or rule of law that provides that an agreement shall be construed against the drafter of the agreement in the event of any inconsistency or ambiguity in such agreement shall not apply to the terms and conditions of the Agreement. 10.19 Contractor Certifications. As required by New York State Procurement Lobbying Act of 2006 (“PLA”), Prime Vendor certifies to CUNY that all information provided by Prime Vendor to CUNY regarding PLA is complete, true and accurate. The applicable PLA forms, and shall be completed and submitted by Prime Vendor to CUNY on or before the Effective Date. -32CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

10.20 Comptroller's Approval. The Agreement shall not be valid, effective or binding upon CUNY until the Agreement has been approved in writing by the State Comptroller and filed in its office. 10.21 Entire Agreement; Modifications. The Agreement, together with all of its Schedules, Exhibits and Attachments, constitutes the final, complete and exclusive statement of the agreement of the parties relative to the subject matter hereof and supersedes all previous or contemporaneous oral or written proposals, negotiations, representations or understandings concerning such subject matter. The Agreement may be modified only pursuant to a writing executed by Prime Vendor and the CUNY General Counsel, or his or her designee, in order to be effective against CUNY. The parties expressly disclaim the right to claim the enforceability or effectiveness of any oral modifications to the Agreement or any amendments based on course of dealing, waiver, reliance, estoppel or other similar legal theory. IN WITNESS WHEREOF, authorized representatives of the parties have executed this Master Services Agreement effective as of the Effective Date. THE CITY UNIVERSITY OF NEW YORK

[Prime Vendor]

, [Title]

Frederick P. Schaffer, General Counsel and Senior Vice Chancellor of Legal Affairs

APPROVED AS TO FORM

New York State Attorney General Date:

APPROVED AND FILED IN THE OFFICE OF THE STATE COMPTROLLER

Office of the State Comptroller

Date

-33CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

CERTIFICATE OF ACKNOWLEDGMENT OF THE CONTRACTOR - INDIVIDUAL, CORPORATION, PARTNERSHIP, or LIMITED LIABILITY COMPANY:

STATE OF COUNTY OF

) ) ss: )

On the ___ day of ______________in the year 201__ before me, the undersigned, ________________________________, personally known to me or proved to me on the basis of satisfactory evidence to be the individual whose name is subscribed to the within instrument and acknowledged to me that s/he executed the same in her/his capacity, and that by her/his signature on the instrument, the individual, or the person upon behalf of which the individual acted, executed the instrument; and further that: [Mark an X in the appropriate box and complete the accompanying statement.] o

(If an individual): _he executed the foregoing instrument in his/her name and on his/her own behalf.

o

(If a corporation): _he is the____________________________________________________ of ______________________, the corporation described in said instrument; that, by authority of the Board of Directors of said corporation, _he is authorized to execute the foregoing instrument on behalf of the corporation for purposes set forth therein; and that, pursuant to that authority, _he executed the foregoing instrument in the name of and on behalf of said corporation as the act and deed of said corporation.

o

(If a partnership): _he is the____________________________________________________ of ______________________, the partnership described in said instrument; that, by the terms of said partnership, _he is authorized to execute the foregoing instrument on behalf of the partnership for purposes set forth therein; and that, pursuant to that authority, _he executed the foregoing instrument in the name of and on behalf of said partnership as the act and deed of said partnership.

o

(If a limited liability company): _he is a duly authorized member of ____________________ LLC, the limited liability company described in said instrument; that _he is authorized to execute the foregoing instrument on behalf of the limited liability company for purposes set forth therein; and that, pursuant to that authority, _he executed the foregoing instrument in the name of and on behalf of said limited liability company as the act and deed of said limited liability company.

Notary Stamp

_________________________________ Notary Public or Commissioner of Deeds

_________________________________ Registration No.

-34CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

NEW YORK STATE APPENDIX A STANDARD CLAUSES FOR NEW YORK STATE CONTRACTS The parties to the attached contract, license, lease, amendment or other agreement of any kind (hereinafter, "the contract" or "this contract") agree to be bound by the following clauses which are hereby made a part of the contract (the word "Contractor" herein refers to any party other than the State, whether a contractor, licenser, licensee, lessor, lessee or any other party): 1. EXECUTORY CLAUSE. In accordance with Section 41 of the State Finance Law, the State shall have no liability under this contract to the Contractor or to anyone else beyond funds appropriated and available for this contract. 2. NON-ASSIGNMENT CLAUSE. In accordance with Section 138 of the State Finance Law, this contract may not be assigned by the Contractor or its right, title or interest therein assigned, transferred, conveyed, sublet or otherwise disposed of without the State’s previous written consent, and attempts to do so are null and void. Notwithstanding the foregoing, such prior written consent of an assignment of a contract let pursuant to Article XI of the State Finance Law may be waived at the discretion of the contracting agency and with the concurrence of the State Comptroller where the original contract was subject to the State Comptroller’s approval, where the assignment is due to a reorganization, merger or consolidation of the Contractor’s business entity or enterprise. The State retains its right to approve an assignment and to require that any Contractor demonstrate its responsibility to do business with the State. The Contractor may, however, assign its right to receive payments without the State’s prior written consent unless this contract concerns Certificates of Participation pursuant to Article 5-A of the State Finance Law. 3. COMPTROLLER'S APPROVAL. In accordance with Section 112 of the State Finance Law (or, if this contract is with the State University or City University of New York, Section 355 or Section 6218 of the Education Law), if this contract exceeds $50,000 (or the minimum thresholds agreed to by the Office of the State Comptroller for certain S.U.N.Y. and C.U.N.Y. contracts), or if this is an amendment for any amount to a contract which, as so amended, exceeds said statutory amount, or if, by this contract, the State agrees to give something other than money when the value or reasonably estimated value of such consideration exceeds $10,000, it shall not be valid, effective or binding upon the State until it has been approved by the State Comptroller and filed in his office. Comptroller's approval of contracts let by the Office of General Services is required when such contracts exceed $85,000 (State Finance Law Section 163.6-a). However, such pre-approval shall not be required for any contract established as a centralized contract through the Office of General Services or for a purchase order or other transaction issued under such centralized contract. 4. WORKERS' COMPENSATION BENEFITS. In accordance with Section 142 of the State Finance Law, this contract shall be void and of no force and effect unless the Contractor shall provide and maintain coverage during the life of this contract for the benefit of such employees as are required to be covered by the provisions of the Workers' Compensation Law. 5. NON-DISCRIMINATION REQUIREMENTS. To the extent required by Article 15 of the Executive Law (also known as the Human Rights Law) and all other State and Federal statutory -35CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

and constitutional non-discrimination provisions, the Contractor will not discriminate against any employee or applicant for employment because of race, creed, color, sex (including gender identity or expression), national origin, sexual orientation, military status, age, disability, predisposing genetic characteristics, marital status or domestic violence victim status. Furthermore, in accordance with Section 220-e of the Labor Law, if this is a contract for the construction, alteration or repair of any public building or public work or for the manufacture, sale or distribution of materials, equipment or supplies, and to the extent that this contract shall be performed within the State of New York, Contractor agrees that neither it nor its subcontractors shall, by reason of race, creed, color, disability, sex, or national origin: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work; or (b) discriminate against or intimidate any employee hired for the performance of work under this contract. If this is a building service contract as defined in Section 230 of the Labor Law, then, in accordance with Section 239 thereof, Contractor agrees that neither it nor its subcontractors shall by reason of race, creed, color, national origin, age, sex or disability: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work; or (b) discriminate against or intimidate any employee hired for the performance of work under this contract. Contractor is subject to fines of $50.00 per person per day for any violation of Section 220-e or Section 239 as well as possible termination of this contract and forfeiture of all moneys due hereunder for a second or subsequent violation. 6. WAGE AND HOURS PROVISIONS. If this is a public work contract covered by Article 8 of the Labor Law or a building service contract covered by Article 9 thereof, neither Contractor's employees nor the employees of its subcontractors may be required or permitted to work more than the number of hours or days stated in said statutes, except as otherwise provided in the Labor Law and as set forth in prevailing wage and supplement schedules issued by the State Labor Department. Furthermore, Contractor and its subcontractors must pay at least the prevailing wage rate and pay or provide the prevailing supplements, including the premium rates for overtime pay, as determined by the State Labor Department in accordance with the Labor Law. Additionally, effective April 28, 2008, if this is a public work contract covered by Article 8 of the Labor Law, the Contractor understands and agrees that the filing of payrolls in a manner consistent with Subdivision 3-a of Section 220 of the Labor Law shall be a condition precedent to payment by the State of any State approved sums due and owing for work done upon the project. 7. NON-COLLUSIVE BIDDING CERTIFICATION. In accordance with Section 139-d of the State Finance Law, if this contract was awarded based upon the submission of bids, Contractor affirms, under penalty of perjury, that its bid was arrived at independently and without collusion aimed at restricting competition. Contractor further affirms that, at the time Contractor submitted its bid, an authorized and responsible person executed and delivered to the State a noncollusive bidding certification on Contractor's behalf. 8. INTERNATIONAL BOYCOTT PROHIBITION. In accordance with Section 220-f of the Labor Law and Section 139-h of the State Finance Law, if this contract exceeds $5,000, the Contractor agrees, as a material condition of the contract, that neither the Contractor nor any substantially owned or affiliated person, firm, partnership or corporation has participated, is participating, or shall participate in an international boycott in violation of the federal Export Administration Act of 1979 (50 USC App. Sections 2401 et seq.) or regulations thereunder. If such Contractor, or any of the aforesaid affiliates of Contractor, is convicted or is otherwise found to have violated said laws or regulations upon the final determination of the United States Commerce Department or -36CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

any other appropriate agency of the United States subsequent to the contract's execution, such contract, amendment or modification thereto shall be rendered forfeit and void. The Contractor shall so notify the State Comptroller within five (5) business days of such conviction, determination or disposition of appeal (2NYCRR 105.4). 9. SET-OFF RIGHTS. The State shall have all of its common law, equitable and statutory rights of set-off. These rights shall include, but not be limited to, the State's option to withhold for the purposes of set-off any moneys due to the Contractor under this contract up to any amounts due and owing to the State with regard to this contract, any other contract with any State department or agency, including any contract for a term commencing prior to the term of this contract, plus any amounts due and owing to the State for any other reason including, without limitation, tax delinquencies, fee delinquencies or monetary penalties relative thereto. The State shall exercise its set-off rights in accordance with normal State practices including, in cases of set-off pursuant to an audit, the finalization of such audit by the State agency, its representatives, or the State Comptroller. 10. RECORDS. The Contractor shall establish and maintain complete and accurate books, records, documents, accounts and other evidence directly pertinent to performance under this contract (hereinafter, collectively, "the Records"). The Records must be kept for the balance of the calendar year in which they were made and for six (6) additional years thereafter. The State Comptroller, the Attorney General and any other person or entity authorized to conduct an examination, as well as the agency or agencies involved in this contract, shall have access to the Records during normal business hours at an office of the Contractor within the State of New York or, if no such office is available, at a mutually agreeable and reasonable venue within the State, for the term specified above for the purposes of inspection, auditing and copying. The State shall take reasonable steps to protect from public disclosure any of the Records which are exempt from disclosure under Section 87 of the Public Officers Law (the "Statute") provided that: (i) the Contractor shall timely inform an appropriate State official, in writing, that said records should not be disclosed; and (ii) said records shall be sufficiently identified; and (iii) designation of said records as exempt under the Statute is reasonable. Nothing contained herein shall diminish, or in any way adversely affect, the State's right to discovery in any pending or future litigation. 11. IDENTIFYING INFORMATION AND PRIVACY NOTIFICATION. (a) Identification Number(s). Every invoice or New York State Claim for Payment submitted to a New York State agency by a payee, for payment for the sale of goods or services or for transactions (e.g., leases, easements, licenses, etc.) related to real or personal property must include the payee's identification number. The number is any or all of the following: (i) the payee’s Federal employer identification number, (ii) the payee’s Federal social security number, and/or (iii) the payee’s Vendor Identification Number assigned by the Statewide Financial System. Failure to include such number or numbers may delay payment. Where the payee does not have such number or numbers, the payee, on its invoice or Claim for Payment, must give the reason or reasons why the payee does not have such number or numbers. (b) Privacy Notification. (1) The authority to request the above personal information from a seller of goods or services or a lessor of real or personal property, and the authority to maintain such information, is found in Section 5 of the State Tax Law. Disclosure of this information by the seller or lessor to the State is mandatory. The principal purpose for which the information is collected is to enable the State to identify individuals, businesses and others who have been -37CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

delinquent in filing tax returns or may have understated their tax liabilities and to generally identify persons affected by the taxes administered by the Commissioner of Taxation and Finance. The information will be used for tax administration purposes and for any other purpose authorized by law. (2) The personal information is requested by the purchasing unit of the agency contracting to purchase the goods or services or lease the real or personal property covered by this contract or lease. The information is maintained in the Statewide Financial System by the Vendor Management Unit within the Bureau of State Expenditures, Office of the State Comptroller, 110 State Street, Albany, New York 12236. 12. EQUAL EMPLOYMENT OPPORTUNITIES FOR MINORITIES AND WOMEN. In accordance with Section 312 of the Executive Law and 5 NYCRR 143, if this contract is: (i) a written agreement or purchase order instrument, providing for a total expenditure in excess of $25,000.00, whereby a contracting agency is committed to expend or does expend funds in return for labor, services, supplies, equipment, materials or any combination of the foregoing, to be performed for, or rendered or furnished to the contracting agency; or (ii) a written agreement in excess of $100,000.00 whereby a contracting agency is committed to expend or does expend funds for the acquisition, construction, demolition, replacement, major repair or renovation of real property and improvements thereon; or (iii) a written agreement in excess of $100,000.00 whereby the owner of a State assisted housing project is committed to expend or does expend funds for the acquisition, construction, demolition, replacement, major repair or renovation of real property and improvements thereon for such project, then the following shall apply and by signing this agreement the Contractor certifies and affirms that it is Contractor’s equal employment opportunity policy that: (a) The Contractor will not discriminate against employees or applicants for employment because of race, creed, color, national origin, sex, age, disability or marital status, shall make and document its conscientious and active efforts to employ and utilize minority group members and women in its work force on State contracts and will undertake or continue existing programs of affirmative action to ensure that minority group members and women are afforded equal employment opportunities without discrimination. Affirmative action shall mean recruitment, employment, job assignment, promotion, upgradings, demotion, transfer, layoff, or termination and rates of pay or other forms of compensation; (b) at the request of the contracting agency, the Contractor shall request each employment agency, labor union, or authorized representative of workers with which it has a collective bargaining or other agreement or understanding, to furnish a written statement that such employment agency, labor union or representative will not discriminate on the basis of race, creed, color, national origin, sex, age, disability or marital status and that such union or representative will affirmatively cooperate in the implementation of the Contractor's obligations herein; and (c) the Contractor shall state, in all solicitations or advertisements for employees, that, in the performance of the State contract, all qualified applicants will be afforded equal employment opportunities without discrimination because of race, creed, color, national origin, sex, age, disability or marital status. Contractor will include the provisions of "a", "b", and "c" above, in every subcontract over $25,000.00 for the construction, demolition, replacement, major repair, renovation, planning or design of real property and improvements thereon (the "Work") except where the Work is for the -38CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

beneficial use of the Contractor. Section 312 does not apply to: (i) work, goods or services unrelated to this contract; or (ii) employment outside New York State. The State shall consider compliance by a contractor or subcontractor with the requirements of any federal law concerning equal employment opportunity which effectuates the purpose of this section. The contracting agency shall determine whether the imposition of the requirements of the provisions hereof duplicate or conflict with any such federal law and if such duplication or conflict exists, the contracting agency shall waive the applicability of Section 312 to the extent of such duplication or conflict. Contractor will comply with all duly promulgated and lawful rules and regulations of the Department of Economic Development’s Division of Minority and Women's Business Development pertaining hereto. 13. CONFLICTING TERMS. In the event of a conflict between the terms of the contract (including any and all attachments thereto and amendments thereof) and the terms of this Appendix A, the terms of this Appendix A shall control. 14. GOVERNING LAW. This contract shall be governed by the laws of the State of New York except where the Federal supremacy clause requires otherwise. 15. LATE PAYMENT. Timeliness of payment and any interest to be paid to Contractor for late payment shall be governed by Article 11-A of the State Finance Law to the extent required by law. 16. NO ARBITRATION. Disputes involving this contract, including the breach or alleged breach thereof, may not be submitted to binding arbitration (except where statutorily authorized), but must, instead, be heard in a court of competent jurisdiction of the State of New York. 17. SERVICE OF PROCESS. In addition to the methods of service allowed by the State Civil Practice Law & Rules ("CPLR"), Contractor hereby consents to service of process upon it by registered or certified mail, return receipt requested. Service hereunder shall be complete upon Contractor's actual receipt of process or upon the State's receipt of the return thereof by the United States Postal Service as refused or undeliverable. Contractor must promptly notify the State, in writing, of each and every change of address to which service of process can be made. Service by the State to the last known address shall be sufficient. Contractor will have thirty (30) calendar days after service hereunder is complete in which to respond. 18. PROHIBITION ON PURCHASE OF TROPICAL HARDWOODS. The Contractor certifies and warrants that all wood products to be used under this contract award will be in accordance with, but not limited to, the specifications and provisions of Section 165 of the State Finance Law, (Use of Tropical Hardwoods) which prohibits purchase and use of tropical hardwoods, unless specifically exempted, by the State or any governmental agency or political subdivision or public benefit corporation. Qualification for an exemption under this law will be the responsibility of the contractor to establish to meet with the approval of the State. In addition, when any portion of this contract involving the use of woods, whether supply or installation, is to be performed by any subcontractor, the prime Contractor will indicate and certify in the submitted bid proposal that the subcontractor has been informed and is in compliance with specifications and provisions regarding use of tropical hardwoods as detailed in §165 State Finance Law. Any such use must meet with the approval of the State; otherwise, the

-39CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

bid may not be considered responsive. Under bidder certifications, proof of qualification for exemption will be the responsibility of the Contractor to meet with the approval of the State. 19. MACBRIDE FAIR EMPLOYMENT PRINCIPLES. In accordance with the MacBride Fair Employment Principles (Chapter 807 of the Laws of 1992), the Contractor hereby stipulates that the Contractor either (a) has no business operations in Northern Ireland, or (b) shall take lawful steps in good faith to conduct any business operations in Northern Ireland in accordance with the MacBride Fair Employment Principles (as described in Section 165 of the New York State Finance Law), and shall permit independent monitoring of compliance with such principles. 20. OMNIBUS PROCUREMENT ACT OF 1992. It is the policy of New York State to maximize opportunities for the participation of New York State business enterprises, including minority and women-owned business enterprises as bidders, subcontractors and suppliers on its procurement contracts. Information on the availability of New York State subcontractors and suppliers is available from: NYS Department of Economic Development Division for Small Business Albany, New York 12245 Telephone: 518-292-5100 Fax: 518-292-5884 email: [email protected] A directory of certified minority and women-owned business enterprises is available from: NYS Department of Economic Development Division of Minority and Women's Business Development 633 Third Avenue New York, NY 10017 212-803-2414 email: [email protected] https://ny.newnycontracts.com/FrontEnd/VendorSearchPublic.asp The Omnibus Procurement Act of 1992 requires that by signing this bid proposal or contract, as applicable, Contractors certify that whenever the total bid amount is greater than $1 million: (a) The Contractor has made reasonable efforts to encourage the participation of New York State Business Enterprises as suppliers and subcontractors, including certified minority and women-owned business enterprises, on this project, and has retained the documentation of these efforts to be provided upon request to the State; (b) The Contractor has complied with the Federal Equal Opportunity Act of 1972 (P.L. 92-261), as amended; (c) The Contractor agrees to make reasonable efforts to provide notification to New York State residents of employment opportunities on this project through listing any such positions with the Job Service Division of the New York State Department of Labor, or providing such notification in such manner as is consistent with existing collective bargaining contracts or agreements. -40CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

The Contractor agrees to document these efforts and to provide said documentation to the State upon request; and (d) The Contractor acknowledges notice that the State may seek to obtain offset credits from foreign countries as a result of this contract and agrees to cooperate with the State in these efforts. 21. RECIPROCITY AND SANCTIONS PROVISIONS. Bidders are hereby notified that if their principal place of business is located in a country, nation, province, state or political subdivision that penalizes New York State vendors, and if the goods or services they offer will be substantially produced or performed outside New York State, the Omnibus Procurement Act 1994 and 2000 amendments (Chapter 684 and Chapter 383, respectively) require that they be denied contracts which they would otherwise obtain. NOTE: As of May 15, 2002, the list of discriminatory jurisdictions subject to this provision includes the states of South Carolina, Alaska, West Virginia, Wyoming, Louisiana and Hawaii. Contact NYS Department of Economic Development for a current list of jurisdictions subject to this provision. 22. COMPLIANCE WITH NEW YORK STATE INFORMATION SECURITY BREACH AND NOTIFICATION ACT. Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law Section 899-aa; State Technology Law Section 208). 23. COMPLIANCE WITH CONSULTANT DISCLOSURE LAW. If this is a contract for consulting services, defined for purposes of this requirement to include analysis, evaluation, research, training, data processing, computer programming, engineering, environmental, health, and mental health services, accounting, auditing, paralegal, legal or similar services, then, in accordance with Section 163 (4-g) of the State Finance Law (as amended by Chapter 10 of the Laws of 2006), the Contractor shall timely, accurately and properly comply with the requirement to submit an annual employment report for the contract to the agency that awarded the contract, the Department of Civil Service and the State Comptroller. 24. PROCUREMENT LOBBYING. To the extent this agreement is a "procurement contract" as defined by State Finance Law Sections 139-j and 139-k, by signing this agreement the contractor certifies and affirms that all disclosures made in accordance with State Finance Law Sections 139-j and 139-k are complete, true and accurate. In the event such certification is found to be intentionally false or intentionally incomplete, the State may terminate the agreement by providing written notification to the Contractor in accordance with the terms of the agreement. 25. CERTIFICATION OF REGISTRATION TO COLLECT SALES AND COMPENSATING USE TAX BY CERTAIN STATE CONTRACTORS, AFFILIATES AND SUBCONTRACTORS. To the extent this agreement is a contract as defined by Tax Law Section 5-a, if the contractor fails to make the certification required by Tax Law Section 5-a or if during the term of the contract, the Department of Taxation and Finance or the covered agency, as defined by Tax Law 5a, discovers that the certification, made under penalty of perjury, is false, then such failure to file or false certification shall be a material breach of this contract and this contract may be terminated, by providing written notification to the Contractor in accordance with the terms of the agreement, if the covered agency determines that such action is in the best interest of the State.

-41CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

26. IRAN DIVESTMENT ACT. By entering into this Agreement, Contractor certifies in accordance with State Finance Law §165-a that it is not on the “Entities Determined to be NonResponsive Bidders/Offerers pursuant to the New York State Iran Divestment Act of 2012” (“Prohibited Entities List”) posted at: http://www.ogs.ny.gov/about/regs/docs/ListofEntities.pdf Contractor further certifies that it will not utilize on this Contract any subcontractor that is identified on the Prohibited Entities List. Contractor agrees that should it seek to renew or extend this Contract, it must provide the same certification at the time the Contract is renewed or extended. Contractor also agrees that any proposed Assignee of this Contract will be required to certify that it is not on the Prohibited Entities List before the contract assignment will be approved by the State. During the term of the Contract, should the state agency receive information that a person (as defined in State Finance Law §165-a) is in violation of the above-referenced certifications, the state agency will review such information and offer the person an opportunity to respond. If the person fails to demonstrate that it has ceased its engagement in the investment activity which is in violation of the Act within 90 days after the determination of such violation, then the state agency shall take such action as may be appropriate and provided for by law, rule, or contract, including, but not limited to, imposing sanctions, seeking compliance, recovering damages, or declaring the Contractor in default. The state agency reserves the right to reject any bid, request for assignment, renewal or extension for an entity that appears on the Prohibited Entities List prior to the award, assignment, renewal or extension of a contract, and to pursue a responsibility review with respect to any entity that is awarded a contract and appears on the Prohibited Entities list after contract award. January 2014

-42CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 1.5 DEFINITIONS Whenever used in the Agreement, including in any Schedules, Exhibits, Attachments and other documents attached to the Agreement, the following terms shall have the meaning ascribed to them below. Other capitalized terms used in the Agreement are defined in the context in which they are used and shall have the meanings ascribed therein. The terms defined in this Schedule include the plural as well as the singular. "Additional Resource Charges" or "ARCs" are defined in Section 3 of Exhibit 2. “Affiliate(s)” means any person, firm, corporation (including service corporation and professional corporation), partnership (including general partnership, limited partnership and limited liability partnership), limited liability company, joint venture, association, business trust or other similar entity that, now or in the future, directly or indirectly, controls, is controlled with or by or under common control with Prime Vendor. For purposes of the foregoing, “control” shall mean the direct or indirect control of fifty percent (50%) or more of the voting power to elect directors thereof, or any other entity, the power to direct the management of such entity. Upon request, Prime Vendor shall provide CUNY with a list of entities qualifying as Affiliates of Prime Vendor. "Agreement" or "MSA" is referenced in the preamble and means this Master Services Agreement, entered into by and between CUNY and Prime Vendor, effective as of the Effective Date, inclusive of all Schedules, Exhibits and Attachments. "Application" means any software provided by CUNY to Prime Vendor in which Prime Vendor provides Hosting Services. "Application Pillar" is defined in Section 3 of Exhibit 2. "Application Response Time" is described in Section 5.3 of Attachment C to Exhibit 2. "At Risk Amount" is defined in Section 2.3 of Attachment C to Exhibit 2. "Certification Criteria" is defined in Section 2 of Schedule 2.3. "Certification Form" is attached to the Agreement as Attachment A to Schedule 2.3. "Change of Control" means: (a) any transaction or combination of transactions as a result of which either a person, an entity or a group of persons and/or entities that customarily has acted in concert and that presently is in control of a party ceases to be in control of such party; or (b) the sale, transfer, exchange or other disposition (including disposition in full or partial dissolution) of fifty percent (50%) or more of the beneficial ownership (as defined in Rule 13(d) of the Securities Exchange Act of 1934) of the voting power of a party, or of the assets of such party that constitute a substantial or material business segment of such party; or (c) the divestiture, in whole or in part, of the business unit or division of Prime Vendor that has provided the Services hereunder.

-43CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"Change Order", "Change Request" and "Change Response" are defined in Section 1.2 of Schedule 2.2. "Chronic Performance Standards Failures" is defined in Section 2.3(D) of Exhibit 2. "Communications Management" is defined in Section 1.14 of Exhibit 2. "Confidential Information" shall mean: (a) information concerning the other party's business affairs, property and methods of operation that is marked "confidential" and/or "proprietary"; and (b) in the case of CUNY, regardless of whether such information is marked confidential or proprietary: (i) CUNY Data; (ii) any information and materials relating to Third Party vendors that have provided any part of CUNY's information or communications infrastructure; (iii) any information of CUNY that is maintained or stored by or through any Application; and/or (iv) to the extent not covered above, names, addresses, Social Security numbers, e-mail addresses, telephone numbers, financial profiles, credit card information, driver's license numbers, medical data, law enforcement records, agency source code or object code and agency security data, or other information identifiable to an individual that relates to any of the foregoing types of information. "Contract Supplement" is defined in Article 2. "Control Objectives" is defined in Section 2.6.1.1 of Exhibit 2. "CPI" means the annual increase in percentage points (or fraction thereof) of the official Consumer Price Index, All Urban Consumers, U.S. City Average, All Items, published by the Bureau of Labor Statistics, United States Department of Labor. The CPI data shall be determined by reference to the "Percent Dec-Dec" column of the Consumer Price Index History Table for the applicable year, published by the United States Department of Labor, Bureau of Labor Statistics. "Critical Milestone" means those key Deliverables and key events, to be identified in the Project Agreement or Contract Supplement, as significant project-related milestones deliverables and events. "CUNY" is defined in the Recitals and includes any successors and assigns. "CUNY Chief Information Officer" means the CUNY Chief of Information Technology, or his or her designee. "CUNY Data" means any and all data collected, stored, managed or used by an Application or is otherwise used or transmitted in connection with the Hosting Services, or is data belonging to CUNY and is otherwise in the control or possession of Prime Vendor, and such data does not cease to be CUNY Data because it is transferred or transmitted beyond CUNY's immediate possession, custody or control. "CUNY Executive Sponsor" is defined in Section 1.3.2. "CUNY Policies" is defined in Section 10.14.

-44CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"CUNY Project Director" and "CUNY Project Manager(s)" are defined in Section 1 of Schedule 2.4. "CUNY Requirements" means the business and technical requirements and Performance Standards that may be attached to a Project Agreement or Contract Supplement. With respect to the Hosting Services, the business and technical requirements are set forth in the Hosting Services Exhibit, with the Performance Standards being set forth in Section 5.0 of Attachment C of the Hosting Services Exhibit. "CUNY Security Policies and Procedures" means CUNY's security policies and procedures, currently located at http://www.cuny.edu/about/administration/offices/la.html, as such documents may be updated from time-to-time by CUNY. "Cutover" is defined in Section 3 of Exhibit 2. "Data Protected by Law" is defined in Section 3 of Exhibit 2. "Deficiencies" is defined in Section 2.6.3 of Exhibit 2. "Delay Credits" is defined in Section 2.3(b) of Schedule 2.1. "Deliverables" means documentation, designs, diagrams, configurations, functional specifications, technical specifications, data transformations, data aggregations, schematics, architectural renderings, prototypes, software, screen layouts and other documents and materials developed or prepared by Prime Vendor, either alone or jointly with CUNY. "Device" is defined in Section 3 of Exhibit 2. "Disabling Code" is defined in Section 4.2. "Disaster" is defined in Section 1.5.5 of Exhibit 2. "Disaster Recovery Restoration" is described in Section 5.4 of Attachment C to Exhibit 2. "Disclosing Party" is defined in Section 7.2. "Documentation" means, collectively, and shall be interpreted in the following order of precedence: (a) first, technical or other specifications, features or functionality and any special provision relating thereto, if any, as described in a Project Agreement or Contract Supplement; (b) second, the CUNY Requirements; (c) third, Deliverables other than the CUNY Requirements; (d) fourth, the applicable RFP Response; and (e) fifth, all of the written, printed, electronic or other format materials published or otherwise made available by Prime Vendor to CUNY. "Due Date" means the date by which a Deliverable or Critical Milestone must be completed. "E" is defined in Section 5.1.3. "Effective Date" is defined in the Recitals.

-45CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"End Point Protection Platform" is defined in Section 3 of Exhibit 2. "Enhancements" is defined in Section 3 of Exhibit 2. "ERP System" means the Applications listed on Attachment A of the Hosting Services Exhibit and the related conversions, customizations, extensions, modifications, localizations, and interfaces. "Ethical Hacking" is defined in Section 1.11.1(I) of Exhibit 2. "Events of Default" is defined in Section 5.2. "Executive Sponsor" is defined in Section 1.3.2. "Fixed Fee" means a sum certain to acquire Services and, if applicable, associated expenses, which amount, if applicable, will be set forth in a Project Agreement or Contract Supplement. "Force Majeure Event" is defined in Section 10.5. "Functionality Releases" is defined in Section 3 of Exhibit 2. "Gain Sharing/Improvement Opportunity" is defined in Section 4.0 of Attachment D to Exhibit 2. "HIPAA" is defined in Section 7.7. "Holidays" means those days on which CUNY observes a holiday in a particular calendar year as published from time-to-time by CUNY. "Hosting Renewal Option" is defined in Section 2.2 of Exhibit 2. "Hosting RFP Response" is defined in the Recitals, and is incorporated into and made a part of the Agreement. "Hosting Services" means the Services to be provided by Prime Vendor under the Hosting Services Exhibit. "Hosting Services Exhibit" is defined in Section 3 of Exhibit 2. "Hosting Stabilization Period" is defined in Section 4.1 of Attachment C to Exhibit 2. "Hosting Term" is defined in Section 2.2 of Exhibit 2. "Hosting Transition Plan" is defined in Section 2.5 of Exhibit 2. "Incident", "Incident Report", "Incident Response", and "Incident Resolution Report" are defined in Section 3 of Exhibit 2. "Included Maintenance" is defined in Section 1(D) of Exhibit 2. -46CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"Indemnified Parties" and "Indemnifying Party" are defined in Section 8.1. "Information Security Officer" is defined in Section 1.3.7(b). "Initial Hosting Term" is defined in Section 2.2 of Exhibit 2. "Instance" is defined in Section 3 of Exhibit 2. "Intellectual Property Rights" means any and all rights in and to all copyrights, inventions, patents, trademarks, trade secrets and any other proprietary rights in or to tangible or intangible property recognized in any jurisdiction in the world, whether or not registered or registerable. "Interim Resolution" is defined in Section 3 of Exhibit 2. "ISO Security Standards" is defined in Section 1.3.7(c). "Issue" means any of the following: (a) any presently identified event, circumstance or problem that adversely affects the ability to meet project requirements, or a Deliverable Due Date or Critical Milestone Due Date, whether by Prime Vendor, CUNY or a Third Party; or (b) any event, problem, difficulty, circumstance or defect which affects or may affect the system or the operation of the system by CUNY, including the failure to meet the Performance Standards, or the delivery of the Hosting Services by Prime Vendor. "Joint Resource Plan" is defined in Section 2.1 of Schedule 2.1. "Key Personnel" is defined in Section 2 of Schedule 2.4. "Knowledge" is defined in Section 2.9 of Exhibit 2. "Law" or "Laws" means all existing and future laws, statutes, regulations, rules, administrative codes, ordinances, executive orders, polices, judicial opinions and/or decrees and other decisions having the effect of law (and any amendments thereto) by any federal, state or local government, authority, department or agency in any location that CUNY conducts business. "Level 1 Incident," "Level 2 Incident" and "Level 3 Incident" are defined in Section 3 of Exhibit 2. "Maintenance Code Release" is defined in Section 3 of Exhibit 2. "Migration Project" is defined in the Recitals, is further described in the Migration Project Agreement and includes the transition, conversion and migration of CUNY's existing hosted environment to Prime Vendor's hosted environment. "Migration Project Agreement" means the Project Agreement for the Migration Project, attached as Exhibit 1. "Migration Project Statement of Work" is the statement of work attached to the Migration Project Agreement. -47CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"Monthly Hosting Fees" is defined in Section 3 of Exhibit 2. "Monthly Performance Report" is defined in Section 1.2 of Attachment C to Exhibit 2. "Multi-Party Incident" is defined in Section 1.13.5 of Exhibit 2. "N" is defined in Section 5.1.3. "Non-Production Infrastructure Availability" is described in Section 5.2 of Attachment C to Exhibit 2. "Original Estimated Hours" is defined in Section 3.2.3. "Page Load Data Point(s)" is defined in Section 5.3.2 of Attachment C to Exhibit 2. "Partnering Principles" is defined in Section 1.2. "Performance Credits" are defined in Section 2 of Attachment C to Exhibit 2, and refers to the financial consequences, if any, associated with failure of a system or Service, as applicable, to conform to the applicable Performance Standards. "Performance Standards" are defined in Section 5 of Attachment C to Exhibit 2, and refers to the standards for performance of a Service as set forth in the Hosting Service Exhibit, and as may be set forth in a Project Agreement or Contract Supplement. "Performance Standard(s) Failure(s)" is defined in Section 3 of Exhibit 2. "Personal Information" means: (a) information, including CUNY Data, from which a natural person can be identified by reference to an identification number, including an individual's Social security number, driver's license number or New York identification card number, or an account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; or (b) such other definition as may be set forth in Personal Information Laws. "Personal Information Law(s)" means any law that regulates the disclosure, handling and/or security of Personal Information, including the New York Technology Law, or any similar federal or state statute or regulation that exists as of the Effective Date or may be enacted in the future. "PLA" is defined in Section 10.20. "Point(s) of Demarcation" is defined in Section 3 of Exhibit 2. "Primary Hours of Operation" is defined in Section 3 of Exhibit 2. "Prime Vendor" means _______________, and any successors and permitted assigns. "Prime Vendor Account Executive" is defined in Section 1.3.4.

-48CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"Prime Vendor Contract Manager" is defined in Section 1.3.6. "Prime Vendor Environment" means the Prime Vendor environment identified in Attachment B to Exhibit 2. "Prime Vendor Executive Sponsor" is defined in Section 1.3.2. "Prime Vendor Implementation Methodologies" means the methodologies used by Prime Vendor to provide and/or implement a Service, as may be further defined and described in a Project Agreement or Contract Supplement. "Prime Vendor Personnel" is defined in Section 1.11.1(D)(1) of Exhibit 2. "Prime Vendor Portal" is defined in Section 3 of Exhibit 2. "Prime Vendor Project Director" and "Prime Vendor Project Manager(s)" are defined in Section 1.3.5. "Prime Vendor Tools and Utilities" is defined in Section 1.8 of Schedule 2.1. "Procedures Manual" is defined in Section 2.7.1 of Exhibit 2. "Production Application Availability" is described in Section 5.1 of Attachment C to Exhibit 2. "Production Baselining Period" is defined in Section 3.3 of Attachment C to Exhibit 2. "Project Agreement" is defined in Article 2. "Project Completion" means when all the obligations of Prime Vendor under a Project Agreement have been completed, and the CUNY Executive Sponsor, or his or her designee, has provided written confirmation that Prime Vendor's obligations under the Project Agreement have been satisfied. Without limiting the foregoing, any and all Documentation and other Deliverables relating to the Services delivered under the Project Agreement must be certified as complete by CUNY, and Prime Vendor must have fulfilled its obligations relating to the transfer of Knowledge. Nothing else, including CUNY's use of the Services, in whole or in part, in a live, production environment shall constitute acceptance or completion, or affect any rights and remedies that may be available to CUNY under Law. "Project Plan" is defined in Section 2.1 of Schedule 2.1. "Project Status Meetings" is defined in Section 1.1 of Schedule 2.1. "Project Status Report" means the report to be developed by Prime Vendor in accordance with the terms of Section 1.2 of Schedule 2.1. "Quality Credits" and "Quality Incentives" are defined in Section 2.4.2(b) of Schedule 2.1. "RCA" is defined in Section 1.13.5(B)(3) of Exhibit 2. -49CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"Receiving Party" is defined in Section 7.2. "Records" is defined in Section 2.6.2 of Exhibit 2. "Reduced Resource Charges" or "RRCs" are defined in Section 3 of Exhibit 2. "Refresh" is defined in Section 1.7.1(P) of Exhibit 2. "Remedial Plan" is defined in Section 2.6.3 of Exhibit 2. "Review Period" is defined in Section 2 of Schedule 2.3. "RFP" is referenced in the Recitals, and includes all updates and supplements to the originallyissued RFP, along with all clarifications and additional information provided by CUNY. "RFP Response" means Prime Vendor’s response to a CUNY request for proposal, including any supplements and clarifications thereto. Without limiting the foregoing and with respect to the Migration Project, the RFP Response includes the following Prime Vendor submissions: ________________ and ________________. [LIST EACH OF THE RFP SUPPLEMENTS AND RESPONSES] "Risk" means any potential event that could adversely affect the project's success (scope, resources, effort, quality, or schedule) at a future point in time. The impact to the project could take the form of diminished quality of the end product, increased costs, delayed completion or failure. "Scheduled Downtime" is defined in Section 3 of Exhibit 2. "Security Breach Notification Statutes" means laws regulating the disclosure and/or security of Personal Information such as laws requiring, among other things, that notice be given to affected individuals if a breach of security occurs in respect of Personal Information, including New York Technology Law and Massachusetts General Laws Chapter 93H. "Security Event" is defined in Section 7.8.2. "Security Management" is described in Section 5.6 of Attachment C to Exhibit 2. "Security Policies and Procedures" is defined in Section 1.3.7(a). "Service Rate(s)" are defined in Section 3.2.2 and are set forth in Schedule 3.2.2. "Service Request" is defined in Section 3 of Exhibit 2. "Service Request Response and Resolution Time" is described in Section 5.5 of Attachment C to Exhibit 2. "Services" means any and all services acquired by CUNY from Prime Vendor, including the Hosting Services and any and all conversion, migration, consulting and transition services. -50CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

"SOC 2 Type 2 Report" is defined in Section 3 of Exhibit 2. "Statement of Work" is defined in Section 2.1 of Schedule 2.1. "Subcontract Agreement," "Subcontractor NDA Agreement" and "Subcontractor" are defined in Exhibit 3. "Technical Design and Architecture" is defined in Attachment B to Exhibit 2. "Third Party" or "Third Parties" means persons, corporations and entities other than Prime Vendor or CUNY. "Third Party NDA Agreement" is defined in Exhibit 4. "Third Party Solution Provider" is defined in Section 1.13.5 of Exhibit 2. "Transition Period" is defined in Section 5.5. "UCITA" is defined in Section 10.16. "Unscheduled Downtime" is defined in Section 3 of Exhibit 2. "Vacancy" means a circumstance in which Prime Vendor does not have a specific individual fully performing the responsibility of the applicable Key Personnel position, and one Prime Vendor employee sharing two or more Key Personnel positions shall constitute a Vacancy.

