RFP 2026-060 USM Athletic Apparel and Sponsorship

UNIVERSITY OF MAINE SYSTEM

MASTER AGREEMENT

This Master Agreement ("Agreement" or "Master Agreement") entered into this 1st day of July, 2026, by and between the University of Maine System, hereinafter referred to as the "University" and __________________________________, hereinafter referred to as "Contractor".

WITNESSETH, that for and in consideration of the payments and agreements hereinafter mentioned, to be made and performed by the University, the Contractor hereby agrees with the University to provide the products and services described in this agreement, and the following Riders, hereby incorporated into this Agreement and made part of it by reference:

Rider A - Specifications of Work to be Performed

Rider A-1 - Pricing

Rider B - Insurance Requirements

Rider C - University of Maine System Standards for Safeguarding Information

Rider D - Services Engagement Form

Agreement Amendments as required

Request for Proposal #2026-060 Issue Date March 27, 2026 Titled USM Athletic Apparel and Sponsorship

Contractor's Bid in Response to Request for Proposal #2026-060 Proposal Submission Date April 24, 2026 Titled USM Athletic Apparel and Sponsorship

WHEREAS, the University desires to enter into an agreement and the Contractor represents itself as competent and qualified to accomplish the specific requirements of this Agreement to the satisfaction of the University;

NOW THEREFORE, in consideration of the mutual promises contained herein, the parties hereby agree as follows:

This Agreement, along with any documents identified, which are incorporated by reference, constitutes the entire Agreement between the parties, and there are no other or further written or oral understandings or agreements with respect thereto.

Specifications of Work: The Contractor agrees to perform the services and/or provide products described in Rider A, which is hereby incorporated by reference and sets forth the suite of services/products available to the University.

For services requested by individual University institutions, the Parties shall jointly develop and execute a Engagement Form(s), which may be prepared using (i) the format provided in Rider D, or (ii) the Contractor's standard Order Form, provided that such Order Form contains all information reasonably required by the University and is consistent with this Agreement and includes the agreement reference.

Each Engagement Form shall be governed by all terms and conditions of this Agreement. Notwithstanding the foregoing, (a) the engagement administrator identified for a specific Engagement Form may differ from the Agreement Administrator, and (b) the term of an Engagement Form may differ from the Term of this Agreement but shall not extend beyond the Agreement's termination date.

Each Engagement Form must be fully executed by the Parties. University institutions may enter into multiple Engagement Forms over the Term of this Agreement as necessary to support their operational needs.

Term: This Agreement shall commence on July 1, 2026 and shall terminate on June 30, 2028, unless terminated earlier as provided in this Agreement with option for additional renewals upon the parities' mutual written agreement. In no event shall the renewal term extend beyond an additional 10 years.

Payment:

Payment shall be made upon submittal of an electronic invoice to the University by the Contractor on a net 30 basis unless discount terms are offered. In the event there is a discrepancy with the invoice, payment terms shall be effective starting on the date the discrepancy is resolved, for only that portion of the invoice that is disputed. Invoices must include a purchase order number.

"Additional Services" The University will have the option to purchase additional services under this Agreement.

As required by the University institutions, the parties will develop jointly specific Engagement Form(s). The required format of this document is detailed in Section 1.

Termination: The Agreement or an Engagement Form (Rider D or Order Form) may be terminated by the University in whole, or in part, whenever for any reason the University shall determine that such termination is in the best interest of the University. Any such termination shall be affected by delivery to the Contractor of a Notice of Termination specifying the extent to which performance of the Agreement is terminated and the date on which such termination becomes effective. The University shall pay all allowable costs incurred up to the effective date of termination. However, the Contractor shall not be reimbursed for any costs incurred after the effective date of termination.

Obligations Upon Termination: Any materials produced in performance of this agreement are the property of the University and shall be turned over to the University upon request. The University shall pay the Contractor for all services performed to the effective date of termination subject to offset of sums owed by the Contractor to the University.

