librarytechnology.org · web viewdartmouth college. request for proposal. library management...

DARTMOUTH COLLEGEREQUEST FOR PROPOSAL

Library Management System

You are invited to submit a comprehensive proposal for a Library Management System. Your proposal shall be submitted in accordance with the terms and conditions of this RFP. Please find the statement of Dartmouth College requirements in the Scope of Work section, starting on page 8.

The intent of the RFP is to indicate to the prospective bidders the minimum requirements and solicit specific information and pricing.

PROPOSAL ISSUE DATE: February 1, 2018PROPOSAL DUE DATE: March 1, 2018Send responses to: Attn: Joe Montibello Dartmouth College

HB 6025Hanover NH, 03755 Email: [email protected]: 603-646-9394

| P a g e 1

TABLE OF CONTENTS

A. INTRODUCTION......................................................................... 3

B. GENERAL INSTRUCTIONS........................................................ 3

C. PROPOSER RESPONSIBILITY................................................ 3-4

D. RFP SUBMISSIONS AND REQUIREMENTS............................ 4-5

E. RFP FORMAT.......................................................................... 5-6

F. RFP QUESTIONS........................................................................ 6

G. RFP TIMELINE ...........................................................................6

H. EVALUATION CRITERIA......................................................... 6-7

I. AWARD....................................................................................... 7

J. SCOPE OF WORK....................................................................... 8

K. FUNCTIONAL CHECKLISTS...................................................9-47

INCLUDING:Exhibit A: SCOPE OF WORKExhibit B: PROPOSER DECLARATION FORMExhibit C: SAMPLE DARTMOUTH MASTER GOODS AND SERVICES

AGREEMENTExhibit D: VOLUNTARY PRODUCT ASSESSMENT TEMPLATEExhibit E: MAINTENANCE AND SUPPORTExhibit F: DARTMOUTH COLLEGE INFORMATION TECHNOLOGY RISK

ADDITIONAL INSURANCE REQUIREMENTSExhibit G: VENDOR SECURITY SELF-ASSESSMENT

A. INTRODUCTION

An Ivy League institution, Dartmouth enrolls approximately 4,100 undergraduates in the liberal arts and 1,700 graduate students. In addition to 19 graduate programs in the arts and sciences, it is home to the nation's fourth oldest medical

| P a g e 2

school: the Dartmouth Medical School, founded in 1797; the nation's first professional school of engineering: the Thayer School of Engineering, founded in 1867; and the first graduate school of management in the world: the Tuck School of Business, established in 1900.

B. GENERAL INSTRUCTIONS

Dartmouth College (“Dartmouth”) may accept the proposals, which, in the sole opinion of Dartmouth, best meet its needs. Dartmouth is under no obligation to accept the lowest, or any proposal.

Dartmouth will notify all Proposers of any substantive clarification provided in response to any inquiry. Dartmouth may extend the proposal due date if such information significantly amends this solicitation or makes compliance with the original proposed due date impractical.

No data or details of this RFP are to be shared with outside parties without the prior written approval of the parties. RFP questions and other data provided should be treated as confidential business documents and should be used solely for the purpose of responding to this document. Any breach of this confidentiality clause may result in immediate disqualification of your organization from this selection process.

Dartmouth reserves the right to:

• Reject any or all responses tendered

• Negotiate exclusively with one or more vendors of choice

• Terminate or modify the process at any time

We want this to be an interactive process and as such, will make every reasonable effort to provide you with sufficient data for your responses. As provided in Section F below, you are invited to ask questions during the response process and to seek additional information, if needed.

C. PROPOSER RESPONSIBILITY

It is the responsibility of each Proposer before submitting a proposal to:

1) Examine thoroughly the Proposal document and other data identified in the Proposal document for complete and successful process development.

2) Ensure proper intended performance, and reflect the cost of such performance accurately in your Proposal.

3) Consider applicable laws that may affect cost, progress, performance, or furnishing of the work.

| P a g e 3

4) Promptly notify Dartmouth of all conflicts, errors, ambiguities, or discrepancies which a Proposer has discovered in or between the Proposal documents and such other related documents.

5) Meet all deadlines established in the RFP.

D. RFP SUBMISSIONS AND REQUIREMENTS

1) Proposed Format and Due Date: Proposals shall be submitted to the issuing office by March 1, 2018.

2) To be considered for selection, bidders must submit a complete response to this RFP. One (1) original hard copy and a Microsoft Word or PDF email attachment of the proposal must be submitted to Joe Montibello at Dartmouth.

3) Proposal Preparation

a. Proposals should be prepared simply and economically, providing a straightforward, concise description of capabilities to satisfy the requirements of the RFP. Emphasis should be on completeness and clarity of content.

b. Proposals should contain a table of contents which cross-references the RFP requirements, including category and item/question numbers to make clear which requirement they respond to. Information which the bidder desires to present that does not fall within any of the requirements of the RFP should be inserted at an appropriate place or be attached at the end of the proposal and designated as additional material. Proposals that are not organized in this manner risk elimination from consideration if the evaluators are unable to find where the RFP requirements are specifically addressed.

c. Ownership of all data, materials and documentation originated and prepared for Dartmouth, pursuant to the RFP, shall belong exclusively to Dartmouth. Where there is confidential or proprietary information, those pages should be clearly marked in the upper and lower right corners with the word "Confidential" so that the indicated information may be easily identified.

4) Oral Presentation: Bidders who submit a proposal in response to this RFP may be required to give an oral presentation of their proposal to Dartmouth if specifically requested by Dartmouth.

E. RFP FORMAT

| P a g e 4

Proposals should be as thorough and detailed as possible so that the working group may properly evaluate the bidder’s capabilities to provide the desired services. Proposers are required to respond to all elements of the Statement of Needs, as well as, submit the following items with their complete proposal:

1) Cover Sheet, and all addenda acknowledgements, signed and filled out as required.

2) COMPANY INFORMATIONProvide, in summary form, company structure (corporation, LLC, etc.), state of filing, number of employees, years in business, qualifications, etc.

3) KEY PERSONNELProvide a list of key personnel and/or positions that will be assigned to the contract, as well as how you propose to provide sufficient staffing. This should include positions in project management, technical support, administrative, etc.

If necessary, the Proposer shall provide the College with sufficient documentation, including resumes as appropriate, to show that Proposer and their proposed staff are sufficiently experienced and qualified to provide the services required under this RFP.

4) FINANCIAL REFERENCESProvide evidence of the firm’s fiscal solvency including verifiable materials which could include a copy of the latest audited financial statement, a current Dun & Bradstreet financial report, Tax Returns, Bank References, etc. Proposer must also include disclosure and details of any pending lawsuits that Proposer may be implicated or involved.

5) BUSINESS REFERENCESA minimum of three references. References from colleges and universities comparable to Dartmouth are preferred. Include the length of service, dollar volume, year contract was entered into, and the name and address of the person the College can contact to verify the Firm's qualifications.

6) OTHER INFORMATIONProposer should provide any other information that would be helpful in evaluating the Proposer’s ability to provide services to Dartmouth.

F. RFP QUESTIONS

All questions concerning this RFP shall be directed in writing only to Joe Montibello at [email protected] no later than February 15, 2018.

Dartmouth reserves the right to respond to all Proposers when answering questions submitted by one firm.

| P a g e 5

G. RFP TIMELINE

(Subject to change at the discretion of Dartmouth) Issuance of RFP: February 1, 2018 Last Date for Proposer Questions: February 15, 2018 Proposal Due Date: March 1, 2018 Proposal Evaluation Phase: March 1 to April 30, 2018 Notification of Finalist: April 30, 2018 Contract Start Date: contract signed by July 31,

2018

H. EVALUATION CRITERIA

Some of the factors that will be considered include, but are not necessarily limited to (order of factors should NOT be construed to imply a ranking or weighting system):

1) Academic and Higher Education experience.

2) Portfolio, including experience, performance history, and references.

3) Pricing and budget, including administrative overhead and all expenses.

4) Clearly articulated plan, methodology, time table, and business model for accomplishing the work in a creative, practical and cost-effective way.

5) An understanding of the needs of Dartmouth, an appreciation for working with a complex and diverse higher education institution, and a perceived ability to work successfully with Dartmouth stakeholders.

6) Technical Expertise, including background and resumes of consultants. Please provide pricing for services for the period of the Agreement as required.

7) Proposal’s conformance to this RFP.

I. AWARD

Upon receipt and evaluation of the Proposals, Dartmouth will make a selection of the apparent qualified Proposer. The selection will be based on Dartmouth’s determination of the most advantageous proposal meeting all the needs of Dartmouth. Dartmouth also reserves the right to reject all proposals if it is deemed in the best interest of Dartmouth to do so. Dartmouth will be evaluating each proposal in its entirety. There is no single element that will be used in making the selection of one company over another. Dartmouth reserves the right to accept or reject any or all proposals, any portion or combination of services; to negotiate with any or all vendors or contractors. Proposals should be submitted initially on the most favorable terms.

| P a g e 6

EXHIBIT A:

SCOPE OF WORK

Dartmouth College Library serves the student and faculty population of Dartmouth College. The Library is an essential part of the student experience at Dartmouth and librarians work closely with students from their first term on campus, availing them of the expertise held by staff while training students to be confident researchers in their own right. Moreover, the Library is dedicated to supporting high‐level research and works in partnership with the Faculty of Arts & Sciences, the Thayer School of Engineering, the Tuck School of Business, the Geisel School of Medicine, and the School of Graduate and Advanced Studies. Dartmouth Library is supported by a highly committed professional and support staff of about 170, providing expertise for the Dartmouth community across the campus.

The Library system consists of Baker-Berry Library, seven specialized libraries (Biomedicine, Health Science, Business & Engineering, Physical Sciences, Art, Music, and Special Collections) and an off-site Library Depository. The current collection totals nearly 5 million items, both physical and online and an annual collections budget of $12 million; resources are managed primarily through a variety of systems including:

Sierra Information Management System CONTENTdm ShelfLoc (a locally created system for managing off-site storage materials) XCDAS (an open source XML collections / directory based archive system) ArchiveSpace ArchiveIT Summon SpringShare LOCKSS

The Library is a member of the Ivy Plus Libraries, a partnership between thirteen leading academic research libraries ― Brown University, the University of Chicago, Columbia University, Cornell University, Dartmouth College, Duke University, Harvard University, Johns Hopkins University, the Massachusetts Institute of Technology, the University of Pennsylvania, Princeton University, Stanford University and Yale University ― that collectively provide access to a rich and unique record of human thought and creativity through resource sharing and collaboration. A core feature of the Ivy Plus partnership is BorrowDirect, an unmediated library resource sharing partnership with allows users the ability to search and request research materials from a federated union catalog of 70 million volumes.

Strategic objectives for the Library are to be partners in research, co-educators in teaching and learning, and to provide inspiring environments for inspiring ideas. This request for proposals imagines an information system which will advance Library objectives.

| P a g e 7

Functional ChecklistsIn this portion of the RFP, respond to each item on the checklist forms and in every case provide descriptive information to explain your response. In cases where there is an exception or where you wish to propose an alternative, please provide a detailed explanation of the exception or the alternative. Dartmouth will, at its discretion, consider or deny any exception or alternative and award the contract based on the solution that best meets our needs. There may be additional informational questions below each checklist. If so, answer those questions concisely.

Section 1 (Categories 1-4): Systems and Services Requirements Category 1: Systems and Architecture The technology landscape for libraries is always changing, and our library systems should keep up with and advance those changes. Additionally, the LMS must be able to connect with multiple other systems on our campus to provide efficient workflows for staff and seamless user experiences for patrons.

Item # Specification Yes – Included

Yes, with add'l cost

Exceptions or alternatives

Describe how solution meets/does not meet requirement

1.1 System supports whole-database export.1.2 System is available as a cloud-hosted

solution

1.3 System is available as a multitenant (as opposed to multi-instance) architecture

1.4 System data, including records of all types, is accessible to staff and exportable

1.5 Business logic is accessible to staff and exportable

1.6 System is configurable and re-configurable such that the library will be able to keep up with patron expectations

| P a g e 8

1.7 Modifying index tables and running re-indexing functions can be done by authorized library staff

1.8 Tables that control import and export functions for data are configurable by library staff.

1.9 User authorization tables can be configured to protect metadata in all record types from unauthorized edit, and to restrict any processes that cause global changes to data to selected individual accounts.

1.10 The number of simultaneous staff users is not limited.

1.11 Enables simultaneous batch operations by multiple libraries and users without limits

1.12 MARC validation tables can be synchronized with the current version of the MARC formats.

1.13 Solution monitors system reliability and performance, and reports both to Customer Service and to relevant library staff.

1.14 System does not require scheduled downtime to perform routine updates

1.15 There are no hard limits on the number of records of various types which the solution can manage

1.16 Higher than normal transaction loads in staff functions do not affect search and display for patrons

1.17 Implementation configurations can be

| P a g e 9

modified or changed after implementation without additional expense

1.18 Uses and supports secure protocols to safeguard data in transit

1.19 Solution supports encryption in backups and in replica sets

1.20 Does not require network infrastructure outside normal internet protocol standards

1.21 Provides data recovery or rollback to specific points in time and with subsets of records in the event data loss occurs

1.22 Respondent has a security program with defined processes, policies, industry best practices, roles and responsibilities.