-51CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 2.1 PROJECT MANAGEMENT SERVICES Prime Vendor shall provide the Services as described in a Project Agreement or Contract Supplement, and when providing such Services shall comply with the further terms and conditions set forth in this Schedule. 1. Project Management Services. For projects in which Prime Vendor is performing project management Services, Prime Vendor shall act as the project manager and shall perform all customary duties of a project manager, including performing the day-to-day project management duties, managing the provision and coordination of the Services provided by Prime Vendor, reporting on the progress of or delays involving CUNY, and managing to complete the project on-time and within the Fixed Fee or budget. Without limiting the generality of the foregoing, Prime Vendor shall provide the following project management Services, which Services may be supplemented as specified in a Project Agreement: 1.1 Project Status and Other Meetings. On the dates and locations specified in the Statement of Work and/or Project Plan and other dates as reasonably requested by CUNY, the Prime Vendor Project Director, the Prime Vendor Project Manager(s), the CUNY Project Director and applicable CUNY Project Manager(s) and other appropriate representatives of the parties shall discuss the status of the project ("Project Status Meetings"). Project Status Meetings for a project shall be held with the frequency (e.g., weekly) and at the location (e.g., at CUNY) as set forth in the applicable Project Agreement. At least two (2) business days before each Project Status Meeting, Prime Vendor shall create and distribute to all meeting participants, a meeting agenda, and send the Project Status Report electronically to CUNY. At each Project Status Meeting, the parties shall review the Project Status Report and discuss any existing or newly discovered Issues and Risks, progress towards project goals, any proposed changes to Critical Milestone or Deliverables Due Dates and other Issues relevant to the project. Prime Vendor shall keep minutes of the meetings and shall include such minutes in the next Project Status Report. In addition, Prime Vendor shall create, maintain, update and circulate to applicable personnel a separate schedule that identifies the time, place, location and participants for all Project Status Meetings, other status meetings, team meetings, executive briefings and other meetings relating to the project. For all Prime Vendor-arranged or conducted meetings: (a) Prime Vendor shall discuss such dates for meetings in advance with all key personnel from CUNY who need to attend such meetings to avoid scheduling the meetings when there are scheduling conflicts, and conflicts of availability for key personnel of CUNY; and (b) Prime Vendor shall prepare all meeting materials and present them to the meeting attendees sufficiently in advance of the meeting to permit time for review by the recipients. 1.2

Project Status Reporting Management, Reports and Feedback.

(a) General. The Project Status Report shall conform to the form, format, frequency, quality standards, content structure, minimum data sets, nomenclature and other operational program management systems adopted by CUNY, and be signed by -52CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

the Prime Vendor Project Director (or Prime Vendor Project Manager if there is no Prime Vendor Project Director) and include: (i) Excerpts from project issue logs based on escalation criteria as specified by CUNY's approved processes; (ii) Excerpts from project risks logs based on escalation criteria as specified by CUNY's approved processes; (iii) If applicable, the cost management plan, both actual funds expended and those to be encumbered; (iv) A separate section identifying the accomplishments and Issues encountered since the last Project Status Report, and suggestions and proposed actions for dealing with and resolving such Issues, including identifying and explaining actual delays and expected delays, and the impact of such Due Date delays and expected delays, relating to the Statement of Work, Project Plan and Deliverable Due Dates and Critical Milestone Due Dates; (v) A separate section identifying previously-reported Issues, the date such Issue was previously reported, and the action taken to address such Issues – if no action was taken by either party, Prime Vendor shall identify which party was required to act and identify that such party did not take action; (vi) Based on the estimating models determined by CUNY, the percent complete for each Deliverable, Critical Milestone and other milestones and the effort remaining and/or estimated number of hours required to complete each Deliverable, Critical Milestone and other milestones; (vii) Thirty (30) and sixty (60) day forecasts identifying all the activities and tasks required of the project teams and the expected Deliverables and other outputs, which forecasts must be consistent with the timeframes set forth in the Project Plan; (viii) A cumulative summary and status of each Change Request, Change Response and Change Order, and a determination as to whether response time frame commitments are being met; (ix) Compliance with Deliverable Due Dates and Critical Milestone Due Dates, and whether any Delay Credits, Quality Credits and/or Incentives are incurred, earned back or due; (x)

Status of any requests for additional Prime Vendor Personnel;

(xi) Status of any proposed changes to any other Schedules, Exhibits or Attachments to a Project Agreement or Contract Supplement, or any proposed amendments to the Agreement;

-53CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(xii) Tasks/activities accomplished and Deliverables completed since last Project Status Report, tasks/activities/Deliverables planned for completion/delivery between the issuance of the current Project Status Report and the next Project Status Report and the dependencies of such tasks/activities/Deliverables; and (xiii)

Such other matters as one party may request of the other.

Issues or Risks that may arise shall be timely reported by one party to the other. Prime Vendor shall include in the Project Status Reports any delays by CUNY and/or Third Parties or other circumstances as well as any Issues that are reported by CUNY to Prime Vendor. For any delays caused by CUNY (including any failures by CUNY personnel to fulfill its responsibilities), Prime Vendor shall identify the delay and/or the specific activity, task or subtask in the Project Plan that CUNY has not completed on time. CUNY shall have the right to assume that Prime Vendor is not aware of any Issues or Risks unless Prime Vendor specifically identifies such Issues or Risks in the Project Status Reports. No Issues or Risks shall be deleted or removed from the Project Status Report, issue log or risk log, respectively, until such Issue or Risk has been resolved to CUNY's reasonable satisfaction and CUNY agrees to remove the Issue from the Project Status Report, issue log or risk log, as applicable. (b) Feedback and Updates. CUNY shall have the right, but not the obligation, to provide feedback and comment on any Project Status Report provided by Prime Vendor. If CUNY provides written feedback and comment to a Project Status Report, Prime Vendor shall incorporate into and address such feedback and comment in the next Project Status Report. 1.3 Issue Management. The issue log tool and issue management methodology shall be identified in each Project Agreement, and Prime Vendor shall use such tool and methodology to provide issue management Services. Prime Vendor shall identify and report on all Issues, whether such Issues are identified by Prime Vendor or CUNY, which arise in a project. Without limiting the generality of the foregoing, Prime Vendor shall: (a) Populate an issues log as soon as Prime Vendor or CUNY identifies an Issue; to the extent the Prime Vendor's tool is used for the issue log, Prime Vendor shall provide CUNY with the ability to directly input Issues; (b) For each Issue identified, propose to CUNY a mitigation plan to eliminate or mitigate the Issue, and upon approval, Prime Vendor shall include the mitigation plan in the issues log; (c) Monitor all outstanding Issues and report on whether the previouslyapproved mitigation efforts have been or are being undertaken and then assess whether the mitigation efforts are successful or need further revision; and

-54CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(d) Provide the current, updated issues log to the CUNY Project Director on no less than a weekly basis, and such updated log shall be included in connection with the delivery of the Project Status Report. To the extent Prime Vendor uses an issues log tool other than CUNY's tool, Prime Vendor shall provide CUNY with unrestricted access to such issues log tool, including the ability to export, save and download any or all information contained in such tool relating to any CUNY project. 1.4 Risk Management. The risk log tool and risk management methodology shall be identified in each Project Agreement, and Prime Vendor shall use such tool and methodology to provide risk management Services. Prime Vendor shall provide risk management Services for both episodic and on-going Risks in a project. Without limiting the generality of the foregoing, Prime Vendor shall: (a) Populate a risk log as soon as Prime Vendor or CUNY identifies a Risk; to the extent the Prime Vendor's tool is used for the risk log, Prime Vendor shall provide CUNY with the ability to directly input Risks; (b) For each Risk identified, propose to CUNY a mitigation plan to eliminate or mitigate the Risk, and upon approval, Prime Vendor shall include the mitigation plan in the risk log; (c) Monitor all outstanding Risks and report on whether the previouslyapproved mitigation efforts have been or are being undertaken and then assess whether the mitigation efforts are successful or need further revision; and (d) Provide the current, updated risk log to the CUNY Project Director on no less than a weekly basis, and such updated log shall be included in connection with the delivery of the Project Status Report. 1.5 Project Cost Management. CUNY may create a cost management plan for use in managing a project. If CUNY develops a cost management plan, Prime Vendor will provide data inputs during the pendency of the project required to populate such cost management data based on Deliverables, Critical Milestones and milestones. 1.6 Communications Plan. Each Project Agreement shall include a comprehensive communication plan which shall have at least two (2) separate components: One component targeted to communications to project team members and other internal constituents (internal); and a second component targeted to communications to broader CUNY constituencies (external). The internal constituents plan will be developed by Prime Vendor with CUNY input, and the CUNY constituencies plan will be developed by CUNY with Prime Vendor input. The communication plan shall include, as applicable: (a) Developing communications standards, methods, formats and templates, with Prime Vendor initially providing a variety of samples and templates with respect to internal and external constituencies for CUNY's consideration;

-55CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(b) Communicating project status for both internal and external constituencies, including preparing a project newsletter as mutually agreed, but no less than quarterly during the pendency of a project; (c)

Communicating team member assignments for internal constituencies;

(d) Communicating upcoming tasks, meetings and Critical Milestones for internal constituencies; (e)

Communicating Issues and Risks for internal constituencies; and

(f)

Schedule management for internal constituencies.

Prime Vendor's development of its component of the communications plan shall be a Deliverable, subject to the terms of Schedule 2.3. 1.7

Document Management and Control.

(a) Form and Format. In developing written documentation, Prime Vendor shall present for CUNY's approval, the form and format for documentation templates and conventions such that all project-related documentation retains a consistent look and feel. (b) Repository. For each project, using the tool or utility agreed to by the parties and identified in a Project Agreement, a project repository will be developed and used to track documents and other project artifacts. Prime Vendor shall comply with CUNY's procedures and policies relating to the use, version control and updating of the repository, and shall ensure that any items uploaded into the repository are uploaded on a timely basis, are an accurate version of the documents to be uploaded, and use the taxonomy and naming conventions approved by CUNY. (c) Security of Documents in Prime Vendor’s Control. Prime Vendor shall ensure the security of all project materials under Prime Vendor’s control, including as requested by CUNY. 1.8 Project Management, Performance and Other Tools, Utilities, Etc. Prime Vendor grants to CUNY a royalty-free, perpetual license to all Prime Vendor (or its Affiliate’s)owned utilities and tools used by Prime Vendor to provide Services, and, to the extent such licenses are sub-licensable by Prime Vendor to CUNY, a license to Third Party-owned utilities and tools used by Prime Vendor to provide Services, including all tools and utilities used by Prime Vendor to provide project management, implementation, performance monitoring, testing, managing and operational and other support of CUNY's systems which are hosted by Prime Vendor (collectively, "Prime Vendor Tools and Utilities"), which Prime Vendor Tools and Utilities shall be set forth in a Project Agreement or Contract Supplement. If Prime Vendor has omitted any tools and utilities described above, such tools and utilities shall nonetheless be Prime Vendor Tools and Utilities, the parties promptly shall update the Project Agreement or other appropriate documentation to reflect such omitted tools and utilities, and Prime Vendor shall provide such tools and utilities to CUNY in accordance with the above terms. If there are tools and utilities introduced in the future by Prime Vendor, then such tools and utilities shall be -56CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Prime Vendor Tools and Utilities and Prime Vendor shall make such tools and utilities available to CUNY in accordance with and subject to the terms set forth in this Section. During the pendency of a project, Prime Vendor shall provide training and education on the use of, and Knowledge transfer with respect to the Prime Vendor Tools and Utilities. For so long as the Agreement is not terminated and Prime Vendor is providing Hosting Services to CUNY, Prime Vendor shall provide updated versions and/or all new Prime Vendor Tools and Utilities as such updated versions are available, all at no additional cost to CUNY. 1.9 Contract Compliance Meeting. Prime Vendor and CUNY shall meet approximately monthly to discuss the parties’ compliance with the Agreement and any pending Project Agreements and resolve any compliance Issues. 1.10 Cooperation; Coordination with Other CUNY Contractors. CUNY may involve Third Parties in the implementation of a project to assist CUNY in the discharge of its responsibilities or otherwise perform activities and tasks not otherwise assigned to Prime Vendor. Notwithstanding any such Third Party involvement, Prime Vendor shall: (a) Take the lead to facilitate communications with and work constructively and cooperatively with CUNY's Third Parties involved in a project; (b) Notify CUNY in writing in a Project Status Report if any Third Party’s performance (or failure to perform) has or may impact the project; and (c) Work with the CUNY Project Director(s) to facilitate resolution of any Issues which develop relating to such Third Parties. 2.

Implementation Services.

2.1 Statements of Work, Project Plans and Joint Resource Plans. Each Project Agreement or Contract Supplement that involves Prime Vendor’s provision of implementation, development and/or other Services shall include the following documents, as further described below: A statement of work ("Statement of Work"), an integrated project plan ("Project Plan") and joint resource plan ("Joint Resource Plan"), each of which shall be initially created jointly by the parties through an implementation planning study or other mutually agreed process and attached to the applicable Project Agreement or Contract Supplement. Thereafter, the Project Plan and Joint Resource Plan shall be updated and maintained by Prime Vendor in accordance with the requirements in this Section and pursuant to applicable quality standards, and each updated Project Plan and Joint Resource Plan shall be subject to written approval by CUNY. Additionally, changes to the Project Plan must be made in accordance with CUNY's change control process. Changes to the Statement of Work shall occur through an amendment to the applicable Project Agreement or Contract Supplement. (a)

Statement of Work. The Statement of Work shall include, as applicable: (i)

(ii) the parties;

A general description of the project; A complete description of the scope and responsibilities of each of

-57CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(iii) A complete description of any assumptions applicable to the scope of Services; any assumptions not identified cannot be later claimed by Prime Vendor as an assumption in the project; (iv) The Critical Milestones and entrance and exit (completion) criteria for determining whether a Critical Milestone has been successfully completed; (v) Descriptions of Deliverables, including dependent Deliverables, in such detail as requested by CUNY; (vi)

Payment milestones; and

(vii)

Other mutually agreed terms.

(b) Project Plan. The Project Plan shall be integrated, meaning that the plan must cover all aspects of the project and include all Prime Vendor and CUNY (or its Third Party)-only activities and tasks. The project tool used to develop the Project Plan will be agreed to by the parties prior to project initiation, and shall include, as applicable: (i)

Commencement and completion dates for the project;

(ii) All Critical Milestone and Deliverable events and Deliverable Due Dates and Critical Milestone Due Dates (with such Critical Milestones being identified by a different color and with the phrase "Critical Milestone" in the Project Plan document so that users can search on such term); (iii) All other milestones, activities, tasks and subtasks, along with their dependencies; (iv) For each grouping or subgrouping of Application components, identify the activities that are related to other groupings or subgrouping of Application components, including any activities that affect another grouping or subgrouping, e.g., design activities of one grouping of Application components may need to be designed considering the implementation of another grouping or subgrouping, etc.; (v) Sufficient description of all activities, tasks and subtasks (including CUNY-only responsibilities) to be performed by Prime Vendor, CUNY or Third Party responsible for, and the location of, such activities, tasks and subtasks; and (vi) The dates, duration and locations of Project Status Meetings and contract compliance meetings. The initial Project Plan for a particular Project Agreement or Contract Supplement may be preliminary at the time such Project Agreement or Contract Supplement is developed, and accordingly, a more detailed Project Plan may need to be developed by the parties as the project proceeds. Any such final Project Plan shall be subject to the terms of Schedule 2.3.

-58CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

The status of any discussion regarding the change to a Deliverable Due Date or Critical Milestone Due Date shall be reflected in the next succeeding Project Status Report. (c) Joint Resource Plan. The Joint Resource Plan shall identify the role, amount and timing of CUNY and Prime Vendor (including approved subcontractors) personnel assigned to a project. Prime Vendor shall track and report to CUNY personnel utilization and the variance between actual personnel utilization and the Joint Resource Plan. Prime Vendor shall manage and update the Joint Resource Plan as changes are made to such plan, and any updates to the plan must be submitted with the Project Status Report. Prime Vendor shall not reduce any non-Key Personnel resources set forth in the plan without CUNY's prior written consent, it being acknowledged by Prime Vendor that a reduction in personnel may jeopardize Prime Vendor's ability to meet Due Dates and/or the quality standards for the project, unless Prime Vendor can demonstrate, to CUNY's sole satisfaction, that such impacts will not occur. Nothing contained herein shall prohibit Prime Vendor from supplementing its personnel at any time. The updates to the Joint Resource Plan shall set forth any agreed to reductions in personnel, any vacancies in personnel positions along with Prime Vendor's plan to fill such vacancies, any supplemental personnel being added by Prime Vendor, whether such personnel have been previously assigned or planned to be assigned. 2.2 Addressing Inadequate Personnel Planning or Availability of Personnel. Inadequate personnel planning and/or availability of personnel can have a significant negative impact on the ability to meet Deliverable Due Dates and Critical Milestone Due Dates. Inadequate personnel planning can result from, among other things, Prime Vendor not accurately representing the types or number of personnel needed by CUNY to complete its tasks and activities, CUNY not hiring or having its personnel available when needed, and delays on the part of Prime Vendor that has the effect of requiring CUNY to attempt to accomplish too many tasks in a compressed timeframe (e.g., in order to meet a Critical Milestone). If the lack of personnel needed to complete the tasks and activities for a given Critical Milestone is based on or linked to Prime Vendor delays such as not completing prior activities when required, providing Deliverables late or other delays, then Prime Vendor shall identify such Issue in a Project Status Report and work with CUNY to determine whether: (a) CUNY personnel can be effectively reallocated in a manner that will not jeopardize the ability to meet other timeframes or obligations in the project (current or future); (b) timeframes for any particular task or activity, such as completing prelive testing, can be accelerated; (c) if time frames can be accelerated, whether it is prudent or consistent with industry practices to do so (if it is not prudent or consistent with industry practices, then CUNY shall be under no obligation to agree to any such acceleration); or (d) there is any other impact on the project. If it is determined that Prime Vendor was the cause of the delay (based on any of the above reasons or otherwise), then Prime Vendor shall be responsible for the additional costs and expenses involved in either hiring additional CUNY personnel, providing additional Prime Vendor personnel to accelerate performance, or both. If the reason for the need for additional CUNY personnel is attributable to CUNY, then CUNY shall be responsible for such additional costs and expenses, and if the solution is additional Prime Vendor personnel, CUNY shall only be obligated to the extent a Change Order is signed by CUNY. 2.3 Implementation Delays. A Critical Milestone will be achieved successfully when CUNY verifies in writing that the activities, events and/or Deliverables that comprise such Critical Milestone have met all applicable acceptance criteria and CUNY has signed the applicable Deliverables Certification Form. Subject to the further terms of this Section, if CUNY reasonably deter-59CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

mines that Prime Vendor is likely to fail to meet a Critical Milestone Due Date or a Deliverable Due Date, or if Prime Vendor already has failed to meet a Critical Milestone Due Date or Deliverable Due Date, then: (a) Additional Personnel. At CUNY's option, Prime Vendor shall provide to CUNY, at no additional cost, additional Prime Vendor personnel required or necessary to timely achieve the Deliverable Due Date and/or Critical Milestone Due Date, or, if Prime Vendor has already failed to meet one (1) or more Deliverable Due Dates and/or Critical Milestone Due Dates, complete the Critical Milestone(s) or Deliverable(s) as soon as practicable, provided that any adjustment of a Critical Milestone Due Date shall not operate to adjust any future Critical Milestone Due Date unless specifically agreed to in writing by CUNY; and (b) Delay Credits and Earn Back Rights. CUNY shall be entitled to receive credits in the amounts and pursuant to the terms and conditions set forth in the applicable Project Agreement or Contract Supplement for each day that Prime Vendor fails to timely achieve a Critical Milestone Due Date on the original missed Critical Milestone Due Date ("Delay Credits"). The parties agree that the Delay Credits represent a lower net Services fee to Prime Vendor for not completing the implementation on time, and is not to be construed as a penalty or an exclusive remedy. If a Critical Milestone Due Date is reset pursuant to a mutually agreed Change Order, such reset Due Date shall not operate or be construed to automatically waive any Delay Credits unless CUNY specifically agrees in writing in connection with such reset Due Date that CUNY waives the applicable Delay Credits. Prime Vendor shall have the ability to earn back the Delay Credits associated with a Critical Milestone if the next succeeding Critical Milestone Due Date (on an unadjusted basis) is met. Delay Credits associated with Cutover and Project Completion cannot be earned back by Prime Vendor. CUNY's acceptance of additional personnel or Delay Credits as provided in Sections 2.2 or 2.3 shall not be construed or implied to limit or constitute a waiver of any of CUNY's rights as provided in Article 5. Prime Vendor shall not be obligated to provide additional personnel at no additional cost or to provide Delay Credits to CUNY to the extent Prime Vendor’s failure to achieve any Critical Milestone is caused by CUNY or its Third Party’s delays or a Force Majeure Event that was not capable of being mitigated. To the extent set forth in a Project Agreement, the parties may agree to economic incentives for completing Critical Milestones prior to the applicable Critical Milestone Due Date. 2.4 Quality Standards. In order to reduce the risk of project failure, Prime Vendor must provide quality personnel and produce quality, on-time Deliverables. In order to ensure quality, Prime Vendor agrees to propose only quality personnel for projects, and provide quality Deliverables in accordance with any additional quality standards that may be set forth in a Project Agreement or Contract Supplement. As part of meeting quality standards, Prime Vendor further agrees to the following project quality reviews: 2.4.1

Project Quality Reviews.

Prime Vendor, through a separate, independent, internal audit group within Prime Vendor's organization, shall conduct a quarterly internal project review -60CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

for each CUNY project, which shall, at a minimum, measure and assess Prime Vendor's performance generally and against the quality standards set forth in the Project Agreement or Contract Supplement. Without limiting the foregoing, quality shall be assessed on the timeliness of the delivery of Prime Vendor’s project management, implementation, the personnel Prime Vendor has assigned to the activities and tasks and their on-time delivery of such Services. Prime Vendor shall provide CUNY with a full and complete copy of such review (i.e., not a summary) within five (5) business days after the end of each such calendar quarter. If there are areas of improvement or deficiencies cited in an audit, within fifteen (15) business days following each such calendar quarter, Prime Vendor shall develop and implement an action plan acceptable to CUNY to address such items.

-61CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 2.2 CHANGE ORDER PROCEDURES 1.

Change Order Procedures.

1.1 General. Strict project management control processes and the documentation of changes to a Project Agreement or Contract Supplement and similar implementation items are all important components of project management discipline. Accordingly, with respect to any changes that will result in an out-of-scope activity, a change to a Deliverable Due Date or Critical Milestone Due Date, or a reduction in the scope of activities, a Change Order will be required pursuant to this Section and any additional change control processes as may be mutually agreed to by the parties. For purposes of the Agreement, an out-of-scope activity is an activity that is not identified or contemplated in the applicable Statement of Work or Project Plan, or otherwise addressed as part of the work to be performed in connection with a Project Agreement or Contract Supplement. Prime Vendor acknowledges that a reduction in the scope of work will result in a credit to be provided to CUNY in an amount equal to the amount of reduced work effort, and that such credit may be held and retained by CUNY for future out-of-scope Change Orders or as a set off as provided for in the Agreement. 1.2 Change Orders. Change Orders shall be initiated by a change request ("Change Request") and can be initiated by either party. CUNY and Prime Vendor shall each bear their own costs in preparing and analyzing the Change Request and Change Response. The form of the Change Request is attached as Attachment A to Schedule 2.2. (a) CUNY-Generated Change Requests. Within three (3) business days following receipt of any CUNY Change Request, Prime Vendor shall acknowledge that it has received the Change Request and that the appropriate Prime Vendor representative(s) are working on a response. Within ten (10) business days for a Change Request involving a request by CUNY to change one (1) or more Deliverable Due Dates or Critical Milestone Due Dates and within seven (7) business days for all other Change Requests, following Prime Vendor’s receipt of such CUNY Change Request, Prime Vendor shall update the Change Request form to include its response ("Change Response") describing in detail: (i) Any additional Services to be performed required as a result of the Change Request and/or Services that are no longer required as a result of the Change Request; (ii) The effect, if any, that any such additional or deleted Services shall have on the Statement of Work and/or Project Plan; (iii) The cost or savings associated with such additional or deleted Services; and (iv) Any other information relating to the Change Request that may reasonably be requested by CUNY. -62CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

If CUNY accepts a Change Response, the parties shall finalize the Change Response form and once signed shall constitute a "Change Order." If CUNY rejects such Change Response, Prime Vendor shall proceed to fulfill its obligations as originally agreed under the Agreement and the applicable Project Agreement or Contract Supplement. Compliance with the timeframes set forth herein are important to ensure that Issues that need to be solved with a Change Order are processed on a timely basis. Accordingly, if Prime Vendor repeatedly fails to abide by the timeframes, or fails to process any Change Requests relating to Critical Milestone or Deliverable Due Dates in a manner that will or may cause significant delays, then CUNY shall be entitled to withhold fifty percent (50%) of all payments due or that may become due to Prime Vendor until Prime Vendor complies with the timeframes required herein, or, if no fees are due or will become due, then CUNY shall be entitled to a credit equal to One Thousand Dollars ($1,000) per day (which credit Prime Vendor shall, at CUNY's option, either pay directly to CUNY or accrue and set-off against future amounts that will be payable), until Prime Vendor complies with the timeframes required herein. (b) Prime Vendor-Generated Change Requests. For Prime Vendorgenerated Change Requests, CUNY shall review and evaluate such request and provide feedback to Prime Vendor during the Project Status Meetings. To the extent such Change Request identifies an out-of-scope Service, additional value-added Services or other similar items, CUNY shall not be obligated to provide a written response to such request. 1.3 Special Provisions Relating to Change Orders for Changes to Deliverable Due Dates and Critical Milestone Due Dates. Deliverable Due Dates and Critical Milestone Due Dates shall not be changed at any time prior to Project Completion under the applicable Project Agreement or Contract Supplement without the prior written consent of CUNY and pursuant to a Change Order. (a) Prime Vendor-Proposed Changes. If Prime Vendor proposes a change in a Deliverable Due Date or Critical Milestone Due Date, it shall submit a Change Request along with a detailed explanation of the basis for the Change Request, an updated Project Plan reflecting all adjusted dates, including the adjusted Deliverable Due Date and/or Critical Milestone Due Date and, if there is an impact on the scope of Services, a revised Statement of Work (or portion thereof), highlighting the proposed text change and, if there is a proposed change in the fee, an updated fee and payment schedule. If the Change Request is due to a delay on the part of CUNY, any Third Party or a Force Majeure Event, Prime Vendor shall: (a) for a Force Majeure Event, identify the Force Majeure Event and explain what steps or measures Prime Vendor took to mitigate the effect of the Force Majeure Event; (b) for a delay on the part of CUNY or any of its Third Parties, specify in detail the failure or inaction by CUNY or its Third Party, provided, however, if the reason there is a CUNY or Third Party delay is that predecessor responsibilities of Prime Vendor were not performed which resulted, in whole or in part, in the CUNY or Third Party delay, Prime Vendor shall not be entitled to claim a delay on the part of CUNY or the Third Party. A Change Request is not complete, nor shall CUNY be required to review a Change Request without the foregoing revised documents. In addition, any delay by Prime Vendor which results in a disruption to the allocation of person-63CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

nel to be provided by CUNY shall not be a basis for Prime Vendor to claim delays on the part of CUNY, and any such disruption to CUNY personnel shall be identified in the Project Status Report. If the CUNY Project Director disagrees that such Change Request is warranted, the matter shall be escalated to the Prime Vendor Account Executive and the CUNY Project Director, and then to the Executive Sponsors if needed, for resolution. (b) CUNY-Proposed Changes. If CUNY proposes a change in a Deliverable Due Date or Critical Milestone Due Date, the parties shall meet to discuss the proposed date changes and Prime Vendor shall prepare a Change Request along with the items referenced in subsection (a). 1.4 Administration of Change Orders. The Prime Vendor Project Manager and the CUNY Project Director shall be authorized to administer the Change Order process set forth in this Section; provided that all proposed Change Orders must be approved in writing by the CUNY Chief Information Officer, or his or her designee, in order to be effective against CUNY and must be signed by an authorized employee of Prime Vendor, in order to be effective against Prime Vendor.

-64CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ATTACHMENT A TO SCHEDULE 2.2 CHANGE ORDER FORM Step 1: Change Request Description

Title:

Change Order #:

Submitted By:

Phone # (Extension):

Date:

Describe the Nature of the Requested Change:

In-Scope vs. Out-of-Scope Is this change within the Project Scope? Yes ___ No ___ If Yes, explain basis for determination:

Step 2: Initiation Approval Written Response by Prime Vendor – Expected Date: CUNY Signature: _______________________________________

Date: _________

Step 3: Scope of Work, Impact Analysis and Cost Part I. Scope – Describe the Work to be Performed by Prime Vendor (Attach Functional Specifications, As Applicable) Describe the work to be performed by Prime Vendor:

-65CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Part II. Impact Analysis A. Impact on Critical Milestone Due Dates or Deliverable Due Dates? Yes __ No __

Comments/Explanation: ______________________________ ______________________________ B. Impact on Other Milestone/Key Dates or Deliverables? Yes __ No __ Comments/Explanation: _______________________________ _______________________________ C. Impact on CUNY's Resources? Yes __ No __ Comments/Explanation: _____________________________ _____________________________ D. Update to Project Agreement or Contract Supplements: If there are new or revised specifications applicable to this Change Order, or you answered "yes" to any of the above items, you will need to update and attach to this Change Order one (1) or more of the following documents (check which ones are applicable).  Statement of Work  Project Plan  Joint Resource Plan  Payment Schedule  CUNY Requirements (New and Revised)  Other (Please Specify)

________________________

-66CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Part III. Fees and Payment Terms

A. Fixed Fee Quote: $ Specify payments terms: ______________________________________________________ B. Time and Materials – If a Fixed Fee quote is not reasonably possible, check here ____ C. Not-to-Exceed Quote: $________ D. No Charges Applicable to this Change Order – Prime Vendor to Initial Here ______ Part IV. Prime Vendor Signature Submitted by: Prime Vendor By:

Date: Authorized Signature

Print Name: Part V. Approval of Change Order by CUNY Selection of Fee Arrangement: (Check Appropriate Box)  Fixed Fee  Time and Materials  No Charge Change Order (Work is Considered Within Scope) Agreed To: The City University of New York By:

Date: Authorized Signature

Print Name:

-67CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

_____________

SCHEDULE 2.3 CERTIFICATION PROCESS FOR DELIVERABLES; OWNERSHIP 1. General. As part of a Project Agreement, Contract Supplement, Change Order or other applicable document or request, Prime Vendor may prepare and/or provide Deliverable(s) for CUNY. 2. Review and Certification of Deliverables. Each Deliverable shall be in a form, format, and in such detail as is necessary to: (a) in the case of Deliverables in respect of which specifications have been developed, cause it to conform to such specifications; or (b) in the case of Deliverables in respect of which specifications have not been developed, considering the purpose of the Deliverable, cause it to be reasonably acceptable to CUNY; and (c) and be of fit quality, including meeting any quality standards as may be set forth in a Project Agreement or Contract Supplement (the applicable acceptance criteria for a Deliverable under the foregoing subsections shall constitute the "Certification Criteria" for the purposes of this Section). Prior to delivery to CUNY, Prime Vendor shall perform a systematic review of each Deliverable and shall, at the time of delivery to CUNY, confirm in writing that the Deliverable conforms to the Certification Criteria. Following receipt of the applicable Deliverable and within the review period that is applicable to the Deliverable (or if none is specified, then within a reasonable period of time) (the "Review Period"), CUNY shall review the Deliverable. If the Deliverable does not conform to its Certification Criteria, CUNY promptly will notify Prime Vendor of the deficiencies, but no later than within the Review Period, and Prime Vendor promptly will modify the Deliverable and resubmit it to CUNY for its review. The process described above will repeat until the Deliverable conforms to its Certification Criteria, and once this condition is met the Deliverable will be certified by CUNY. To the extent the failure of the Deliverable to conform to the Certification Criteria was caused by Prime Vendor, Prime Vendor shall perform its obligations relating thereto without additional cost or expense to CUNY. The parties acknowledge that certain Deliverables, such as design and configuration documents, will be subject to further activities, such as unit, systems and integration and user acceptance testing. If, upon testing or other confirmation process, a Deliverable that was previously certified does not meet the intended functionality due to a Prime Vendor error or design flaw, then the corrections required will be provided by Prime Vendor at no cost to CUNY. If the previously certified Deliverable does not meet the intended functionality due to a change in CUNY's requirements or a CUNY error in communicating its requirements, then any correction shall be subject to a charge pursuant to a Change Order. Any extensions of time permitted by CUNY where the Certification Criteria are not met does not waive any rights or remedies CUNY has with respect to an Event of Default for failure of Prime Vendor to meet a Critical Milestone Due Date. If there is substantial but not complete conformance to the Certification Criteria and Prime Vendor wants CUNY to partially certify the Deliverable, Prime Vendor shall make a request for partial certification and accompanying such request shall be a plan to complete the Deliverable and the timeframe therefor. CUNY will evaluate any such request but shall not be required to agree to partial certification. If CUNY agrees to a partial certification, the Certification Form to be signed shall specify that the Deliverable is being partially certified, and the form must have attached an agreed to "Compliance Plan" on how the remaining components of the Deliverable will be completed. If there is partial certification, CUNY may agree, but shall not be required as -68CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

a condition thereof, to make a partial payment against such certification, and any such partial payment shall require an amendment to the payment terms under a Project Agreement or Contract Supplement to be effective against CUNY. 3. Certification Form. Upon accepting (or partial certification as provided above) any Deliverable submitted by Prime Vendor, CUNY shall provide Prime Vendor with written acceptance of such Deliverable by the signing of the Certification Form set forth in Attachment A to Schedule 2.3 by the CUNY Project Director, or his or her designee, and for Deliverables that create a payment obligation, the additional signature of the CUNY Chief Information Officer shall be required. No other form of certification, such as email communications, oral information or otherwise, shall be effective for purposes of certification, payment or otherwise, and shall not be effective against CUNY. 4. Ownership of Deliverables. Subject to Prime Vendor's rights under Section 5, CUNY shall be and remain the sole and exclusive owner of any Deliverables, such as designs, configurations, interfaces, extensions and other software, test scripts, test data bases, workflow diagrams and schematics and reports developed by Prime Vendor for or on behalf of CUNY. Ownership shall inure to the benefit of CUNY from the date of the conception, creation or fixation of the Deliverable in a tangible medium of expression, as applicable, and all newly created copyright aspects of such Deliverables shall be considered "works-made-for-hire" within the meaning of the Copyright Act of 1976, as amended. If and to the extent such Deliverables, or any part thereof, are not considered "works-made-for-hire" within the meaning of the Copyright Act of 1976, as amended, Prime Vendor shall be deemed to have expressly assigned to CUNY all exclusive right, title and interest in and to such Deliverables without further consideration, and Prime Vendor agrees to promptly execute all such documents as may be requested by CUNY to evidence and/or perfect CUNY's Intellectual Property Rights therein. 5. Pre-Existing and Independently Developed Intellectual Property. Each party (and/or its Third Party licensors) is and shall remain the owner of all right, title and interest in and to that party’s Intellectual Property Rights that existed prior to the Effective Date and in and to that party’s Intellectual Property Rights that may be independently developed by such party on or after the Effective Date.

-69CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

ATTACHMENT A TO SCHEDULE 2.3 CERTIFICATION FORM CERTIFICATION OF DELIVERABLES AND CRITICAL MILESTONES Deliverable Name:

______________________: Deliverable Number: _____________

Critical Milestone Name: ______________: Critical Milestone Number: ____________ Check One: CUNY certifies that the Certification Criteria for the above referenced Deliverable or Critical Milestone have been fully met. CUNY certifies that the Certification Criteria for the above referenced Deliverable or Critical Milestone have been partially met as follows, and the balance of the Certification Criteria shall be met according to the Compliance Plan, a copy of which is attached to this Certification Form. Certification Criteria Met: _____________________________ _____________________________ _____________________________ Certification Criteria Not Met: __________________________ (Must Attach an Agreed to Compliance Plan) To be effective against CUNY, this form must be signed by the CUNY Project Director (or his or her designee as communicated in writing by CUNY to Prime Vendor). For Critical Milestones or Deliverables that result in a CUNY payment obligation, the Certification Form must also be signed by the CUNY Chief Information Officer to be effective against CUNY.