Non-Appropriation: Notwithstanding any other provision of this Agreement, if the University is not appropriated sufficient funds to pay for the work to be performed under this Agreement or if funds are de-appropriated, then the University is not obligated to make payment under this Agreement.

Conflict of Interest: No officer or employee of the University shall participate in any decision relating to this agreement which affects his or her personal interest in any entity in which he or she directly or indirectly has interest. No employee of the University shall have any interest, direct or indirect, in this agreement or proceeds thereof.

Modification: This Agreement may be modified or amended only in a writing signed by both parties.

Assignment: This Agreement, or any part thereof, may not be assigned, transferred or subcontracted by the Contractor without the prior written consent of the University.

Applicable Law: This Agreement shall be governed and interpreted according to the laws of the State of Maine.

Administration: Campus Athletic Director(s) shall be the University's authorized representative in all matters pertaining to the administration of the terms and conditions of this Agreement.

Non-Discrimination: In the execution of the agreement, the Contractor shall not discriminate on the basis of race, color, religion, sex, sexual orientation, transgender status or gender expression, national origin or citizenship status, age, disability, genetic information, or veteran status and shall provide reasonable accommodations to qualified individuals with disabilities upon request. The university encourages the employment of qualified individuals with disabilities.

Indemnification: The Contractor shall comply with all applicable federal, state and local laws, rules, regulations, ordinances and orders relating to the services provided under this Agreement. Contractor shall indemnify, defend and hold the University, its Trustees, officers, employees, and agents, harmless from and against any and all loss, liability, claims, damages, actions, lawsuits, judgments and costs, including reasonable attorney's fees, that the University may become liable to pay or defend arising from or attributable to any acts or omissions of the Contractor, its agents, employees or subcontractors, in performing its obligations under this Agreement, including, without limitation, for violation of proprietary rights, copyrights, or rights of privacy, arising out of a publication, translation, reproduction, delivery, performance, use or disposition of any data furnished under the Agreement or based on any libelous or other unlawful matter contained in such data.

Agreement Validity: In the event one or more clauses of this Agreement are declared invalid, void, unenforceable or illegal, that shall not affect the validity of the remaining portions of this Agreement.

Independent Contractor: Contractor is an independent contractor of the University, not a partner, agent or joint venture of the University and neither Party shall hold itself out contrary to these terms by advertising or otherwise, nor shall either party be bound by any representation, act or omission whatsoever of the other. For U.S. entities, Contractor, its employees and subcontractors if any, is/are independent contractors for whom no Federal or State Income Tax will be deducted by the University, and for whom no retirement benefits, social security benefits, group health or life insurance, vacation and sick leave, Worker's Compensation and similar benefits available to University's employees will accrue. The parties further understand that annual information returns as required by the Internal Revenue Code and Maine Income Tax Law will be filed by the University with copies sent to Contractor. Contractor will be responsible for compliance with all applicable laws, rules and regulations involving but not limited to, employment, labor, Workers Compensation, hours of work, working conditions, payment of wages, and payment of taxes, such as unemployment, social security and other payroll taxes, including other applicable contributions from such persons when required by law.

Intellectual Property: Any information and/or materials, finished or unfinished, produced in performance of this Agreement, and all of the rights pertaining thereto, are the property of the University and shall be turned over to the University upon request.

Entire Agreement: This Agreement sets forth the entire agreement between the parties on the subject matter hereof and replaces and supersedes all prior agreements on the subject, whether oral or written, express or implied. This Agreement is the entire agreement between the University (including University's employees and other End Users) and Contractor. In the event that Contractor enters into terms of use agreements or other agreements, policies or understandings, whether on Contractor's purchase order, website, electronic, click-through, verbal or in writing, with University's employees or other End Users, such agreements shall be null, void and without effect, and the terms of this Agreement shall apply. University will not be bound to any other terms and conditions set forth in any documents, agreements or policies posted on Contractor's website unless such terms and conditions are set forth in this Agreement. Contractor may not unilaterally change any term or condition of this Agreement.

Licensing: Contractor shall secure in its name and at its expense all federal, state, and local licenses and permits required for operation under this Agreement. Contractor shall provide proof of such licensure or permit to the University prior to commencing work under this Agreement.

