State of Colorado Purchase Order Terms and Conditions

Effective Date: 3/21/2025

Purchase Order Terms and Conditions

Section 1: Offer/Acceptance.

This Purchase Order, together with these terms and conditions (including, if applicable, Addendum 1: Additional Terms and Conditions for Information Technology, and Addendum 2: Additional Terms and Conditions for Federal Provisions, below), and any other attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference (collectively the “PO”) shall represent the entire and exclusive agreement between the State and the Vendor. If this PO refers to Vendor’s bid or proposal, this PO is an ACCEPTANCE of Vendor’s OFFER TO SELL in accordance with the terms and conditions of this PO. If a bid or proposal is not referenced, this PO is an OFFER TO BUY, subject to Vendor’s acceptance, demonstrated by Vendor’s performance or written acceptance of this PO. Any COUNTER-OFFER TO SELL automatically CANCELS this PO, unless a change order accepting the counter-offer is issued in accordance with §4 accepting a counter-offer. The State shall not be responsible or liable for goods or services delivered or performed prior to issuance of this PO.

Section 2: Order of Precedence.

In the event of a conflict or inconsistency within this PO, such conflict or inconsistency shall be resolved by giving preference to the documents in the following order of priority:

If applicable, Addendum 2: Additional Terms and Conditions for Federal Provisions, below;
the Purchase Order document;
these Terms and Conditions (including, if applicable, Addendum 1: Additional Terms and Conditions for Information Technology below); and
any attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference.
Any terms and conditions included on Vendor’s forms or invoices not included in this PO are void.

Any terms and conditions included on Vendor's forms or invoices not included in this PO are void.

Section 3: Safety Information.

All chemicals, equipment, and materials proposed or used in the performance of this PO shall conform to the requirements of the Occupational Safety and Health Act of 1970. Vendor shall furnish all Material Safety Data Sheets (MSDS) for any regulated chemicals, equipment, or hazardous materials at the time of delivery.

Section 4: Changes.

Vendor shall furnish goods or services in strict accordance with the specifications and price set forth for each item. This PO shall not be modified, superseded or otherwise altered, except in writing signed by the State and accepted by Vendor. If this PO is for goods only and Vendor has not delivered the goods prior to the expiration of this PO, but Vendor delivers all of the goods to the State only after expiration of this PO, then the State, in its sole discretion, may accept the goods under this PO by extending this PO and delivering the modification to Vendor; however, regardless of anything to the contrary, if the State does not extend this PO for any reason then the goods delivered after expiration of this PO shall be deemed rejected, Vendor shall arrange the return of all delivered goods at Vendor’s sole expense, and the State shall have no liability for any such goods.

Section 5: Delivery.

Unless otherwise specified in this PO, delivery shall be FOB destination, freight prepaid and allowed. The State is relying on the promised delivery date and any installation or service performance set forth in this PO as material and basic to the State’s acceptance. If Vendor fails to deliver or perform as and when promised, the State, in its sole discretion, may cancel its order, or any part thereof, without prejudice to its other rights, return all or part of any shipment so made, and charge Vendor with any loss or expense sustained as a result of such failure to deliver or perform as promised. Time is of the essence.

Section 6: Rights to Materials.

[Not Applicable to POs issued either in whole or in part for Information Technology, as defined in CRS § 24-37.5-102(2); which shall be governed by Addendum 1 §B.] Unless specifically stated otherwise in this PO, all materials, including without limitation supplies, equipment, documents, content, information, or other material of any type, whether tangible or intangible (collectively “Materials”), furnished by the State to Vendor or delivered by Vendor to the State in performance of its obligations under this PO shall be the exclusive property of the State. Vendor shall return or deliver all Materials to the State upon completion or termination of this PO.

Section 7: Reporting.

If Vendor is served with a pleading or other document in connection with an action before a court or other administrative decision-making body, and such pleading or document relates to this PO or may affect Vendor’s ability to perform its obligations under this PO, Vendor shall, within 10 days after being served, notify the State of such action and deliver copies of such pleading or document to the State. Vendor shall disclose, in a timely manner, in writing to the State all violations of federal or state criminal law involving fraud, bribery, or gratuity violations potentially affecting this PO. The State may impose any remedies available, which may include, without limitation, suspension or debarment.

Section 8: Conflicts of Interest.

Vendor acknowledges that with respect to this PO, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Vendor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Vendor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Vendor is uncertain as to such, Vendor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction with respect to the actual or apparent conflict constitutes a breach of this PO. Vendor acknowledges that all State employees are subject to the ethical principles described in §24-18-105, C.R.S. Vendor further acknowledges that State employees may be subject to the requirements of §24-18-105, C.R.S. with regard to this PO.

Section 9: Warranties.

All provisions and remedies of the Colorado Uniform Commercial Code, CRS, Title 4 (“UCC”), relating to implied or express warranties for goods are incorporated herein, in addition to any warranties contained in this PO.

Section 10: Inspection and Acceptance.