Print Name: _________________, CUNY Project Director

Print Name: _________________, CUNY Chief Information Officer (Required for Critical Milestones and Deliverables that require payment)

-70CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 2.4 PERSONNEL 1. CUNY Personnel. As required by the size or complexity of a project, CUNY will appoint a Project Director ("CUNY Project Director") who shall be responsible for a project, and one or more Project Managers ("CUNY Project Manager(s)") who will be responsible for coordinating CUNY's resources and personnel and have overall responsibility for ensuring CUNY's performance of its responsibilities under the Migration Project Agreement. The CUNY Project Director and/or CUNY Project Manager may designate other CUNY personnel or agents as their designees, provided that any such designation to be effective as against CUNY must be communicated in writing to Prime Vendor. 2. Prime Vendor Personnel. Prime Vendor shall provide sufficient, qualified personnel to perform Prime Vendor’s obligations, including: (a) if necessary for the project given its size and/or complexity, a Project Director; (b) one or more Prime Vendor Project Managers; and (c) such other key personnel as may be designated in the applicable Project Agreement or Contract Supplement (collectively referred to as the "Key Personnel"). All Key Personnel shall be available at locations specified in the applicable Project Plan and as otherwise reasonably requested by CUNY. At CUNY's request, Prime Vendor shall provide CUNY with a list of Prime Vendor personnel, which list shall include professional qualifications for each person listed, specifying the persons qualified to be the Key Personnel. CUNY shall have the opportunity to conduct telephone or in-person interviews of such Key Personnel candidates at no cost to CUNY. CUNY shall have the right to approve, in its sole discretion, all Key Personnel and other Prime Vendor personnel assigned to a project. If CUNY does not provide such approval, then Prime Vendor shall not assign such personnel to provide Services to CUNY, whether on-site or off-site. 3. Experience of Prime Vendor Personnel. Key Personnel and other personnel assigned by Prime Vendor to provide Services to CUNY (other than administrative personnel) shall have the qualifications listed below. If Prime Vendor wants to assign personnel to CUNY's account that do not meet all of the following qualifications, such assignment shall require the prior written approval of CUNY, which approval may be withheld in CUNY's sole discretion. If CUNY does not provide its prior written approval of such personnel, then Prime Vendor shall not assign such personnel to provide Services to CUNY, whether on-site or off-site. Qualifications of Prime Vendor personnel shall include: (a) With respect to the services provided under each Project Agreement or Contract Supplement, at least five (5) years' experience in project management for project directors and managers (certification as a project management professional (PMP) is preferred), three (3) years' experience in project management for mid-level project personnel, and twelve (12) months of relevant experience for basic project personnel; (b) Specific experience with other customers in the Prime Vendor Implementation Methodologies to be used in the project; (c) Substantial experience in the university and higher education environment to the tasks assigned such personnel;

-71CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(d) Participation in on-time, on-budget, successful projects of similar size and scale in the same role and with the same responsibilities as such personnel has under the applicable Project Agreement or Contract Supplement; (e) If applicable, certification in the technologies used in the project, including the specific release or version levels of software, to successfully complete the Services under the applicable Project Agreement or Contract Supplement; (f) At least one (1) reference from a recent project of a similar size and scale stating that such personnel consistently met expectations and fulfilled their role and responsibilities effectively; and (g) Eighteen (18) months experience working with the component of the Service in which such personnel is providing Services. 4. Removal of Prime Vendor Personnel by CUNY. If CUNY has concerns over Key Personnel or other Prime Vendor personnel assigned to a project and CUNY believes that the problem is capable of being corrected, CUNY shall bring such concerns to the attention of Prime Vendor. Prime Vendor shall have a period of seven (7) days following such disclosure to resolve any problems with respect to such person in a manner that is satisfactory to CUNY. If Prime Vendor is unable to resolve the problem within such seven (7) day period to CUNY's satisfaction, then Prime Vendor shall remove such person and provide a replacement as soon as reasonably possible thereafter (not to exceed fourteen (14) days following the seven (7)-day correction period), taking into consideration such person’s duties and responsibilities. Nothing contained in this Section shall restrict CUNY from immediately removing Prime Vendor’s personnel if Prime Vendor’s personnel is engaging in a manner that is unlawful, non-compliant with CUNY Policies, or other exigent circumstances exist that require immediate removal. 5. Removal/Reassignment by Prime Vendor. Except upon CUNY's prior written consent, which consent may be withheld in CUNY's sole discretion, Prime Vendor shall not remove (other than upon termination of employment or a reason outside of Prime Vendor's control) from a CUNY project or temporarily reassign any Prime Vendor personnel to another account until such time as such personnel have completed all of their assigned responsibilities under the Project Agreement or Contract Supplement. 6. Transition. If Prime Vendor removes any Prime Vendor personnel from CUNY's account for any reason (including if such Prime Vendor personnel leaves the employment of Prime Vendor or if Prime Vendor terminates such personnel's employment), if such Prime Vendor personnel is removed as provided in Section 4, or if Prime Vendor wants to replace or reassign any personnel, and either CUNY consents to such replacement or reassignment, or CUNY's consent to such replacement or reassignment is not required as provided in Section 5), then: (a) Promptly (but in no event more than two (2) business days) following the date that Prime Vendor knows any Prime Vendor personnel will cease to be assigned to CUNY's account to provide Services, Prime Vendor shall provide written notice to CUNY of the name and role of such Prime Vendor personnel and the date that such Prime Vendor personnel will cease to be assigned to CUNY's account and a transition plan in accordance with this Section describing the transition of replacement personnel to replace the replaced personnel;

-72CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(b) The terms of Section 2 with respect to CUNY's right to select replacement personnel shall apply; (c)

The terms of Section 3 shall apply;

(d) The proposed replacement personnel shall possess comparable experience and training as the Prime Vendor personnel to be replaced; and (e) Prime Vendor shall fill the Vacancy within five (5) days for non-Key Personnel and within eight (8) days for Key Personnel. To the extent the replaced personnel remains employed by Prime Vendor, the replacement personnel shall work with the replaced personnel during a mutually agreed transition period, the duration of which shall be determined based on the duties and responsibilities of the person actually to be replaced, and all costs and expenses associated with educating and training the replacement personnel shall be borne by Prime Vendor. Additionally, following the transition period, the replaced personnel shall continue to be available by telephone to answer any projectrelated questions. 7. Key Personnel Vacancies. If there is a Vacancy in a Key Personnel position beyond the timeframe set forth in Section 6, CUNY shall have the right to withhold any amounts due to Prime Vendor under the Agreement until Prime Vendor provides a qualified replacement, or if no fees are then due or will become due, then CUNY shall be entitled to a credit in the amount of One Thousand Dollars ($1,000) per day, which credit Prime Vendor shall, at CUNY 's option, either pay directly to CUNY or accrue and set-off against future amounts that will be payable. In addition, a Vacancy in a Key Personnel position shall not be a basis for Prime Vendor to claim any excused failure to meet a Deliverable Due Date and/or Critical Milestone Due Date. 8. Prime Vendor Personnel Listing. Upon the commencement of any Project Agreement or Contract Supplement, Prime Vendor shall provide CUNY with a comprehensive written listing of all Prime Vendor personnel providing Services (including employees, subcontractors, agents and management and upper management personnel in oversight roles) under such Project Agreement or Contract Supplement which shall include: (a)

An organizational chart and hierarchy diagram;

(b)

Names of all such personnel;

(c)

Titles of all such personnel;

(d)

The roles and responsibilities of all such personnel;

(e) Contact information for all such personnel (e.g., address, e-mail, cell phone number, office phone number, etc.); (f)

Work location for all such personnel;

(g) Duration of assignment of such personnel (e.g., from and to dates, from and to milestones); and

-73CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

(h) Percentage of allocation of all personnel (in the event that any Prime Vendor personnel are not full-time on CUNY's account). Prime Vendor shall maintain and update this listing as the information and/or personnel change during the course of an applicable Project Agreement or Contract Supplement. 9. Background Checks. For any personnel providing Services and/or having access to CUNY Data or the ERP System, Prime Vendor shall have conducted, and such personnel shall have passed, a background check, which will include verification of the right to work in the United States and state and national criminal background checks for prior felony convictions. If there are any events or circumstances with an individual providing Services to CUNY or having access to CUNY Data and/or the ERP System that would disqualify such person from passing Prime Vendor’s background check procedures, then Prime Vendor shall alert CUNY of such fact and remove such individual from CUNY's account and/or accessing or otherwise interacting with CUNY Data or the ERP System. CUNY reserves the right to require Prime Vendor to augment its background check and screening procedures. 10. Identification Credentials. Each party shall have the right to require the other party’s employees, agents, representatives and subcontractors to exhibit identification credentials issued by such party in order to access the other party’s facilities. 11. Facility Rules. All Prime Vendor employees, agents, representatives and subcontractors shall, while on CUNY's premises, comply with all CUNY Policies, copies of which shall be made available to Prime Vendor upon request. Prime Vendor shall ensure that any of its personnel performing work on CUNY's premises, or accessing CUNY's computer systems do so with CUNY's advance permission and according to all applicable security and workplace-related CUNY Policies, including the Security Policies and Procedures. Prime Vendor shall not stop, delay or interfere with CUNY's day-to-day operations without the prior written consent of an authorized CUNY representative(s). 12. Damage to Buildings, Grounds or Other Furnishings. Prime Vendor shall be responsible for any damage or injury to the buildings, grounds, physical property or other furnishings of CUNY by Prime Vendor’s employees, representatives and/or agents. Prime Vendor shall report the occurrence of any such damages or injuries to the CUNY building/facilities manager. 13. Collocation. Prime Vendor personnel, including permitted subcontractors, will co-locate with CUNY personnel, and any CUNY subcontractors, in CUNY facilities as available, as required by CUNY and as set forth in a Project Agreement or Contract Supplement and, as reasonably determined by CUNY after consultation with Prime Vendor, such personnel will be provided a desk, storage cabinet, and connection to the Internet. To the extent Prime Vendor personnel use their own equipment (e.g., laptops, PDAs, etc.) such equipment shall be subject to and require compliance with CUNY Policies, including the Security Policies and Procedures.

-74CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 3.2.2 SERVICE RATE(S) [THIS SCHEDULE IS TO BE COMPLETED PRIOR TO CONTRACT SIGNING.]

-75CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

SCHEDULE 10.3.1 INSURANCE COVERAGES

Type of Insurance Coverage

Minimum Policy Limits Per Annual Aggregate Occurrence/Claim

Workers Compensation

Employer's Liability

Per state Law requirements

 Each Accident: $1,000,000  Disease, Each Employee: $1,000,000  Disease, Policy Limit: $1,000,000

Commercial General Liability Business Automobile Liability

Per state Law requirements

The policy shall be written to meet the statutory requirements for the state in which the work is to be performed, including occupational disease. The policy must include a waiver of subrogation in favor of CUNY. The policy shall cover all Prime Vendor's employees.

$10,000,000

$5,000,000

$10,000,000

$1,000,000

$10,000,000

Professional Liability/Errors & Omissions and Internet Policies

$25,000,000

$50,000,000

ID Theft and Cyber Extortion

$100,000,000

$100,000,000

Umbrella or Excess Liability

$100,000,000

$100,000,000

-76CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

Additional Requirements

The policy must include a waiver of subrogation in favor of CUNY. The policy must include a waiver of subrogation in favor of CUNY. Must include coverage for Internet professional services, ASP, web portal, security/privacy. The policy must include a waiver of subrogation in favor of CUNY. Must include coverage for credit/privacy monitoring for two years, crisis management and public relations expense. The policy must include a waiver of subrogation in favor of CUNY. .

SCHEDULE 10.14 CUNY POLICIES

CUNY Policy Title Acceptable Use of Computer Resources Revised Information Technology Security Procedures IT Security Procedures – Data Center Security & Environment Supports Guidelines for the Implementation of the Student Records Access Policy and the Federal Family Educational Rights and Privacy Act (FERPA) Gramm-Leach-Bliley Information Security Program Identity Theft Prevention Program Records Retention and Disposition Schedule University Policy on Purchasing from Minority-Owned and Women-Owned Businesses Domestic Violence and the Workplace* Policy on Drugs and Alcohol* Policies and Procedures on Equal Opportunity, NonDiscrimination, and against Sexual Harassment* Policies and Procedures Concerning Sexual Assault, Stalking and Domestic and Intimate Partner Violence Against Students* ` *These policies are applicable to any Prime Vendor personnel providing Services on CUNY’s premises.

-77CUNY HOSTING RFP - ATTACHMENT A Master Services Agreement

EXHIBIT 1 MIGRATION PROJECT AGREEMENT Migration Project Agreement Date: _______, 2014 This Migration Project Agreement, including all Schedules and Attachments referenced herein (collectively, the " Migration Project Agreement"), is a Project Agreement to that certain Master Services Agreement, by and between CUNY and Prime Vendor, dated _______, 2014 (the "Agreement" or "MSA"). Capitalized terms used herein shall have the meanings ascribed to them in the Migration Project Agreement or, if not defined herein, such terms shall have the meanings ascribed to them in the Agreement. IN WITNESS WHEREOF, authorized representatives of the parties have executed this Migration Project Agreement effective as of the date written above. THE CITY UNIVERSITY OF NEW YORK

[Prime Vendor]

, [Title]

Frederick P. Schaffer, General Counsel and Senior Vice Chancellor of Legal Affairs

APPROVED AS TO FORM

New York State Attorney General Date: APPROVED AND FILED IN THE OFFICE OF THE STATE COMPTROLLER

Office of the State Comptroller

CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

Date

TABLE OF CONTENTS Page 1.

Migration Project Description .......................................................................

1

2.

Summary of Fees and Costs .......................................................................

1

3.

Migration Project Schedules ........................................................................

1

4.

Payment Terms and Payment Milestones ...................................................

1

5.

Migration Services ...................................................................................

1

5.1 5.2 5.3 5.4 5.5 5.6

Migration Project Statement of Work ............................................... Key Personnel ................................................................................ Migration Project Plan ..................................................................... Migration Project Joint Resource Plan ............................................ Critical Milestones and Delay Credits .............................................. Use of Prime Vendor Migration Methodologies ...............................

1 2 3 3 3 4

Prime Vendor Tools and Utilities ..................................................................

4

6.

-iCUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

MIGRATION PROJECT SCHEDULES Schedule 4 Schedule 5.1 Schedule 5.2 Schedule 5.3 Schedule 5.4 Schedule 5.5 Schedule 6

Payment Terms and Payment Milestones Migration Project Statement of Work Key Personnel Migration Project Plan Migration Project Joint Resource Plan Critical Milestones; Delay Credits Prime Vendor Tools and Utilities

- ii CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

TERMS AND CONDITIONS 1. Migration Project Description. The Migration Project is defined as all the preparatory work necessary to establish the physical, virtual, and network environments for the CUNYfirst Hosting Services at Prime Vendor’s hosting site. It also includes the planning for and moving of all the CUNYfirst Applications, CUNY Data and any other required objects from CUNY’s existing hosted environment, testing, qualifying, validating, providing all requisite documentation, and certifying that the Applications have been properly moved and are operational. Included in the Migration Project will be the Business Continuity Plan build-out of the Disaster Recovery site and the migration of all CUNY Data and Applications. 2. Summary of Fees and Costs. The following table sets forth the summary of the fees for the Migration Project: Migration Project Fees

Amount

Total Migration Project Fees 3. Migration Project Schedules. The following Schedules are incorporated into and made a part of the Migration Project Agreement: Schedule 4 Schedule 5.1 Schedule 5.2 Schedule 5.3 Schedule 5.4 Schedule 5.5 Schedule 6

Payment Terms and Payment Milestones Migration Project Statement of Work Key Personnel Migration Project Plan Migration Project Joint Resource Plan Critical Milestones; Delay Credits Prime Vendor Tools and Utilities

4. Payment Terms and Payment Milestones. The Fixed Fee for the Migration Project Services shall be payable in accordance with the payment milestones ("Payment Milestones") and other terms and conditions set forth in Schedule 4. Additionally, Schedule 4 sets forth the fixed charges for the travel, out-of-pocket and related expenses for the Migration Project. 5. Migration Services. 5.1 Migration Project Statement of Work. The Migration Project Statement of Work is set forth in Schedule 5.1. The Migration Project Statement of Work sets forth the various assumptions, roles and responsibilities of each of the parties. (a) Completeness of Services and Products. Prime Vendor represents and warrants to CUNY that, as of the Effective Date: (a) Prime Vendor -1– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

identified in the Migration Project Statement of Work all software, equipment, services and other items required to migrate the ERP System from being hosted at its current data center to be hosted at Prime Vendor's data center as described in the Hosting Services Exhibit; (b) all such software, equipment, services and other items are included in this Migration Project Agreement; and (c) the Services to be provided by Prime Vendor on a fixed-fee basis under the Migration Project Statement of Work are the complete services required to meet CUNY's requirements as set forth herein, and there are no other services (i.e., optional or needed additional services) that are omitted from the Migration Project Statement of Work but necessary to meet such requirements. Without limiting the applicability or generality of the foregoing, Prime Vendor represents to CUNY that, with respect to this Migration Project Agreement, it has performed sufficient due diligence activities to properly determine, subject to the Assumptions set forth in the Migration Project Statement of Work, the software, equipment, products and scope of services required to successfully migrate the ERP System from being hosted at its current data center to be hosted at Prime Vendor's data center as described in the Hosting Services Exhibit. Prime Vendor acknowledges that, subject to the Assumptions, the above representations and warranties are a material factor influencing CUNY's decision to enter into, and that CUNY materially relied upon such representations and warranties when it entered into, the MSA (including the Hosting Services Exhibit) and this Migration Project Agreement. (b) Special Provisions Relating to Scope. The parties acknowledge that, given the complexities inherent in migrating the ERP System, there may be additional activities and tasks that may be required to migrate the ERP System from being hosted at its current data center to be hosted at Prime Vendor's data center as described in the Hosting Services Exhibit that are not reflected in the Migration Project Agreement, but are nonetheless advisable, necessary or required to successfully migrate the ERP System from being hosted at its current data center to be hosted at Prime Vendor's data center as described in the Hosting Services Exhibit. If there is a disagreement as to which party is responsible for a given activity, task or subtask, the matter shall be referred to the Prime Vendor Account Executive and the CUNY Migration Project Director for resolution, and they will use as guidelines in resolving the matter whether the activity, task or subtask was reasonably related and/or linked to a party's stated responsibilities in the Migration Project Statement of Work and/or Migration Project Plan. (c) Assumptions. The assumptions set forth in the Migration Project Statement of Work ("Assumptions") identify the complete list of assumptions applicable to the Migration Project (including the Migration Project Statement of Work, Migration Project Joint Resource Plan and Migration Project Plan) and relied on by the parties in developing the scope of work set forth in the Migration Project Statement of Work. If an assumption is determined to be no longer valid, then a party may assert that the assumption will result in an out-of-scope activity or event, entitling that party to activate the Change Order procedures. 5.2 Key Personnel. The Key Personnel for the Migration Project are set forth in Schedule 5.2. -2– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

5.3 Migration Project Plan. The Migration Project Plan existing as of the Effective Date is set forth in Schedule 5.3. The commencement and completion dates for the Migration Project are as follows: _________ to ________. The Migration Project Plan will be revised from time-to-time by the parties, and once revised shall become incorporated into and a part of the Migration Project Agreement. Any change(s) to the Due Date of a Critical Milestone must be made pursuant to the Change Order procedures set forth in the MSA to be effective. 5.4 Migration Project Joint Resource Plan. The Migration Project Joint Resource Plan set forth in Schedule 5.4 identifies the role, amount and timing of CUNY and Prime Vendor personnel resources assigned to the Migration Project. Prime Vendor recommended the skill level, amount and timing of CUNY resources in the Migration Project Joint Resource Plan and such plan is based on Prime Vendor's knowledge of the ERP System and the experience of Prime Vendor's other similarly-situated customers for whom Prime Vendor has migrated the ERP System (or similar system) from a data center hosted by a Third Party to Prime Vendor's data center. Prime Vendor represents to CUNY that the amount and roles of CUNY resources described therein are reasonably adequate to perform the tasks assigned to CUNY in the Migration Project Statement of Work within the applicable timeframes set forth in the Migration Project Statement of Work and Migration Project Plan. Prime Vendor represents that, based on its experience and project planning undertaken at CUNY prior to the Effective Date, the Migration Project Joint Resource Plan, Migration Project Statement of Work and Migration Project Plan reference and contain sufficient hours in which to migrate the ERP System from being hosted at its current data center to be hosted at Prime Vendor's data center as described in the Hosting Services Exhibit. Prime Vendor shall track and report to CUNY resource utilization and the variance between actual resource utilization and the Migration Project Joint Resource Plan. 5.5 Critical Milestones and Delay Credits. The Critical Milestones and Delay Credits for the Migration Project are set forth in Schedule 5.5. Upon certifying any Critical Milestone submitted by Prime Vendor, CUNY shall provide Prime Vendor with written certification of such Critical Milestone by signing the Certification Form set forth in Attachment A to Schedule 2.3 of the MSA by the CUNY Project Director, or her or his designee, and for Critical Milestones that create a payment obligation, the additional signature of the CUNY Chief Information Officer shall be required. No other form of certification, such as email communications, oral information or otherwise, shall be effective for purposes of certification, payment or otherwise, and shall not be effective against CUNY. For purposes of the Project Completion Critical Milestone, Prime Vendor acknowledges that if there is a Prime Vendor-caused delay that results in the Project Completion Critical Milestone not being met by the Due Date, then, in addition to any of CUNY’s rights under the MSA, CUNY may be required to renew the hosting services with its current hosting provider for up to an additional one (1) year period. If the existing hosting services are required to be renewed as stated in the preceding sentence, Prime Vendor acknowledges and agrees: (a) the Project Completion Due Date will be extended for up to one (1) year, with such extended date to be communicated in writing by CUNY to Prime Vendor; (b) CUNY shall not be required to expend any resources or otherwise continue performance under the Migration Project Agreement until such time as needed for re-starting the Cutover planning for the adjusted Project Completion Due Date; and -3– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

(c) at the appropriate time, Prime Vendor will work with CUNY with respect to the adjusted Project Completion Due Date and shall provide any required re-work and re-perform such Services as needed in connection with the Cutover and the adjusted Project Completion Due Date, all at no additional cost or expense to CUNY. 5.6 Use of Prime Vendor Migration Methodologies. Prime Vendor has recommended using certain proprietary and non-proprietary methodologies for the Migration Project ("Prime Vendor Migration Methodologies", as further described in the Migration Project Statement of Work). Prime Vendor represents to CUNY that, based on its due diligence conducted prior to the Effective Date, the Prime Vendor Migration Methodologies are appropriate, sufficient and applicable to the Services required to complete the Migration Project with quality Deliverables, on-time and within the Fixed Fee. Based on such representation, CUNY has agreed that such methodologies will be used in the Migration Project. However, if CUNY or Prime Vendor determines that one or more of the Prime Vendor Migration Methodologies are impeding the progress of the Migration Project or are negatively impacting the quality of Deliverables, on-time performance or budgetary considerations, then Prime Vendor shall adjust, modify or change the Prime Vendor Migration Methodologies to address the negative impact on the Migration Project, and any such changes to the Prime Vendor Migration Methodologies shall be subject to a no cost Change Order in order to make such changes effective. 6. Prime Vendor Tools and Utilities. The Prime Vendor Tools and Utilities associated with the Migration Project are set forth in Schedule 6.

-4– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 4 PAYMENT TERMS AND PAYMENT MILESTONES [THIS SCHEDULE IS TO BE COMPLETED PRIOR TO CONTRACT SIGNING.]

Payment Milestones

Expected Date

Project Completion

% of Total Migration Project Fees

20%

-5– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

Amount

SCHEDULE 5.1 MIGRATION PROJECT STATEMENT OF WORK [THIS SCHEDULE IS TO BE DEVELOPED DURING THE NEGOTIATION PERIOD.]

-6CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 5.2 KEY PERSONNEL [CUNY TO APPROVE KEY PERSONNEL PROPOSED BY PRIME VENDOR.] Each of the following individuals constitutes Key Personnel under the terms of the Agreement: Full Time

Position

Part Time

Prime Vendor Executive Sponsor*

X

Prime Vendor Account Executive*

X

Prime Vendor Information Security Officer*

X

Project Director

X

Project Manager

X

Quality Assurance Lead

X

Migration Project Lead

X

Security Lead

X

Testing Lead

X

Other Prime Vendor personnel shall be considered Key Personnel as agreed to in writing by the parties. On-site personnel generally shall adhere to the work schedule of Monday – Fridays, 8:00 a.m. to 5:00 p.m., Eastern time, provided that the work schedule will not limit Prime Vendor personnel from working additional hours during the work week and during the weekend. The hours of certain Prime Vendor on-site personnel may be staggered or flexible hours instituted provided the CUNY Program Director agrees that Migration Project needs are not being compromised. * The Prime Vendor Executive Sponsor, Prime Vendor Information Security Officer and Prime Vendor Account Executive shall not be chargeable to CUNY.

-7CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 5.3 MIGRATION PROJECT PLAN [THIS SCHEDULE IS TO BE DEVELOPED DURING THE NEGOTIATION PERIOD.]

-8– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 5.4 MIGRATION PROJECT JOINT RESOURCE PLAN [THIS SCHEDULE IS TO BE DEVELOPED DURING THE NEGOTIATION PERIOD.]

-9– CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 5.5 CRITICAL MILESTONES; DELAY CREDITS [THE TABLE BELOW IS TO BE COMPLETED PRIOR TO CONTRACT SIGNING.]

Critical Milestones

Due Date

Project Kickoff

Project Completion For Prime Vendor-caused delays, Delay Credits shall equal to Twenty-Five Thousand Dollars ($25,000) per calendar day for each calendar day of delay. Prime Vendor shall, at CUNY's option, pay the Delay Credits directly to CUNY or accrue and set off the Delay Credits against future amounts that will be payable.

- 10 – CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

SCHEDULE 6 PRIME VENDOR TOOLS AND UTILITIES [THIS SCHEDULE IS TO BE COMPLETED PRIOR TO CONTRACT SIGNING.] 1.

INCLUDE ALL TOOLS AND UTILITIES USED BY PRIME VENDOR’S TO MIGRATE THE ERP SYSTEM

2.

INCLUDE ALL AUTOMATED TESTING TOOLS (INCLUDING STRESS TESTING/PERFORMANCE MANAGEMENT TOOLS) PRIME VENDOR PLANS TO EMPLOY, AND INCLUDE THE SPECIFIC RELEASE OR VERSION NUMBER

3.

INCLUDE ALL OTHER TOOLS AND UTILITIES TO BE USED BY PRIME VENDOR DURING THE MIGRATION PROJECT]

Tool

Type

Description

- 11 – CUNY HOSTING RFP - ATTACHMENT A Exhibit 1 – Migration Project Agreement

EXHIBIT 2 HOSTING SERVICES

THE CITY UNIVERSITY OF NEW YORK AND

[PRIME VENDOR]

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

TABLE OF CONTENTS Page 1.

Description and Scope of Services ............................................................. Hosting Facility Management ................................................................ Hardware and Operating System Management .................................... Network Management ........................................................................... 1.3.1 Prime Vendor Obligations ............................................................... 1.3.2 CUNY Responsibilities .................................................................... 1.4 Storage Management ........................................................................... 1.5 Backup/Restore and Disaster Recovery ............................................... 1.5.1 Back-Up Operations........................................................................ 1.5.2 Back-Ups and Retention ................................................................. 1.5.3 Incident Data Restoration................................................................ 1.5.4 Disaster Recovery and Business Continuity Plan ........................... 1.5.5 Disaster Recovery and Business Continuity Services ..................... 1.5.6 Disaster Recovery Rehearsals ........................................................ 1.6 Desktop Management ........................................................................... 1.6.1 CUNY Responsibilities .................................................................... 1.7 Data Administration .............................................................................. 1.7.1 Prime Vendor Obligations ............................................................... 1.7.2 CUNY Responsibilities .................................................................... 1.8 Applications Management..................................................................... 1.8.1 Prime Vendor Obligations ............................................................... 1.8.2 CUNY Responsibilities .................................................................... 1.9 Release Management........................................................................... 1.9.1 Prime Vendor Obligations ............................................................... 1.9.2 CUNY Responsibilities .................................................................... 1.10 Monitoring ............................................................................................. 1.10.1 Prime Vendor Obligations ............................................................... 1.10.2 Tools and Utilities............................................................................ 1.11 Security ................................................................................................ 1.11.1 Prime Vendor Obligations ............................................................... 1.11.2 CUNY Responsibilities .................................................................... 1.12 Performance Management ................................................................... 1.12.1 Prime Vendor Obligations ............................................................... 1.12.2 CUNY Responsibilities .................................................................... 1.13 Prime Vendor Customer Support Center .............................................. 1.13.1 Prime Vendor Obligations – Customer Support Center ................... 1.13.2 Prime Vendor Obligations – Service Request Process .................... 1.13.3 CUNY Responsibilities .................................................................... 1.13.4 Incident Levels ................................................................................ 1.13.5 Multi-Vendor Sourced Environment................................................. 1.14 Communications Management ............................................................. 1.14.1 Prime Vendor and CUNY Joint Communications Management Responsibilities ............................................................................. 1.14.2 Service Delivery Management ........................................................ 1.1 1.2 1.3

-iCUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

1 2 3 4 4 4 5 5 5 7 7 8 8 8 9 9 9 9 11 11 11 12 12 12 13 13 13 14 15 15 20 20 20 20 20 21 21 22 22 22 24 24 24

Page 1.14.3 CUNY Responsibilities – Service Scheduling .................................. 1.14.4 CUNY Responsibilities – Cutover Assessments ..............................

25 25

Additional Terms ........................................................................................ 2.1 Access and Security ............................................................................. 2.2 Term of Hosting Services...................................................................... 2.3 Event of Default and Termination for Chronic Performance Standards Failures.............................................................................. 2.4 Hosting Systems Decommission........................................................... 2.5 Transition of Hosting Facilities .............................................................. 2.6 Controls over Financial Reporting and Operations ................................ 2.6.1 Audits.............................................................................................. 2.6.1.1 General .................................................................................. 2.6.1.2 SOC 2 Type 2 Reports ........................................................... 2.6.2 Maintenance of Records ................................................................. 2.6.3 Results of Inquiries and Remedial Plan ........................................... 2.6.4 Subcontractors................................................................................ 2.6.5 Costs .............................................................................................. 2.7 Procedures Manual............................................................................... 2.7.1 Development and Ongoing Maintenance of Procedures Manual ..... 2.7.2 Contents ......................................................................................... 2.8 Prime Vendor Environment Documentation and Transition to In-House Solution ............................................................................... 2.9 Technical Assistance and Knowledge Transfer.....................................

26 26 26

Hosting Definitions and Terms ....................................................................

34

Attachment A – Application Listing .........................................................................

39

Attachment B – Prime Vendor Environment and Technical Design and Architecture 1.0 Summary of Production and Non-Production Instances ........................ 2.0 Technical Design and Architecture ……………………………………….. 3.0 ITIL and Best Practices .........................................................................

42 42 45 47

Attachment C – Service Level Agreement .............................................................. 1.0 Performance Standard Reporting ......................................................... 1.1 Prime Vendor Portal and General Reporting ................................... 1.2 Performance Standard Measurement and Reporting ...................... 2.0 Performance Credits ............................................................................. 2.1 Overview of Performance Credit Process for Performance Standard Failures.......................................................................... 2.2 Invoicing Related to Performance Standard Failures ...................... 2.3 Performance Credit At Risk Amount Cap ........................................ 2.4 Commencement of Performance Standards Obligations ................. 2.5 Excused Performance Standards Failures ...................................... 2.6 Root-Cause Analysis ...................................................................... 3.0 Additions and Deletions of Performance Standards .............................. 3.1 Additional Performance Standards .................................................. 3.2 Deletion of Performance Standards ................................................

48 48 48 48 48

2.0

3.0

-iiCUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

27 27 28 28 28 28 29 30 30 30 31 31 31 31 32 32

48 49 49 49 49 50 50 50 51

Page 3.3

Baseline Period for Proposed New Performance Standards ........... Performance Standards and Performance Credits During Hosting Stabilization Period ............................................................................... 4.1 Hosting Stabilization Period ............................................................ 4.2 Performance Standards During Hosting Stabilization Period ........... 4.3 Performance Credits During Hosting Stabilization Period................

51

Performance Standards ........................................................................ Performance Standard – Production Application Pillar Availability .. Performance Standard – Non-Production Infrastructure Availability ..................................................................................... 5.3 Performance Standard – Application Response Time ..................... 5.3.1 Measurement ....................................................... 5.3.2 Calculation ........................................................... 5.4 Performance Standard – Disaster Recovery Restoration ................ 5.5 Performance Standard – Service Request Response and Resolution Time ............................................................................ 5.5.1 Incident Level Definitions..................................................... 5.5.1.1 Service Request Response and Resolution Time Performance Calculation ............................ 5.5.2 Determining Service Request Incident Level ....................... 5.5.2.1 Initial Incident Level .............................................. 5.5.2.2 Downgrades of Incident Levels ............................. 5.5.2.3 Upgrade of Incident Levels ................................... 5.5.2.4 Adherence to Incident Level Definitions ................ 5.5.3 Service Request Escalations ............................................... 5.5.3.1 CUNY Escalation .................................................. 5.5.4 Hours of Operations for the Customer Support Center .................................................. 5.6 Performance Standard – Security Management ..............................

52 53

Attachment D – Fees and Charges ........................................................................ 1.0 Monthly Hosting Fees During the Initial Hosting Term .......................... 2.0 Monthly Hosting Fees and Additional Resource Charges During the Hosting Renewal Option Period ........................................... 3.0 Additional Resource Charges and Reduced Resource Charges ........... 3.1 Additional Storage Charges ............................................................ 3.2 Additional and Removed Production Instances ............................... 3.3 Additional and Removed Non-Production Instances ....................... 3.4 Additional Refreshes ....................................................................... 3.5 Additional and Removed Servers .................................................... 3.6 Increase to Number of Concurrent Users ........................................ 3.7 Additional VPN Connections ........................................................... 4.0 Improvements and Gain Sharing Opportunities ....................................

60 60

Attachment E – Disaster Recovery and Business Continuity Plan .......................... Attachment F – Summary of Prime Vendor's Monitoring Activities .........................

65 66

4.0

5.0

5.1 5.2

-iiiCUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

52 52 52 52

54 55 55 56 56 57 57 57 58 58 58 58 58 59 59 59 59

60 61 61 62 62 62 63 63 63 64

HOSTING SERVICES This Hosting Services Exhibit describes the Hosting Services to be performed by Prime Vendor for CUNY under the MSA and other terms and conditions relating to such Hosting Services.

1.

DESCRIPTION AND SCOPE OF SERVICES

This Section 1 describes the Hosting Services to be performed by Prime Vendor and related responsibilities of CUNY under this Hosting Services Exhibit. A. Normal and Routine Services Included. Acknowledging that there are many activities and tasks typically undertaken in a data center to operate, manage, administer and maintain software-based solutions, and further acknowledging that each and every activity and task may not be set forth in this Hosting Services Exhibit, in addition to the tasks specifically listed in this Section, Prime Vendor shall perform, as part of the Hosting Services, the followingdescribed services, functions, responsibilities and tasks, which shall be deemed to be implied by and included within the scope of the Hosting Services to the same extent and in the same manner as if specifically described in this Hosting Services Exhibit, unless specifically identified in this Hosting Services Exhibit as being excluded from the Hosting Services or identified as a CUNY Responsibility: (a) those that are similar to the services, functions, responsibilities and/or tasks performed by CUNY or its Third Party hosting organization prior to the Effective Date, provided that such services, functions, responsibilities and/or tasks: (i) relate to information technology services or functions; and (ii) are a natural extension of, or relate to, a major service category generally identified or described in this Hosting Services Exhibit; and/or (b) those that are required for the proper performance of the Hosting Services and are an inherent part of, or a necessary sub-part included within, the Hosting Services. B. CUNY Responsibilities. The ability of Prime Vendor to deliver Hosting Services at the performance levels specified in this Hosting Services Exhibit and within the Monthly Hosting Fees may be dependent on CUNY fulfilling the applicable CUNY Responsibilities described in this Section 1. A failure of CUNY to discharge a CUNY Responsibility shall not result in or be construed as a breach of the MSA or this Hosting Services Exhibit by CUNY. If Prime Vendor believes that CUNY is not fulfilling one or more CUNY Responsibilities and that such failure has or may impact Prime Vendor's ability to deliver the Hosting Services in accordance with the terms and conditions of this Hosting Services Exhibit and within the Monthly Hosting Fees, Prime Vendor shall provide timely written notice of such failure to CUNY. CUNY is responsible for maintaining licenses for the Applications and for any software licensed by CUNY for which Prime Vendor provides Hosting Services and for support and maintenance services related thereto, however, not including any software required for Prime Vendor to operate the Prime Vendor Environment or otherwise perform the Hosting Services. C. Information Technology Infrastructure Library (“ITIL”). In addition to Prime Vendor's representations and warranties under the MSA, Prime Vendor shall perform the Hosting Services in accordance with the IT Service Management Best Practice guidance promulgated by ITIL, as such standards are updated from time-to-time, including guidelines for configuration management, change control and problem resolution.

-1CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

D. Hosting Services to Include All Release Management of Applications. The following activities shall be included in the Hosting Services for the Monthly Hosting Fees: The loading, configuring, and compiling of Enhancements, and the migrating and movement of Enhancements between and among Production Instances and Non-Production Instances, and any other corrections, fixes or modifications to the Applications made or provided by the Third Party manufacturer of such Applications (and, if necessary, restoration of the Instance from a back-up made of such Instance prior to the application of any such Enhancement, and any other correction, fix or modification to the Applications made or provided by the Third Party manufacturer of such Applications) (collectively, "Included Maintenance"). If Prime Vendor omits the loading, configuring, compiling and migrating of extensions, interfaces and/or reports within the Prime Vendor Environment from a future Project Agreement or Contract Supplement pertaining to new or additional Applications to be hosted by Prime Vendor, such loading, configuring, compiling and migrating shall be deemed included in the Hosting Services at no additional cost. E. Scope of Excluded Activities and Tasks from Hosting Services. The following activities and tasks represent the only activities and tasks excluded from the scope of Hosting Services for the Monthly Hosting Fees referenced in Attachment D and, as described below, any such activities or tasks may be subject to a Change Order: 1. 2. 3.

New design work; Services for any Applications not referenced on Attachment A; or CUNY LAN and workstation management beyond the Point of Demarcation;

References to any Production Instance in this Hosting Services Exhibit mean those Instances within the Prime Vendor Environment in which CUNY users process live business data as part of CUNY's business transactions or develop Applications for live business data. Certain NonProduction Instances are required under the terms of this Hosting Services Exhibit to mirror Production Instances, including the stage and reporting Instances, along with live transactional Instances.

1.1

Hosting Facility Management Prime Vendor shall: A. B.

C. D. E.

Provide the physical primary data center in the United States for the Hosting Services. Provide a physical secondary data center in the United States at least at a distance from the physical primary data center acceptable to CUNY for use in recovery operations and/or during disaster recovery Services. Manage all aspects of the data centers. Maintain physical security of the data centers, interconnecting networks and any location where CUNY Data is present. Maintain an inventory of assets.

-2CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

1.2

Hardware and Operating System Management Prime Vendor shall, with respect to the Prime Vendor Environment: A. B. C.

