Contract Management

Contract Provisions- Required by Policy

Legal review of contract (prior to executing) required for:

·        Operationally critical third parties,

·        Foreign based third parties,

·        Contracts >$100,000, or

·        Any complex contract at the discretion of the business unit.

*agreement with foreign based 3^rd party may be subject to interpretation of foreign courts relying on local laws and may deal with enforcement of contracts differently

Confidentiality Agreement (includes NDA and important NPPI provisions)

·        This can be incorporated into the contract or be the standalone Confidentiality Agreement document available in Sharepoint:

Monitoring and performance standards (Service Level Agreement or SLA) establishing service expectations and metrics and remedies or penalties if not met.

Process to respond to a security or cybersecurity incident and breaches in data security including notification requirements amongst the parties, regulators, and law enforcement

Indemnification to hold Bank harmless for any claims/liability resulting from vendor negligence

Contract Provisions- Recommended

Confidentiality, security of information and encryption requirements

Nature and scope of arrangements/service:

·        Rights of each party,

·        Responsibilities of each party,

·        Timeframe of relationship (term),

·        Product/service(s) being contracted for,

·        Training to be provided to bank employees,

·        Support to be provided,

·        Customer Service included

Responsibilities for providing and receiving information required to conduct business and use of that information

Ownership and license:

·        Ability and circumstances under which service provider may use property inclusive of data, hardware, software and intellectual property,

·        Ownership of any information generated by vendor,

·        *Ability to access source code and programs under certain circumstances * (if applicable)

Cost and compensation:

·        Description of how fees calculated and which party responsible for any fees for non-recurring items or special requests including:

·        Legal, audit or examination fees,

·        Expense related to purchasing and maintaining equipment, hardware or software

Business resumption and contingency plan of vendor in the event of operation failures including:

·        Responsibility for backing up information,

·        Requirement to have and to maintain disaster recovery and contingency plans,

·        Responsibility for testing plans and providing testing results,

·        Remedies if miss recovery standard,

·        *Right to participate in BCP testing and/or be provided with a copy of testing results*

Notification and Bank approval of changes to service/product

Type and frequency of due diligence or other reports to be provided to the bank (i.e. usage, SOC, regulatory, audit, financials, BCP)

Limits on liability (typically limited by vendor to 1 year of fees paid) review to determine if any limitation is reasonable compared to amount of potential loss

Insurance (liability, cybersecurity insurance etc.)

Dispute resolution including:

·        Choice of governing law [both domestic (state) and international (if foreign based service provider)],

·        Dispute resolution process (arbitration, mediation, etc),

·        Continuation of arrangement between parties during resolution process period

Compliance with laws, regulations and regulatory requirements including:

·        Privacy laws and regulations relating to NPPI (nonpublic personal information) including state (MA General Law 201 CRM 17.00) and GLBA

·        Subjection to regulatory examination oversight (will allow regulatory agencies to review vendor documents)

Default and termination in the event 3^rd party: violates law, fails to meet performance standards, fails to provide required notices, increases cost substantially or experiences bankruptcy, insolvency, closure, acquisition and merger.  Should also address:

·        Notification requirements for 3^rd party violations,

·        List of acceptable remedies and opportunities for curing,

·        Preservation and timely return of data, records and other resources.

Record maintenance (example- software, something is broken need to notify)

Terms relating to use of bank premises, equipment or employees (if applicable)

Subcontracting and multiple service provider relationships requirements including:

·        Permissibility/prohibition of 3^rd party to subcontract or use another party to meet its obligations with regard to the contract and any notice/approval requirements

·        Clearly stating that vendor has accountability for all service it and its subcontractors provide,

·        Define services that may be subcontracted

·        For critical vendors, vendor's due diligence process for engaging and monitoring subcontractors to include assessment of financial condition,

·        Any limitations on subcontracting such as prohibition from certain data or services being located or handled outside of US

Controls at vendor are tested and audited independently if applicable to service or due diligence requirements (examples- independent audit for annual Service Organization Control Report- SOC, internal testing or independent model validation)