1.23 Security is incorporated in software/service design lifecycle

1.24 Third parties have assessed the security of the solution

1.25 Data validation is performed on records as they are created and edited, and does not vary whether records are created in batch or singly

1.26 Unique identifiers within records (e.g. record numbers, barcodes, patron IDs) can be validated for uniqueness at import or creation

1.27 Changes to records of all types are tracked with an audit trail that is visible to permitted staff

1.28 Records can be manually reverted to

| P a g e 10

previous versions.1.29 Simultaneous edits of the same record are

managed to avoid conflicts1.30 Complies with laws and regulations

governing the storage and use of “protected” user data, such as Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA)

1.31 Respondent has an incident response and notification process for data breaches

1.32 System maintains authentication logs that can be provided upon request to Dartmouth information security staff

1.33 Data access can be segmented by permissions (e.g. student staff can be prevented from accessing selected fields)

1.34 Can leverage Dartmouth identity stores (e.g. CAS, OIM, Shibboleth/SAML) for staff and patron accounts but also provide for identities to be created and managed within the system

1.35 Provides highly granular access controls for staff functions

1.36 Routine and batch processes can be scheduled to run at specified dates/times without direction intervention by library or systems staff

1.37 A locally customizable test instance/sandbox is provided where Dartmouth can preview and test upcoming version updates from the

| P a g e 11

vendor as well as local configuration changes

1.38 System's database tables and views are accessible to library staff, allowing SQL read and write queries.

1.39 When data are added, changed, or deleted from the system, the indexes are updated immediately.

1.40 System should interact with campus financial systems (Oracle at Dartmouth) directly for invoicing, collecting fines, etc.

1.41 System should interact with campus Student Information Systems (e.g. Banner) directly for patron loading

1.42 System should interact with campus HR information system directly for patron loading

1.43 System should support Single Sign-On integration with standard authentication systems

Q1.a In the context of system architecture, describe plans for technology changes relating to this ILS over the next 2-3 years.Q1.b What are the biggest risks to the solution, in terms of availability (e.g., power outages, network outages, data corruption, software bugs, reliance on external partners), and how are these risks mitigated? Provide any examples you can of large outages that have occurred, how long they lasted, and how you resolved them. Q1.c Provide sample reference data or screenshots, as appropriate, of monitoring feedback. Q1.d Indicate any outbound and/or inbound connections initiated by your product, identifying port number, protocol and the nature of the traffic. Q1.e Describe how your solution addresses group-based permissions for staff functions. Also describe any differences in which permissions and privileges can be managed for a group vs. an individual account.

Category 2: API Needs| P a g e 12

Library staff need programmatic access to our data and system functions in order to develop and maintain solutions for our patrons.





2.1 The system provides APIs that allow the library to programmatically create, read, update, and delete records of all types in the system

2.2 The system provides APIs that allow the library to programmatically create, read, update, and delete business logic (loan rules, etc.)

2.3 System allows for creation of API Keys that provide / restrict access to different types of data

2.4 APIs available to the library should, wherever possible, be the same ones used by the software

2.5 All APIs are well documented and include interactive documentation where queries can be tested against the library's data

2.6 APIs are RESTful2.7 APIs are capable of returning results in

JSON

Category 3: Accessibility and UsabilityThe Dartmouth College Library is committed to providing technologies accessible to all individuals who need to create and access information to conduct business at Dartmouth or pursue academic, clinical and research activities.

| P a g e 13

We provide a highly usable environment for both staff and public users, with strong preference given to responsive interfaces that do not require separate products or environments for mobile use. We prefer solutions that incorporate universal and inclusive design that are inherently accessible to people both with and without disabilities. To this effect, in addition to responding to the specifications below, provide VPATs (found in Appendix 1) describing the extent to which your solution(s) are accessible via assistive technologies.





3.1 All functionality for staff and patrons is operable and accessible through a keyboard interface, voice control and a screen reader

3.2 Cross-browser support3.3 Multi-platform (OS) support3.4 Mobile device support3.5 Provides staff interface automation, using

such techniques as keyboard shortcuts, task-oriented macros, and keystroke recording

3.6 Library staff can access and use reporting, updating, importing and exporting functions without intervention by systems/IT staff

3.7 The needs, wants and limitations of end users of this solution are given extensive attention at each stage of the design process.

3.8 The company regularly gathers usability data and does usability testing during product development

3.9 Usability improvements are prioritized in

| P a g e 14

the product lifecycle3.10 System meets WCAG Level A and Level AA

requirements and success criteria3.11 System uses a limited number of simple,

easy-to-read typefaces 3.12 System limits the use of font variations

such as bold, italics, and ALL CAPITALS 3.13 Avoids small text size and controls size

using relative units such as "em" and % 3.14 Text can be resized up to 200% without

loss of content or functionality 3.15 Avoids images of text, except for logos3.16 Ensures sufficient color contrast between

text and background 3.17 Color contrast meets WCAG AA contrast

ratio 3.18 Information conveyed with color is also

conveyed by other means, such as text3.19 Images and non-text elements have a text

equivalent 3.20 Provides pause, stop or hide functions for

moving, blinking, scrolling or auto- updating information

3.21 Does not use flashing images and content 3.22 Information that is conveyed with shape

or location is also conveyed by other means, such as text clues

3.23 Does not rely on icons for navigation and information

3.24 Gives user the opportunity to request more time for session timeouts and other timed responses

| P a g e 15

3.25 Adheres to principles of responsive design

3.26 Forms allow people using assistive technology to access the information, field elements and functionality required for completion and submission of the form, including all directions and cues

3.27 Tables are used for displaying tabular data only, using appropriate table tags

3.28 Uses correct semantic markup with attention to compliant HTML, page titles, section headings, stated default language, etc.

3.29 Does not use scrolling areas within a scrolling window

3.30 Does not use frames 3.31 JavaScript events which trigger on mouse

movement also trigger on keyboard movement

3.32 All fake HTML elements (e.g. buttons, links) use WAI-ARIA roles to tell the keyboard and screen reader to treat them as if they were native HTML elements

3.33 Limits capturing the keyboard focus or creating keyboard shortcuts that override existing keyboard shortcuts

3.34 Adheres to WAI-ARIA to make rich internet applications accessible

3.35 Does not use Adobe Flash 3.36 Provides a text alternative for audio files

and ensures clear audio recordings (if applicable to Help files, staff

| P a g e 16

documentation or interfaces supplied by the respondent)

Q3.a Describe some of the User Experience and Usability specialists you have on staff and what role they take in product development.

Category 4: Customer Service / Support / Implementation / Training The library needs its ILS vendor to act as a partner, working with us in our attempts to improve service to our patrons.

The intention of this RFP is to ensure that the Dartmouth College Library is using the best LMS for our needs, in the most efficient and effective way possible. The implementation plan and any training associated with the system(s) the vendor is offering will be important in understanding how we will come to use the system to our greatest benefit.





4.1 Customer support staff respond to library reports of problems quickly

4.2 Clear path to work with developers on addressing bug reports

4.3 Clear path to work with developers on addressing feature requests

4.4 Explicit annual report of the cost of maintenance and a list of what is and isn't included

4.5 Security issues with the software reported to or discovered by the vendor are shared with the library as soon as possible

4.6 User community space for sharing problems and solutions, code, query examples, etc.

| P a g e 17

4.7 System includes well indexed, searchable documentation for all features and functions.

Q4.a Does the implementation process support migration of all records, metadata, and business process data? If any types of pre-existing data are out of scope for migration, please list them out as explicitly as possible and explain what must be done to mitigate this data loss. Please comment specifically on verbose free-text note fields included in our current order record structure.Q4.b Provide the resume of the proposed Project Manager and implementation consultant, including references. Implementation consultants should be experienced in higher education application processing. Q4.c Provide an implementation task list and timeline including time estimates for proposed implementation. Q4.d Provide a summary of all implementation services available.Q4.e If the vendors response to this RFP is successful, what is the earliest date we could begin testing the implementation? Q4.f Provide an outline of the support you will offer during the cutover or transition process. Q4.g Please provide a summary of training services available, including costs.Q4.h What training services are available with the purchase of the solution? Does the vendor offer on-site training both before “go-live” and ongoing during the length of use? Is there web-based training available?

Section 2 (Categories 5-15): Resource ManagementThe system must allow the library to manage (find, suggest, purchase, catalog, circulate, and track) resources for our patrons across many categories (physical/electronic, on-campus/remote storage, owned/subscription/open access).

The Dartmouth Libraries are seeking a solution for Resource Management, to be used in a centralized suite of Collection, Access, and Delivery Services working groups to provide accurate and timely access to collections in all formats. Primary goals include procurement and management of commercial digital collections, budget management and business intelligence to support budget design, support for development and management of rich metadata to describe library collections, including features to support metadata import and export to/from many external systems, and minimization/elimination of redundant processes. Goals also include control of continuing resources, including the integration of usage data to support decision making.

Category 5: Workflow SupportItem # Specification Yes – Yes, Exceptions Describe how solution meets/does not

| P a g e 18

Included with add'l cost

or alternatives

meet requirement

5.1 Workflows can be integrated across functional areas to avoid repetitive data entry and management

5.2 Integrates management of e-resources with other functional components such as acquisitions, cataloging, discovery, etc.

5.3 Supports integration between interlibrary loan and acquisitions to provide support for purchase-on-demand programs

5.4 Supports workflow tracking such as automated reminders or alerts

5.5 Supports customized workflow automation, e.g. running transformations on incoming vendor data to enhance with local data or apply local schemas.

Category 6: Acquisitions Management Item # Specification Yes –

IncludedYes, with add'l cost



6.1 Automated selection, ordering, invoicing, and claiming, using standards like EDIFACT and X12

6.2 Duplicate checking in automated acquisitions processing

6.3 Automated creation of order, invoice, holding and item records for bibliographic

| P a g e 19

records imported from vendor 6.4 Supports creation of brief bibliographic

records (non-MARC) for a variety of uses 6.5 Supports bibliographic records with no

attached records 6.6 Permits unlimited funds 6.7 Multiple funds can be used to pay a single

order 6.8 Supports storing and sharing of a single

vendor data file across different functional areas.

6.9 Integrates with vendor websites including, but not limited to, export and import of financial transactions such as payment of invoices, credit card transactions and wire transfers

6.10 Can manage additional charges such as taxes, shipping and handling and maintenance fees for materials purchasing, both physical and electronic

6.11 Provides custom retention periods for selected acquisitions data

6.12 Provides audit trails for acquisitions activity

6.13 All acquisitions data can be reported out, including but not limited to order, vendor, bibliographic and item data

6.14 Supports fiscal-year closing 6.15 Fiscal close records can be retained

indefinitely 6.16 System should include an electronic

method for managing required signatures

| P a g e 20

for invoices prior to payment

Category 7: Serials and Holdings Management Item # Specification Yes –




7.1 Allows reuse of date predictions and enumeration patterns for serials

7.2 Supports externally supplied check-in pattern data, for example data coded in bibliographic MARC tag 891 in WorldCat.

7.3 Supports recording and receipt of issues with SISAC and/or UPC

7.4 All serials data can be reported out, including order, vendor, bibliographic and item records

7.5 Supports generation of statistics from serial records (number of active subscriptions, number of missing journal issues, number of pieces received, etc.)

7.6 Provides support for output of holdings data in the OCLC Local Holdings Record format

7.7 Supports KBART format for output of holdings data to Knowledgebase, and import of vendor-supplied holdings data

7.8 Serials check-in can automatically update the MARC 21 holdings record, including all content related to the 85X/86X paired fields, either during receiving or as a

| P a g e 21

separate function 7.9 Serials check-in function supports

automated creation of item-level records which store barcode and location data.

7.10 Provides direct links to preceding/ succeeding titles in the serial record

7.11 Supports holdings records that are fully compatible with current MARC standards

7.12 Provides capability to export and import holdings records for both serials and monographs

7.13 Supports multiple holdings locations and call numbers

7.14 Supports linked records such as items bound together with separate bibliographic records and shared holding records

Q7.a Describe how the system supports the upload of local holdings data to OCLC WorldCat Local Holdings Record, and ongoing management of these data, for all library resources.

Category 8: Electronic Resource Management The Dartmouth Libraries have a collaborative purchasing process in place for electronic resources. This includes both individual electronic resource purchasing, negotiated by specific libraries, and ownership of electronic resources as a group. The solution must support existing national and international standards for electronic resource management.





8.1 Allows reuse of date predictions and enumeration patterns for electronic resources

8.2 E-resource records can be created at

| P a g e 22

different hierarchical levels to support different packages and combination of purchases, (I.e. products offered by sub-divisions of a company, multiple products purchased from the same company).

8.3 Library staff can easily navigate from e-resource records to associated cost and fund data

8.4 Allows recording of perpetual access rights for both individual titles and package resources

8.5 Data and related functions (e.g. OpenURL resolution) stored in the library's Knowledgebase are integrated into processing and discovery functions

8.6 Data in the library's Knowledgebase can be customized with local collections or titles

8.7 Changes to data in the Knowledgebase dynamically update holdings data in holdings records.

8.8 E-resource records include data to manage administrative and product configuration functions, as well as contact information for vendors and publishers. Fields that hold login/passwords for product administrative functions can be protected from unauthorized view and edit.

8.9 Includes “tickler” functionality for renewal and other reminders

8.10 Enables tracking new resources from trials

| P a g e 23

through to access 8.11 Provides a well-formatted archive of prior

subscription and cost data for quick analysis of cost trends and evaluation of annual increases

8.12 Ingests and manages usage statistics for e-resources at the separate library level

8.13 Supports the creation and extraction of lists of e-resource records for integration into local web sites, subject/product lists, external vendors, etc.

8.14 Stores digital license documents in multiple formats (e.g. Word, PDF) in a way that makes them readily accessible to library staff

8.15 Displays customized license data to staff and patrons

8.16 Maintains usage data (both current and indefinitely historical) for e-resource packages at the package and title level

8.17 E-resource management integrates with the discovery system to permit notifications on package or title level about outages or other relevant information for patrons

Category 9: Collection ManagementItem # Specification Yes –




| P a g e 24

9.1 Supports spine-label printing9.2 Supports multiple spine label printing data

streams.9.3 Supports 1000 or more distinct library

locations and prints locations on spine labels. Supports hierarchical relationships for locations (sub-locations within a library).