D. E. F. G. H. I.

J. K. L.

M. N. O. P. Q.

Manage host, workstation and network device operating system security in accordance with Section 1.11 to this Hosting Services Exhibit. Perform maintenance for operating systems. Provide CUNY with advance written notice and general information about changes to be made to the Prime Vendor Environment during routine maintenance. Monitor performance. Identify performance Issues. Implement and test fixes to performance Issues regarding the hardware and operating system. Plan, implement and manage capacity based on the scope and use of the Hosting Services and the Performance Standards. Identify need for, and analyze impact of, infrastructure patches. Apply security and other patches to all: (i) operating systems, database systems, interfaces, firmware and other infrastructure components comprising or within the Prime Vendor Environment and all Applications and other software hosted by Prime Vendor, including all security patches, version updates, and service packs provided by Third Party vendors; (ii) equipment and hardware used to provide the Hosting Services, including the Prime Vendor Environment, including hosts, servers, workstations and network devices, and security devices; and (iii) all software and equipment and hardware used by the Applications or personnel who support the Applications. Patch management shall include regular monthly patch vulnerability scanning to verify that no security patches are missing from any component of the Applications or Prime Vendor Environment. Primary Vendor shall proactively monitor all Third Party vendors who provide components of the Applications and the Prime Vendor Environment for patch alerts and update notices. In general, workstation patches should be applied within twenty-four (24) hours of patch release from any Third Party vendor. Patches for host devices and network devices should be applied after reasonable testing to ensure a patch does not adversely impact solutions availability, but in no case should they take longer than fifteen (15) days to apply. Ensure that the hosting platform is built on each Third Party vendor’s certified platform. Test patches and the interaction of such patches to the components to which they are applied. Provide CUNY with monthly evidence that patch management in accordance with Section 1.2(I) above was accomplished, including providing vulnerability assessments of any Devices that were not patched. Review hardware maintenance plans. Schedule and execute hardware maintenance. Execute preventative maintenance plans. Test components that have received maintenance. Monitor maintenance plan for its effectiveness. -3-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

R. S.

1.3

Perform standard reboots and any other regular maintenance of the hardware as recommended by the applicable hardware manufacturers. As new hardware is added to the configuration, design and perform tests to ensure the hardware performs in accordance with the equipment manufacturer specifications.

Network Management 1.3.1

Prime Vendor Obligations

As part of the management of equipment and connectivity for the different parts of the network (LAN and WAN) from the Hosting Services data center to the Point of Demarcation, Prime Vendor shall: A. B. C.

D.

E. F.

G.

Maintain and monitor all network LANs within the data center. Configure changes to all network LANs within the data center. Perform internal IP address management, router table management, NAT administration, switch administration and firewall administration at the data centers. Enable the Applications to be accessible on the public Internet by CUNY users in a manner that maintains data security pursuant to Section 1.11 and the requirements set forth in the MSA. Plan, implement and manage capacity based on the scope of Hosting Services, in coordination with CUNY. Provide two (2) circuits (a minimum of 1 GB each) from two (2) separate service providers on physically diverse paths that terminate at CUNY’s designated Points of Demarcation in New York City, one (1) circuit (a minimum of 100 MBPS) to Prime Vendor’s backup failover facility that also terminates at CUNY’s designated Points of Demarcation in New York City, and one (1) circuit (a minimum of 100MBPS) from Prime Vendor’s primary hosting facility to CUNY’s disaster recovery facility in the greater New York City metropolitan area. At CUNY's election, Prime Vendor shall provide performance data identifying network performance from the Point of Demarcation to CUNY's site.

The summary of Prime Vendor's monitoring activities is set forth in Attachment E. 1.3.2

CUNY Responsibilities

CUNY will: A. B. C. D. E.

Provide external DNS management for CUNY address space. Provide internal DNS management within the CUNY network. Manage CUNY's internal network. Unless purchased by CUNY from Prime Vendor pursuant to Section 3.8 of Attachment D, procure connectivity from the connectivity provider. Unless purchased by CUNY from Prime Vendor pursuant to Section 3.8 of Attachment D, manage the connectivity provider, including management of network segments from the Point of Demarcation to CUNY. -4-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

F.

1.4

Specify any required network connectivity (port, addresses, etc.) for any software originating from CUNY's network.

Storage Management Prime Vendor shall: A. B. C. D.

E. F. G.

1.5

Monitor and maintain file systems. Provide offsite media storage. Monitor and maintain storage for database Instances. Provide continuous replication of both Application data files and databases between Prime Vendor’s primary and disaster recovery environments in accordance with CUNY’s recovery point objective set forth in Section 5.4 of Attachment C. Plan capacity based on the scope and use of Hosting Services and the Performance Standards. Utilize industry standard technology for hot swappable, high availability storage devices and media. Maintain physical and logical security of all storage including file systems, decommissioned storage devices and media, all in accordance with Section 1.11.

Backup/Restore and Disaster Recovery 1.5.1

Back-Up Operations

Prime Vendor shall perform the following back-up operations: Production Backups Backup Type Baseline

Daily Incremental Files Database Hot Backups Database Archives

Applications

Operating System/Infrastructure Full Backup Copy (Refreshed Baseline)

Description

Frequency

Pre-Production (go-live) Image

For each Application, one (1) baseline backup prior to any Cutover for that Application

Any element (including all files, Application data and objects) in the Prime Vendor Environment that changes during the period Complete Prime Vendor database backup including all CUNY Data in database Prime Vendor archive files containing any change to the database which allows point in time recovery All Application executables and configuration files and source code for software operating the Application Stored images of operating systems, including configuration files, BIOS, firmware, router configurations, SANS configuration settings, virtualization settings Full backup of all data, Applications and other files referenced in this chart

-5CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Daily Weekly Daily

Weekly As changes are made, but not less than once each month Annually and upon request of CUNY whenever there is an Enhance-

Backup Type

Description

Frequency ment or other major change

Continuous Prime Vendor Database Log Files

Prime Vendor relational database management system archive logging is activated for the production Prime Vendor Environment and replicated to the secondary data center at 15 minute intervals each of which shall be on a 24 x 7 basis, except during Scheduled Downtime

Ongoing

Non-Production (excluding Demo) Backups Backup Type Daily Incremental Files Database Hot Backups Database Archives Applications Operating System/Infrastructure

Full Backup Copy (Refreshed Baseline)

Description Data or object changes during the period residing in the file system Complete Prime Vendor database backup including all CUNY Data in database Prime Vendor archive files containing any change to the database which allows point in time recovery All Application executables and configuration files operating the Application Stored images of full operating systems, including configuration files, BIOS, firmware, router configurations, SANS configuration settings, virtualization settings Full backup of all Applications, software and other files referenced in this chart

Frequency Daily Weekly Daily Weekly As changes are made, but not less than once each month Annually and upon request of CUNY whenever there is an Enhancement or other major change

For each backup, Prime Vendor shall make two (2) identical copies, and the maintenance and retention obligations set forth herein shall apply to both copies of the backups. All backed up data shall be encrypted, and upon request, Prime Vendor shall provide CUNY with the names of the individuals who are authorized to recover and decrypt backup files. As part of its backup procedures, Prime Vendor shall perform automated verification of each backup to confirm that complete data, Application and other software and other files have been successfully backed up. The results of the automated verification shall be placed in backup logs which shall be made available and accessible to CUNY online 24 x 7 x 365. In addition, Prime Vendor each quarter shall perform manual checks to verify that the backup procedures are working properly and the then-current set (at the time of manual verification) of backups have all the required data, Applications and other files properly backed up. Within three (3) business days of Prime Vendor's manual verification, Prime Vendor shall provide CUNY with a written report verifying the successful completion of the data backups, or, if there are Issues with respect to the backups or backup procedures, Prime Vendor shall identify the Issues and submit with the written notice a corrective action plan to be implemented no later than five (5) business days. At the end of the five (5) day period, Prime Vendor shall report to CUNY whether it has corrected the Issue. A failure of Prime Vendor to report the correction or to correct an Issue within the five (5) day period shall constitute a failure of the Disaster Recovery Performance Standard. CUNY shall have the right to require Prime Vendor to conduct additional automated or manual verifications until any Issues have been corrected. -6CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

1.5.2

Back-Ups and Retention

During the Hosting Term and for the seven (7) year period thereafter, Prime Vendor shall transfer to, maintain and retain the backup copies at a physically secure designated offsite location in the United States at least at a distance from the primary data center acceptable to CUNY. Prime Vendor shall disclose the location of the offsite storage location to CUNY. Prime Vendor shall ensure that there is limited access to the backup media whether at Prime Vendor's primary data center facility, secondary data center facility or off-site storage facility. If Prime Vendor uses a Third Party to transport and/or store backup media, Prime Vendor shall have a written agreement with such Third Party incorporating appropriate handling of media safeguards, consistent with industry practices, and limiting the number of Third Party personnel having access to such media. Prime Vendor shall be responsible for any and all damages relating to the use, misuse and/or loss of media, whether caused by Prime Vendor or a Third Party handler or offsite storage provider. The retention periods for the backups are as follows: Description Baseline and Refreshed Baselines Daily Weekly Monthly

Retention Period The duration of the Hosting Term 6 days 4 weeks 12 months

During the Hosting Term and for the seven (7) year period thereafter, Prime Vendor shall retain and maintain the versions of the software, tools and utilities required to retrieve and restore the backups. If Prime Vendor fails to maintain the software, tools and utilities to retrieve and restore the backups, Prime Vendor shall be responsible for converting such data, at its expense, to an industry standard format selected by CUNY. After the Hosting Term, Prime Vendor shall provide such backups to CUNY subject to the parties executing a Change Order for the reasonable (and substantiated) costs to retain such copies and provided CUNY pays Prime Vendor, at the Service Rate(s) and any out-of-pocket materials expenses. CUNY may request back-up copies of CUNY Data and other files from Prime Vendor in an industry-standard format designated by CUNY, and if Prime Vendor does not support the designated format, in a format mutually agreed to by the parties. The fee for additional back-ups is listed as an ARC in Attachment D. 1.5.3

Incident Data Restoration

For Incidents not involving a Disaster, Prime Vendor shall perform data restoration Services to recover lost or corrupted data from production data as soon as possible from CUNY's request, but in no event commencing greater than two (2) hours from CUNY's request. For the Disaster recovery time objective and recovery point objective, see Section 5.4 of Attachment C. -7CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

1.5.4

Disaster Recovery and Business Continuity Plan

The preliminary Disaster Recovery and Business Continuity Plan is set forth in Attachment E. Within ninety (90) days from the Effective Date, Prime Vendor will provide CUNY with a detailed, updated plan for CUNY's review. The Disaster Recovery and Business Continuity Plan is a Deliverable and its delivery is a Critical Milestone event subject to the terms of the MSA. After delivery of the updated plan, the parties shall meet to finalize the plan, and once agreed to by CUNY, it shall supersede the preliminary plan and become the new Attachment E. If Prime Vendor fails to deliver the updated plan within the 90-day period, or fails to finalize the plan with CUNY within 180 days from the Effective Date, CUNY shall have the right to suspend payment of all amounts due or to be due and owing under the MSA until the plan is finalized and agreed to by CUNY. Once the Disaster Recovery and Business Continuity Plan is finalized, the plan shall be updated by Prime Vendor on an annual basis as part of the Procedures Manual update process described in Section 2.7. Subsequently approved Disaster Recovery and Business Continuity Plans shall replace the then-existing plan and become the new Attachment E. 1.5.5

Disaster Recovery and Business Continuity Services

A "Disaster" is an unplanned event that causes a complete loss of access to and use of the Applications and other software included in the scope of Hosting Services, where such loss of access and use is likely to continue for a period greater than twelve (12) hours. CUNY and Prime Vendor agree, within two (2) hours after an event that may qualify as a Disaster, to determine the nature and cause of the event. Upon the reasonable determination by CUNY’s Chief Information Officer or his designee that an Incident qualifies as a Disaster and the declaration of a Disaster by CUNY for purposes of commencing disaster recovery Services, Prime Vendor shall follow the procedures set forth in the Disaster Recovery and Business Continuity Plan to restore the production Prime Vendor Environment, at the primary data center or a secondary data center, in accordance with the timeframes set forth in Section 5.4 of Attachment C. The back-up production Prime Vendor Environment at the secondary data center shall be a mirror of the Production Instances at the primary data center. 1.5.6

Disaster Recovery Rehearsals

Prior to Cutover, Prime Vendor shall set up a test of the active/passive failover capability of the Application between the primary and secondary data center to confirm that the production ready Prime Vendor Environment can be restored in accordance with the Disaster Recovery and Business Continuity Plan. The rehearsal will test all parts of the Business Continuity Plan, except as otherwise specified by CUNY. Rehearsals shall not be complete until operations can be successfully tested from the secondary data center. Prior to commencing the first rehearsal, Prime Vendor shall provide CUNY with information on Prime Vendor's infrastructure and readiness to fulfill its Disaster Recovery obligations, including the circuits provisioned by Prime Vendor between the primary and secondary data centers, etc. At any time during the Hosting Term, CUNY shall have the right to confirm that the various components of the secondary data center are installed and functioning and that -8CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

CUNY’s data are being replicated and maintained in accordance with the Performance Standards for Disaster Recovery Restoration set forth in Section 5.4 of Attachment C. Once per year after Cutover and at any time upon the request of CUNY, Prime Vendor shall conduct a disaster recovery rehearsal to confirm that the production Prime Vendor Environment can be restored in accordance with the Disaster Recovery and Business Continuity Plan. CUNY will have the right to observe and/or directly participate in such rehearsals. If a disaster recovery rehearsal reveals that there are deficiencies, Prime Vendor shall develop a corrective plan of action as soon as possible, not to exceed ten (10) days, and implement such plan within thirty (30) days, all at no additional cost to CUNY. Upon completion of the corrections, CUNY shall have the right to require a partial or full rehearsal to confirm that the corrections have been implemented successfully. Prime Vendor shall perform the disaster recovery rehearsals described in this Section as part of the Monthly Hosting Fees set forth in Attachment D.

1.6

Desktop Management 1.6.1

CUNY Responsibilities – Desktop Management

CUNY will: A.

B. C. D.

1.7

Manage and administer all CUNY-issued end-user equipment; Manage and deploy browsers and terminal services client software; Provide support for CUNY-issued end-user equipment; and Manage and deploy CUNY’s desktop patches as appropriate.

Data Administration 1.7.1

Prime Vendor Obligations

Prime Vendor shall: A.

B. C. D.

E.

Administer data files and database Instances including configuration, sizing, instantiation, ongoing storage management, stopping, starting, connectivity setup and configuration, problem diagnosis, tuning, patching, and backups for data restoration and recovery. Manage and maintain all database software associated with the Applications and otherwise included in the scope of Hosting Services. Administer the database Instances identified in Attachment B. Pursuant to a Service Request from CUNY, provide change (read + change only) access to non-production data and databases on an asneeded/restricted basis for developer access, and promptly (but no later than two (2) hours from the request) provide read only access to the production database for authorized CUNY technical personnel. Provide routine start-ups and shutdowns for the Prime Vendor managed database Instances. -9-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

F.

G. H. I. J. K. L.

M.

N.

O.

P.

Provide database security management in accordance with then-current industry standards and best practices and CUNY Policies, including ensuring that data at rest is encrypted. Maintain custom database User IDs. Monitor database performance. Isolate and, at CUNY’s request, tune database performance. Install and test fixes to database performance Issues as reported by CUNY. Plan database capacity based on the Hosting Services as described in Section 1. Provide copies of Application configuration files. CUNY may review the configuration files for troubleshooting purposes only, and will not have access to change these files. Provide CUNY with real-time (ten (10) minutes or less) database replication to CUNY’s local database instances using replication tools such as Oracle’s Golden Gate. In addition to the database actions that Prime Vendor may be required to implement in support of the Hosting Services as described in Section 1, CUNY may require additional database actions (including actions to write to the database for the purpose of correcting erroneous data or otherwise), as it reasonably determines are needed, as part of the Hosting Services. Such CUNY requested database actions are defined as CUNY requests for Prime Vendor to execute specific database commands on CUNY's behalf. To facilitate system efficiency, Prime Vendor shall manage the movement and location of all data and database files, including managing the relocation of data files, online redo log files, and database control files. Prime Vendor shall provide written notice to CUNY at least five (5) days in advance of all file relocations, except in circumstances where immediate action is required, and in such circumstances Vendor shall provide written notice to CUNY as soon thereafter as feasible. CUNY is responsible for all data within CUNY Application-specific schema. Prime Vendor shall reload in accordance with industry best practices an image copy of each reporting Instance and ready such image copies for CUNY’s use (each, a "Refresh") prior to 6 a.m. Eastern time each calendar day. In addition, at CUNY’s request, Prime Vendor shall provide a Refresh of Production Instances and other Non-Production Instances identified by CUNY prior to 6 p.m. Eastern time each calendar day and ready such image copies for CUNY’s use the next calendar day prior to 6 a.m. Eastern time up to twenty-five (25) times per month. The initial Refresh for a new Production Instance purchased through an ARC under Section 3.4 of Attachment D shall not be considered a Refresh for purposes of this Section 1.7.1(P). Upon CUNY's request and at no additional cost to CUNY, Prime Vendor shall encrypt or obfuscate all personal data in connection with the migration to test.

Additional Terms Relating to Refreshes Other than Prime Vendor-initiated Refreshes, Prime Vendor shall provide additional database Refreshes at the ARC rate. CUNY-requested Refreshes will require one (1) -10CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

business day advance written notice. If the requested Refresh would coincide with a scheduled maintenance period, the parties will schedule the Refresh as soon as practicable after such maintenance period. Refreshes from an existing Instance (and not an archive) to a new Instance shall not take more than twenty-four (24) hours to complete. Following written notice to CUNY and subject to CUNY’s prior written consent, Prime Vendor may perform database Refreshes to facilitate Prime Vendor’s compliance with Performance Standards set forth in Attachment C, at no additional cost to CUNY. Prime Vendor shall notify CUNY regarding the initiation and completion of any such Refresh. All Refreshes will be performed during scheduled time periods to be mutually agreed to between CUNY and Prime Vendor. Access to New Data and Infrastructure Changes Prior to implementing any Enhancements that involve new data and/or infrastructure changes affecting CUNY Data, Prime Vendor shall provide CUNY with as much advance notice of the changes as possible, and not less than sixty (60) days before any such change is made. At no additional cost to CUNY, Prime Vendor shall create a complete non-production set of Prime Vendor Environments, replicating CUNY's then-current NonProduction Instances, so that CUNY can test the data and infrastructure changes. Prime Vendor shall continue to maintain both sets of non-production Prime Vendor Environments until the Enhancements are stabilized and there are no Level 1 or Level 2 Incidents relating to the Enhancements and CUNY places the Enhancements into production. 1.7.2

CUNY Responsibilities

CUNY will assist with the testing of database performance Issues as reasonably requested by Prime Vendor provided CUNY has the technical skill level to provide such assistance.

1.8

Applications Management 1.8.1

Prime Vendor Obligations

Upon CUNY’s request, Prime Vendor shall collaborate with CUNY to manage the Application architecture, such as the application servers, web servers, database servers, and batch servers, as follows: A. B. C. D. E.

Configure and maintain server environments. Provide reboots of server components according to an agreed to maintenance schedule. Identify Application performance Issues and tune systems to meet Prime Vendor’s performance standards set forth in this Hosting Services Exhibit. Monitor Application software server components. Execute production and non-production jobs as required for processing the Application's internal processes, extensions, reports and interfaces. -11-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

F.

G. H.

I.

Schedule all batch processes, job runs, interfaces, or other processes to be run in the Prime Vendor Environment according to the job schedule provided by CUNY. Assess failed jobs and determine proper resolution including potential rerun or skip run. Monitor and notify CUNY designated resources of the success or failure of pre-defined batch jobs, and assist CUNY in the assessment of failed jobs. Apply Application patches as directed by CUNY.

Prime Vendor shall make a real-time log of the foregoing actions (including when an action is scheduled to occur and when an action was successfully completed) available to CUNY online, and shall provide CUNY with a monthly summary recapping the foregoing actions taken in the previous month. 1.8.2

CUNY Responsibilities

CUNY will: A. B. C. D. E. F.

G.

1.9

Assist in identifying performance Issues as requested by Prime Vendor. Manage and deploy any needed CUNY client software, such as browsers, remote access software and mobile software. Configure and manage the physical hardware and software associated with CUNY's printers. Maintain production and non-production job schedules. Assess impact of failed jobs. If needed, provide its authorized personnel with 2-Tier access to the development Instance of the Prime Vendor Environment during the preproduction phase of the Hosting Services, for the purpose of implementation support and/or configuration of the Application. Provide, maintain and update as needed, a schedule identifying the frequency, time and any other scheduling requirements for CUNY's receipt of interfaces, reports or other output from and relating to the Application.

Release Management 1.9.1

Prime Vendor Obligations

Prime Vendor shall, with respect to each of the Prime Vendor Environments, as applicable: A. B.

Verify the installation of patches per the install instructions. Track all patches applied to the Application.

Upon CUNY’s prior written request, Prime Vendor shall, with respect to each of the Prime Vendor Environments, as applicable: C.

Apply and migrate Enhancements as such Enhancements are made available. -12-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

D.

E.

F. G.

H. I. J.

K. 1.9.2

Install and execute the Oracle-provided utilities to assist CUNY in identifying extensions, interfaces and reports that could be overwritten, made inoperable or unable to function in their intended manner as a result of the Enhancements. Migrate software objects to the production Prime Vendor Environment as directed by CUNY on a weekly scheduled basis and as required to address emergency fixes. Coordinate and apply regulatory modifications. Coordinate with CUNY to determine which Enhancements should be applied and provide overall management of the update process in accordance with an agreed to schedule. Migrate objects between the Prime Vendor Environments, as needed and as directed by CUNY. Install security patches in accordance with Section 1.11. Identify any Enhancements that Prime Vendor determines are advisable to perform the Hosting Services in accordance with the Performance Standards, and prioritize the installation of such Enhancements so that Performance Standards can be met. Install all Enhancements, as directed by CUNY.

CUNY Responsibilities

CUNY will: A. B. C. D. E. F. G. H.

1.10

Work with Prime Vendor to identify and analyze the impact of Enhancements. Initiate requests to migrate software objects. Provide approval to install Enhancements. Plan and execute testing of Enhancements, including performing configuration testing. Develop and coordinate implementation/upgrade strategy for Enhancements. Perform integration testing prior to application of patches to the production Prime Vendor Environment. Perform acceptance testing of all patches. Provide post-installation functional testing of all patches.

Monitoring 1.10.1

Prime Vendor Obligations

Prime Vendor shall monitor the performance, security and availability of the Prime Vendor Environment by use of the tools and utilities sufficient to accurately and reliably report on the Performance Standards. Prime Vendor represents and warrants that the tools and utilities it uses to report on the Performance Standards are sufficient to meet the Performance Standards. As part of its monitoring activities under this Section 1.10, Prime Vendor shall:

-13CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

A.

B.

C.

D. E. F. G. H. I.

Perform continuous real-time operational, performance and security monitoring of hardware, infrastructure, OS, LAN, database, Applications and other software included in the scope of Hosting Services. With respect to security monitoring, Prime Vendor shall provide a logging and monitoring strategy that meets or exceeds CUNY’s standards and outlines how the Prime Vendor will meet requirements outlined in the Security Policies and Procedures. Collect information about the capacity, performance, configuration and operational state of the Prime Vendor Environment, and compile such information in a Prime Vendor controlled repository. Install and provide automated event monitoring and notification software and perform initial event notification and escalation for all systems, including online transaction processing. Respond to events according to event notification and escalation procedures. Monitor capacity of application servers, web servers, database servers, batch servers, storage devices and network. Monitor availability and performance of critical components, such as the Prime Vendor network architecture. Install a Prime Vendor tool set that enables monitoring and management capabilities for the Prime Vendor Environment. Facilitate appropriate configuration of events. Perform vulnerability scanning using a CUNY-approved scanning tool at least monthly to identify vulnerabilities and track progress in remediation of identified vulnerabilities on all host, workstation, and network devices that support the Application. Provide CUNY with a monthly electronic summary of this activity, and, upon request, details for any given device.

Prime Vendor shall make a real-time log of the foregoing actions (including when an action is scheduled to occur and when an action was successfully completed) available to CUNY and provide a monthly report of the foregoing actions taken in the previous month. 1.10.2

Tools and Utilities.

Without limiting Prime Vendor's obligations under Section 1.10.1 above, the following are tools and utilities are intended to be used by Prime Vendor to monitor the Hosting Services:  

[PRIME VENDOR TO SUPPLY PRIOR TO CONTRACT SIGNING] _____________________________ _____________________________

Prime Vendor shall provide CUNY with credentials to access the above tools and utilities. Prime Vendor shall install and integrate CUNY monitoring agents behind Prime Vendor’s firewall in read-only mode utilizing current SNMP standard protocol, and Prime Vendor shall provide CUNY the ability to monitor on-line (on a read-only basis) all elements of -14CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

the Prime Vendor Environment and the Prime Vendor’s Technical Design and Architecture.

1.11

Security

The terms and conditions set forth in this Section are in addition to, and not in lieu of, Prime Vendor's obligations to comply with the Security Policies and Procedures and other security and confidentiality obligations as set forth in the MSA. Prime Vendor shall limit administrative access to hosts and workstations that host or access CUNY Data to the least number of personnel required to meet Prime Vendor's obligations under this Hosting Services Exhibit. Prime Vendor shall employ management, operational and technical controls within the security framework of the ISO Security Standards, and Prime Vendor acknowledges that it will be audited to this standard. The security related controls employed by Prime Vendor are described in this Section 1.11 and may be further described in the Procedures Manual.

1.11.1 Prime Vendor Obligations Prime Vendor shall: A. B.

C.

Perform security-related changes to the Prime Vendor Environment. Create and change Prime Vendor administrative User IDs, de-provision Prime Vendor administrative users and reset administrative passwords. Prime Vendor shall maintain and secure audit logs of all actions of users who have administrative privileges with respect to the Prime Vendor Environment, and shall make such logs available to CUNY in electronic form upon request. Audit log data shall be retained by Prime Vendor for a period of two (2) years from date of data capture. Maintain and monitor a physical security policy and provide the following physical security of the primary and secondary data centers and to the CUNY-designated locations in which the Prime Vendor Environment is housed: 1. Restrict Access – Data Centers – Prime Vendor shall limit access to the primary and secondary data centers to personnel requiring access to perform their assigned duties and to authorized visitors. Visitors are to be checked in and escorted by data center personnel. 2. Restrict Access – Prime Vendor Environment – Prime Vendor shall limit access to the area in which the Prime Vendor Environment is housed to only such periods as specified personnel are actively engaged in CUNY-related duties. Blanket or unlimited duration for Prime Vendor personnel is prohibited. 3. Data Handling and Secure Media Storage – Prime Vendor shall maintain the security of CUNY Data in all phases of the CUNY Data’s lifecycle. Data Protected by Law and other sensitive data at rest must be encrypted with a minimum of 128-bit encryption. Portable back-up media must be secured, encrypted, and access limited to authorized personnel only at all times while stored on premise, while in transit to off-premise storage facilities, and while in off-premise storage facilities. -15-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

4.

5.

D.

Review Access – Prime Vendor shall periodically (no less than once a year) review its practices regarding restrictions to physical access to the primary and secondary data centers and conduct a daily review of the physical access logs for unusual and/or suspicious entries and take follow-up action as appropriate. Prime Vendor shall report any such entry to CUNY within two (2) hours of being identified by Prime Vendor. Inspection – Prime Vendor shall once annually, upon CUNY’s request, permit CUNY to perform an on-site (or off-site, at CUNY’s election) inspection and review of Prime Vendor’s facilities and access policies.

Provide the following logical security of the primary data center: 1.

2.

3.

4. 5.

Application and Database Access – Access by personnel of Prime Vendor and its subcontractors and/or data center facility(ies) (collectively, for purposes of this Section, "Prime Vendor Personnel") to the Applications and other software included in the scope of Hosting Services, database programs, utilities of any form, CUNY Data and all other components of the Prime Vendor Environment and communications will be limited to those personnel providing Hosting Services as well as tasks incidental to Hosting Services. Access to operating systems, network applications and/or CUNY Data by Prime Vendor Personnel shall only be through Prime Vendor-assigned individual User IDs, and individual User IDs issued to Prime Vendor Personnel shall not be shared. Access shall be provided only for such periods as specified Prime Vendor Personnel are actively engaged in CUNYrelated duties. Blanket or unlimited duration access for Prime Vendor Personnel is prohibited. Prime Vendor shall maintain records that will permit Prime Vendor to identify, at any given day and time, any Prime Vendor Personnel who used a User ID to access and/or change any operating system, network application and/or CUNY Data, and if there is any unauthorized access and/or change by any Prime Vendor Personnel by use of a User ID to operating systems, network applications and/or CUNY Data. Prime Vendor shall be responsible and liable for the actions and/or omissions of any individual assigned a User ID or otherwise given access by Prime Vendor. Co-Mingled Data – Prime Vendor shall either: (a) locate CUNY Data on data storage devices separate and apart from Prime Vendor's other customers; or (b) if CUNY Data resides on data storage devices that contain other Prime Vendor customer data, then Prime Vendor shall create logical partitions and implement such access and security controls to prohibit CUNY Data from being accessible by any Third Party or Prime Vendor Personnel not otherwise authorized to access CUNY Data. Operating System Access – Access by Prime Vendor Personnel to the operating system of the Prime Vendor Environment will be limited to those personnel providing Hosting Services as well as tasks incidental to Hosting Services. Security Patches – Security patches shall be applied in accordance with the schedule set forth in Section 1.2(I). Antivirus protection will be maintained at up to date levels at all times on all servers used in the data center to deliver Hosting Services, and -16-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

E.

such antivirus protection shall not impede or hinder CUNY's ability to access the Prime Vendor Environment. 6. Review Access – Prime Vendor shall periodically (no less than once a year) review its practices regarding restrictions to logical access to the Prime Vendor Environment. 7. Security Event and Audit Logs – Prime Vendor shall create security event and audit logs and retain them for a period of two (2) years from date of entry. Prime Vendor shall conduct continuous real-time analysis of the security event and audit logs for all infrastructure security components, review the logs for anomalies and suspicious patterns, create security Incidents as warranted, and provide quarterly reporting of all security events. Upon request, Prime Vendor shall provide CUNY with a secured real-time security event log feed suitable for integration with CUNY’s Security Information and Event Management (SIEM) system. Provide the following network security applicable to the Prime Vendor Environment: 1. Control Network Edge (Firewalls) and Remote Access – Prime Vendor shall maintain industry standard firewall configurations with current firmware and rule sets and other security and technologies to control access to the network within the primary and secondary data centers that support the Prime Vendor Environment (including the Applications and other software included in the scope of Hosting Services and CUNY Data within the Prime Vendor Environment) from external sources. The Hosting Services and CUNY Data must be logically segregated to be contained within a security perimeter and may not be directly connected to the Internet. Firewalls shall fail closed, and the firewall access policy shall default to “deny”. 2. Intrusion Detection / Prevention – Prime Vendor shall maintain industry standard security technology to proactively monitor for and protect against unauthorized intrusion attempts to access to the network within the primary and secondary data centers that support the Prime Vendor Environment (including the Applications and other software included in the scope of Hosting Services and CUNY Data within the Prime Vendor Environment) from internal and external sources. The system must consist of both anomaly or profile based analysis and signature matching analysis, using a subscription service that is updated, at minimum, weekly. 3. Monitor for Vulnerabilities and Remediate – Prime Vendor shall maintain industry standard security technologies to continually monitor for software and configuration vulnerabilities on the network within the primary and secondary data centers that support the Prime Vendor Environment (including the Applications and other software included in the scope of Hosting Services and CUNY Data within the Prime Vendor Environment) and seek to remediate and/or mitigate such vulnerabilities as soon as possible either non-disruptively or during established maintenance windows. 4. Patch Management – See Section 1.2(I). 5. Control Web Application Vulnerabilities – Prime Vendor shall use industry standard web application firewall and pattern recognition soft-17-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

F.

ware to block access to the Application from exploits that seek to take advantage of known web application vulnerabilities. 6. End Point Protection Platform – Prime Vendor shall implement and operate an End Point Protection Platform to ensure that all components of the Prime Vendor Environment secure CUNY Data. The End Point Protection Platform must operate full spectrum capability for defending servers and workstations running the operating systems used by the Applications, be centrally controlled and integrated into an overall layered defensive strategy for protecting CUNY Data and all Prime Vendor Environment components, and have network perimeter capability to detect common viruses, malware, and malicious traffic at the network perimeter to prevent malicious content from entering the Prime Vendor Environment. Security Incidents, Breaches, Attempts to Breach and Compromises – 1. Notification and Identification – Prime Vendor shall immediately notify CUNY of and create a Service Request and assign a Level 1 Incident relating to any of the following: A security breach, a failure of any security control, an attack on Prime Vendor's systems (regardless of whether any CUNY Data or the Prime Vendor Environment was accessed or potentially compromised) or a suspected breach of the Prime Vendor Environment (Production or Non-Production Instances), or any part thereof, and whether in the primary or secondary data center. Prime Vendor shall respond and resolve such Service Requests in accordance with Section 5.5 of Attachment C, provided that Prime Vendor shall immediately commence isolating and containing the spread of any Incident once detected or reported, and shall use its continuous and dedicated efforts on a 24 x 7 basis to remediate such Incident. The Prime Vendor Information Security Officer shall be the primary liaison between Prime Vendor and CUNY during any such security breach. 2. Investigative Reporting; Root Cause Determination and Monthly Reporting – Prime Vendor shall undertake an investigation and perform a root cause analysis of any security Incident that involves a security or suspected security breach of and/or failure of a security control relating to the Prime Vendor Environment. The results of the analysis will be documented and any remaining high risk open Issues will be addressed and/or corrected, if applicable, by Prime Vendor within five (5) days from the completion of such investigation and root cause analysis. The Prime Vendor Information Security Officer shall be the primary liaison between Prime Vendor and CUNY during any such investigation and root cause analysis. Prime Vendor shall provide monthly security Incident reports to CUNY depicting Incidents that occurred or are ongoing during the month, corrective actions taken, and any ongoing remediation efforts necessary to correct identified problems. 3. Prime Vendor Cooperation with CUNY – Prime Vendor shall cooperate fully with CUNY at any time CUNY needs to investigate a potential misuse or threat to the Application or the operation of its systems that interact with the Application. At the request of CUNY, the Prime Vendor Information Security Officer shall be available to be the primary li-18-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

G.

H.

I.

J.

K.

L.

aison between Prime Vendor and CUNY during any such investigation. 4. Computer Crimes – Prime Vendor shall immediately notify CUNY of any computer crimes involving CUNY or any CUNY Data that become known or are suspected by Prime Vendor. e-Discovery – Prime Vendor shall respond on a timely basis and at CUNY's expense at the Service Rate(s) to requests by the CUNY Office of General Counsel or its designee to comply with CUNY records hold and electronic records discovery requirements. Media Disposal – Prime Vendor shall wipe/erase all media to be disposed of containing CUNY Applications and CUNY Data according to Media Sanitization Procedures standards defined by the National Institute of Standards and Technology (NIST), currently found at http://csrc.nist.gov/publications/nist pubs/800-88/NISTSP80088_rev1.pdf. Prime Vendor shall clear/erase all CUNY-specific configurations stored in hardware or firmware to be disposed of or repurposed for non-CUNY use prior to disposal or repurposing. On an annual basis upon CUNY's written notice to Prime Vendor and at a mutually agreeable time (but subject to the further terms below), Prime Vendor shall retain, at no additional cost to CUNY, an independent Third Party to perform security penetration testing (“Ethical Hacking”) against the Applications. The Third Party and CUNY shall discuss the scope of the Ethical Hacking tests using industry best practices as the Third Party and CUNY agree, including references to practices, methodologies and techniques set forth in the NIST Special Publications 800 Series, OWASP (Open Web Application Security Standard), and OSSTMM (Open Source Security Testing Methodology Manual). Ethical Hacking testing will be conducted during periods other than test period exclusion time periods agreed to between the Third Party and CUNY and communicated to Prime Vendor, which exclusion time periods will generally relate to high-volume production period. If Prime Vendor has a concern over the exclusion time period, Prime Vendor and CUNY will meet to address Prime Vendor's concerns. Testing shall take place during times other than the agreed to exclusion windows and without Prime Vendor’s knowledge of the specific date and time of the test. Upon the completion of the Ethical Hacking testing, Prime Vendor shall provide the written results of the test to CUNY along with any remediation plan to address any gaps in security. Device Connection – Prime Vendor shall ensure that any of its Devices (including mobile Devices) that connect to the Hosting Services comply with CUNY Policies, including the Security Policies and Procedures. Internal Security Policies – Prime Vendor shall provide CUNY with copies of its internal security policies governing data center operations, including physical security, operating system security and network security. If Prime Vendor uses any subcontractor to provide Hosting Services, Prime Vendor shall provide CUNY with copies of the internal security policies of such subcontractor governing data center operations, including physical security, operating system security and network security. Virtualization – Any use of virtualization and/or multi-tenant shared infrastructure or technology by Prime Vendor shall provide sufficient isolation so as not to compromise, degrade or diminish the security or privacy of CUNY -19-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Applications and CUNY Data or of the Prime Vendor Environment. Prime Vendor’s use of any virtualization and/or multi-tenant shared technology shall be subject to CUNY’s prior written consent. 1.11.2

CUNY Responsibilities

CUNY will: A. B. C.

1.12

Be responsible for maintaining access control lists for users requiring access to the Prime Vendor Environment. Add, modify and delete CUNY end-user accounts as needed. Maintain Application security configurations needed, roles, permission lists and user profiles.

Performance Management 1.12.1

Prime Vendor Obligations

Prime Vendor shall: A. B. C. D. E. F. G.

Monitor Performance Standards on a continuous real-time basis to meet the requirements of this Hosting Services Exhibit. Identify or determine Issues affecting Application performance. Facilitate the analysis of Application-related Issues with the appropriate software provider. Assist in troubleshooting Application performance Issues with Prime Vendor operational support services. Identify and isolate Issues to a specific extension, interface and/or report. Perform load testing of the Prime Vendor Environment whenever there is a new module, release or version of the Application. Resolve any performance Issues that cause performance to fall below agreed upon Performance Standards in accordance with and as defined in Attachment C.

Prime Vendor shall provide a monthly report detailing the foregoing activities for the previous month. 1.12.2

CUNY Responsibilities

CUNY will: A. B.

1.13

Submit Service Requests in connection with Application performance Issues upon discovery of such Issues. Assist Prime Vendor in troubleshooting Issues arising from extensions.

Prime Vendor Customer Support Center Prime Vendor’s Customer Support Center will provide support and assistance for incoming Service Request receipt and routing during the Primary Hours of Operation and will track progress to resolution as described below. Prime Vendor shall coordinate Issue -20-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

handling, resolution and escalation for any call within Prime Vendor's areas of responsibility. CUNY may contact the Customer Support Center via telephone and/or via the Prime Vendor Portal. 1.13.1

Prime Vendor Obligations – Customer Support Center

As part of the Customer Support Center services, Prime Vendor shall: A.

B. C. D. E.

1.13.2

Address Issues arising from the Hosting Services, including the computing server environment, database, remote access software, components of the Applications and other software included in the scope of Hosting Services (e.g., web server, app server, process scheduler), Prime Vendor LAN, hardware and operating system. Train the applicable CUNY personnel on the protocol for communicating Issues and provide training materials for use by CUNY personnel. Conduct status meetings on a weekly basis, or as needed, documenting discussions and agreements with CUNY. Resolve submitted Service Requests according to priority. Coordinate support and maintenance services Issues with CUNY and CUNY's Third Parties, when needed.

Prime Vendor Obligations – Service Request Process

The Service Request process provides for diagnosis and resolution of problems reported in connection with the Application. As part of this process, for each Service Request, Prime Vendor shall: A.