The State’s final acceptance of goods or services is contingent upon completion of all applicable inspection procedures. All goods delivered shall be newly manufactured and the current model, unless otherwise specified. The State shall have the right to inspect goods or services provided under this PO at all reasonable times and places. The State shall be the sole judge in determining “equals” with regard to conformance with the specifications outlined in this PO for quality, price, and performance. If any of the goods or services do not conform to this PO, the State, at its sole discretion, may require Vendor to either:

replace the goods specified by the State or
perform the services again, without additional payment from the State.

When defects in the quality or quantity of goods or services cannot be corrected by replacement or re-performance, the State may:

require Vendor to take necessary action to ensure that future performance conforms to this PO and
equitably reduce the payment due Vendor to reflect the reduced value of the goods or services performed.

These remedies do not limit the remedies otherwise available in this PO, at law, or in equity.

Section 11: Taxes.

The State is exempt from federal excise taxes and from State and local sales and use taxes.

Section 12: Payment.

The State shall not pay Vendor any amount for performance under this PO in excess of the Document Total set forth on the Purchase Order document. The State shall pay Vendor for all amounts due within 45 days after the State’s receipt of goods or services and acceptance of a correct invoice of amount due. Amounts not paid by the State within 45 days of the State’s acceptance of the invoice shall bear interest on the unpaid balance beginning on the 45th day at the rate set forth in CRS §24-30-202(24) until paid in full. Interest shall not accrue if a good faith dispute exists as to the State’s obligation to pay all or a portion of the amount due. Vendor shall invoice the State separately for interest on delinquent amounts due, referencing the delinquent payment, number of day’s interest to be paid, and applicable interest rate. The State may benefit from any early payment discount offered by Vendor by making payment within the timeframes required by Vendor to be eligible for such discount. If Vendor offers an early payment discount, then the discount shall be shown on Vendor’s invoices to the State, and if the State makes payment on the invoice within the time frame for the discount, Vendor shall either:

accept the payment amount less the appropriate discount or
refund the discount back to the State.

Except as specifically agreed in this PO, Vendor shall be solely responsible for all costs, expenses, and other charges it incurs in connection with its performance under this PO.

Section 13: Assignment.

Vendor’s rights and obligations under this PO shall not be transferred or assigned without the prior, written consent of the State and execution of a new PO. Any attempt at assignment or transfer without such consent and new PO shall be void. Any new PO approved by the State shall be subject to the same terms and conditions as those set forth in this PO.

Section 14: Subcontracts.

Unless otherwise specified in this PO, Vendor shall not enter into any subcontract in connection with its obligations under this PO without the prior, written approval of the State. Vendor shall submit to the State a copy of each such subcontract upon request by the State. All subcontracts entered into by Vendor in connection with this PO shall comply with all applicable federal and state laws and regulations, shall provide that they are governed by the laws of the State of Colorado, and shall be subject to all provisions of this PO.

Section 15: Severability.

The invalidity or unenforceability of any provision of this PO shall not affect the validity or enforceability of any other provision of this PO, which shall remain in full force and effect, provided, that the parties can continue to perform their obligations in accordance with the intent of this PO.

Section 16: Survival of Certain PO Terms.

Any provision of this PO that imposes an obligation on a party after termination or expiration of this PO shall survive the termination or expiration of this PO and shall be enforceable by the other party.

Section 17: Third Party Beneficiaries.

Except for the parties’ respective successors and assigns, this PO does not and is not intended to confer any rights or remedies upon any person or entity other than the parties. Enforcement of this PO and all rights and obligations hereunder is reserved solely to the parties. Any services or benefits which third parties receive as a result of this PO are incidental to this PO, and do not create any rights for such third parties.

Section 18: Waiver.

A party’s failure or delay in exercising any right, power, or privilege under this PO, whether explicit or by lack of enforcement, shall not operate as a waiver, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise of such right, power, or privilege.

Section 19: Indemnification. [Not Applicable to Inter-governmental POs]

Vendor shall indemnify, save, and hold harmless the State, its employees, agents and assignees (the “Indemnified Parties”), against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the Indemnified Parties in relation to any act or omission by Vendor, or its employees, agents, subcontractors, or assignees in connection with this PO. This shall include, without limitation, any and all costs, expenses, claims, damages, liabilities, court awards and other amounts incurred by the Indemnified Parties in relation to any claim that any work infringes a patent, copyright, trademark, trade secret, or any other intellectual property right or any claim for loss or improper disclosure of any confidential information or personally identifiable information.

Section 20: Notice.

All notices given under this PO shall be in writing, and shall be delivered to the contacts for each party listed on the Purchase Order document. Either party may change its contact or contact information by notice submitted in writing to the other party without a formal modification to this PO.

Section 21: Insurance.