9.4 Spine label formats are available for LC, Dewey, and locally-defined call number formats.

9.5 Labels output formats are customizable 9.6 Identifies and collapses serial binding

units 9.7 Provides automated alerts for serials

binding 9.8 Exports binding information to send

electronically to binding vendor Category 10: Cataloging





10.1 Fully supports MARC21 bibliographic and holdings formats, including all defined field tags, indicator values, subfield values, and fixed field values

10.2 Fully utilizes all MARC21 defined fields, indicators, and subfields in staff and public display and discovery functions

| P a g e 25

10.3 Provides a method to synchronize internal import, export, and index tables with MARC format changes as they are announced by LC

10.4 Provides support for OCLC customized adaptations of the MARC format (e.g. 891 field)

10.5 Imports bibliographic, holdings, item-level (barcode and location) data and authority records in MARC21 (UTF-8 character sets) with OCLC Connexion

10.6 Manages multiple classification schemas and subject vocabularies including, but not limited to, LC Classification and Subject Headings, SuDoc classification numbers, local classification schemas, and LC Genre Form Terms.

10.7 Permits suppression of records from public-facing displays and makes them plainly identifiable as suppressed in staff views

10.8 Permits suppression of bibliographic records with all attachments, and of individual records (item-level, holdings) attached to a non-suppressed bibliographic record.

10.9 Supports input of characters in non-roman scripts, e.g. Chinese, Japanese, Korean, Cyrillic, Hebrew, Arabic

10.10 Provides indexing/searching of the non-roman scripts listed above, in both staff and public interfaces

| P a g e 26

10.11 Provides a method for storing locally-defined data identifying the source of a bibliographic record (e.g. which batch upload transaction or when manually input)

10.12 Provides a method for marking bibliographic records for future output to authority control vendor or related services. Maintains transactional data for authority control export/import processes

10.13 Provides field-tag-level editing authorizations to protect some fields from editing

10.14 Supports bidirectional cataloging and bidirectional script display (e.g. Arabic, Hebrew).

10.15 Supports ALA diacritics input and display without peripheral software

10.16 Displays Unicode characters in all screens of the solution (staff and public)

10.17 Supports and protects local notes, classification schemas and unique local metadata

10.18 Provides contextual help within the system (e.g.: MARC field definitions and parameters, access to Catalogers Desktop, etc.) and highlights field errors

10.19 Allows library to customize when warning messages appear (e.g.: when deleting a record, when erroneous data is entered into fixed fields, etc.

| P a g e 27

10.20 Supports reporting out of data from deleted records.

10.21 Supports customized rules for copy numbering.

10.22 Supports use of multiple call numbers for items attached to one bibliographic record. For continuing resources, integrates call number data with holdings data (I.e. volumes 1-10 in Dewey, volumes 10-20 in LC).

10.23 Previous versions of edited records should be stored and accessible. The version history should record the identity of the editor and the nature of the changes made

10.24 Permits the definition of distinct indexes for retrieval of data in specific field groups (I.e. many call number indexes, many subject and genre vocabularies) without limits to numbers of available indexes or other system-imposed limitations.

Q10.a Describe how record display and suppression is handled for all aspects of the solution, including, but not limited to: staff workstations, public interface, Web browser, and mobile devices and platformsQ10.b Identify all metadata schemas that are supported and describe how they are implemented. Describe any conversion tools or utilities that will translate from one metadata schema to another.

Category 11: Authority Control Item # Specification Yes –




| P a g e 28

11.1 Supports current MARC standards for authority data

11.2 Manages import and export of authority data with an external authority vendor, export formats compliant with NACO requirements, and import/export of unique identifiers/URIs to/from external services

11.3 Preserves and displays local authority records in staff interface and makes use of headings in discovery facets and searching

11.4 Supports unique persistent identifiers and linked data applications. Supports direct query of authorities databases in the discovery environment.

11.5 Supports manual entry of local authority records including templates for constant data.

11.6 Supports management of multiple taxonomies for names, and multiple taxonomies for subjects.

11.7 Supports direct links between controlled terms in bibliographic records and matching authority records.

11.8 Supports locally-defined schemas for storing and managing identity data

11.9 Supports multiple distinct vocabularies and identity data sets, including storage of actionable URIs.

Category 12: Quality Control | P a g e 29





12.1 Supports global changes to entire fields and subfields, and specific strings within fields and subfields in all record types including, but not limited to, order, vendor, bibliographic, holdings, authority, patron records

12.2 Maintains history of global change processes

12.3 Provides reports to support database maintenance functions

12.4 Provides ability to manipulate data during record imports, including but not limited to adding fields (and data within fields), deleting fields (and data within fields), moving fields (and data within fields), preventing overlay/protecting existing data.

12.5 Provides reports of overlays when importing

12.6 Provides function to check URLs in bibliographic and holdings records, including separate reports for "not found" results. Supports exclusion of URLs from checking processes, customizable by the library.

Category 13: Circulation / Reserves / Resource Sharing | P a g e 30

The Dartmouth Libraries seek a single LMS solution that can meet the circulation, reserves and resource sharing needs of its separate libraries. We require a solution that enables efficient circulation and resource sharing in our multi-campus and multi-library system. We wish to facilitate access to physical and electronic resources among our patrons of all types on all campuses, while providing local control appropriate to the primary user base of that campus. The Dartmouth Libraries anticipate the need to implement specific circulation lending rules for separate libraries, along with rules that apply across all the libraries. We have a strong culture of maintaining data privacy and security on behalf of our patrons. Only data functionally necessary to perform a given transaction should be available during transaction processing. We consider communication with and among staff and patrons to be of critical importance. Therefore, the Dartmouth Libraries require a solution that provides tools for information and notification delivery to staff and patrons in both electronic and printed form. The Dartmouth Libraries seek a flexible and configurable course reserves system for associating both physical and electronic items with courses and faculty. We also need a solution that can integrate at a transaction level with sharing platforms outside the LMS. Currently, Dartmouth participates in such platforms as NLM DOCLINE, OCLC Resource Sharing, ILLiad, BorrowDirect and RapidILL.





13.1 Handles multiple libraries and campuses with respect to requesting, circulation, pickup locations and delivery

13.2 Tracks items in transit for delivery to and from the original library

13.3 Provides for exceptions like backdating check-ins or overriding due dates

13.4 Supports offline circulation transactions when the system is unavailable, and a means of synchronizing those transactions into the system after the issue has been resolved

13.5 Allows creation of manual patron records and temporary item records

| P a g e 31

13.6 Provides real-time hold shelf capabilities for requested and recalled items

13.7 Course reserves allows linking physical collection items as well as electronic full-text items

13.8 Allows linking items to multiple courses 13.9 Allows automated activation,

deactivation, reuse and display of courses based on locally controlled time periods (e.g. terms).

13.10 Allows faculty with appropriate patron status to identify and self-service course reserve items from the discovery layer, subject to library staff review

13.11 Provides for integration of course reserves information with external learning management systems (Dartmouth uses Canvas currently) via API's or other web services

13.12 Enables distributed responsibility to authorized staff for maintaining permissions for specific circulation functions (e.g. overrides and patron blocks)

13.14 Assigns diverse permissions to circulation rules including view-only, edit for library/sub-location, and manage all

13.15 Correctly controls circulation for library closures and hours to prevent fines or notices during closures

13.16 Permits staff to access functions beyond traditional circulation as needed (e.g.

| P a g e 32

acquisitions, etc.) 13.17 Staff members should be able to survey

the contents of the shelves electronically as they inventory the collection in the stacks, and be able to see in real time if an item is checked out, missing, or misplaced

13.18 Manually and automatically generates bills and fees for services, fines and lost items

13.19 Permit separate libraries to opt out of any portion of fining/billing or requiring payments

13.20 Calculates fines on an ongoing basis, based on overdue status, rather than at return of overdue material

13.21 Keeps detailed history on bills and fines for unlimited time period

13.22 Accepts partial as well as full payments 13.23 Permits waiving of partial and full fines

with appropriate permissions 13.24 Allows batch operations on fines, such as

globally waiving fines for specific time periods, locations, etc.

13.25 Transmits and receives patron debit and credit information to and from financial systems via API or other web service

13.26 Allows automatic and manual blocks of patrons both at the system-wide and separate library level

13.27 Allows a patron to access collections at multiple Dartmouth libraries while

| P a g e 33

maintaining a primary affiliation with one library for pickups and account management

13.28 Allows management of patrons (alumni, community borrowers, etc.) who have local privileges, but no data in the College system of record

13.29 Provides manual and automated creation of patron records (singly and in batch)

13.30 Allows global and individual update of patron records

13.31 Reports transaction and other errors for staff correction and management

13.32 Provides an array of print and electronic notices including but not limited to receipts, paging lists, book bands, hold shelf tags, pickup, overdue and courtesy notices

13.33 Allows customization, design and branding of both print and electronic notices

13.34 Provides email notices for all notice types 13.35 Provides detailed SMS notices for all

notice types 13.36 Enables staff communication about

individual transactions or patron (message alerts in records, as an example)

13.37 Supports NISO Circulation Interchange Protocol (NCIP)

13.38 Supports ANSI/NISO Z39.83 13.39 Supports the SIP2 Protocol

| P a g e 34

13.40 Integrates with traditional interlibrary loan systems (OCLC Resource Sharing, DOCLINE, ILLiad etc.) for the requesting of electronic and physical materials of items not owned by Dartmouth

13.41 Enables creation of temporary records for ILL items coming from a non-Dartmouth library

Category 14: Statistics and ReportingTo ensure that its patrons’ needs are being met, the Dartmouth College Library engages in a continual process of modifying collections, services and workflow based on empirical data. We expect the new LMS to deliver reports, statistical data and metrics in a timely and straightforward manner. We will prefer a flexible combination of “canned” reports for frequently required information such as collections use statistics; a simple reporting interface accessible to all staff for ad hoc reports; the ability to create dashboards for management level reporting; and complete access to all record types and fields for use with third party reporting tools like Tableau.





14.1 All MARC tags, indicators, and subfields are available for query and articulated reporting, with the ability to identify any character within any of these field structures.

14.2 Supports the use of Boolean logic, regular expressions, and SQL query methods

14.3 Outputs reports in .csv, full MARC, and MARC XML

14.4 Queries are run across the entire database in a timely manner (less than one hour)

| P a g e 35

14.5 Standard “canned” reports are available that can be easily used by library staff without extensive training

14.6 Standard reports are provided for collections use, including but not limited to lending/borrowing by a variety of data points, such as patron and item type, and locations, over flexible date ranges

14.7 Reporting function includes reports that assist with database maintenance tasks such as discovering record anomalies or duplication of unique identifiers (call numbers, barcodes, control numbers).

14.8 Statistical data is retained indefinitely 14.9 Variables for reporting tools to use in

gathering statistics are comprehensive and include all fields in all record types

14.10 User-generated lists of records can be generated using all record types and fields as sources of Boolean criteria

14.11 User-generated lists of records can be produced using SQL and/or basic and extended versions of applicable regular expression engine

14.12 User-generated lists of records can be generated to include data from all record types and fields

14.14 User-generated lists of records can be exported in formats usable by various software programs such as Excel, with flexible delimiters of field data

14.15 User-generated lists of records can be

| P a g e 36

used as the basis for global updates to any fields in the selected list

14.16 Retains transaction-oriented information indefinitely for reporting purposes

14.17 Allows the automatic removal of personally identifiable information from transaction data

14.18 Collection Management Dashboard displays are available to select and view reports on fund balances, titles purchased or up for renewal, e-resource status, etc. For acquisitions and collection management, there is detailed fund reporting, and the ability to track in real time what is happening with expenditures.

14.19 Manager dashboards are available with a focus on subscription renewals for all formats and usage statistics for subscriptions and e-resource packages

14.20 Budget reports are available by fund, classification, format, etc.

14.21 Staff can generate reports on their library’s collections by age, usage, and other factors that might influence retention

14.22 Staff can generate reports on paper serials including number of active subscriptions, number of pieces received, date last received, unfulfilled expected dates.

14.23 Reports can be created, saved and automated to run at specific intervals.

14.24 System provides the ability to view

| P a g e 37

individual funds and selector activity along with structured higher-level financial reports.

Q14.a Describe how the solution delivers customizable, relational views of LMS data. Include information about data available through these views, whether the views are read-only or provide update capabilities, and any export or scripting capabilities. Can these views include arbitrary data from multiple record types (e.g., bibliographic data and order data)? What, if any, limitations exist on combining data elements from multiple record types for reporting or updating?

Category 15: Data ManagementItem # Specification Yes –




15.1 System should include granular permissions so that staff access to some data or functions can be limited by the library

15.2 System should include an audit trail of what changes have been made to records, and by whom

15.3 System should include an audit trail of what changes have been made to system tables / business logic, and by whom

15.4 System must support metadata creation and management for MARC records

15.5 System must support metadata creation and management for records in non-MARC formats (e.g. MODS, DC, etc.)

Category 16: Discovery and Patron Experience

| P a g e 38

Library patrons expect a Google-like search experience and do not always understand the myriad resource silos and access restrictions that they encounter when searching library collections. Dartmouth wants a discovery solution that supports patrons’ research needs, enabling them to locate and access relevant resources efficiently. We seek a solution that can do this by integrating resource silos, by providing a more feature-rich search interface than has typically been found in traditional library catalogs and by facilitating access to electronic resources. At the same time, the discovery solution should provide search options for experienced researchers who require a greater level of control and specificity in an interface. The Dartmouth College Library seeks a discovery solution that will serve the widely different needs of our diverse population of library users. We envision a single solution that enables discovery of resources, regardless of format or resource type, in local collections and beyond. This discovery solution may be a component of your integrated library system or an independent offering designed solely for discovery. The discovery solution will enable patrons to customize the search experience by controlling for preferred formats and locations, including the local institution’s collection, locations within the local collection or any resources that can be accessed or obtained by Dartmouth community members. The discovery solution will search across disparate resource silos, integrate the search results and present them to the patron through an intuitive interface.





16.1 Support for patron functions to be used with accessibility software (screenreaders, dictation, etc.)

16.2 Support for user-created lists of resources that can be saved, shared, annotated, requested in bulk, etc.

16.3 Searches disparate resource silos (e.g., local returnable and/or digital collections, including but not limited to OAI-PMH harvested metadata), vendor-supplied electronic resource collections, shared catalogs like WorldCat, etc.