Record Keeping, Audit and Inspection of Records: The Contractor shall maintain books, records and other compilations of data pertaining to the requirements of the Agreement to the extent and in such detail as shall properly substantiate claims for payment under the Agreement. All such records shall be kept for a period of seven years or for such longer period as specified herein. All retention periods start on the first day after the final payment of the Agreement. If any litigation, claim, negotiation, audit or other action involving the records is commenced prior to the expiration of the applicable retention period, all records shall be retained until completion of the action and resolution of all issues resulting therefrom, or until the end of the applicable retention period, whichever is later. The University, the grantor agency (if any), or any of their authorized representatives shall have the right at reasonable times and upon reasonable notice, to examine and copy the books, records and other compilations of data of the Contractor pertaining to this Agreement. Such access shall include on-site audits.

Publicity, Publication, Reproduction and use of Agreement's Products or Materials: Unless otherwise provided by law or the University, title and possession of all data, reports, programs, software, equipment, furnishings and any other documentation or product paid for with University funds shall vest with the University. The Contractor shall at all times obtain the prior written approval of the University before it, any of its officers, agents, employees or subcontractors, either during or after termination of the Agreement, makes any statement bearing on the work performed or data collected under this Agreement to the press or issues any material for publication through any medium of communication. If the Contractor or any of its subcontractors publishes a work dealing with any aspect of performance under the Agreement, or of the results and accomplishments attained in such performance, the University shall have a royalty free, non-exclusive and irrevocable license to reproduce, publish or otherwise use and to authorize others to use the publication.

Confidentiality: The Contractor shall comply with all laws and regulations relating to confidentiality and privacy including but not limited to any rules or regulations of the University.

Force Majeure: Neither party shall be liable to the other or be deemed to be in breach of this Agreement for any failure or delay in rendering performance arising out of causes beyond its reasonable control and without its fault or negligence. Such causes may include, but are not limited to, acts of God or of a public enemy, fires, flood, epidemics, strikes, embargoes or unusually severe weather. Dates or time of performance shall be extended to the extent of delays excused by this section provided that the party whose performance is affected notifies the other promptly of the existence and nature of such delay.

Notices: Unless otherwise specified in an attachment hereto, any notice hereunder shall be in writing and addressed to the persons and addresses below.

To the University:

Notice Submission via Email:

To Contractor:

Company Name:

Contact Name:

Address:

Phone Number:

EMail:

Invoices: Unless otherwise specified in an attachment hereto, invoices and questions regarding invoices will be directed to:

University of Maine System

Accounts Payable

PO BOX 3955

SCRANTON, PA 18505

Phone:

Fax:

Invoice Submission Email:

Invoice Inquires: UMSCentralAP@maine.edu

Order of Precedence: In the event of any conflict among the documents in this agreement, the following order of precedence shall apply:

Terms and conditions of this Agreement

Rider A - Specifications of Work to be Performed

Rider A-1 - Pricing

Rider B - Insurance Requirements

Rider C - University of Maine System Standards for Safeguarding Information

Rider D - Services Engagement Form

Agreement Amendments as required

Request for Proposal #2026-060 Issue Date March 27, 2026 Titled USM Athletic Apparel and Sponsorship

Contractor's Bid in Response to Request for Proposal #2026-060 Proposal Submission Date April 24, 2026 Titled USM Athletic Apparel and Sponsorship

Multi-Institution Capabilities University will have the option to include products and services under this Agreement to additional University institutions, this includes any additional University institutions formed during the term of this agreement, all facilities utilized by an institution including those managed and/or owned by a third party, and additional entities, such as, the University College a division of University of Maine at Augusta.

Authorized Participating Entities: The Community College System and Maine Maritime Academy, as public higher education institutions within the State of Maine, may elect to utilize this Agreement under the same terms. The Contractor agrees to extend the products and services provided under this Agreement to these additional entities, subject to all terms, conditions, and pricing specified herein.

