Frequently Asked Questions
I. Introduction
Q: What has changed in how “Performance” is defined?
A: The updated language clarifies that “Performance” includes, but is not limited to, services, obligations, costs, commodities, deliverables, programs, and commitments under a contract. The phrase “but shall not be limited to” was added to emphasize that the list is illustrative, not exhaustive, giving the definition greater flexibility to encompass various contract-related activities.
Q: How was the definition of a “Deliverable” changed?
A: The new language expands the definition of “Deliverable” to include both tangible and intangible products, goods, or services. Previously, only tangible products were specified. This change acknowledges that many modern IT deliverables (e.g., software licenses, cloud services) may not have a physical form but are still critical contract outputs.
II. Section 4. Contract Termination or Suspension (Existing Section 4)
This section has been significantly expanded and divided into three parts: (a) Termination/Suspension, (b) Force Majeure, and (c) Payment Upon Termination, to clarify rights, obligations, and procedures in the event of a contract ending early.
Q: Has the Department’s right to terminate or suspend a contract changed?
A: The Department still retains broad discretion to terminate or suspend a contract with or without cause, and without penalty, but the updated language:
- Clarifies that this can be done in whole or in part
- Adds “in its sole discretion, for any reason” for additional legal clarity and authority
Q: What’s new in the Force Majeure clause?
A: This section was rewritten and expanded to:
- Formally define qualifying events as “Force Majeure Events”
- Require the Contractor to notify the Department with details of the delay and its cause
- Oblige the Contractor to mitigate and resume work as soon as possible
- Specify what does not count as Force Majeure:
- Subcontractor failure
- Price increases
- Market fluctuations
- Labor disputes
- Power failures
The updated section explicitly states that Force Majeure does not excuse the Contractor from complying with disaster recovery and business continuity (DR/BC) obligations outlined in the Commonwealth’s Enterprise Security Policies and Standards. Failure to meet DR/BC obligations will be treated as “fault” or “negligence.”
Q: What happens if a contract that included pre-paid services is terminated?
A: If the Department prepaid for subscription-based services and the contract is later terminated, the Contractor must refund the unused, pro-rata portion of the pre-payment—even if the termination was without cause. This ensures that the State is not paying for services not received.
III. Section 6. Confidentiality, Privacy and Protection of Data (Existing Section 6)
Q: Has the data protection requirement changed?
A: The core obligation remains the same: the Contractor must ensure physical security and restricted access to all Department data in its possession or used in performance. However, the updated language is now more structured and detailed for clarity.
A new paragraph was added requiring that if the Contractor accesses Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA):
- The Contractor must comply with all applicable HIPAA requirements
- The Contractor must execute a Business Associate Agreement (BAA) where necessary
This addition ensures that any handling of sensitive health data is subject to federal privacy safeguards and contractual enforcement.
IV. Section 8. Assignment (Existing Section 8)
A change was made to make it clear that payments to third-party assignees will be handled as if the payments were made directly to the Contractor and are subject to the Comptroller’s Bill Payment Policy. This means payments remain subject to intercept, offset, counterclaims, or other Department or State rights against the Contractor.
V. Section 9. Subcontracting by Contractor (Existing Section 9)
Q: What does the term “Subcontractor” include?
A: The updated language expands the definition of “Subcontractor” to explicitly include a broad range of entities connected to the Contractor, such as representatives, agents, affiliates, consultants, volunteers, suppliers, service providers, hosting providers, and providers of third-party software embedded in the Contractor’s product. The updates provide greater clarity around who qualifies as a subcontractor and ensure comprehensive oversight and accountability for all parties involved in contract performance.
VI. Section 11. Insurance (New Section)
The Contractor (including its subsidiaries and subcontractors) must maintain appropriate insurance coverage throughout the Contract term—and for two years after, if claims-made policies apply. The required types and amounts of insurance will either be specified in the Contract or, if not, must be consistent with what is customary for contracts of similar scope and nature.
VII. Section 12. Liability and Indemnification (Existing Sections 11 and 12)
Sections 11 and 12 were combined into one comprehensive clause that clarifies the Contractor’s responsibilities for liability and indemnification related to contract performance.
The term “unlimited claims” was replaced with Indemnified Claims. Liability for emerging technologies like Generative AI (GenAI) was included as an example of the covered claims.
