ANNEX I - TERMS OF REFERENCE (ToR) Staff Augmentation Services for Business Application Development
Table of Contents 1. BACKGROUND
UNICEF is the agency of the United Nations mandated to advocate for the protection of children's rights, to help meet their basic needs and to expand their opportunities to reach their full potential. Guided by the Convention on the Rights of the Child UNICEF strives to establish children's rights as international standards of behaviour towards children. UNICEF's role is to mobilise political will and material resources to help countries ensure a "first call for children". UNICEF is committed to ensuring special protection for the most disadvantaged children.
UNICEF carries out its work through its headquarters in New York, 8 regional offices and 125 country offices world-wide. UNICEF also has a research centre in Florence, a supply operation headquarters based in Copenhagen and offices in Tokyo and Brussels. UNICEF's 37 committees raise funds and spread awareness about the organisations mission and work.
UNICEF Supply Division (SD), a UNICEF headquarter office located in Copenhagen, procures and supplies over 5,000 products to address the needs of children essential to fulfil children’s rights, as well as providing rapid supply response to emergencies. Supporting child survival and development programmes around the world, UNICEF-procured supplies are critical in providing for children’s health, education and protecting them from abuse, exploitation, and neglect.
UNICEF Supply Division(SD) Operational Analysis & Technology Centre (OATC) manages multiple applications to support core business processes that were developed over time to accommodate specific needs. These applications are managed within SD hosted Lotus Notes/Domino environment. As the UNICEF Domino messaging/application environment has been phased out with Microsoft technologies and environments, and UNICEF is planning to decommission the global Lotus Notes/Domino environment in 2017, UNICEF SD needs to compulsively migrate and re-develop relevant SD business applications.
UNICEF SD OATC has reviewed the existing Domino/Lotus Notes business applications based on their relevance to the current business processes as well as the usage in the last quarters, aiming to identify the applications that are due to be migrated to the Microsoft platform, and found out that six (6) business applications needs to be redeveloped as actively used locally or globally.
There is need for both short-term and long-term services for various software- related tasks of wide-ranging scopes, for unique new development tasks, as well as modification work to functioning platforms and applications.
Page 2 of 23 2. PURPOSE, SCOPE OF THE PROPOSED WORK AND REQUIRED SERVICES
2.1 Purpose
OATC wishes to identify a community of software programming service providers, who builds upon both open source software principles and technologies as well as proprietary mainstream technologies such as Microsoft .NET development. and can provide UNICEF SD and UNICEF Country Offices with software development services as outlined below. These services will be facilitated through a Long Term Arrangement for Services (LTAS) which will be signed between UNICEF SD and the successful bidder(s). An LTAS allows UNICEF offices globally to contract directly with service providers based on an agreed set of services and costs.
2.2 Scope of Work and Required Services
Required services to be procured through the LTAS are outlined below. In order to bid for a specific category of service, proposers must ensure that they have the access to personnel with the skills required for the specific services described here.
SERVICE EXPECTED/KEY DELIVERABLES 1. Project Management - managing the development Development and implementation of project and implementation of contractual requirements, according to agreements, proposals reflecting developing proposals, provision of leadership to project requirements, reports reflecting work project team, identifying, planning and managing delivered project resources and progress reporting 2. Business and Requirements Analysis - business Scoping and documentation of user requirements analysis, requirements gathering, prioritization, for an application or other product; business release and resource planning, check API standards, analysis delivered including facilitation of requirements gathering sessions, which may take place in a variety of field or office settings 3. Software Development - programming, Software programming of an application or other customization, cloud infrastructure setup, QA and product; delivered as fully tested and functional testing, user experience/interface work, over a wide product; relevant code provided and signed off range of technologies and programming languages. by UNICEF Keywords: MS Azure, Amazon AWS, TFS, SharePoint Online, ASP.NET MVC, ASP.NET Core, Entity framework, Python, AngularJS, Node.js, Kendo UI, SAML (among others). 4. System Architecture - Software architecture and System architecture in place for an application or strategies, software models and components, product meeting the business and technical interface specifications requirements