16.4 Retrieves relevant items regardless of format or physical location and displays,

| P a g e 39

organizes and limits search results in clearly described manner

16.5 Permits control of search scope and retrieval results both before and after search by criteria such as availability, location, creation or publication date, format and version or resource type (faceted filtering)

16.6 Enables known-item searches for author, titles and controlled subject terms

16.7 Provides specific, highly relevant results for single-word and brief title searches, (e.g., the journals “Nature” or “Science”, or book title “Ada”)

16.8 Displays records with multiple formats or editions grouped under one title, clearly distinguishing differences for the user

16.9 Uses clearly explained and documented methods for prioritizing and relevantly ranking results from the millions of metadata entries a standard discovery interface offers

16.10 Facilitates expert searching techniques for advanced searchers, generally through intuitive user-interface elements

16.11 Recommends subjects and provides alternate titles, spelling corrections and other ways to help patrons identify and use alternate search strategies

16.12 Provides direct links to preceding/succeeding titles in serials records that contain them

| P a g e 40

16.13 Integrates course reserve searching and display

16.14 Provides optional supplemental content such as book covers, tables of content, indexes, reviews, altmetrics and content previews

16.15 User-interface provides "virtual shelf browsing" capabilities, to present users with access to "adjacent" materials

16.16 Provides patrons with easy-to-identify tools for using system features to request, obtain and access resources

16.17 Displays availability, status and location of specific resources at both the initial (browse) level of display and at detailed display screens

16.18 Enables patrons to request physical items from any Dartmouth library location / branch

16.19 Communicates access rights for items harvested from the Dartmouth digital repository

16.20 Restricts patron access to only those electronic items patron is entitled to use after login

16.21 Provides custom results based on IP geography (on-campus/off-campus) or login status

16.22 Enables patrons to login to view, renew, track requested, current or historical checked out physical items

16.23 Enables patrons to create and save, print,

| P a g e 41

share or export single items or lists of items to citation management, word processing or other productivity software

16.24 Permits patrons to save searches16.25 Permits patrons to set and receive alerts

and notifications about the status of specific items or categories of items available, for example based on saved searches

16.26 Enables patrons to send and share results via social media and SMS

16.27 Enables patrons to opt in or out of account history/reading/saved lists at any time

16.28 Supports direct access to detailed resource information or electronic full-text, where allowed

16.29 Minimizes use of interim screens such as resolver result screens when connecting patrons to full- text information

16.30 Provides staff with advanced functionality in the discovery layer without launching separate interface sessions (e.g., ability to view MARC records)

16.31 Provides customizable discovery views for logged in users, by category (by status— fac/staff/student)

16.32 Provides branding and customization options beyond logomarks and accent colors

16.33 Enables interoperability with online reference chat, social networks, external

| P a g e 42

subject guides and other electronic services for communication between library patrons and staff

16.34 Enables local control over metadata to include in retrieval results, including the control of and customization of metadata that displays to the patron

16.35 Permits customization of metadata to display (or suppress) in (1) public-facing catalog display, (2) library staff display, (3) MARC display for the public, and (4) MARC display for staff view and edit

16.36 Permits the library to create links to external resources in individual records or browse interfaces, based on data in the user search terms or in retrieved records (e.g. link to search in WorldCat, IMDB, Internet Archive or to local information about special collections or gifts)

16.37 Allows library to add custom facets 16.38 Allows library to set language defaults 16.39 Allows library to customize Help screens

and menus 16.40 Allows library to include custom local

scripting for additional local features 16.41 Allows library to provide custom local

icon sets 16.42 Allows library to add user alerts generally

or based on user status 16.43 Allows library to influence relevance of

results

| P a g e 43

16.44 Allows library to influence priority of results based on collections

16.45 Allows library to determine length of user session and how session limits are communicated to the user

16.46 Works with multiple formats or editions are gathered in results display

16.47 Patron login mechanisms should allow for some users to use Dartmouth's campus authentication system (CAS or Shibboleth/SAML) and others to authenticate based on account information in the LMS

16.48 URL's for individual records should be persistent

16.49 URL's for lists of search / browse results should be persistent

16.50 System facilitates social media activities like recommending, tagging, reviewing, rating, and sharing

16.51 System provides notifications to users based on saved preferences, supplied keywords, or even entire bibliographies

16.52 Exported result sets from the system need to be manageable by any platform or service (mobile, RSS, web services, batch loading)

16.53 System can expose collections trends and activity to the public in real time on our web site and on the flat screens in the various libraries

16.54 System allows user to retrieve a set

| P a g e 44

comprised of all records in the database and the ability to use facets as the sole search method; the user sees no system-defined limit to the maximum number of records to display.

16.55 Spell-checking and search suggestions must be based on data indexed from the records in the system, not from external dictionary files.

Q16.a Describe how the system generates facets from library bibliographic and related records.Q16.b Describe how the system generates facets from OAI-PMH harvested records.Q16.c Describe how the system generates facets from supplied metadata for all additional indexed resources.Q16.d Describe what features are available to patrons when logged in to the system, and how those features are made apparent to users. Q16.e Describe your company’s policies on backing up, recovering and purging patron-supplied data. For example, how might you handle a patron who has accidentally deleted a resource list created in your solution? One who no longer wants information they contributed to be available through the solution?

Additional Product or Service Information

Respondents are welcome, but not required, to provide information about related products and services. This information, unless covered by the functional requirements above, will not be used to score proposals.

| P a g e 45

EXHIBIT B

PROPOSER DECLARATION FORM

Proposer agrees to perform in accordance with all provisions of the RFP documents and any addenda thereto, as stated in this RFP. Proposer agrees that its response to this RFP is a firm offer to Dartmouth which cannot be withdrawn for one hundred twenty (120) calendar days from and after the RFP response due date.

Proposer certifies that it has; (a) examined and understands all of the provisions of the RFP and the conditions of the contract documents attached thereto, as well as any addenda issued prior to the due date; (b) that it has reviewed and supports the accuracy of its response to this RFP; (c) that it is fully and financially capable of performing the work as outlined in the RFP; (d) has satisfied itself as to the nature and location of all work, the technical, general, and local conditions to be encountered in the performance of any work, the requirements of the contract and all other matters which may in any way affect performance or the cost thereof; and that Dartmouth shall not be responsible for any errors or omissions on the part of the undersigned in preparing this RFP.

Proposer acknowledges that they have read all of the terms and conditions of the Dartmouth Master Agreement (a copy of which has been provided as Exhibit “C”) and that the terms and conditions set forth in the Master Agreement shall be used and binding without change for the awarded Proposer. Any changes to the terms and conditions that Proposer wishes to make shall be submitted to Dartmouth for review and consideration as part of the Proposal response and will be used as part of the evaluation process. If awarded a contract, Proposer agrees to execute the Master Agreement and deliver it to Dartmouth within five (5) business days, of such award, along with any required certificates of insurance and additional specifications.

Proposer understands that by responding to this RFP and engaging in the associated process, he/she (including his/her agents, employees and assigns) hereby agrees to conduct all negotiations and related dealings with integrity, honesty, and good faith. Proposer further agrees to honor the terms of its final RFP response determined to be mutually acceptable to both parties and to adhere to said terms during all stages of contract review, negotiation and execution. Proposer agrees that no changes will be made to the final RFP response unless mutually agreed upon by Proposer and Dartmouth, in writing.

____________________________ ______________________________Authorized Signatory Title

____________________________ ______________________________Print Name Date

| P a g e 46

EXHIBIT C:

SAMPLE AGREEMENT FOR GOODS AND SERVICESBY AND BETWEEN

TRUSTEES OF DARTMOUTH COLLEGEAND

[CONTRACTOR]

This Agreement for Goods and Services (“Agreement”) is made as of the Effective Date set forth below between Trustees of Dartmouth College (“Dartmouth”) and the contractor or vendor identified in the Basic Contract Information below (“Contractor”). (Each of Dartmouth and Contractor is sometimes referred to in this Agreement as a "Party" and collectively they are referred to as the "Parties.")

Recitals

1. Dartmouth wishes to engage Contractor to provide the goods and perform the services described in this Agreement upon the terms and conditions set forth herein.

2. Contractor represents it is duly qualified, and willing and able, to provide the goods and perform the services set forth in this Agreement upon the terms and conditions set forth herein (the “Master Terms.”)

In consideration of the mutual covenants and promises contained in this Agreement and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by Dartmouth and Contractor, Dartmouth and Contractor hereby agree as follows:

1. Basic Contract Information.

1.1 Effective Date . The "Effective Date" of this Agreement is the date of the latest signature in the signature block at the end of this Agreement.

1.2 Name of Contractor . "Contractor" is with a business address at .

1.3 Scope of Services . Contractor shall provide the goods (“Goods”) and perform the services (“Services”) described on Exhibit A (the "Scope of Services”) attached hereto and incorporated herein by reference.

2. Term and Termination.

| P a g e 47Dartmouth Sample Agreement for Goods and Services_Version 9/2017

2.1 Term. This Agreement shall be effective on Effective Date and shall remain in effect until all obligations set forth in this Agreement have been satisfactorily fulfilled unless terminated pursuant to the provisions of this Agreement.

2.2 Dartmouth Termination for Convenience. Dartmouth, in its sole discretion, may terminate this Agreement at any time, without cause, by providing at least sixty (60) days’ prior written notice to Contractor.

2.3 Failure to Perform. If Contractor fails to perform any of its obligations under this Agreement and such failure continues for ten (10) days after written notice of such failure given to Contractor by Dartmouth, Dartmouth may immediately, or at any time thereafter, terminate this Agreement by written notice to Contractor, without prejudice to any remedies (whether set forth in this Agreement or provided by law) which might otherwise be available to Dartmouth.

2.4 Effect of Termination. Upon termination of this Agreement, Dartmouth shall pay any undisputed amounts for the Goods and Services provided up to and including the effective date of termination in accordance with the procedures in Exhibit A with respect to timing of invoicing and payment, and the Parties shall have no further rights or obligations under this Agreement other than such rights and obligations arising prior to the date of such termination, including any rights of a non-breaching Party at law or in equity, provided, that the provisions of this Section 2.4, Section 1, Sections 3.9, 3.10 and 3.13, and Sections 5 through 12 shall survive such termination and continue in effect.

3. Performance of Services and Delivery of Goods.

3.1 Standards of Performance for Services; Replacement of Contractor Personnel. Contractor shall perform the Services and/or provide the Goods (as called for under the Scope of Services) with promptness and diligence in accordance with any timetable or schedule set forth in Exhibit A and in accordance with Section 5.4. Contractor shall assign qualified individuals with suitable training, education, experience and skills to provide the Services. In the event that Dartmouth would like to have any Contractor personnel replaced based on Dartmouth’s reasonable, good faith business judgment, Dartmouth shall inform Contractor in writing and Contractor shall remove such personnel in accordance with Dartmouth’s request and will manage the transition of replacement personnel to minimize the impact on the performance of the Services. Contractor shall have a reasonable period of time, taking into account the nature of the Services being provided and the reasons for Dartmouth’s replacement request, to replace such personnel with another person with suitable training, education, experience and skills to provide the Services.

3.2 Delivery of Goods. Contractor shall deliver the Goods and perform the Services in a timely manner in accordance with this this Agreement, including the specifications set forth in documentation issued by Contractor relating to the Goods and Services, including without limitation the information set out in Exhibit A and any information provided to Dartmouth at the time of delivery (the “Specifications”) and in accordance with Section 5.3. Contractor agrees that Dartmouth shall have the right to reject any Goods and Services in accordance


with Section 3.3 below that do not meet the Specifications; such rejection, however, will not relieve Contractor of its obligation to provide conforming Goods.

3.3 Acceptance. Dartmouth reserves the right to inspect and test all Goods and Services prior to Acceptance, and to reject any Goods and Services that are defective or otherwise do not conform to this Agreement, including the Scope of Services and Specifications, and Contractor agrees to provide reasonable assistance at Contractor’s own expense for such inspections and tests. Unless otherwise specified in the Scope of Services, Dartmouth will have thirty (30) days from delivery of Goods or completion of Services, as the case may be (the “Delivery Date”), to inspect, test and verify conformance to the requirements of this Agreement, including the Scope of Services and Specifications, and will have ten (10) days thereafter to provide Contractor with a notice of deficiency as to any Goods or Services that Dartmouth identifies as nonconforming to such requirements (the “Deficiency Notice”). If Dartmouth does not provide a Deficiency Notice as to particular Goods or Services, those Goods and Services will be deemed accepted immediately upon expiration of the ten (10) day period (“Acceptance”). Upon receipt of the Deficiency Notice, Contractor will: (i) as to Goods, replace the non-conforming Goods with conforming Goods within five (5) business days, and (ii) as to Services, re-perform the Services to the satisfaction of Dartmouth within ten (10) business days (each and collectively the “Cure Period”). All substitute Goods and re-performed Services will be at the sole expense of Contractor. If the substitute Goods and/or the re-performed Services are still non-conforming at the end of the Cure Period, Dartmouth may, at its sole option, mutually agree with Contractor on a further time for cure or alternative remedy, cancel this Agreement as to those Goods or Services, accept the Goods or Services at a price reduction acceptable to Dartmouth and Contractor, or reject the Goods or Services completely and terminate this Agreement without further liability on to Dartmouth and without prejudice to its rights and remedies under the law. Contractor agrees to pay the costs and to assume all risk associated with rejected Goods and Services, including but not limited to, costs of storage, transportation charges for return, and delivery of replacements. Dartmouth’s lack of inspection of any Goods or Services does not waive its right to contest the condition of Goods or Services later determined to be defective, nonconforming or otherwise unacceptable.

3.4 Risk of Loss: Contractor assumes and retains all risk of loss with respect to the Goods ordered and all work in progress, materials, and other items related to this Agreement until the same are finally accepted by Dartmouth. Contractor assumes and retains all risk of loss of, or damage relating to, any Goods, work in progress, materials, and other items rejected by Dartmouth until the same are received by Contractor or finally accepted by Dartmouth.

3.5 Recalls. Contractor will be responsible for all costs and expenses associated with any Goods that are subject to a manufacturer or Contractor initiated product recall.