Signatures

Per University policy, "Any agreement for services that will, or may, result in the expenditure by the University of $50,000 or more must be approved in writing by the Chief Procurement Officer, or designee, and if it is not approved, valid or effective until such written approval is granted."

Chief Financial Officer approval is required of any University of Maine System agreement of $50,000 or more, and it is not approved, valid or effective until such written approval is granted.

Chief Business Officer approval is required of any campus specific agreement of $50,000 or more, and it is not approved, valid or effective until such written approval is granted.

BY: ________________________________ BY: ________________________________

Title: ______ Title: _____

Chief Procurement Officer or designee Chief Financial/Business Officer or designee

Date: ______________________________ Date: ______________________________

RIDER A

SPECIFICATIONS OF WORK TO BE PERFORMED

The Contractor agrees to the Specifications of Work to be Performed as follows:

INTENT AND PURPOSE

The University of Maine System acting on behalf of University of Southern Maine (USM) sought responses to provide Athletic Apparel and Sponsorship.

USM sought to establish a comprehensive athletic apparel procurement and sponsorship agreement to support the Southern Maine Huskies athletic programs. This solicitation encompasses the provision of athletic uniforms, practice gear, sideline apparel, shoes, athletic equipment, and promotional merchandise while establishing a mutually beneficial partnership that enhances the visibility and brand recognition of USM athletics.

The Contractor will serve as the exclusive athletic apparel provider for all USM intercollegiate athletic teams, supporting approximately 475-500 student-athletes across 23 varsity sports programs.

Men's Sports: Baseball, Basketball, , , , , , , , , and

Women's Sports: Basketball, , Field Hockey, , , , , Softball, , , , and

FY2025 Spend:

PRODUCT SCOPE OF WORK:

The solution will support the following requirements:

Uniforms: The vendor shall provide complete game uniforms for all USM athletic teams, incorporating official school colors with appropriate Southern Maine Huskies branding. All uniforms must meet NCAA regulations and conference specifications for each respective sport:

Basketball, field hockey, women's lacrosse, soccer and volleyball uniforms feature moisture-wicking technology and contemporary designs.

Baseball and softball uniforms with durable construction suitable for outdoor play

Hockey and men's lacrosse jerseys with durable construction suitable for contact sports.

Track and field competition wear designed for optimal athletic performance.

Tennis apparel suitable for year-round outdoor competitions.

Golf attire reflects professional appearance standards.

Cross country/track and field racing uniforms and warm-up gear.

Practice and Training Apparel: The Respondent shall supply comprehensive practice gear to support daily training activities and conditioning programs for USM athletic teams.

Moisture-wicking practice jerseys and shorts for all sports

Specialized practice equipment including reversible jerseys

Warm-up suits and jackets for outdoor sports

Training shirts and performance wear

Cold weather gear suitable for Maine climate conditions

Off-season conditioning apparel

Sideline and Support Staff Apparel: USM requires professional sideline apparel for coaching staff, athletic trainers, equipment managers, and support personnel.

Coaching polo shirts and quarter-zip pullovers

Sideline jackets and outerwear

Coaching pants and shorts

Athletic department staff uniforms

Official game day attire for all support personnel

Product Specifications and Quality Standards

Material and Construction Requirements: All apparel provided must meet collegiate athletic standards for durability, performance, and appearance. Materials should be appropriate for the demanding physical requirements of intercollegiate athletics while maintaining professional appearance throughout extended use. The Respondent should utilize advanced fabric technologies including moisture management systems, antimicrobial treatments, and enhanced durability features. All stitching and construction methods must withstand frequent washing and intensive athletic use.

Branding and Design Standards: The vendor shall incorporate USM official logos, wordmarks, and branding elements in accordance with established university brand guidelines. All designs require approval from USM athletics administration prior to production.

Official USM athletic logos

Southern Maine Huskies name representations

Consistent color matching to university brand standards

Player names and numbers as specified by coaching staff

Conference and NCAA required markings.

