Common use of NONDISCLOSURE AND DATA SECURITY AGREEMENT Clause in Contracts

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial Consultants, Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DES-SLA-721 (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DES-SLA-721 (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsSpark Business Academy, Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160v (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxx Xxxxxx Xxxxxxx CEO 11/24/2023 Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160v (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsFish and Explore, Inc. (“ContractorLLC(“Contractor”), xxxxxx hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160s (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxx Xxxxxx Director Date: 11/27/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160s (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial Consultants, Stantec Consulting Se_rvices Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230j (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Da_vid Xxxxx Senior Vice President, Raftelis 6/18/2024 Transportation Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230j (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxxx Xxxxx 7/19/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation 0000 Xxxxxxxxxx Xxxxxxxxx, Xxxxxxxxx, XX 00000 June 15, 2023 Procurement Officer Arlington County Government, Dept. of Management and Finance 0000 Xxxxxxxxx Xxxxxxxxx, Xxxxx 000 Arlington, VA 22201 xxxxxxxxx@xxxxxxxxxxx.xx Dear Xx Xxxxxxxx, Thank you for the opportunity to present a Best and Final Evaluation Scope Offer (BAFO) to the Selection Advisory Committee of Work/Arlington County for the Arlington County Energy Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate contract, 23-DES-RFP-230. As requested, we are providing our BAFO on hourly rates for the effectiveness contract positions. As we illustrated in our proposal dated October 17, 2022, we are extremely qualified to perform the services identified in the Request for Proposals (RFP) and are local to your projects. Given our long-standing relationship with Arlington County, we are pleased to offer you a volume discount on the contract. If, in any given contract year, we are awarded more than $2,999,999 worth of work, we can offer Arlington County a 5% discount on work for the remainder of that contract year, from the 3,000,000th dollar to the completion of the Contractor’s performance on contract year. Please see our rates attached to this letter. Thank you for the Contract/Project across opportunity to submit a BAFO. We look forward to continuing our relationship with Arlington County and look forward to working with you. Please do not hesitate to contact us with any questions. Regards, Senior Vice President Senior Principal Transportation Program Director Phone: 000-000-0000 Phone: 000-000-0000 xxxxx.xxxxx@xxxxxxx.xxx xxxx.xxxxxxxx@xxxxxxx.xxx The tables below set out the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments fully loaded hourly rates proposed for work to explain assigned ratings are required be performed under this contract. We have defined 12 rate levels that cover the full range of expertise and seniority needed to execute the scope of work. Table 2 identifies the specific rate level and rate that apply to each expert identified by name in this proposal. On larger and more complex task orders, the Stantec team proposes to include support staff that will make the consulting services we provide to the County more cost- effective. The support staff, which will be identified during task order proposal preparation, will fit into the lower rate levels in Table 1 below. Stantec reserves the right to negotiate escalated rates in future years of the contract to account for any performance ratings below “satisfactory” or an “excellent” in any categoryinflation, should our contract by extended beyond one year.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsConduent State & Local Solutions, Inc. Inc., (“Contractor”), xxxxxx hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24647-DES-SLA-721 15 (the “Project” or “Main Agreement”) or that may be accessed through other County-County- owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. penalties (e.g., the Government Data Collection and Dissemination Practices Act, formerly called the Privacy Protection Act, Va. Code§ 2.2-3800 et seq., and the Secrecy of Information Act, Va. Code§ 58.1-3, which may be punishable by a jail sentence of up to six months and/or a fine of up to $1,000.00.) Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted both in transit and at rest; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, security and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and or running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-County- approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors subcontractors, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates, shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors subcontractors, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates, are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ ICurrent Software 1 Future Software 1 Handhelds 2 Printers 2 Hardware Configuration & Delivery 3 System Testing, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DES-SLA-721 (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.Training & Acceptance 3

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsXxxx Xxxxxxx Consulting Engineers, Inc. P (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230d (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxx Xxxxxxxxxxx 7/18/2023 Corporate Secretary Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230d (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Xxxxx Xxxxxxxxxxx 7/18/2023 Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor NameDocuSign Envelope ID: Contract NoF029B337-9709-4A9A-87AB-D1B3267E2FFD Tuesday, June 20, 2023 Sy Gezachew, VCCO, VCO/A Procurement Officer Arlington County Government Department of Management and Finance 0000 Xxxxxxxxx Xxxx.: Date: Project/Contract Name: Interim Evaluation , Xxxxx 000 Arlington, VA 22201 Dear Xx, Thank you for the opportunity to submit a Best and Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across Offer (BAFO) for the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required services for any performance ratings below “satisfactory” or an “excellent” in any categorythe above referenced RFP.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsXxxxxxx Camps, Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160r (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxx Xxxxxxx President Date: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160r (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial Consultants, Inc. Patriot Girls Basketball Camp (“Contractor”), xxxxxx hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160u (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxx X Xxxxx Director Date: 11/28/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160u (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial Consultants, Inc. Tennis Central Corp. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160w (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxx Xxxxxx CEO Date: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160w (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsArlington Soccer Association, Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160q (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxxxx Xxxxxx Director of Operations Date: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160q (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsEastern Research Group, Inc. (“Contractor”), xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230f (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice Xxxxx Xxxxxx President, Raftelis 6/18/2024 /CEO 7/19/2023 Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 2423-DES-SLA-721 RFP-230f (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxxx Xxxxxx 7/19/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness Eastern Research Group, Inc. June 15, 2023 Mr. Sy Gezachew, County Purchasing Agent Arlington County Office of the Contractor’s performance Purchasing Agent 0000 Xxxxxxxxx Xxxxxxxxx, Xxxxx 000 Arlington, VA 22201 xxxxxxxxx@xxxxxxxxxxx.xx Dear Mr. Gezachew, Eastern Research Group, Inc. (ERG) is pleased to submit its best and final offer (BAFO) for hourly rates associated with RFP No. 23-DES-RFP-230 - Energy Services. We have updated our proposed hourly rates consistent with our current calendar year 2023 rates, and are offering a 2% discount on all staff. If you have any remaining questions or needs concerning our proposal or enclosed BAFO for hourly rates, please contact one of the Contract/individuals listed below. Offeror Name and Address Eastern Research Group, Inc. 0000 Xxxxxx Xxxxxxxxx, Unit 350 Arlington, VA 22201 UEI DK4TBEJRAR56 Title Project across Director Senior Contract Administrator Telephone Number 000-000-0000 000-000-0000 Email xxxx.xxxxxxx@xxx.xxx xxxxxx.xxxxxx@xxx.xxx ERG looks forward to the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments opportunity to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.provide Arlington County the highest quality of support under this procurement. Sincerely, Xxxxx Xxxxxxx, Vice President Eastern Research Group, Inc.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsOrange Line Sports, Inc. LLC (“Contractor”), xxxxxx hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160t (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxxx Xxxx Owner 11/21/2023 Date: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160t (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of Raftelis Financial ConsultantsThe Fencers Club, Inc. (“ContractorLLC dba Nova Fencing & Archery Club(“Contractor”), xxxxxx hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP-160x (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Vice President, Raftelis 6/18/2024 Xxxxxxx Xxxxxxxx Owner/Head Coach Date: 11/30/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DESDPR-SLA-721 RFP- 160x (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category.