3.6 Shipping. Contractor shall pack, mark and ship all Goods in a commercially reasonable manner sufficient to secure the lowest, reasonable transportation


cost and in accordance with the shipping instructions contained herein and the requirements of common carriers. All Goods will be shipped to Dartmouth “FOB” destination to the address specified in the Scope of Services at Exhibit A, unless instructed otherwise by Dartmouth in writing. Any and all freight charges that the Parties have agreed in writing to be for Dartmouth’s account must be stated separately with respect to each item shipped. Shipments are not to be sent C.O.D.

3.7 Documents. All documents provided by Contractor will include the Dartmouth Purchase Order Number governing Contractor's sale to Dartmouth of the Goods or the provision of the Services subject to this Agreement. Contractor will provide to Dartmouth all shipping papers, including without limitation the original bill of lading, express receipt, memorandum of shipment and packing slip (stating "Order Complete" if the last one in the Purchase Order), to Dartmouth prior to shipment arrival or included in the shipment. The terms of this Agreement control over any printed terms on a Contractor purchase order, acknowledgement, confirmation or invoice, except to the extent expressly agreed to by Dartmouth in writing.

3.8 Safety Data. Contractor shall notify Dartmouth in writing within three (3) business days of issuance of the Purchase Order by Dartmouth of any local, state, and/or federal laws or regulations relating to hazardous or toxic substances or hazardous wastes, or any other applicable environmental, health, or safety laws or regulations applicable to the shipping, handling, use, storage, disposal or any other activity pertaining to the Goods or Services to be furnished hereunder. Contractor shall provide Dartmouth with handling instructions, applicable warnings, and material safety data sheets with each shipment of Goods.

3.9 Compliance with Laws and Dartmouth Policies. Contractor shall comply with all applicable laws with respect to its performance under this Agreement, including, but not limited to, environmental laws and laws pertaining to anti-discrimination and anti-retaliation in employment, labor, wages, hours, leave and other conditions of employment, and current OSHA requirements. It is the policy of Dartmouth to maintain a drug-free workplace. Contractor agrees that it will inform all of its employees, contractors and agents that Dartmouth seeks to ensure that all individuals are free from the effects of illegal drug use and/or are not impaired due to drugs or alcohol while performing Services, and that illegal drugs are not permitted on Dartmouth’s premises. Contractor agrees that, while on Dartmouth's premises, Contractor's employees and Subcontractors will comply with all regulations of Dartmouth then in effect, including safety and security regulations, and take all necessary precautions to prevent injury or damage to persons or property.

3.10 Equal Opportunity. If Dartmouth requires Goods and/or Services ordered pursuant to this Agreement in order to perform under a contract or subcontract with the federal government, Contractor shall comply with and be subject to all applicable laws, including but not limited to, all federal acquisition regulations, Executive Orders 11246 and 11375 as amended from time to time, and the rules and regulations promulgated thereunder, including the provisions set forth in 41


CFR §§60-1.4(a), 60-300.5(a), and 60-741.5(a) and the applicable rules, regulations and guidelines as may be issued to implement these laws by any local, state or federal agency or authority, including the State of New Hampshire and the United States. During the performance of this Agreement, Contractor agrees that it will not discriminate against any employee or applicant for employment because of race, color, sex, religion, national origin, citizenship, sexual orientation, gender identity or expression, age, genetic information, pregnancy, marital or parental status, disability, or status as a disabled veteran, recently separated veteran, other protected veteran, Vietnam era veteran, and/or Armed Forces Services medal veteran (each individually referred to as "Qualified Covered Veteran" and collectively as "Qualified Covered Veterans"). Contractor will take affirmative action to identify women, minority, disabled, Qualified Covered Veteran-owned vendors and Subcontractors who are capable of fulfilling Dartmouth’s requirements, as well as to employ, advance in employment, and treat all qualified individuals without discrimination based upon their race, color, sex, religion, national origin, citizenship sexual orientation, gender identity or expression, age, genetic information, pregnancy, marital or parental status, disability, or status as a Qualified Covered Veteran. Such action shall include, but not be limited to, the following: employment, upgrading, promotion, demotion or transfer, recruitment or recruitment advertising, layoff or termination, right of return from layoff and rehiring, rates of pay or other forms of compensation and changes in compensation, leave of absence, sick leave or any other leave, and selection for training including apprenticeship, as well as any other affirmative action measures which are required by applicable law.

3.11 Non-Exclusivity. Unless otherwise specified in Exhibit A, the Goods and/or Services will be provided on a non-exclusive basis and Dartmouth may procure services similar or identical to the Services and goods similar or identical to the Goods from sources other than Contractor.

3.12 Time is of the Essence. Contractor understands that time is of the essence in performing the Services and delivering the Goods and that failure to perform this Agreement on time and as agreed could cause substantial disruption and expense to Dartmouth.

3.13 Independent Contractors. Nothing in this Agreement shall make Dartmouth and Contractor partners, joint venturers, joint employers or otherwise associated in or with the business of the other. Contractor is an independent contractor engaged in the operation of its own business; neither Party shall be considered to be the agent, master or servant of the other for any purpose whatsoever, neither Party has any general authority to enter into any contract, or incur any debts or other obligations, on behalf of, the other Party, and neither Party shall be liable for any debts, accounts, obligations or other liabilities of the other Party except as specifically provided herein.

4. Compensation; Terms of Payment.

4.1 Fee and Expenses. Dartmouth shall pay fees to Contractor ("Fees"), and reimburse Contractor for its reasonable pre-approved expenses (“Expenses”), as set forth in Exhibit A.


4.2 Payment Terms. Contractor shall provide Dartmouth with detailed invoices for Fees and Expenses and, assuming Dartmouth has no objection to the invoiced Fees and Expenses, such invoices shall be payable by Dartmouth within forty-five (45) days following Acceptance. At Dartmouth’s option, Dartmouth may submit payment to Contractor via a Single Use Account with no additional fees.

5. Warranties

5.1 Financial Capability. Contractor represents and warrants to Dartmouth that it is financially capable of fulfilling its obligation under this Agreement.

5.2 No Legal Impediments to Performance. Contractor represents and warrants to Dartmouth that there are no legal or administrative proceedings pending or threatened against Contractor that could adversely affect Contractor’s performance hereunder and that Contractor is not prohibited by any restrictions in its organizational documents, by any agreements or obligations with third parties or by any applicable law from entering into, or performing its obligations under, this Agreement.

5.3 Specific Warranties for Goods. Contractor warrants that the Goods: (i) will be new, (ii) will conform to and operate in conformity with the Specifications in Exhibit A or as otherwise provided by Dartmouth, (iii) will be merchantable and fit for their intended purpose, (iv) will be free from errors, malfunctions and defects (including design defects); and (v) will be free from all liens, security interests, claims (including to title), and encumbrances..

5.4 Specific Warranties for Performance of Services. Contractor warrants that it will perform all Services in a timely, professional and workmanlike manner consistent with industry standards.

5.5 Warranty Claims Response. Except as otherwise provided in the Scope of Services relating to testing and acceptance, Contractor will correct all warranty or defect issues within ten (10) days of written notice.

5.6 Warranty Periods. Except as otherwise provided in third party warranties as discussed below, all warranty periods under this Agreement, including the Scope of Services, commence as of the date of Acceptance. For Goods and Services of Contractor, the warranty period will be for a period of five (5) years. For Goods of third parties being provided by Contractor, Contractor agrees that the Goods will be warranted for such time, under such conditions, and otherwise in accordance with the warranties given by the manufacturer(s) of the Goods, that such warranties will pass through to the benefit of Dartmouth, and that Contractor will process all warranty claims against manufacturer(s) on behalf of Dartmouth.

5.7 Debarment. Contractor represents to Dartmouth that neither Contractor, nor to Contractor’s knowledge any person employed or engaged by Contractor, has been excluded from participation in any United States government healthcare program or has been debarred from or under any other United States


government federal program nor is Contractor aware of any pending or potential actions that would give rise to any such exclusion or debarment.

6. Insurance Requirements.

6.1 Coverage Requirements. During the Term, Contractor will maintain at its expense, and ensure that its Subcontractors obtain and maintain at their expense, insurance with insurers licensed to do business in all jurisdictions where Contractor and/or its Subcontractors provide goods or services, and Contractor agrees to abide by, and ensure that its Subcontractors involved in the performance of Contractor’s obligations under this Agreement abide by, the minimum coverage and other insurance requirements, all as set forth in this Section 6 and on Exhibit B attached hereto, as applicable, which is incorporated herein by reference. Insurers shall have an A.M. Best rating of AV or greater.

6.1.1 Commercial General Liability Insurance. Commercial general liability insurance written on an occurrence basis, including bodily injury, property damage, personal injury, advertising injury, products and completed operations and contractual liability in the amount no less than:

$1,000,000 each occurrence;$1,000,000 products/completed operations limit;$1,000,000 advertising injury and personal injury limit; and$1,000,000 general aggregate.

6.1.2 Business Automobile Liability Insurance. If using motor vehicles (owned, hired, or borrowed) to deliver Goods or perform Services under this Agreement, business automobile liability insurance with a minimum limit of $1,000,000 combined single limit each accident for bodily injury and property damage for all owned, rented leased or hired vehicles used in conjunction with this Agreement.

6.1.3 Workers’ Compensation Insurance. If employees working on Dartmouth premises, statutory workers’ compensation insurance in accordance with all state and local requirements of the state(s) in which Goods are provided or Services will be performed. This will include employers’ liability insurance with minimum occurrence limits of:

$100,000 bodily injury by accident/$100,000 each accident;$500,000 bodily injury by disease/$500,000 policy limit; and$100,000 bodily injury by disease/$100,000 each employee.

6.1.4Professional Liability Insurance . Professional or Errors and Omissions Liability Insurance with combined single limits of $2,000,000 per occurrence and $2,000,000 aggregate, per year, covering the performance of Contractor and any of its Subcontractors under this Agreement.

6.1.5 Additional Policies of Insurance. Contractor shall additionally carry such additional coverage or policies of insurance as specified on Exhibit B, attached hereto, as applicable.


6.2 “Claims Made” Coverage. Any liability insurance purchased on a “claims made” basis must be continuously maintained for a period equal to the applicable statute of repose, but in any case not less than 3 years, following final delivery of Goods or termination of Services either through the continued purchase of insurance or the purchase of an extended reporting period. The retroactive date applicable to such “claims made” insurance, if any, must precede the first date on which Services are to be performed and/or Goods are to be delivered.

6.3 Verification of Coverage. Contractor, for itself and any permitted Subcontractors, will have furnished to Dartmouth original certificates of insurance and amendatory endorsements or copies of the applicable policy language effecting coverage required under this Section 6 and Exhibit B attached hereto, as applicable, prior to or at the time of execution of this Agreement, and shall further provide evidence that the foregoing is in place and will not be cancelled or reduced during the term of the Agreement without the insurer giving Dartmouth such number of days' prior written notice as such policies permit. Contractor’s and any Subcontractors’ certificates of insurance will list “Trustees of Dartmouth College” as an Additional Insured on its or their commercial general liability policy and business automobile liability policy (as applicable). Contractor and any of its Subcontractors will submit updated certificates of insurance upon expiration of the required policies. Neither Contractor’s failure to provide, nor Dartmouth’s failure to obtain, proof of compliance shall act as a waiver of any of the terms in this Agreement. Dartmouth reserves the right to require complete, certified copies of all required insurance policies, including endorsements required under this Section 6 and Exhibit B attached hereto, at any time. Such certificates of insurance and endorsements must be submitted to [Business UNIT/department], Hanover, New Hampshire 03755.

7. Indemnification.

7.1 Contractor Indemnification Obligation. Contractor agrees to and will indemnify and defend Dartmouth, its affiliated corporations, and its and their trustees, directors, owners, members, managers, officers, employees, representatives and agents from and against any third party claims, demands, actions, suits and proceedings (collectively “Claims”), and all damages, losses, liabilities, penalties, interest, settlement payments, and expenses, including without limitation attorneys' fees, arising from or related to any Claim (collectively, “Damages") resulting or arising from or connected in any way with the performance or non-performance of its obligations under this Agreement, including without limitation: any Claim (i) that the Goods or Services infringe, misappropriate or violate any patent, copyright, trademark, trade secret, privacy, publicity or other intellectual property or proprietary right of third party, (ii) of libel, defamation, fraud, misrepresentation or other similar claim in connection with the Goods or Services, (iii) arising from any breach of any representation or warranty of Contractor provided herein, (iv) arising from any breach by Contractor of any other provision of this Agreement, or (v) arising from any negligence, recklessness or willful misconduct of Contractor or any


Subcontractor or other Person (each, as defined below) acting on behalf of or a the direction of Contractor.

7.2 Procedures regarding Claims. Dartmouth shall notify Contractor in writing within thirty (30) days of the assertion by a third party of any Claim that is subject to indemnification under this Section 7. Failure to notify Contractor shall not result in the waiver of indemnity rights with respect to such Claim unless such failure materially prejudices the ability of Contractor to defend such Claim and then only to the extent thereof. The Parties shall cooperate with each other in the defense and settlement of any such Claim. In the event Contractor does not accept the defense of any Claim, Dartmouth shall have the right to defend such Claim. Dartmouth may, at its sole option, participate in the defense of any Claim with counsel of its own choosing and at its own expense. Contractor may not settle any Claim for other than monetary relief, or enter into any consent judgment, without Dartmouth’ consent, which will not be unreasonably withheld, conditioned or delayed.

8. Data Security Matters.

8.1 Data Security Regulations. Contractor will ensure that all Services are performed in a manner that complies with any applicable data protection, data security, and data breach laws or regulations of any jurisdiction in which Contractor operates or processes data, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (collectively, “Data Security Regulations”).

