ict agreement for as-a-service · web viewclause 1 of the cloud core terms governs the hierarchy of...

Cloud Agreement – signing pagesThis is a Cloud Agreement for procuring Cloud Services via the NSW Government buy.nsw platform (buy.nsw). It consists of:

1. the core terms for cloud services - version dated 18 October 2018 (“Cloud Core Terms”)

2. the annexed requirements for cloud services (“Requirements”)

3. Attached Seller Terms (if any).

Clause 1 of the Cloud Core Terms governs the hierarchy of documents forming part of this Cloud Agreement, and their legal effect.

This Cloud Agreement is between:

“we” the Buyer.

Name of Buyer:

ABN:

Signed by Buyer’s authorised representative (without personal liability):

Print name:

Witnessed by:

Print name:

Date:

Cloud Agreement | 1

“you” the Seller.

Name of Seller:

ABN:

Signed by Seller’s authorised representative:

Print name:

Witnessed by:

Print name:

Date:

Cloud Agreement | 2

Cloud Agreement Requirements

Table of Contents

PART A: ESTABLISHING THE CLOUD AGREEMENT..............................................................................................................5

1. Terms used in these Requirements.............................................................................................................................5

2. Executing the Cloud Agreement..................................................................................................................................5

3. Cloud Services procured under the Cloud Agreement................................................................................................5

4. Scope of the Cloud Agreement....................................................................................................................................6

5. Agreement Period.......................................................................................................................................................7

6. Specific details re fees and payment...........................................................................................................................8

7. Who can use the Cloud Services and what are the access control arrangements?.....................................................9

8. Insurance - options available under Cloud Core Terms.............................................................................................11

9. Intellectual property - options available under Cloud Core Terms............................................................................11

10. Your contact person for notices, communications and consents..............................................................................11

11. Our contact person for notices, communications and consents...............................................................................12

PART B: BUYER DATA AND SELECTED REGION.................................................................................................................13

12. Selected Region for Buyer Data - options available under Cloud Core Terms...........................................................13

13. Licence to Buyer data - options available under Cloud Core Terms...........................................................................13

PART C: DELIVERING THE CLOUD SERVICES.....................................................................................................................15

14. Detailed security requirements.................................................................................................................................15

15. Service performance and service levels.....................................................................................................................15

16. Support......................................................................................................................................................................16

17. Performance monitoring and reporting....................................................................................................................16

18. Relevant policies and standards................................................................................................................................17

19. Changes to the Cloud Services...................................................................................................................................18

20. Disengagement arrangements..................................................................................................................................19

PART D: DICTIONARY.......................................................................................................................................................20

21. Dictionary..................................................................................................................................................................20

ATTACHMENT 1: DETAILED SECURITY REQUIREMENTS....................................................................................................22

ATTACHMENT 2: EXCLUDED SERVICES.............................................................................................................................23

Cloud Agreement - Requirements | 3


ATTACHMENT 3: ATTACHED SELLER TERMS (if any).........................................................................................................24



These Requirements set out details of our specific requirements in relation to the Cloud Services and the Cloud Agreement. Where options or alternative arrangements are permitted under the Cloud Core Terms, the specific details are set out in these Requirements.

PART A: ESTABLISHING THE CLOUD AGREEMENT

1. Terms used in these Requirements

Capitalised terms used in these Requirements:

have the meaning set out in these Requirements – including section 21 (Dictionary)

or if not defined in these Requirements, have the meaning given in the Cloud Core Terms

2. Executing the Cloud Agreement

The Cloud Agreement may be executed:

by facsimile or by electronic signature in a format agreed between the parties; or

in counterparts, each of which (including signature pages) will be deemed an original, but all of which together constitute one and the same agreement.

3. Cloud Services procured under the Cloud Agreement

(a) We wish to acquire the following cloud services under this Cloud Agreement (the “Cloud Services”):

[Add description of the Cloud Services to be procured – and incorporate buy.nsw reference for further details of those Cloud Services on buy.nsw where applicable]

(b) You must provide the Cloud Services in accordance the Cloud Agreement, including:

the relevant details posted on buy.nsw; and the details set out in these Requirements.

The details set out in these Requirements will prevail over the details on buy.nsw where there is any inconsistency.