B. C. D. E. F. G. H. I. J. K. L. M.

Receive the Service Request from CUNY's authorized representative submitted either through the Prime Vendor Portal or by telephone via the Prime Vendor Customer Support Center. Generate Service Requests via events detected by Prime Vendor’s monitoring tools. Validate the Service Request that is generated by CUNY's authorized representative for identity and authorization. Acknowledge receipt of the Service Request received from CUNY's authorized representative. Perform initial problem determination so that the Service Request can be assigned to the correct Prime Vendor resource. Record an initial Incident Level as defined in Section 5.5 of Attachment C. Gather required information to facilitate determination of the cause of the Issue that is the subject of the Service Request. Track the Service Request for analysis and reporting. Provide CUNY a Service Request reference number. Perform problem diagnosis of the cause of the Issue. Determine potential resolution options. Determine the applicable resolution in conjunction with CUNY's support team. Escalate and resolve Service Requests in accordance with Section 5.5 of Attachment C. -21-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

N.

1.13.3

Proactively communicate with appropriate CUNY personnel regarding all Issues and other Defects, including providing updates at least every two (2) hours regarding the status of any Level 1 Defects and other Level 1 Incidents.

CUNY Responsibilities

CUNY will: A. B. C. D. E.

F. G.

H. I.

Submit CUNY Service Requests via CUNY authorized representatives. Submit each Service Request after the occurrence of the underlying Incident of which CUNY becomes aware. Submit support calls to the Customer Support Center or submit tickets via the Prime Vendor Portal. Participate with and assist Prime Vendor in resolving the Service Request. For Service Requests for Level 1 and 2 Incidents, provide an operational contact that will be available to Prime Vendor by telephone or pager on a 24 x 7 basis while Prime Vendor works towards closure of such Service Requests. Assist Prime Vendor in connection with fault isolation of Issues. Address Issues and questions related to CUNY's business processes and the functionality of the Applications and other software included in the scope of Hosting Services (such as how-to, feature/function questions). Address Issues related to extensions (once Prime Vendor is no longer providing Services under the applicable Statement of Work). Manage CUNY's internal communications.

1.13.4 Incident Levels. CUNY shall classify, or reclassify, as applicable, all Incidents as Level 1, Level 2 or Level 3 Incidents. Prime Vendor shall honor CUNY's classification. If subsequently Prime Vendor disagrees on the classification of any Incident, such dispute shall be escalated for resolution in accordance with the procedures set forth in the MSA. 1.13.5 Multi-Vendor Sourced Environment. Prime Vendor acknowledges that the Hosting Services and Applications are being deployed as one of several components of CUNY's total technology environment. As such, Prime Vendor shall cooperate with CUNY and all Third Parties that have services and/or products in CUNY's technology environment, including as set forth below, to minimize the disruptions and Incidents within CUNY's technology environment and interfaced Third Party systems. The following operational processes will govern the interactions between Prime Vendor, CUNY and Third Parties relating to the interoperability and functioning of the Applications and other CUNY's systems (each, a "Third Party Solution Provider"). Upon detecting an Incident, CUNY will make an initial determination of whether the Incident relates to the Hosting Services or Applications. If CUNY believes that the Incident relates to a CUNY Application, CUNY will notify the applicable software manufacturer for resolu-22CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

tion, and Prime Vendor will cooperate with the software manufacturer to resolve the Incident. If CUNY believes that the Incident relates to the Hosting Services, in whole or in part (a "Multi-Party Incident"), CUNY will notify Prime Vendor of the applicable Third Party Solution Provider, and Prime Vendor and the Third Party Solution Provider will respond and resolve the Multi-Party Incident. A.

Help Desk Interaction Process.

1.

If CUNY opens a ticket with Prime Vendor related to a Multi-Party Incident, Prime Vendor’s Help Desk will coordinate and cooperate with applicable Third Party Solution Provider as necessary to resolve the Incident. In order to resolve the Multi-Party Incident within acceptable timeframes, Prime Vendor’s Help Desk shall proactively communicate with the Help Desks of the applicable Third Party Solution Provider, while notifying CUNY-designated personnel in writing (including through e-mail) of the time and substance of all such communications.

2.

Prime Vendor and the applicable Third Party Solution Provider will transfer and track calls sent to and from their respective Help Desks. All information needed by CUNY to confirm the proper Help Desk pass offs from one desk to another will be made available to CUNY at times and formats as mutually agreed upon by the parties.

B.

Escalation Process.

If a ticket related to a Multi-Party Incident is handed off by Prime Vendor to a Third Party Solution Provider and then returned by a Third Party Solution Provider to Prime Vendor, or handed off by a Third Party Solution Provider to Prime Vendor and then returned by Prime Vendor to a Third Party Solution Provider, the ticket will be escalated to CUNY. The following steps will be followed by both Prime Vendor and the Third Party Solution Provider to ensure cooperative and timely resolution of the ticket: 1.

A triage event will be scheduled to include representatives from Prime Vendor, the Third Party Solution Provider and CUNY, if any Level 1 or Level 2 Incident is transferred (even once) back to the Help Desk that originally opened the ticket.

2.

If Prime Vendor and the applicable Third Party Solution Provider are unable to mutually determine the appropriate party responsible to resolve the ticket, CUNY will have the right to assign it to either Prime Vendor or the Third Party Solution Provider.

3.

If a Multi-Party Incident assigned to Prime Vendor for resolution by CUNY is transferred to a Third Party Solution Provider and eventually determined through root cause analysis ("RCA") to be a Prime Vendor responsibility, for purposes of measuring Interim Resolution and Final Resolution times, the entire time the ticket was unresolved shall be used in the calculation (i.e., both the time that the ticket was with Prime Vendor and the -23-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Third Party Solution Provider). This will provide an incentive for all providers to resolve the ticket expeditiously. 4.

Without limiting the other terms of this Section 1.13.5(B), CUNY may choose to have Prime Vendor conduct an RCA for any Multi-Party Incident.

In the process of monitoring and resolving Multi-Party Incidents the following dispute resolution or mutual alignment process will be invoked: The Prime Vendor Account Executive, a CUNY representative and the project executive for the applicable Third Party Solution Provider will meet as requested by CUNY to resolve all Issues. If they are unable to reach an agreement, the matter shall be referred to the Executive Sponsors for resolution.

1.14

Communications Management The parties will establish a formal management framework to enhance communication between the parties, identify weaknesses and strengths in the performance of Prime Vendor's obligations herein and CUNY Responsibilities, and coordinate ongoing operations and requirements with respect to the Hosting Services ("Communications Management"). The framework described herein is in support of ITIL procedures and industry best practices. 1.14.1

Prime Vendor and CUNY Joint Communications Management Responsibilities:

Communications Management Committee The parties will jointly: A. B. C. D. E. F. G. 1.14.2.

Appoint senior management representatives to participate in the Communications Management Committee. Hold formal Communications Management Committee meetings on a quarterly basis. Develop executive relationships between the parties. Develop and update strategies for ongoing Hosting Services. Approve strategies for introducing new and updated technology into the Hosting Services. Work to resolve escalated service related Issues. Review operational performance of the Hosting Services.

Service Delivery Management

Prime Vendor shall: A. B. C.

Assign a service delivery management team to deliver Hosting Services described in this Section. Facilitate completion of each phase of the Hosting Services. Advise CUNY regarding Enhancements applied to the Applications within the Prime Vendor Environment and as to training for CUNY personnel. -24-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

D. E. F. G.

H.

I.

1.14.3

Conduct status meetings on a weekly basis, and record discussions taking place during such meetings. Coordinate Prime Vendor visits to CUNY locations. Coordinate CUNY visits to Prime Vendor locations. Notify CUNY when a change to the Prime Vendor Environment, technology, best practices or other factors occurs that requires an update to plans and documents that underlie the Hosting Services, such as the Disaster Recovery and Business Continuity Plan, Technical Design and Architecture, escalation procedures, runbook(s) and the Procedures Manual. Create and update (as appropriate as a result of changes in the Prime Vendor Environment, technology, best practices or other factors) plans and documents that underlie the Hosting Services as referenced above. Facilitate a kickoff and planning meeting with CUNY to review this Hosting Services Exhibit and any applicable Project Agreement and/or Contract Supplement. The kickoff meeting shall include the following topics: 1. Review of Hosting Services to be provided. 2. Definition of the respective roles and responsibilities of each party. 3. Establishment of Hosting Services related implementation and production timelines.

CUNY Responsibilities – Service Scheduling

CUNY will: A. B. C. D.

1.14.4

Notify Prime Vendor when CUNY is ready to begin use of the Prime Vendor Environment to process production data for CUNY business transactions. Notify Prime Vendor when there is a change to CUNY's services schedule. Notify Prime Vendor when CUNY would like to visit Prime Vendor’s data center or when CUNY would like Prime Vendor to visit CUNY. Notify Prime Vendor when CUNY identifies a change to the Prime Vendor Environment, technology, best practices or other factors that requires an update to plans and documents that underlie the Hosting Services, as referenced above.

CUNY Responsibilities – Cutover Assessments

CUNY will assist in the preparation of, and provide updates to, Cutover assessments to confirm the production readiness of the Prime Vendor Environment, and correct discrepancies identified by Prime Vendor.

-25CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

2.0

ADDITIONAL TERMS

2.1

Access and Security

CUNY is responsible for issuing User IDs for CUNY-designated users, and for administering and maintaining such User IDs. The parties will work together during the implementation of a project on a collaborative and cooperative basis with respect to implementing CUNY's security procedures and practices, including the commitment of Prime Vendor Hosting personnel to work with Prime Vendor Consulting personnel in the design and configuration of CUNY's security procedures or practices. Prime Vendor shall not permit non-read infrastructure level access, or information on how to obtain such access, that in Prime Vendor’s sole judgment would potentially jeopardize the security or integrity of the Prime Vendor Environment. Prime Vendor shall permit CUNY with read-only access to the infrastructure level. The type of access that Prime Vendor shall grant on a readonly basis shall include, at CUNY's written election:     

Read only access to the database as described in Section 1.7.1(D) Read only access to report output Read only access to report logs Read/write access to the data files directory Other access as agreed to by the parties

Prime Vendor shall implement and transfer all data to CUNY, and any access shall be permitted only via an encrypted network connection.

2.2

Term of Hosting Services

Subject to CUNY's earlier termination rights as set forth in the MSA, the initial term of Hosting Services will commence on the Effective Date and will end five (5) years after Cutover (the "Initial Hosting Term"). Subject to the approval of the New York Office of the State Comptroller, CUNY shall have five (5) successive one (1) year renewal options to commence immediately after expiration of the Initial Hosting Term (each, a "Hosting Renewal Option"), which options are exercisable by CUNY upon written notice to Prime Vendor no less than ninety (90) days prior to the expiration of the Initial Hosting Term or then-current Hosting Renewal Option period, as applicable. If the Hosting Renewal Option does not involve any change to the then-current Prime Vendor Environment or to the scope of the Hosting Services, then the Monthly Hosting Fees for the Hosting Renewal Option period will be calculated in accordance Section 2.0 of Attachment D. If the Hosting Renewal Option involves change to the then-current Prime Vendor Environment or to the scope of the Hosting Services, the Change Order for the Hosting Renewal Option period shall contain applicable adjustments to the scope, Prime Vendor Environment and pricing (based on the ARCs, and if the ARCs are not applicable, from Prime Vendor’s then current list rates, subject to any discounts mutually agreed to by the parties) of the Hosting Services for the Hosting Renewal Option period.

-26CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

The Initial Hosting Term and, if the Hosting Renewal Option is exercised, the Hosting Renewal Option period are collectively referred to as the "Hosting Term."

2.3 Event of Default and Termination for Chronic Performance Standards Failures A Prime Vendor Event of Default shall be deemed to occur and this Hosting Services Exhibit may be terminated by CUNY, in CUNY’s sole discretion, if: A.

B. C. D.

Prime Vendor fails for two (2) consecutive months or for any four (4) months during any twelve (12) month period to meet any of the following performance levels for a particular month: (i) Production Application Pillar Availability: Achievement of less than ninety-nine and one half percent (99.50%) Production Application Pillar Availability; (ii) Application Response Time: Achievement of less than eighty-five percent (85%) of all Transactions executed within a twenty percent (20%) deviation of the Performance Standard; and/or (iii) Service Request Response and Resolution Time for all Service Requests for Level 1 Incidents: Achievement of less than ninety-five percent (95%) of Service Requests within the Performance Standard; Security Management: Any failure by Prime Vendor to conform to the security terms and conditions set forth in Section 1.11; Disaster Recovery: Recovery time is greater than eight (8) hours or recovery point is greater than fifteen (15) minutes; and/or CUNY is entitled to one hundred percent (100%) of the At Risk Amount in Performance Credits during any two (2) months during any twelve (12) month period (subsections (A) through (D) are individually referred to as a "Chronic Performance Standards Failure" and collectively referred to as "Chronic Performance Standards Failure(s)").

CUNY shall provide written notice of termination, and the date for termination, to Prime Vendor within ninety (90) days following the end of the month in which CUNY is eligible to exercise its right to terminate under this Section, provided that a subsequent cure of the performance shall not diminish CUNY's right to terminate.

2.4

Hosting Systems Decommission

During the Hosting Term at any time, and upon the expiration of the Hosting Term or the earlier termination of the Hosting Services, at no additional cost or fee to CUNY, Prime Vendor shall provide CUNY with: (A) two (2) complete and correct copies of each of the Prime Vendor Environments, including all databases, in an industry standard format selected by CUNY, provided that if Prime Vendor does not use such format, then on an industry standard format mutually agreed to by the parties; and (B) the following Knowledge transfer:   

Release levels and patch levels for each Application and associated databases and operating systems Documentation of technology stack The then-current Procedures Manual -27-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit





Information regarding the following topics:  Installation  Logins for environment-specific accounts  Operations procedures Keys used to encrypt and decrypt CUNY Data to disk, database or media

If CUNY elects to have Prime Vendor maintain the Prime Vendor Environment after Prime Vendor complies with its transition Services obligations under the MSA, provided CUNY agrees to pay Prime Vendor for the Monthly Hosting Fees for such month or months, as applicable, Prime Vendor shall maintain as fully operational (in accordance with the terms of this Hosting Services Exhibit) the then-current Prime Vendor Environment on a month-to-month basis.

2.5

Transition of Hosting Facilities

If Prime Vendor wants to change or move the hosting facilities or hosting subcontractors, if any, Prime Vendor shall provide written notice to CUNY at least one hundred eighty (180) days prior to the Prime Vendor-requested termination date, and such written notice shall be accompanied by a detailed written transition plan ("Hosting Transition Plan") sufficient to demonstrate a transition at Hosting Services performance levels in accordance with this Hosting Services Exhibit to Prime Vendor or another hosting provider or facility. The parties shall meet to discuss any concerns that CUNY may have with respect to the Hosting Transition Plan. Upon CUNY's written consent that the Hosting Transition Plan and successor are acceptable, Prime Vendor shall be permitted to transition the Hosting Services to another facility or provider, but only in accordance with the agreed to Hosting Transition Plan. Any change to the Hosting Transition Plan shall be subject to CUNY's written consent, which consent shall be provided in CUNY's sole discretion, prior to implementing any such change.

2.6

Controls Over Financial Reporting and Operations

2.6.1 Audits. The terms and conditions set forth in this Section (and Prime Vendor's obligations under this Section) shall apply to Prime Vendor and to each Prime Vendor subcontractor providing any component of the Hosting Services (and, where appropriate, each reference to Prime Vendor in this Section shall be read to mean and include any such subcontractors). Prime Vendor shall cause each subcontractor providing any component of the Hosting Services to comply with the terms set forth in, and Prime Vendors obligations under, this Section. Without limiting the generality of the foregoing, Prime Vendor's data center provider (if an entity other than Prime Vendor) shall constitute a subcontractor for purposes of the MSA. 2.6.1.1

General.

In connection with providing the Hosting Services, Prime Vendor shall comply with SOC 2 criteria for complying with the trust services principles (collectively, the "Control Objectives"). Prime Vendor shall not alter or modify the descriptions of the Control Objectives, and compliance shall include all five (5) trust services principles as specified in the Guide: Reporting on Controls at a Service Organization (SOC 2) published by the AICPA (“SOC 2 Guide”). Prime Vendor shall provide to CUNY for its review no later than sixty (60) days prior to the commencement of Prime Vendor audits undertaken in this Section 2.6.1 an electronic or written copy of the scope of audit (including the services, testing scope and procedures, reporting procedures relating to deficiencies, control environment -28CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

and customer reporting), and any additional Control Objectives beyond those specified by the SOC 2 Guide used or to be used in the audits described below in this Section 2.6.1. Control Objectives shall include the audit of policies, practices and procedures involving the delivery of Applications and other CUNY systems via mobile Devices and platforms. If CUNY determines as a result of any such review that Prime Vendor must comply with additional Control Objectives or expand the scope of its audit, CUNY shall so notify Prime Vendor in writing and such Control Objectives and/or expanded scope of audit thereafter shall constitute the scope of audit and/or Control Objectives for purposes of this Hosting Services Exhibit. If Prime Vendor wants to change the Control Objectives or reduce the scope of audit subsequent to the delivery of the last SOC 2 Type 2 Report, Prime Vendor shall so notify CUNY in writing at least sixty (60) days prior to the proposed change, including identifying the planned effective date of such change, and such proposed changed Control Objectives or scope of audit shall be subject to the CUNY review process described above in this Section. Prime Vendor shall cooperate with CUNY and its auditors (including CUNY's internal or independent Third Party auditors) in connection with the terms, obligations and rights set forth in this Section 2.6. 2.6.1.2

SOC 2 Type 2 Reports. A.

By Prime Vendor. In accordance with the requirements set forth in this Section, Prime Vendor shall cause a nationally-recognized certified public accounting firm to conduct audits with respect to the Control Objectives for each six (6)-month period that begins on January 1 or July 1, as applicable, during the Hosting Term and to promptly prepare SOC 2 Type 2 Reports following each such audit. No later than September 1 for the audit ending the June 30 period, and no later than March 1 for the audit ending the December 31 period, Prime Vendor shall deliver to CUNY a full and complete electronic copy of each such SOC 2 Type 2 Report. Within thirty (30) days following CUNY's written request for a letter updating the most recently issued SOC 2 Type 2 Report, an authorized senior executive corporate officer of Prime Vendor shall deliver to CUNY a bridge letter that contains a written description of any material changes to the control environment that would adversely affect the prior delivered SOC 2 Type 2 Report to cover the time period not covered under the scope of such most recently issued audit report from the date of such report until the date requested in CUNY’s written request, or if there have not been any such changes, a letter stating that there have not been any changes since the date of the most recently issued report.

B.

By CUNY. At CUNY's request and its sole cost and expense, CUNY shall have the right (either through its own audit staff or an independent Third Party auditor) to conduct reviews and audits of the type covered by SOC 2 Type 2 Reports or other reviews and audits to ensure compliance with the Control Objectives and Prime Vendor's other obligations under the MSA. Such reviews or audits will be conducted during regular business hours beginning within thirty (30) days of CUNY’s request, will be subject to Prime Vendor’s reasonable security policies (which will not apply to the extent they prevent or interfere with CUNY's right to conduct a -29-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

review or audit as described in this Section) and will not unreasonably interfere with Prime Vendor’s business activities. Further, within the scope of each such review or audit, such reviewers and/or auditors shall have the right to examine and audit the Records and question and interview any personnel with knowledge about the Control Objectives and other financial, operational, security, physical or other aspects of the Hosting Services. If the report identifies any test result deviations or Deficiencies requiring remediation, CUNY shall deliver to Prime Vendor a full and complete copy of the report. C.

2.6.2

Auditor Independence. As of the Effective Date, Prime Vendor uses ___________ to conduct its SOC 2 Type 2 audits and Prime Vendor's subcontractor uses ____________ to conduct its SOC 2 Type 2 audits. In order to assure auditor independence, Prime Vendor shall provide CUNY at least ninety (90) days prior written notice if Prime Vendor intends to use an auditing firm other than __________ to conduct such audits, and shall discuss with CUNY, and address any concerns that CUNY may have regarding such change of auditors.

Maintenance of Records.

Prime Vendor shall develop and maintain appropriate books and records documenting the Control Objectives, and such records shall include the auditor's work papers (collectively, "Records"). Prime Vendor shall make copies of the Records available to CUNY and its auditors in electronic and paper format at no additional charge to CUNY, and CUNY and its auditors shall be permitted to retain a copy of such Records. 2.6.3

Results of Inquiries and Remedial Plan.

If any SOC 2 Type 2 Report or other audit report (whether conducted under Section 2.6.1.2(A) or Section 2.6.1.2(B)) reveals any deficiencies and/or exceptions with respect to the Control Objectives or otherwise that impact CUNY (the "Deficiencies"), Prime Vendor shall prepare and deliver to CUNY a detailed plan for remedying all such Deficiencies (each such plan, a "Remedial Plan"). Prime Vendor shall deliver such Remedial Plan to CUNY within a reasonable period of time following identification of any Deficiencies based on the nature and complexity of the Deficiencies to be remedied, not to exceed thirty (30) days following CUNY's written request for same. Prime Vendor shall bear all costs and expenses associated with correcting all Deficiencies. 2.6.4

Subcontractors.

Without limiting the other terms and requirements set forth in Section 10.4 of the MSA (including the requirement to identify CUNY as a direct and intended third party beneficiary in any subcontractor agreement), any agreement between Prime Vendor and a subcontractor that will be providing any component of the Hosting Services must include substantially the same terms as those set forth in this Section 2.6 (modified as appropriate since the agreement will be one between Prime Vendor and the applicable subcontractor). As provided in Section 10.4 of the MSA, at the request of CUNY, Prime Vendor shall provide CUNY with a full and complete copy of any proposed or signed agreement with the subcontractor (pricing may be redacted), to ensure that the subcon-30CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

tracted Services or other items are adequately covered, and CUNY may condition the approval of any subcontractor based on Prime Vendor's (and/or its subcontractor's) compliance with the foregoing. 2.6.5

Costs.

Except as otherwise expressly provided otherwise in this Section 2.6 to the contrary, each party shall bear its own costs and expenses incurred in connection with performing its obligations and/or exercising its rights under this Section 2.6, including costs and expenses charged by its own independent auditors.

2.7

Procedures Manual 2.7.1

Development and Ongoing Maintenance of Procedures Manual.

Prime Vendor shall develop and regularly update a detailed, CUNY-specific procedures manual that minimally includes the contents described in Section 2.7.2 below (the "Procedures Manual"). Prime Vendor shall deliver the first draft of the Procedures Manual to CUNY for its review, comments and approval within sixty (60) days prior to Cutover, and thereafter promptly shall consider incorporating into the Procedures Manual CUNY's comments and suggestions. If Prime Vendor fails to deliver the final draft Procedures Manual to CUNY on or before Cutover, CUNY shall have the right to suspend any and all payments then due or to become due and owing to Prime Vendor until Prime Vendor complies with the terms of this Section. The Procedures Manual is a Deliverable subject to the terms of the MSA. From and after approval of the Procedures Manual by CUNY, Prime Vendor shall make available online or deliver to CUNY on a quarterly basis and for its review and comments, an updated Procedures Manual, which shall reflect appropriate additions, changes and/or updates. The Procedures Manual shall be made available online in a downloadable, editable format or delivered to CUNY in an editable electronic format (such as Microsoft Word). 2.7.2

Contents.

The Procedures Manual shall include and/or describe the following items and such other items as are appropriate or necessary to have a full and complete understanding of the Prime Vendor Environment: A.

B. C. D. E.

Copies of the then-current Technical Design and Architecture, including systems, infrastructure and applications, (which Prime Vendor shall update, if changes have occurred, each time the Procedures Manual is updated), and the then-current Disaster Recovery and Business Continuity Plan (which Prime Vendor shall update, if changes have occurred, each time the Procedures Manual is updated). Back-up, data recovery, data aging and data archiving procedures. Listing of, and procedures for using, tools used to monitor and maintain the Prime Vendor Environment. Listing of, and procedures for executing, batch programs and other scripts developed to run processes on the system. Listing of all Third Party software required to run the system, including manufacturer and release and version levels. -31-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

F. G. H. I. J. K. L. M. N.

System configuration layout. Description and copies of all policies and access permissions configured into the Application(s). Description and copies of all security-related policies and procedures. Runbooks and related instructions provided by CUNY, as appropriate. System, infrastructure and application installation and configuration guides for the as-built environment. Change management procedures for changes in infrastructure components. Security Incident response methodology and plan Disaster Recovery and Business Continuity procedures. Notification process and list of CUNY individuals to be notified by Prime Vendor in particular situations.

2.8 Prime Vendor Environment Documentation and Transition to In-House Solution Upon request, Prime Vendor shall provide CUNY with full and complete Documentation on the Prime Vendor Environment sufficient to enable CUNY to replicate the operating environment used by Prime Vendor to CUNY, including, the complete technical architecture, operating procedure manuals, runbook(s), and release and version levels of all operating system software, middleware and other software used as part of the Prime Vendor Environment.

2.9

Technical Assistance and Knowledge Transfer

Prime Vendor shall transfer information and knowledge relating to the Prime Vendor Environment, the processes and procedures Prime Vendor uses to manage the Instances, and other technical detail to enable CUNY to maximize its ability to operate and support the system(s) on a going forward basis ("Knowledge"). Without limiting the generality of the foregoing, Prime Vendor shall provide electronic and printed copies of its runbooks and other procedures Documentation to CUNY, and shall review, educate and inform CUNY on the contents thereof and any strategies involved in arriving at the policies and procedures used by Prime Vendor as reflected therein. The transfer of Knowledge shall also include information on the following: (a) Maintenance and support tools, utilities, diagnostic programs and supporting programs utilized by Prime Vendor in the support and maintenance of the Applications, interfaces and other Deliverables; (b) Security requirements and methodologies implemented to prevent or detect unauthorized access, and any networking security tools; (c) Methodologies that address traffic management, workload balancing, segmentation, routing and overall network performance analysis; (d) analysis;

The installation/maintenance of tools to support network performance

(e) Management and troubleshooting, including how to install and utilize management and remote troubleshooting tools; -32CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

(f) Any and all updated, changed or revised policies, practices, procedures, processes and/or techniques with respect to the Knowledge previously transferred to CUNY hereunder.

-33CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

3.0 HOSTING DEFINITIONS AND TERMS The following definitions and terms apply to this Hosting Services Exhibit and will supersede any conflicting terms in the MSA. "Additional Resource Charges" or "ARCs" means charges, in addition to the Monthly Hosting Fees, for items identified in Attachment D, and purchased by CUNY through a purchase order or, as applicable, authorized pursuant to a Change Order. "Application Pillar" means a single set of related Applications (e.g., the PeopleSoft Human Resources Application Pillar includes human resources, payroll, benefits, etc.), and the Application modules within an Application Pillar that together support a common functionality, requiring all the user data and online application objects to reside in a single Instance and utilize a single Instance. "Application Response Time" is described in Section 5.3 of Attachment C to this Hosting Services Exhibit. "Application Response Time Hours" is described in Section 5.3 of Attachment C to this Hosting Services Exhibit. "At Risk Amount" is defined in Section 2.3 of Attachment C. "Chronic Performance Standards Failures" is defined in Section 2.3. "Communications Management" is defined in Section 1.14. "Concurrent User" means an individual person actively utilizing system processes involving submitting requests, receiving results of requests from the system, and viewing the results of the requests. An individual who is logged on to multiple sessions is considered one (1) Concurrent User. Calls to and from a system from a computer or other device, including calls to the database to retrieve and/or send data, shall not constitute, or be counted as, a Concurrent User. "Control Objectives" is defined in Section 2.6.1.1. "Cutover" means the date that CUNY's production system will be in use from Prime Vendor's facilities for CUNY's business operations, and, as of the Effective Date, is ____________, 2014. "Data Protected by Law" means data regulated and/or protected by Law, and includes all Laws that prohibit or limit disclosure. "Deficiencies" is defined in Section 2.6.3. "Device" means a desktop, laptop, smart phone or other mobile or other electronic device. "Disaster" is defined in Section 1.5.5. "Disaster Recovery Restoration" is described in Section 5.4 of Attachment C. -34CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

"End Point Protection Platform" means a solution that converges endpoint device security functionality into a single product that delivers antivirus, anti-spyware, personal firewall, application control and other styles of host intrusion prevention (for example, behavioral blocking) capabilities into a single and cohesive solution, including integrated vulnerability, patch and configuration management capabilities for proactive protection, data protection features, such as disk and file encryption, data loss prevention, and device control, and device endpoints, including the management and tracking of mobile Devices. "Enhancements" means all Functionality Releases and Maintenance Code Releases. "Ethical Hacking" is defined in Section 1.11.1(I). "Functionality Releases" means software code releases provided by software providers, such as tool upgrades to the Application or service packs, and any release containing new functionality, that are designed to change the functionality or intended results of processing data where such change represents a departure from the originally designed functionality. Functionality Releases may include Maintenance Code Releases. "Gain Sharing/Improvement Opportunity" is defined in Section 4.0 of Attachment D. "Hosting Renewal Option" is defined in Section 2.2. "Hosting Services Exhibit" means this Exhibit 2. "Hosting Stabilization Period" is defined in Section 4.1 of Attachment C. "Hosting Term" is defined in Section 2.2. "Hosting Transition Plan" is defined in Section 2.5. "Incident" means any Level 1 Incident, Level 2 Incident or Level 3 Incident. "Incident Response" means a fax, email, update to or telephone call from Prime Vendor acknowledging that an Incident Report has been received and that appropriate technical personnel have been assigned to work on the Incident. "Included Maintenance" is defined in Section 1(D). "Initial Hosting Term" is defined in Section 2.2. "Instance" means a single set of related objects, including but not limited to, the software module(s), users data, configuration, and custom objects (e.g., conversions, customizations, extensions, modifications, localizations, and interfaces) that support a common functionality or business process (e.g., Financials, PeopleSoft Portal, Human Capital Management, Campus Solutions). Instances are further classified to specify the purpose and use of the Instance, such as Production (PRD), Production Staging (PSTG), Sandbox/Demo (SND/DMO), Testing (TST) and Development (DEV). The software module(s) that reside in an Instance are defined by the manufacturer of the software in the user manuals. -35CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

"Interim Resolution" means Prime Vendor: (a) reinitiates or restarts, as applicable, the Hosting Services or Applications, if the reported Issue caused the Hosting Services or Applications to be inoperative; (b) enables CUNY to access the Hosting Services or Applications, as applicable, if the reported Issue caused CUNY to be unable to access the Hosting Services or Applications; or (c) provides CUNY with a workaround acceptable to CUNY that solves or mitigates a reported Incident. "ITIL" is defined in Section 1(C). "Knowledge" is defined in Section 2.9. "Level 1 Incident" means any failure to provide the Hosting Services, including a failure to meet the Performance Standards, that directly or significantly impacts the ability to use one or more Applications, or materially exposes CUNY to liability because of operational, business, financial or information deficiencies. "Level 2 Incident" means any failure to provide the Hosting Services, including a failure to meet the Performance Standards, that adversely affects CUNY's use of one or more Applications. "Level 3 Incident" means any failure to provide the Hosting Services, including a failure to meet the Performance Standards, that causes minor problems to occur with the Hosting Services or an Application that can be circumvented without difficulty or disruption to CUNY's operations. "Maintenance Code Release" means any software code release provided by Prime Vendor designed to address the manner of processing data or operating the Application (e.g., any software patch, fix, tools update, tax update, bug fix, maintenance packs, etc.). Maintenance Code Releases do not include any Functionality Releases. "Monthly Hosting Fees" means Prime Vendor’s regularly recurring fees payable in connection with its performance of Hosting Services for a single calendar month, as set forth in Attachment D and as adjusted in accordance with the terms and conditions of this Hosting Services Exhibit. The Monthly Hosting Fees do not include ARCs or one-time fees or costs agreed to by the parties via the Change Order procedures. "Monthly Performance Report" is defined in Section 1.2 of Attachment C. "Multi-Party Incident" is defined in Section 1.13.5. "Non-Production Infrastructure Availability" means the availability of development, test and other Non-Production Instances. "Non-Production Instance" means any of the components of the Prime Vendor Environment that do not comprise Production Instances. "Page Load Data Point(s)" is defined in Section 5.3.2 of Attachment C. "Performance Credit(s)" means a credit deducted from the Monthly Hosting Fees in connection with one or more Performance Standard Failures, as described in Section 2.0 of Attachment C. -36CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

"Performance Standards" means the level of performance, as stated in Section 5.0 of Attachment C, at which Prime Vendor is required to perform a particular function, service or subset of the Hosting Services. "Performance Standard(s) Failure(s)" means the failure of Prime Vendor to perform a function, service or subset of the Hosting Services at a level equal to or greater than the applicable Performance Standard during a month of the Hosting Term. "Point(s) of Demarcation" means and includes the router(s) and/or device(s) where the telecommunication circuits providing connectivity between the Prime Vendor’s hosting site(s) and CUNY's systems terminate. "Primary Hours of Operation" or "PHO" means the hours in which the Prime Vendor Customer Support Center is staffed, which shall be 24 x 7 x 365. "Prime Vendor Environment" means the Instances identified in Attachment B or otherwise needed, necessary or required to operate the Application in accordance with and to meet the Performance Standards and the other terms and conditions of this Hosting Services Exhibit. "Prime Vendor Personnel" is defined in Section 1.11.1(D)(1). "Prime Vendor Portal" means the Internet-based portal provided by Prime Vendor as part of the Hosting Services as described in Section 1.1 of Attachment C. "Procedures Manual" is defined in Section 2.7.1. "Production Application Pillar Availability" is described in Section 5.1 of Attachment C. "Production Baselining Period" is defined in Section 3.3 of Attachment C. "Production Instance" means an Instance within the Prime Vendor Environment in which CUNY users process live business data as part of CUNY's business transactions or develop Applications for live business data. "RCA" is defined in Section 1.13.5(B)(3). "Records" is defined in Section 2.6.2. "Reduced Resource Charges" or "RRCs" means the reduced charge for removing a Service subject to an Additional Resource Charge as described in Section 3 of Attachment D and shall be equal in value to the ARC rate for that Service. "Refresh" is defined in Section 1.7.1(P). "Remedial Plan" is defined in Section 2.6.3. "Scheduled Downtime" means the period of time that one (1) or more components of an Application, whether in the production or non-production Prime Vendor Environment, is unavailable due to scheduled system maintenance. Scheduled Downtime may affect Prime Vendor customers individually or as a group. Scheduled Downtime may include proactive -37CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

software maintenance, CUNY-specific infrastructure upgrades, or relocation or reconfiguration of the production Prime Vendor Environment. Prime Vendor will work with CUNY to define Scheduled Downtime windows for maintenance each month for one (1) year in advance. For any Scheduled Maintenance outside the planned schedule, seven (7) days prior written notice to, and agreement with, CUNY will be required. The production Prime Vendor Environment will have a maximum of twelve (12) hours of Scheduled Downtime per month, scheduled at Prime Vendor’s discretion, but only between 8 p.m. on Saturday to 8 a.m. on Sunday Eastern time. The parties can increase such Scheduled Downtime due to circumstances presented by CUNY and/or Prime Vendor, subject to the Change Order procedures or as mutually agreed. If a portion or all of the maintenance period is not required, the Prime Vendor Environment will be available to CUNY. If emergency maintenance is required, Prime Vendor shall provide reasonable advance notification of the maintenance, and such downtime shall be added to the permitted Scheduled Downtime timeframe. "Security Management" is described in Section 5.6 of Attachment C. "Service Request" means any request related to the Hosting Services that is submitted to the Customer Support Center by telephone, via Internet, or by Prime Vendor through a Prime Vendor monitoring tool or otherwise to the Customer Support Center. "Service Request Response and Resolution Time" is described in Section 5.5 of Attachment C. "SOC 2 Guide" is defined in Section 2.6.1.1. "SOC 2 Type 2 Report" means a report, issued pursuant to the Public Company Accounting Oversight Board's AT Section 101, Attest Engagements (as the same may be modified from time-to-time, including any replacement or successor standard), on a service organization's controls over the security, availability and processing integrity of the service organization's system, the confidentiality of the information that the service organization's system processes or maintains for user entities, and the privacy of personal information that the service organization collects, uses, retains, discloses and disposes of for user entities. "Technical Design and Architecture" is defined in Attachment B. "Third Party Solution Provider" is defined in Section 1.13.5. "Unscheduled Downtime" means the total time, other than Scheduled Downtime, during which CUNY is unable to access an Application.

-38CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT A APPLICATION LISTING* (INCLUDING ALL RELATED CONVERSIONS, CUSTOMIZATIONS, EXTENSIONS, MODIFICATIONS, LOCALIZATIONS, AND INTERFACES)

Financials General Ledger Receivables (non-student) Asset Management Cash Management Deal Management Billing (non-student) Expenses Payables eProcurement Supplier Connection Purchasing eSettlements Human Capital Management Human Resources Benefits Administration Payroll for North America Payroll Interface Time and Labor eProfile eProfile Manager Desktop ePerformance ePay eBenefits eDevelopment eCompensation Manager Desktop eCompensation Talent Acquisition Manager Candidate Gateway Absence Management Campus Solutions Academic Advisement Campus Community Financial Aid Recruiting & Admissions Student Financials Student Records -39CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Campus Self-Service Gradebook Personal Portfolio Contributor Relations Customer Relationship Management Marketing Online Marketing Telemarketing Support Support for Customer Self-Service Multi-channel Communications Help Desk for Human Resources Help Desk Help Desk for Employee Self-Service Help Desk for Human Resources Dashboard CTI Integration Reporting Applications PeopleSoft Enterprise Performance Management Warehouse CRM Warehouse Customer Marketing Mart Sales mart Services Mart Customer Scoreboard Financial Warehouse Advanced Cost Accounting Mart Scoreboard Planning and Budgeting Enterprise Service Automation Mart GL and Profitability Mart Payables Mart Receivables Mart Real Estate Mart HCM Warehouse Compensation Mart Learning and Development Mart Recruiting Mart Workforce Profile Mart Workforce Planning Workforce Scoreboard Supply Chain Warehouse Fulfillment and Billing Mart Inventory Mart Procurement Mart -40CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Spend Mart Supply Chain Planning Mart Supplier Rating System Activity Based Mgt. Campus Solutions Warehouse Enterprise Portal Enterprise Portal HRMS Portal Pack Financials Portal Pack Supply Chain Portal Pack CRM Portal Pack EPM Portal Pack Asset Management Portal Pack ESA Portal Pack Other Enterprise Learning Management Fusion Middleware for PeopleSoft Enterprise BPEL Process Manager Option Product Information Data Librarian Customer Data Librarian Directory Interface User Productivity Kit/Content Material WebSphere/WebLogic for PeopleSoft Enterprise PeopleTools - Enterprise Development PeopleSoft Performance Monitor Third Party Applications – Licensed under PeopleSoft Microfocus Crystal Reports for PeopleSoft Enterprise (third party product) Crystal Enterprise/Business Objects for PeopleSoft Enterprise Third Party Hosted Applications for CUNYfirst Control-M Agents Runner Technologies (Zip codes) Phire Golden Gate Oracle OHS Servers Oracle OAM Webgates

*Not all of these Applications have been implemented by CUNY as of the date of issuance of the Request for Proposals. The foregoing list shall remain effective regardless of any renaming, rebranding, bundling or debundling of the Application by the software provider.