Sizing and Inventory Management: The Respondent shall maintain comprehensive sizing options to accommodate the diverse physical requirements of USM student athletes. A complete range of sizes from extra-small through multiple extra-large options must be available for all apparel categories. The vendor will work directly with USM athletic staff members to establish appropriate inventory levels and manage seasonal ordering requirements. Emergency replacement items must be available at short notice to address equipment damage or loss during competition seasons.

Promotional and Giveaway Items: USM requires promotional merchandise for special events, recruiting activities, and community engagement initiatives.

Alumni event promotional items

Community outreach program materials

Special game day promotional merchandise

Fan Merchandise: The vendor shall provide USM with access to retail merchandise featuring official university and athletic branding for sale through campus bookstore and athletic department channels.

T-shirts and casual wear for students and alumni

Hats and headwear featuring USM logos

Outerwear including hoodies and jackets

Accessories and novelty items

Seasonal and special event merchandise

Sponsorship and Partnership Elements

USM sought a comprehensive sponsorship arrangement that provides financial support for the athletic department while establishing the vendor as the official athletic apparel partner. The partnership shall include annual financial contributions to support USM athletic programs, equipment allowances, and promotional consideration that enhances the overall value of the agreement.

Examples of such additional financial incentives are presented below. These are suggestions only and are not presented to restrict or exclude other similar incentives. Respondents and their manufacturers are encouraged to offer other incentives that USM may be interested in as well.

Signing bonus

Contract "Kick-off" bonuses such as special rates or offers for the first season for select teams

Branding package

Incentive bonuses tied to annual business thresholds

Incentive bonuses tied to achievements such as Conference Coach of the Year or reaching the NCAA tournaments.

Marketing and Promotional Opportunities: The selected vendor will receive marketing benefits including logo placement on USM digital signage, website recognition, and promotional opportunities during home athletic events.

Signage at athletic venues

Digital marketing presence on athletics websites and social media

Game day promotional announcements

Special event partnership opportunities

Additional Scope: The Contractor shall permit product and services not covered herein to be added by mutual agreement, without voiding the provisions of the existing agreement. The Contractor, for additional consideration, shall furnish additional such products and services to the University.

PRICING: Refer to RIDER A-1. Pricing will be valid for the term of the Agreement.

PERFORMANCE TERMS AND CONDITIONS

Employees: The Contractor shall employ only competent and satisfactory personnel and shall provide a sufficient number of employees to perform the required services efficiently and in a manner satisfactory to the University. If the University Agreement Administrator notifies the Contractor in writing that any person employed on this Agreement is incompetent, disorderly, or otherwise unsatisfactory, such person shall not again be utilized in the execution of this Agreement without the prior written consent of the Agreement Administrator.

Business and Performance Reviews: Recognizing that successful performance of this agreement is dependent on favorable response, the Contractor shall meet at least quarterly with the Agreement Administrator or designee for a business and performance review to evaluate operations and make necessary adjustments. These meetings will normally be conducted electronically but shall be face-to-face on demand. As part of these reviews, the University reserves the right to review equipment specifications quarterly and update equipment specifications accordingly. Contractor shall provide a single point of contact (i.e., relationship manager) and shall notify University in writing and in advance whenever there is a change to that single point of contact.

Campus Visits: The Contractor agrees to maintain good relations with the University. The Contractor shall make campus visits "as needed" on three days' notice. The Contractor will coordinate campus visits with the University Services Information and Technology Department to ensure proper communication and sharing of information related to customer projects.

Toll-Free Access: The Contractor shall provide to the University, toll-free telephone access to technical support. The University prefers a unique toll-free telephone number just for the University. The Contractor shall provide an escalated support feature to ensure that unresolved support issues can be elevated to upper level management.

Standards for Safeguarding Information: The Contractor is expected to comply with these standards as outlined in Rider C - University of Maine System Standards for Safeguarding Information. Should the Contractor fail to comply with the standards and is unable to reasonably cure its noncompliance within 60 days, the University may terminate this agreement.

RIDER A-1

PRICING

RIDER B

INSURANCE REQUIREMENTS

Contractor's Liability Insurance: During the term of this agreement, the Contractor shall maintain the following insurance:

Coverage limit requirements can be met with a single underlying insurance policy or through the combination of an underlying insurance policy plus an Umbrella insurance policy.