Page 3 of 23 5. Developer Operations- Provide set up, system System setup, integration and administration to integration, deployment and other IT infrastructure specifications as provided by UNICEF support 6. Documentation - Provide set-up documentation, Technical manuals in appropriate formats for system integration guidelines, technical and end- user each audience as defined by UNICEF, signed off manuals by the target audience 7. Mobile systems/backend – Development and Server-side application development work for modification of backend web services for mobile mobile systems; delivered as fully tested and applications. Development and modification of server- functional product with any relevant API/usage side applications, APIs and web services for mobile documentation; relevant code provided and applications. May require some development and signed off by UNICEF modification of mobile applications for Android, iPhone, including QA, testing and user interface work 8. Mobile systems/frontend – Development and Android/IOS application development work; modification of mobile applications for Android and delivered as fully tested and functional product; IOS relevant code provided and signed off by UNICEF 9. User experience and interface design - analysing, User experience and interface meeting users' designing and user testing for software applications, needs; design standards are meeting defining design standards, establishing processes for requirements set by UNICEF or partners user testing, reviews, user flows, wireframes, 10. Graphic Design - Requirements gathering, Graphic elements designed, delivered as required prototyping, branding/logos; programming - CSS by UNICEF development; web screen mock-ups 11. Web Design and Development- Programming - Designs for websites according to project XHTML, DHTML, Javascript, Typescript, AJAX, PHP; requirements, website front and back-end Drupal (Acquia), Joomla, Phython, Sitecore, user programming work as per requirements experience/interface design for low-end feature phones (among others). 12. Support and maintenance services - user support Support and maintenance services for a product for an application or product, resolving user problems or application delivered according to or requests, provision of helpdesk support, managing requirements set by UNICEF or partner online content (knowledge base, manuals, etc.) about an application or product 13. Database Services - Programming - SQL reports, Database designs, SQL queries, migration scripts and strategies, performance profiling profiling/performance reports, triggers, data and tuning, with PostgreSQL, MySQL, MS-SQL, Access, migrations, and views delivered in the DB2, NoSQL (CouchDB, Hadoop..), and Oracle specifications as required by UNICEF Databases
All technical services should assume that user-based design of the applications, sites and products will be necessary and must include adequate provision for testing and quality assurance. This will be the full responsibility of the company providing services.
UNICEF staff will supervise the work required and delivered under this LTAS. The work will be done using a development method that is deemed suitable and agreed upon for the work. This includes the Agile development method, which
Page 4 of 23 will involve regular meetings to re-assess progress, check priorities, and set priorities for the remaining time.
In addition, where applicable (projects based on open source tools), OATC strongly encourages software developers to participate in relevant open-source community online forums, share and maintain code using online repositories (such as Github), solicit, test, and accept contributions from volunteers, and communicate requirements, feature development, process and approaches to the global open-source community.
3. DURATION AND LOCATION
Validity of any LTAS resulting from this PFPS will be valid for an initial period of 24 months. A twelve (12) months extension may be granted to selected providers upon completion of satisfactory services, favourable review by contracting offices, and demonstrated continued need for services within UNICEF. Successful proposers will be expected to be available for potential contracts immediately after the anticipated award date.
Software services required include remote and on-site work conducted in UNICEF locations. It should be noted that UNICEF prefers to work with open source software whenever possible, and as fitting to the needs of each particular project.
4. SPECIAL TERMS AND CONDITIONS
All software services provided under contracts with UNICEF using this LTAS shall consider the following special terms and conditions that UNICEF SD commonly upholds its vendors to in projects:
4.1 Agile development
The design and software development process shall include regular check-ins to reassess progress, check priorities and adapt specific details. However, all of the contracted features to be implemented within the agreed timeframe. Publicly visible roadmap and development priorities Project management (i.e. using tools such as Redmine, Trello, etc.)
4.2 Full source ownership
Page 5 of 23 Source code fully owned by UNICEF. Documentation, testing and frequent commitment of all code to UNICEF TFS and/or to appropriate online repositories such as GitHub
4.3 Test coverage
Automated testing of overall system, including provision of unit tests for all source code that can be included on the integration build server. Near total test coverage for all code is required. Performance and scalability Repeatable testing of system performance to ensure scalability, including automated detailed performance measurement of all software modules under stress-test conditions. Unit testing, user acceptance testing and integration testing must be thoroughly documented. User Acceptance Testing (UAT) will be signed off by the respective stakeholders as acceptance of deliverables.
4.4 Data Protection
The vendor shall ensure provision of Data Protection as defined in ANNEX I.D.
4.5 Travel
The vendor should be willing to travel (sometimes on short notice) to develop/deploy/test software in the field. Travel costs for turnkey projects will be pre-approved and reimbursed by UNICEF as per the UNICEF rules and regulations for travel for consultants i.e. irrespective of the distance and duration of the flight, most direct and economy flight ticket shall apply.