Except as otherwise specifically stated in this PO, Vendor shall obtain and maintain insurance as specified in this section at all times during the term of this PO:

workers’ compensation insurance as required by state statute, and employers’ liability insurance covering all Vendor employees acting within the course and scope of their employment;
Commercial general liability insurance written on an Insurance Services Office occurrence form, covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: $1,000,000 each occurrence; $1,000,000 general aggregate; $1,000,000 products and completed operations aggregate; and $50,000 any one fire; and
Automobile liability insurance covering any auto (including owned, hired and non-owned autos) with a minimum limit of $1,000,000 each accident combined single limit. If Vendor will or may have access to any protected information, then Vendor shall also obtain and maintain insurance covering loss and disclosure of protected information and claims based on alleged violations of privacy right through improper use and disclosure of protected information with limits of $1,000,000 each occurrence and $1,000,000 general aggregate at all times during the term of this PO. Additional insurance may be required as provided elsewhere in this PO. All insurance policies required by this PO shall be issued by insurance companies with an AM Best rating of A-VIII or better. This insurance requirement shall not apply if this PO is solely for goods, as determined by the State, unless specifically stated otherwise in this PO or any attachment or exhibit to this PO. If Vendor is a public agency within the meaning of the Colorado Governmental Immunity Act, then this section shall not apply and Vendor shall instead comply with the Colorado Governmental Immunity Act. The State shall be named as additional insured on all commercial general liability policies required of Vendor. All insurance policies secured or maintained by Vendor in relation to this Purchase Order shall include clauses stating that each carrier shall waive all rights of recovery under subrogation or otherwise against Vendor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers.

Section 22: Termination Prior to Vendor Acceptance.

If Vendor has not begun performance under this PO, the State may cancel this PO by providing written notice to the Vendor.

Section 23: Termination for Cause.

If Vendor refuses or fails to timely and properly perform any of its obligations under this PO with such diligence as will ensure its completion within the time specified in this PO, the State may notify Vendor in writing of non-performance and, if not corrected by Vendor within the time specified in the notice, terminate Vendor’s right to proceed with this PO or such part thereof as to which there has been delay or a failure. Vendor shall continue performance of this PO to the extent not terminated.
Vendor shall be liable for excess costs incurred by the State in procuring similar goods or services and the State may withhold such amounts as the State deems necessary.
If after rejection, revocation, or other termination of Vendor’s right to proceed under the UCC or this clause, the State determines for any reason that Vendor was not in default or the delay was excusable, the rights and obligations of the State and Vendor shall be the same as if the notice of termination had been issued pursuant to termination under §24.

Section 24: Termination in Public Interest.

The State is entering into this PO for the purpose of carrying out the public interest of the State, as determined by its Governor, General Assembly, or Courts. If this PO ceases to further the public interest of the State as determined by its Governor, General Assembly, or Courts, the State, in its sole discretion, may terminate this PO in whole or in part and such termination shall not be deemed to be a breach of the State’s obligations hereunder. This section shall not apply to a termination for cause, which shall be governed by §23. A determination that this PO should be terminated in the public interest shall not be equivalent to a State right to terminate for convenience. The State shall give written notice of termination to Vendor specifying the part of this PO terminated and when termination becomes effective. Upon receipt of notice of termination, Vendor shall not incur further obligations except as necessary to mitigate costs of performance. For services or specially manufactured goods, the State shall pay:

reasonable settlement expenses,
this PO price or rate for supplies and services delivered and accepted,
reasonable costs of performance on unaccepted supplies and services, and
a reasonable profit for the unaccepted work.

For existing goods, the State shall pay:

reasonable settlement expenses,
the PO price for goods delivered and accepted,
reasonable costs incurred in preparation for delivery of the undelivered goods, and
a reasonable profit for the preparatory work.

The State’s termination liability under this section shall not exceed the total PO price. As a condition for payment under this section, Vendor shall submit a termination proposal and reasonable supporting documentation, and cost and pricing data as requested by the State.

Section 25: Funds Availability.

Financial obligations of the State payable after the State’s current fiscal year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available. If this PO is funded in whole or in part with federal funds, this PO is subject to and contingent upon the continuing availability of federal funds for the purposes hereof. The State represents that it has set aside sufficient funds to make payment for goods delivered in a single installment, in accordance with the terms of this PO.

Section 26: Governmental Immunity.

Liability for claims for injuries to persons or property arising from the negligence of the State, its departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the Colorado Governmental Immunity Act, CRS §24-10-101, et seq., the Federal Tort Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C. 1346(b), and the State’s risk management statutes, CRS §§24-30-1501, et seq. No term or condition of this PO shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, contained in these statutes.

Section 27: Independent Contractor.

Vendor shall perform its duties under this PO as an independent contractor and not as an employee. Neither Vendor nor any agent or employee of Vendor shall be deemed to be an agent or employee of the State. Vendor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Vendor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Vendor or any of its agents or employees. Vendor shall pay when due all applicable employment taxes, income taxes and local head taxes incurred pursuant to this PO. Vendor shall

provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law,
provide proof thereof when requested by the State, and
be solely responsible for its acts and those of its employees and agents.

Section 28: Compliance with Law.

Vendor shall comply with all applicable federal and state laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices.