The University of Maine System shall be named as Additional Insured on the Commercial General Liability insurance.

Certificates of Insurance for all of the above insurance shall be filed with:

University of Maine System

Risk Manager

Robinson Hall

46 University Drive

Augusta, Maine 04330

Certificates shall be filed prior to the date of performance under this Agreement. Said certificates, in addition to proof of coverage, shall contain the standard statement pertaining to written notification in the event of cancellation, with a thirty (30) day notification period.

The University reserves the right to change the insurance requirement or to approve alternative insurances or limits, at the University's discretion.

RIDER C

UNIVERSITY OF MAINE SYSTEM

STANDARDS FOR SAFEGUARDING INFORMATION

Scope: This Rider addresses the Contractor's responsibility for safeguarding Protected University Data. For the purposes of this Rider, Protected University Data is defined as any data or information owned by Institution that the Contractor creates, obtains, accesses (via records, systems, or otherwise), receives (from Institution or on behalf of the Institution), or uses in the course of its performance of the agreement which include, but not be limited to: social security numbers; drivers' license numbers; credit card numbers; and all information whose collection, disclosure, protection, and disposition is governed by state or federal law or regulation, particularly information subject to the Family Educational Rights and Privacy Act (FERPA).

Term and Termination: This Rider shall take effect upon execution and shall be in effect commensurate with the term of the Agreement to which it is attached.

Subcontractors and Agents: Contractor shall not provide any Protected University Data to subcontractors, agents, or other third parties without prior written authorization from the University. If Contractor provides any Protected University Data received from the University, or created or received by Contractor on behalf of the University, to a subcontractor or agent, the Contractor shall require such subcontractor or agent to agree to the same restrictions and conditions as are imposed on Contractor by this Agreement and Rider.

Property of University: Unless otherwise stated in the Agreement, all Protected University Data is the property of the University and shall be turned over to the University upon request.

Return or Destruction of Protected University Data:

Within 30 days of termination, cancellation, or expiration of the Agreement, for any reason, Contractor shall cease and desist all uses and disclosures of Protected University Data and shall return all such information received from the University, or created or received by Contractor on behalf of the University, unless the University requests that all such data be destroyed beyond all ability to recover. This provision shall apply to information that is in the possession of subcontractors or agents of Contractor. Contractor shall retain no copies of University information, including any compilations derived from and allowing identification of any individual's confidential information.

In the event that Contractor determines that returning or destroying any such information is infeasible, Contractor shall provide to University notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of such information is infeasible, Contractor shall extend the protections of this Agreement to such information and limit further uses and disclosures of such information to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such information.

Survival: While any Protected University Data is in the possession or control of the Contractor, its subcontractors or agents, the respective rights and obligations of Contractor pursuant to this Rider shall survive termination of the Agreement.

Reasonable and Appropriate Controls: The Contractor agrees to implement reasonable and appropriate privacy and security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted Protected University Data furnished by the University, or collected by the Contractor on behalf of the University

If information pertaining to student educational records is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with FERPA.

If information pertaining to protected health information is accessed, used, collected, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with HIPAA and Contractor shall sign and adhere to a Business Associate Agreement.

If Contractor engages in electronic commerce on behalf of the University or cardholder data relating to University activities is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with current PCI-DSS requirements.

If information pertaining to protected financial customer information is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with GLBA.

If information pertaining to persons located in the European Economic Area (EEA) is accessed, transferred, stored, or processed by Contractor; Contractor shall protect, collect, store, transfer, and process such data in accordance with the obligations of a data processor, or in accordance with the obligations of a data controller if specified within the underlying agreement as a data controller, as set forth in the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and shall provide reasonable assistance at the request of the University for fulfillment of requests made pursuant to the rights afforded to data subjects in GDPR Chapter III.