4.6 Maintenance and support for turnkey solutions
In case the vendor will be called upon implementing a turnkey solution, Standard Support and Non-Standard Support shall include, but not limited to below:
Changes or additional features to the solution (to be determined). Bug fixes that were not caught in the user acceptance testing. Second level technical support to troubleshoot user issues. Technical support to UNICEF ICT and business teams as required. Support in keeping any mobile application current on iPhone and Android.
Page 6 of 23 Note: Offers for turnkey solutions should include a specific list of Standard Support Services and Non-Standard Support Services. Cost for Standard Support (on a monthly basis) and Non-Standard Support (Time & Materials) should be quoted separately.
5. TECHNICAL EXPERTISE
5.1 Required
Experience with the relevant technical skill set as indicated for each service presented above; professional references and concrete examples of working products will be requested Capable of deploying and maintaining software remotely on a Windows/Linux-UNIX-like server and cloud services such as MS Azure, AWS, Linode etc..
5.2 Desired
Experience leading scoping, user testing and training for technology projects Knowledge of environment in which UNICEF operates, and understanding of the constraints of working in a developing-world environment. This should include experience developing low-bandwidth applications in challenging work environments. Experience developing software as part of a distributed team using source control systems, especially in an open-source environment
6. REPORTING AND RESPONSIBILITY
The bidder unless otherwise negotiated on a case by case basis is fully responsible to procure any equipment or software license that is required for fulfilling the specified duties, there will be no provision of equipment or development tools from UNICEF. UNICEF, upon request, will provide the vendor with access to all the sample datasets For cloud services, UNICEF will be responsible for providing the MS Azure infrastructure/Amazon AWS/Linode for development, testing and production environment; the vendor may choose to develop on a proprietary development environment if preferred. All assignments and tasks will be monitored, evaluated and managed by OATC in Supply Division and ICT teams in other UNICEF offices. The hours spent by the consultant(s) are to be documented in a time log with details of all the hours used. The hours spent will be held up against the ToR and agreed business requirements for each assignment/project to ensure that the deliverables are met. All issues application and system related are to be captured in an issue log and tracked. A weekly status meeting via Skype for Business will be held to monitor and evaluate the progress of each of the assignment/project. Additional IT specific targeted status meetings as
Page 7 of 23 required will be held throughout the assignment/project along with the directly involved stakeholders. Evaluation will follow the sign offs for each assignment/project with inputs from OATC and stakeholders. UNICEF application development guidelines has to be followed throughout all assignments. The guidelines will be shared at the start of the assignment.
Page 8 of 23 1. ANNEX IA – PROPOSAL EVALUATION
Structure of Technical Proposal
Proposals must include complete and accurate information. The proposal must include, but is not limited to, the following items:
Title page clearly indicating name of the bidding entity and contact person Institutional profile (ANNEX I.A) Identification of services for which proposal is being submitted (ANNEX I.B) and description of proposer's relevant experience in the line of work, including CVs/resumes of lead resource persons, availability of resources and partnership arrangements, if any samples of work related to the specific services; links to software code repositories at least 3 references from clients for whom the bidder has carried out similar work list of previous UN contracts carried out in related fields of work, if any Proposed methodology, course of action and solutions to be provided for each of the services for which the proposer is applying. This text should provide enough information for UNICEF to evaluate whether the proposer has the skills and personnel profiles required to carry out the category of work, as well as the vision and forethought to lead on new and innovative solutions to UNICEF's needs. Other arrangements or clarifications the proposer would like to make that are not expressed elsewhere, in support of their proposal. Innovative, out-of-the-box ideas are welcome. Reference letters or evaluation forms from previous contracts of a similar nature. Note that letters that do not explicitly refer to the name of the contracted entity will not be considered. Audited financial statements as of 31 December 2016 or the most recent year available.
Evaluation Process
Each proposal will be assessed first on its technical merits (including by reference to legal requirements) and subsequently on its price. The proposal obtaining the overall highest score after adding the scores for the technical and financial proposals is/are the proposal(s) that offers best value for money and will be recommended for award of LTAS.
The evaluation panel will first evaluate each response for compliance with the requirements of this PFPS. Responses deemed not to meet all of the mandatory requirements will be considered non-compliant and rejected at this stage without further consideration. Failure to comply with any of the terms and
Page 9 of 23 conditions contained in this PFPS, including provision of all required information, may result in a response or proposal being disqualified from further consideration.