(c) Updating buy.nsw details: You are responsible for updating the details posted on buy.nsw so that they remain current throughout the Agreement Period, provided that:

notice of changes: you must provide notice of such changes by sending a message to the email address nominated by us in section 11 of these Requirements (Our contact person for notices, communications and consents); and

all changes to the details posted to buy.nsw are subject to the terms and conditions set out in section 19 of these Requirements (Changes to the Cloud Services), including in relation to notice periods and restrictions on the scope of security changes.

4. Scope of the Cloud Agreement

(a) Excluded Services: You are not permitted to supply services under the Cloud Agreement that fall within the scope:

set out in Attachment 2 of these Requirements (Excluded Services), as that list may be updated by agreement between us during the Agreement Period; or

identified as “excluded services” on buy.nsw at any time during the Agreement Period,

which comprise “Excluded Services”. For clarity, professional services and consulting services comprise Excluded Services and are not permitted to be supplied under the Cloud Agreement.

(b) Third-Party Pass-Through Software: Where the Cloud Services may be used in connection with an optional third party software component:

which we select, and which we require you to supply in connection with the Cloud Services; and

which is acquired by you from a third party supplier who requires you to impose certain terms in connection with the use of that software,

being “Third-Party Pass-Through Software”, then

you must separately disclose those third party supplier terms to us prior to procurement of the relevant Cloud Services (Pass-Through Terms), to be incorporated as part of your Attached Seller Terms; and

where we expressly agree in writing (as set out below), we will be bound by those Pass-Through Terms in connection with our use of the Third-Party Pass-Through Software (as contemplated under clause 1(b)(ii) of the Cloud Core Terms).

Choose Option 1 or Option 2 and mark with an X.

Option 1: No Third-Party Pass-Through Software is required in connection with the Cloud Services.

Option 2: The following Third-Party Pass-Through Software is required in connection with the Cloud Services, and we consent to the relevant Pass-Through Terms which are incorporated in your Attached Seller Terms:



[Complete details of Third-Party Pass-Through Software – or state “not applicable”.]

5. Agreement Period

(a) You agree to provide the Cloud Services to us for the following “Agreement Period”:

“Commencement Date” for the Agreement Period:

[Add Commencement Date]

Duration of the Agreement Period:

Choose option 1 or 2 and mark with an X

Option 1: Fixed term

[Add details of fixed term.]

If the Buyer agrees to vary the 30 day notice period for early termination in accordance with clause 19 (Early Termination) of the Cloud Core Terms, specify details here – or state “Not Applicable”.

If the Buyer agrees to pay any early termination fees, specify details here – or state “Not Applicable”.

Option 2:

Agreement Period continues indefinitely until either party terminates, provided that:

we may terminate on 30 days’ notice in accordance with clause 19 (Early termination) of the Cloud Core Terms

you may terminate by providing us with a minimum of 12 months’ notice, except where an alternative notice period is specified below:

[Add details of notice period that Seller is required to provide for termination if it differs from the 12 months’ notice period specified above – or write “Not Applicable”]

(b) Agreement Period extends until end of disengagement: If we ask you to provide disengagement services under:

clause 20 (Consequences of termination or expiry) of the Cloud Core Terms; and

section 20 (Disengagement arrangements) of these Requirements,

then the Agreement Period will continue until the end of those disengagement services.Cloud Agreement - Requirements | 7


6. Specific details re fees and payment

The following terms apply in addition to clause 13 (Payment and invoicing) of the Cloud Core Terms:

(a) You may invoice us for the Cloud Services in accordance with actual usage - except where we agree otherwise, as set out below:

[Add alternative charging arrangements where applicate – or state “not applicable]

(b) Fees for the Cloud Services will be calculated in accordance with the pricing details set out below:

[Add details of fees for the Cloud Services]

(c) The fees include all taxes, except GST. In addition, we will pay GST where required in accordance with applicable law.