8.2 Data Security Safeguards. Contractor will implement and maintain reasonable administrative, technical and physical safeguards, and other security measures appropriate for the protection of any data provided by Dartmouth that will be maintained by Contractor as part of the Services (“Data”) unauthorized use or disclosure. Contractor represents and warrants to Dartmouth that Contractor’s responses to Dartmouth’s “Information Security Controls for Vendors” questionnaire attached hereto as Exhibit C (“Questionnaire”) are complete and accurately reflect Contractor’s existing security policies. Without limiting the generality of the first sentence of this Section 8.2, Contractor agrees that for as long as it provides Services to Dartmouth, Contractor shall not alter its information technology security policies in any manner that would constitute a material reduction in the requirements described on the Questionnaire. Contractor acknowledges that Data may also include (i) certain information about a natural person that identifies such person or could reasonably be used to identify such person, or relates to a person and is associated with information that could reasonably be used to identify such person and is classified as protected or restricted from disclosure or use under Data Security Regulations (“Protected Personal Data”), (ii) information about an entity that is proprietary or otherwise confidential (“Sensitive Entity Data”) , and/or (iii) data arising from the aggregation and analysis of any of the foregoing.

8.3 Data Security Breach. Contractor will promptly (and in any event within three business days or such shorter period as may be required under applicable Data Security Regulations) notify Dartmouth of the occurrence of any event that


constitutes or is reasonably suspected to constitute a “breach” or any equivalent term under any applicable Data Security Regulation or an unauthorized disclosure of Protected Personal Data or Sensitive Entity Data (a “Data Security Breach”). In the event of a Data Security Breach, Contractor will share with Dartmouth the following information to the extent applicable and known: (i) a description of the facts pertaining to the Data Security Breach, including without limitation, the date of the Data Security Breach and the date of discovery of the Data Security Breach; (ii) a description of any Protected Personal Data or Sensitive Entity Data involved in the Data Security Breach; (iii) the names of the individuals who committed the Data Security Breach or who knew of it at the time it occurred; (iv) the names of the unauthorized individuals or entities to whom Protected Personal Data or Sensitive Entity has been disclosed; (v) the likelihood that the Protected Personal Data or Sensitive Entity Data involved in the Data Security Breach has been or will be misused; (vi) a description of the action taken or proposed by Contractor to mitigate the financial, reputational or other harm to the individual(s) or entities who may be the subject(s) of the Data Security Breach, including the prevention of further unauthorized access or disclosure of Protected Personal Date or Sensitive Entity Data; and (vii) such other information as Dartmouth may reasonably request including, without limitation, the information, data and documentation required by Dartmouth to timely comply with applicable Data Security Regulations or other laws. Unless required by applicable law, Contractor will only be required to provide the notices and information set forth above and will not be required to notify the individuals or entities whose Protected Personal Data or Sensitive Entity Data has been disclosed. Each party will also reasonably cooperate with the other party in connection with the investigation of such Data Security Breach. Contractor will not, except as may be required by applicable Data Security Regulations or other laws, make any public announcements relating to such Data Security Breach without Dartmouth’s prior written approval.

8.4 Reimbursement. Contractor will reimburse each of the indemnified persons and entities described in Section 7.1 for any Data Security Breach Remedy Costs (as hereafter defined) incurred by any of them in connection with a Data Security Breach to the extent such Data Security Breach is caused by Contractor, including any of Contractor’s Subcontractors’, acts or omissions or any breach of Sections 8.1, 8.2 or 8.3. Contractor will be obligated to make such reimbursement promptly following receipt of a request therefor from Dartmouth which describes the purpose for which reimbursement is requested and including supporting evidence as to the incurrence of the costs for which reimbursement is claimed. For purposes of the foregoing, “Data Security Breach Remedy Costs” means all reasonable costs a person or entity may incur in connection with remediation efforts for (i) the development and delivery of legal notices required by Data Security Regulations, which may include providing notice to all persons whose Protected Personal Data may have been affected by a Data Security Breach, (ii) the establishment of a toll-free telephone number where affected persons may receive information relating to a Data Security Breach; and (iii) the provision of credit monitoring expenses for affected persons.


8.5 FERPA. Contractor acknowledges and understands that Dartmouth may be required to protect certain personally identifiable information (“PII”) and student education records from disclosure under the Family Educational Rights and Privacy Act, including regulations promulgated thereunder (“FERPA”). To the extent that Contractor may be subject to FERPA in its performance of Services under this Agreement, Contractor agrees to: (i) use and/or disclose any such PII and student education records only as needed for the performance of the Services; (ii) secure all PII and student education records related to Dartmouth’s students using industry standard security practices, which will include procedures at least as stringent as those data security standards as Contractor is required to maintain under this Agreement. PII and/or student educational records shall be released to permitted Subcontractors by Contractor only to the extent necessary for the performance of the Services, and Contractor shall ensure that any such permitted Subcontractors to which PII and/or student educational records are released abide by the same restrictions, including without limitation such data security requirements, as those which apply to Contractor in connection with such PII and student educational records as set out herein.

9. Use of Dartmouth’s Name; Contractor Confidentiality Obligations.

9.1 Restrictions on Use of Dartmouth’s Name. The use by Contractor of the name, trademarks, trade names, logos, or any adaptations thereof, of Dartmouth in any publication, press release, advertisement, announcement, promotional material, or promotional activity requires the prior written consent of Dartmouth.

9.2 Confidentiality.

9.2.1 Confidentiality Obligations. “Confidential Information” means (i) any information disclosed by Dartmouth to Contractor in connection with this Agreement which does not fall within any of the exceptions set forth in Section 9.2.2 below, and (ii) the provisions of this Agreement. Contractor shall treat and maintain the Confidential Information as confidential and proprietary, including observing with respect thereto the same safeguards and protections that Contractor observes with respect to its own confidential or proprietary information and in all events at least reasonable care. Contractor shall not use Confidential Information for any purpose except for the limited purpose of performing its obligations under this Agreement, nor shall Contractor disclose Confidential Information to any Person without the prior written consent of Dartmouth except: (i) to its employees and permitted Subcontractors as necessary in connection with Contractor’s performance of its obligations under this Agreement, provided that Contractor has informed such employees and permitted Subcontractors of the requirements of this Section 9.2 and instructs them and ensures that they are obligated comply with these requirements, or (ii) when required to be disclosed by court rule or law, or when necessary to enforce Contractor’s rights hereunder, provided that in each such case under this clause (ii) Contractor gives Dartmouth prompt advance notice of any such requirement or planned disclosure and cooperates with Dartmouth in attempting to limit such


disclosure, including obtaining a protective order, as deemed appropriate by Dartmouth..

9.2.2 Exceptions to Confidentiality. The following information will not be considered Confidential Information under this Agreement: (i) information obtained by Contractor from a third party who is not under a confidentiality obligation to Dartmouth; (ii) information already in the possession of Contractor prior to receipt from Dartmouth, without any obligation of confidentiality and which can be verified through appropriate documentation; and (iii) information that is in the public domain through no fault or wrongful act of Contractor.

9.3 Injunctive Relief. Contractor acknowledges and agrees that a breach of Section 9.1 or 9.2.1 will cause irreparable damage to Dartmouth. Accordingly, Contractor agrees that in the event of any breach by Contractor of Section 9.1 or 9.2.1, in addition to any other remedy that may be available at law or in equity, Dartmouth will be entitled to immediate temporary, as well as preliminary and permanent injunctive relief without the requirement to post or obtain any bond, surety or security and without the necessity of having to establish the failure of legal remedies.

9.4 Obligations Upon Termination. Upon termination of this Agreement Contractor will, and will cause all Persons to whom it has disclosed Confidential Information to: (a) stop using all Confidential Information under their possession or control; (b) permanently and completely erase and destroy all such Confidential Information residing in any computer memory or data storage apparatus; and (c) at Dartmouth’s option, either destroy or return to Dartmouth all such Confidential Information that is in tangible form and all copies thereof. Any such destruction referenced herein will be undertaken according to industry recognized best practices for safe and thorough destruction and erasure, and upon request, be certified in writing to Dartmouth by an authorized officer of Contractor supervising such destruction.

10. Proprietary Rights.

10.1 Definitions. “Proprietary Rights” means all right, title, interests in, ownership, Intellectual Property Rights, rights of publicity and privacy, and other rights, of any kind and nature worldwide, including those arising under statutory and common law, and whether or not registered or perfected. “Intellectual Property Rights” means all intellectual property rights worldwide arising under statutory or common law, whether or not registered or perfected, including without limitation all (i) rights associated with works of authorship, including copyrights, copyright applications and copyright registrations, (ii) rights associated with indicia of source, including trademarks and service marks, trade names and trade dress, (iii) rights relating to patents and patent applications, (iv) rights relating to the protection of trade secrets, know-how and information that is confidential, and (iv) all registrations, applications, renewals, extensions, continuations, divisions, or reissues thereof and the like related to any of the foregoing, whether now existing or hereafter filed, issued or acquired.


10.2 Rights of the Parties. All Proprietary Rights held by each of the Parties prior to the commencement of the Agreement shall remain the sole property of such Party. All right, title and interest in and to any work product, including but not limited to designs, inventions, discoveries, products, computer programs, procedures, trade secrets, works of authorship and other proprietary information, Contractor makes, conceives or develops, alone or with others, arising directly from performance by Contractor of Services pursuant to the Agreement (“Work Product”), including the Proprietary Rights therein, shall belong exclusively to Dartmouth and shall be deemed to be a work made for hire. To the extent that sole title to any Work Product may not, by operation of law, vest with Dartmouth or such Work Product may not be considered works made for hire, Contractor hereby irrevocably transfers and assigns any and all of its right, title and interest in and to any and all such Work Product, including without limitation all Proprietary Rights therein and all causes of action for past infringement of such rights, to Dartmouth.

10.3 Contractor’s Undertakings. Contractor agrees to (i) disclose promptly in writing to Dartmouth all Work Product, (ii) cooperate and assist Dartmouth to apply for, and to execute any applications or assignments reasonably necessary to obtain, any patent, copyright, trademark or other statutory protection for any such Work Product in Dartmouth’s or its designee(s)’ name(s) as Dartmouth shall request from time to time, (iii) treat such Work Product as “Confidential Information” as defined in Section 9.2 above, and (iv) execute such documents and take such other actions as Dartmouth shall reasonably request from time to time to confirm, perfect and enforce its rights under this Section 10. Any cooperation or assistance Contractor provides pursuant to this Section 10 will be at Dartmouth’s sole expense. Contractor represents and warrants to Dartmouth that all Work Product created by Contractor, including any permitted Subcontractor, under the Agreement (i) does not and will not infringe any Proprietary Right of any Person or contain any libelous, unlawful or otherwise actionable matter, and (ii) is original and previously unpublished except for any third-party material that is either (x) in the public domain or (y) for which permission to use same in the Work Product, including without limitation without any restrictions on Dartmouth’s use of the Work Product, has been obtained.

11. Governing Law; Venue; Litigation Costs.

11.1 Governing Law; Venue and Consent to Jurisdiction. This Agreement will be governed by and construed in accordance with the laws of the State of New Hampshire. Contractor agrees that it shall not bring any suit against Dartmouth, its trustees, directors, owners, members, managers, trustees, officers, employees, representatives or agents with respect to this Agreement in any court other than a state or federal court of appropriate subject matter and venue located in the State of New Hampshire. Contractor consents to the exclusive personal jurisdiction of such courts in the event that Dartmouth shall bring any suit against Contractor with respect to this Agreement. The Parties agree that neither the United Nations Convention on Contracts for the International Sale of Goods nor any other laws pertaining to the contractual relations of the Parties will apply to this Agreement.


11.2 Attorneys’ Fees. In the event of litigation between the Parties arising from or related to this Agreement, the prevailing party shall be entitled to recovery of all reasonable costs and attorneys’ fees.

12. Miscellaneous

12.1 Cooperation by Dartmouth. Dartmouth shall provide Contractor such access to its information, property and personnel as may be reasonably required in order to permit Contractor to perform its obligations hereunder.

12.2 Right to Audit. Contractor shall maintain auditable records of all Goods and Services associated with this Agreement and will make such records available to Dartmouth upon request. The records must be kept for the balance of the calendar year in which they were made and for six (6) additional years thereafter.12.3 Employee Hiring and Non-Solicitation. The Parties acknowledge that each Party has invested substantial time and expense in recruiting, hiring, training and retaining the Party’s respective employees. The Parties agree not to hire any of the other Party’s employees or agents who are involved with the Services during the term of this Agreement and for twelve (12) months thereafter, without the other Party’s prior written consent, provided, that the foregoing shall not be deemed to prohibit a Party from interviewing, make an offer of employment or other engagement, or engaging or hiring, any person who responds to a general publicly available advertisement or solicitation initiated on or behalf of such Party, such as a website posting. For purposes of this Section 12.3 of the Agreement, “to hire” means to hire as an employee or otherwise engage or retain as an independent contractor or consultant. The Parties acknowledge each other’s investment of time and expense in hiring and training qualified employees and finding and utilizing qualified Subcontractors and regard this Section 12.3 as reasonable and necessary to protect such investment of time and money.

12.4 Assignment. Contractor shall neither assign nor transfer any rights or obligations under this Agreement without prior written approval from Dartmouth.

12.5 Subcontractors and Others. Contractor shall not subcontract any portion of the Services without prior written approval from Dartmouth. Contractor shall be responsible for compliance of each Subcontractor and employee, director, officer, member, manager, and owner of Contractor with all the terms of this Agreement, and Contractor shall not be relieved of any of its obligations as stated herein. Contractor shall be liable for the acts and/or omissions of each Subcontractor and employee, director, officer, member, manager, and owner of Contractor, that give rise to liability to Dartmouth and/or that constitute a breach of this Agreement by Contractor. As used in this Agreement the term “Subcontractor” means subcontractors, agents, consultants, and any other Person acting on behalf of or at the instruction of Contractor.