A total score of 70 (out of 100) will be calculated for each proposer on the technical proposal. The minimum score of 55 points would be required for technical compliance. UNICEF will rank proposers from highest score to lowest, and award an LTAS to proposers with the highest overall scores. UNICEF reserves the right to limit the number of LTAS awardees in order to reduce transaction costs associated with dealing with multiple service providers. Successful proposers will be notified in writing.
The proposals will be evaluated against the following:
Total Technical: 70 points total
The price/cost of each of the technically compliant proposals shall be considered only upon evaluation of the above technical criteria. Only proposals which receive a minimum of 55 points will be considered further. You will be assessed according to the following technical criteria:
Criteria Type Description Points Portfolio Strength of user experience, interaction, and visual design 15 Portfolio Strength of technical expertise in software development 15 Portfolio Range of variety and comprehensiveness of application 10 samples presented Talent Pool Strength of sample resources profile shared 10 Organization Capability Demonstrated ability to advise clients on relevant new 10 technology, industry standards, and best practices based on expertise and available business intelligence Previous Client Experience Demonstrated experience/case studies with similar projects 10
Financial Proposal: 30 points total
The total amount of points allocated for the price component is 30 points. The maximum number of points will be allotted to the lowest financial proposal that is opened and compared among those invited firms/institutions which obtain the threshold points in the evaluation of the technical component. All other financial proposals will receive points in inverse proportion to the lowest price; e.g.:
Max. score for financial proposal (i.e. 30) * price of lowest proposal Score for ------proposal X = ------price of proposal X
Page 10 of 23 Total Technical and Financial = 100 points
The bidders should ensure that all pricing information is provided in accordance with the template provided in ANNEX I.C, and the following:
The currency of the proposal shall be in US Dollars. All prices/rates quoted must be exclusive of all taxes as UNICEF is a tax-exempt organization. All prices/rates quoted must be exclusive of all taxes as UNICEF is a tax-exempt organization. The proposal obtaining the overall highest score after adding the scores for the technical and financial proposals is the proposal that offers best value for money.
NOTE: Companies should fill in ONLY the services they can provide and the employees they currently have available on staff.
2. ANNEX II.A: INSTITUTIONAL PROFILE [Please check the box when appropriate]
GENERAL INFORMATION
Full company name: Address: Country: Contact Person: E-mail address: Website: Tel: Fax: Alternative Contact person: E-mail address: Type of Organisation * Private Sector * NGO * Foundation * Other, ......
MAIN SERVICES
Briefly describe your company's main services and areas of expertise (max 150 words}
Page 11 of 23 GEOGRAPHIC FOOTPRINT & PRESENCE
Region 1: E.g. East Africa Offices in the region, if any: List all the countries where you have offices in this region Number of employees in the region: Region 2 : E.g. South East Asia Offices in the region, if any: List all the countries where you have offices in this region Number of employees in the region: Region 3: E.g. Latin America Offices in the region, if any: List all the countries where you have offices in this region Number of employees in the region: Add as required...
ADDITIONAL INFORMATION
Company established in {year): Years of experience providing similar service(s): Number of employees: Annual turnover (USD): 0 Registration with If so, registration UNGM1 number: Experience working with UN Agencies over the last 5 No years Yes Briefly mention the UN agency and the type of work done, including the details of referees
1 United Nations Market Place (www.ungm.org)
Page 12 of 23 Page 13 of 23 3. ANNEX II.A: PART II – AVAILABILITY OF RESOURCES Please check [x] the box for the resources available in your company
ON-SITE OFF-SHORE
A. On-site Resources for B. On-site Resources for C. Resources for Off-Shore Copenhagen, Denmark New York, USA SN Service Position/Tasks
Mid- Mid- Mid- Junior Senior Junior Senior Junior Senior Level Level Level (<2 yrs) (> 5 yrs) (<2 yrs) (> 5 yrs) (<2 yrs) (> 5 yrs) (2-5 yrs) (2-5 yrs) (2-5 yrs)
1 Project Management Project Manager - managing development and implementation of contractual requirements, resource planning, proposal development and managing project team 2a. Business and Requirements Business Analyst – requirements gathering, Analysis prioritization, release and resource planning
2b. Business and Requirements Facilitator - often a BA with specific experience Analysis facilitating workshops and requirements analysis sessions 3a. Software Development Programmer - Java, Ruby, .Net, Python, Javascript/front- end other etc. 3b. Software Development Quality Assurance Analyst - testing, testing automation