(d) Clause 13 (Payment and invoicing) of the Cloud Core Terms requires monthly invoicing in arrears, unless otherwise agreed. Where alternative invoicing arrangements apply, they may be specified below:

[Add alternative invoicing arrangement where applicate – or state “not applicable]

(e) Clause 13 (Payment and invoicing) of the Cloud Core Terms requires payment by electronic transfer in Australian dollars, unless otherwise agreed. Where alternative payment arrangements apply, they may be specified below:

[Add alternative payment arrangement where applicable – or state “not applicable”]

(f) Invoices should be sent to the following contact details:



Name:

Role:

Phone:

Email:

7. Who can use the Cloud Services and what are the access control arrangements?


Option 1: IaaS or Paas: For those Cloud Services provided as IaaS or PaaS:

(i) you are responsible for designing, developing and implementing the access controls for the Cloud Services (ensuring the system supports authentication, authorisation etc);

(ii) we will determine the persons who are authorized to use those Cloud Services, using the access controls that you make available to us;

(iii) we are responsible for managing the access controls that you provide to us, ensuring that they are kept secure and are not accessible by unauthorized persons,

except where alternative arrangements are set out below:

[Complete details of any alternative arrangements for access controls where required – or state “not applicable]

(iv) you are responsible for:

managing and monitoring access; and detecting and monitoring intrusion,

in relation to the underlying infrastructure which hosts the Cloud Services; and

(v) the party specified below is responsible for:

continuously monitoring access to the Cloud Services to detect malicious behaviour that could lead to exfiltration, stolen credentials, or attack on the Cloud Services; and

detecting when an unauthorized device or user attempts to connect to the Cloud Services, and automatically preventing such access,

together with any required additions or variations to these monitoring arrangements:



[Complete details of party responsible for monitoring access controls, and any additional details or alternative arrangements required in relation to monitoring access]

Option 2: SaaS: For those Cloud Services provided as SaaS:

(i) the following licensing rights govern the scope of persons entitled to use the Cloud Services:

[Complete details of licensing rights]

(ii) you are responsible for designing, developing and implementing the access controls for the Cloud Services (ensuring the system supports authentication, authorisation etc); and

(iii) you must configure the access controls in accordance with our access policies and directions, based on specified roles and associated levels of permissions and access;

except where alternative arrangements are set out below:

[Complete details of any alternative arrangements for access controls where required – or state “not applicable]

(iv) you are responsible for:

continuously managing and monitoring access to the Cloud Services;

detecting intrusion and other malicious behaviour that could lead to exfiltration, stolen credentials, or attack on the Cloud Services; and

configuring and implementing the alerts and notifications to be generated in the case of such intrusion and other malicious behaviour,

in relation to the Cloud Services (including the underlying infrastructure which hosts the Cloud Services); and

(v) we are responsible for taking the action required in response to any alerts and notifications generated under paragraph (iv),

with any required additions or variations to these arrangements being set out below:

[Complete details of any additional details or alternative arrangements required in relation to monitoring and responding to intrusion and other malicious behaviour]



8. Insurance - options available under Cloud Core Terms

Where we specify any insurance requirements below, you must comply with those requirements instead of the requirements set out in clause 14 (Insurance) of the Cloud Core Terms for those particular types of insurance:

[Buyer to complete alternative insurance requirements if applicable.]

9. Intellectual property - options available under Cloud Core Terms

New Materials: Alternative arrangements apply to the following New Materials, as permitted under clause 11 (Intellectual property) of the Cloud Core Terms:

[Add alternative arrangements for New Materials where applicable – or state “not applicable”]

10.Your contact person for notices, communications and consents

Name:

Role:

Phone:

Email:

Address:

These details may be updated by you by electronic notice to us.

11.Our contact person for notices, communications and consents

Name:

Role:

Phone:

Email:



Address:

These details may be updated by us by electronic notice to you.



PART B: BUYER DATA AND SELECTED REGION

12.Selected Region for Buyer Data - options available under Cloud Core Terms

In accordance with clause 9 (Selected Region for Buyer Data) of the Cloud Core Terms:


Option 1: The Selected Region is Australia.