Language clarifying the Commonwealth’s right to control the defense was included.
VIII. Section 13. Limitation of Liability (Existing Section 13)
The major change in this section is related to the data breach cap. There is a higher minimum liability cap ($500k vs. $250k), but a reduced multiplier on the contract value (3x vs. 5x).
This new language clarifies that incidental/consequential damages apply only for specific claim types (personal injury, property, property damage, intellectual property and data breaches).
The “Unlimited Claims” phrase was removed in favor of specific claim categories.
IX. Section 14. Warranties (New Section)
Q: What warranties does the Contractor provide in this new section?
A: The Contractor offers several warranties:
- Functionality: Deliverables will function as described for at least six (6) months after acceptance. If issues arise, the Contractor must fix them at no cost or the Department may terminate the contract. Subscription licenses are covered for the full subscription term.
- Non-Infringement: Deliverables will not infringe on any third-party rights, and the Contractor has the authority to provide all licenses and rights granted under the contract.
- Qualified Personnel: Services will be performed by properly trained personnel, meeting industry standards and all contract requirements. Staff with access to Commonwealth systems or confidential data are vetted and trained in security requirements.
- Software Publisher Assurance: If reselling software, the Contractor must confirm the publisher can meet contract terms before submitting a quote to the Commonwealth.
- Malware-Free: Deliverables will be free from viruses, malware, and other harmful components.
X. Section 17. AI Usage Disclosure (New Section)
Contractors must proactively disclose any use of artificial intelligence (AI), including generative AI (GenAI), in their products or services.
XI. Section 19. Contract Boilerplate Interpretation, Severability, Conflicts With Law, Integration (Existing Section 17)
Added at the end: “For the avoidance of doubt, any provision in any document forming a Contract, or any subsequent updates to Contractor terms of use or privacy policies, that conflicts with, modifies, waives, or alters a provision of these IT Terms and Conditions shall be null and void unless expressly approved in writing prior to execution by EOTSS, ANF, OSD, and CTR.”
This is a new paragraph explicitly nullifying any conflicting contract terms, including future updates to contractor terms of use or privacy policies, unless formally approved in writing by all four departments.
XII. Section 20. Press Release and Marketing (New Section)
This section restricts the Contractor from making any public statements or announcements about the Contract without prior written approval from the Department. Such approval must not be unreasonably withheld, and the Contractor is permitted without additional approval to share contract details with regulators or financial institutions when necessary. Additionally, the Contractor is prohibited from using State-specific branding (e.g., logos, icons, the Commonwealth Seal) for commercial purposes without written consent, in compliance with state law.
Q: How do I use the IT Terms and Conditions?
A: The IT Terms and Conditions should be provided to bidders and prospective vendors during the solicitation process. The IT Terms and Conditions should be used in connection with the Commonwealth Standard Contract Form. Please check off “IT Terms and Conditions” on the corresponding Standard Contract Form prior to execution.
Q: When should a Department use the IT Terms and Conditions?
A: The IT Terms and Conditions should be used to govern Contracts subject to the object codes for information technology as defined by the Office of the Comptroller’s Expenditure Classification Handbook or other contracts as expressly approved in writing by the Executive Office of Technology Services and Security (EOTSS), the Executive Office for Administration and Finance (ANF), the Operational Services Division (OSD), or the Office of the Comptroller (CTR). Departments should consult the following guidance when deciding which version of the Commonwealth’s contract documents to use:
| Agency Procurement under a Statewide Contract |
Agency Procurement without a Statewide Contract |
|
Procurement issued after July 1, 2025 |
Procurement issued before July 1, 2025 and agreement signed after July 1, 2025 |
Agreement signed before July 1, 2025 and renewal or amendment signed after July 1, 2025 |
| The version of the IT Terms and Conditions and Standard Contract Form used in the Statewide Contract shall govern any agreement or SOW executed under the Statewide Contract OSD will transition to the revised IT Terms and Conditions upon renewal/re-bid of Statewide Contracts. |
Use updated IT Terms and Conditions |
Use of either version of the form is permissible; Departments should use their best judgment during transition between versions of the IT Terms and Conditions. |
Use of either version of the form is permissible; Departments should use their best judgment during transition between versions of the IT Terms and Conditions. |
