TargetSolutions Learning LLC 5/1/2018

• The Service Provider shall be responsible for any deductible or self-insured retention contained in the insurance policy. • The coverage under the policy shall be primary, and not excess, to any other insurance carried by the Service Provider. • In the event contractor fails to keep in effect at all times the insurance coverage required by this provision, the City may, in addition to any other remedies it may have, terminate the contract upon the occurrence of such event, subject to the provisions of the contract. 5. Breach Notification and Recovery: City of Everett requires public breach notification when city staffs data is lost or stolen. Additionally, unauthorized access or disclosure of such non-public data is considered to be a breach. The Service Provider will provide notification without unreasonable delay and all communication shall be coordinated with the City of Everett. When the Service Provider or their subcontractors are liable for the loss, the Service Provider shall bear all costs associated with the investigation, response and recovery from the breach including but not limited to credit monitoring services with a term of at least 3 years, mailing costs, website, and toll free telephone call center services. The City of Everett shall not agree to any limitation on liability to the extent that it creates an obligation on the part of the City of Everett to hold a Contractor harmless. Section 7.1 (Limitation of Liability) does not apply to this Section 5 (Breach Notification and Recovery). Service Provider's liability for Breach Notification and Recovery as described in this Section shall be limited to the Cyber liability insurance policy limits as set forth in Section 4 (c) above. 6. Notification of Legal Requests: The Service Provider shall contact the City of Everett upon receipt of any electronic discovery, litigation holds, discovery searches, and expert testimonies related to, or which in any way might reasonably require access to the data of the City. The Service Provider shall not respond to subpoenas, service of process, and other legal requests related to the City of Everett without first notifying the City unless prohibited by law from providing such notice. 7. Termination and Suspension of Service: In the event of termination of the contract, the Service Provider shall implement an orderly return of City of Everett data in CSV or XML or another mutually agreeable format. The Service Provider shall guarantee the subsequent secure disposal of City of Everett data. a) Suspension of services: During any period of suspension or contract negotiation or disputes, the Service Provider shall not take any action to intentionally erase any City of Everett data. b) Termination of any services or agreement in entirety: In the event of termination of any services or agreement in entirety, the Service Provider shall not take any action to intentionally erase any City of Everett data for a period of 90 days after the effective date of the termination, unless otherwise requested by the City pursuant to Section 1 above. After such 90 day period, the Service Provider shall have no obligation to maintain or provide any City of Everett data and shall thereafter, unless legally prohibited, dispose of all City of Everett data in its systems or otherwise in its possession or under its control as specified in section 7d) below. Within this 90 day timeframe, vendor will continue to secure and back up City of Everett data covered under the contract. c) Post-Termination Assistance: The City of Everett shall be entitled to any post-termination assistance generally made available with respect to the Services unless a unique data retrieval arrangement has been established as part of the Service Level Agreement. d) Secure Data Disposal: When requested by the City of Everett, the provider shall destroy all requested data in all of its forms, for example: disk, CD/DVD, backup tape, and paper. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST) approved methods and upon the City's request, certificates of destruction shall be provided to the City of Everett. 8. Background Checks: The Service Provider shall conduct criminal background checks and not utilize any staff, including sub-contractors, to fulfill the obligations of the contract who has been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for a minimum of 1 year is an authorized penalty. The Service Provider shall promote and maintain an awareness of the importance of securing the City's information among the Service Provider's employees and agents. 9. Data Dictionary: Prior to go-live, the Service Provider shall provide a data dictionary. TSL Client Agreement with City of Everett 8 Rev P—Revised Date 04/10/2018