Option 2: The Selected Region is:

[Complete details of alternative Selected Region where applicable]

The terms on which we consent to this alternative Selected Region are as follows:

[To be completed where there the Buyer selects a region outside Australia. The Buyer is responsible for: (i) assessing the proposed arrangements for storing and processing Buyer Data outside Australia in accordance

with the criteria set out in clause 7 (Buyer Data) of the Cloud Core Terms; and (ii) granting consent on terms which enable the Buyer to satisfy itself that the arrangements are sufficient:

to address the associated risks and legal requirements (depending on the nature of the Buyer Data involved and the relevant regions);

to ensure that the handling of Personal Information will at all times be conducted in accordance with applicable Privacy Laws and other applicable laws;

to ensure that the Buyer’s Confidential Information is managed in accordance with its obligations under the State Records Act 1998 (NSW)); and

to ensure that the handling of any other Buyer Data complies with the security requirements under the Cloud Agreement.]

13.Licence to Buyer data - options available under Cloud Core Terms

(a) Licence to Buyer Data:

In accordance with clause 7(f) of the Cloud Core Terms (Licence to Buyer Data in connection with delivery of the Cloud Services):


Option 1: You are not licensed to use our Buyer Data for any purposes.



Option 2: You are licensed to access and/or use our Buyer Data for the following purposes connected with delivery of the Cloud Services:

[Buyer to complete if applicable. These purposes should be connected to delivery of the Cloud Services.

Eg: for the purpose of delivering the Cloud Services.

Eg: for the limited purpose of trouble-shooting and resolving any performance issues arising in relation to the Cloud Services.]

(b) Consent required for use of Buyer Data for other purposes:

In accordance with clause 7(g) of the Cloud Core Terms (Consent required for use of Buyer Data for other purposes):


Option 1: No consent provided: We do not consent to your use of our Buyer Data for any other purposes (in addition to those specified in section 13(a) above) - whether in identified or de-identified form. For clarity, this means that you are not in any circumstances permitted to:

commercially exploit our Buyer Data; or

use our Buyer Data for data analytics or to target advertising to us,

whether in identified or de-identified form.

Option 2: Limited consent provided on terms and conditions: In addition to any licence specified in section 13(a) above (in connection with delivery of the Cloud Services), we consent to your use of our Buyer Data as follows:

for the following additional purposes:

[Buyer to complete if applicable, where the Buyer consents to the Seller using Buyer Data for additional purposes – and to specify whether in identified or de-identified form. This could include purposes associated with the Seller:

(i) commercially exploiting Buyer Data; or(ii) using Buyer Data for data analytics or to target advertising to the Buyer.

our consent is subject to the following terms and conditions:

[Such consent can only be given on terms and conditions which enable the Buyer to satisfy itself that appropriate arrangements are in place for additional use of the Buyer Data (eg: for commercial exploitation and/or data analytics), and for the use of any knowledge ascertained or derived from the Buyer Data. Buyer to complete if Option 2 is selected.]



PART C: DELIVERING THE CLOUD SERVICES

14.Detailed security requirements

In addition to your obligations under clause 10 (Security) of the Cloud Core Terms, you must comply with the detailed security requirements set out in Attachment 1 of these Requirements (Detailed Security Requirements).

15.Service performance and service levels

(a) You must make the Cloud Services available to us in accordance with your resilience and redundancy commitments and other service performance commitments set out on buy.nsw.

(b) Where specified below, you must comply with the following additional or amended service performance requirements:

[Add additional or amended service performance requirements – or state “not applicable”]

(c) You must make the Cloud Services available to us:

in accordance with your availability commitments on buy.nsw; and

in accordance with any other service levels set out on buy.nsw

(d) Where any additional or amended service levels are required, they may be specified below:

[Add additional or amended Service Levels where required – or state “not applicable”]

(e) Service credits: Where you fail to achieve the specified service levels, then you must provide any applicable service credits or rebates as set out on buy.nsw. Where any additional service credits are available, they may be specified below

[Add additional service credits / rebates where applicable – or state “not applicable”]



(f) Changes to service levels and service credits: You may change the service levels and associated service credits where so permitted under section 19 of these Requirements (Changes to the Cloud Services).

16.Support

(a) If a Cloud Service fails to comply with the Cloud Agreement, you must fix the problem as soon as reasonably possible and in accordance with applicable service levels.

(b) You must provide help desk services in accordance with your support commitments set out on buy.nsw and any additional details set out below (and the details set out below will prevail where there is any inconsistency).