-41CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT B PRIME VENDOR ENVIRONMENT AND TECHNICAL DESIGN AND ARCHITECTURE This Attachment describes the Prime Vendor Environment and the Technical Design and Architecture that will be provided and used by Prime Vendor to provide the Hosting Services. Except as provided below, references to the Instances, technical design and architecture are provided on an information basis only and shall not operate to limit or diminish Prime Vendor's obligations to provide the Hosting Services in accordance with the Performance Standards and other terms and conditions set forth in this Hosting Services Exhibit.

1.0

Summary of Production and Non-Production Instances

The Prime Vendor Environment will consist of the Production and Non-Production Instances listed below. The Production Instances will be logically separate from the Non-Production Instances, and the Prime Vendor Environment will be logically separate from any other customer of Prime Vendor. Prime Vendor shall ensure that data in the Non-Production Instances will not egress the Prime Vendor Environment, except upon code promotion. To the extent additional Instances are required or needed to meet the CUNY Requirements, such additional Instances will be provided by Prime Vendor at no additional cost to CUNY. Without limiting the generality of the foregoing, any Instances implemented prior to Project Completion of the Migration Project shall be provided at no additional cost to CUNY. Instances required for disaster recovery and performance testing purposes will be in addition to the Instances listed below and shall be provided by Prime Vendor at no additional charge to CUNY. Provided such usage is coordinated with and approved in advance by CUNY, Prime Vendor shall be permitted to use the disaster recovery Instances for performance testing, as needed.

Application Pillar FSCM FSCM FSCM FSCM FSCM FSCM FSCM FSCM FSCM FSCM

Instance DMO DEV CFG CNV FIT SIT UAT TST TRN GOLD -42-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Category Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production

Protected by Identity Management System (IMS)* No No No No No No Yes Yes Yes Yes

Application Pillar FSCM FSCM FSCM FSCM FSCM FSCM CS CS CS CS CS CS CS CS CS CS CS CS CS CS CS CS HCM HCM HCM HCM HCM HCM HCM HCM HCM HCM HCM HCM

Instance PDEV PTST PSTG PREP PROD SND DMO DEV CFG CNV FIT SIT UAT TST TRN GOLD PDEV PTST PSTG PREP PROD SND DMO DEV CFG CNV FIT SIT UAT TST TRN GOLD PDEV PTST -43-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Category Production Production Production Production Production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Production Production Production Production Production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Non-production Production Production

Protected by Identity Management System (IMS)* Yes Yes Yes Yes Yes Yes No No No No No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No No No No No Yes Yes Yes Yes Yes Yes

Application Pillar HCM HCM HCM HCM ELM ELM ELM ELM ELM ELM ELM CRM CRM CRM CRM CRM CRM CRM Portal Portal Portal Portal Portal Portal Portal Portal Portal EPM EPM EPM EPM EPM EPM EPM

Instance PSTG PREP PROD SND DMO TST PTST PDEV PSTG PROD SND DMO TST PTST PSTG PDEV PROD SND DMO TST DEV TRN PTST PSTG PDEV PROD SND DMO SIT TST DEV PTST PSTG PDEV -44-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Category Production Production Production Non-production Non-production Non-production Production Production Production Production Non-production Non-production Non-production Production Production Production Production Non-production Non-production Non-production Non-production Non-production Production Production Production Production Non-production Non-production Non-production Non-production Non-production Production Production Production

Protected by Identity Management System (IMS)* Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes No Yes No Yes Yes Yes Yes Yes Yes No No No No Yes Yes Yes

Application Pillar EPM EPM BPEL BPEL BPEL BPEL BPEL BPEL PPM

Instance PROD SND DEV TST TRN PDEV PTST PROD PROD

Category Production Non-production Non-production Non-production Non-production Non-production Non-production Production Production

Protected by Identity Management System (IMS)* Yes Yes No No No No No No No

*CUNY uses Oracle’s Identity Management Product Suite (including OAM, OIM, OVD and OID.) Application Pillar Legend: FSCM CS HCM ELM CRM Portal EPM BPEL PPM

Financial Supply Chain Management Campus Solutions Human Capital Management Enterprise Learning Management Customer Relationship Management Portal Enterprise Performance Management Warehouse Business Process Execution Language PeopleSoft Performance Monitor

Instance Legend: CFG – Configuration CNV – Conversion DEV – Development DMO – Demo FIT – Framework for Integration Testing GOLD – Pristine Copy PROD – Production PDEV – Production Development

2.0

PREP – Production Report PSTG – Production Stage PTST – Production Test SIT – System Integration Testing SND – Sandbox TRN – Training TST – Test UAT – User Acceptance Testing

Technical Design and Architecture -45-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

The preliminary technical design and architecture of the Prime Vendor Environment is set forth below (the "Technical Design and Architecture"). In accordance with the terms below, Prime Vendor shall further define and update, with the assistance of CUNY, as needed, a detailed, CUNY-specific technical design and architecture that is in the form, format and in such detail, and minimally including the following contents, as necessary to fulfill its purposes: 

              

Overview - Objectives and Approach - System Requirements - Key Technical Assumptions - Sizing Inputs Hardware Recommendation Summary Web Server Sizing Integration Approach and Tools Report Repository Reverse Proxy Servers Application Server Sizing Windows Batch (Report) Server Sizing Load Testing Servers Database Server Sizing Storage Sizing Load Balancers Failover Process Switches and Network Instance Plan Virtualization Strategy, if any

Prime Vendor shall deliver the updated Technical Design and Architecture to CUNY within thirty (30) days after the Effective Date, and a further updated version sixty (60) days prior to Cutover. If Prime Vendor fails to deliver the updated version of the Technical Design and Architecture to CUNY on or before Cutover, CUNY shall have the right to suspend any and all Monthly Hosting Fees payments then due or to become due and owing to Prime Vendor until Prime Vendor complies with the terms of this Section. From and after Cutover, Prime Vendor shall continuously update the Technical Design and Architecture whenever required to reflect the then current technical design and architecture, provided that any changes to the Technical Design and Architecture that relates to the connectivity to CUNY's network shall be subject to the prior written consent of CUNY. Prime Vendor shall provide prior written notice at least ten (10) days prior to any Prime Vendor change to the Prime Vendor Environment that will have an impact on CUNY's operation of the Applications and other software included in the scope of Hosting Services. In addition, Prime Vendor shall not, without the prior written consent of CUNY, which consent may be withheld in CUNY's sole discretion, alter or revise any components of the Technical Design and Architecture that relate to the connectivity between Prime Vendor and CUNY, including physical connections, data transmission protocols, firewall configuration changes, and the like. [INSERT PRELIMINARY TECHNICAL DESIGN AND ARCHITECTURE DEVELOPED AND FINALIZED IN THE NEGOTIATIONS]

-46CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

3.0

ITIL and Best Practices.

Prime Vendor shall implement and practice ITIL standards and other best practices for implementing changes to the Prime Vendor Environment. Any changes to the End Point Protection Platform, security or disaster recovery components of the Prime Vendor Environment shall require the prior written approval of CUNY.

-47CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT C SERVICE LEVEL AGREEMENT 1.0

Performance Standard Reporting

1.1

Prime Vendor Portal and General Reporting Prime Vendor shall provide CUNY with access to a CUNY-specific Prime Vendor Portal for Hosting Services on a 24 x 7 x 365 basis. The Prime Vendor Portal will allow CUNY to enter Service Requests related to Hosting Services and view all Scheduled Downtime, Unscheduled Downtime, Monthly Performance Reports and Service Requests. In addition to the Prime Vendor Portal, Prime Vendor shall provide regular and periodic reports and updates to CUNY as such notifications are required in this Hosting Services Exhibit, and at any time upon request by CUNY.

1.2

Performance Standard Measurement and Reporting On a monthly basis, Prime Vendor shall assess its performance with respect to each component of the Hosting Services for which a Performance Standard has been established in accordance with Section 5.0 of Attachment C. Within five (5) business days after the end of each month, and at any time upon CUNY’s request, Prime Vendor shall provide to CUNY a performance report that will, with respect to the immediately preceding month: (a) identify and describe any Performance Standard Failure that occurred; (b) notify CUNY of any Performance Credits to which CUNY is entitled; and (c) show how such Performance Credits were calculated (collectively, a "Monthly Performance Report"). The failure to provide a Monthly Performance Report as provided in this Section 1.2 or to report the Performance Standards at any time during any measurable period in any given month where CUNY users report performance degradation in the production and/or non-production systems, regardless of cause, shall be deemed a Performance Standard Failure for all Performance Standards, resulting in the maximum amount of Performance Credits allowable under this Hosting Services Exhibit.

2.0

Performance Credits

2.1

Overview of Performance Credit Process for Performance Standard Failures A.

Single Performance Standard Failures. If a Performance Standard Failure occurs in any calendar month, then Prime Vendor shall provide a Performance Credit to CUNY equal to the amount of Monthly Hosting Fees times the percentage referenced in the applicable Performance Standard, subject to the further limitations herein. By way of example, if Prime Vendor fails to meet the Application Response Time Performance Standard, and the applicable percentage ref-48-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

erenced for failing to meet the Application Response Time is 20% as indicated in the table in Section 5.3 of Attachment C, then the Performance Credit for the month would be equal to the Monthly Hosting Fees x 20%. The parties agree that Performance Credits represent a lower net Monthly Hosting Fee for Prime Vendor not providing the Hosting Services as set forth herein, and is not to be construed as a penalty or an exclusive remedy. B.

2.2

Multiple Performance Standard Failures. If more than one Performance Standard Failure occurs in a single month, the sum of the corresponding Performance Credits will be credited to CUNY, subject to the limitations set forth in Section 2.3 below.

Invoicing Related to Performance Standard Failures Prime Vendor shall apply the total amount of all Performance Credits for which CUNY is eligible due to Performance Standard Failures that occurred in an applicable month to the invoice generated by Prime Vendor for the Monthly Hosting Fees for the following calendar quarter. If CUNY is eligible to receive a Performance Credit for any of the final months of the Hosting Term and no subsequent invoice for the Monthly Hosting Fees is due to be generated by Prime Vendor during the Hosting Term (or the amount of such subsequent invoice is less than the amount of the Performance Credit for such month), Prime Vendor shall pay to CUNY the amount of such Performance Credit (or the amount of the Performance Credit in excess of the amount of the subsequent invoice) within thirty (30) days after the final day of such month.

2.3

Performance Credit At Risk Amount Cap

The aggregate maximum amount of Performance Credits that CUNY may receive for all failures by Prime Vendor to meet Performance Standards in any single calendar month shall not exceed one hundred percent (100%) of the Monthly Hosting Fees for such calendar month (prior to deduction of any Performance Credits) (the "At Risk Amount").

2.4

Commencement of Performance Standards Obligations

CUNY's right to receive, and Prime Vendor’s obligation to pay, any Performance Credits shall commence upon Cutover.

2.5

Excused Performance Standards Failures

Prime Vendor will be excused from meeting the Performance Standards for the Hosting Services that are actually and adversely affected by any of the conditions or events described below, but only for the duration of the time period that any such conditions or events are in effect. Excused Performance Standards Failures are: A.

Those caused by CUNY's failures to meet the CUNY Responsibilities set forth in Section 2.1 regarding Access and Security, provided that Prime Vendor provides timely written notice of such failure upon Prime Vendor's knowledge that such failure directly will affect Prime Vendor's inability to meet the applicable Performance Standard under this Hosting Services Exhibit. -49-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

B.

C.

D.

E.

F. G.

2.6

With respect to a Performance Standard Failure of Application Response Time under Section 5.3 of Attachment C, those caused by any deterioration or impact that is attributable to batch processes or reports that have not been tested by CUNY, or to batch processes that are not identified in the production batch schedule or executed outside the production batch schedule. Those caused by network changes or failures beyond the Point(s) of Demarcation for which Prime Vendor is not responsible or by CUNY equipment infrastructure changes or failures for which Prime Vendor is not responsible. Those caused by failures or fluctuations in electrical or telecommunications equipment or lines or other equipment beyond the Point(s) of Demarcation for which Prime Vendor is not responsible, including any network issue that results in a latency of 150 milliseconds or greater. Those caused by a Force Majeure Event (other than as set forth in Section 5.4 of Attachment C), provided that no single point of failure of a communications line between the Prime Vendor Environment and the Points of Demarcation for which Prime Vendor is not responsible or at the Point of Demarcation itself (i.e., the failure of a single router) shall constitute a Force Majeure Event. Those caused by a declared Disaster (other than as set forth in Section 5.4 of Attachment C). Those caused by the concurrent use of the Prime Vendor Environment by more than 15,000 Concurrent Users.

Root-Cause Analysis.

Prime Vendor shall commence performing a root-cause analysis to identify the cause of a Performance Standard Failure immediately upon the occurrence of such failure involving a Service Request for a Level 1 Incident, and within three (3) business days of the occurrence of all other Performance Standard Failures. Prime Vendor shall complete, and report to CUNY the results of, the root-cause analysis of a Performance Standard Failure involving a Service Request for a Level 1 Incident within forty-eight (48) hours of the occurrence of such failure, and within seven (7) days of the occurrence of all other Performance Standard Failures. If the cause of such failure is within Prime Vendor’s control, Prime Vendor shall take such corrective action to cure the Performance Standard Failure. If the cause of such failure is not within Prime Vendor’s control, Prime Vendor shall meet with CUNY to discuss a corrective plan of action mutually acceptable to the parties. Notwithstanding any root cause analysis or efforts undertaken by Prime Vendor herein, additional Performance Standard Failures of the same or similar type shall continue to generate Performance Credits under the terms herein.

3.0

Additions and Deletions of Performance Standards

3.1

Additional Performance Standards

CUNY shall have the right to add one (1) or more Performance Standards by written notice to Prime Vendor not more than twice a year throughout the Hosting Term. Prime Vendor reserves the right to adjust the Monthly Hosting Fees based on inclusion of such additional Performance Standards provided Prime Vendor can provide adequate substantiation that additional resources will be required to meet the additional Performance Standards. The new Performance Standards will be established in one of the following ways: -50CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

A.

Where Prime Vendor has measured and reported to CUNY, in accordance with Section 1.2 of Attachment C, verifiable performance measurements for a particular component of the Hosting Services for a period of at least three (3) months immediately preceding CUNY's request for a new Performance Standard, CUNY can elect to establish a new Performance Standard at the data point equal to the average monthly performance achieved during that three (3) month period, or such other level of performance as may be mutually agreed to by the parties; or

B.

Where Prime Vendor has not measured and reported to CUNY, in accordance with Section 1.2 of Attachment C, verifiable performance measurements for a particular component of the Hosting Services for a period of least three (3) months immediately preceding CUNY's request for a new Performance Standard, the parties will follow the procedures defined in Section 3.3 of Attachment C for production baselining to establish a new Performance Standard.

CUNY will be responsible for any actual, substantiated incremental costs incurred by Prime Vendor to measure proposed new Performance Standards that are not then measured by Prime Vendor. The commencement date on which the new Performance Standard shall become eligible for Performance Credits shall be jointly determined by the parties.

3.2

Deletion of Performance Standards.

CUNY may request the deletion of any Performance Standard upon written notice to Prime Vendor, which notice shall be delivered at least thirty (30) days prior to the date on which such deletion to the Performance Standard is to be effective. The parties will mutually agree, pursuant to the Change Order procedures, upon the deletion of such Performance Standard. If CUNY previously requested the addition of a Performance Standard in which Prime Vendor required an increase in Monthly Hosting Fees, the Monthly Hosting Fees will be reduced to reflect such removed Performance Standard (excluding amounts of any un-capitalized costs of equipment and other components of the Prime Vendor Environment that are not able to be recouped by Prime Vendor as a consequence of the removal of such Performance Standard).

3.3

Baseline Period for Proposed New Performance Standards

For any new Performance Standard proposed by CUNY to which Section 3.1(B) of Attachment C applies (i.e., three (3) months of performance data does not exist for the proposed new Performance Standard), Prime Vendor shall measure and report (as described in Section 1.2 of Attachment C) the actual performance of the Hosting Services in production against the new proposed Performance Standard for a period of six (6) consecutive months for the purpose of establishing such Performance Standard (the "Production Baselining Period"). Any Production Baselining Period shall commence only after the applicable Application is placed into production. The new Performance Standard established at the end of such Production Baselining Period will be equal to the average of the documented monthly performance measured during the Production Baseline Period. CUNY is not entitled to receive, and Prime Vendor is not obligated to pay, Performance Credits for the applicable new Performance Standard until the conclusion of the Production Baselining Period. -51CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

4.0 Performance Standards and Performance Credits During Hosting Stabilization Period 4.1

Hosting Stabilization Period

The hosting stabilization period (the “Hosting Stabilization Period”) shall be the first ten (10) business days after Cutover.

4.2

Performance Standards During Hosting Stabilization Period

During the Hosting Stabilization Period, the following Performance Standards shall apply:

4.3

A.

The Production Application Pillar Availability Performance Standard will be at least ninety eight and one half percent (98.50%);

B.

At least eighty five percent (85%) of all Transactions will be executed within a twenty percent (20%) deviation of the Application Response Time Performance Standard; and

C.

At least ninety five percent (95%) of all Severity Service Requests will meet the Service Request Resolution Time Performance Standard.

Performance Credits During Hosting Stabilization Period

If performance falls below the Performance Standards described in Section 4.2 for the Hosting Stabilization Period the amount of Performance Credit shall equal the Performance Credit otherwise due multiplied by seventy-five percent (75%).

5.0

Performance Standards

Unless otherwise indicated, all of the Performance Standards shall be measured and reported on a monthly basis as set forth in Section 1.2 of Attachment C. Prime Vendor represents and warrants that it has undertaken such due diligence as necessary to confirm that the Prime Vendor Environment is sufficient and based on the CUNY Requirements to operate the Applications and other items included in the scope of Hosting Services in accordance with the Performance Standards. If the Prime Vendor Environment is not sufficient to meet any of the Performance Standards, Prime Vendor shall, in addition to granting Performance Credits to CUNY, promptly correct the Prime Vendor Environment and incorporate such additional hardware, software and services into the Prime Vendor Environment at no additional cost to CUNY to bring the Hosting Services within the Performance Standards. In addition, if Prime Vendor fails to achieve any single Performance Standard in: (a) any two (2) or more consecutive measurement intervals; or (b) any three (3) or more measurement intervals (non-consecutive or consecutive) during any twelve (12) consecutive measurement intervals, then, upon CUNY's request, Prime Vendor's Chief Technology Officer shall meet with CUNY to discuss Prime Vendor's proposed solution to the problem. Further, upon CUNY's request, within one (1) week after each subsequent failure of Prime Vendor to comply with a Performance Standard, Prime Vendor's Chief Technology Officer and Chief Executive Officer shall meet at CUNY to discuss Prime Vendor's proposed solution to the problem.

-52CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

5.1

Performance Standard – Production Application Pillar Availability

Production Application Pillar Availability generally means that all Applications are accessible, available and fully functional as implemented. The Performance Standard under this Section 5.1 shall apply to all Application Pillars used by CUNY in a Production Instance. Prime Vendor shall measure and report on the Production Application Pillar Availability of each Application Pillar on a continuous basis during each day of each month. Production Application Pillar Availability will be calculated with the following formula: Total minutes in a calendar month, minus The aggregate amount of Unscheduled Downtime and Scheduled Downtime in such month, divided by Total minutes in such calendar month, minus Scheduled Downtime in such month. The Production Application Pillar Availability Performance Standard is 99.90%. By way of example, assume the total minutes of a month are 43,200, and for that month the Scheduled Downtime is 480 minutes, the Unscheduled Downtime for the FSCM Application Pillar is 54 minutes, and the Unscheduled Downtime for the remaining Application Pillars is 0 minutes. The Production Application Pillar Availability for that month is equal to: 43,200 – 480 = 42,720 – 54 = 42,666/42,720 = 99.87% The Performance Credit applicable to Production Application Pillar Availability calculated with the above formula shall be determined in accordance with the following Table: Production

> 99.90% - 100%

Performance Credit % of Monthly Hosting Fees No Credit

< 99.90% and > 99.80%

25%

< 99.80% and > 99.60%

50%

< 99.60%

100%

Production Application Pillar Availability

A failure of one or more Application Pillars to achieve the Performance Standard shall be deemed a Performance Standard Failure of the Production Application Pillar Availability entitling CUNY to the Performance Credits referenced in the above Table; provided, however, that where more than one Application Pillar fails to achieve the Performance Standard, the Application Pillar with the lower availability measurement shall be used to calculate the Performance Credits, and provided further that such multiple failures shall not be deemed a multiple Perfor-53CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

mance Standard Failure under Section 2.1(B) of Attachment C. By way of example, if, in the prior example, in addition to the FSCM Application Pillar having 54 minutes of Unscheduled Downtime, the CRM Application Pillar experienced 102 minutes of Unscheduled Downtime, then for purposes of determining the Performance Credits, CUNY shall be entitled to a Performance Credit of 50% of the Monthly Hosting Fees based on the following calculation: Production Application Pillar Availability for FSCM = 99.87% Production Application Pillar Availability for CRM = 99.76% (43,200 – 480 = 42,720 – 102 = 42,618/42,720). An Application Pillar in the Production Instance shall be deemed to be unavailable, inaccessible and/or not fully functioning as implemented the earlier of: (a) the time Prime Vendor’s monitoring system reveals the unavailability or inaccessibility of an Application Pillar; and (b) the time CUNY notifies Prime Vendor of the unavailability or inaccessibility of an Application Pillar, or that an Application within an Application Pillar is not fully functioning as implemented. CUNY and Prime Vendor shall each notify the other of the occurrence of any unavailability or inaccessibility of an Application Pillar and/or the non-fully functioning as implemented of an Application and the restoration thereof as promptly as possible. An Application Pillar shall be deemed to be restored to availability and accessibility, and an Application shall be deemed fully functioning as implemented, at the time CUNY notifies Prime Vendor that availability and/or accessibility of an Application Pillar has been restored and/or the Application is fully functioning as implemented. If an Application is not fully functioning as implemented due to Prime Vendor not fulfilling its Hosting Services obligations herein, in whole or in part, then the Application shall be deemed to be not fully functioning as implemented for purposes of the Production Application Pillar Availability Performance Standard. If an Application is not fully functioning as implemented due to circumstances other than Prime Vendor not fulfilling its Hosting Services obligations herein, then the Application shall not be deemed to be not fully functioning as implemented for purposes of the Production Application Pillar Availability Performance Standard.

5.2

Performance Standard – Non-Production Infrastructure Availability

Prime Vendor shall measure Non-Production Infrastructure Availability for each non-production Instance in the Prime Vendor Environment between 8 a.m. and 6 p.m. on a continuous basis. If the monitored infrastructure does not respond to the monitoring tool or utility, the non-production Instance in the Prime Vendor Environment will be deemed "unavailable." Non-Production Infrastructure Availability will be calculated on a non-production Instance-bynon-production Instance basis in accordance with the following formula: Total minutes between 8 a.m. and 6 p.m. in a calendar month minus Unscheduled Downtime and Scheduled Downtime between 8 a.m. and 6 p.m. measured for the applicable non-production Instance in such month divided by -54CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Total minutes between 8 a.m. and 6 p.m. in such calendar month minus Scheduled Downtime. The Performance Credit applicable to the Non-Production Infrastructure Availability calculated with the above formula shall be determined in accordance with the following Table:

Non-Production Non-Production Infrastructure Availability for Each Non-Production Instance failing to meet the Performance Standard < 90.0%

5.3

Performance Credit - % of Monthly Hosting Fees 20%

Performance Standard – Application Response Time Prime Vendor will measure response times using page load transactions. The Application Response Time each month shall be the value of the ninety-eighth (98th) percentile* of all Page Load Data Points during the hours between 9 a.m. and 4 p.m. for each business day during that month (the “Application Response Time Hours”). The Performance Credit applicable to the Application Response Time Performance Standard shall be determined in accordance with the following Table: Application Response Time Performance Standard and Performance Credit Calculation Application Response Time Ranges (in seconds)

Performance Credit

Greater Than

Less Than/ Equal To

Performance Credit – % of Monthly Hosting Fees

N/A 2.0 2.5 3.0 3.5 4.0

2.0 2.5 3.0 3.5 4.0 N/A

No Credit 20% 40% 60% 75% 100%

*The 98th Percentile means the data point representing the 98th part of the statistical distribution of Page Load Time data (not the average of such data points). For example, if there are 100 Page Load Time data points, and there are 95 data points at 2.0 seconds and the remaining 5% of data points are at 2.5 seconds, then the 98th percentile of Page Load Time data points will be 2.5 seconds. 5.3.1

Measurement

Page Load Data Points will be collected and reported for all CUNY user transactions 24 x 7 x 365, other than during Scheduled Downtime. Prime Vendor shall report to -55CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

CUNY on all the Page Load Data Points measured for such month. If Prime Vendor's measurement tool or utility is unavailable for any reason during the Application Response Time Hours, other than for an excused performance under Section 2.5 of Attachment C, or experiences a problem with measuring or reporting Page Load Data Points in accordance with the Application Response Time Performance Standard, then such failure shall be deemed a Performance Standard Failure for the Application Response Time Performance Standard. Prime Vendor shall provision and maintain, at its cost and expense, any measurement tools and utilities required to capture the Page Load Data Points. 5.3.2

Calculation

The term "Page Load Data Point(s)" shall mean the collection of the time in which users depress the ENTER, SUBMIT or similar action key on the keyboard (or mouse or voice activation) to the time it takes to refresh the user's Device screen with updated or new data plus the time it takes for the acknowledgement to reach the measurement tool or utility from the users' Device. The time interval will be calculated in seconds (to the tenth position).

5.4

Performance Standard – Disaster Recovery Restoration

A Performance Standard Failure of the Disaster Recovery Performance Standard occurs any time when there is a failure by Prime Vendor to conform to the requirements set forth in Sections 1.5.4 and 1.5.5 and the Disaster Recovery Plan during a declared Disaster or during any rehearsal of the Disaster Recovery Plan and, as a consequence: A.

The recovery time achieved is greater than eight (8) hours from the declaration of a Disaster, the failure of which to achieve shall result in a Performance Credit of five percent (5%) of the Monthly Hosting Fees for each one (1) hour increment (or part thereof) beyond eight (8) hours; or

B.

The recovery point achieved is greater than fifteen (15) minutes, the failure of which to achieve shall result in a Performance Credit of twenty percent (20%) of the Monthly Hosting Fees for each five (5) minute increment (or part thereof) beyond fifteen (15) minutes; or

C.

Prime Vendor fails to correct the Issues within the time frames set forth in Section 1.5 which shall result in a Performance Credit of five percent (5%) of the Monthly Hosting Fees for each calendar day in which the Issues are not corrected and certified as corrected by Prime Vendor.

In connection with the recovery time and recovery point achieved by Prime Vendor, in order to meet the Disaster Recovery Performance Standard and for purposes of determining whether a Performance Credit is due to CUNY, CUNY must have one hundred percent (100%) of the functionality, but at seventy five percent (75%) of standard production capacity, and full production capacity within two (2) weeks after the Disaster.

-56CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

5.5

Performance Standard – Service Request Response and Resolution Time 5.5.1

Incident Level Definitions

Each Service Request will be assigned one of the Incident Levels listed in the Table below. Each of the Service Requests will be measured from the time of submission of the Service Request via the Prime Vendor Portal, by telephone via the Customer Support Center, or when Prime Vendor detects the problem and logs the problem as an Issue or a trouble or similar ticket in the Prime Vendor Portal or otherwise to the Customer Support Center. For Level 1 Incidents, Prime Vendor shall provide CUNY with updates at least every two (2) hours regarding the status of such Incidents until the Incident is closed or downgraded.

Level of Service Request

Monthly Average Time to Respond to Service Requests

Monthly Average Time to Close or Downgrade Service Requests

Level 1 Incident Level 2 Incident

15 Minutes 15 Minutes

Level 3 Incidents and General Requests not involving an Incident

8 Hours

2 Hours 4 Hours As agreed to by the parties, not to exceed one (1) week

5.5.1.1 Service Request Response and Resolution Time Performance Calculation Service Requests for Level 1 Incidents, Level 2 Incidents and Level 3 Incidents will be used to calculate Prime Vendor’s monthly performance against Service Request Response and Resolution Time set forth in the Table in Section 5.5.1 above. Prime Vendor shall measure the time it takes, during the applicable month: (a) to respond to each such Service Request; (b) to close each such Service Request; and (c) to implement automated or manual workarounds that result in a downgrade of the Incident Level of the Service Request as described in Section 5.5.2.2 below. The measurement excludes Service Requests: (x) relating to problems other than Service Requests for Level 1 Incidents, Level 2 Incidents or Level 3 Incidents; (y) relating to defects in the Applications; or (z) resulting from the failure of infrastructure that CUNY provides. The Service Request Response and Resolution Time Performance Standard will be calculated in accordance with the following formula: Total number of all Service Requests for all measured Incident Levels which meet both the times to respond and the close or downgrade such Service Requests (i.e., the same Service Request must meet both the applicable time to respond and the applicable time to close or downgrade) as set forth in the Table in Section 5.5.1 above in a calendar month, divided by -57CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Total number of all Service Requests for all measured Incident Levels in such calendar month. CUNY shall receive a Performance Credit for the Performance Standard Failure of Service Request Response and Resolution Time. Prime Vendor shall issue a Performance Credit of two percent (2%) of the Monthly Hosting Fees for each one percent (1%) (or part thereof) that the Service Request Response and Resolution Time for all Service Requests of all Incident Levels is below ninety-eight percent (98%) in the applicable month. To the extent CUNY involvement is required to address a remedy of a failure of the Performance Standards, any delays on the part of CUNY in working with Prime Vendor during the Service Request process will not be counted in the elapsed time for remedying and conforming to the applicable Performance Standard. 5.5.2

Determining Service Request Incident Level 5.5.2.1

Initial Incident Level

CUNY will designate in accordance with the Incident designations set forth in Section 5.5.1 above and Prime Vendor shall record the initial Incident Level of a Service Request at the time the Service Request is made. The Incident Level of a Service Request may be adjusted by mutual agreement of the parties as set forth in Sections 5.5.2.2 and 5.5.2.3 below. 5.5.2.2

Downgrades of Incident Levels

If, during the Service Request process, the Issue no longer warrants the Incident Level currently assigned based on its current impact on CUNY's business operations, then the parties may mutually agree to downgrade the Incident Level to the Incident Level that most appropriately reflects its current impact. 5.5.2.3

Upgrade of Incident Levels

If, during the Service Request process, the Issue warrants the assignment of a higher Incident Level than that currently assigned based on the current impact on CUNY's business operations, then the Incident Level shall be upgraded to the Incident Level that most appropriately reflects its current impact. 5.5.2.4

Adherence to Incident Level Definitions

Prime Vendor and CUNY shall work in good faith to develop a process to assure that the assignment and adjustment of any Incident Level designation is accurate based on the current impact on CUNY's business operations.

-58CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

5.5.3

Service Request Escalations 5.5.3.1

CUNY Escalation

CUNY may escalate at any time the handling of an unresolved Service Request from the initial analyst to which the Service Request was routed to a Prime Vendor duty manager. The duty manager will document the open business or technical Issues and will work with CUNY to define an action plan to address the Issue. If the action plan fails to resolve the Service Request, CUNY may escalate the Service Request to a Prime Vendor senior manager for resolution. If the Service Request remains unresolved, CUNY may successively escalate the Issue to: (a) the Prime Vendor Service Delivery Manager for Hosting Services; (b) the Service Delivery Director for Hosting Services; and (c) Prime Vendor’s Executive Sponsor, until such Issue is resolved. 5.5.4

Hours of Operations for the Customer Support Center Except where otherwise stated or required as part of Prime Vendor's obligations, the Customer Support Center will be staffed during the PHO. During such time, Prime Vendor shall respond to inquiries from CUNY about any outstanding Service Request.

5.6

Performance Standard – Security Management If Prime Vendor fails to provide Hosting Services in accordance with Section 1.11 and/or fails to materially comply with the Security Policies and Procedures: (a) CUNY shall receive a Performance Credit of 100% of the Monthly Hosting Fees; (b) an Event of Default shall be deemed to have occurred under the MSA; and (c) CUNY shall be entitled to any other rights and remedies provided for in the MSA.

-59CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT D [DO NOT FILL IN ANY BLANKS HIGHLIGHTED IN YELLOW. PROPOSERS SHOULD RESPOND TO THESE MATTERS IN THE COST PROPOSAL WORKSHEET.]

FEES AND CHARGES This Attachment D sets forth the Monthly Hosting Fees and Additional Resource Charges (ARCs) to be paid by CUNY in connection with the Hosting Services. Such fees and charges shall be payable only for periods following Cutover. Prime Vendor will invoice CUNY for the Monthly Hosting Fees and Additional Resource Charges on a quarterly basis, with each invoice being issued during the first week of each calendar quarter during the Hosting Term for Monthly Hosting Fees and Additional Resource Charges to be incurred during that calendar quarter. (Any such fees and charges incurred for the period preceding the first full calendar quarter following Cutover will be added to the invoice for that quarter.) Each quarterly invoice shall reflect the total amount of all Performance Credits for which CUNY is eligible due to Performance Standard Failures that occurred during the previous calendar quarter in accordance with Section 2.2 of Attachment C.

1.0

Monthly Hosting Fees During the Initial Hosting Term

The Monthly Hosting Fees for each month of the Initial Hosting Term following Cutover are $_____________. The Monthly Hosting Fees set forth above are subject to adjustment pursuant to the Change Order procedures and by inclusion of Additional Resource Charges that recur continuously on a monthly basis and become part of the Monthly Hosting Fees.

2.0 Monthly Hosting Fees and Additional Resource Charges During the Hosting Renewal Option Period A.

Monthly Hosting Fees. If CUNY exercises a Hosting Renewal Option in accordance with Section 2.2, the Monthly Hosting Fee for the Hosting Renewal Option period will be calculated as follows: 1.02 X the Monthly Hosting Fee applicable in the last month of the expiring annual period (i.e., the last month of the Initial Hosting Term or then-expiring Hosting Renewal Option period, as applicable)

B.

Additional Resource Charges. If CUNY exercises a Hosting Renewal Option, unless other pricing is then agreed to by the parties (and documented through the Change Order procedures or an amendment to this Hosting Services Exhibit), the Additional Resource Charges for the Hosting Renewal Option period will remain as set forth in Section 3 below, except that the Additional Resource Charges may be increased up to 1.02 -60-

CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

multiplied by the ARC applicable in the last month of the expiring annual period (i.e., the last month of the Initial Hosting Term or then-expiring Hosting Renewal Option period, as applicable) to the extent that such Additional Resource Charges are attributable to hourly labor costs.

3.0

Additional Resource Charges and Reduced Resource Charges

In addition to the Monthly Hosting Fees, CUNY is entitled to order pursuant to a purchase order (or, if there are terms that must be discussed by the parties in connection with an ARC (see, e.g., Section 3.5 below), a Change Order) setting forth the relevant details of the Service being ordered, and Prime Vendor will deliver and invoice CUNY for, the Services that are subject to Additional Resource Charges as described below in this Section. Notwithstanding anything that may be contained herein to the contrary, Additional Resource Charges shall not apply to the extent Prime Vendor is required to provide the applicable Service to meet the CUNY Requirements, the Performance Standards or the other terms and conditions set forth in this Hosting Services Exhibit or MSA. ARCs that do not recur continuously on a monthly basis will be separately invoiced by Prime Vendor. The Additional Resource Charges include related labor costs, except as otherwise specifically noted. As indicated below, CUNY can remove a resource from certain Services subject to an ARC under this Section 3 by providing Prime Vendor with ten (10) days prior written notice that it is issuing a Reduced Resource Charge, and upon such effective date of such removal, Prime Vendor shall reduce the Monthly Hosting Fees accordingly. 3.1

Additional Storage Charges CUNY is entitled to order, and Prime Vendor shall provide, additional database and nondatabase storage at the applicable monthly ARC rates set forth in the Tables below. Database storage means the amount of usable primary storage needed for production of each database Instance, and non-database storage means the amount of usable primary storage needed for purposes of production other than for databases, such as reports, interface files and conversion files. The monthly ARC prices set forth in the Tables below are for useable primary storage and include, at no additional charge, storage for RAID, secondary, temporary tables, hot and cold online backups, media backups and warm-site disaster recovery (production only). Charges for both types of storage include operational support for backups as defined in this Hosting Services Exhibit. Description Up to 18 TB Database Storage Additional Database Storage – 1 to 5 TB Additional Database Storage – 6 to 20 TB Additional Database Storage – 21 TB or more

Monthly ARC for Useable Database Storage Included within the Monthly Hosting Fees as of the Effective Date* $ ____ per TB $ ____ per TB $ ____ per TB

-61CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Description Up to 50 TB Non-Database Storage Additional Non-Database Storage – 1 to 5 TB Additional Non-Database Storage – 6 to 10 TB Additional Non-Database Storage – 11 TB or more

Monthly ARC for Useable Non-Database Storage Included within the Monthly Hosting Fees as of the Effective Date* $ ____ per TB $ ____ per TB $ ____ per TB

*All storage for data backed up and retained under Section 1.5.2 is also included within the Monthly Hosting Fees and shall not be subject to Additional Resource Charges.

3.2

Additional and Removed Production Instances CUNY is entitled to add Production Instances to, and to remove Production Instances from, the Prime Vendor Environment at the monthly ARC/RRC associated with each such Production Instance set forth in the Table below. Such monthly ARC/RRC includes the hardware required by Prime Vendor to perform Hosting Services for each such additional or removed Production Instance; however, such monthly ARC/RRC does not include, and CUNY must separately order and pay for software licenses for the additional Production Instance, as applicable. Description Additional/Removed Production Instance

3.3

Monthly ARC/RRC $ ____ per Instance

Additional and Removed Non-Production Instances CUNY is entitled to order, and Prime Vendor shall provide, additional Non-Production Instances at the monthly ARC rate set forth in the Table below. CUNY may also remove Non-Production Instances at the RRC rate set forth in the Table below. Description Additional/Removed Non-Production Instance

3.4

Monthly ARC/RRC $ ____ per Instance

Additional Refreshes CUNY is entitled to order, and Prime Vendor shall provide, additional Refreshes beyond the amount set forth in Section 1.7.1(P) at the one-time ARC rate for each such Refresh that is set forth in the Table below. Description Additional Refreshes

ARC $ ____ per Refresh

-62CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

3.5

Additional and Removed Servers CUNY is entitled to order, and Prime Vendor shall provide, physical or virtual servers in addition to Production Instances and Non-Production Instances (including additional servers that may be required to operate an Application that CUNY wants to add to the scope of the Hosting Services) at a monthly ARC rate calculated as provided in the Table below. Similarly, CUNY may remove physical or virtual servers (including servers that are not required to operate an Application as part of the scope of the Hosting Services) at a monthly RRC rate calculated as provided in the Table below. Such Table sets forth a monthly ARC/RRC for representative additional or removed servers.