Section 29: Choice of Law, Jurisdiction and Venue. [Not Applicable to Inter-governmental POs]

Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this PO. The UCC shall govern this PO in the case of goods unless otherwise agreed in this PO. Any provision included or incorporated herein by reference, which conflicts with said laws, rules, and regulations shall be null and void. All suits or actions related to this PO shall be filed and proceedings held in the State of Colorado and exclusive venue shall be in the City and County of Denver. Any provision incorporated herein by reference which purports to negate this or any other provision in this PO in whole or in part shall not be valid or enforceable or available in any action at law, whether by way of complaint, defense, or otherwise. Vendor shall exhaust administrative remedies in CRS §24-109-106, prior to commencing any judicial action against the State.

Section 30: Prohibited Terms.

Nothing in this PO shall be construed as a waiver of any provision of CRS §24-106-109. Any term included in this PO that requires the State to indemnify or hold Vendor harmless; requires the State to agree to binding arbitration; limits Vendor’s liability for damages resulting from death, bodily injury, or damage to tangible property; or that conflicts with that statute in any way shall be void ab initio.

Section 31: Vendor Offset and Erroneous Payments. [Not Applicable to Inter-governmental POs or to POs issued solely for goods]

The State Controller may withhold payment under the State’s Vendor offset intercept system for debts owed to State agencies for:

unpaid child support debts or child support arrearages;
unpaid balances of tax, accrued interest, or other charges specified in CRS §39-21-101, et seq.;
unpaid loans due to the Student Loan Division of the Department of Higher Education;
amounts required to be paid to the Unemployment Compensation Fund; and
other unpaid debts owing to the State as a result of final agency determination or judicial action.

The State may also recover, at the State's discretion, payments made to Vendor in error for any reason, including, but not limited to, overpayments or improper payments, and unexpected or excess funds received by Vendor by deduction from subsequent payments under this PO, deduction from any payment due under any other contracts, grants or agreements between the State and Vendor, or by any other appropriate method for collecting debts owed to the State.

ADDENDUM 1:
Additional Terms & Conditions for Information Technology

IF ANY PART OF THE SUBJECT MATTER OF THIS PO IS INFORMATION TECHNOLOGY, AS DEFINED INCRS § 24-37.5-102 (2), THE FOLLOWING PROVISIONS ALSO APPLY TO THIS PO.

Section 1: Definitions.

The following terms shall be construed and interpreted as follows:

“Business Day” means any day in which the State is open and conducting business, but shall not include Saturday, Sunday or any day on which the State observes one of the holidays listed in CRS §24-11-101(1);
“CJI” means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy, as amended, and all Criminal Justice Records as defined under CRS §24-72-302;
“HIPAA” means the federal Health Information Portability and Accountability Act
“Incident” means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, pursuant to CRS §§24-37.5-401 et seq.;
“PCI” means payment card information including any data related to credit card holders’ names, credit card numbers, or the other credit card information as may be protected by state or federal law;
“PHI” means any protected health information, including, without limitation any information whether oral or recorded in any form or medium that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual including, without limitation, any information defined as Individually Identifiable Health Information by HIPAA;
“PII” means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records, including, without limitation, all information defined as personally identifiable information in CRS §24-72-501. “PII” shall also mean “personal identifying information” as set forth at § 24-74-102, et. seq., C.R.S.;
“State Confidential Information” means any and all State Records not subject to disclosure under the Colorado Open Records Act, CRS §§24-72-200.1, et seq. (“CORA”), and includes, without limitation, PII, PHI, PCI, Tax Information, CJI, and State personnel records not subject to disclosure under CORA;
“State Records” means any and all State data, information, and records, regardless of physical form;
“Tax Information” means federal and State of Colorado tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation, including, without limitation all information defined as federal tax information in Internal Revenue Service Publication 1075; and
“Work Product” means the tangible and intangible results of the delivery of goods and performance of services, whether finished or unfinished, including drafts.

Section 2: Intellectual Property.

Except to the extent specifically provided elsewhere in this PO, any State information, including without limitation pre-existing State software, research, reports, studies, data, photographs, negatives or other documents, drawings, models, materials; or Work Product prepared by Vendor in the performance of its obligations under this PO shall be the exclusive property of the State (collectively, “State Materials”). Vendor shall deliver all State Materials to the State upon completion or termination of this PO. The State’s exclusive rights in any Work Product prepared by Vendor shall include, but not be limited to, the right to copy, publish, display, transfer, and prepare derivative works. Vendor shall not use, willingly allow, cause or permit any State Materials to be used for any purpose other than the performance of Vendor’s obligations hereunder without the prior written consent of the State. The State shall maintain complete and accurate records relating to:

its use of all Vendor and third party software licenses and rights to use any Vendor or third party software granted under this PO and its attachments to which the State is a party and
all amounts payable to Vendor pursuant to this PO and its attachments and the State’s obligations under this PO or to any amounts payable to Vendor in relation to this PO, which records shall contain sufficient information to permit Vendor to confirm the State’s compliance with the use restrictions and payment obligations under this PO or to any third-party use restrictions to which the State is a party.