[Add additional / alternative help desk service arrangement where applicate – or state “not applicable]

17.Performance monitoring and reporting

(a) You will provide performance monitoring and reporting for the Cloud Services:

(i) providing a personalised view into the performance and availability of the Cloud Services, including:

dashboard of events in progress and affected resources;

proactive notification of scheduled activities; and

alerting of the health of your resources deployed in the delivery of Cloud Services;

(ii) in accordance with your commitments on buy.nsw; and

(iii) in accordance with any additional or amended details set out below (which will prevail over the details on buy.nsw where there is any inconsistency).

[Add additional / alternative help desk service arrangements where applicate – or state “not applicable]

(b) In addition, we authorize and direct you to provide reporting information to buy.nsw to facilitate whole-of-government reporting and data analytics – including information about the Cloud Services that we procure from you and associated spend.



18.Relevant policies and standards

(a) You will comply with the following policies and/or standards in relation to the Cloud Services (as updated by us from time to time throughout the Agreement Period):

NSW Government Digital Information Security Policy (DISP).

[Buyer to complete details of any additional policies and/or standards that are required. Note that detailed security requirements are to be set out in Attachment 1]

(b) ICT accessibility:

Where specified below, any Cloud Services must meet Accessibility Standard AS EN 301 549.


Option 1:

The Cloud Services must comply with Accessibility Standard AS EN 301 549 (or equivalent) in the following areas:

Option 2: We do not require compliance with Accessibility Standard AS EN 301 549 for the Cloud Services.

(c) Background checks and clearances:

Where specified below, you must complete background checks for your Personnel who have access to our Buyer Data, and/or ensure that they have appropriate clearances, in accordance with the requirements set out below:


Option 1:

You must complete the following background checks on your Personnel who have access to our Buyer Data, and/or ensure that they have the following clearances:

[Buyer to complete if applicable. These requirements should align with the agency’s internal requirements for security clearances of Personnel. Note that these requirements extend to the Seller’s subcontractors, as well as its own Personnel. Please pay particular attention to the requirements for any of the Seller’s Personnel who have privileged access to Buyer Data.]

Option 2: We do not require any background checks to be completed or any clearances to be obtained.



19.Changes to the Cloud Services

(a) We expect that you will make changes to the Cloud Services (including in relation to service levels and security arrangements) to ensure that they keep pace with technological advancements and improvements in methods of delivery. There are no restrictions on your ability to make changes to the Cloud Services (including updates to the details on buy.nsw in accordance with section 3(c) of these Requirements (Updating buy.nsw details)), except where set out in the remaining terms of this section 19.

(b) We are entitled to cloud service enhancements for the Cloud Services at no additional charge. However, this does not entitle us to new products or functionality which are not acquired under the Cloud Agreement and are separately priced.

(c) Where you wish to make any of the following changes:

(i) security changes: changes in relation to the security requirements set out in Attachment 1 (Detailed security requirements):

you must continue to provide at least the same level of security as is described in Attachment 1 of the Requirements (Detailed security requirements) on the Execution Date; and

for any other changes to the security requirements, you must use all reasonable endeavours to provide us with at least 90 days’ prior notice in accordance with section 19(e) below; and

(ii) changes to service performance and service levels: changes in relation to the service performance requirements and/or service levels (including any associated service credits) applying under section 15 (Service performance and service levels):

you must provide us with at least 180 days’ prior notice in accordance with section 19(e) below before you materially reduce the benefits offered to us – as compared with the requirements applying on the Commencement Date; and

for any other changes (except those governed by section 19(d) below), you must use all reasonable endeavours to provide us with at least 90 days’ prior notice in accordance with section 19(e) below.

(d) Other changes: You must not make any changes that would result in any Cloud Services being discontinued or unable to comply with the Cloud Agreement (including changes which would lead to a material adverse impact on the Cloud Services resulting in a loss of functionality, capability or Buyer Data, or alteration of Buyer Data or a cloud service) unless:

(i) you make those changes for all your customers receiving the same Cloud Service; and

(ii) you provide us with at least 12 months’ notice in accordance with section 19(e) below, except where such changes are necessary to address an Emergency (in which case you must provide such notice as is reasonably practicable).