4 System Architecture System I Software Architect - system/software architecture, interface requirements, standards, etc. 5 Developer Operations Operations Manager - feature/code roll-out to production systems, hosting infrastructure planning, design, implementation, elastic cloud based hosting, scripts/machinery to manage hosting 6a. Documentation Technical Writer - technical writing, editing, proofreading, integration of computer based material, etc 6b. Documentation Manual Developer - help and manual development, training material, etc
7a. Mobile systems/backend Programmer - Ruby, C#, .Net, Python, Java, AngularJS, Kendo UI, or other
7b. Mobile systems/backend Quality Assurance Analyst - testing, testing automation
8a. Mobile systems/frontend Programmer - Android/IOS frameworks, or other
8b. Mobile systems/frontend Quality Assurance Analyst - testing, testing automation
9 User experience and User experience and User Interface Designer - setting interface design design standards, analyzing and designing user tests, user task analysis, user flows, wireframes, and user testing of designs 10a. Graphic Design Designer - requirements gathering, prototyping, branding/logos 10b. Graphic Design Developer - CSS development, web screen mock-ups
11a. Web Design and User experience and User Interface Designer Development- Programming 11b. Web Design and Programmer - XHTML, DHTML, javscript/jquery, AJAX, Development- Programming PHP, etc 11c. Web Design and Quality Assurance Analyst - testing, testing automation Development- Programming 12a Support and maintenance User Support Specialist - user support, resolving services technical issues, helpdesk support, managing online content about IT projects or applications, etc.
12b. Support and maintenance Developer - software maintenance, troubleshooting, services patching, etc.
13 Database Services - Database Administrator – database design, managing Programming database applications, monitoring/maintaining databases and performance, SQL queries, etc.
Page 14 of 23 4. ANNEX II.B: SERVICES & AREAS OF EXPERTISE [Please check the box when appropriate] (PLEASE REFER TO SERV ICES LISTED IN THE RFPS)
Describe your expertise and experience for each service, and refer to any work or product produced (websites, digital platform, etc.). Attach samples of work related to the specific services; links to software code repositories strongly recommended for programming work. Provide at least 3 references from clients for whom the bidder has carried out similar work. Attach CVs of resources required (1,2,7,8 and 9).
SERVICE DESCRIPTION (MAX.350 WORDS PER SERVICE) 1. Project Management * in addition, please provide 1 CV 2. Business and Requirements Analysis * in addition, please provide 1 CV 3. Software Development 4. System Architecture 5. Developer Operations 6. Documentation 7. Mobile systems/backend * in addition, please provide 1 CV 8. Mobile systems/frontend * in addition, please provide 1 CV 9. User experience and interface design * in addition, please provide 1 CV 10. Graphic Design 11. Web Design and Development- Programming 12. Support and maintenance services 13. Database Services - Programming
EXPERIENCE IN SOFTWARE CODING LANGUAGES
Describe briefly your expertise and experience for each coding language, and refer to any work or product produced.
Type Service Brief Description (max. 150 words per language) Javascript/Typescript C#/.NET PHP Perl Python ... (Add as appropriate)
METHODOLOGY AND APPROACH FOR SOFTWARE DEVELOPMENT
Project management Briefly describe your approach and methodology to structure, plan,
Page 15 of 23 approach and methodology and control the process of software development and indicate which methodologies your company is most familiar with (e.g. waterfall, Agile, etc.). Max. 150 words Risk management Briefly describe how your company deals with risk management in software development. Max. 150 words.
Page 16 of 23 5. ANNEX II.C: DAY RATE FOR SERVICES (Excel template attached separately)
6. ANNEX II.D - DATA PROTECTION PROVISION
Definitions.
"End User" means any and all employees, contractors, consultants, agents or other representatives of UNICEF; any members or customers of UNICEF; any other external users collaborating with UNICEF, in each case, authorized by UNICEF to access and use the Services; and every user of the platforms and its affiliated applications.
"UNICEF Data" means any and all data, including all text, sound, software, or image files that are provided to the Contractor by, or on behalf of, UNICEF and/or End Users through UNICEF's and/or End Users' use of the Services or in connection with Services, including any information, whether in oral or written (including electronic) form, created by or in any way originating with UNICEF and/or End Users, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with UNICEF and/or End Users, in the course of using and configuring the Services. UNICEF Data specifically includes, without limitation,(a) any and all credentials issued to UNICEF by the Contractor, records relating to UNICEF's use of the Services and administration of End User accounts, and other UNICEF information and (b) any and all End User account credentials and information, and any and all records sent, received and/or created by or for End Users, including, without limitation (i) any email content, headers and attachments, and/or (ii) any personally-identifiable, financial or other information of any End User or third party the use and/or disclosure of which is restricted under applicable laws, in each case, contained in such records or in any logs or other records of the Contractor reflecting End User's use of the Services.