12.6 Notices. All notices or other communications required or permitted to be given hereunder shall be in writing and shall be deemed to have been delivered to a Party upon: (i) personal delivery to that Party; (ii) electronically confirmed delivery by facsimile to the telephone number provided by the Party for such purposes; (iii) electronic mail transmission to the electronic mailbox provided by the Party for such purposes; (iv) upon deposit for overnight delivery with a bonded courier holding itself out to the public as providing such services, with charges prepaid; or (v) four (4) business days following deposit with the United States Postal Service, postage prepaid, and in any case addressed to the Party’s address set forth below, or to any other address that the Party provides by notice, in accordance with this Section 12 to the other Party:

DARTMOUTH: CONTRACTOR:

ATTN: ATTN: Dartmouth College Procurement Services 7 Lebanon St, Suite 313 Hanover, NH 03755 Fax: (603) 646-3810 Fax: Email: [email protected]: :

with a copy to:

ATTN:__________________________Office of the General Counsel63 South Main Street, Suite 301Hanover, NH 03755Fax: 603-646-2447Email: [email protected]

12.7 Counterparts; Validity of Electronic Copies; Amendments; Waivers. This Agreement may be executed in counterparts, each of which will be deemed an original, but all of which together shall constitute one and the same instrument. An executed copy of this Agreement that is delivered by facsimile or other electronic means shall be sufficient to show execution and delivery thereof. This Agreement may be amended only by a written document signed by authorized representatives of the Parties. No waiver of any provision of this Agreement shall be valid or binding unless set forth in writing and duly executed by the Party against whom enforcement of the waiver is sought. No failure by a Party to exercise, and no delay by a Party in exercising, any right hereunder will operate as a waiver of such right, nor will any single or partial exercise by a Party of any right hereunder preclude any future exercise of that right, or any other right, by that Party.

12.8 Electronic Signatures. The parties recognize that various laws have been implemented in the United States and abroad to reduce legal challenges to electronic signatures, including without limitation, the Electronic Signatures in Global and National Commerce Act, the Personal Information Protection and


Electronic Documents Act, and legislation implementing EU Directive 199/93/EC, and locally in New Hampshire pursuant to NH RSA Chapter 294-E, Uniform Electronic Transactions Act. The parties acknowledge and agree that they may use and accept electronic signatures, and this Agreement may be executed using electronic signatures. Further, the parties agree that neither party shall raise a challenge that this Agreement is invalid or unenforceable solely because any electronic signature is not an advanced electronic signature due to the absence of a qualified certificate, or any other challenge under local law due to the use of electronic signatures. Such electronic execution and delivery shall be considered valid, binding and effective for all purposes.

12.9 Language. The parties agree that they will contract in the English language and that there shall be no requirement to translate this Agreement or any of the documents incorporated into this Agreement into any other language. In the event of any inconsistencies between any translations thereof into another language, the English language version shall govern.

12.10Interpretation.

12.10.1 This Agreement is the joint work product of representatives of each party. Accordingly, in the event of ambiguities in this Agreement, no inference will be drawn against either party, including the party that drafted this Agreement in its final form.

12.10.2 All exhibits hereto will be interpreted in a manner that favors consistency with the Master Terms. To the extent there are any inconsistencies between the Master Terms and any of the exhibits, the Master Terms will govern unless the Parties have explicitly agreed otherwise in writing; except that in all cases the provision(s) most protective of Dartmouth will apply. Any capitalized terms defined in Master Terms will have the same meaning in the exhibits and vice versa. Terms other than those defined in this Agreement or the applicable exhibits shall be given their plain English (or relevant alternative language, if in a language other than English) meaning and terms of art having a specialized meaning in the relevant industry shall be construed in accordance with industry standards. Unless the context otherwise requires, words importing the singular include the plural and vice-versa and words importing the masculine include the feminine and neuter and vice-versa. The term “including” means “including, but not limited to”. The terms “herein”, “hereunder”, “hereof” and similar expressions refer to the Agreement in its entirety. “Person” means any individual or entity, including unincorporated organizations, associations and partnerships. The terms “law” and “laws” means statutes, common law, regulations, rules, ordinances, treaties, and the like, and when referring to remedies includes both damages and equitable remedies. Except as otherwise specifically stated in this Agreement, “days” means calendar days.

12.11Binding Effect; No Third Party Beneficiaries. This Agreement shall be binding upon, and inure to the benefit of, the Parties and their respective successors and permitted assigns. Nothing in this Agreement is intended to confer on any Person, other than the Parties and their respective successors and permitted assigns, any rights hereunder.


12.12Severability. If any term or condition of this Agreement is determined to be invalid or unenforceable in whole or in part for any reason, this Agreement shall be reformed to be valid and enforceable consistent with the intention of the parties as expressed herein to the greatest extent permitted by law.

12.13Captions. The captions and headings used in this Agreement are for convenience only and do not limit or amplify the terms and provisions hereof.

12.14 Entire Agreement; Order of Precedence. This Agreement, including the Master Terms and all exhibits hereto, constitutes the entire agreement of the Parties, and supersedes any agreements, either oral or written, between the Parties hereto, with respect to the subject matter hereof. Each Party acknowledges that no representations, inducements, promises, or agreements, oral or otherwise, have been made by the other Party, or anyone acting on behalf of the other Party, that are not embodied herein, and that no other agreement, statement, or promise not contained in this Agreement shall be valid or binding. The terms of this Agreement take precedence over the terms of any Purchase Order or similar document issued by a Party, which may be accepted by the other Party for administrative convenience only.

[Signature page to follow.]


IN WITNESS WHEREOF, the Parties have caused this Agreement to be duly executed, effective as of the Effective Date.

TRUSTEES OF [_____________________________]DARTMOUTH COLLEGE

By: By: (signature) (signature)

(print name) (print name)

(title) (title)

(date) (date)


EXHIBIT D:VOLUNTARY PRODUCT ASSESSMENT TEMPLATE

Respondents must fill in the Voluntary Product Accessibility Template (VPAT) and include with the RFP response.

Section 1194.21 Software Applications and Operating Systems – Detail

VPATTM Voluntary Product Accessibility Template®

Criteria Supporting Features Remarks and explanations

(a) When software is designed to run on a system that has a keyboard, product functions shall be executable from a keyboard where the function itself or the result of performing a function can be discerned textually.

(b) Applications shall not disrupt or disable activated features of other products that are identified as accessibility features, where those features are developed and documented according to industry standards. Applications also shall not disrupt or disable activated features of any

Dartmouth CollegeRFP, Library Management System | P a g e 65

operating system that are identified as accessibility features where the application programming interface for those accessibility features has been documented by the manufacturer of the operating system and is available to the product developer.

(c) A well-defined on-screen indication of the current focus shall be provided that moves among interactive interface elements as the input focus changes. The focus shall be programmatically exposed so that Assistive Technology can track focus and focus changes.

(d) Sufficient information about a user interface element including the identity, operation and state of the element shall be available to Assistive Technology. When an image represents a program element, the information conveyed by the image must also be available in text.

(e) When bitmap images are used to


identify controls, status indicators or other programmatic elements, the meaning assigned to those images shall be consistent throughout an application's performance.

(f) Textual information shall be provided through operating system functions for displaying text. The minimum information that shall be made available is text content, text input caret location, and text attributes.

(g) Applications shall not override user selected contrast and color selections and other individual display attributes.

(h) When animation is displayed, the information shall be displayable in at least one non-animated presentation mode at the option of the user.

(i) Color coding shall not be used as the only means of conveying information, indicating an action, prompting a


response or distinguishing a visual element.

(j) When a product permits a user to adjust color and contrast settings, a variety of color selections capable of producing a range of contrast levels shall be provided.

(k) Software shall not use flashing or blinking text, objects, or other elements having a flash or blink frequency greater than 2 Hz and lower than 55 Hz.

(m) When a web page requires that an applet, plug-in or other application be present on the client system to interpret page content, the page must provide a link to a plug-in or applet that complies with §1194.21(a) through (l).

(n) When electronic forms are designed to be completed on-line, the form shall allow people using Assistive Technology to access the information, field elements and functionality required for completion and submission of the form, including all directions and cues.


(o) A method shall be provided that permits users to skip repetitive navigation links.

(p) When a timed response is required, the user shall be alerted and given sufficient time to indicate more time is required.

Note to 1194.22: The Board interprets paragraphs (a) through (k) of this section as consistent with the following priority 1 Checkpoints of the Web Content Accessibility Guidelines 1.0 (WCAG 1.0) (May 5 1999) published by the Web Accessibility Initiative of the World Wide Web Consortium: Paragraph (a) - 1.1, (b) - 1.4, (c) - 2.1, (d) - 6.1, (e) - 1.2, (f) - 9.1, (g) - 5.1, (h) - 5.2, (i) - 12.1, (j) - 7.1, (k) - 11.4.


EXHIBIT E:

Maintenance and Support 1. General provisions. As used in this Exhibit, the term “Provider” means vendor’s name and the term “Customer” means Licensee. Terms not defined in this Exhibit have the same definition as in the Agreement. Provider will, at no cost during the Term of the Agreement (a) ensure that the Application Service continues to perform in accordance with the Agreement and all Documentation (including all functional and technical specifications), (b) provide all Enhancements, and (c) provide to Customer maintenance and support as more fully described below. a. Unlimited 24/7 access to general online support at ______________________________. b. Technical support for the Software and Enhancements in multiple environments (e.g. production, test, development, etc.). c. Ability to submit and track support tickets in the Online Support Center. d. On-site support as required by Customer. e. Scheduled weekend or after hours support for planned upgrades/maintenance (one month advance notice to Customer is

required). f. Priority phone line with immediate access to second tier resources as needed. g. Access to all Enhancements that Provider makes to the Services and/or Software licensed to Customer. h. Invitations to special webinar previews of new product releases. i. Discounted registration to Provider’s seminars and other special offers.


2. Technical Support. a. Customer will have unlimited access to Provider’s technical support via e-mail (___________________), and telephone

(____________________) from 6:00 am to 6:00 pm Eastern Time Monday through Friday excluding standard U.S. federal holidays. If Customer’s issue is not resolved during a telephone call or email exchange, or if Customer chooses to do so immediately, it may submit an online support ticket through Provider’s Online Support Center. Provider will acknowledge receipt of the problem, issue a ticket number for tracking, correct all errors, bugs, deviations or failures in the performance of the Services and ensure that the Services continue to perform in accordance with the Specifications and the service levels set forth herein. Provider will respond to requests for technical support in accordance with the Response Table set forth below. The Provider technical support representative(s) will remain engaged with Customer (either on the phone, via e-mail or through Provider’s website, or on site) until the technical support issue is satisfactorily resolved, and will bring in members of Provider’s development team on an as-needed basis. Provider will resolve all technical support issues in accordance with the Response Table requirements. For each technical support issue submitted by Customer to Provider, Provider will maintain a record of such request and will report to Customer the status of such technical support issue until resolved. Provider will provide Customer with a unique ticket number for each such technical support request. Failure of Provider to abide any support or maintenance provision will constitute a material breach of this Agreement.

Response Table

Classification Failure Description ResponseCritical/Emergency Fatal, no useful work can be done. Respond within 1 hour, resolve within 2 hours;

resources will be dedicated until the issue is resolved.

Major/Urgent Severe impact, major functionality disabled. Errors cause intermittent system failure. Performance issues.

Respond within 2 hours; resolve within 12 hours; resources will be dedicated until the issue is resolved.

Important Normal operation is interrupted or delayed by software or system problems. Subscriber’s site is having



problems during a critical operation.Minor

Degraded operations/minimal impact. Errors causing malfunction of non-critical functionality.


3. Enhancements. “Enhancements” means all upgrades, modifications, patches, fixes, and the like necessary for the Services to remain current and to continue operating in accordance with the Agreement and all Specifications and at the service level requirements set forth in this Schedule, and all new versions and new releases pertaining to the Services. To the extent that Provider periodically makes available to its licensees Enhancements, Provider simultaneously will make such Enhancements available to Customer at no additional cost. Customer will have the right, in its sole discretion, to accept any Enhancement and to install, or have installed by Provider, such Enhancement on Customer’s computer system. The failure of Customer to include any Enhancement in its Software will not affect Provider’s Maintenance and Support obligations as set forth herein. Provider will provide to Customer, at no additional cost, an appropriate conversion utility for each Enhancement delivered hereunder if such conversion utility is required to migrate data and/or files in a format compatible with the new Enhancement. At the time of delivery of an Enhancement, Provider will prepare and deliver to Customer without additional cost any Documentation revisions, additions or updates necessitated by such Enhancement. All Enhancements will be deemed part of the Services, including all Software and/or Documentation, and will be maintained in accordance with the terms of the Agreement and this Maintenance and Support Schedule. 4. Availability of Services. a. Application service availability will be measured for each calendar month period.

i. The Application Services will be available to Customer and users a minimum of 99.9% of the time during any month.

ii. There will be no period of interruption in accessibility to the Services that exceeds two (2) continuous hours. The sole exception to subsection (i) and (ii) above is the following scheduled maintenance periods:


Day of Week Start Time End TimeSaturday 10:00 PM EST,

Saturday night4:00 AM EST,Sunday morning

Sunday 10:00 PM EST,Sunday night

3:00 AM EST,Monday morning

b. Response Time. The mean response time for user access to and from Provider’s website will not exceed more than one (1) second during any one (1) hour period. c. Bandwidth. Provider’s bandwidth for each of Provider’s internet connections will operate at no more than sixty percent (60%) capacity in any one hour period. d. Inapplicability of Force Majeure. The standards set forth in this Schedule apply regardless of the cause of the interruption in Software Services, even if the interruption is beyond the control of Provider. e. Service Performance Metrics. On the first day of every month, and at any other time as reasonably requested by Customer, Provider at its expense will deliver to Customer in electronic form the service level metrics identified in this Schedule for the previous calendar month period. f. Root-Cause Analysis. Upon a service level set forth in Section 4 not meeting the acceptable threshold values, Provider will (i) perform a root-cause analysis to identify the cause, (ii) provide Customer with a written report detailing the cause and procedure for correcting such issues, and (iii) provide Customer with written confirmation and assurance reasonably satisfactory to Customer that such issues have been corrected and will not re-occur. 5. Service Credits. In addition to any other remedy available to it as set forth in Section 6, Customer will be entitled to a credit against the next payable fee due to Provider (or if no fee is due and owing, then to a refund) as follows: a. For any breach of Section 4(a)(i), in accordance with the credit provisions set forth below:


Uptime Level Available CreditOver 99.5% but under 99.9%Over 99.0 % but under 99.5%Over 98.5% but under 99.0%Over 98.0% but under 98.5%Under 98%

Credit equal to 1% of annual license feeCredit equal to 2% of annual license feeCredit equal to 3% of annual license feeCredit equal to 4% of annual license feeCredit equal to 5% of annual license fee

b. For any breach of Section 4(a)(ii), in accordance with the credit provisions set forth below:

Uptime Level Available CreditOver 2 hrs. but under 2.25 hrs.Over 2.25 hrs. but under 2.5 hrs.Over 2.5 hrs. but under 2.75 hrs.Over 2.75 hrs. but under 3.0 hrs. Over 3.0 hrs.

