Page 22

Crossroads Software Maintenance and Enhancement Services VDH PAGE 22 Contract # VDH-21-707-0156

employee of the Supplier; or ii. Claims for bodily injury, including death, and damage to real property or tangible property resulting from the negligence of the Supplier or any employee of the Supplier Supplier’s indemnification obligations and liability shall not exceed, in aggregate, twice the value of the Contract. B. Limitation of Liability Subject to the provisions of 24.A. Supplier Liability, Supplier will be liable for damages caused by its employees, agents, or subcontractors. Except for liability arising out of a Party’s intentional or willful misconduct, fraud, or recklessness, neither Party will be liable to the other Party for any indirect, incidental, consequential, or punitive damages, including (without limitation) loss of profit, income, or savings, even if advised of the possibility of these damages.

25. INSURANCE In addition to the insurance coverage required by law as referenced in the “Incorporated Contractual Provisions” section of this Contract below, Supplier shall carry: Errors and omissions insurance coverage in the amount of $5,000,000 per occurrence.

26. SECURITY COMPLIANCE Supplier shall comply with all provisions of the then-current Commonwealth security procedures, published by VITA and which may be found at: VITA POLICIES, STANDARDS & GUIDELINES any successor URL(s) as are pertinent to Supplier's operation. Further, Supplier shall comply with all applicable provisions of VDH’s then-current security procedures as are pertinent to Supplier's operation and that have been provided to Supplier by VDH. Supplier shall also comply with all applicable federal, state, and local laws and regulations. Any unauthorized release of any Confidential Information, or Commonwealth proprietary or personal information, by the Supplier or Supplier Personnel constitutes a breach of Supplier’s obligations under the Contract. Supplier shall notify VDH within 24 hours of discovery of, or when Supplier should have discovered, any breach of “unencrypted” and “un-redacted” personal information, as those terms are defined in Code § 18.2-186.6, and other confidential or personal identifying information provided to the Supplier by VDH. To the extent permitted by law, Supplier shall provide VDH the opportunity to participate in the investigation of the breach and to exercise control over reporting the unauthorized disclosure. Supplier shall ensure performance of an audit of Supplier’s environment at least annually to provide assurance of “Controls Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy” in accordance with the then-current standards set forth by the American Institute of CPAs. Supplier shall indemnify, defend, and hold the Commonwealth, VITA, their officers, directors, employees and agents harmless from and against any and all Claims, including reasonable expenses suffered by, accrued against, or charged to or recoverable from the Commonwealth, VITA, their officers, directors, agents or employees, on account of the failure of Supplier to perform its obligations pursuant this section. VDH reserves the right to review Supplier's information security program prior to the commencement of Licensed Services and at least once annually during the Term of this Contract. During the performance of the Licensed Services, and on an annual basis, VDH will be entitled, at its own expense, to perform, or to have performed, an on-site audit of Supplier's information security program. In lieu of an on-site audit, upon request by VDH, Supplier shall implement any reasonably required safeguards as identified by any program audit.

27. IMPORT/EXPORT Supplier shall comply with all data export laws and regulations. In addition, VDH policy requires that any data deemed “restricted” or “sensitive” by either federal or state authorities, may only be collected, developed, analyzed, or otherwise used or obtained by persons or entities working within the boundaries of the United States.

28. BANKRUPTCY If Supplier becomes insolvent, takes any step leading to its cessation as a going concern, fails to pay its debts as they become due, or ceases business operations continuously for longer than 15 business days, then VDH may immediately terminate this Contract on notice to Supplier unless Supplier immediately DocuSign Envelope ID: D69B105E-7A47-46ED-8B09-C0071CE057F5 DocuSign Envelope ID: 33024638-F519-4808-AF31-3DA182A2CE1E