2. Status. The Contractor recognizes that UNICEF is a subsidiary organ of the United Nations, an international organization established by treaty, and that as a result of its status it enjoys certain privileges and immunities as set forth in the Convention on the Privileges and Immunities of the United Nations (the "General Convention") and is an "international organization" for purposes of the International Organizations Immunities Act, Public Law 79- 291 enacted by the United States Congress on 29 December 1945 (the "Immunities Act"). The Contractor further recognizes that UNICEF Data is
Page 17 of 23 subject to the privileges and immunities accorded to the United Nations, including UNICEF, pursuant to the General Convention and as such (a) will be deemed part of UNICEF's archives which are inviolable wherever located and by whomsoever held and (b) will be immune from search, requisition, confiscation, expropriation and any form of interference, whether by executive, administrative, judicial or legislative action, unless such immunity is expressly waived in writing by UNICEF.
3. Data Ownership and Protection. (a) The Parties agree that, as between them, all UNICEF Data compiled by, processed by or received by the Contractor under the Contract, together with all rights (including intellectual property and proprietary rights), title and interest thereto, will be the exclusive property of UNICEF, and the Contractor has a limited, nonexclusive license to access and use these UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Contractor will have no other rights, whether express or implied, in or to any UNICEF Data or its content.
(b) The Contractor (i) will treat the UNICEF Data as confidential;(ii) will segregate UNICEF Data from other data to the fullest extent possible; (iii) will use the UNICEF Data only for the purpose of fulfilling its duties under the Contract and for the sole benefit of UNICEF and its End Users; (iv) will deliver the UNICEF Data only to UNICEF or duly authorized representatives of UNICEF; and (v) will not disclose or transmit the UNICEF Data or their contents to any person or entity (other than the personnel of the Contractor (as defined below) who need to access the UNICEF Data to enable the Contractor to deliver the Services under this Contract) without the prior written consent of UNICEF. The Contractor will ensure that, prior to being granted access to the UNICEF Data, all employees, contractors, agents and other representatives of the Contractor ("personnel") who will perform services under this Contract: (A) have undergone and passed criminal background screenings; (B) have successfully completed training of a nature sufficient to enable them to effectively comply with all UNICEF Data protection provisions of this Contract; and (C) possess all qualifications necessary to the nature of their duties and the sensitivity of the UNICEF Data.
(c) The Contractor will not use any UNICEF Data for the benefit of the Contractor or any third party and, in particular, will not engage in "data mining" of any UNICEF Data or communications by or for UNICEF or any End Users, whether through automated or human means, except as expressly authorized in writing by UNICEF.
(d) UNICEF retains the right to use the Services to access and retrieve, at any time and in UNICEF's sole discretion, any UNICEF Data stored on the Contractor's infrastructure relating to the Services.
Page 18 of 23 (e) The Contractor will implement, maintain and use administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other measures, (collectively, "Protective Measures"), including, without limitation, data encryption, anti-virus and anti-malware protections, intrusion detection and reporting methods, which are necessary and sufficient: (i) to protect the confidentiality and integrity of all UNICEF Data that is electronically maintained, stored, processed and/or transmitted; (ii) to protect all UNICEF Data from unauthorized access, destruction, use, modification or disclosure; and (iii) to protect all UNICEF Data against deterioration or degradation of its quality and authenticity. Such Protective Measures will be no less protective than those used by the Contractor to protect its own confidential information, and in no event less than reasonable in view of the nature and type of UNICEF Data involved. The Contractor will be held accountable only for the development environments maintained by the Contractor.
(f) UNICEF will have the exclusive right to determine the geographical boundaries and location of the facilities where UNICEF Data may be transferred to, stored and processed. The Contractor will not transfer or otherwise process UNICEF Data or change the location of the facilities at which UNICEF Data is stored without UNICEF's prior written approval.
(g) The Contractor will impose the same requirements relating to data protection and non-disclosure of data, as are imposed upon the Contractor itself by the Contract, on its service providers, subcontractors and other third parties and will remain responsible for compliance with such requirements by its service providers, subcontractors and other third parties.