Credit equal to 1% of annual license feeCredit equal to 2% of annual license feeCredit equal to 3% of annual license feeCredit equal to 4% of annual license feeCredit equal to 5% of annual license fee

c. These credits under Sections 5(a) and 5(b) are cumulative. The credits will not apply to the extent that the failure to achieve the respective service levels is due to (i) scheduled maintenance and system upgrades, or (ii) Customer’ documented misuse of the Services. 6. Other Remedies. In addition to any other remedy available to it under the Agreement (including this Schedule), under the law, and/or in equity, Customer may immediately terminate the Agreement without a further cure period if: (a) any breach of this Schedule is not cured within the lesser of the next measurable period (only if applicable) or five (5) business days, (b) there are breaches of this Schedule in consecutive months, or (c) there are breaches of this schedule in any three (3) nonconsecutive months within any six (6) month period.


EXHIBIT F:DARTMOUTH COLLEGE

INFORMATION TECHNOLOGY RISKADDITIONAL INSURANCE REQUIREMENTS

(Exhibit B to the MSA)

1. In addition to the insurance coverage requirements set out in Section 6.1 of the Agreement, contractor shall maintain the following:

Cyber Liability/Network & Information Security Liability

Cyber Liability/Network & Information Security Liability with aggregate minimum liability coverage limits of at least $5,000,000 covering at least claims involving privacy violations, information theft, damage to or destruction of electronic information, intentional or unintentional release of private information, alteration of electronic information, extortion and network security.


Exhibit GVENDOR SECURITY SELF-ASSESSMENT

(Exhibit C to the MSA)

Dartmouth Control #

Control ObjectiveISO #

HIPAA

PCI

MA Data Privacy

enter VENDOR name:

DATA PROTECTION & PRIVACY OF PERSONAL INFORMATION

Enter Vendor Responses below

6.3 Proper authorization, documented via signed data use agreement or legal contract, must be obtained for disclosure of patient and/or employee health information and other private records such as payroll, address, benefits, and alumni data, etc. Third parties receiving such data must meet DISC security controls per this checklist. x x


6.8

All computers used to manage confidential Dartmouth information, including PII, PHI, PCI information must have password-protected screensavers, with timeout set to 15 mins or less.

11.5.5 x x x

6.10. The doors to offices housing confidential information must be locked when employees not present. Secure confidential data in locked file cabinets, desk drawers, or other containers which can be locked.

7.2.2 x

6.15 Confidential information must not be left unattended in public areas. All business documents must be removed from conference rooms, and white/black boards erased, immediately after meetings are concluded.

11.3.3

6.17 Confidential information can only be accessed by those individuals who are required to maintain, process or administer such data as part of their job.

11.1.1 x

6.25 Dartmouth confidential data may not be downloaded to local disc drives or

12.3.1

x x x


removable media unless said disc drives/media are protected by encryption.

6.28 Systems processing credit card data must be certified as PCI-compliant. Such systems, which store, process, or transmit credit card data must meet all PCI DSS requirements.

6.2.3 x

CORRECT PROCESSING IN APPLICATIONS USED FOR DARTMOUTH DATA

7.1

Restrict access to source code and development libraries to authorized programmers and management.

12.4.3 x x

7.2

All applications and systems must be tested prior to deployment to ensure that security features and functions meet or exceed the security requirements established by the approved system design.

12.2.1 x

7.4 Delete, replace, encrypt, or mask all production, personally identifiable, or financially sensitive data used for testing and development. Where this is not practical, access to test data must be

12.4.2

x x x


strictly controlled, including tamper-proof logging of all transactions associated with the userID, and a documented process for permanent deletion of the test data (simple deletion of files containing test data is insufficient to meet this control).

7.6

Verify that changes to a system or application comply with regulatory requirements

12.2.1 x

7.8

Input data validation: Data input in applications must be validated to ensure that the data is correct and appropriate.

12.2.1 x

7.9

Control of internal processing: Validation checks must be incorporated into applications to detect the corruption of information through processing errors or deliberate acts. Control includes: (a) use of both automatic and manual methods of data verification and cross-checking, as appropriate; and (b) defined responsibilities and processes for responding to detected errors.

12.2.2

7.10. Data integrity: Requirements for ensuring 12.2.3


authenticity and protecting data integrity in applications must be identified, and appropriate controls identified and implemented.

7.11

Output data validation: Data output from applications must be validated to ensure that the processing of stored information is correct and appropriate to the circumstances. Control includes: (a) use of both automatic and manual methods of data verification and cross-checking, as appropriate; and (b) defined responsibilities and processes for responding to detected errors.

12.2.4

7.12

Control of Operational Software (Software configuration management) All changes to software must be authorized, controlled, and tracked. Configuration management practices must include revision control and the establishment of baselines

12.4.1 x

TECHNICAL VULNERABILITY MANAGEMENT


8.1

Timely information about technical vulnerabilities of information systems used by the organization should be obtained, evaluated in terms of organizational exposure and risk, and appropriate countermeasures taken. Control includes: implementing vulnerability mitigation, including deployment of security patches, according to the following risk schedule: High – As soon as possible but within 1 week. Medium – Within 2 weeks. Low – Within 1 month

12.6.1 x x x

8.4Conduct internal and external network vulnerability scans quarterly

15.2.2 x

8.5Conduct internal and external penetration test once per year

15.2.2 x

MANAGEMENT OF INFORMATION SECURITY INCIDENTS

9.1 Establish management responsibilities and procedures to ensure a quick, effective and orderly response to information security incidents. This process must be tested at

13.2.1

x x x


least annually, if not used for an actual incident during that timeframe. Process must contain (a) procedures to contain and remediate the effects of the incident, including emergency action to protect network assets; (b) communication procedures to provide information about the incident to Dartmouth and to those actually or potentially affected by the incident. Dartmouth must be notified of a security incident within 24 hours of the initial discovery of the incident.

ACCESS CONTROL

11.15

Initial Passwords in Operating Systems and applications must be changed from the default values.

11.2.3 x

11.20.Access controls must be periodically reviewed, at least once per year.

11.2.4

11.21

Access to systems processing Dartmouth data must default to "deny all" access and granting of "least privilege."

11.2.2 x x x

11.22 The access control procedure for vendor's user registration and de-registration (to vendor's own systems with access to

11.2.1

x x x


Dartmouth data) must include: a) using unique user IDs to enable users to be linked to and held responsible for their actions; the use of group IDs must only be permitted where they are necessary for business or operational reasons, and must be approved and documented;b) checking that the user has authorization from the system owner for the use of the information system or service; separate approval for access rights from management may also be appropriate;c) checking that the level of access granted is appropriate to the business purposeand is consistent with organizational security policy, e.g. it does not compromisesegregation of duties;d) giving users a written statement of their access rights;e) requiring users to sign statements indicating that they understand the conditions of access;f) ensuring service providers do not provide access until authorization procedures have beencompleted;g) maintaining a formal record of all persons registered to use the service;h) immediately removing or blocking access rights of users who have changed roles or jobs


or left the organization;i) periodically checking for, and removing or blocking, redundant user IDs and accountsj) ensuring that redundant user IDs are not issued to other users.k) inactive accounts must be disabled at 90 days of inactivityl) requiring enhanced authentication for non-electronic transactions (e.g. call center to obtain information or reset password). Multiple items from a personal profile on record are required. SSN is not allowed as a sole credential.

11.24 Vendor's User Password Management a) Vendor's Employee/contractor users must be required to sign a statement to keep personal passwords confidential and to keep group passwords solely within the members of the group; this signed statement could be included in the terms and conditions of employmentb) when users are required to maintain their own passwords they must be provided initially with a secure temporary password, which they are forced to change immediately;

11.2.3

x x x


c) establish procedures to verify the identity of a user prior to providing a new, replacement or temporary password;d) temporary passwords must be given to users in a secure manner; the use of third parties or unprotected (clear text) electronic mail messages must be avoided;e) temporary passwords must be unique to an individual and must not be guessable;f) Users and systems administrators must take steps to ensure that they never store passwords unencrypted on computer systems and that all systems encrypt the passwords in transmission or don't transmit passwords at all (e.g. asymmetric key encryption).g) passwords must not be embedded in any automated logon process or stored within a macro or function key that bypasses initial authentication.

11.25 The review of vendor's user access rights must adhere to the following guidelines: a) users’ access rights must be reviewed at

11.2.4

x x x


regular intervals, e.g. a period of 6 months, and after any changes, such as promotion, demotion, or termination of employmentb) user access rights must be reviewed and re-allocated when moving from one employment to another within the same organization;c) authorizations for special privileged access rights must be reviewed at more frequent intervals, e.g. at a period of 3 months;d) privilege allocations must be checked at regular intervals to ensure that unauthorized privileges have not been obtained;e) changes to privileged accounts must be logged for periodic review.

11.26 Unattended user equipment: a) terminate active sessions when finished, unless they can be secured by an appropriate locking mechanism, e.g. a password protected screen saver with inactivity timeout of 15

11.3.2

x x


mins or less; b) log-off mainframe computers, servers, and office PCs when the session is finishedc) Applications must end an active session due to inactivity of 1 hour

11.28

User authentication for external connections: Appropriate authentication methods must be used to control access by vendor's remote users. Remote access by vendor's highly privileged users (e.g. system administrators, DBAs, network engineers, etc) to systems processing Dartmouth information requires strong authentication (e.g. two-factor authentication) and VPN access.

11.4.2 x x x

11.29

Mobile Computing and communications for vendor's users accessing Dartmouth data: All mobile computing devices (laptops, notebook computers, PDAs, smartphones) must be password protected and encrypted. Removable media (CDs, DVDs, thumb drives, etc) containing confidential data must be password protected and encrypted

11.7.1 x x


11.30.

After more than 6 unsuccessful login attempts, the account must be automatically locked for at least 30 minutes or until identity is confirmed

11.5.1 x x

PHYSICAL SECURITY

14.1

Security perimeters (barriers such as walls, card controlled entry gates or manned reception desks) must be used to protect areas that contain Dartmouth information and information processing facilities.

9.1.1 x

14.4

Suitable intruder detection systems must be installed to national, regional orinternational standards and regularly tested to cover all external doors and accessiblewindows; unoccupied areas must be alarmed at all times;

9.1.1

14.5

Secure areas must be protected by appropriate entry controls to ensure that only authorized personnel are allowed access.

9.1.2 x x

14.6 The date and time of entry and departure of visitors must be recorded, and all visitors

9.1.2

x


must be supervised unless their access has been previously approved;

NETWORK CONTROLS

15.9

Appropriate logging and monitoring must be applied to enable recording of security relevant actions. At a minimum, system logs should include userID, date and time of the action, and description of the action.

10.6.1 x x

15.12

Access to confidential data systems, must be controlled by strong (something you know + something you have, e.g. userID + password + physical token or digital certificate), or enhanced authentication (userID + password + shared secret, e.g. security question & answer) x x x

15.17

All wireless devices containing Dartmouth data, including laptops and PDAs/Smartphones, must have inactivity timeout of 15 mins or less and require password at power up.

11.5.5 x x

15.18Anti- virus defenses must be in place at internet gateways (mail servers, etc)

10.6.2 x

15.19 The internal network addressing scheme 11.4


for critical systems must not be visible via external connections, i.e., NAT addressing must be used for these systems. .7

15.20.

Appropriate intrusion detection and prevention systems must be in place to monitor and defend the network from intrusion

10.10.2 x x

15.21

Network segments housing critical applications must be protected by intrusion prevention systems. Use of host based IPS in lieu of protecting the entire segment is acceptable.

10.10.2

15.22

Vulnerable services on any device connected to the network must be turned off by default, and only enabled if protected by a compensating control.

12.6.1

15.23

Authentication credentials and other central directory attributes must be secure from unauthorized access. Third-party sites accessing Dartmouth central directory attributes must utilize secure authentication methods approved by Dartmouth College.

11.5.4


15.25

Devices which attach to the network must initially be installed with vendor defined defaults turned 'off', and only the necessary and secure services enabled as required.

12.6.1 x

15.26

Protect critical and highly confidential data via firewall protected subnets or other technology creating security zones.

11.4.5 x x

15.27

Firewall, router, switch configurations must be tested, approved, and documented. Rules and settings must be reviewed every 6 months.

11.4.6 x

15.28

Prohibit direct public access to critical and highly confidential systems processing Dartmouth data

10.6.1 x

15.29

Remote administrative access to systems containing or processing Dartmouth data must use encryption and strong authentication

11.7.1 x x

15.30.

Dartmouth confidential data traversing untrusted networks, including email, must be encrypted

12.3.1 x x x

15.31 All devices connected to the vendor's 10.7 x x


network must have up to date Anti Virus software, personal firewall, and up to date security patches .1

15.33

Media containing Darmouth data must be disposed of securely and safely when no longer required, using formal procedures. Media containing sensitive information must be stored and disposed of securely and safely, e.g. by incineration or shredding, or erased of data for use by another application within the organization; erased data must be unrecoverable

10.7.2 x x

15.36

Audit logs recording user activities, exceptions, and information security events must be produced and kept for 1 year to assist in future investigations and access control monitoring.

10.10.1 x x

15.39

The clocks of all relevant information processing systems within an organization or security domain must be synchronized with an agreed accurate time source.

10.10.6 x

DOCUMENTS and MEDIA


16.6

When no longer required, Dartmouth confidential documents must be shredded, not recycled. Dartmouth information contained on other media must be erased/overwritten/destroyed, to render the data unrecoverable.

7.2.2 x

END OF RFP