Vendor retains the exclusive rights, title and ownership to any and all pre-existing materials owned by or licensed to Vendor including, but not limited to all pre-existing software, licensed products, associated source code, machine code, text images, audio, video, and third-party materials, delivered by Vendor under this PO, whether incorporated in a deliverable or necessary to use a deliverable (collectively, “Vendor Property”). Vendor Property shall be licensed to the State as set forth in a State-approved license agreement:

entered into as exhibits or attachments to this PO,
obtained by the State from the applicable third-party Vendor, or
in the case of open source software, the license terms set forth in the applicable open source license agreement.

Notwithstanding anything to the contrary herein, the State shall not be subject to any provision incorporated in any exhibit or attachment attached hereto, any provision incorporated in any terms and conditions appearing on any website, any provision incorporated into any click through or online agreements, or any provision incorporated into any other document or agreement between the parties that

requires the State to indemnify Vendor or any other party,
is in violation of State laws, regulations, rules, fiscal rules, policies, or other State requirements as deemed solely by the State, or
is contrary to this PO.

Section 3: License or Use Audit Rights.

If this PO includes any license or other right to use Vendor’s intellectual property, Vendor shall have the right, at any time during and throughout the term of this PO, but not more than once during any State fiscal year, to request via written notice in accordance with the notice provisions of this PO that the State audit its use of Vendor’s intellectual property and certify as to its compliance with any applicable license or use restrictions and limitations contained in this PO (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Vendor (“Audit Certification”) within 120 days following the State’s receipt of the Audit Request. If upon receipt of the State’s Audit Certification, the parties reasonably determine that:

the State’s use of licenses, use of software, use of programs, or any other use of intellectual property during the audit period exceeded the use restrictions and limitations contained in this PO (“Overuse”) and
the State would have been or is then required to purchase additional rights to use Vendor’s intellectual property (“Additional Rights”), Vendor shall provide written notice to the State in accordance with the notice provisions of this PO identifying any Overuse or required Additional Rights and request that the State bring its use into compliance with such use restrictions and limitations.

Notwithstanding anything to the contrary in this PO, or incorporated as a part of Vendor’s or any subcontractor’s website, click-through or online agreements, third-party agreements, or any other documents or agreements between the parties, the State shall not be liable for the costs associated with any Overuse or Additional Rights, during the audit period regardless of whether the State may have been notified in advance of such costs.

Section 4: Vendor Records.

Vendor shall maintain a file of all documents, records, communications, notes, and other materials relating to the work (the “Vendor Records”). Vendor Records shall include all documents, records, communications, notes and other materials maintained by Vendor that relate to any work performed by Subcontractors, and Vendor shall maintain all records related to the work performed by Subcontractors required to ensure proper performance of that work. Unless a longer period is required in this PO or any attachment or exhibit to this PO, Vendor shall maintain Vendor Records until the last to occur of:

the date 3 years after the date this Purchase Order expires or is terminated,
final payment under this Purchase Order is made,
the resolution of any pending Purchase Order matters, or
if an audit is occurring, or Vendor has received notice that an audit is pending, the date such audit is completed and its findings have been resolved (the “Record Retention Period”).

Vendor shall permit the State, the federal government, and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy, and transcribe Vendor Records during the Record Retention Period. Vendor shall make Vendor Records available during normal business hours at Vendor’s office or place of business, or at other mutually agreed upon times or locations, upon no fewer than 2 Business Days’ notice from the State, unless the State determines that a shorter period of notice, or no notice, is necessary to protect the interests of the State. The State, in its discretion, may monitor Vendor’s performance of its obligations under this Purchase Order using procedures as determined by the State. The State shall monitor Vendor’s performance in a manner that does not unduly interfere with Vendor’s performance of the work. Vendor shall promptly submit to the State a copy of any final audit report of an audit performed on Vendor’s records that relates to or affects this Purchase Order or the work, whether the audit is conducted by Vendor or a third party.

Section 5: Information Confidentiality.

Vendor shall keep confidential, and cause all subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Vendor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this PO, permitted by law, or approved in writing by the State. Vendor shall provide for the security of all State Confidential Information in accordance with all applicable laws, rules, policies, publications, and guidelines. If Vendor or any of its subcontractors will or may have access to any State Confidential Information or any other protected information, Vendor shall comply with all Colorado Office of Information Security (OIS) policies and procedures which OIS has issued pursuant to CRS §§24-37.5-401 through 406, and 8 CCR §1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies, all information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to Vendor’s performance under this PO. Such obligations may arise from HIPAA; IRS Publication 1075; Payment Card Industry Data Security Standard (PCI-DSS); Federal Bureau of Investigation Criminal Justice Information Service Security Addendum; Centers for Medicare & Medicaid Services (CMS) Minimum Acceptable Risk Standards for Exchanges; and Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information With The Social Security Administration. Vendor shall immediately forward any request or demand for State Records to the State’s purchasing agent.

Section 6: Other Entity Access and Nondisclosure Agreements.