The right to audit (by bank or bank's representatives) and to require remediation based on results

Identification of which party responsible for delivery customer statements or disclosures

Customer complaints received by 3^rd party (who handles Bank or 3^rd party) and associated notice or reporting requirements

Internal controls will be maintained sufficient to reasonably ensure ability to perform services and to meet requirements (example- internal controls over financial reporting)

Confidentiality , security of information and encryption requirements

Monitoring and performance standards (Service Level Agreement or SLA) establishing service expectations, metrics by which service will be measured and remedies or penalties if agreed upon service levels not met.

Nature and scope of arrangements/service:

·         Rights of each party,

·         Responsibilities of each party,

·         Timeframe of relationship (term),

·         Product/service(s) being contracted for,

·         Training to be provided to bank employees,

·         Support to be provided,

·         Customer Service included

Responsibilities for providing and receiving information required to conduct business and use of that information

Ownership and license:

·         Ability and circumstances under which service provider may use property inclusive of data, hardware, software and intellectual property,

·         Ownership of any information generated by vendor,

·         *Ability to access source code and programs under certain circumstances *

Cost and compensation- description of how fees calculated and which party responsible for any fees for non-recurring items or special requests including:

·         Legal, audit or examination fees,

·         Expense related to purchasing and maintaining equipment, hardware or software

Business resumption and contingency plan of vendor in the event of operation failures including:

·         Responsibility for backing up information,

·         Requirement to have and to maintain disaster recovery and contingency plans,

·         Responsibility for testing plans and providing testing results,

·         Remedies if miss recovery standard,

·         *Right to participate in BCP testing and/or be provided with a copy of testing results*

Notification and Bank approval of changes to service/product

Type and frequency of due diligence or other reports to be provided to the bank (i.e. production, QA, usage, SOC, regulatory, audit, financial, BCP and testing and results)

Indemnification to hold Bank harmless for any claims/liability resulting from vendor negligence

Limits on liability review to determine if any proposed damage limitation is reasonable compared to amount of potential loss

Insurance (liability, cybersecurity insurance etc.)

Dispute resolution including:

·         Choice of governing law [both domestic (state) and international (if foreign based service provider)],

·         Dispute resolution process,

·         Continuation of arrangement between parties during resolution process period

Compliance with laws, regulations and regulatory requirements including:

·         Privacy laws and regulations relating to NPPI (nonpublic personal information) including state (MA General Law 201 CRM 17.00) and GLBA

·         Subjection to regulatory examination oversight (will allow regulatory agencies to review vendor documents)

Process to respond to a security or cybersecurity incident and breaches in data security including notification requirements amongst the parties, regulators and law enforcement and continuation of service

Default and termination in the event 3^rd party: violates law, fails to meet performance standards, fails to provide required notices, increases cost substantially or experiences bankruptcy, insolvency, closure, acquisition and merger.  Should also address:

·         Notification requirements for 3^rd party violations

·         List of acceptable remedies and opportunities for curing,

·         3^rd party's preservation and timely return of data, records and other resources,

Record maintenance (i.e. software, something is broken need to notify)

Terms relating to use of bank premises, equipment or employees (if applicable)

Notifications of subcontracting and multiple service provider relationships including:

·         Clearly stating that vendor has accountability for all service it and its subcontractors provide,

·         Define services that may be subcontracted, vendor's due diligence process for engaging and monitoring subcontractors to include assessment of financial condition,

Any limitations on subcontracting such as prohibition from certain data or services being located or handled outside of US

Permissibility/prohibition of 3^rd party to subcontract or use another party to meet its obligations with regard to the contract and any notice/approval requirements

Controls at vendor are tested and audited independently

The right to audit and to require remediation (by bank or bank's representatives)

Identification of which party responsible for delivery customer statements or disclosures

Customer complaints received by 3^rd party ( who handles Bank or 3^rd party) and associated notice or reporting requirements

Internal controls required of vendor (not previously addressed)