3.6

Cores

Memory

1 2 4

8 GB 16 GB 32 GB

ARC/RRC Physical Hardware $ ____ $ ____ $ ____

ARC/RRC Virtual Hardware $ ____ $ ____ $ ____

Increase in Number of Concurrent Users If CUNY wants to increase the number of Concurrent Users beyond the number of users specified in Section 2.5(G) of Attachment C, CUNY is entitled to order, and Prime Vendor shall provision the Prime Vendor Environment to accommodate and meet the Performance Standards for, additional Concurrent Users in increments of 1,000 at the following monthly ARC rate: # of Concurrent Users

Monthly ARC

Up to 15,000

Included within the Monthly Hosting Fees as of the Effective Date

Additional block increment of 1,000 Concurrent Users – from 15,001 to 16,000 Additional block increment of 1,000 Concurrent Users – from 16,0001 to 20,000 Additional block increment of 1,000 Concurrent Users – more than 20,000

3.7

$ ____

$ ____

$ ____

Additional VPN Connections The ARC/RRC rates for Prime Vendor to establish and manage additional VPN connections, or to remove existing VPN connections, are as follows: Description

ARC/RRC Included within the Monthly Hosting Fees as of the Effective Date

Up to 4 VPN connections Establish an additional VPN connection, includes testing and remedia-

-63CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

$ ____ per setup

Description tion of any problems with the connection Managing the additional VPN connection

4.0

ARC/RRC

$ ____ per month

Improvements and Gain Sharing Opportunities

Each party may identify potential savings, enhanced quality in delivering the Hosting Services and/or enhanced Performance Standards opportunities (each, a "Gain Sharing/Improvement Opportunity"). If either party identifies a Gain Sharing/Improvement Opportunity, the parties shall discuss such Gain Sharing/Improvement Opportunity, including the likelihood that such Gain Sharing/Improvement Opportunity will result in savings to CUNY and/or improved quality as to the Hosting Services and/or enhanced Performance Standards and, if approved by CUNY, Prime Vendor shall further research the Gain Sharing/Improvement Opportunity and present a written proposal to CUNY within a mutually agreed time frame. Prime Vendor's proposal shall include, as applicable, the estimated current costs, the recommended changes, the anticipated savings and/or improvements in the Performance Standards and/or Hosting Services that will be achieved by CUNY and a proposed Change Request (including a project schedule) or Contract Supplement setting forth each party's responsibilities if the Gain Sharing/Improvement Opportunity is to be realized. In the case of improved quality of Hosting Services or enhanced Performance Standards, a mutually agreed value shall be ascribed to such improved Hosting Services or enhanced Performance Standards and used as the basis for any gain sharing as hereinafter described. If CUNY agrees with Prime Vendor's proposal, the parties shall execute the Change Order or Contract Supplement, and the parties thereafter shall proceed to implement the Gain Sharing/Improvement Opportunity based on the terms and conditions specified therein. The parties shall specify in the Change Order or Contract Supplement the gain sharing formula (if any) that will be applicable in order to compensate Prime Vendor with respect to the Gain Sharing/Improvement Opportunity; however, the parties anticipate that such gain sharing formula shall provide, at a minimum, that Prime Vendor will be reimbursed by CUNY for Prime Vendor’s actual cost of implementing such Gain Sharing/Improvement Opportunity and thereafter Prime Vendor will be entitled to fifty percent (50%) of the savings or value in improved Hosting Services or enhanced Performance Standards for a period of two (2) years and CUNY will be entitled to the remaining fifty percent (50%) of the savings for value in improved Hosting Services or enhanced Performance Standards for a period of two (2) years, after which CUNY will be entitled to all further savings or enhanced value.

-64CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT E DISASTER RECOVERY AND BUSINESS CONTINUITY PLAN [TO BE PROPOSED BY PRIME VENDOR AND DEVELOPED JOINTLY BY PRIME VENDOR AND CUNY DURING THE NEGOTIATION PERIOD AND REPLACED IN ACCORDANCE WITH THE TERMS OF THIS EXHIBIT.]

-65CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

ATTACHMENT F SUMMARY OF PRIME VENDOR'S MONITORING ACTIVITIES [THIS SCHEDULE IS TO BE COMPLETED PRIOR TO CONTRACT SIGNING.] Layer

Monitoring

Tools

Infrastructure Technology Stack Transactional Service Desk

-66CUNY HOSTING RFP - ATTACHMENT A Exhibit 2 – Hosting Services Exhibit

Instances

EXHIBIT 3 SUBCONTRACTOR CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT This Subcontractor Confidentiality and Non-Disclosure Agreement ("Agreement") is executed this ____ day of __________, 201_, by __________________________________ ("Subcontractor"). W I T N E S S E T H: WHEREAS, _____________, a ____________ corporation with a place of business at ________________________ ("Prime Vendor"), and The City University of New York, an educational corporation acting pursuant to New York State Education Law Article 125, with its principal place of business at 205 East 42nd Street, New York, NY 10021 ("CUNY"), entered into that certain Master Services Agreement, dated _________, 201_ ("Master Agreement"); WHEREAS, with CUNY's prior written consent, Prime Vendor and Subcontractor entered into an agreement ("Subcontract Agreement") under which, among other things, Subcontractor will provide certain of the services and/or deliverables that Prime Vendor is obligated to provide to CUNY under the Master Agreement; and WHEREAS, Subcontractor may have access to certain confidential and proprietary information of CUNY, and Prime Vendor and CUNY want to protect the confidentiality of any such confidential and proprietary information that may be disclosed by Prime Vendor or CUNY to Subcontractor. NOW, THEREFORE, in consideration of the foregoing recitals and the mutual covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Subcontractor agrees to the foregoing and as follows: 1.

CONFIDENTIAL INFORMATION

CUNY Confidential Information shall have the meaning as described in the Master Agreement. 2.

NON-DISCLOSURE AND RESTRICTED USE OF CONFIDENTIAL INFORMATION

2.1 Nondisclosure and Restricted Use. At all times during and after Subcontractor's access to the Confidential Information, Subcontractor will hold the Confidential Information in confidence and, except as is required in connection with Subcontractor's performance of its obligations to Prime Vendor, Subcontractor: (a) shall not use, copy, disclose or otherwise make the Confidential Information available to any other person or entity without the prior written consent of CUNY; and (b) shall not remove or permit to be removed from the Confidential Information any notice placed thereon by Prime Vendor or CUNY indicating the confidential nature of, or the proprietary right of CUNY in, the Confidential Information. 2.2 Notification Obligation. If Subcontractor becomes aware of any unauthorized use or disclosure of the Confidential Information by any person or entity, Subcontractor promptly and fully shall advise Prime Vendor and CUNY of all facts known to Subcontractor concerning such unauthorized use or disclosure.

-1CUNY HOSTING RFP - ATTACHMENT A Exhibit 3 – SUBCONTRACTOR CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

2.3 Return of Confidential Information. Upon the termination of Subcontractor's obligations to Prime Vendor, or at any time upon Prime Vendor's or CUNY's request, Subcontractor shall promptly return to CUNY (or destroy provided a written certification of such destruction is provided to CUNY) all of the Confidential Information in Subcontractor's possession, custody or control. In connection with any such return, upon Prime Vendor's or CUNY's request, Subcontractor shall provide CUNY with an affidavit stating that: (a) Subcontractor has returned to CUNY all Confidential Information to which Subcontractor had access; (b) Subcontractor does not have any Confidential Information, or copies thereof, in Subcontractor's possession, custody or control; and (c) Subcontractor has not made the Confidential Information, or any part thereof, available to any other person or entity without the prior written consent of Prime Vendor and CUNY. If Subcontractor has made the Confidential Information available to another person or entity without the prior written consent of Prime Vendor and CUNY, Subcontractor agrees to promptly document the extent and nature of such dissemination, including, without limitation, identifying: (d) what Confidential Information was disclosed; (e) to whom the Confidential Information was disclosed; (f) the manner and means by which the Confidential Information was disclosed; and (g) the date(s) on which such disclosure occurred. 3.

GENERAL PROVISIONS

3.1 Injunctive Relief. Because of the unique and highly confidential nature of the Confidential Information, Subcontractor acknowledges and agrees that CUNY may suffer irreparable harm if Subcontractor breaches any of Subcontractor's obligations under this Agreement and that monetary damages may be inadequate to compensate for such breach. Accordingly, in addition to any other rights and remedies that may be available to Prime Vendor and CUNY at law and in equity, Prime Vendor and/or CUNY shall be entitled to seek enforcement of the provisions of this Agreement by seeking injunctive relief. 3.2 Severability. If any provision of this Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, such determination shall not affect the validity or enforceability of any other part or provision of this Agreement. 3.3 Waiver. No delay or omission by Prime Vendor or CUNY to exercise any right occurring upon Subcontractor's non-compliance or default with respect to any of the terms of this Agreement shall impair any such right or power or be construed to be a waiver thereof. A waiver by Prime Vendor or CUNY of any of the covenants, conditions or agreements to be performed by Subcontractor shall not be construed to be a waiver of any succeeding breach thereof or of any other covenant, condition or agreement herein contained. 3.4 Public Disclosures. Without the prior written consent of CUNY, which consent may be withheld in CUNY's sole discretion, Subcontractor shall not make or publish, directly or indirectly, any statements, articles, public or private announcements (including, without limitation, any announcement made via e-mail or any posting on the Internet or any Prime Vendor website), media releases, press conferences, advertising or similar publicity in any form relating to the fact that the parties have entered into the Agreement or that CUNY and Prime Vendor have a contractual relationship, the name, image or logo of CUNY or any of its Affiliates (or any variation or combination of such name, image or logo), as well as the name or image of any CUNY employee or contractor of CUNY. Without limiting the generality of the foregoing, Subcontractor shall not, without CUNY's prior written approval: (a) make any references to third

-2CUNY HOSTING RFP - ATTACHMENT A Exhibit 3 – SUBCONTRACTOR CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

parties that CUNY is a customer of Subcontractor or Prime Vendor; (b) include or make any reference to CUNY or CUNY's name in any proposals to third parties; or (c) provide CUNY contact information to existing or prospective customers of Subcontractor or Prime Vendor. 3.5 Governing Law; Jurisdiction. The Agreement, and all the rights and duties of Subcontractor arising from or relating in any way to the subject matter of the Agreement or the transaction(s) contemplated by it, shall be governed by, construed and enforced only in accordance with the laws of the United States and the State of New York (excluding any conflict of laws provisions that would refer to and apply the substantive laws of another jurisdiction). SUBCONTRACTOR AGREES TO THE EXCLUSIVE JURISDICTION AND VENUE OF THE APPLICABLE COURTS LOCATED IN THE STATE OF NEW YORK. 3.6 Third Party Beneficiary. CUNY and its Affiliates are direct and intended thirdparty beneficiaries of the terms of this Agreement. If Subcontractor receives conflicting requests and/or instructions from Prime Vendor and CUNY with respect to the terms of this Agreement, Subcontractor shall comply with CUNY's requests and/or instructions. 3.7 Assignment; Subcontracting. Subcontractor shall not assign the Subcontract Agreement or this Agreement, nor subcontract or delegate any of its obligations under the Subcontract Agreement or this Agreement, without the prior written consent of Prime Vendor and CUNY. 3.8 Conflicts of Interpretation. In the event of any conflicts between the terms of this Agreement and the terms of the Subcontract Agreement, the terms of this Agreement shall control. 3.9 Scope of Agreement. The terms and conditions of this Agreement shall apply to CUNY and its Affiliates, as that term is defined in the Master Agreement, but only as to Confidential Information that is disclosed under the Master Agreement to Subcontractor hereunder. 3.10 Exclusive Agreement; Modifications. This Agreement constitutes the complete and exclusive statement of the agreement of the parties with respect to the subject matter of this Agreement and supersedes all prior oral and written proposals, negotiations, representations, promises, agreements, warranties or understandings concerning such subject matter. All provisions that by their nature require survival shall survive after any termination of this Agreement or Subcontractor's access to the Confidential Information. This Agreement may be modified only pursuant to a writing executed by CUNY, Prime Vendor and Subcontractor. IN WITNESS WHEREOF, this Subcontractor Confidentiality and Non-Disclosure Agreement has been executed on the date and year first above written. [SUBCONTRACTOR] By: Printed Name: Title: ____________________________________

-3CUNY HOSTING RFP - ATTACHMENT A Exhibit 3 – SUBCONTRACTOR CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

EXHIBIT 4 THIRD PARTY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT This Third Party Confidentiality and Non-Disclosure Agreement ("Third Party NDA Agreement") is executed this ____ day of __________, 201_, by __________________________________ ("Third Party"). W I T N E S S E T H: WHEREAS, Prime Vendor, a ________ corporation with a place of business at ___________________________ ("Prime Vendor"), and The City University of New York, an educational corporation acting pursuant to New York State Education Law Article 125, with its principal place of business at 205 East 42nd Street, New York, NY 10021 ("CUNY"), entered into that certain Master Services Agreement, dated _________, 201_ ("Master Agreement"); WHEREAS, Third Party has obligations to CUNY that will require Third Party to be granted access to the hosted environment and/or CUNY Applications, as such terms are defined in the Master Agreement and such user may be exposed to and has a need to know certain confidential and proprietary information of Prime Vendor; and WHEREAS, CUNY and Prime Vendor want to protect the confidentiality of any such confidential and proprietary information that may be disclosed by Prime Vendor or CUNY to Third Party. NOW, THEREFORE, in consideration of the foregoing recitals and the mutual covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Third Party agrees to the foregoing and as follows: 1.

CONFIDENTIAL INFORMATION

Prime Vendor Confidential Information shall have the meaning as described in the Master Agreement. 2.

NON-DISCLOSURE AND RESTRICTED USE OF CONFIDENTIAL INFORMATION

2.1 Nondisclosure and Restricted Use. Third Party acknowledges and agrees that Prime Vendor owns all right, title and interest in and to the Prime Vendor Confidential Information, and in and to all copies thereof, and in and to all of the related trade secrets, copyrights, patents and other proprietary rights. Accordingly, at all times during and after Third Party's access to the Prime Vendor Confidential Information, Third Party will hold the Prime Vendor Confidential Information in confidence and, except as is required in connection with Third Party's performance of its obligations to CUNY, Third Party: (a) shall not use, copy, disclose or otherwise make the Prime Vendor Confidential Information available to any other person or entity without the prior written consent of CUNY and Prime Vendor; and (b) shall not remove or permit to be removed from the Prime Vendor Confidential Information any notice placed thereon by CUNY or Prime Vendor indicating the confidential nature of, or the proprietary right of Prime Vendor in, the Prime Vendor Confidential Information. The furnishing of the Prime Vendor Confidential Information for the limited purposes set forth herein does not constitute the

-1CUNY HOSTING RFP - ATTACHMENT A Exhibit 4 – THIRD PARTY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

grant, option, license, sublicense, assignment, or other form of transfer to Third Party of any rights, title or interest in or to such Prime Vendor Confidential Information. Third Party shall not copy, translate, disassemble or decompile, nor create or attempt to create the source code from the object code of the ERP System licensed hereunder or use it to create a derivative work, unless authorized in writing by Prime Vendor. 2.2 Notification Obligation. If Third Party becomes aware of any unauthorized use or disclosure of the Prime Vendor Confidential Information by any person or entity, Third Party promptly and fully shall advise CUNY and Prime Vendor of all facts known to Third Party concerning such unauthorized use or disclosure. 2.3 Return of Proprietary Information. Upon the termination of Third Party's access to the ERP System, or at any time upon Prime Vendor's or CUNY's request, Third Party shall return to Prime Vendor all of the Prime Vendor Confidential Information in Third Party's possession, custody or control. In connection with any such return, upon Prime Vendor's or CUNY's request, Third Party shall provide Prime Vendor with an affidavit stating that: (a) Third Party has returned to Prime Vendor all Prime Vendor Confidential Information to which Third Party had access; (b) Third Party does not have any Prime Vendor Confidential Information, or copies thereof, in Third Party's possession, custody or control; and (c) Third Party has not made the Prime Vendor Confidential Information, or any part thereof, available to any other person or entity without the prior written consent of Prime Vendor and CUNY. If Third Party has made the Prime Vendor Confidential Information available to another person or entity without the prior written consent of Prime Vendor and CUNY, Third Party agrees to promptly document the extent and nature of such dissemination, including, without limitation, identifying: (d) what Prime Vendor Confidential Information was disclosed; (e) to whom the Prime Vendor Confidential Information was disclosed; (f) the manner and means by which the Prime Vendor Confidential Information was disclosed; and (g) the date(s) on which such disclosure occurred. 3.

GENERAL PROVISIONS

3.1 Injunctive Relief. Because of the unique and highly confidential nature of the Prime Vendor Confidential Information, Third Party acknowledges and agrees that Prime Vendor may suffer irreparable harm if Third Party breaches any of Third Party's obligations under this Third Party NDA Agreement and that monetary damages may be inadequate to compensate for such breach. Accordingly, in addition to any other rights and remedies that may be available to Prime Vendor and CUNY at law and in equity, Prime Vendor and/or CUNY shall be entitled to seek enforcement of the provisions of this Third Party NDA Agreement by seeking injunctive relief. 3.2 Severability. If any provision of this Third Party NDA Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, such determination shall not affect the validity or enforceability of any other part or provision of this Third Party NDA Agreement. 3.3 Waiver. No delay or omission by Prime Vendor or CUNY to exercise any right occurring upon Third Party's non-compliance or default with respect to any of the terms of this Third Party NDA Agreement shall impair any such right or power or be construed to be a waiver thereof. A waiver by Prime Vendor or CUNY of any of the covenants, conditions or agreements to be performed by Third Party shall not be construed to be a waiver of any succeeding breach thereof or of any other covenant, condition or agreement herein contained.

-2CUNY HOSTING RFP - ATTACHMENT A Exhibit 4 – THIRD PARTY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

3.4 Governing Law; Jurisdiction. The Third Party NDA Agreement, and all the rights and duties of Third Party arising from or relating in any way to the subject matter of the Third Party NDA Agreement or the transaction(s) contemplated by it, shall be governed by, construed and enforced only in accordance with the laws of the state of New York (excluding any conflict of laws provisions that would refer to and apply the substantive laws of another jurisdiction). THIRD PARTY AGREES TO THE EXCLUSIVE JURISDICTION AND VENUE OF THE APPLICABLE COURTS LOCATED IN THE STATE OF NEW YORK. 3.5 Third Party Beneficiary. Prime Vendor is a direct and intended third-party beneficiary of the terms of this Third Party NDA Agreement. If Third Party receives conflicting requests and/or instructions from Prime Vendor and CUNY with respect to the terms of this Third Party NDA Agreement, Third Party shall comply with Prime Vendor's requests and/or instructions. 3.6 Assignment; Subcontracting. Third Party shall not assign, subcontract or delegate any of its obligations under the Third Party NDA Agreement, without the prior written consent of Prime Vendor and CUNY. 3.7 Exclusive Agreement; Modifications. This Third Party NDA Agreement constitutes the complete and exclusive statement of the agreement of the parties with respect to the subject matter of this Third Party NDA Agreement and supersedes all prior oral and written proposals, negotiations, representations, promises, agreements, warranties or understandings concerning such subject matter. All provisions that by their nature require survival shall survive after any termination of this Third Party NDA Agreement or Third Party's access to the Prime Vendor Confidential Information. This Third Party NDA Agreement may be modified only pursuant to a writing executed by CUNY, Prime Vendor and Third Party. IN WITNESS WHEREOF, this Third Party Confidentiality and Non-Disclosure Agreement has been executed on the date and year first above written. [THIRD PARTY]

By: Printed Name: Title: ____________________________________

-3CUNY HOSTING RFP - ATTACHMENT A Exhibit 4 – THIRD PARTY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

ATTACHMENT B: MINIMUM QUALIFICATIONS CERTIFICATION By signing this form, the undersigned certifies that it can provide and/or meet all of the minimum qualifications listed below. Please use the line space, where provided, to describe how you are going to provide or meet each minimum qualification. The bidder must meet all of the qualifications described in Section 1.3. The Technical Proposal must contain information to support the claimed qualifications, as noted in the Minimum Qualifications Certification Form. You may count the same projects in multiple Minimum Qualification statements if the project meets the criteria. Qualification

As supported in this proposal on page(s)

1.1.

1.2

1.3

1.4

Proposer Signature and Title

Date:

Printed Name Company Name Company Address

CUNY HOSTING RFP

1

ATTACHMENT B

Attachment D: REFERENCE FORM Proposer Name: Reference Name: Reference Main Line of Business: Reference Contact Information Primary Contact Person’s Name: Title: Affiliation/Company employed by: Mailing Address: Phone: E-mail: Provide a brief description of a recent implementation for which they are serving as a reference. Implementation Description: Implementation Cost ($ Amount): Number of Employees: Dates of Engagement: Products implemented and the modules/ functionality within those products that were deployed: Current Status (complete, in progress, etc.): Services Provided and relevance to Business Application Descriptions (see Attachment B - please indicate the name of the application description): Sub-Contractors (if applicable*): Third-party Product used (if applicable):

* Note: If reference is for the Primary Contractor, please indicate if this project involved partnering with the subcontractor(s) proposed in this proposal. If reference is for a Subcontractor, please indicate if this project involved partnering with the Primary Contractor.

CUNY HOSTING RFP

ATTACHMENT D

ATTACHMENT E: CONTRACTOR’S RESPONSIBILITY WHEN PROPOSING FORMER CUNY EMPLOYEES It is the Contractor’s responsibility to ensure that it proposes staff that is eligible to work on the proposed project. It is an individual’s responsibility to comply with the Public Officer’s Law. The following procedure applies if either of the following criteria is met. • It is two years or less between the date that the individual is proposed and the individual’s date of separation from the State. •

The individual proposed has worked on the project while employed by CUNY, regardless of how long ago they left CUNY.

Procedure •

• •

Before the C ontractor proposes an individual, the individual must obtain an opinion from the New York State Ethics Commission that approves their participation in the project as they are proposed. A copy of this opinion must be on file in the Contractor’s office and available for review by CUNY, if requested. Failure to obtain New York State Ethics approval for an individual’s participation in a project may jeopardize the firm’s designation for that project.

CUNY Hosting RFP

Page 1

ATTACHMENT E

Attachment F: Proposer Information and Certifications (Please submit this with your Volume II: Price Proposal) CONTRACT NUMBER: UCO-560 PROJECT TITLE: CUNYfirst Project Migration and Hosting Services

I.

PROPOSER INFORMATION

FIRM NAME: ADDRESS:_ CITY:_

STATE:

ZIP CODE:

-

TELEPHONE : (

)

-

FAX: (

)

-

E-MAIL ADDRESS: CONTACT PERSON: Proposer’s Federal Identification Number (FIN):_ •

Please indicate below the name, title, address, and telephone/fax numbers of the person who prepared this proposal, as well as any other individual(s) with authority to negotiate and contractually bind the Offeror and also who may be contacted during the period of proposal evaluation:

Preparer’s Name/Title: Address: Telephone:

(

)

_-

FAX: (

)

-

FAX: (

)

-

Other Authorized Individual(s): Name/Title:_ Address:_ Telephone:

(

)

-

CUNY HOSTING RFP

ATTACHMENT F Page 1

II. PROPOSER CERTIFICATIONS By signing below, I,

, an authorized individual (NAME)

of

, make the following certifications

(FIRM) regarding the subject proposal: • • •

180-Day Offer: This proposal is a firm offer for a 180-day (or more) period from the date of submission. The firm has complied with the requirements of the Procurement Lobbying Act. M/W/DBE Status - check all that apply (NOTE: If you, or any sub-consultant, are claiming status as a certified minority-owned or women-owned business enterprise in New York State, you may be asked to produce copies of documentation of your status): Minority-Owned Women-Owned Neither of the above

Signature:

III. ACCEPTANCE OF AGREEMENT* By signing below, I, of

, authorized individual (NAME) hereby (ACCEPT/DO NOT ACCEPT) (circle one)

(FIRM) all the terms and conditions of Contract contained in Attachment E to this Request for Proposals. Signature: ( NAME OF ACCEPTOR) *

Any exceptions or deviations taken must contain sufficient amplification and justification to permit evaluation. The benefit to CUNY shall be explained for each exception taken. List any exceptions on a separate sheet(s) of paper and attach to this form. Such exceptions will not, of themselves, automatically cause a proposal to be termed unacceptable. However, a large number of exceptions - or one or more significant exceptions not providing benefit to CUNY - may result in rejection of such proposal as unacceptable.

CUNY HOSTING RFP

ATTACHMENT F Page 2

CUNY HOSTING RFP

ATTACHMENT F Page 3

ATTACHMENT G INFORMATION REQUIRED TO BE SUBMITTED BY SHORT-LISTED PROPOSERS

Note: In accordance with Section 4. Proposal Evaluation, the evaluation of the Technical and Management Proposal and the Price Proposal occurs in two (2) Stages. Stage I includes the evaluation of all the information required to be submitted in response to Section 3, Proposal Format and Contents, sub-sections 3.2, 3.3 and 3.4. Proposers that are short-listed based on the process set forth in Section 4. Proposal Evaluation, Stage I, Steps 1 through 3 will be notified in writing and required to provide the Key Personnel, Migration Project, and Hosting Site Capabilities information contained in this Attachment G. Do not include Attachment G information in your initial submission of the Volume I Technical and Management Proposal.

1.

Key Team Member Résumés and Executive Sponsor Title

Short-Listed Proposers must provide the following information upon written request from CUNY: a. Resumes of the Key Team Members for the Migration Project and Hosting Services, and cross over roles (see Section 2, Contract Specifics, sub-section 2.1.4 for a list of roles that will be considered as key staff). The Proposer shall indicate whether these individuals are employed by the Proposer or a proposed subcontractor. Résumés must include relevant employment history, years with and progression within Proposer or the applicable subcontractor, specific migration project and hosting services references that include mention of the person’s role in each referenced project, the number of similar projects completed in the past five years, education, licenses, and professional certifications. Résumés shall be limited to a maximum of three (3) pages. b. Biographies for additional proposed key staff (indicate whether they are employed by the Proposer or a proposed subcontractor). Biographies should provide a summary of the relevant skills and experience of the proposed staff member and should be limited to no more than a half page of text; c. The title and responsibilities of the Executive Sponsor; and d. An organization chart indicating how the Proposer’s recommended organization for the Migration Project and Hosting Services organization will be structured and how it will relate to Migration Project and Hosting Services roles at CUNY. Note: Submission of false or inaccurate information concerning a Proposer-proposed staff member shall result in disqualification of the candidate and, if appropriate, of the entire Proposal. Should it become necessary to replace any of the Key Team Members named in your Proposal during the evaluation

CUNY Hosting RFP

1

Attachment G

process, whether it is at the request of CUNY or the Proposer, Proposer is under a continuing obligation to provide CUNY with full information about a comparable replacement promptly. 2.

Migration Project

Short-Listed Proposers, upon written notice from CUNY, must provide technical information directly related to their Proposal, including, but not limited to, software and hardware platforms, operating systems, network and monitoring tools, storage platforms, and Disaster Recovery (DR) tools, as it relates to: a. Architecture and configuration document; b. Technical design and architecture; and c. DR methodology, procedures, and test plans.

3.

Hosting Site Capabilities

Short-Listed Proposers, upon written request from CUNY, must provide documentation on the following hosting site capabilities: a. Physical security; b. Physical condition of site; c. Physical capacity; d. Monitoring tools; e. Change control protocols; f. DR site; g. Physical location of primary site in relation to DR site; h. Fire suppression system; and i. Redundancy: i. Direct facility electrical power; ii. Backup power generation; and iii. Network and network providers.

CUNY Hosting RFP

2

Attachment G

ATTACHMENT H: PROCUREMENT LOBBYING ACT AND FORMS Procurement Lobbying Act 1. Required Forms: The consultant shall sign and e-mail or fax the following forms.

These forms are part of and due no later than the submission of the consultant’s proposal. a)

“Offerer’s Affirmation of Understanding of and Agreement pursuant to State Finance Law §139-j (3) and §139-j (6) (b)” “Offerer Disclosure of Prior Non-Responsibility Determinations”.

b)

2. CUNY Guidelines and Procedures Under the requirements of the State Procurement Lobbying Act all communications regarding advertised projects are to be channeled through the Office of the University Controller (Designated Contacts). Communication with any other CUNY employee concerning this project during the restricted period (i.e. from advertisement through designation) that is determined to be an attempt to influence the procurement may result in disqualification.

3. Summary of the policy and prohibitions regarding permissible contacts a) Contacts prior to designation: Any communications during the restricted period are only permitted with the following Designated Contact Person: Paul Fallon City University of New York 230 W. 41st Street New York, N. Y. 10036 Attention: CUNY Employee Assistance Program Services These are some communications during the restricted period exempted from this restriction: • • • • • • •

CUNY HOSTING RFP

Submission of a Proposal; Submittal of written questions as part of the solicitation process; Ministerial communications concerning due dates or contact information; Participation in a pre-proposal conference or site visit; Complaints by an offerer to CUNY’s Office of General Counsel where the Designated Contact fails to respond in a timely manner; Negotiations with the University after notice of a tentative contact award; Debriefings about a procurement contract award; or

Page 1

ATTACHMENT H

•

Filing of written disputes in administrative hearings, judicial proceedings and to the State Attorney General, Inspector General, or Comptroller, or the City District Attorney.

If any other CUNY employee is contacted and they believe a reasonable person would infer that the communication was intended to influence the procurement, the contact must be reported by the CUNY employee. If the University determines an impermissible contact was made, that offerer cannot be awarded the contract. A second violation would lead to a four year bar on the award of public contracts to the offerer. b) Contacts after designation CUNY identifies its primary negotiation contacts. The designated contacts for negotiation may then include: The Office of the University Controller Designation Analyst The Office of the University Controller Associate Controller The law does not limit who may be contacted during the negotiation process. However, if any CUNY employee is contacted and they believe a reasonable person would infer that the communication was intended to influence the procurement, the contact must be reported by the CUNY employee. c) Information Required from Offerers that contact CUNY staff, prior to contract approval by the Office of the State Comptroller: The individuals contacting CUNY should refer and shall be prepared to provide the following information, either by e-mail or fax as directed by CUNY: Person’s name, firm person works for, address of employer, telephone number, occupation, firm they are representing, and whether owner, employee, retained by or designated by the firm to appear before or contact CUNY. d) Applicability to an executed contract Restrictions similar to those described above apply to approval or denial of an assignment, amendment (other than amendments that are authorized and payable under the terms of the procurement contract as it was finally awarded or approved by the comptroller, as applicable), renewal or extension of a procurement contract, or any other material change in the procurement contract resulting in a financial benefit to the offerer. The staff noted above as well as the project manager and consultant manager are considered designated contact persons. The University may identify other contact persons for each of these processes. 4. For more information on this law Please visit http://www.ogs.ny.gov/acpl or contact the Designated Contact listed above.

CUNY HOSTING RFP

Page 2

ATTACHMENT H

Offerer’s Affirmation of Understanding of and Agreement pursuant to State Finance Law §139-j (3) and §139-j (6) (b)

Offerer affirms that it understands and agrees to comply with the procedures of the Government Entity relative to permissible Contacts as required by State Finance Law §139-j (3) and §139-j (6) (b). Contract Procurement No.

UCO-560

By: ___________________________________

Date:____________________

Name: ________________________________ Title: _________________________________ Contractor Name: _______________________________________________________ Contractor Address: _____________________________________________ ______________________________________________________________________ ______________________________________________________________________ Form 1

CUNY HOSTING RFP

Page 3

ATTACHMENT H

Offerer Disclosure of Prior Non-Responsibility Determinations Name of Individual or Entity Seeking to Enter into the Procurement Contract _____________________________________________________________________________________ Address: _____________________________________________________________________________ Name and Title of Person Submitting this Form: _______________________________________________ Contract Procurement Number: ______________UCO-539_________________ Date:________________________ 1. Has any Governmental Entity made a finding of non-responsibility regarding the individual or entity seeking to enter into the Procurement Contract in the previous four years? (Please circle): No Yes If yes, please answer the next three questions: 2. Was the basis for the finding of non-responsibility due to a violation of State Finance Law §139-j (Please circle): No Yes 3. Was the basis for the finding of non-responsibility due to the intentional provision of false or incomplete information to a Governmental Entity? (Please circle): No Yes 4. If you answered yes to any of the above questions, please provide details regarding the finding of nonresponsibility below. Governmental Entity: ___________________________________________________________ Date of Finding of Non-responsibility: ______________________________________________ Basis of Finding of Non-Responsibility: _____________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ (Add additional pages as necessary) 5. Has any Governmental Entity or other governmental agency terminated or withheld a Procurement Contract with the above-named individual or entity due to the intentional provision of false or incomplete information? (Please circle): No Yes 6. If yes, please provide details below. Governmental Entity: ____________________________________ Date of Termination or Withholding of Contract: ____________________________________ Basis of Termination or Withholding: ____________________________________________ ___________________________________________________________________________ ____________________________________________________________________________ ____________________________________________________________________________ ____________________________________________________________________________ (Add additional pages as necessary) Offerer certifies that all information provided to the Governmental Entity with respect to State Finance Law §139-k is complete, true and accurate. By:

Date: Signature

Name: Title:

CUNY HOSTING RFP

Form 2

Page 4

ATTACHMENT H

ATTACHMENT I COMPANY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

This Confidentiality and Non-Disclosure Agreement ("Agreement") is executed this ____ day of __________, 201_, by __________________________________ ("Company"). W I T N E S S E T H: WHEREAS, Company, a ____________ corporation with a place of business at ______________________________________________, is intending to respond to a Request for Proposals ("RFP“) by The City University of New York ("CUNY") for services to migrate CUNY’s hosting operations for its CUNYfirst Enterprise Resource Planning system ("CUNYfirst") applications to a new environment and to provide these hosting operations on an ongoing basis in a manner that will meet CUNY’s current and future needs. CUNY is an educational corporation acting pursuant to New York State Education Law Article 125, with its principal place of business at 205 East 42nd Street, New York, NY 10021; and WHEREAS, in preparing its response to the RFP, Company plans to attend a document viewing session at CUNY’s facilities in New York City at which prospective respondents to the RFP will be provided the opportunity to view certain technical and related system documentation in connection with CUNYfirst and will have access to certain confidential and proprietary information of CUNY; and WHEREAS, CUNY wants to protect the confidentiality of all such confidential and proprietary information that may be disclosed by CUNY to Company. NOW, THEREFORE, in consideration of the foregoing recitals and the mutual covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Company agrees to the foregoing and as follows: 1.

CONFIDENTIAL INFORMATION

CUNY Confidential Information shall mean all technical and related system documentation and information in connection with CUNYfirst that CUNY makes available to prospective respondents to the RFP at the document viewing session in New York City and thereafter in response to the questions raised by the prospective respondents to the RFP who attend the document viewing session. 2.

NON-DISCLOSURE AND RESTRICTED USE OF CONFIDENTIAL INFORMATION

2.1 Nondisclosure and Restricted Use. Company acknowledges and agrees that CUNY owns all right, title and interest in and to the Confidential Information, and in and to all copies thereof, and in and to all of the related trade secrets, copyrights, patents and other proprietary rights. Accordingly, at all times during and after Company's access to the Confidential Information, Company will hold the Confidential Information in confidence, and Company: (a) shall not use, copy, disclose or otherwise make the Confidential Information available to any other person or entity without the prior written consent of CUNY; and (b) shall not remove or permit to be removed from the Confidential Information any notice placed thereon

-1CUNY HOSTING RFP COMPANY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

by CUNY indicating the confidential nature of, or the proprietary right of CUNY in, the Confidential Information. The furnishing of the Confidential Information for the limited purposes set forth herein does not constitute the grant, option, license, sublicense, assignment, or other form of transfer to Company of any rights, title or interest in or to such Confidential Information. 2.2 Notification Obligation. If Company becomes aware of any unauthorized use or disclosure of the Confidential Information by any person or entity, Company promptly and fully shall advise CUNY of all facts known to Company concerning such unauthorized use or disclosure. 2.3 Return of Confidential Information. At any time upon CUNY's request, Company shall promptly return to CUNY (or destroy, provided a written certification of such destruction is provided to CUNY) all of the Confidential Information in Company's possession, custody or control. In connection with any such return, upon CUNY's request, Company shall provide CUNY with an affidavit stating that: (a) Company has returned to CUNY all Confidential Information to which Company had access; (b) Company does not have any Confidential Information, or copies thereof, in Company's possession, custody or control; and (c) Company has not made the Confidential Information, or any part thereof, available to any other person or entity without the prior written consent of CUNY. If Company has made the Confidential Information available to another person or entity without the prior written consent of CUNY, Company agrees to promptly document the extent and nature of such dissemination, including, without limitation, identifying: (d) what Confidential Information was disclosed; (e) to whom the Confidential Information was disclosed; (f) the manner and means by which the Confidential Information was disclosed; and (g) the date(s) on which such disclosure occurred. 3.