4. Compelled Disclosure. (a) If disclosure of any UNICEF Data is compelled (whether directly or indirectly) under a legally binding order or other instrument issued by any local, national or international governmental regulatory or law enforcement authority or agency, tribunal, court or arbitrator (each a "Governmental Body" and collectively, "Governmental Bodies") that has jurisdiction over the Contractor or data held and processed by the Contractor, the Contractor shall, before making any disclosure of any UNICEF Data, take the following actions:
(i) promptly notify UNICEF of such compelled disclosure and the terms thereof and provide UNICEF with the Contractor's legal opinion that such disclosure is legally binding on it and that the legal process is sufficient and valid;
(ii) consult with UNICEF regarding the Contractor's response to such demand or request and,at UNICEF's request, provide UNICEF a true, correct and complete copy of the Contractor's response to such demand or request;
Page 19 of 23 (iii) advise the relevant Governmental Body of the inviolability of UNICEF Data under the General Convention and the International Organizations Immunity Act, Public Law 79-291, 29 December 1945 (USA) or such other national law recognizing the privileges and immunities of UNICEF in such jurisdiction;
(iv) use its best efforts to redirect such Governmental Body to request disclosure directly from UNICEF or, at a minimum, to provide UNICEF the opportunity to present its position to such Governmental Body;
(v) seek an extension of time for disclosure of the UNICEF Data sufficient to permit UNICEF an opportunity to obtain a protective order or take such other appropriate actions as UNICEF may deem appropriate to assert its privileges and immunities; and
(vi) cooperate with UNICEF's reasonable requests in connections with efforts by UNICEF to ensure that its privileges and immunities are upheld.
(b) The Contractor will continue to consult with UNICEF and keep UNICEF informed of developments with respect to the disclosure and subsequent use of UNICEF Data, including all communications with the relevant Governmental Body relevant to UNICEF Data, and to consult with UNICEF before taking any actions in this regard. If the Contractor is prohibited by law from notifying UNICEF of the disclosure demanded by the relevant Governmental Body, the Contractor will nevertheless take the actions required under paragraphs (iii), (iv) and (v) above and will notify UNICEF promptly upon the lapse, termination, removal or modification of such prohibition.
5. Data Compromise. (a) "Data Compromise" means any actual, threatened or reasonably suspected unauthorized access to, disclosure of, use of or acquisition of computerized UNICEF Data that compromises the security, confidentiality, or integrity of the UNICEF Data, or the ability of UNICEF or End Users to access the UNICEF Data.
(b) In the event of any Data Compromise, the Contractor will notify UNICEF immediately upon the Contractor's discovery of such Data Compromise, specifying: (i) the nature and source of the incident, (ii) the nature or type of UNICEF Data implicated in the incident, (iii) the person or entity responsible for the Data Compromise, if known, (iv) the actions taken or proposed to be taken by the Contractor to mitigate any deleterious effect of such Data Compromise; and (v) the actions taken or proposed to be taken by the Contractor to correct, remedy or cure the breach, and to prevent similar Data Compromises from occurring in the future. The Contractor will keep UNICEF reasonable informed of the progress of the Contractor's implementation of such mitigating and corrective actions.
Page 20 of 23 (c) As soon as possible following the date when the Contractor discovers a Data Compromise, the Contractor, at its sole cost and expense, will complete the implementation of any and all actions necessary to: (i) mitigate any deleterious effect of such Data Compromise, (ii) correct, remedy or cure such Data Compromise, and (iii) prevent similar Data Compromises from occurring in the future, and will restore UNICEF's and, as directed by UNICEF, End Users' access to the Services.
(d) The Contractor, at its sole cost and expense, will cooperate fully with UNICEF's investigation of, remediation of, and/or response to any Data Compromise. The Contractor's failure to resolve, to UNICEF's reasonable satisfaction, any such Data Compromise will entitle UNICEF to terminate this Contract with immediate effect.
(e) The Contractor will not provide notice of any Data Compromise directly to any Governmental Body or to any third party, in each case, without prior written permission from UNICEF.
6. Interruptions and suspension of service. (a) Notwithstanding the Force Majeure provisions contained in the Contract, in the event the Contractor, or any of its infrastructure or facilities necessary to provide the Services, experiences or suffers a disaster, the Contractor, at its sole cost and expense, will provide disaster recovery Services to UNICEF and End Users, and will take all necessary steps to ensure that neither UNICEF nor End Users are denied access to the Services for more than minimally necessary. The Contractor will procure and maintain, at the Contractor's sole cost and expense, all necessary capability to resume the provision of the Services from one or more alternate locations and via one or more alternate telecommunications routes in the event of a disaster that renders unusable or unavailable any of the Contractor's primary infrastructure or facilities for the provision of the services.