(e) Notice of changes: You may provide notice of such changes by sending a message to the email address nominated in section 11 (Our contact person for notices, communications and consents).



20. Disengagement arrangements

(a) You agree to make the following disengagement services available on request:

[Add specific details of disengagement services that are available (including government rate card) – or state “not available”]

(b) In addition to the media decommissioning requirements set out in clause 20 (Consequences of termination or expiry) of the Cloud Core Terms, you must comply with the following technical arrangements (which may include a media decommissioning process):

You must comply with the media destruction methods as specified in https://acsc.gov.au/publications/Information_Security_Manual_2017_Controls.pdf

[Add specific details of any other technical arrangements for media decommissioning – or state “not applicable”]


https://acsc.gov.au/publications/Information_Security_Manual_2017_Controls.pdf


PART D: DICTIONARY

21.Dictionary

In these Requirements, capitalised terms have meaning set out below. Capitalised terms which are not defined below have the meaning given to them in the Core Terms.

Account Information Has the meaning given in clause 7 (Buyer Data) of the Cloud Core Terms.

Agreement Period Has the meaning given in section 5 of these Requirements (Agreement Period).

Attached Seller Terms Has the meaning given in clause 22 (Dictionary) of the Cloud Core Terms.

Buyer Data Has the meaning given in clause 7(a) (Buyer Data) of the Cloud Core Terms.

Cloud Agreement Has the meaning given in clause 1(a) of the Cloud Core Terms.

Cloud Core Terms Has the meaning given on the signing pages for the Cloud Agreement.

Cloud Services Has the meaning given in section 3 of these Requirements (Cloud Services procured under the Cloud Agreement).

Commencement Date Has the meaning given in section 5 of these Requirements (Agreement Period).

Emergency Has the meaning given in clause 22 (Dictionary) of the Cloud Core Terms.

Excluded Services Has the meaning given in section 4(a) of these Requirements (Excluded Services).

Execution DateMeans the date on which both parties have signed the Cloud Agreement, being the most recent signing date specified on the signing pages at the front of the Requirements.

IaaS Refers to Cloud Services which are provided in the form of “Infrastructure as a Service”.

New Materials Has the meaning given in clause 11 (Intellectual Property) of the Cloud Core Terms.



PaaS Refers to Cloud Services which are provided in the form of “Platform as a Service”.

Pass-Through Terms Has the meaning given in section 4(b) of these Requirements (Third-Party Pass-Through Software).

Personal Information Has the meaning given in clause 22 (Dictionary) of the Cloud Core Terms.

Personnel Means the personnel of either party (as applicable), as described in clause 21.1 of the Cloud Core Terms.

Privacy Laws Has the meaning given in clause 22 (Dictionary) of the Cloud Core Terms.

Requirements Has the meaning given on the signing pages for the Cloud Agreement.

SaaS Refers to Cloud Services which are provided in the form of “Software as a Service”.

Selected Region Means the region(s) selected by us in accordance with section 12 of these Requirements (Selected Region for Buyer Data).

Third-Party Pass-Through Software

Has the meaning given in section 4(b) of these Requirements (Third-Party Pass-Through Software).


Cloud Agreement Attachments

ATTACHMENT 1: DETAILED SECURITY REQUIREMENTS

[These details are required to be completed under section 14 of these Requirements (Detailed security requirements).

It is recognised that the security requirements will vary, depending on the nature of the cloud services.

The buyer and seller are required to complete detailed security requirements here – depending on the nature of the cloud services being procured. Those details should align with the requirements set out in clause 10 (Security) of the Cloud Core Terms.

In parallel, DFSI is developing checklists and guidelines around best practice security requirements for particular types of cloud services and security scenarios.]



ATTACHMENT 2: EXCLUDED SERVICES

Devices Any hardware or other devices supplied by the Seller.

Professional Services Professional services and consulting services, including those services acquired in connection with any Cloud Services

Other[To be completed if applicable]

[Please provide feedback on the scope of services that should be excluded from this Cloud Agreement.]



ATTACHMENT 3: ATTACHED SELLER TERMS (if any)


ict agreement for as-a-service · web viewclause 1 of the cloud core terms governs the hierarchy of...

Documents