GENERAL PROVISIONS

3.1 Injunctive Relief. Because of the unique and highly confidential nature of the Confidential Information, Company acknowledges and agrees that CUNY may suffer irreparable harm if Company breaches any of Company's obligations under this Agreement and that monetary damages may be inadequate to compensate for such breach. Accordingly, in addition to any other rights and remedies that may be available to CUNY at law and in equity, CUNY shall be entitled to seek enforcement of the provisions of this Agreement by seeking injunctive relief. 3.2 Severability. If any provision of this Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, such determination shall not affect the validity or enforceability of any other part or provision of this Agreement. 3.3 Waiver. No delay or omission by CUNY to exercise any right occurring upon Company's non-compliance or default with respect to any of the terms of this Agreement shall impair any such right or power or be construed to be a waiver thereof. A waiver by CUNY of any of the covenants, conditions or agreements to be performed by Company shall not be construed to be a waiver of any succeeding breach thereof or of any other covenant, condition or agreement herein contained. 3.4 Public Disclosures. Without the prior written consent of CUNY, which consent may be withheld in CUNY's sole discretion, Company shall not make or publish, directly or indirectly, any statements, articles, public or private announcements (including, without limitation, any announcement made via e-mail or any posting on the Internet), media releases,

-2CUNY HOSTING RFP COMPANY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

press conferences, the name, image or logo of CUNY or any of its educational units, related entities, or auxiliary enterprises (or any variation or combination of such name, image or logo), as well as the name or image of any CUNY employee or contractor of CUNY. 3.5 Governing Law; Jurisdiction. This Agreement, and all the rights and duties of Company arising from or relating in any way to the subject matter of this Agreement or the transaction(s) contemplated by it, shall be governed by, construed and enforced only in accordance with the laws of the United States and the State of New York (excluding any conflict of laws provisions that would refer to and apply the substantive laws of another jurisdiction). COMPANY AGREES TO THE EXCLUSIVE JURISDICTION AND VENUE OF THE APPLICABLE COURTS LOCATED IN THE STATE OF NEW YORK. 3.6 Assignment; Subcontracting. Company shall not assign this Agreement, nor subcontract or delegate any of its obligations under this Agreement, without the prior written consent of CUNY. 3.7 Exclusive Agreement; Modifications. This Agreement constitutes the complete and exclusive statement of the agreement of the parties with respect to the subject matter of this Agreement and supersedes all prior oral and written proposals, negotiations, representations, promises, agreements, warranties or understandings concerning such subject matter. All provisions that by their nature require survival shall survive after any termination of this Agreement or Company's access to the Confidential Information. This Agreement may be modified only pursuant to a writing executed by CUNY and Company. IN WITNESS WHEREOF, this Confidentiality and Non-Disclosure Agreement has been executed on the date and year first above written. [COMPANY] By: Printed Name: Title: ____________________________________

-3CUNY HOSTING RFP COMPANY CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT

ATTACHMENT J: MWBE RFP PROVISIONS CONTRACTOR REQUIREMENTS AND PROCEDURES FOR BUSINESS PARTICIPATION OPPORTUNITIES FOR NEW YORK STATE CERTIFIED MINORITY- AND WOMENOWNED BUSINESS ENTERPRISES AND EQUAL EMPLOYMENT OPPORTUNITIES FOR MINORITY GROUP MEMBERS AND WOMEN NEW YORK STATE LAW Pursuant to New York State Executive Law Article 15-A, the City University of New York (“CUNY”) recognizes its obligation under the law to promote opportunities for maximum feasible participation of certified minority-and women-owned business enterprises and the employment of minority group members and women in the performance of CUNY contracts. In 2006, the State of New York commissioned a disparity study to evaluate whether minority and womenowned business enterprises had a full and fair opportunity to participate in state contracting. The findings of the study were published on April 29, 2010, under the title "The State of Minority and Women-Owned Business Enterprises: Evidence from New York" (“Disparity Study”). The report found evidence of statistically significant disparities between the level of participation of minority-and women-owned business enterprises in state procurement contracting versus the number of minority-and women-owned business enterprises that were ready, willing and able to participate in state procurements. As a result of these findings, the Disparity Study made recommendations concerning the implementation and operation of the statewide certified minority- and women-owned business enterprises program. The recommendations from the Disparity Study culminated in the enactment and the implementation of New York State Executive Law Article 15-A, which requires, among other things, that CUNY establishes goals for maximum feasible participation of New York State Certified minority- and women – owned business enterprises (“MWBE”) and the employment of minority groups members and women in the performance of New York State contracts. This Attachment is incorporated into and made part of the Request for Proposals to which it is attached. Business Participation Opportunities for MWBEs

For purposes of this solicitation, CUNY hereby establishes an overall goal of 20% for MWBE participation (based on the current availability of qualified MWBEs). A contractor (“Contractor”) on the contract awarded pursuant to this RFP (the “Contract”) may satisfy this participation goal by subcontracting a portion of the Services under the Contract to New York State Certified Minority-Owned Business Enterprises (“MBE”) or Women-Owned Business Enterprises (“WBE”) or to a combination of MBEs and WBEs. . A Contractor must document good faith efforts to provide meaningful participation by MWBEs as subcontractors or suppliers in the performance of the Contract and Contractor agrees that CUNY may withhold payment pending receipt of the required MWBE documentation. The directory of New York State Certified MWBEs can be viewed at: http://www.esd.ny.gov/mwbe.html. For guidance on how CUNY will determine a Contractor’s “good faith efforts,” refer to 5 NYCRR §142.8. In accordance with 5 NYCRR §142.13, Contractor acknowledges that if it is found to have willfully and intentionally failed to comply with the MWBE participation goals set forth in the Contract, such finding CUNY HOSTING RFP

1

ATTACHMENT J

constitutes a breach of Contract and CUNY may withhold payment from the Contractor as liquidated damages. Such liquidated damages shall be calculated as an amount equaling the difference between: (1) all sums identified for payment to MWBEs had the Contractor achieved the contractual MWBE goals; and (2) all sums actually paid to MWBEs for work performed or materials supplied under the Contract. By submitting a bid or proposal, a bidder or proposer for the Contract (“Proposer”) agrees to submit the following documents and information as evidence of compliance with the foregoing: A. Proposers are required to submit a MWBE Utilization Plan on Form #1 with their bid or proposal. Any modifications or changes to the MWBE Utilization Plan after the Contract award and during the term of the Contract must be reported on a revised MWBE Utilization Plan and submitted to CUNY. B. CUNY will review the submitted MWBE Utilization Plan and advise the Proposer of CUNY acceptance or issue a notice of deficiency within 30 days of receipt. C. If a notice of deficiency is issued, Proposer agrees that it shall respond to the notice of deficiency within seven (7) business days of receipt by submitting to the City University of New York, 230 W. 41st Street, 5th Floor, New York, NY 10036, Attention: John Harwood, fax 212 397-5685, a written remedy in response to the notice of deficiency. If the written remedy that is submitted is not timely or is found by CUNY to be inadequate, CUNY shall notify the Proposer and direct the Proposer to submit, within five (5) business days, a request for a partial or total waiver of MWBE participation goals on Form #2. Failure to file the waiver form in a timely manner may be grounds for disqualification of the bid or proposal. D. CUNY may disqualify a Proposer as being non-responsive under the following circumstances: a) If a Proposer fails to submit a MWBE Utilization Plan; b) If a Proposer fails to submit a written remedy to a notice of deficiency; c) If a Proposer fails to submit a request for waiver; or d) If CUNY determines that the Proposer has failed to document good faith efforts. Contractors shall attempt to utilize, in good faith, any MBE or WBE identified within its MWBE Utilization Plan, during the performance of the Contract. Requests for a partial or total waiver of established goal requirements made subsequent to Contract Award may be made at any time during the term of the Contract to CUNY, but must be made no later than prior to the submission of a request for final payment on the Contract. Contractors are required to submit a Contractor’s Quarterly M/WBE Contractor Compliance & Payment Report on Form #3 to CUNY (at the address and to the attention of the office required by CUNY from time to time) by the 10th day following each end of quarter over the term of the Contract documenting the progress made toward achievement of the MWBE goals of the Contract. All reporting forms and manner of reporting referenced herein are subject to revision by CUNY at any time. Equal Employment Opportunity Requirements By submission of a bid or proposal in response to this solicitation, the Proposer/Contractor agrees with all of the terms and conditions of Appendix A – Standard Clauses for All New York State Contracts CUNY HOSTING RFP

2

ATTACHMENT J

including Clause 12 - Equal Employment Opportunities for Minorities and Women. The Contractor is required to ensure that it and any subcontractors awarded a subcontract over $25,000 for the construction, demolition, replacement, major repair, renovation, planning or design of real property and improvements thereon (the "Work") except where the Work is for the beneficial use of the Contractor, shall undertake or continue programs to ensure that minority group members and women are afforded equal employment opportunities without discrimination because of race, creed, color, national origin, sex, age, disability or marital status. For these purposes, equal opportunity shall apply in the areas of recruitment, employment, job assignment, promotion, upgrading, demotion, transfer, layoff, termination, and rates of pay or other forms of compensation. This requirement does not apply to: (i) work, goods, or services unrelated to the Contract; or (ii) employment outside New York State. The selected Proposer agrees to submit to CUNY, within ten (10) days of CUNY’s request, a Minority and Women-Owned Business Enterprises and Equal Employment Opportunity Policy Statement, Form # 4. The selected Proposer further agrees to submit to CUNY, within ten (10) days of CUNY’s request, a staffing plan (Form #5) identifying the anticipated work force to be utilized on the Contract and if awarded a Contract, will, upon request, submit to CUNY, a workforce utilization report identifying the workforce actually utilized on the Contract if known. Further, pursuant to Article 15 of the Executive Law (the “Human Rights Law”), all other State and Federal statutory and constitutional non-discrimination provisions, the Contractor and sub-contractors will not discriminate against any employee or applicant for employment because of race, creed (religion), color, sex, national origin, sexual orientation, military status, age, disability, predisposing genetic characteristic, marital status or domestic violence victim status, and shall also follow the requirements of the Human Rights Law with regard to non-discrimination on the basis of prior criminal conviction and prior arrest. Please Note: Failure to comply with the foregoing requirements may result in a finding of nonresponsiveness, non-responsibility and/or a breach of the Contract, leading to the withholding of funds, suspension or termination of the Contract or such other actions or enforcement proceedings as allowed by the Contract.

CUNY HOSTING RFP

3

ATTACHMENT J

ATTACHMENT J: MWBE CONTRACT PROVISIONS PARTICIPATION BY MINORITY GROUP MEMBERS AND WOMEN WITH RESPECT TO STATE CONTRACTS: REQUIREMENTS AND PROCEDURES I. General Provisions A. The City University of New York (“CUNY”) is required to implement the provisions of New York State Executive Law Article 15-A and 5 NYCRR Parts 142-144 (“MWBE Regulations”) for all State contracts as defined therein, with a value (1) in excess of $25,000 for labor, services, equipment, materials, or any combination of the foregoing or (2) in excess of $100,000 for real property renovations and construction. B. The Contractor to the subject contract (the “Contractor” and the “Contract,” respectively) agrees, in addition to any other nondiscrimination provision of the Contract and at no additional cost to CUNY, to fully comply and cooperate with CUNY in the implementation of New York State Executive Law Article 15-A. These requirements include equal employment opportunities for minority group members and women (“EEO”) and contracting opportunities for certified minority and women-owned business enterprises (“MWBEs”). Contractor’s demonstration of “good faith efforts” pursuant to 5 NYCRR §142.8 shall be a part of these requirements. These provisions shall be deemed supplementary to, and not in lieu of, the nondiscrimination provisions required by New York State Executive Law Article 15 (the “Human Rights Law”) or other applicable federal, state or local laws. C. Failure to comply with all of the requirements herein may result in a finding of nonresponsiveness, non-responsibility and/or a breach of contract, leading to the withholding of funds or such other actions, liquidated damages pursuant to Section VII of this Attachment or enforcement proceedings as allowed by the Contract. D. This Attachment is incorporated into and made part of the Request for Proposals to which it is attached and the Contract to be procured thereunder. II. Contract Goals

A. For purposes of this procurement, CUNY hereby establishes an overall goal of 20% for Minority and Women-Owned Business Enterprises (“MWBE”) participation (based on the current availability of qualified MWBEs). Contractor may satisfy this participation goal by subcontracting a portion of the Services under the Contract to New York State Certified MinorityOwned Business Enterprises (“MBE”) or Women-Owned Business Enterprises (“WBE”) or to a combination of MBEs and WBEs.

B. For purposes of providing meaningful participation by MWBEs on the Contract and achieving the Contract Goals established in Section II-A hereof, Contractor should reference the directory of New York State Certified MBWEs found at the following internet address:

________________________________________________________________+_ http://www.esd.ny.gov/mwbe.html CUNY HOSTING RFP

4

ATTACHMENT J

Additionally, Contractor is encouraged to contact the Division of Minority and Woman Business Development ((518) 292-5250; (212) 803-2414; or (716) 846-8200) to discuss additional methods of maximizing participation by MWBEs on the Contract. C. Where MWBE goals have been established herein, pursuant to 5 NYCRR §142.8, Contractor must document “good faith efforts” to provide meaningful participation by MWBEs as subcontractors or suppliers in the performance of the Contract. In accordance with Section 316-a of Article 15-A and 5 NYCRR §142.13, the Contractor acknowledges that if Contractor is found to have willfully and intentionally failed to comply with the MWBE participation goals set forth in the Contract, such a finding constitutes a breach of contract and the Contractor shall be liable to CUNY for liquidated or other appropriate damages, as set forth herein. III. Equal Employment Opportunity (EEO) A. Contractor agrees to be bound by the provisions of Article 15-A and the MWBE Regulations promulgated by the Division of Minority and Women's Business Development of the Department of Economic Development (the “Division”). If any of these terms or provisions conflict with applicable law or regulations, such laws and regulations shall supersede these requirements. B. Contractor shall comply with the following provisions of Article 15-A: 1. Contractor and Subcontractors shall undertake or continue existing EEO programs to ensure that minority group members and women are afforded equal employment opportunities without discrimination because of race, creed, color, national origin, sex, age, disability or marital status. For these purposes, EEO shall apply in the areas of recruitment, employment, job assignment, promotion, upgrading, demotion, transfer, layoff, or termination and rates of pay or other forms of compensation. 2. The Contractor shall submit an EEO policy statement to CUNY within ten (10) days of CUNY’s request. 3. If Contractor or Subcontractor does not have an existing EEO policy statement, CUNY may provide the Contractor or Subcontractor a model statement (see Form # 4 – Minority and Women-Owned Business Enterprises Equal Employment Opportunity Policy Statement). 4. The Contractor’s EEO policy statement shall include the following language: a. The Contractor will not discriminate against any employee or applicant for employment because of race, creed, color, national origin, sex, age, disability or marital status, will undertake or continue existing EEO programs to ensure that minority group members and women are afforded equal employment opportunities without discrimination, and shall make and document its conscientious and active efforts to employ and utilize minority group members and women in its work force. b. The Contractor shall state in all solicitations or advertisements for employees that, in the performance of the contract, all qualified applicants will be afforded equal employment opportunities without discrimination because of race, creed, color, national origin, sex, age, disability or marital status. c. The Contractor shall request each employment agency, labor union, or authorized representative of workers with which it has a collective bargaining or other agreement or understanding, to furnish a written statement that such employment agency, labor union, or representative will not discriminate on the basis of race, creed, color, national origin, CUNY HOSTING RFP

5

ATTACHMENT J

sex age, disability or marital status and that such union or representative will affirmatively cooperate in the implementation of the Contractor's obligations herein. d. The Contractor will include the provisions of Subdivisions (a) through (c) of this Subsection 4 and Paragraph “E” of this Section III, which provides for relevant provisions of the Human Rights Law, in every subcontract in such a manner that the requirements of the subdivisions will be binding upon each subcontractor as to work in connection with the Contract. C. Form # 5 – Equal Employment Opportunity Staffing Plan To ensure compliance with this Section, the Contractor shall submit a staffing plan (Form # 5) to document the composition of the proposed workforce to be utilized in the performance of the Contract by the specified categories listed, including ethnic background, gender, and Federal occupational categories. Contractors shall complete the Staffing plan form and submit it within ten days of CUNY’s request, but no later than the time of award of the contract. D. Form #6 - Equal Employment Opportunity Workforce Employment Utilization Report (“Workforce Report”) 1. Once a contract has been awarded and during the term of Contract, Contractor is responsible for updating and providing notice to CUNY of any changes to the previously submitted Staffing Plan. This information is to be submitted on a quarterly basis during the term of the contract to report the actual workforce utilized in the performance of the contract by the specified categories listed including ethnic background, gender, and Federal occupational categories. The Workforce Report must be submitted to report this information. 2. Separate forms shall be completed by Contractor and any subcontractor performing work on the Contract. 3. In limited instances, Contractor may not be able to separate out the workforce utilized in the performance of the Contract from Contractor's and/or subcontractor's total workforce. When a separation can be made, Contractor shall submit the Workforce Report and indicate that the information provided related to the actual workforce utilized on the Contract. When the workforce to be utilized on the contract cannot be separated out from Contractor's and/or subcontractor's total workforce, Contractor shall submit the Workforce Report and indicate that the information provided is Contractor's total workforce during the subject time frame, not limited to work specifically under the contract. E. Contractor shall comply with the provisions of the Human Rights Law, all other State and Federal statutory and constitutional non-discrimination provisions. Contractor and subcontractors shall not discriminate against any employee or applicant for employment because of race, creed (religion), color, sex, national origin, sexual orientation, military status, age, disability, predisposing genetic characteristic, marital status or domestic violence victim status, and shall also follow the requirements of the Human Rights Law with regard to non-discrimination on the basis of prior criminal conviction and prior arrest. IV. MWBE Utilization Plan A. The Contractor represents and warrants that Contractor has submitted an MWBE Utilization Plan, Form # 1, either prior to, or at the time of, the execution of the contract.

CUNY HOSTING RFP

6

ATTACHMENT J

B. Contractor agrees to use such MWBE Utilization Plan for the performance of MWBEs on the Contract pursuant to the prescribed MWBE goals set forth in Section III-A of this Attachment. C. Contractor further agrees that a failure to submit and/or use such MWBE Utilization Plan shall constitute a material breach of the terms of the Contract. Upon the occurrence of such a material breach, CUNY shall be entitled to any remedy provided herein, including but not limited to, a finding of Contractor non-responsiveness. V. Waivers A. For Waiver Requests Contractor should use Form # 2, the Request for Waiver of MWBE Participation Goal. B. If the Contractor, after making good faith efforts, is unable to comply with MWBE goals, the Contractor may submit a Request for Waiver form documenting good faith efforts by the Contractor to meet such goals. If the documentation included with the waiver request is complete, CUNY shall evaluate the request and issue a written notice of acceptance or denial within twenty (20) days of receipt. C. If CUNY, upon review of the MWBE Utilization Plan and updated Quarterly MWBE Contractor Compliance Reports determines that Contractor is failing or refusing to comply with the Contract goals and no waiver has been issued in regards to such non-compliance, CUNY may issue a notice of deficiency to the Contractor. The Contractor must respond to the notice of deficiency within seven (7) business days of receipt. Such response may include a request for partial or total waiver of MWBE Contract Goals. VI. Quarterly MWBE Contractor Compliance Report Contractor is required to submit a Quarterly MWBE Contractor Compliance Report, Form # 3, to CUNY by the 10th day following each end of quarter over the term of the Contract documenting the progress made towards achievement of the MWBE goals of the Contract. All reporting forms and manner of reporting referenced herein are subject to revision by CUNY at any time.

VII. Liquidated Damages - MWBE Participation A. Where CUNY determines that Contractor is not in compliance with the requirements of the Contract and Contractor refuses to comply with such requirements, or if Contractor is found to have willfully and intentionally failed to comply with the MWBE participation goals, Contractor shall be obligated to pay to CUNY liquidated damages.

B. Such liquidated damages shall be calculated as an amount equaling the difference between: 1. All sums identified for payment to MWBEs had the Contractor achieved the contractual MWBE goals; and 2. All sums actually paid to MWBEs for work performed or materials supplied under the Contract. CUNY HOSTING RFP

7

ATTACHMENT J

C. In the event a determination has been made which requires the payment of liquidated damages and such identified sums have not been withheld by CUNY, Contractor shall pay such liquidated damages to CUNY within sixty (60) days after they are assessed by CUNY unless prior to the expiration of such sixtieth day, the Contractor has filed a complaint with the Director of the Division of Minority and Woman Business Development pursuant to Subdivision 8 of Section 313 of the Executive Law in which event the liquidated damages shall be payable if Director renders a decision in favor of CUNY.

Contractor shall designate a staff member to act as the Minority Business Enterprise Liaison responsible for administering the Minority and Women-Owned Business Enterprises-Equal Employment Opportunity (M/WBE-EEO) program for this Contract, and shall provide such Liaison’s identity and contact information to CUNY upon request. Contractor’s Liaison shall coordinate all M/WBE-EEO Contract matters with University staff designated by CUNY for such purposes.

M/WBE Contract Goals 20% Minority and Women’s Business Enterprise Participation

CUNY HOSTING RFP

8

ATTACHMENT J

ATTACHMENT K - NEW YORK STATE FORMS

MWBE & EEO Forms  Form #1 – MWBE Utilization Plan  Form #2 – Request for Waiver of MWBE Participation Goals  Form #3 – Quarterly MWBE Contractor Compliance Report  Form #4 – MWBE & EEO Policy Statement  Form #5 – EEO Staffing Plan  Form #6 – EEO Workforce Employment Utilization Report

[FORMS TO FOLLOW THIS PAGE]

CUNYfirst Hosting RFP

1

ATTACHMENT K

Form 1 - M/WBE UTILIZATION PLAN

INSTRUCTIONS: This form must be submitted with any bid, proposal, or proposed negotiated contract or within a reasonable time thereafter, but prior to contract award. This Utilization Plan must contain a detailed description of the supplies and/or services to be provided by each certified Minority and Women-owned Business Enterprise (M/WBE) under the contract, Attach additional sheets as necessary.

Offeror’s Name: Address: City, State, Zip Code: Telephone No.: Region/Location of Work: 1. Certified M/WBE Subcontractors/Suppliers Name, Address, Email Address, Telephone No.

A.

B.

Federal Identification No.: Solicitation No.:

Project No.: M/WBE Goals in the Contract: MBE 20%

2. Classification (circle MBE or WBE below, as applicable)

3. Federal ID No.

4. Detailed Description of Work (Attach additional sheets, if necessary)

5. Dollar Value of Subcontracts/ Supplies/Services and intended performance dates of each component of the contract.

NYS ESD CERTIFIED* MBE WBE NYS ESD CERTIFIED MBE WBE

6. IF UNABLE TO FULLY MEET THE MBE AND WBE GOALS SET FORTH IN THE CONTRACT, OFFEROR MUST SUBMIT A REQUEST FOR WAIVER FORM (Form # 2).

PREPARED BY (Signature):

TELEPHONE NO.: EMAIL ADDRESS:

DATE: FOR M/WBE USE ONLY

NAME AND TITLE OF PREPARER (Print or Type): SUBMISSION OF THIS FORM CONSTITUTES THE OFFEROR’S ACKNOWLEDGEMENT AND AGREEMENT TO COMPLY WITH THE M/WBE REQUIREMENTS SET FORTH UNDER NYS EXECUTIVE LAW, ARTICLE 15-A, 5 NYCRR PART 143, AND THE ABOVE-REFERENCED SOLICITATION. FAILURE TO SUBMIT COMPLETE AND ACCURATE INFORMATION MAY RESULT IN A FINDING OF NONCOMPLIANCE AND POSSIBLE TERMINATION OF YOUR CONTRACT.

*If NYSESD Certified as both MBE & WBE, only MBE or WBE may be used, not both.

REVIEWED BY:

UTILIZATION PLAN APPROVED: YES NO Date: Contract No.: Project No. (if applicable): Contract Award Date: Estimated Date of Completion: Amount Obligated Under the Contract: Description of Work: NOTICE OF DEFICIENCY ISSUED:

MWBE Form # 1

DATE:

YES

NO

Date:

NOTICE OF ACCEPTANCE ISSUED: YES

NO

Date:

FORM 2 - REQUEST FOR WAIVER FORM INSTRUCTIONS: SEE PAGE 2 OF THIS ATTACHMENT FOR REQUIREMENTS AND DOCUMENT SUBMISSION INSTRUCTIONS. Offerer/Contractor Name: Federal Identification No.: Address:

Solicitation/Contract No.:

City, State, Zip Code:

M/WBE Goals: 20%

By submitting this form and the required information, the offerer/contractor certifies that every Good Faith Effort has been taken to promote M/WBE participation pursuant to the M/WBE requirements set forth under the contract. Contractor is requesting a: 1.

MWBE Waiver – A waiver of the MBE Goal for this procurement is requested.

Total

Partial

2. Waiver Pending ESD Certification – (Check here if subcontractors or suppliers of Contractor are not certified M/WBE, but an application for certification has been filed with Empire State Development.) Date of such filing with Empire State Development: ____________________________ PREPARED BY (Signature):

Date:

SUBMISSION OF THIS FORM CONSTITUTES THE OFFERER/CONTRACTOR’S ACKNOWLEDGEMENT AND AGREEMENT TO COMPLY WITH THE M/WBE REQUIREMENTS SET FORTH UNDER NYS EXECUTIVE LAW, ARTICLE 15-A AND 5 NYCRR PART 143. FAILURE TO SUBMIT COMPLETE AND ACCURATE INFORMATION MAY RESULT IN A FINDING OF NONCOMPLIANCE AND/OR TERMINATION OF THE CONTRACT.

Name and Title of Preparer (Printed or Typed):

If necessary, submit with the bid or proposal or if submitting after award submit to such address and office as required by The City University of New York from time to time.

Telephone Number:

Email Address:

******************** FOR CAMPUS USE ONLY ******************** REVIEWED BY:

Waiver Granted:

DATE:

YES

Total Waiver Partial Waiver *Conditional Notice of Deficiency Issued ___________________ *Comments:

MWBE Form # 2

REQUIREMENTS AND DOCUMENT SUBMISSION INSTRUCTIONS When completing the Request for Waiver Form please check all boxes that apply. To be considered, the Request for Waiver Form must be accompanied by documentation for items 1 – 11, as listed below. If box # 3 has been checked above, please see item 11. Copies of the following information and all relevant supporting documentation must be submitted along with the request: 1.

A statement setting forth your basis for requesting a partial or total waiver.

2.

The names of general circulation, trade association, and M/WBE-oriented publications in which you solicited certified M/WBEs for the purposes of complying with your participation goals.

3.

A list identifying the date(s) that all solicitations for certified M/WBE participation were published in any of the above publications.

4.

A list of all certified M/WBEs appearing in the NYS Directory of Certified Firms that were solicited for purposes of complying with your certified M/WBE participation levels.

5.

Copies of notices, dates of contact, letters, and other correspondence as proof that solicitations were made in writing and copies of such solicitations, or a sample copy of the solicitation if an identical solicitation was made to all certified M/WBEs.

6.

Provide copies of responses made by certified M/WBEs to your solicitations.

7.

Provide a description of any contract documents, plans, or specifications made available to certified M/WBEs for purposes of soliciting their bids and the date and manner in which these documents were made available.

8.

Provide documentation of any negotiations between you, the Offerer/Contractor, and the M/WBEs undertaken for purposes of complying with the certified M/WBE participation goals.

9.

Provide any other information you deem relevant which may help us in evaluating your request for a waiver.

10. Provide the name, title, address, telephone number, and email address of offerer/contractor’s representative authorized to discuss and negotiate this waiver request. 11. Copy of notice of application receipt issued by Campus.

Note: Unless a Total Waiver has been granted, the offerer or contractor will be required to submit all reports and documents pursuant to the provisions set forth in the Contract, as deemed appropriate by CUNY, to determine M/WBE compliance.

MWBE Form # 2

Form 3 - Quarterly M/WBE Contractor Compliance Report

Page __ of __

CUNY SERVICES CONTRACTS Reporting Quarter

4/1/__ - 6/30/__

7/1/__ - 9/30/__

10/1/__ - 12/31/__

1/1/__ - 3/31/__

Instructions: For EACH CUNY Services Contract on which you are the Prime Contractor complete at least one of these Quarterly M/WBE Contractor Compliance Report Forms, as follows: A. Prime Contractor is NOT a NYS Certified M/WBE AND Prime Contractor did NOT utilize any NYS Certified M/WBE Vendor on the contract/purchase order/task order during the applicable Reporting Quarter: Complete the "PRIME CONTRACTOR INFORMATION" section of this form only and sign at the bottom. B. Prime Contractor is a NYS Certified M/WBE &/OR Prime Contractor utilized one or more NYS Certified M/WBE Vendors on the contract/purchase order/task order during the applicable Reporting Quarter: Complete & sign a separate form, including both the "PRIME CONTRACTOR INFORMATION" & the "NYS CERTIFIED M/WBE VENDOR INFORMATION" sections of this form, for EACH NYS Certified M/WBE Vendor utilized, including you if applicable, during the Reporting Quarter.If a particular M/WBE Vendor was utilized as a sub-contractor on more than one contract, purchase order or task order, complete a separate form for the M/WBE Vendor for EACH contract, purchase order or task order on which that M/WBE Vendor was utilized. Likewise, if a particular M/WBE Vendor was utilized to provide more than one type of work, product or service on a particular contract, purchase order or task order, complete a separate form for EACH type of work, product or service provided by that M/WBE Vendor on the contract, purchase order or task order. For example, if M/WBE Vendor XYZ provided both security services & cleaning services on a particular contract, purchase order or task order,complete a separate form for M/WBE Vendor XYZ for each of these two services.

PRIME CONTRACTOR INFORMATION Prime Contractor Name Prime Contract #/ Purchase Order # Task Order Project # Prime Contract Start Date

____/____/____

Industry of the Prime Contract

___ Construction ___ Commodities

___ Construction Consultant ___ Services/Consultant ___ Other (specify) ____________________________

NYS CERTIFIED M/WBE VENDOR INFORMATION * *Vendors include NYS Certified Subcontractors, Suppliers & Prime Contractors

NYS Certified M/WBE Vendor Name Vendor Address Vendor Payee ID (Federal ID #) ____ Prime Contractor

Vendor Contractor Status Describe the Work, Product or Service Provided by the Vendor Vendor NYS Certified M/WBE Status

____ Sub-contractor/Supplier

(Note: Only one type of Work, Product or Service may be cited.)

Indicate one Status ONLY:

Total Dollar Amount Invoiced from NYS Certified M/WBE Vendor in the Reporting Quarter (Even if $0)

___ MBE

___ WBE

$ ____________________

`` Report Prepared by: Name ________________________________________ Title _________________________________________

Signature _______________________________ Date ___/___/___

Form 4 MINORITY AND WOMEN-OWNED BUSINESS ENTERPRISES AND EQUAL EMPLOYMENT OPPORTUNITY POLICY STATEMENT (Name of Bidder/Proposer)___________________, the (bidder/proposer) agrees to adopt the following policies with respect to the following project: Project Title:____________ Project Number:___________.

This organization will and will cause its (a) This organization will not discriminate EEO contractors and subcontractors to take good against any employee or applicant for faith actions to achieve the M/WBE contract participation goals set employment because of race, creed, color, national origin, sex, by the State for that area in which the State-funded project is age, disability or marital status, will undertake or continue existing located, by taking the following steps: programs of affirmative action to ensure that minority group members are afforded equal employment opportunities without (1) Actively and affirmatively solicit bids for contracts and discrimination, and shall make and document its conscientious subcontracts from qualified State certified MBEs or WBEs, and active efforts to employ and utilize minority group members including solicitations to M/WBE contractor associations. and women in its work force on state contracts. (2) Reference the Directory of the New York State Certified (b)This organization shall state in all solicitations or M/WBEs found at the following internet address: advertisements for employees that in the performance of the http://www.esd.ny.gov/mwbe.html and solicit bids from State contract all qualified applicants will be afforded equal them directly. employment opportunities without discrimination because of race, (3) Ensure that plans, specifications, request for proposals creed, color, national origin, sex disability or marital status. and other documents used to secure bids will be made (c) At the request of the contracting agency, this organization available in sufficient time for review by prospective shall request each employment agency, labor union, or M/WBEs. authorized representative will not discriminate on the basis of (4) Where feasible, divide the work into smaller portions to race, creed, color, national origin, sex, age, disability or marital enhance participation by M/WBEs and encourage the status and that such union or representative will affirmatively formation of joint venture and other partnerships among cooperate in the implementation of this organization’s obligations M/WBE contractors to enhance their participation. herein. (5) Document and maintain records of bid solicitation, (d) Contractor shall comply with the provisions of the Human including those to M/WBEs and the results thereof. Rights Law, all other State and Federal statutory and Contractor will also maintain records of actions that its constitutional non-discrimination provisions. Contractor and subcontractors have taken toward meeting M/WBE subcontractors shall not discriminate against any employee or contract participation goals. applicant for employment because of race, creed (religion), color, (6) Ensure that progress payments to M/WBEs are made on a sex, national origin, sexual orientation, military status, age, timely basis so that undue financial hardship is avoided, disability, predisposing genetic characteristic, marital status or and that where appropriate, bonding and other credit domestic violence victim status, and shall also follow the requirements are waived or appropriate alternatives requirements of the Human Rights Law with regard to nondeveloped to encourage M/WBE participation. discrimination on the basis of prior criminal conviction and prior arrest. (e) This organization will include the provisions of sections (a) through (d) of this agreement in every subcontract in such a manner that the requirements of the subdivisions will be binding upon each subcontractor as to work in connection with the State contract..

M/WBE

Agreed to this ______ day of __________________, 2___________ By _______________________________________ Print:___________________________________ Title:_____________________

Form #4

Form 5 - EEO STAFFING PLAN Instructions on page 2 Solicitation No.:

Reporting Entity:

Report includes Contractor’s/Subcontractor’s: □ Work force to be utilized on this contract □ Total work force □ Offerer □ Subcontractor Subcontractor’s name________________

Offeror’s Name: Offeror’s Address:

Enter the total number of employees for each classification in each of the EEO-Job Categories identified EEO-Job Category

Total Work force

Work force by Gender Total Total Male Female (M) (F)

Work force by Race/Ethnic Identification White (M) (F)

Black (M) (F)

Hispanic (M) (F)

Asian (M) (F)

Native American (M) (F)

Disabled (M) (F)

Officials/Administrators Professionals Technicians Sales Workers Office/Clerical Craft Workers Laborers Service Workers Temporary /Apprentices Totals PREPARED BY (Signature):

NAME AND TITLE OF PREPARER (Print or Type):

MWBE Form # 5

TELEPHONE NO.: EMAIL ADDRESS: Submit completed with bid or proposal

DATE:

Veteran (M) (F)

General instructions: The selected Proposer and each subcontractor identified in the bid or proposal must complete an EEO Staffing Plan (ADM/EEO 100) and submit it within ten (10) days of CUNY’s request. Where the work force to be utilized in the performance of the State contract can be separated out from the contractor’s and/or subcontractor’s total work force, the selected Proposer shall complete this form only for the anticipated work force to be utilized on the State contract. Where the work force to be utilized in the performance of the State contract cannot be separated out from the contractor’s and/or subcontractor’s total work force, the selected Proposer shall complete this form for the contractor’s and/or subcontractor’s total work force. Instructions for completing: 1. Enter the Solicitation number that this report applies to along with the name and address of the selected Proposer. 2. Check off the appropriate box to indicate if the selected Proposer completing the report is the contractor or a subcontractor. 3. Check off the appropriate box to indicate work force to be utilized on the contract or the selected Proposer’s total work force. 4. Enter the total work force by EEO job category. 5. Break down the anticipated total work force by gender and enter under the heading ‘Work force by Gender’ 6. Break down the anticipated total work force by race/ethnic identification and enter under the heading ‘Work force by Race/Ethnic Identification’. Contact the M/WBE Permissible contact(s) for the solicitation if you have any questions. 7. Enter information on disabled or veterans included in the anticipated work force under the appropriate headings. 8. Enter the name, title, phone number and email address for the person completing the form. Sign and date the form in the designated boxes. RACE/ETHNIC IDENTIFICATION Race/ethnic designations as used by the Equal Employment Opportunity Commission do not denote scientific definitions of anthropological origins. For the purposes of this form, an employee may be included in the group to which he or she appears to belong, identifies with, or is regarded in the community as belonging. However, no person should be counted in more than one race/ethnic group. The race/ethnic categories for this survey are: 

WHITE

(Not of Hispanic origin) All persons having origins in any of the original peoples of Europe, North Africa, or the Middle East.



BLACK

a person, not of Hispanic origin, who has origins in any of the black racial groups of the original peoples of Africa.



HISPANIC a person of Mexican, Puerto Rican, Cuban, Central or South American or other Spanish culture or origin, regardless of race.



ASIAN & PACIFIC a person having origins in any of the original peoples of the Far East, Southeast Asia, the Indian subcontinent or the Pacific Islands. ISLANDER



NATIVE INDIAN (NATIVE a person having origins in any of the original peoples of North America, and who maintains cultural identification through tribal AMERICAN/ ALASKAN affiliation or community recognition. NATIVE)

OTHER CATEGORIES 

 

DISABLED INDIVIDUAL

VIETNAM ERA VETERAN GENDER

MWBE Form # 5

any person who:

-

has a physical or mental impairment that substantially limits one or more major life activity(ies)

-

has a record of such an impairment; or is regarded as having such an impairment.

a veteran who served at any time between and including January 1, 1963 and May 7, 1975. Male or Female

Form 6 - QUARTERLY EEO WORK FORCE UTILIZATION REPORT Contract No.:

Reporting Entity: □ Contractor □ Subcontractor

Contractor’s Name: Contractor’s Address:

Reporting Period: □ April 1, 20___ - June 30, 20___ □ July 1, 20___ - September 30, 20___ □ October 1, 20___ - December 31, 20___ □ January 1, 20___ - March 31, 20___ Contractor’s Federal ID Number: Report includes: □ Work force to be utilized on this contract □ Contractor/Subcontractor’s total work force

Enter the total number of employees in each classification in each of the EEO-Job Categories identified. Work force by Work force by Gender Race/Ethnic Identification EEO-Job Category Total Male Female White Black Hispanic Asian Work (M) (F) (M) (F) (M) (F) (M) (F) (M) (F) force (0 Officials/Administrators

Native American (M) (F)

Disabled (M) (F)

Veteran (M) (F)

Professionals Technicians Sales Workers Office/Clerical Craft Workers Laborers Service Workers Temporary /Apprentices Totals PREPARED BY (Signature):

TELEPHONE NO.:

DATE:

EMAIL ADDRESS: AME AND TITLE OF PREPARER (Print or Type):

MWBE Form # 6

Submit completed form to: Such address and office as CUNY may require from time to time.

General Instructions: The work force utilization report is to be submitted on a quarterly basis during the life of the contract to report the actual work force utilized in the performance of the contract broken down by the specified categories. When the work force utilized in the performance of the contract can be separated out from the contractor’s and/or subcontractor’s total work force, the contractor and/or subcontractor shall submit a Utilization Report of the work force utilized on the contract. When the work force to be utilized on the contract cannot be separated out from the contractor’s and/or subcontractor’s total work force, information on the total work force shall be included in the Utilization Report. Utilization reports are to be completed for the quarters ended 3/31, 6/30, 9/30 and 12/31 and submitted to CUNY within 15 days of the end of each quarter. If there are no changes to the work force utilized on the contract during the reporting period, the contractor can submit a copy of the previously submitted report indicating no change with the date and reporting period updated. Instructions for completing: 1. Enter the number of the contract that this report applies to along with the name and address of the Contractor preparing the report. 2. Check off the appropriate box to indicate if the entity completing the report is the contractor or a subcontractor. 3. Check off the box that corresponds to the reporting period for this report. 4. Check off the appropriate box to indicate if the work force being reported is just for the contract or the Contractor’s total work force. 5. Enter the total work force by EEO job category. 6. Break down the total work force by gender and enter under the heading ‘Work force by Gender’ 7. Break down the total work force by race/ethnic background and enter under the heading ‘Work force by Race/Ethnic Identification’. Contact the Office of University Controller at CUNY if you have any questions. 8. Enter information on any disabled or veteran employees included in the work force under the appropriate heading. 9. Enter the name, title, phone number and email address for the person completing the form. Sign and date the form in the designated boxes. RACE/ETHNIC IDENTIFICATION Race/ethnic designations as used by the Equal Employment Opportunity Commission do not denote scientific definitions of anthropological origins. For the purposes of this report, an employee may be included in the group to which he or she appears to belong, identifies with, or is regarded in the community as belonging. However, no person should be counted in more than one race/ethnic group. The race/ethnic categories for this survey are: 

WHITE

(Not of Hispanic origin) All persons having origins in any of the original peoples of Europe, North Africa, or the Middle East.



BLACK

a person, not of Hispanic origin, who has origins in any of the black racial groups of the original peoples of Africa.



HISPANIC a person of Mexican, Puerto Rican, Cuban, Central or South American or other Spanish culture or origin, regardless of race.



ASIAN & PACIFIC a person having origins in any of the original peoples of the Far East, Southeast Asia, the Indian subcontinent or the Pacific Islands. ISLANDER



NATIVE INDIAN (NATIVE a person having origins in any of the original peoples of North America, and who maintains cultural identification through tribal AMERICAN/ ALASKAN affiliation or community recognition. NATIVE)

OTHER CATEGORIES  DISABLED INDIVIDUAL

any person who:



VIETNAM ERA VETERAN

a veteran who served at any time between and including January 1, 1963 and May 7, 1975.



GENDER

Male

MWBE Form # 6

or

-

Female

has a physical or mental impairment that substantially limits one or more major life activity(ies) has a record of such an impairment; or is regarded as having such an impairment.