(b) In the event of an outage of Services, the Contractor will refund or credit UNICEF, at UNICEF's election, the pro-rated amount of fees under the Contract corresponding to the time period for which the services were unavailable.
(c) The Contractor will provide UNICEF with no less than thirty (30) days' prior written notice of any time period during which the Services will be unavailable due to non emergency scheduled maintenance or Enhancements. If the services are unavailable during any unscheduled and unforeseen times, the Contractor will immediately provide notice thereof to UNICEF and will cooperate with UNICEF's reasonable requests for information regarding the unavailability of the Services (e.g., causes, effect on the services, estimated duration).
(d) UNICEF may suspend or terminate, or direct in writing the Contractor to suspend or terminate (in which case the Contractor will suspend or terminate),
Page 21 of 23 an End User's access to services in accordance with UNICEF's internal rules, regulations, policies and/or procedures.
7. Disabling Code Warranty. The Contractor represents and warrants to UNICEF that the Services will not contain, and UNICEF will not receive from the Contractor, any virus, worm, trap door, back door, timer, clock, counter or other limiting routine, instruction or design, or other malicious, illicit or similar unrequested code, including surveillance software or routines which may, or is designed to, permit access by any person, or on its own, to erase, or otherwise harm or modify any Data or any system, server, facility or other infrastructure of UNICEF or any End User (collectively, a "Disabling Code"). If a Disabling Code is identified, the Contractor, at its sole cost and expense, will take all steps necessary to: (i) restore and/or reconstruct any and all UNICEF Data lost by UNICEF and/or End Users as a result of Disabling Code; (ii) furnish to UNICEF a corrected version of the Services without the presence of Disabling Codes; and,(iii) as needed, re-implement the Services.
8. Data Transfer on Termination or Expiration. (a) At the time of expiration or in the event of termination of this Contract, the Contractor shall, at the written election of UNICEF, provide UNICEF with a backup copy of all then current UNICEF Data in native readable format, and where practical will attempt to securely remove all UNICEF Data relating thereto from the Contractor's servers, networks and systems. If it is not practical to remove the Data,the Contractor will inform UNICEF of such failure to remove all UNICEF Data, providing details of which UNICEF Data is affected and where it is stored. The Contractor will continue to protect the UNICEF Data and treat it as confidential in accordance with the terms of this Contract. The Contractor will take and complete all of the foregoing actions within thirty (30) days of the expiration or termination of this Contract, and will provide UNICEF with sufficient written proof of the information transferred or removed. The Contractor will ensure (i) that such migration of the UNICEF Data uses facilities, methods and formats that are compatible and interoperable le with the relevant systems of UNICEF, and (ii) that UNICEF will have sufficient access to the UNICEF Data during the entire duration of the transition. The Contractor will take all necessary actions (including, without limitation, work closely with the Contractor's successor) to provide for a successful, effective and efficient migration of UNICEF Data and transition of service with minimal disruption to UNICEF or End Users.
(b) The Contractor will provide UNICEF with no less than ninety (90) days prior written notice of impending cessation (whether by sale of equity or assets, merger, consolidation, operation of law, bankruptcy or otherwise) of the Contractor or any of its subcontractors. Such written notice will be accompanied by (i) any contingency and/or exit plans in connection with such cessation, (ii) a full inventory and configuration of the servers, routers, other hardware and software involved in the provision of the Services, along with supporting
Page 22 of 23 documentation, indicating which, if any, of these are owned by or dedicated to UNICEF and/or End Users. Following the giving of such notice, and prior to the expiration of such ninety (90) day period, the Contractor, at its sole cost and expense, will (a) destroy or transfer to UNICEF, or to a third party designated in writing by UNICEF, any and all UNICEF Data or other UNICEF assets previously escrowed; (b) provide UNICEF access to the infrastructure and facilities of the Contractor or its subcontractors (as the case may be) in connection with such destruction or transfer, and (c) otherwise fully implement its contingency and/or exit plans. The Contractor will take all necessary actions to provide for an effective and efficient migration of UNICEF Data and transition of service with minimal disruption to UNICEF or End Users.
Page 23 of 23