Vendor may provide State Records to its agents, employees, assigns and subcontractors as necessary to perform the work, but shall restrict access to State Confidential Information to those agents, employees, assigns, and subcontractors who require access to perform their obligations under this PO. Vendor shall ensure all such agents, employees, assigns, and subcontractors sign agreements containing nondisclosure provisions at least as protective as those in this PO, and that the nondisclosure provisions are in force at all times the agent, employee, assign or subcontractor has access to any State Confidential Information. Vendor shall provide copies of those signed nondisclosure provisions to the State upon execution of the nondisclosure provisions if requested by the State.

Section 7: Use, Security, and Retention.

Vendor shall use, hold, and maintain State Confidential Information in compliance with all applicable laws and regulations only in facilities located within the United States, and shall maintain a secure environment that ensures confidentiality of all State Confidential Information. Vendor shall provide the State with access, subject to Vendor’s reasonable security requirements, for purposes of inspecting and monitoring access and use of State Confidential Information and evaluating security control effectiveness. Upon the expiration or termination of this PO, Vendor shall return State Records provided to Vendor or destroy such State Records and certify to the State that it has done so, as directed by the State. If Vendor is prevented by law or regulation from returning or destroying State Confidential Information, Vendor warrants it will guarantee the confidentiality of, and cease to use, such State Confidential Information.

Section 8: Incident Notice and Remediation.

If Vendor becomes aware of any Incident, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Vendor can establish none of Vendor or any of its agents, employees, assigns, or subcontractors are the cause or source of the Incident, Vendor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Vendor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State at no additional cost to the State. The State may adjust or direct modifications to this plan, in its sole discretion and Vendor shall make all modifications as directed by the State. If Vendor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Vendor shall reimburse the State for the reasonable actual costs thereof.

Section 9: Data Protection and Handling.

Vendor shall ensure that all State Records and Work Product in the possession of Vendor or any subcontractors are protected and handled in accordance with the requirements of this PO at all times. Upon request by the State made any time prior to 60 days following the termination of this PO for any reason, whether or not this PO is expiring or terminating, Vendor shall make available to the State a complete and secure download file of all data that is encrypted and appropriately authenticated. This download file shall be made available to the State within 10 Business Days following the State’s request, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions, and attachments in its native format. Upon the termination of Vendor’s services under this PO, Vendor shall, as directed by the State, return all State Records provided by the State to Vendor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If legal obligations imposed upon Vendor prevent Vendor from returning or destroying all or part of the State Records provided by the State, Vendor shall guarantee the confidentiality of all State Records in Vendor’s possession and will not actively process such data. The State retains the right to use the established operational services to access and retrieve State Records stored on Vendor’s infrastructure at its sole discretion and at any time.

Section 10: Compliance with OIS Policies and Procedure.

Vendor shall review, on a semi-annual basis, all Colorado Office of Information Security (“OIS”) policies and procedures which OIS has promulgated pursuant to CRS §§ 24-37.5-401 through 406 and 8 CCR § 1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies, to ensure compliance with the standards and guidelines published therein. Vendor shall cooperate, and shall cause its subcontractors to cooperate, with the performance of security audit and penetration tests by OIS or its designee.

Section 11: Safeguarding PII.

If Vendor or any of its subcontractors will or may receive PII under this PO, Vendor shall provide for the security of such PII, in a manner and form acceptable to the State, including, without limitation, all State requirements relating to non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Vendor shall be a “Third-Party Service Provider” as defined in CRS §24-73-103(1)(i) and shall maintain security procedures and practices consistent with CRS §§24-73-101. In addition, as set forth in § 24-74-102, et. seq., C.R.S., Contractor, including, but not limited to, Contractor’s employees, agents and Subcontractors, agrees not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Contractor is given direct access to any State databases containing PII, Contractor shall execute, on behalf of itself and its employees, the certification PII Individual Certification Form or PII Entity Certification Form [Download form from Hyperlink] on an annual basis and Contractor’s duty and obligation to certify shall continue as long as Contractor has direct access to any State databases containing PII. If Contractor uses any Subcontractors to perform services requiring direct access to State databases containing PII, the Contractor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII.

Section 12: Software Piracy Prohibition.

State or other public funds payable under this PO shall not be used for the acquisition, operation, or maintenance of computer software in violation of federal copyright laws or applicable licensing restrictions. Vendor hereby certifies and warrants that, during the term of this PO and any extensions, Vendor has and shall maintain in place appropriate systems and controls to prevent such improper use of public funds. If the State determines that Vendor is in violation of this provision, the State may exercise any remedy available at law or in equity or under this PO, including, without limitation, immediate termination of this PO and any remedy consistent with federal copyright laws or applicable licensing restrictions.

Section 13: Information Technology.

To the extent that Vendor provides physical or logical storage of State Records; Vendor creates, uses, processes, discloses, transmits, or disposes of State Records; or Vendor is otherwise given physical or logical access to State Records in order to perform Vendor’s obligations under this PO, Vendor shall, and shall cause its subcontractors, to:

provide physical and logical protection for all hardware, software, applications, and data that meets or exceeds industry standards and the requirements of this PO;
maintain network, system, and application security, which includes, but is not limited to, network firewalls, intrusion detection (host and network), annual security testing, and improvements or enhancements consistent with evolving industry standards;
comply with State and federal rules and regulations related to overall security, privacy, confidentiality, integrity, availability, and auditing;
provide that security is not compromised by unauthorized access to workspaces, computers, networks, software, databases, or other physical or electronic environments;
promptly report all Incidents, including Incidents that do not result in unauthorized disclosure or loss of data integrity, to a designated representative of the OIS; and
comply with all rules, policies, procedures, and standards issued by the Governor’s Office of Information Technology (OIT), including project lifecycle methodology and governance, technical standards, documentation, and other requirements posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies.

Vendor shall not allow remote access to State Records from outside the United States, including access by Vendor’s employees or agents, without the prior express written consent of OIS. Vendor shall communicate any request regarding non-U.S. access to State Records to the State. The State, acting by and through OIS, shall have sole discretion to grant or deny any such request.

Section 14: Accessibility.

Vendor shall comply with and the Work Product provided under this PO shall be in compliance with all applicable provisions of §§24-85-101, et seq., C.R.S., and the Accessibility Standards for Individuals with a Disability, as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S. Vendor shall also comply with all State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the Web Content Accessibility Guidelines (WCAG), incorporated in the State of Colorado technology standards. Vendor shall indemnify, save, and hold harmless the Indemnified Parties against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the Indemnified Parties in relation to Vendor’s failure to comply with §§24-85-101, et seq., C.R.S., or the Accessibility Standards for Individuals with a Disability as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S. The State may require Vendor’s compliance to the State’s Accessibility Standards to be determined by a third party selected by the State to attest to Vendor’s Work Product and software is in compliance with §§24-85-101, et seq., C.R.S., and the Accessibility Standards for Individuals with a Disability as established by OIT pursuant to Section §24-85-103 (2.5), C.R.S.

ADDENDUM 2:
Additional Terms & Conditions for Federal Provisions

IF ANY PART OF THIS PO HAS BEEN FUNDED, IN WHOLE OR IN PART, WITH FEDERAL FUNDS, THE FOLLOWING PROVISIONS SHALL ALSO APPLY TO THIS PO.

Section 1: Applicability of Provisions.

The Contract or Purchase Order to which these Federal Provisions are attached has been funded, in whole or in part, with an Award of Federal funds. In the event of a conflict between the provisions of these Federal Provisions, the Special Provisions, the body of the Contract or Purchase Order, or any attachments or exhibits incorporated into and made a part of the Contract or Purchase Order, the provisions of these Federal Provisions shall control.

Section 2: Compliance.

Contractor shall comply with all applicable provisions of the Transparency Act, all applicable provisions of the Uniform Guidance, and the regulations issued pursuant thereto, including but not limited to these federal Provisions. Any revisions to such provisions or regulations shall automatically become a part of these Federal Provisions, without the necessity of either party executing any further instrument. The State of Colorado may provide written notification to Contractor of such revisions, but such notice shall not be a condition precedent to the effectiveness of such revisions.

Section 3: System for Award Management (SAM) and UNIQUE ENTITY ID Requirements.

SAM. Contractor shall maintain the currency of its information in SAM until the Contractor submits the final financial report required under the Award or receives final payment, whichever is later. Contractor shall review and update SAM information at least annually after the initial registration, and more frequently if required by changes in its information.

Unique Entity ID. Contractor shall provide its Unique Entity ID to its Recipient, and shall update Contractor’s information at http://www.sam.gov at least annually after the initial registration, and more frequently if required by changes in Contractor’s information.

Section 4: Contract Provisions Required by Uniform Guidance Appendix II to Part 200.

Contracts for more than the simplified acquisition threshold, which is the inflation adjusted amount determined by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) as authorized by 41 U.S.C. 1908, must address administrative, contractual, or legal remedies in instances where contractors violate or breach contract terms, and provide for such sanctions and penalties as appropriate. The simplified acquisitions threshold is $250,000
All contracts in excess of $10,000 must address termination for cause and for convenience by the non-Federal entity including the manner by which it will be effected and the basis for settlement.
Equal Employment Opportunity. Except as otherwise provided under 41 CFR Part 60, all contracts that meet the definition of “federally assisted construction contract” in 41 CFR Part 60-1.3 must include the equal opportunity clause provided under 41 CFR 60-1.4(b), in accordance with Executive Order 11246, “Equal Employment Opportunity” (30 FR 12319, 12935, 3 CFR Part, 1964-1965 Comp., p. 339), as amended by Executive Order 11375, “Amending Executive Order 11246 relating to Equal Employment Opportunity,” and implementing regulations at 41 CFR Part 60, “Office of federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor.”
Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. The non-Federal entity must place a copy of the current prevailing wage determination issued by the Department of Labor in each solicitation. The decision to award a contract or subcontract must be conditioned upon the acceptance of the wage determination. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency. The contracts must also include a provision for compliance with the Copeland “Anti-Kickback” Act (40 U.S.C. 3145), as supplemented by Department of Labor regulations (29 CFR Part 3, “Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States”). The Act provides that each contractor or subrecipient must be prohibited from inducing, by any means, any person employed in the construction, completion, or repair of public work, to give up any part of the compensation to which he or she is otherwise entitled. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency.
Contract Work Hours and Safety Standards Act (40 U.S.C. 3701-3708). Where applicable, all contracts awarded by the non-Federal entity in excess of $100,000 that involve the employment of mechanics or laborers must include a provision for compliance with 40 U.S.C. 3702 and 3704, as supplemented by Department of Labor regulations (29 CFR Part 5). Under 40 U.S.C. 3702 of the Act, each contractor must be required to compute the wages of every mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the standard work week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and provide that no laborer or mechanic must be required to work in surroundings or under working conditions which are unsanitary, hazardous or dangerous. These requirements do not apply to the purchases of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence.
Rights to Inventions Made Under a Contract or Agreement. If the Federal award meets the definition of “funding agreement” under 37 CFR § 401.2 (a) and the recipient or subrecipient wishes to enter into a contract with a small business firm or nonprofit organization regarding the substitution of parties, assignment or performance of experimental, developmental, or research work under that “funding agreement,” the recipient or subrecipient must comply with the requirements of 37 CFR Part 401, “Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements,” and any implementing regulations issued by the awarding agency.
Clean Air Act (42 U.S.C. 7401-7671q.) and the federal Water Pollution Control Act (33 U.S.C. 1251-1387), as amended - Contracts and subgrants of amounts in excess of $150,000 must contain a provision that requires the non-Federal award to agree to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).
Debarment and Suspension (Executive Orders 12549 and 12689) - A contract award (see 2 CFR 180.220) must not be made to parties listed on the government wide exclusions in the System for Award Management (SAM), in accordance with the OMB guidelines at 2 CFR 180 that implement Executive Orders 12549 (3 CFR part 1986 Comp., p. 189) and 12689 (3 CFR part 1989 Comp., p. 235), “Debarment and Suspension.” SAM Exclusions contains the names of parties debarred, suspended, or otherwise excluded by agencies, as well as parties declared ineligible under statutory or regulatory authority other than Executive Order 12549.
Byrd Anti-Lobbying Amendment (31 U.S.C. 1352) - Contractors that apply or bid for an award exceeding $100,000 must file the required certification. Each tier certifies to the tier above that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352. Each tier must also disclose any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award. Such disclosures are forwarded from tier to tier up to the non-Federal award.
Prohibition on certain telecommunications and video surveillance services or equipment §2 CFR 200.216
1. Recipients and sub recipients are prohibited from obligating or expending loan or grant funds to:
  1. Procure or obtain;
  2. Extend or renew a contract to procure or obtain; or
  3. Enter into a contract (or extend a contract) to procure or obtain equipment, services, or systems that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. As described in Public Law 115-232, section 889, covered telecommunications equipment is telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities).
Contracts with small and minority businesses, women’s business enterprises, and labor surplus area firms. (2 CFR §200.321). The non-Federal entity must take all necessary affirmative steps to assure that minority businesses, women's business enterprises, and labor surplus area firms are used when possible.
Domestic preferences for procurements. (2 CFR §200.322) As appropriate and to the extent consistent with law, the non-Federal entity should, to the greatest extent practicable under a Federal award, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States (including but not limited to iron, aluminum, steel, cement, and other manufactured products). The requirements of this section must be included in all subawards including all contracts and purchase orders for work or products under this award.
Procurement of recovered materials. (2 CFR §200.323) A non-Federal entity that is a state agency or agency of a political subdivision of a state and its contractors must comply with section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act. The requirements of Section 6002 include procuring only items designated in guidelines of the Environmental Protection Agency (EPA) at 40 CFR part 247 that contain the highest percentage of recovered materials practicable, consistent with maintaining a satisfactory level of competition, where the purchase price of the item exceeds $10,000 or the value of the quantity acquired during the preceding fiscal year exceeded $10,000; procuring solid waste management services in a manner that maximizes energy and resource recovery; and establishing an affirmative procurement program for procurement of recovered materials identified in the EPA guidelines.

Section 5: Termination for Convenience of the Government.

Pursuant to §4.2 of these Federal Provisions, the State of Colorado may terminate this contract, in whole or in part, when it is in the Government’s interest. Solicitations and contracts shall include clauses as required by FAR 49.502 (2023). Termination for convenience of the government shall comply with the following provisions of the Federal Acquisition Regulations:

For Fixed Price Contracts: FAR 52.249-2 (2023)
For Contracts for Personal Services: FAR 52.249-12 (2023)
For Construction Contracts for Dismantling, Demolition, or Removal of Improvements: FAR 52.249-3 (2023)
For Educational and Other Nonprofit Institutions: FAR 52.249-5 (2023)

Section 6: Event of Default.

Failure to comply with these Federal Provisions shall constitute an event of default under the Contract and the State of Colorado may terminate the Contract upon 30 days prior written notice if the default remains uncured five calendar days following the termination of the 30 day notice period. This remedy will be in addition to any other remedy available to the State of Colorado under the Contract, at law or in equity.

For more information contact:

Ryan Yarrow
ryan.yarrow@state.co.us