Prohibition of Unauthorized Use or Disclosure of Information: Contractor agrees to hold all information in strict confidence. Contractor shall not use or disclose information received from, or created or received by, Contractor on behalf of the University except as permitted or required by this Agreement, as required by law, or as otherwise authorized in writing by the University. For the avoidance of doubt, transfers of Protected University Data to another country without the prior written authorization of the University constitute unauthorized use of information in breach of this Section 8.

Contractor Employee Data Access Control: All Contractor employees shall be adequately screened, commensurate with the sensitivity of their jobs. Contractor agrees to limit employee access to data on a need-to-know basis. Contractor shall impose a disciplinary process for employees not following privacy procedures. Contractor shall have a process to remove access to Protected University Data immediately upon termination or re-assignment of an employee by the Contractor.

Data Breach: Contractor shall report to the University any use or disclosure of Protected University Data not authorized by this Agreement or in writing by the University. Contractor shall make the report to the University not more than one (1) business day after Contractor learns of such use or disclosure. Contractor's report shall identify; (i) the nature of the unauthorized use or disclosure, (ii) the information used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Contractor has done or shall do to mitigate the effects of the unauthorized use or disclosure, and (v) what corrective action Contractor has taken or shall take to prevent future similar unauthorized use or disclosure. Contractor shall provide such other information, including a written report, as reasonably requested by the University.

Contractor shall take appropriate steps to remedy such data breach and mitigate, to the extent practicable, any harmful effect that is known to Contractor of a security breach or use or disclosure of Protected University Data by Contractor in violation of the requirements of this agreement. Contractor shall keep University informed on the progress of each step of the incident response. Contractor shall indemnify and hold University harmless from all liabilities, costs and damages arising out of or in any manner connected with the security breach or unauthorized use or disclosure by Contractor of any Protected University Data. Contractor shall mitigate, to the extent practicable, any harmful effect that is known to Contractor of a security breach or use or disclosure of Protected University Data by Contractor in violation of the requirements of this Agreement. In addition to the rights of the Parties established by this Agreement, if the University reasonably determines in good faith that Contractor has materially breached any of its obligations, the University, in its sole discretion, shall have the right to terminate the Agreement immediately.

Mobile Devices: If mobile devices are used by the Contractor in the performance of this Agreement to access Protected University Data, Contractor shall install and activate authentication and encryption capabilities on each mobile device in use.

Contractor Hosted Data: If Contractor hosts Protected University Data in or on Contractor or subcontractor facilities, the following additional clauses apply.

Computers that host Protected University Data shall be housed in secure areas that have adequate walls and entry control such as a card-controlled entry or staffed reception desk. Only authorized personnel shall be allowed to enter, and visitor entry will be strictly controlled.

Contractor shall design and apply physical protection against damage from fire, flood, earthquake, explosion, civil unrest, and other forms of natural or man-made disasters. Contractor shall protect hosted systems with Uninterruptible Power Supply (UPS) devices sufficient to meet business continuity requirements.

Contractor shall backup systems or media stored at a separate location with regular scheduled incremental and full back-ups with sufficient retention of backup files to restore data. Contractor shall test restore procedures not less than once per year.

Contractor shall provide for reasonable and adequate protection on its network and system to include firewall and intrusion detection/prevention.

Contractor shall use strong encryption and certificate-based authentication on any server hosting on-line and e-commerce transactions with the University to ensure the confidentiality and non-repudiation of the transaction while crossing networks.

Contractor shall require strong passwords for any user accessing Protected University Data. Strong passwords shall be at least eight characters long; contain at least one upper and one lower case alphabetic characters; and contain at least one numeric or special character.

The installation or modification of software on systems containing Protected University Data shall be subject to formal change management procedures and segregation of duties requirements.

Contractor who hosts Protected University Data shall engage an independent third-party auditor to evaluate the information security controls not less than every two (2) years. Such evaluations shall be made available to the University upon request.

Records and Compliance: Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders.

System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system.

RIDER D

ENGAGEMENT FORM

This Engagement Form shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution's engagement with the Contractor.

This Engagement Form when fully executed by the Parties, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & B:

SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider B pricing must be specified below):

SIGNATURES: